Skip to content

This role creates a hashicorp vault cluster secured by another vault.

Notifications You must be signed in to change notification settings

tibeer/hashicorp-vault-cluster-role

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

hashicorp-vault-cluster-role

This role creates for you a hashicorp vault cluster secured/unsealed by another vault. It is not (yet) idempotent!

Requirements

  • You need to have installed
    • docker.io
    • python3-docker
    • apt-transport-https
  • Four instances
    • One for the cluster unsealer
    • Three for the cluster

Role Variables

Watch out for the true values. They need to be strings, otherwise Jinja2 will template them to True, which is invalid in HCL.

Variable Default value  Usage
unsealer_host_group_name "unsealer" Inventory group name for the unsealer node
cluster_hosts_group_name "cluster" Inventory group name for the cluster nodes
vault_docker_registry "index.docker.io" Registry from where to pull the docker image
vault_docker_tag "latest" Tag of the docker image version
vault_docker_image "{{ vault_docker_registry }}/hashicorp/vault:{{ vault_docker_tag }}" Docker image to use
vault_unsealer_policy_name "autounseal" Name of policy in unsealer vault
vault_unsealer_policy_path "/tmp/{{ vault_unsealer_policy_name }}.hcl" Policy file location
vault_unsealer_host "{{ ansible_default_ipv4.address }}" Unsealer node address
vault_unsealer_storage_path "/home/ubuntu/vault-data" Data storage location
vault_unsealer_config_path "/home/ubuntu/config.hcl" Config file location
vault_unsealer_port 8200 Port number of the vault node for external communication
vault_unsealer_cluster_port "{{ vault_unsealer_port + 1 }}" Port number of the vault node for internal communication
vault_unsealer_default_lease_ttl "168h" Default TTL for secrets; in this case seven days
vault_unsealer_max_lease_ttl "720h" Maximum TTL for secrets; in this case 30 days
vault_unsealer_tls_disable "true" If the external communication should be secured by TLS
vault_unsealer_enable_ui "true" Enable (or disable) the included UI
vault_cluster_host "{{ ansible_default_ipv4.address }}" Cluster node address
vault_cluster_storage_path "/home/ubuntu/vault-data" Config file location
vault_cluster_config_path "/home/ubuntu/config.hcl" Policy file location
vault_cluster_port 8200 Port number of the vault node for external communication
vault_cluster_cluster_port "{{ vault_cluster_port + 1 }}" Port number of the vault node for internal communication
vault_cluster_default_lease_ttl "168h" Default TTL for secrets; in this case seven days
vault_cluster_max_lease_ttl "720h" Maximum TTL for secrets; in this case 30 days
vault_cluster_tls_disable "true" If the external communication should be secured by TLS
vault_cluster_enable_ui "true" Enable (or disable) the included UI

Dependencies

None.

Example Playbook

Below you'll find an example playbook. This role requires you to have the unsealer and the cluster in two different inventory groups. Based on the groups the cluster connections will be established.

- name: Setup vault cluster
  hosts: all
  pre_tasks:
    - name: install requirements
      ansible.builtin.apt:
        name:
          - apt-transport-https
          - docker.io
          - python3-docker 
      become: true
  roles:
    - name: vault cluster setup role
      role: hashicorp-vault-cluster-role
      vars:
        unsealer_host_group_name: "unsealer"
        cluster_hosts_group_name: "cluster"
        vault_unsealer_port: 8202  # trick to only use three VMs

Example inventory:

[unsealer]
10.0.0.10

[cluster]
10.0.0.10
10.0.0.11
10.0.0.12

License

BSD

About

This role creates a hashicorp vault cluster secured by another vault.

Topics

Resources

Stars

Watchers

Forks

Packages

No packages published

Languages