Skip to content

REFERENCE.md

Latest commit

 

History

History
1015 lines (571 loc) · 28.2 KB

REFERENCE.md

File metadata and controls

1015 lines (571 loc) · 28.2 KB

Reference

Table of Contents

Classes

Public Classes

  • vaultbot: Installs and configures vaultbot

Private Classes

  • vaultbot::config: Manages the vaultbot global config
  • vaultbot::install: Installs vaultbot
  • vaultbot::service: Manages the vaultbot service

Defined types

Classes

vaultbot

Installs and configures vaultbot

Examples

Install vaultbot with default settings
include vaultbot
Provide the default bundle config
class { 'vaultbot':
  FIXME
}

Parameters

The following parameters are available in the vaultbot class:

version

Data type: String[1]

The vaultbot version to install.

Default value: '1.14.3'

ensure

Data type: Enum['absent','present']

This specifies whether to install vaultbot. Should be one of [present, absent].

Default value: 'present'

install_method

Data type: Enum['archive']

This sets the installation method. Only 'archive' method is supported at the moment.

Default value: 'archive'

download_url

Data type: String[1]

URL template to download the vaultbot release from. This is inline_epp()-processed template with the following variables available:

  • version: See version parameter
  • os: OS kernel (windows/linux/darwin)
  • arch: Machine architecture (amd64/arm64)
  • download_extension: See download_extension parameter

Default value: 'https://gitlab.com/msvechla/vaultbot/-/releases/v<%= $version %>/downloads/vaultbot_<%= $version %>_<%= $os %>_<%= $arch %><%= $download_extension %>'

download_extension

Data type: String[1]

Extension of the archive to download. This determines extractor indirectly.

Default value: '.tar.gz'

checksum_verify

Data type: Boolean

If set to 'true', checksum of the archive downloaded will be verified.

Default value: true

checksum_url

Data type: String[1]

URL of a file containing the archive checksums.

Default value: 'https://gitlab.com/msvechla/vaultbot/-/releases/v<%= $version %>/downloads/vaultbot_<%= $version %>_checksums.txt'

binary_name

Data type: String[1]

Name of vaultbot binary to install into.

Default value: 'vaultbot'

bin_dir

Data type: Stdlib::AbsolutePath

Path to install vaultbot into.

Default value: '/usr/local/bin'

archives_top_dir

Data type: Stdlib::AbsolutePath

Path to store downloaded archive into.

Default value: '/opt/vaultbot'

etc_dir

Data type: Stdlib::AbsolutePath

Path to store vaultbot configs into.

Default value: '/etc/vaultbot'

proxy_url

Data type: Optional[String[1]]

If set, use the URL as a HTTP proxy to use when downloading files.

Default value: undef

service_manage

Data type: Boolean

If set to true, manage the vaultbot timer and service.

Default value: true

on_calendar

Data type: String[1]

Systemd timer OnCalendar value. This defines when to run the vaultbot service.

Default value: 'daily'

on_boot_sec

Data type: String

Systemd timer OnBootSec value. This defines how long to wait before starting the vaultbot service after system reboot. Disabled if set to empty string ('').

Default value: '15min'

randomized_delay_sec

Data type: String

Systemd timer RandomizedDelaySec value. This defines a random delay before starting the service from the timer. Disabled if set to empty string ('').

Default value: '15min'

exec_start

Data type: String[1]

Systemd service ExecStart value.

Default value: "${bin_dir}/${binary_name}"

syslog_identifier

Data type: String[1]

Systemd service SyslogIdentifier value.

Default value: 'vaultbot-%i'

auto_confirm

Data type: Optional[Boolean]

If set to true, user prompts will be auto confirmed with yes.

Default value: undef

vault_addr

Data type: Optional[String[1]]

The address of the Vault server expressed as a URL and port.

Default value: undef

vault_cacert

Data type: Optional[Stdlib::Absolutepath]

Path to a PEM-encoded CA cert file to use to verify the Vault server SSL certificate.

