Install Enterprise via repo

CHANGELOG.md

@@ -3,6 +3,28 @@
 - Add support for proxy configuration
 - Add support for system certificates with `vault_tls_certs_path` and `vault_tls_private_path`
 
+## v2.5.9
+- Add ability to install Vault Enterprise via HashiCorp Repo
+- Removed check of non-existent variable "vault_install_remote_repo" in tasks/main.yml
+- Bumped Vault version to v1.18.2
+- Revamped Readme
+
+## v2.5.8
+- Add vault_unauthenticated_metrics_access to listener
+
+## v2.5.7
+- Added support for useful options when running Vault behind a load balancer
+
+## v2.5.6
+- Fix systemd forking process bug that prevents to stop/restart vault properly
+- Use exec to replace the calling process which effectively nullify the forkin problem
+
+## v2.5.5
+- become_user vault_user when modifying files in vault_home
+
+## v2.5.4 
+- New installation instructions
+
 ## v2.5.3
 - Add Prometheus telemetry support (thanks @bbayszczak)
 - Add tag check_vault to to Vault status debug task (thanks @NorthFuture)

defaults/main.yml

@@ -8,7 +8,7 @@
 # Package variables
 vault_version_suffix: "{{ '+prem' if vault_enterprise_premium else '' }}{{ '.hsm' if vault_enterprise_premium_hsm else '' }}"
 vault_version: "{{ lookup('env', 'VAULT_VERSION') | default('1.18.2', true) }}{{ vault_version_suffix }}"
-vault_version_repo_suffix: "-1"
+vault_version_repo_suffix: "{{ '+ent' if vault_enterprise }}-1"
 vault_architecture_map:
   # this first entry seems... redundant (but it's required for reasons)
   amd64: amd64

role_variables.md

@@ -1119,6 +1119,10 @@ Place the Vault Enterprise zip archive into `{{ role_path }}/files` and set
 `vault_enterprise: true` or use the `VAULT_ENTERPRISE="true"` environment
 variable. Attempts to download the package from `vault_zip_url` if zip is not found in files/.
 
+Since v2.5.9 of this role you can also install Vault Enterprise via the HashiCorp Repo. In order to install Vault Enterprise via the HashiCorp Repo, set `vault_install_hashi_repo: true*` as well as `vault_enterprise: true`.
+
+**Warning:** Non-Enterprise Package will be removed if already installed and vault_enterprise is set to *true* and vice versa. 
+
 ## `vault_enterprise_premium`
 
 - Set to True if using premium binary. Basically just includes "+prem" in "vault_version" var

tasks/install_hashi_repo.yml

@@ -65,19 +65,26 @@
         name: "{{ vault_rhsm_repo_id }}"
         state: enabled
 
+- name: Ensure Enterprise package is not present when OSS is desired and vice versa
+  package:
+    name: "{{ 'vault' ~ ('-enterprise' if not (vault_enterprise | bool) else '') }}"
+    state: absent
+  become: true
+
 - name: Install Vault package
   package:
     name: "{{ _vault_repo_pkg }}"
     state: present
   become: true
   vars:
     _vault_repo_pkg: "{% if (ansible_pkg_mgr in ['yum', 'dnf']) %}\
-                  vault-{{ vault_version }}{{ vault_version_repo_suffix }}\
+                  vault-{{ 'enterprise-' if (vault_enterprise | bool) else '' }}{{ vault_version }}{{ vault_version_repo_suffix }}\
                 {% elif (ansible_pkg_mgr == 'apt') %}\
-                  vault={{ vault_version }}{{ vault_version_repo_suffix }}\
+                  vault{{ '-enterprise' if (vault_enterprise | bool) else '' }}={{ vault_version }}{{ vault_version_repo_suffix }}\
                 {% else %}\
-                  vault={{ vault_version }}{{ vault_version_repo_suffix }}\
+                  vault{{ '-enterprise' if (vault_enterprise | bool) else '' }}={{ vault_version }}{{ vault_version_repo_suffix }}\
                 {% endif %}"
+  notify: Restart vault
 
 - name: Mask default Vault config from package
   become: true

tasks/main.yml

@@ -58,7 +58,7 @@
   when:
     - vault_enterprise | bool
     - not vault_install_remotely | bool
-    - not vault_install_remote_repo | bool
+    - not vault_install_hashi_repo | bool
     - installation_required | bool
 
 - name: Install OS packages and Vault via control host
@@ -72,7 +72,6 @@
 - name: Install Vault via HashiCorp repository
   include_tasks: install_hashi_repo.yml
   when:
-    - not vault_enterprise | bool
     - not vault_install_remotely | bool
     - vault_install_hashi_repo | bool
     - installation_required | bool

version.txt

@@ -1 +1 @@
-v2.5.2
+v2.5.9