diff --git a/CHANGELOG.md b/CHANGELOG.md index 77bd3e4..d51465b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,28 @@ - Add support for proxy configuration - Add support for system certificates with `vault_tls_certs_path` and `vault_tls_private_path` +## v2.5.9 +- Add ability to install Vault Enterprise via HashiCorp Repo +- Removed check of non-existent variable "vault_install_remote_repo" in tasks/main.yml +- Bumped Vault version to v1.18.2 +- Revamped Readme + +## v2.5.8 +- Add vault_unauthenticated_metrics_access to listener + +## v2.5.7 +- Added support for useful options when running Vault behind a load balancer + +## v2.5.6 +- Fix systemd forking process bug that prevents to stop/restart vault properly +- Use exec to replace the calling process which effectively nullify the forkin problem + +## v2.5.5 +- become_user vault_user when modifying files in vault_home + +## v2.5.4 +- New installation instructions + ## v2.5.3 - Add Prometheus telemetry support (thanks @bbayszczak) - Add tag check_vault to to Vault status debug task (thanks @NorthFuture) diff --git a/defaults/main.yml b/defaults/main.yml index 5664a2b..373f426 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -8,7 +8,7 @@ # Package variables vault_version_suffix: "{{ '+prem' if vault_enterprise_premium else '' }}{{ '.hsm' if vault_enterprise_premium_hsm else '' }}" vault_version: "{{ lookup('env', 'VAULT_VERSION') | default('1.18.2', true) }}{{ vault_version_suffix }}" -vault_version_repo_suffix: "-1" +vault_version_repo_suffix: "{{ '+ent' if vault_enterprise }}-1" vault_architecture_map: # this first entry seems... redundant (but it's required for reasons) amd64: amd64 diff --git a/role_variables.md b/role_variables.md index 5676f3c..6c09bff 100644 --- a/role_variables.md +++ b/role_variables.md @@ -1119,6 +1119,10 @@ Place the Vault Enterprise zip archive into `{{ role_path }}/files` and set `vault_enterprise: true` or use the `VAULT_ENTERPRISE="true"` environment variable. Attempts to download the package from `vault_zip_url` if zip is not found in files/. +Since v2.5.9 of this role you can also install Vault Enterprise via the HashiCorp Repo. In order to install Vault Enterprise via the HashiCorp Repo, set `vault_install_hashi_repo: true*` as well as `vault_enterprise: true`. + +**Warning:** Non-Enterprise Package will be removed if already installed and vault_enterprise is set to *true* and vice versa. + ## `vault_enterprise_premium` - Set to True if using premium binary. Basically just includes "+prem" in "vault_version" var diff --git a/tasks/install_hashi_repo.yml b/tasks/install_hashi_repo.yml index 0ec0bf4..79b5c95 100644 --- a/tasks/install_hashi_repo.yml +++ b/tasks/install_hashi_repo.yml @@ -65,6 +65,12 @@ name: "{{ vault_rhsm_repo_id }}" state: enabled +- name: Ensure Enterprise package is not present when OSS is desired and vice versa + package: + name: "{{ 'vault' ~ ('-enterprise' if not (vault_enterprise | bool) else '') }}" + state: absent + become: true + - name: Install Vault package package: name: "{{ _vault_repo_pkg }}" @@ -72,12 +78,13 @@ become: true vars: _vault_repo_pkg: "{% if (ansible_pkg_mgr in ['yum', 'dnf']) %}\ - vault-{{ vault_version }}{{ vault_version_repo_suffix }}\ + vault-{{ 'enterprise-' if (vault_enterprise | bool) else '' }}{{ vault_version }}{{ vault_version_repo_suffix }}\ {% elif (ansible_pkg_mgr == 'apt') %}\ - vault={{ vault_version }}{{ vault_version_repo_suffix }}\ + vault{{ '-enterprise' if (vault_enterprise | bool) else '' }}={{ vault_version }}{{ vault_version_repo_suffix }}\ {% else %}\ - vault={{ vault_version }}{{ vault_version_repo_suffix }}\ + vault{{ '-enterprise' if (vault_enterprise | bool) else '' }}={{ vault_version }}{{ vault_version_repo_suffix }}\ {% endif %}" + notify: Restart vault - name: Mask default Vault config from package become: true diff --git a/tasks/main.yml b/tasks/main.yml index a497da5..799e4d6 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -58,7 +58,7 @@ when: - vault_enterprise | bool - not vault_install_remotely | bool - - not vault_install_remote_repo | bool + - not vault_install_hashi_repo | bool - installation_required | bool - name: Install OS packages and Vault via control host @@ -72,7 +72,6 @@ - name: Install Vault via HashiCorp repository include_tasks: install_hashi_repo.yml when: - - not vault_enterprise | bool - not vault_install_remotely | bool - vault_install_hashi_repo | bool - installation_required | bool diff --git a/version.txt b/version.txt index f6dcb64..0fa4116 100644 --- a/version.txt +++ b/version.txt @@ -1 +1 @@ -v2.5.2 +v2.5.9