Ansible role vault

Install Hashicorp Vault, either a package or a binary.

GitHub	GitLab	Downloads	Version

Example Playbook

This example is taken from molecule/default/converge.yml and is tested on each push, pull request and release.

---
- name: Converge
  hosts: all
  become: yes
  gather_facts: yes

  roles:
    - role: robertdebock.vault

The machine needs to be prepared. In CI this is done using molecule/default/prepare.yml:

---
- name: Prepare
  hosts: all
  become: yes
  gather_facts: no

  roles:
    - role: robertdebock.bootstrap
    - role: robertdebock.core_dependencies
    - role: robertdebock.hashicorp

Also see a full explanation and example on how to use these roles.

Role Variables

The default values for the variables are set in defaults/main.yml:

---
# defaults file for vault

# Select the type of Vault to install. Either "oss", "ent" or "hsm".
# `oss` means Open Source.
# `ent` means Enterprise.
# `hsm` means Enterprise with HSM support.
vault_type: oss

# Set the version of the package to install.
vault_version: "1.15.2"

# For package installations, a "release" is required. The package would for example be called `vault-1.12.2-1`.
vault_package_release: "1"

# Select the way to intall Vault. Either "package" or "binary".
vault_installation_method: "package"

# When `vault_installation_method` is set to "binary", set the path where to (temporarily) download Vault.
vault_download_path: "/tmp/vault-{{ vault_version }}"

# When `vault_installation_method` is set to "binary", set the (base) path where to install Vault. This can be "" or "/opt" for example.
vault_path: ""

# When `vault_installation_method` is set to "binary", set the user Vault will run under. The user "root" is not allowed.
vault_user: vault

# When `vault_installation_method` is set to "binary", set the group Vault will run under. The group "root" is not allowed.
vault_group: vault

# When `vault_installation_method` is set to "binary", set the shell for the vault_user.
vault_user_shell: /bin/false

# Where to store data. That's Raft data and TLS material.
vault_data_directory: /opt/vault