This Ansible role performs a basic Vault installation, including filesystem structure and example configuration.
It can also bootstrap a minimal development or evaluation server or HA Consul-backed cluster in a Vagrant based environment. See README_VAGRANT.md and the associated Vagrantfile for more details about the developer mode setup.
This role resides on GitHub pending the integration with Ansible Galaxy. To install this role create a roles/requirements.yml file in your Ansible project folder with the following contents:
- src: https://github.com/ansible-community/ansible-vault.git
name: ansible-community.ansible-vault
scm: git
version: masterYou can use git tag in the version attribute. Also you can honor its legacy name: brianshumate.ansible-vault.
Basic installation is possible using the included site.yml playbook:
ansible-playbook -i hosts site.yml
You can also pass variables in using the --extra-vars option to the
ansible-playbook command:
ansible-playbook -i hosts site.yml --extra-vars "vault_datacenter=maui"
Specify a template file with a different backend definition
(see templates/backend_consul.j2):
ansible-playbook -i hosts site.yml --extra-vars "vault_backend_file=backend_file.j2"
You need to make sure that the template file backend_file.j2 is in the
role directory for this to work.
This role requires Archlinux, AmazonLinux, FreeBSD, Debian or a RHEL based Linux distribution. It might work with other software versions, but does work with the following specific software and versions. Sorry, there is no planned support at the moment for Windows.
The minimum supported Ansible version is 2.10. Current supported test environments require
Python 3.9 or newer on managed hosts. Older distributions that only use yum, such as CentOS 7,
RHEL 7, and Amazon Linux 2, are no longer supported.
See the molecule scenarios for currently tested distributions.
| Distribution | Versions tested | Preferred installation source |
|---|---|---|
| AlmaLinux | 8, 9 | dnf |
| AlmaLinux | 10 | dnf5 |
| Amazon Linux | 2023 | dnf |
| ArchLinux | rolling | binary |
| Debian | 12, 13 | apt |
| Rocky Linux | 8, 9 | dnf |
| Rocky Linux | 10 | dnf5 |
| Ubuntu | 22.04, 24.04, 26.04 | apt |
By default, this role may restart vault service when played (when there's a
configuration change, OS Packages installed/updated)
When there's no auto-unseal setup on your cluster, the restart may lead to a situation where all Vault instances will be sealed and your cluster will be down.
To avoid this situation, the service restart by the playbook can be disabled
by using the vault_service_restart role variable.
Setting this vault_service_restart to false will disable the vault
service restart by the playbook. You may have to restart the service manually
to load any new configuration deployed.
Use vault_seal_type to select the Vault seal type. The default is shamir.
For compatibility, an enabled legacy seal variable takes priority over shamir.
Supported values: shamir, transit, awskms, azurekeyvault, gcpckms, ocikms, and pkcs11.
BSD-2-Clause
Special thanks to the folks listed in CONTRIBUTORS.md for their contributions to this project.