Default value: undef

vault_capath

Data type: Optional[Stdlib::Absolutepath]

Path to a directory of PEM-encoded CA cert files to verify the Vault server SSL certificate. If vault_cacert is specified, its value will take precedence.

Default value: undef

vault_client_cert

Data type: Optional[Stdlib::Absolutepath]

Path to a PEM-encoded client certificate for TLS authentication to the Vault server.

Default value: undef

vault_client_key

Data type: Optional[Stdlib::Absolutepath]

Path to an unencrypted PEM-encoded private key matching the client certificate.

Default value: undef

vault_client_timeout

Data type: Optional[Integer[0]]

Timeout variable for the vault client.

Default value: undef

vault_skip_verify

Data type: Optional[Boolean]

If set to true, do not verify Vault's presented certificate before communicating with it. Setting this variable is not recommended except during testing.

Default value: undef

vault_tls_server_name

Data type: Optional[String]

If set, use the given name as the SNI host when connecting via TLS.

Default value: undef

vault_max_retries

Data type: Optional[Integer[0]]

The maximum number of retries when a 5xx error code is encountered.

Default value: undef

vault_token

Data type: Optional[String[1]]

The Vault authentication token.

Default value: undef

vault_renew_token

Data type: Optional[Boolean]

If set, vaultbot tries to automatically renew the current token.

Default value: undef

vault_auth_method

Data type: Optional[Enum['agent','cert','approle','token','aws-iam','aws-ec2','gcp-gce','gcp-iam']]

The method used to authenticate to vault. Should be one of [agent, cert, approle, token, aws-iam, aws-ec2, gcp-gce, gcp-iam].

Default value: undef

vault_certificate_role

Data type: Optional[String[1]]

The certificate role to authenticate against, when using the cert auth method.

Default value: undef

vault_aws_auth_role

Data type: Optional[String[1]]

The role to use for AWS IAM authentication.

Default value: undef

vault_aws_auth_mount

Data type: Optional[String[1]]

The mount path for the vault AWS auth method.

Default value: undef

vault_aws_auth_header

Data type: Optional[String[1]]

The header to use during vault AWS IAM authentication. If empty no header will be set.

Default value: undef

vault_aws_auth_nonce

Data type: Optional[String[1]]

The nonce to use during vault AWS EC2 authentication.

Default value: undef

vault_aws_auth_nonce_path

Data type: Optional[String[1]]

If set, the nonce that is used during vault AWS EC2 authentication will be written to this path.

Default value: undef

vault_gcp_auth_role

Data type: Optional[String[1]]

The role to use for GCP authentication.

Default value: undef

vault_gcp_auth_service_account_email

Data type: Optional[String[1]]

The service account email to use for GCP IAM authentication.

Default value: undef

vault_gcp_auth_mount

Data type: Optional[String[1]]

The mount path for the vault GCP auth method.

Default value: undef

vault_app_role_mount

Data type: Optional[String[1]]

The mount path for the AppRole backend.

Default value: undef

vault_app_role_role_id

Data type: Optional[String[1]]

RoleID of the AppRole.

Default value: undef

vault_app_role_secret_id

Data type: Optional[String[1]]

SecretID belonging to AppRole.

Default value: undef

pki_mount

Data type: Optional[String[1]]

Specifies the PKI backend mount path.

Default value: undef

pki_role_name

Data type: Optional[String[1]]

Specifies the name of the role to create the certificate against.

Default value: undef

pki_ttl

Data type: Optional[String[1]]

Specifies requested Time To Live.

Default value: undef

pki_exclude_cn_from_sans

Data type: Optional[Boolean]

If set to true, the given pki_common_name will not be included in Subject Alternate Names.

Default value: undef

pki_private_key_format

Data type: Optional[Enum['der','pkcs8']]

Specifies the format for marshaling the private key. Should be one of [der, pkcs8].

Default value: undef

pki_renew_percent

Data type: Optional[Float[0.00,1.00]]

Percentage of requested certificate TTL, which triggers a renewal when passed (>0.00, <1.00).

Default value: undef

pki_renew_time

Data type: Optional[String[1]]

Time in hours before certificate expiry, which triggers a renewal (e.g. 12h, 1m). Takes precedence over pki_renew_percent when set.

