3 ms·
I unseal using ansible (with the unseal keys in ansible-vault) and automate the configuration fully through ansible. For example you can use the ansible expect
by lolbrish 9y ago
I unseal using ansible (with the unseal keys in ansible-vault) and automate the configuration fully through ansible. For example you can use the ansible expect module:
- name: unseal 1
expect:
command: '/usr/bin/vault unseal'
responses:
'Key \(will be hidden\): ': "{{vault_seal_key_1}}"
echo: yes
when: vault_sealed_result.rc == 2 and vault_seal_key_1 is defined
tags:
unseal
- bogomipz 9y agoI'm interested in your solution, you are using ansible-vault to store the Hashicorp Vault unseal key(s)? Isn't this just pushing the problem out another level or am I missing something? Thanks.