unkinben
3d59758324
ci/woodpecker/push/apply Pipeline was canceled
Split plugin catalog registration out of the per-engine backend modules into its own concern (previously bundled into #87's gpg_secret_backend). ## Changes - New generic `plugin` module (`vault_plugin`: type/name/command/sha256/plugin_version) that imports a binary into the catalog. - New `config/plugins/` discovery group (filename = catalog name = mount type), wired through `vault_cluster` (`plugins` variable + module) and the syd1 environment. - `config/plugins/vault-plugin-secrets-gpg.yaml` pins the released v0.1.0 binary sha256 (`0e92d740…a7b20`, from the published RPM). Puppet installs the RPM floating, so bump this in lockstep on upgrade. Any engine now registers its plugin by dropping a file in `config/plugins/`; its `*_secret_backend` module just mounts the registered type. Needs the deployer's plugin-catalog access (#88). Merge order: **#88 → this → #87**. Reviewed-on: #89 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
28 lines
723 B
Terraform
28 lines
723 B
Terraform
variable "name" {
|
|
description = "Name to register the plugin under in the catalog (also the mount type)"
|
|
type = string
|
|
}
|
|
|
|
variable "type" {
|
|
description = "Plugin type: secret, auth or database"
|
|
type = string
|
|
default = "secret"
|
|
}
|
|
|
|
variable "command" {
|
|
description = "Plugin binary filename relative to the server plugin_directory. Defaults to the plugin name."
|
|
type = string
|
|
default = null
|
|
}
|
|
|
|
variable "sha256" {
|
|
description = "SHA-256 of the installed plugin binary; must match the on-disk binary"
|
|
type = string
|
|
}
|
|
|
|
variable "plugin_version" {
|
|
description = "Optional plugin version to register the catalog entry under"
|
|
type = string
|
|
default = null
|
|
}
|