Default value: undef

pki_force_renew

Data type: Optional[Boolean]

If set to true, the certificate will be renewed without checking the expiry.

Default value: undef

Defined types

vaultbot::bundle

Manages a certificate bundle with vaultbot

Examples

Create a certificate bundle
FIXME

Parameters

The following parameters are available in the vaultbot::bundle defined type:

ensure

Data type: Enum['absent','present']

This specifies whether to create the bundle. Should be one of [present, absent].

Default value: 'present'

bundle_name

Data type: String[1]

This sets the certificate bundle name.

Default value: $title

logfile

Data type: Optional[Stdlib::Absolutepath]

Path to the vaultbot logfile.

Default value: undef

renew_hook

Data type: Optional[Stdlib::Absolutepath]

Command to execute after certificate has been updated.

Default value: undef

auto_confirm

Data type: Optional[Boolean]

If set to true, user prompts will be auto confirmed with yes.

Default value: undef

vault_addr

Data type: Optional[String[1]]

The address of the Vault server expressed as a URL and port.

Default value: undef

vault_cacert

Data type: Optional[Stdlib::Absolutepath]

Path to a PEM-encoded CA cert file to use to verify the Vault server SSL certificate.

Default value: undef

vault_capath

Data type: Optional[Stdlib::Absolutepath]

Path to a directory of PEM-encoded CA cert files to verify the Vault server SSL certificate. If vault_cacert is specified, its value will take precedence.

Default value: undef

vault_client_cert

Data type: Optional[Stdlib::Absolutepath]

Path to a PEM-encoded client certificate for TLS authentication to the Vault server.

Default value: undef

vault_client_key

Data type: Optional[Stdlib::Absolutepath]

Path to an unencrypted PEM-encoded private key matching the client certificate.

Default value: undef

vault_client_timeout

Data type: Optional[Integer[0]]

Timeout variable for the vault client.

Default value: undef

vault_skip_verify

Data type: Optional[Boolean]

If set to true, do not verify Vault's presented certificate before communicating with it. Setting this variable is not recommended except during testing.

Default value: undef

vault_tls_server_name

Data type: Optional[String]

If set, use the given name as the SNI host when connecting via TLS.

Default value: undef

vault_max_retries

Data type: Optional[Integer[0]]

The maximum number of retries when a 5xx error code is encountered.

Default value: undef

vault_token

Data type: Optional[String[1]]

The Vault authentication token.

Default value: undef

vault_renew_token

Data type: Optional[Boolean]

If set to true, vaultbot tries to automatically renew the current token.

Default value: undef

vault_auth_method

Data type: Optional[Enum['agent','cert','approle','token','aws-iam','aws-ec2','gcp-gce','gcp-iam']]

The method used to authenticate to vault. Should be one of [agent, cert, approle, token, aws-iam, aws-ec2, gcp-gce, gcp-iam].

Default value: undef

vault_certificate_role

Data type: Optional[String[1]]

The certificate role to authenticate against, when using the cert auth method.

Default value: undef

vault_aws_auth_role

Data type: Optional[String[1]]

The role to use for AWS IAM authentication.

Default value: undef

vault_aws_auth_mount

Data type: Optional[String[1]]

The mount path for the vault AWS auth method (default: aws).

Default value: undef

vault_aws_auth_header

Data type: Optional[String[1]]

The header to use during vault AWS IAM authentication. If empty no header will be set.

Default value: undef

vault_aws_auth_nonce

Data type: Optional[String[1]]

The nonce to use during vault AWS EC2 authentication.

Default value: undef

vault_aws_auth_nonce_path

Data type: Optional[String[1]]

If set, the nonce that is used during vault AWS EC2 authentication will be written to this path.

Default value: undef

vault_gcp_auth_role

Data type: Optional[String[1]]

The role to use for GCP authentication.

Default value: undef

vault_gcp_auth_service_account_email

Data type: Optional[String[1]]

The service account email to use for GCP IAM authentication.

Default value: undef

vault_gcp_auth_mount

Data type: Optional[String[1]]

The mount path for the vault GCP auth method.

