Package: ansible-modules-hashivault
Ansible modules for Hashicorp Vault.Install this Ansible module:viapip:pip install ansible-modules-hashivaultviaansible-galaxy(requireshvac>=0.7.2):ansible-galaxy install 'git+https://github.com/TerryHowe/ansible-modules-hashivault.git'Note: Thehashicorplookup plugin does not work with this last install method (ansible/ansible#28770).
You can fallback to the build-in lookup plugin:hashi_vaultIn most cases the Hashicorp Vault modules should be run on localhost.Environmental VariablesThe following variables need to be exported to the environment where you run ansible
in order to authenticate to your HashiCorp Vault instance:VAULT_ADDR: url for vaultVAULT_SKIP_VERIFY=true: if set, do not verify presented TLS certificate before communicating with Vault server. Setting this variable is not recommended except during testingVAULT_AUTHTYPE: authentication type to use:token,userpass,github,ldap,approleVAULT_LOGIN_MOUNT_POINT: mount point for login defaults to auth typeVAULT_TOKEN: token for vaultVAULT_ROLE_ID: (required byapprole)VAULT_SECRET_ID: (required byapprole)VAULT_USER: username to login to vaultVAULT_PASSWORD: password to login to vaultVAULT_CLIENT_KEY: path to an unencrypted PEM-encoded private key matching the client certificateVAULT_CLIENT_CERT: path to a PEM-encoded client certificate for TLS authentication to the Vault serverVAULT_CACERT: path to a PEM-encoded CA cert file to use to verify the Vault server TLS certificateVAULT_CAPATH: path to a directory of PEM-encoded CA cert files to verify the Vault server TLS certificateVAULT_AWS_HEADER: X-Vault-AWS-IAM-Server-ID Header value to prevent replay attacksVAULT_NAMESPACE: specify the Vault Namespace, if you have oneDocumentationThere are a few simple examples in this document, but the full documentation can be found at:https://terryhowe.github.io/ansible-modules-hashivault/modules/list_of_hashivault_modules.htmlReading and WritingThe following example writes the giant secret with two values and then
reads the fie value. Thehashivault_secretmodule is kv2 by default:---
- hosts: localhost
  tasks:
    - hashivault_secret:
        secret: giant
        data:
            foo: foe
            fie: fum
    - hashivault_read:
        secret: giant
        key: fie
        version: 2
      register: vault_readThe lookup plugin:- set_fact:
    looky: "{{lookup('hashivault', 'giant', 'foo', version=2)}}"The hashivault_write, hashivault_read and the lookup plugin assume the
/secret mount point.  If you are accessing another mount point, usemount_point:---
- hosts: localhost
  tasks:
    - hashivault_secret_engine:
        name: stories
        backend: generic
    - hashivault_write:
        mount_point: /stories
        secret: stuart
        data:
            last: 'little'
    - hashivault_read:
        mount_point: /stories
        secret: stuart
        key: last
    - set_fact:
        book: "{{lookup('hashivault', 'stuart', 'last', mount_point='/stories')}}"Version 2 of KV secret engine is also supported, just addversion: 2:---
    - hashivault_read:
        mount_point: /stories
        version: 2
        secret: stuart
        key: last
    - set_fact:
        book: "{{lookup('hashivault', 'stuart', 'last', mount_point='/stories', version=2)}}"Initialization, Seal, and UnsealThe real strength of this module is all the administrative functions you can do. See the documentation
mentioned above for more, but here is a small sample.You may init the vault:---
- hosts: localhost
  tasks:
    - hashivault_init:
      register: vault_initYou may also seal and unseal the vault:---
- hosts: localhost
  vars:
    vault_keys:  "{{ lookup('env','VAULT_KEYS') }}"
  tasks:
    - hashivault_status:
      register: vault_status
    - block:
        - hashivault_seal:
          register: vault_seal
      when: "{{vault_status.status.sealed}} == False"
    - hashivault_unseal:
        keys: '{{vault_keys}}'Action PluginIf you are not using the VAULT_ADDR and VAULT_TOKEN environment variables,
you may be able to simplify your playbooks with an action plugin.  This can
be some somewhat similar to thisexample action plugin.Developer NoteOne of the complicated problems with development and testing of this module isansible/module_utils/hashivault.pyis not a directory in itself which
in my opinion is a problem with ansible.  Because of this limitation with
ansible,pip install -e .does not work like it would for other
projects.  Two potential ways to work around this issue are either use thelink.shscript in the top level directory or run for every change:rm -rf dist; python setup.py sdist
pip install ./dist/ansible-modules-hashivault-*.tar.gzLicenseMIT.