Skip to content

Commit f503470

Browse files
committed
Add all hashivault_unseal supported options
1 parent 5eb4776 commit f503470

File tree

2 files changed

+25
-1
lines changed

2 files changed

+25
-1
lines changed

roles/vault_unseal/README.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,19 @@ Role variables
1515
--------------
1616

1717
* `vault_api_addr`: Vault [API addr](https://www.vaultproject.io/docs/configuration#api_addr) - Full URL including protocol and port (e.g. "http://127.0.0.1:8200"). In a Vault cluster, this should point to an individual Vault server, rather than a load balancer.
18+
* `vault_unseal_authtype`: authentication type
19+
* `vault_unseal_aws_header`: X-Vault-AWS-IAM-Server-ID Header value to prevent replay attacks
20+
* `vault_unseal_ca_cert`: Path to a PEM-encoded CA cert file to use to verify the Vault server TLS certificate
21+
* `vault_unseal_ca_path`: Path to a directory of PEM-encoded CA cert files to verify the Vault server TLS certificate. If `vault_unseal_ca_cert` is specified, its value will take precedence
22+
* `vault_unseal_client_cert`: Path to a PEM-encoded client certificate for TLS authentication to the Vault server
23+
* `vault_unseal_client_key`: Path to an unencrypted PEM-encoded private key matching the client certificate
1824
* `vault_unseal_keys`: List of unseal key shards.
25+
* `vault_unseal_login_mount_point`: Authentication mount point
26+
* `vault_unseal_namespace`: Namespace for Vault
27+
* `vault_unseal_password`: Password for Vault
28+
* `vault_unseal_token`: Token for Vault
29+
* `vault_unseal_username`: Username to login to Vault
30+
* `vault_unseal_verify`: If set, do not verify presented TLS certificate before communicating with Vault server.
1931

2032
Example playbook
2133
----------------

roles/vault_unseal/tasks/main.yml

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,17 @@
11
---
22
- name: Unseal Vault
33
hashivault_unseal:
4-
url: "{{ vault_api_addr }}"
4+
authtype: "{{ vault_unseal_authtype | default(omit) }}"
5+
aws_header: "{{ vault_unseal_aws_header | default(omit) }}"
6+
ca_cert: "{{ vault_unseal_ca_cert | default(omit) }}"
7+
ca_path: "{{ vault_unseal_ca_path | default(omit) }}"
8+
client_cert: "{{ vault_unseal_client_cert | default(omit) }}"
9+
client_key: "{{ vault_unseal_client_key | default(omit) }}"
510
keys: "{{ vault_unseal_keys | join(' ') }}"
11+
login_mount_point: "{{ vault_unseal_login_mount_point | default(omit) }}"
12+
namespace: "{{ vault_unseal_namespace | default(omit) }}"
13+
password: "{{ vault_unseal_password | default(omit) }}"
14+
token: "{{ vault_unseal_token | default(omit) }}"
15+
url: "{{ vault_api_addr }}"
16+
username: "{{ vault_unseal_username | default(omit) }}"
17+
verify: "{{ vault_unseal_verify | default(omit) }}"

0 commit comments

Comments
 (0)