From 08876c2b19145ec0f36a9b6b5ecb4bea39522385 Mon Sep 17 00:00:00 2001 From: Marcus Young Date: Fri, 4 Aug 2017 10:41:43 -0500 Subject: [PATCH 1/5] Attempting to fix tests --- .kitchen.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.kitchen.yml b/.kitchen.yml index 3956e76..110e569 100644 --- a/.kitchen.yml +++ b/.kitchen.yml @@ -10,6 +10,10 @@ verifier: provisioner: name: salt_solo + salt_install: bootstrap + salt_bootstrap_url: https://bootstrap.saltstack.com + salt_bootstrap_options: -p git -p curl stable 2016.11 + salt_version: latest log_level: debug require_chef: false formula: vault From d3ba4453f2e9972e3fb606a877ca2992bbae0a04 Mon Sep 17 00:00:00 2001 From: Marcus Young Date: Fri, 4 Aug 2017 10:51:42 -0500 Subject: [PATCH 2/5] Adding epel to amazonlinux --- .kitchen.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.kitchen.yml b/.kitchen.yml index 110e569..bbc52cb 100644 --- a/.kitchen.yml +++ b/.kitchen.yml @@ -28,6 +28,8 @@ platforms: pid_one_command: /usr/lib/systemd/systemd - name: amazonlinux driver_config: + provision_command: + - yum install -y epel-release image: amazonlinux:latest platform: rhel run_command: /sbin/init From 045ee3cbda28aa27119a2a55d9df9bed8dd82307 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20K=C3=BChne?= Date: Tue, 6 Jun 2017 17:37:05 +0200 Subject: [PATCH 3/5] Rename strict_tls to tls_disable --- README.rst | 2 +- pillar.example | 2 +- vault/defaults.yaml | 2 +- vault/files/server.hcl.jinja | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/README.rst b/README.rst index ea17c31..093fea9 100644 --- a/README.rst +++ b/README.rst @@ -32,7 +32,7 @@ To use it, just include *vault.server* in your *top.sls*, and configure it using listen_protocol: tcp listen_port: 8200 listen_address: 0.0.0.0 - strict_tls: 0 + tls_disable: 0 default_lease_ttl: 24h max_lease_ttl: 24h self_signed_cert: diff --git a/pillar.example b/pillar.example index 4e67e56..cc91871 100644 --- a/pillar.example +++ b/pillar.example @@ -3,7 +3,7 @@ vault: listen_protocol: tcp listen_port: 8200 listen_address: 0.0.0.0 - strict_tls: 0 + tls_disable: 0 tls_cert_file: {} tls_key_file: {} default_lease_ttl: 4380h diff --git a/vault/defaults.yaml b/vault/defaults.yaml index 5dc73dc..4d4e712 100644 --- a/vault/defaults.yaml +++ b/vault/defaults.yaml @@ -3,7 +3,7 @@ vault: listen_protocol: tcp listen_port: 8200 listen_address: 0.0.0.0 - strict_tls: 0 + tls_disable: 0 service: upstart tls_cert_file: {} tls_key_file: {} diff --git a/vault/files/server.hcl.jinja b/vault/files/server.hcl.jinja index 41355f5..528f415 100644 --- a/vault/files/server.hcl.jinja +++ b/vault/files/server.hcl.jinja @@ -7,7 +7,7 @@ backend "s3" { listener "{{ vault.listen_protocol }}" { address = "{{ vault.listen_address }}:{{ vault.listen_port }}" - tls_disable = {{ vault.strict_tls }} + tls_disable = {{ vault.tls_disable }} {% if vault.self_signed_cert.enabled %} tls_cert_file = "/etc/vault/{{ vault.self_signed_cert.hostname }}.pem" tls_key_file = "/etc/vault/{{ vault.self_signed_cert.hostname }}-nopass.key" From 44aaee6628fa572b5d856e6d6e0a532fb47b2570 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20K=C3=BChne?= Date: Tue, 6 Jun 2017 17:20:44 +0200 Subject: [PATCH 4/5] Add ability to run server as non root --- pillar.example | 2 ++ vault/defaults.yaml | 2 ++ vault/files/vault_systemd.service.jinja | 2 ++ vault/init.sls | 8 +++++++- 4 files changed, 13 insertions(+), 1 deletion(-) diff --git a/pillar.example b/pillar.example index 4e67e56..15ba3a0 100644 --- a/pillar.example +++ b/pillar.example @@ -14,3 +14,5 @@ vault: dev_mode: true service: type: upstart + user: root + group: root diff --git a/vault/defaults.yaml b/vault/defaults.yaml index 5dc73dc..9039a96 100644 --- a/vault/defaults.yaml +++ b/vault/defaults.yaml @@ -15,3 +15,5 @@ vault: dev_mode: true service: type: systemd + user: root + group: root diff --git a/vault/files/vault_systemd.service.jinja b/vault/files/vault_systemd.service.jinja index 7042a30..a6417b7 100644 --- a/vault/files/vault_systemd.service.jinja +++ b/vault/files/vault_systemd.service.jinja @@ -8,3 +8,5 @@ After=network-online.target consul.service EnvironmentFile=-/etc/sysconfig/vault Restart=on-failure ExecStart=/usr/local/bin/vault server {% if vault.dev_mode %}-dev{% else %} -config="/etc/vault/config/server.hcl"{% endif %} +User={{ vault.user }} +Group={{ vault.group }} diff --git a/vault/init.sls b/vault/init.sls index 045d200..a6943fd 100644 --- a/vault/init.sls +++ b/vault/init.sls @@ -13,8 +13,14 @@ download vault: install vault: cmd.run: - - name: unzip /tmp/vault.zip -d /usr/local/bin && chmod 0755 /usr/local/bin/vault && chown root:root /usr/local/bin/vault + - name: unzip /tmp/vault.zip -d /usr/local/bin && chmod 0755 /usr/local/bin/vault && chown root:root /usr/local/bin/vault - require: - cmd: download vault - pkg: unzip - unless: test -e /usr/local/bin/vault + +vault set cap mlock: + cmd.run: + - name: "setcap cap_ipc_lock=+ep /usr/local/bin/vault" + - watch: + - cmd: install vault From 09cec65355dd9615eef4c557a89b329fa79d722d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20K=C3=BChne?= Date: Tue, 6 Jun 2017 17:54:57 +0200 Subject: [PATCH 5/5] watch => onchanges --- vault/init.sls | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vault/init.sls b/vault/init.sls index a6943fd..6e4958d 100644 --- a/vault/init.sls +++ b/vault/init.sls @@ -22,5 +22,5 @@ install vault: vault set cap mlock: cmd.run: - name: "setcap cap_ipc_lock=+ep /usr/local/bin/vault" - - watch: + - onchanges: - cmd: install vault