unkinben
dcc73131a4
ci/woodpecker/push/apply Pipeline was successful
## Why v0.1.0 of the rancher plugin minted non-functional tokens — it returned `status.value` (the secret fragment) instead of `status.bearerToken` (`ext/<name>:<secret>`), so every cred and every root rotation 401'd against Rancher. Fixed in plugin v0.1.1 (PR #2, released). ## Changes - `config/plugins/vault-plugin-secrets-rancher.yaml` sha256 → v0.1.1 binary `9e597cd9…d5955` (verified against both v0.1.1 RPMs). Re-registers the catalog entry so OpenBao launches the fixed binary. ## Deploy coordination 1. Puppet installs the v0.1.1 RPM on the vault nodes (separate puppet-prod PR). 2. Merge this → apply re-registers the catalog with the new sha. 3. `vault plugin reload -plugin=vault-plugin-secrets-rancher` so the running plugin swaps to v0.1.1 (its sha must match this catalog entry). --------- Co-authored-by: Ben Vincent <neotheo@gmail.com> Reviewed-on: #96 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
12 lines
564 B
YAML
12 lines
564 B
YAML
# config/plugins/vault-plugin-secrets-rancher.yaml
|
|
# Imports (registers) the rancher secrets plugin in the catalog. Filename =
|
|
# catalog name = mount type. The binary is installed on the OpenBao nodes by
|
|
# Puppet (openbao-plugin-secrets-rancher RPM ->
|
|
# /opt/openbao-plugins/vault-plugin-secrets-rancher).
|
|
#
|
|
# sha256 pins the released v0.1.1 binary; bump it in lockstep with any RPM
|
|
# upgrade or OpenBao will refuse to launch the plugin.
|
|
type: secret
|
|
command: vault-plugin-secrets-rancher
|
|
sha256: "9e597cd9512a0629f940141dc6611bf95eaf165abcb52470eee027bf467d5955"
|