Forge Home

Modules

Resources

PuppetEcosystemPuppet CommunityUpdates

vault

Puppet module to manage Vault (https://vaultproject.io)
Project URLRSS FeedReport issues

670,595 downloads

37,133 latest version

5.0 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 2.3.0 (latest)
  • 2.2.0
  • 2.1.0
  • 2.0.1
  • 2.0.0
  • 1.2.8
  • 1.2.7
  • 1.2.6
  • 1.2.5
  • 1.2.4
  • 1.2.3
  • 1.2.2
  • 1.2.1
  • 1.2.0
  • 1.1.9
  • 1.1.8
  • 1.1.7
  • 1.1.6
  • 1.1.5
  • 1.1.4
  • 1.1.3
  • 1.1.2
  • 1.1.1
  • 1.1.0
  • 1.0.0
  • 0.4.0
  • 0.3.0
  • 0.2.3
  • 0.2.2
  • 0.2.1
  • 0.2.0
  • 0.1.9
  • 0.1.8
  • 0.1.7
  • 0.1.6
  • 0.1.5
  • 0.1.4
  • 0.1.3 (deleted)
  • 0.1.2
  • 0.1.1
  • 0.1.0
released Aug 26th 2016
This version is compatible with:
  • , , ,
This module has been deprecated by its author since Mar 2nd 2023.

The author has suggested puppet-vault as its replacement.

Start using this module

Tags: secrets, hashicorp, vault

Documentation

jsok/vault — version 0.4.0 Aug 26th 2016

Puppet Forge Build Status

puppet-vault

Puppet module to install and run Hashicorp Vault.

Installs v0.6.1 Linux AMD64 binary by default.

Support

This module is currently only tested on:

  • Ubuntu 14.04.
  • CentOS/RedHat 6
  • CentOS/RedHat 7

Usage

include vault

By default, vault requires a minimal configuration including a backend and a listener.

class { '::vault':
    config_hash => {
        'backend' => {
            'file' => {
                'path' => '/tmp',
            }
        },
            'listener' => {
                'tcp' => {
                    'address' => '127.0.0.1:8200',
                    'tls_disable' => 1,
                }
            }
    }
}

or alternatively using Hiera:

---
vault::config_hash:
    backend:
        file:
            path: /tmp
    listener:
        tcp:
            address: 127.0.0.1:8200
            tls_disable: 1

mlock

By default vault will use the mlock system call, therefore the executable will need the corresponding capability.

In production, you should only consider setting the disable_mlock option on Linux systems that only use encrypted swap or do not use swap at all.

The module will use setcap on the vault binary to enable this. If you do not wish to use mlock, modify your config_hash like:

class { '::vault':
    config_hash => {
        'disable_mlock' => true
    }
}

Testing

First, bundle install

To run RSpec unit tests: bundle exec rake spec

To run RSpec unit tests, puppet-lint, syntax checks and metadata lint: bundle exec rake test

To run Beaker acceptance tests: BEAKER_set=<nodeset name> bundle exec rake acceptance where <nodeset name> is one of the filenames in spec/acceptance/nodesets without the trailing .yml, specifically one of:

  • ubuntu-14.04-x86_64-docker
  • centos-6-x86_64-docker
  • centos-7-x86_64-docker