hashicorp-vault cookbook

Install and configure Hashicorp Vault in server and agent mode.

Version 5.0.0 constitutes a major change and rewrite, please see UPGRADING.md.

Maintainers

This cookbook is maintained by the Sous Chefs. The Sous Chefs are a community of Chef cookbook maintainers working together to maintain important cookbooks. If you’d like to know more please visit sous-chefs.org or come chat with us on the Chef Community Slack in #sous-chefs.

Platforms

The following platforms have been certified with integration tests using Test Kitchen:

• Debian/Ubuntu
• RHEL/CentOS and derivatives
• Fedora and derivatives

Requirements

• Chef 14+
• ark Community Cookbook (https://supermarket.chef.io/cookbooks/ark)

Usage

It is recommended to create a project or organization specific wrapper cookbook and add the desired custom resources to the run list of a node. Depending on your environment, you may have multiple roles that use different recipes from this cookbook. Adjust any attributes as desired.

Example of a basic server configuration using Hashicorp HCL for configuration

hashicorp_vault_install 'package' do
  action :upgrade
end

hashicorp_vault_config_global 'vault' do
  sensitive false
  telemetry(
    statsite_address: '127.0.0.1:8125',
    disable_hostname: true
  )

  notifies :restart, 'hashicorp_vault_service[vault]', :delayed

  action :create
end

hashicorp_vault_config_listener 'tcp' do
  options(
    'address' => '127.0.0.1:8200',
    'cluster_address' => '127.0.0.1:8201',
    'tls_cert_file' => '/opt/vault/tls/tls.crt',
    'tls_key_file' => '/opt/vault/tls/tls.key',
    'telemetry' => {
      'unauthenticated_metrics_access' => false,
    }
  )

  notifies :restart, 'hashicorp_vault_service[vault]', :delayed
end

hashicorp_vault_config_storage 'Test file storage' do
  type 'file'
  options(
    'path' => '/opt/vault/data'
  )

  notifies :restart, 'hashicorp_vault_service[vault]', :delayed
end

hashicorp_vault_service 'vault' do
  action %i(create enable start)
end

External Documentation

• https://www.vaultproject.io/docs/configuration
• https://www.vaultproject.io/docs/agent

Resources

• hashicorp_vault_config_auto_auth
• hashicorp_vault_config_entropy
• hashicorp_vault_config_global
• hashicorp_vault_config_listener
• hashicorp_vault_config_seal
• hashicorp_vault_config_service_registration
• hashicorp_vault_config_storage
• hashicorp_vault_config_template
• hashicorp_vault_config
• hashicorp_vault_install
• hashicorp_vault_service

Contributors

This project exists thanks to all the people who contribute.

Backers

Thank you to all our backers!

Sponsors

Support this project by becoming a sponsor. Your logo will show up here with a link to your website.