DOCS.md

Reference

Table of Contents

Classes

• vault: Install & configure a Vault server or Vault Agent
• vault::config: Set the Vault config via JSON file & optionally set up a system service
• vault::install: Install Vault, either from a repository or archive
• vault::params: Parameters for the vault class. It sets variables according to platform.
• vault::service: Manage the Vault system service, enabled by default

Classes

vault

Install & configure a Vault server or Vault Agent

Examples

Basic usage

include vault

Specify a version

class { 'vault':
  version => '1.11.1',
}

Parameters

The following parameters are available in the vault class:

• user
• manage_user
• group
• manage_group
• bin_dir
• config_dir
• config_mode
• manage_config_file
• purge_config_dir
• download_url
• download_url_base
• download_extension
• service_name
• service_enable
• service_ensure
• service_provider
• service_type
• service_options
• manage_repo
• manage_service
• manage_service_file
• storage
• manage_storage_dir
• listener
• ha_storage
• seal
• disable_cache
• telemetry
• default_lease_ttl
• max_lease_ttl
• disable_mlock
• manage_file_capabilities
• num_procs
• install_method
• package_name
• package_ensure
• download_dir
• manage_download_dir
• download_filename
• version
• os_type
• arch
• enable_ui
• api_addr
• extra_config

user

Data type: String

Customise the user vault runs as, will also create the user unless manage_user is false.

Default value: $vault::params::user

manage_user

Data type: Boolean

Whether or not the module should create the user.

Default value: $vault::params::manage_user

group

Data type: String

Customise the group vault runs as, will also create the user unless manage_group is false.

Default value: $vault::params::group

manage_group

Data type: Boolean

Whether or not the module should create the group.

Default value: $vault::params::manage_group

bin_dir

Data type: String

Directory the vault executable will be installed in.

Default value: $vault::params::bin_dir

config_dir

Data type: String

Directory the vault configuration will be kept in.

Default value: $vault::params::config_dir

config_mode

Data type: String

Mode of the configuration file (config.json). Defaults to '0750'

Default value: $vault::params::config_mode

manage_config_file

Data type: Boolean

Whether the config_file should be managed

Default value: $vault::params::manage_config_file

purge_config_dir

Data type: Boolean

Whether the config_dir should be purged before installing the generated config.

Default value: true

download_url

Data type: Optional[String]

Manual URL to download the vault zip distribution from.

Default value: $vault::params::download_url

download_url_base

Data type: String

HashiCorp base URL to download vault zip distribution from.

Default value: $vault::params::download_url_base

download_extension

Data type: String

The extension of the vault download

Default value: $vault::params::download_extension

service_name

Data type: String

Customise the name of the system service

Default value: $vault::params::service_name

service_enable

Data type: Boolean

Set the enable value for service[$service_name]

Default value: $vault::params::service_enable

service_ensure

Data type: String

Set the ensure value for service[$service_name]

Default value: $vault::params::service_ensure

service_provider

Data type: String

Customise the name of the system service provider; this also controls the init configuration files that are installed.

Default value: $vault::params::service_provider

service_type

Data type: String

Choose between server or agent for which mode you want the Vault binary to run as.

Default value: $vault::params::service_type

service_options

Data type: Optional[String]

Additional arguments or options, passed directly to the command run by the service

Default value: $vault::params::service_options

manage_repo

Data type: Boolean

Configure the upstream HashiCorp repository. Only relevant when $vault::install_method = 'repo'.

Default value: $vault::params::manage_repo

manage_service

Data type: Boolean

Instruct puppet to manage service or not

Default value: $vault::params::manage_service

manage_service_file

Data type: Optional[Boolean]

Whether to override the per-install-method management of the service file

Default value: $vault::params::manage_service_file

storage

Data type: Hash

Hash representation of the storage Vault config stanza

Default value: $vault::params::storage

manage_storage_dir

Data type: Boolean

Whether or not the directory for storing data is managed by this module If manage_storage_dir is true and a file or raft storage backend is configured, we create the directory configured in that backend.

Default value: $vault::params::manage_storage_dir

listener

Data type: Variant[Hash, Array[Hash]]

Hash representation of the listener Vault config stanza

Default value: $vault::params::listener

ha_storage

Data type: Optional[Hash]

Hash representation of the ha_storage Vault config stanza

Default value: $vault::params::ha_storage

seal

Data type: Optional[Hash]

Hash representation of the seal Vault config stanza

Default value: $vault::params::seal

disable_cache

Data type: Optional[Boolean]

Sets the disable_cache Vault config value

Default value: $vault::params::disable_cache

telemetry

Data type: Optional[Hash]

Hash representation of the telemetry Vault config

Default value: $vault::params::telemetry

default_lease_ttl

Data type: Optional[String]

Sets the default_lease_ttl Valut config value

Default value: $vault::params::default_lease_ttl

max_lease_ttl

Data type: Optional[String]

Sets the max_lease_ttl Valut config value

Default value: $vault::params::max_lease_ttl

disable_mlock

Data type: Optional[Boolean]

Sets the disable_mlock Valut config value

Default value: $vault::params::disable_mlock

manage_file_capabilities

Data type: Optional[Boolean]

Tightly coupled to $disable_mlock, see vault::install for details

Default value: $vault::params::manage_file_capabilities

num_procs

Data type: Integer

Sets the GOMAXPROCS environment variable, to determine how many CPUs Vault can use. The official Vault Terraform install.sh script sets this to the output of nprocs, with the comment, "Make sure to use all our CPUs, because Vault can block a scheduler thread". Default: number of CPUs on the system.

Default value: $vault::params::num_procs

install_method

Data type: Enum['archive', 'repo']

Can be one of archive or repo

• repo will use a HashiCorp package repository to install Vault
• archive will use a HashiCorp ZIP artifact to install Vault

Default value: $vault::params::install_method

package_name

Data type: String

The name of the package to install if using $install_method = 'repo'

Default value: $vault::params::package_name

package_ensure

Data type: String

Set the ensure parameter for a package install if using $install_method = 'repo'

Default value: $vault::params::package_ensure

download_dir

Data type: String

The directory to download to when using $install_method = 'archive'

Default value: $vault::params::download_dir

manage_download_dir

Data type: Boolean

Whether or not to create/manage the download directory when using $install_method = 'archive'

Default value: $vault::params::manage_download_dir

download_filename

Data type: String

The name of the downloaded file when using $install_method = 'archive'

Default value: $vault::params::download_filename

version

Data type: String

The version of Vault to install

Default value: $vault::params::version

os_type

Data type: String

Override the $facts['kernel'] supplied OS value (e.g., 'Linux')

Default value: $vault::params::os_type

arch

Data type: String

Override the $facts['os']['architecture'] supplied architecture value

Default value: $vault::params::arch

enable_ui

Data type: Optional[Boolean]

Whether or not to enable the Vault web UI

Default value: $vault::params::enable_ui

api_addr

Data type: Optional[String]

Specifies the address (full URL) to advertise to other Vault servers in the cluster for client redirection. This value is also used for plugin backends. This can also be provided via the environment variable VAULT_API_ADDR. In general this should be set as a full URL that points to the value of the listener address

Default value: undef

extra_config

Data type: Hash

Hash representation of any additional Vault configuration not already represented

Default value: {}

vault::config

Set the Vault config via JSON file & optionally set up a system service

vault::install

Install Vault, either from a repository or archive

vault::params

Parameters for the vault class. It sets variables according to platform.

vault::service

Manage the Vault system service, enabled by default