HashiCorp Vault HA (Docker cluster)

OSS

Production HashiCorp Vault HA cluster across N nodes running the official hashicorp/vault Docker image with integrated Raft storage. Each node runs one container managed by a dedicated systemd unit (vault-docker.service); followers auto-join via retry_join, and optional first-run auto-init + persistent auto-unseal keep the cluster unsealed across reboots.

by opensible ✓· ⬇ 0 installs· Security & Secrets· v1.0.0· template vault-cluster

#vault #hashicorp #secrets #docker #cluster #ha #raft

Use in the OpenSible console

Open Infrastructure → Stack Hub Blueprints, switch the source to Cloud hub, then pick HashiCorp Vault HA (Docker cluster) and press Use.

View source

Requirements

ansible >=2.14

Default variables

defaults.json

{
  "ui": true,
  "nodes": [
    {
      "ip": "",
      "name": "vault-1",
      "ssh_port": "",
      "ssh_user": ""
    },
    {
      "ip": "",
      "name": "vault-2",
      "ssh_port": "",
      "ssh_user": ""
    },
    {
      "ip": "",
      "name": "vault-3",
      "ssh_port": "",
      "ssh_user": ""
    }
  ],
  "become": true,
  "api_port": 8200,
  "data_dir": "/var/lib/vault-data",
  "auto_init": true,
  "log_level": "info",
  "cluster_id": "opensible-vault",
  "api_address": "",
  "tls_disable": true,
  "cluster_port": 8201,
  "tls_key_file": "/etc/vault/tls/tls.key",
  "disable_mlock": true,
  "open_firewall": true,
  "tls_cert_file": "/etc/vault/tls/tls.crt",
  "vault_version": "1.18.1",
  "cluster_address": "",
  "health_http_port": 8280,
  "ssh_port_default": 22,
  "ssh_user_default": "root",
  "health_http_enabled": true
}

vars.example.yml

# Example vars for vault-cluster
cluster_id: opensible-vault
vault_version: "1.18.1"

# 3 or 5 nodes recommended for real Raft HA. First node bootstraps the cluster.
nodes:
  - { name: vault-1, ip: 10.0.0.11, ssh_user: root, ssh_port: 22 }
  - { name: vault-2, ip: 10.0.0.12, ssh_user: root, ssh_port: 22 }
  - { name: vault-3, ip: 10.0.0.13, ssh_user: root, ssh_port: 22 }

api_port: 8200
cluster_port: 8201

# Dev only — set to false and provide certs to enable TLS.
tls_disable: true
tls_cert_file: /etc/vault/tls/tls.crt
tls_key_file: /etc/vault/tls/tls.key

data_dir: /var/lib/vault-data
ui: true
disable_mlock: true
log_level: info

# Auto-init on the first node, distribute unseal keys, install
# vault-autounseal.service + .timer on every node.
auto_init: true

open_firewall: true
become: true

Versions (1)

v1.0.0playbook.yml