Skip to content
Branch: master
Find file History
Permalink
Type Name Latest commit message Commit time
..
Failed to load latest commit information.
README.md update doc references to ubuntu Jul 25, 2019
install-vault Fix Ubuntu 18 not having setcap, required for mlock permission Jul 25, 2019

README.md

Vault Install Script

This folder contains a script for installing Vault and its dependencies. You can use this script, along with the run-vault script it installs, to create a Vault Amazon Machine Image (AMI) that can be deployed in AWS across an Auto Scaling Group using the vault-cluster module.

This script has been tested on the following operating systems:

  • Ubuntu 16.04
  • Ubuntu 18.04
  • Amazon Linux 2

There is a good chance it will work on other flavors of Debian, CentOS, and RHEL as well.

Quick start

To install Vault, use git to clone this repository at a specific tag (see the releases page for all available tags) and run the install-vault script:

git clone --branch <VERSION> https://github.com/hashicorp/terraform-aws-vault.git
terraform-aws-vault/modules/install-vault/install-vault --version 0.10.0

The install-vault script will install Vault, its dependencies, and the run-vault script. You can then run the run-vault script when the server is booting to start Vault.

We recommend running the install-vault script as part of a Packer template to create a Vault Amazon Machine Image (AMI) (see the vault-consul-ami example for sample code). You can then deploy the AMI across an Auto Scaling Group using the vault-cluster module (see the root example and vault-cluster-private examples for fully-working sample code).

Command line Arguments

The install-vault script accepts the following arguments:

  • version VERSION: Install Vault version VERSION. Optional if download-url is provided.
  • download-url URL: Install the Vault package hosted in this url. Optional if version is provided.
  • path DIR: Install Vault into folder DIR. Optional.
  • user USER: The install dirs will be owned by user USER. Optional.

Example:

install-vault --version 0.10.4

How it works

The install-vault script does the following:

  1. Creates a user and folders for Vault
  2. Installs Vault binaries and scripts
  3. Configures mlock
  4. Follow-up tasks

Creates a user and folders for Vault

Creates an OS user named vault. Creates the following folders, all owned by user vault:

  • /opt/vault: base directory for Vault data (configurable via the --path argument).
  • /opt/vault/bin: directory for Vault binaries.
  • /opt/vault/data: directory where the Vault agent can store state.
  • /opt/vault/config: directory where the Vault agent looks up configuration.
  • /opt/vault/log: directory where the Vault agent will store log files.
  • /opt/vault/tls: directory where the Vault will look for TLS certs.

Installs Vault binaries and scripts

Installs the following:

  • vault: Either downloads the Vault zip file from the downloads page (the version number is configurable via the --version argument) , or a package hosted on a precise url configurable with --dowload-url (useful for installing Vault Enterprise, for example), and extracts the vault binary into /opt/vault/bin. Adds a symlink to the vault binary in /usr/local/bin.
  • run-vault: Copies the run-vault script into /opt/vault/bin.

Configures mlock

Gives Vault permissions to make the mlock (memory lock) syscall. This syscall is used to prevent the OS from swapping Vault's memory to disk. For more info, see: https://www.vaultproject.io/docs/configuration/#disable_mlock.

Follow-up tasks

After the install-vault script finishes running, you may wish to do the following:

  1. If you have custom Vault config (.hcl) files, you may want to copy them into the config directory (default: /opt/vault/config).
  2. If /usr/local/bin isn't already part of PATH, you should add it so you can run the vault command without specifying the full path.

Dependencies

The install script assumes that systemd is already installed. We use it as a cross-platform supervisor to ensure Vault is started whenever the system boots and restarted if the Vault process crashes. Additionally, it is used to store all logs which can be accessed using journalctl.

Why use Git to install this code?

We needed an easy way to install these scripts that satisfied a number of requirements, including working on a variety of operating systems and supported versioning. Our current solution is to use git, but this may change in the future. See Package Managers for a full discussion of the requirements, trade-offs, and why we picked git.

You can’t perform that action at this time.