Default value: undef

vault_app_role_mount

Data type: Optional[String[1]]

The mount path for the AppRole backend.

Default value: undef

vault_app_role_role_id

Data type: Optional[String[1]]

RoleID of the AppRole.

Default value: undef

vault_app_role_secret_id

Data type: Optional[String[1]]

SecretID belonging to AppRole.

Default value: undef

pki_mount

Data type: Optional[String[1]]

Specifies the PKI backend mount path.

Default value: undef

pki_role_name

Data type: Optional[String[1]]

Specifies the name of the role to create the certificate against.

Default value: undef

pki_common_name

Data type: Optional[String[1]]

Specifies the requested CN for the certificate.

Default value: undef

pki_alt_names

Data type: Optional[Array[String[1]]]

Array of strings which specifies requested Subject Alternative Names.

Default value: undef

pki_ip_sans

Data type: Optional[Array[String[1]]]

Array of strings which specifies requested IP Subject Alternative Names.

Default value: undef

pki_ttl

Data type: Optional[String[1]]

Specifies requested Time To Live.

Default value: undef

pki_exclude_cn_from_sans

Data type: Optional[Boolean]

If set to true, the given pki_common_name will not be included in Subject Alternate Names.

Default value: undef

pki_private_key_format

Data type: Optional[Enum['der','pkcs8']]

Specifies the format for marshaling the private key. Should be one of [der, pkcs8].

Default value: undef

pki_renew_percent

Data type: Optional[Float[0.00,1.00]]

Percentage of requested certificate TTL, which triggers a renewal when passed (>0.00, <1.00).

Default value: undef

pki_renew_time

Data type: Optional[String[1]]

Time in hours before certificate expiry, which triggers a renewal (e.g. 12h, 1m). Takes precedence over pki_renew_percent when set.

Default value: undef

pki_force_renew

Data type: Optional[Boolean]

If set to true, the certificate will be renewed without checking the expiry.

Default value: undef

pki_cert_path

Data type: Optional[Stdlib::Absolutepath]

Path to the requested / to be updated certificate.

Default value: undef

pki_cachain_path

Data type: Optional[Stdlib::Absolutepath]

Path to the CA Chain of the requested / to be updated certificate.

Default value: undef

pki_privkey_path

Data type: Optional[Stdlib::Absolutepath]

Path to the private key of the requested / to be updated certificate.

Default value: undef

pki_pembundle_path

Data type: Optional[Stdlib::Absolutepath]

Path to the PEM bundle of the requested / to be updated certificate, private key and ca chain.

Default value: undef

pki_jks_path

Data type: Optional[Stdlib::Absolutepath]

Path to a JAVA KeyStore where the certificates should be exported.

Default value: undef

pki_jks_password

Data type: Optional[Sensitive[String[1]]]

JAVA KeyStore password.

Default value: undef

pki_jks_cert_alias

Data type: Optional[String[1]]

Alias in the JAVA KeyStore of the requested / to be updated certificate.

Default value: undef

pki_jks_cachain_alias

Data type: Optional[String[1]]

Alias in the JAVA KeyStore of the CA Chain of the requested / to be updated certificate.

Default value: undef

pki_jks_privkey_alias

Data type: Optional[String[1]]

Alias in the JAVA KeyStore of the private key of the requested / to be updated certificate.

Default value: undef

pki_pkcs12_path

Data type: Optional[Stdlib::Absolutepath]

Path to a PKCS#12 KeyStore where the certificates should be exported to.

Default value: undef

pki_pkcs12_umask

Data type: Optional[String[1]]

File mode of the generated PKCS#12 KeyStore. Existing keystore will keep it's mode. Octal format required (e.g. 0644).

Default value: undef

pki_pkcs12_password

Data type: Optional[Sensitive[String[1]]]

Default password is "ChangeIt", a commonly-used password for PKCS#12 files. Due to the weak encryption used by PKCS#12, it is RECOMMENDED that you use the default password when encoding PKCS#12 files, and protect the PKCS#12 files using other means.

Default value: undef