kubespray/roles/vault/defaults/main.yml

---

vault_adduser_vars:
  comment: "Hashicorp Vault User"
  createhome: no
  name: vault
  shell: /sbin/nologin
  system: yes
vault_base_dir: /etc/vault
# https://releases.hashicorp.com/vault/0.6.4/vault_0.6.4_SHA256SUMS
vault_binary_checksum: 04d87dd553aed59f3fe316222217a8d8777f40115a115dac4d88fac1611c51a6
vault_bootstrap: false
vault_ca_options:
  common_name: kube-cluster-ca
  format: pem
  ttl: 87600h
vault_cert_dir: "{{ vault_base_dir }}/ssl"
vault_client_headers:
  Accept: "application/json"
  Content-Type: "application/json"
vault_config:
  backend:
    etcd:
      address: "{{ vault_etcd_url }}"
      ha_enabled: "true"
      redirect_addr: "https://{{ ansible_default_ipv4.address }}:{{ vault_port }}"
      tls_ca_file: "{{ vault_cert_dir }}/ca.pem"
  cluster_name: "kubernetes-vault"
  default_lease_ttl: "{{ vault_default_lease_ttl }}"
  listener:
    tcp:
      address: "0.0.0.0:{{ vault_port }}"
      tls_cert_file: "{{ vault_cert_dir }}/api.pem"
      tls_key_file: "{{ vault_cert_dir }}/api-key.pem"
  max_lease_ttl: "{{ vault_max_lease_ttl }}"
vault_config_dir: "{{ vault_base_dir }}/config"
vault_container_name: kube-hashicorp-vault
# This variable is meant to match the GID of vault inside Hashicorp's official Vault Container
vault_default_lease_ttl: 720h
vault_default_role_permissions:
  allow_any_name: true
vault_deployment_type: docker
vault_download_url: "https://releases.hashicorp.com/vault/{{ vault_version }}/vault_{{ vault_version }}_linux_amd64.zip"
vault_download_vars:
  container: "{{ vault_deployment_type != 'host' }}"
  dest: "vault/vault_{{ vault_version }}_linux_amd64.zip"
  enabled: true
  mode: "0755"
  owner: "vault"
  repo: "{{ vault_image_repo }}"
  sha256: "{{ vault_binary_checksum if vault_deployment_type == 'host' else vault_digest_checksum|d(none) }}"
  source_url: "{{ vault_download_url }}"
  tag: "{{ vault_image_tag }}"
  unarchive: true
  url: "{{ vault_download_url }}"
  version: "{{ vault_version }}"
vault_etcd_url: "https://{{ hostvars[groups.etcd[0]]['ip']|d(hostvars[groups.etcd[0]]['ansible_default_ipv4']['address']) }}:2379"
vault_image_repo: "vault"
vault_image_tag: "{{ vault_version }}"
vault_log_dir: "/var/log/vault"
vault_max_lease_ttl: 87600h
vault_needs_gen: false
vault_port: 8200
# Although "cert" is an option, ansible has no way to auth via cert until
# upstream merges: https://github.com/ansible/ansible/pull/18141
vault_role_auth_method: userpass
vault_roles:
  - name: etcd
    group: etcd
    policy_rules: default
    role_options: default
  - name: kube
    group: k8s-cluster
    policy_rules: default
    role_options: default
vault_roles_dir: "{{ vault_base_dir }}/roles"
vault_secret_shares: 1
vault_secret_threshold: 1
vault_secrets_dir: "{{ vault_base_dir }}/secrets"
vault_temp_config:
  backend:
    file:
      path: /vault/file
  default_lease_ttl: "{{ vault_default_lease_ttl }}"
  listener:
    tcp:
      address: "0.0.0.0:{{ vault_port }}"
      tls_disable: "true"
  max_lease_ttl: "{{ vault_max_lease_ttl }}"
vault_temp_container_name: vault-temp
vault_version: 0.6.4