c12s-kubespray/roles/vault/tasks/cluster/configure.yml

---
- name: cluster/configure | Ensure the vault directories exist
  file:
    dest: "{{ item }}"
    owner: vault
    mode: 0750
    state: directory
    recurse: true
  with_items:
    - "{{ vault_base_dir }}"
    - "{{ vault_cert_dir }}"
    - "{{ vault_config_dir }}"
    - "{{ vault_roles_dir }}"
    - "{{ vault_secrets_dir }}"
    - "{{ vault_log_dir }}"
    - "{{ vault_lib_dir }}"

- name: cluster/configure | Lay down the configuration file
  copy:
    content: "{{ vault_config | to_nice_json(indent=4) }}"
    dest: "{{ vault_config_dir }}/config.json"
    mode: 0640
  register: vault_config_change
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`---`
refactor vault role (#2733) * Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size 2018-05-11 16:11:38 +00:00			`- name: cluster/configure \| Ensure the vault directories exist`
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`file:`
refactor vault role (#2733) * Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size 2018-05-11 16:11:38 +00:00			`dest: "{{ item }}"`
			`owner: vault`
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`mode: 0750`
			`state: directory`
refactor vault role (#2733) * Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size 2018-05-11 16:11:38 +00:00			`recurse: true`
			`with_items:`
			`- "{{ vault_base_dir }}"`
			`- "{{ vault_cert_dir }}"`
			`- "{{ vault_config_dir }}"`
			`- "{{ vault_roles_dir }}"`
			`- "{{ vault_secrets_dir }}"`
			`- "{{ vault_log_dir }}"`
			`- "{{ vault_lib_dir }}"`
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00
			`- name: cluster/configure \| Lay down the configuration file`
			`copy:`
			`content: "{{ vault_config \| to_nice_json(indent=4) }}"`
			`dest: "{{ vault_config_dir }}/config.json"`
			`mode: 0640`
			`register: vault_config_change`