unkin-agent
cc298526e9
ci/woodpecker/push/apply Pipeline was successful
Plugin-backed mounts keep their pinned `plugin_version` when a catalog yaml bumps `version`, so the old catalog entry is deregistered while the mount still points at it and the backend fails to start on the next leader change. - add `mount_plugin_version` module tuning `sys/mounts/<path>/tune` to the catalog yaml version for each plugin-backed mount - register new plugin versions before deregistering old ones (`create_before_destroy`) - document the post-bump backend reload in the arrstack plugin yaml - document that a versioned plugin yaml must keep `version` (removing it strands the mount on the old version) Reviewed-on: #171 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
20 lines
918 B
YAML
20 lines
918 B
YAML
# config/plugins/vault-plugin-secrets-arrstack.yaml
|
|
# Imports (registers) the arrstack secrets plugin in the catalog. Filename =
|
|
# catalog name = mount type. The binary is installed on the OpenBao nodes by
|
|
# Puppet (openbao-plugin-secrets-arrstack RPM ->
|
|
# /opt/openbao-plugins/vault-plugin-secrets-arrstack).
|
|
#
|
|
# sha256 pins the released v0.2.0 binary; bump it in lockstep with any RPM
|
|
# upgrade or OpenBao will refuse to launch the plugin. Registration only
|
|
# succeeds once the Puppet PR has installed the binary on the nodes.
|
|
#
|
|
# Terraform retunes mounts onto a bumped version; after apply, run
|
|
# `bao write sys/plugins/reload/backend mounts=arrstack scope=global`.
|
|
#
|
|
# Once versioned, keep `version` set: dropping it leaves the mount pinned to a
|
|
# deregistered version.
|
|
type: secret
|
|
command: vault-plugin-secrets-arrstack
|
|
version: "0.2.0"
|
|
sha256: "9ea7f16013b3bcbadfcb15b08fd1545f8069893cf864bfdaa57e7e7e72612fa1"
|