unkinben
d080279728
ci/woodpecker/push/apply Pipeline was successful
## Why - The netbox secrets engine cannot be mounted until its plugin binary is registered in the OpenBao catalog, so the catalog entry must land before any engine mount or role config references it. ## How - Add `config/plugins/vault-plugin-secrets-netbox.yaml` registering the plugin as a secret plugin, pinned to the released v0.1.0 binary sha256 that Puppet installs on the OpenBao nodes. Bump the sha in lockstep with any RPM upgrade. ## Dependency order - First of three stacked PRs: this plugin registration, then the netbox modules + wiring (#115), then the netbox backend + terraform-infra role (#117). Merges to master independently. Reviewed-on: #118 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
12 lines
559 B
YAML
12 lines
559 B
YAML
# config/plugins/vault-plugin-secrets-netbox.yaml
|
|
# Imports (registers) the netbox secrets plugin in the catalog. Filename =
|
|
# catalog name = mount type. The binary is installed on the OpenBao nodes by
|
|
# Puppet (openbao-plugin-secrets-netbox RPM ->
|
|
# /opt/openbao-plugins/vault-plugin-secrets-netbox).
|
|
#
|
|
# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
|
|
# upgrade or OpenBao will refuse to launch the plugin.
|
|
type: secret
|
|
command: vault-plugin-secrets-netbox
|
|
sha256: "362b7f6c9e21179ad51d2d810684d9387fe50e3a1887f171700122a0b2a05cef"
|