unkinben
3d59758324
ci/woodpecker/push/apply Pipeline was canceled
Split plugin catalog registration out of the per-engine backend modules into its own concern (previously bundled into #87's gpg_secret_backend). ## Changes - New generic `plugin` module (`vault_plugin`: type/name/command/sha256/plugin_version) that imports a binary into the catalog. - New `config/plugins/` discovery group (filename = catalog name = mount type), wired through `vault_cluster` (`plugins` variable + module) and the syd1 environment. - `config/plugins/vault-plugin-secrets-gpg.yaml` pins the released v0.1.0 binary sha256 (`0e92d740…a7b20`, from the published RPM). Puppet installs the RPM floating, so bump this in lockstep on upgrade. Any engine now registers its plugin by dropping a file in `config/plugins/`; its `*_secret_backend` module just mounts the registered type. Needs the deployer's plugin-catalog access (#88). Merge order: **#88 → this → #87**. Reviewed-on: #89 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
11 lines
542 B
YAML
11 lines
542 B
YAML
# config/plugins/vault-plugin-secrets-gpg.yaml
|
|
# Imports (registers) the gpg secrets plugin in the catalog. Filename = catalog
|
|
# name = mount type. The binary is installed on the OpenBao nodes by Puppet
|
|
# (openbao-plugin-secrets-gpg RPM -> /opt/openbao-plugins/vault-plugin-secrets-gpg).
|
|
#
|
|
# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
|
|
# upgrade or OpenBao will refuse to launch the plugin.
|
|
type: secret
|
|
command: vault-plugin-secrets-gpg
|
|
sha256: "0e92d7408795688badb55789bc1604e8f1dd4d71998656c7f831991fce9a7b20"
|