Skip to main content
This is a pre-production deployment of Warehouse. Changes made here affect the production instance of PyPI (pypi.python.org).
Help us improve Python packaging - Donate today!

Ansible Modules for Hashicorp Vault

Project Description

Ansible modules for Hashicorp Vault.

In most cases the Hashicorp Vault modules should be run on localhost.

Reading and Writing

The following example writes the giant secret with two values and then reads the fie value:

---
- hosts: localhost
  vars:
    foo_value: 'fum'
    fie_value: 'fum'
  tasks:
    - hashivault_status:
      register: 'vault_status'
    - hashivault_write:
        secret: 'giant'
        data:
            foo: '{{foo_value}}'
            fie: '{{fie_value}}'
      register: 'vault_write'
    - hashivault_read:
        secret: 'giant'
        key: 'fie'
      register: 'vault_read'

The lookup plugin:

looky: "{{lookup('hashivault', 'giant', 'foo')}}"

By default, the hashivault_write, hashivault_read and the lookup plugin assume the /secret mount point. If you are accessing another mount point, start the secret with a ‘/’:

---
- hosts: localhost
  tasks:
    - hashivault_write:
        secret: '/stories/stuart'
        data:
            last: 'little'
    - hashivault_read:
        secret: '/stories/charlotte'
        key: 'web'
    - set_fact:
        book: "{{lookup('hashivault', '/stories/charlotte', 'web')}}"

Get a list of secrets:

---
- hosts: localhost
  tasks:
    - hashivault_list:
        secret: '/stories'
      register: vault

Initialization, Seal, and Unseal

You may init the vault:

---
- hosts: localhost
  tasks:
    - hashivault_init:
      register: 'vault_init'

You may also seal and unseal the vault:

---
- hosts: localhost
  vars:
    vault_keys:  "{{ lookup('env','VAULT_KEYS') }}"
  tasks:
    - hashivault_status:
      register: 'vault_status'
    - block:
        - hashivault_seal:
          register: 'vault_seal'
      when: "{{vault_status.status.sealed}} == False"
    - hashivault_unseal:
        keys: '{{vault_keys}}'

Policy

Policy support:

---
- hosts: localhost
  vars:
    name: 'terry'
    rules: >
        path "secret/{{name}}/*" {
          capabilities = ["create", "read", "update", "delete", "list"]
        }
        path "secret/{{name}}" {
          capabilities = ["list"]
        }
  tasks:
    - hashivault_policy_set:
        name: "{{name}}"
        rules: "{{rules}}"
      register: 'vault_policy_set'
    - hashivault_policy_get:
        name: '{{name}}'
      register: 'vault_policy_get'
    - hashivault_policy_list:
      register: 'vault_policy_list'

User Management

Add and delete users for userpass:

---
- hosts: localhost
  vars:
    username: 'portugal'
    userpass: 'Th3m@n!!'
  tasks:
    - hashivault_userpass_create:
        name: "{{username}}"
        pass: "{{userpass}}"
        policies: "{{username}}"
      register: 'vault_userpass_create'

    - hashivault_userpass_delete:
        name: "{{username}}"
      register: 'vault_userpass_delete'

Authentication Backends

Handle auth backends:

---
- hosts: localhost
  tasks:
    - hashivault_auth_list:
      register: 'vault_auth_list'
    - block:
      - hashivault_auth_enable:
          name: "userpass"
        register: 'vault_auth_enable'
      when: "'userpass/' not in vault_auth_list.backends"

Audit Backends

Handle audit backends:

---
- hosts: localhost
  tasks:
    - hashivault_audit_list:
      register: 'vault_audit_list'
    - block:
      - hashivault_audit_enable:
          name: "syslog"
        register: 'vault_audit_enable'
      when: "'syslog/' not in vault_audit_list.backends"

If you are not using the VAULT_ADDR and VAULT_TOKEN environment variables, you may be able to simplify your playbooks with an action plugin. This can be some somewhat similar to this example action plugin.

Developer Note

One of the complicated problems with development and testing of this module is ansible/module_utils/hashivault.py is not a directory in itself which in my opinion is a problem with ansible. Because of this limitation with ansible, pip install -e . does not work like it would for other projects. Two potential ways to work around this issue are either use the link.sh script in the top level directory or run for every change:

rm -rf dist; python setup.py sdist
pip install ./dist/ansible-modules-hashivault-*.tar.gz

License

MIT.

Release History

Release History

This version
History Node

3.4.1

History Node

3.4.0

History Node

3.3.0

History Node

3.2.0

History Node

3.1.0

History Node

3.0.0

History Node

2.11.1

History Node

2.11.0

History Node

2.10.0

History Node

2.9.2

History Node

2.9.1

History Node

2.9.0

History Node

2.8.0

History Node

2.7.0

History Node

2.6.0

History Node

2.5.6

History Node

2.5.5

History Node

2.5.4

History Node

2.5.3

History Node

2.5.2

History Node

2.5.1

History Node

2.5.0

History Node

2.4.0

History Node

2.3.2

History Node

2.3.1

History Node

2.3.0

History Node

2.2.0

History Node

2.1.0

History Node

2.0.0

History Node

1.2.0

History Node

1.1.8

History Node

1.1.7

History Node

1.1.6

History Node

1.1.5

History Node

1.1.4

History Node

1.1.3

History Node

1.1.2

History Node

1.1.1

History Node

1.1

History Node

1.0

History Node

0.9

History Node

0.8

History Node

0.7

History Node

0.6

History Node

0.5

History Node

0.4

History Node

0.3

History Node

0.2

History Node

0.1

Download Files

Download Files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

File Name & Checksum SHA256 Checksum Help Version File Type Upload Date
ansible-modules-hashivault-3.4.1.tar.gz (11.6 kB) Copy SHA256 Checksum SHA256 Source Jul 31, 2017

Supported By

WebFaction WebFaction Technical Writing Elastic Elastic Search Pingdom Pingdom Monitoring Dyn Dyn DNS Sentry Sentry Error Logging CloudAMQP CloudAMQP RabbitMQ Heroku Heroku PaaS Kabu Creative Kabu Creative UX & Design Fastly Fastly CDN DigiCert DigiCert EV Certificate Rackspace Rackspace Cloud Servers DreamHost DreamHost Log Hosting