unkinben
0287a87db7
Registering a plugin in the catalog is a distinct concern from mounting an engine, so give it its own module and config directory instead of folding sha256/command into each engine's backend module. - Add a generic 'plugin' module (vault_plugin: type/name/command/sha256/ plugin_version) that imports a binary into the catalog. - Add a config/plugins/ discovery group (filename = catalog name) and wire it through vault_cluster (plugins variable + module) and the syd1 environment. - Add config/plugins/vault-plugin-secrets-gpg.yaml pinning the released v0.1.0 binary sha256. Other engines can now register their plugin by dropping a file here; their *_secret_backend module just mounts the registered type.
11 lines
542 B
YAML
11 lines
542 B
YAML
# config/plugins/vault-plugin-secrets-gpg.yaml
|
|
# Imports (registers) the gpg secrets plugin in the catalog. Filename = catalog
|
|
# name = mount type. The binary is installed on the OpenBao nodes by Puppet
|
|
# (openbao-plugin-secrets-gpg RPM -> /opt/openbao-plugins/vault-plugin-secrets-gpg).
|
|
#
|
|
# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
|
|
# upgrade or OpenBao will refuse to launch the plugin.
|
|
type: secret
|
|
command: vault-plugin-secrets-gpg
|
|
sha256: "0e92d7408795688badb55789bc1604e8f1dd4d71998656c7f831991fce9a7b20"
|