vaultlocker

Table of Contents

1. Description
2. Setup - The basics of getting started with vaultlocker
   • What vaultlocker affects
   • Beginning with vaultlocker
3. Usage - Configuration options and additional functionality
4. Limitations - OS compatibility, etc.
5. Development - Guide for contributing to the module

Description

This module will install and configure vaultlocker and its requirements (such as the cryptsetup utility).

Setup

What vaultlocker affects

By default, this module will attempt to install and manage Python using the https://forge.puppet.com/modules/puppet/python module and also install the cryptsetup package.

Beginning with vaultlocker

include vaultlocker

will install the vaultlocker tool and a default configuration file. The default configuration will not work as site-specific Vault configuration is necessary for Vault storage of encryption keys.

Usage

An example of passing in a working vaultlocker configuration:

class { 'vaultlocker':
  config => {
    'url'       => https://my-vault-server:8200,
    'approle'   => 'approle-id',
    'secret_id' => 'secret-id',
    'backend'   => 'secret/vaultlocker',
  },
}

An example of passing in devices for encryption:

class { 'vaultlocker':
  config                  => {
    ...
  },
  encrypted_block_devices => [
    '/dev/sdd1',
    '/dev/sde',
  ],
}

Limitations

Developed and tested only on RHEL 8.

Development

All pull requests welcome. pdk test unit should pass for all contributions.

Reference

Table of Contents

Classes

Public Classes

• vaultlocker: This class installs a configures vaultlocker

Private Classes

• vaultlocker::config: Handles vaultlocker configurations
• vaultlocker::install: Handles optional python installation and vaultlocker installation

Defined types

• vaultlocker::encrypt: Automatically run vaultlocker to encrypt a block device.

Classes

vaultlocker

This module will optionally install Python and then install vaultlocker via pip as well as the cryptsetup tool. A vaultlocker configuration file will also be placed in the correct location. An Array of block devices can optionally be passed and a vaultlocker encrypt command will be executed on each unencrypted device.

Examples

include vaultlocker

Parameters

The following parameters are available in the vaultlocker class:

• package_ensure
• package_url
• pip_env_variables
• cmd_env_variables
• manage_python
• python_params
• config
• proxy
• encrypted_block_devices

package_ensure

Data type: Variant[Enum[present, absent, latest], String[1]]

Specifies the vaultlocker pip package ensure value.

package_url

Data type: Variant[Boolean, String]

Specifies the vaultlocker pip package url to use for installation if necessary (such as for installing from a Git repo).

pip_env_variables

Data type: Array

Specifies an Array of environment variables to pass to pip for the vaultlocker package installation.

cmd_env_variables

Data type: Array

Specifies an Array of environment variables to pass to the vaultlocker encrypt command.

manage_python

Data type: Boolean

Specifies whether to attempt to manage Python and part of the module.

python_params

Data type: Hash

Specifies a free-form Hash of parameters and their values to pass to the Python class if Python is being managed.

config

Data type: Hash[String, String]

Specifies a Hash of configs and values for configuration of the vaultlocker tool.

proxy

Data type: Optional[Stdlib::Httpurl]

Specifies a proxy if one is needed for external/internet connections.

encrypted_block_devices

Data type: Array[Stdlib::Unixpath]

Specifies an Array of block device paths. Each block device would be encrypted with vaultlocker if it is not already encrypted.

Defined types

vaultlocker::encrypt

This type with execute vaultlocker encrypt on a block device unless the device is already encrypted.

Examples

vaultlocker::encrypt { '/dev/sdb': }

Parameters

The following parameters are available in the vaultlocker::encrypt defined type:

• device
• environment

device

Data type: Stdlib::Unixpath

Specifies the full path to the block device that vaultlocker will encrypt.

Default value: $title

environment

Data type: Optional[Array]

Specifies an Array of environment variables that are passed to the vaultlocker encrypt command. This is useful because the Python requests module does not use the system CA trust store. You can inject a specific CA cert bundle that includes your Vault server by setting this parameter to something like environment => ['REQUESTS_CA_BUNDLE=/path/to/my/ca-bundle.crt']

Default value: undef

0.1.0

2021-03-15

Feat

• Initial commit