community.hashi_vault.vault_pki_generate_certificate module – Generates a new set of credentials (private key and certificate) using HashiCorp Vault PKI

Note

This module is part of the community.hashi_vault collection (version 3.1.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.hashi_vault.

To use it in a playbook, specify: community.hashi_vault.vault_pki_generate_certificate.

New in version 2.3.0: of community.hashi_vault

Synopsis
Requirements
Parameters
See Also
Examples
Return Values

Synopsis 

Generates a new set of credentials (private key and certificate) based on a Vault PKI role.

Requirements 

The below requirements are needed on the host that executes this module.

hvac (Python library) version 0.9.1 or higher
For detailed requirements, see the collection requirements page.

Parameters 

Parameter	Comments
alt_names list / elements=string	Specifies requested Subject Alternative Names. These can be host names or email addresses; they will be parsed into their respective fields. If any requested names do not match role policy, the entire request will be denied.
auth_method string	Authentication method to be used. `none` auth method was added in collection version `1.2.0`. `cert` auth method was added in collection version `1.4.0`. `aws_iam_login` was renamed `aws_iam` in collection version `2.1.0` and was removed in `3.0.0`. Choices: token ← (default) userpass ldap approle aws_iam jwt cert kubernetes none
aws_access_key aliases: aws_access_key_id string	The AWS access key to use.
aws_iam_server_id string added in 0.2.0 of community.hashi_vault	If specified, sets the value to use for the `X-Vault-AWS-IAM-Server-ID` header as part of `GetCallerIdentity` request.
aws_profile aliases: boto_profile string	The AWS profile
aws_secret_key aliases: aws_secret_access_key string	The AWS secret key that corresponds to the access key.
aws_security_token string	The AWS security token if using temporary access and secret keys.
ca_cert aliases: cacert string	Path to certificate to use for authentication. If not specified by any other means, the `VAULT_CACERT` environment variable will be used.
cert_auth_private_key path added in 1.4.0 of community.hashi_vault	For `cert` auth, path to the private key file to authenticate with, in PEM format.
cert_auth_public_key path added in 1.4.0 of community.hashi_vault	For `cert` auth, path to the certificate file to authenticate with, in PEM format.
common_name string / required	Specifies the requested CN for the certificate. If the CN is allowed by role policy, it will be issued.
engine_mount_point string	Specify the mount point used by the PKI engine. Defaults to the default used by `hvac`.
exclude_cn_from_sans boolean	If true, the given common_name will not be included in DNS or Email Subject Alternate Names (as appropriate). Useful if the CN is not a hostname or email address, but is instead some human-readable identifier. Choices: no ← (default) yes
format string	Specifies the format for returned data. Can be `pem`, `der`, or `pem_bundle`. If `der`, the output is base64 encoded. If `pem_bundle`, the `certificate` field will contain the private key and certificate, concatenated. If the issuing CA is not a Vault-derived self-signed root, this will be included as well. Choices: pem ← (default) der pem_bundle
ip_sans list / elements=string	Specifies requested IP Subject Alternative Names. Only valid if the role allows IP SANs (which is the default).
jwt string	The JSON Web Token (JWT) to use for JWT authentication to Vault.
kubernetes_token string added in 2.5.0 of community.hashi_vault	The Kubernetes Token (JWT) to use for Kubernetes authentication to Vault.
kubernetes_token_path string added in 2.5.0 of community.hashi_vault	If no kubernetes_token is specified, will try to read the token from this path. Default: “/var/run/secrets/kubernetes.io/serviceaccount/token”
mount_point string	Vault mount point. If not specified, the default mount point for a given auth method is used. Does not apply to token authentication.
namespace string	Vault namespace where secrets reside. This option requires HVAC 0.7.0+ and Vault 0.11+. Optionally, this may be achieved by prefixing the authentication mount point and/or secret path with the namespace (e.g `mynamespace/secret/mysecret`). If environment variable `VAULT_NAMESPACE` is set, its value will be used last among all ways to specify namespace.
other_sans list / elements=string	Specifies custom OID/UTF8-string SANs. These must match values specified on the role in `allowed_other_sans`. The format is the same as OpenSSL: `<oid>;<type>:<value>` where the only current valid type is `UTF8`.
password string	Authentication password.
private_key_format string	Specifies the format for marshaling the private key. Defaults to `der` which will return either base64-encoded DER or PEM-encoded DER, depending on the value of format. The other option is `pkcs8` which will return the key marshalled as PEM-encoded PKCS8. Choices: der ← (default) pkcs8
proxies any added in 1.1.0 of community.hashi_vault	URL(s) to the proxies used to access the Vault service. It can be a string or a dict. If it’s a dict, provide the scheme (eg. `http` or `https`) as the key, and the URL as the value. If it’s a string, provide a single URL that will be used as the proxy for both `http` and `https` schemes. A string that can be interpreted as a dictionary will be converted to one (see examples). You can specify a different proxy for HTTP and HTTPS resources. If not specified, environment variables from the Requests library are used.
region string	The AWS region for which to create the connection.
retries any added in 1.3.0 of community.hashi_vault	Allows for retrying on errors, based on the Retry class in the urllib3 library. This collection defines recommended defaults for retrying connections to Vault. This option can be specified as a positive number (integer) or dictionary. If this option is not specified or the number is `0`, then retries are disabled. A number sets the total number of retries, and uses collection defaults for the other settings. A dictionary value is used directly to initialize the `Retry` class, so it can be used to fully customize retries. For detailed information on retries, see the collection User Guide.
retry_action string added in 1.3.0 of community.hashi_vault	Controls whether and how to show messages on retries. This has no effect if a request is not retried. Choices: ignore warn ← (default)
role_id string	Vault Role ID or name. Used in `approle`, `aws_iam`, and `cert` auth methods. For `cert` auth, if no role_id is supplied, the default behavior is to try all certificate roles and return any one that matches.
role_name string / required	Specifies the name of the role to create the certificate against.
secret_id string	Secret ID to be used for Vault AppRole authentication.
timeout integer added in 1.3.0 of community.hashi_vault	Sets the connection timeout in seconds. If not set, then the `hvac` library’s default is used.
token string	Vault token. Token may be specified explicitly, through the listed [env] vars, and also through the `VAULT_TOKEN` env var. If no token is supplied, explicitly or through env, then the plugin will check for a token file, as determined by token_path and token_file. The order of token loading (first found wins) is `token param -> ansible var -> ANSIBLE_HASHI_VAULT_TOKEN -> VAULT_TOKEN -> token file`.
token_file string	If no token is specified, will try to read the token from this file in token_path. Default: “.vault-token”
token_path string	If no token is specified, will try to read the token_file from this path.
token_validate boolean added in 0.2.0 of community.hashi_vault	For token auth, will perform a `lookup-self` operation to determine the token’s validity before using it. Disable if your token does not have the `lookup-self` capability. The default value is `true`. The default value will change to `false` in version 4.0.0. Choices: no yes
ttl string	Specifies requested Time To Live. Cannot be greater than the role’s `max_ttl` value. If not provided, the role’s `ttl` value will be used. Note that the role values default to system values if not explicitly set.
uri_sans list / elements=string	Specifies the requested URI Subject Alternative Names.
url string	URL to the Vault service. If not specified by any other means, the value of the `VAULT_ADDR` environment variable will be used. If `VAULT_ADDR` is also not defined then an error will be raised.
username string	Authentication user name.
validate_certs boolean	Controls verification and validation of SSL certificates, mostly you only want to turn off with self signed ones. Will be populated with the inverse of `VAULT_SKIP_VERIFY` if that is set and validate_certs is not explicitly provided. Will default to `true` if neither validate_certs or `VAULT_SKIP_VERIFY` are set. Choices: no yes

