unkin-agent
df0510e33b
ci/woodpecker/push/apply Pipeline failed
## Why Splits the arrstack Vault engine work (was #124) into three independently-appliable PRs so registration, policy, and engine resources are never bundled. This is **PR 1 of 3 (register)**. ## Change - Registers the `vault-plugin-secrets-arrstack` plugin (v0.1.0) in the OpenBao plugin catalog via `config/plugins/vault-plugin-secrets-arrstack.yaml`. - `sha256` pins the released v0.1.0 binary. - No wiring changes needed: the `plugins` glob and `module.plugin` already exist on `master`. ## Apply order Apply this **after** the Puppet plugin-install PR (unkin/puppet-prod #521, merged) has placed the binary at `/opt/openbao-plugins/vault-plugin-secrets-arrstack` on the OpenBao nodes. Registration fails until the binary is present on-node. ## Stack 1. **register (this PR)** -> `benvin/arrstack-register` off `master` 2. policy -> `benvin/arrstack-policy` 3. resources -> `benvin/arrstack-resources` Supersedes #124. Reviewed-on: #125 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
14 lines
673 B
YAML
14 lines
673 B
YAML
# config/plugins/vault-plugin-secrets-arrstack.yaml
|
|
# Imports (registers) the arrstack secrets plugin in the catalog. Filename =
|
|
# catalog name = mount type. The binary is installed on the OpenBao nodes by
|
|
# Puppet (openbao-plugin-secrets-arrstack RPM ->
|
|
# /opt/openbao-plugins/vault-plugin-secrets-arrstack).
|
|
#
|
|
# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
|
|
# upgrade or OpenBao will refuse to launch the plugin. Registration only
|
|
# succeeds once the Puppet PR has installed the binary on the nodes.
|
|
type: secret
|
|
command: vault-plugin-secrets-arrstack
|
|
version: "0.1.0"
|
|
sha256: "f8ee60ca7ba14819976acb7dc4cfb6799e3e8da8f871d0bb2bd18d1d9e537972"
|