Forge Home

Modules

Resources

PuppetEcosystemPuppet CommunityUpdates

vault

Puppet module to manage Vault (https://vaultproject.io)
Project URLRSS FeedReport issues

669,869 downloads

37,075 latest version

4.3 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 2.3.0 (latest)
  • 2.2.0
  • 2.1.0
  • 2.0.1
  • 2.0.0
  • 1.2.8
  • 1.2.7
  • 1.2.6
  • 1.2.5
  • 1.2.4
  • 1.2.3
  • 1.2.2
  • 1.2.1
  • 1.2.0
  • 1.1.9
  • 1.1.8
  • 1.1.7
  • 1.1.6
  • 1.1.5
  • 1.1.4
  • 1.1.3
  • 1.1.2
  • 1.1.1
  • 1.1.0
  • 1.0.0
  • 0.4.0
  • 0.3.0
  • 0.2.3
  • 0.2.2
  • 0.2.1
  • 0.2.0
  • 0.1.9
  • 0.1.8
  • 0.1.7
  • 0.1.6
  • 0.1.5
  • 0.1.4
  • 0.1.3 (deleted)
  • 0.1.2
  • 0.1.1
  • 0.1.0
released Dec 6th 2016
This version is compatible with:
  • Puppet Enterprise >= 3.2.0 < 3.4.0
  • Puppet >= 3.0.0 < 5.0.0
  • , , ,
This module has been deprecated by its author since Mar 2nd 2023.

The author has suggested puppet-vault as its replacement.

Start using this module

Tags: secrets, hashicorp, vault

Documentation

jsok/vault — version 1.1.4 Dec 6th 2016

Puppet Forge Build Status

puppet-vault

Puppet module to install and run Hashicorp Vault.

Installs v0.6.3 Linux AMD64 binary from the Hashicorp releases CDN by default.

Support

This module is currently only tested on:

  • Ubuntu 14.04.
  • CentOS/RedHat 6
  • CentOS/RedHat 7

Usage

include vault

By default, with no parameters the module will configure vault with some sensible defaults to get you running, the following parameters may be specified to configure Vault. Please see The official documentation for further details of acceptable parameter values.

Parameters

Setup parameters

  • user: Customise the user vault runs as, will also create the user unless manage_user is false.

  • manage_user: Whether or not the module should create the user.

  • group: Customise the group vault runs as, will also create the user unless manage_group is false.

  • manage_group: Whether or not the module should create the group.

  • bin_dir: Directory the vault executable will be installed in.

  • config_dir: Directory the vault configuration will be kept in.

  • purge_config_dir: Whether the config_dir should be purged before installing the generated config.

  • install method: Supports the values repo or archive. See Installation parameters.

  • service_name: Customise the name of the system service

  • service_provider: Customise the name of the system service provider; this also controls the init configuration files that are installed.

  • service_options: Extra argument to pass to vault server, as per: vault server --help

  • num_procs: Sets the GOMAXPROCS environment variable, to determine how many CPUs Vault can use. The official Vault Terraform install.sh script sets this to the output of nprocs, with the comment, "Make sure to use all our CPUs, because Vault can block a scheduler thread". Default: number of CPUs on the system, retrieved from the processorcount fact.

  • manage_backend_dir: When using the file backend, this boolean determines whether or not the path (as specified in the ['file']['path'] section of the backend config) is created, and the owner and group set to the vault user. Default: false

Installation parameters

When install_method is repo

When repo is set the module will attempt to install a package corresponding with the value of package_name.

  • package_name: Name of the package to install, default: vault
  • package_ensure: Desired state of the package, default: installed
  • bin_dir: Set to the path where the package will install the Vault binary, this is necessary to correctly manage the disable_mlock option.

When install_method is archive

When archive the module will attempt to download and extract a zip file from the download_url, the extracted file will be placed in the bin_dir folder.

  • download_url: URL to download the vault zip distribution from. You can specify a local file on the server with a fully qualified pathname, or use http, https, ftp or s3 based URI's.
  • download_dir: Path to download the zip file to, default: /tmp
  • manage_download_dir: Boolean, whether or not to create the download directory, default: false
  • download_filename: Filename to (temporarily) save the downloaded zip file, default: vault.zip

Configuration parameters

By default, with no parameters the module will configure vault with some sensible defaults to get you running, the following parameters may be specified to configure Vault. Please see The official documentation for further details of acceptable parameter values.

  • backend: A hash containing the Vault backend configuration, default:
{ 'file' => { 'path' => '/var/lib/vault' }}
  • listener: A hash containing the listeniner configuration, default:
{
   'tcp' => {
      'address' => '127.0.0.1:8200',
      'tls_disable' => 1,
    }
}

  • ha_backend: An optional hash containing the ha_backend configuration

  • telemetry: An optional hash containing the telemetry configuration

  • disable_cache: A boolean to disable or enable the cache (default: undefined)

  • disable_mlock: A boolean to disable or enable mlock See below (default: undefined)

  • default_lease_ttl: A string containing the default lease TTL (default: undefined)

  • max_lease_ttl: A string containing the max lease TTL (default: undefined)

  • extra_config: A hash containing extra configuration, intended for newly released configuration not yet supported by the module. This hash will get merged with other configuration attributes into the JSON config file.

Examples

class { '::vault':
  backend => {
    'file' => {
      'path' => '/tmp',
    }
  },
  listener => {
    'tcp' => {
      'address' => '127.0.0.1:8200',
      'tls_disable' => 0,
    }
  }
}

or alternatively using Hiera:

---
vault::backend:
  file:
    path: /tmp

vault::listener
  tcp:
    address: 127.0.0.1:8200
    tls_disable: 0

vault::default_lease_ttl: 720h

mlock

By default vault will use the mlock system call, therefore the executable will need the corresponding capability.

In production, you should only consider setting the disable_mlock option on Linux systems that only use encrypted swap or do not use swap at all.

The module will use setcap on the vault binary to enable this. If you do not wish to use mlock, set the disable_mlock attribute to true

class { '::vault':
  disable_mlock => true
}

Testing

First, bundle install

To run RSpec unit tests: bundle exec rake spec

To run RSpec unit tests, puppet-lint, syntax checks and metadata lint: bundle exec rake test

To run Beaker acceptance tests: BEAKER_set=<nodeset name> bundle exec rake acceptance where <nodeset name> is one of the filenames in spec/acceptance/nodesets without the trailing .yml, specifically one of:

  • ubuntu-14.04-x86_64-docker
  • centos-6-x86_64-docker
  • centos-7-x86_64-docker

Related Projects

  • hiera-vault: A Hiera backend to retrieve secrets from Hashicorp's Vault