Examples 

- name: Login and use the resulting token
  community.hashi_vault.vault_login:
    url: https://localhost:8200
    auth_method: ldap
    username: "john.doe"
    password: "{{ user_passwd }}"
  register: login_data

- name: Generate a certificate with an existing token
  community.hashi_vault.vault_pki_generate_certificate:
    role_name: test.example.org
    common_name: test.example.org
    ttl: 8760h
    alt_names:
      - test2.example.org
      - test3.example.org
    url: https://vault:8201
    auth_method: token
    token: "{{ login_data.login.auth.client_token }}"
  register: cert_data

- name: Display generated certificate
  debug:
    msg: "{{ cert_data.data.data.certificate }}"

Return Values 

Common return values are documented here, the following are the fields unique to this module:

Key	Description
data complex	Information about newly generated certificate Returned: success
data complex	Payload Returned: success
ca_chain list / elements=string	Linked list of CA certificates. Returned: success Sample: [”—–BEGIN CERTIFICATE—–…—–END CERTIFICATE—–“]
certificate string	Generated certificate. Returned: success Sample: “—–BEGIN CERTIFICATE—–…—–END CERTIFICATE—–”
issuing_ca string	CA certificate. Returned: success Sample: “—–BEGIN CERTIFICATE—–…—–END CERTIFICATE—–”
private_key string	Private key used to generate certificate. Returned: success Sample: “—–BEGIN RSA PRIVATE KEY—–…—–END RSA PRIVATE KEY—–”
private_key_type string	Private key algorithm. Returned: success Sample: “rsa”
serial_number string	Certificate’s serial number. Returned: success Sample: “39:dd:2e:90:b7:23:1f:8d:d3:7d:31:c5:1b:da:84:d0:5b:65:31:58”
lease_duration integer	Vault lease duration. Returned: success Sample: 21600
lease_id string	Vault lease attached to certificate. Returned: success Sample: “pki/issue/test/7ad6cfa5-f04f-c62a-d477-f33210475d05”
renewable boolean	True if certificate is renewable. Returned: success Sample: false
warning string	Warnings returned by Vault during generation. Returned: success

Authors

Florent David (@Ripolin)

Collection links

Issue Tracker Repository (Sources) Discussion, Q&A, troubleshooting Communication

community.hashi_vault.vault_pki_generate_certificate module – Generates a new set of credentials (private key and certificate) using HashiCorp Vault PKI

Synopsis

Requirements

Parameters

See Also

Examples

Return Values