Documentation

hashivault_token_create - Hashicorp Vault token create module

New in version 3.3.0.

Synopsis

  • Module to create tokens in Hashicorp Vault.

Parameters

Parameter Choices/Defaults Comments
authtype Default:
token
authentication type to use: token, userpass, github, ldap, approle
ca_cert Default:
to environment variable VAULT_CACERT
path to a PEM-encoded CA cert file to use to verify the Vault server TLS certificate
ca_path Default:
to environment variable VAULT_CAPATH
path to a directory of PEM-encoded CA cert files to verify the Vault server TLS certificate : if ca_cert is specified, its value will take precedence
client_cert Default:
to environment variable VAULT_CLIENT_CERT
path to a PEM-encoded client certificate for TLS authentication to the Vault server
client_key Default:
to environment variable VAULT_CLIENT_KEY
path to an unencrypted PEM-encoded private key matching the client certificate
display_name
A display name to associate with this token
explicit_max_ttl
An explicit maximum lifetime for the token
id
The token value that clients will use to authenticate with vault
lease
If specified, the lease time will be this value. (e.g. 1h)
metadata
Metadata to associate with the token
no_default_policy Default:
no
If specified, the token will not have the "default" policy included in its policy set
no_parent
If specified, the token will have no parent
num_uses
The number of times this token can be used until it is automatically revoked
orphan
If specified, the token will have no parent. Only This prevents the new token from being revoked with your token.
password Default:
to environment variable VAULT_PASSWORD
password to login to vault.
period
If specified, every renewal will use the given period. Periodic tokens do not expire (unless explicit_max_ttl is also provided).
policies
List of Policy to associate with this token.
renewable
Whether or not the token is renewable to extend its TTL up to Vault's configured maximum TTL for tokens
role
If set, the token will be created against the named role
token Default:
to environment variable VAULT_TOKEN
token for vault
ttl
Initial TTL to associate with the token; renewals can extend this value.
url Default:
to environment variable VAULT_ADDR
url for vault
username Default:
to environment variable VAULT_USER
username to login to vault.
verify Default:
to environment variable VAULT_SKIP_VERIFY
if set, do not verify presented TLS certificate before communicating with Vault server : setting this variable is not recommended except during testing
wrap_ttl
Indicates that the response should be wrapped in a cubbyhole token with the requested TTL.

Examples

---
- hosts: localhost
  tasks:
    - name: "Create a {{admin_name}} token, and stop using root token"
      hashivault_token_create:
        display_name: "{{admin_name}}"
        policies: ["{{admin_name}}"]
        renewable: True
        token: "{{vault_root_token}}"
      register: "vault_token_admin"

Status

Author

  • UNKNOWN

Hint

If you notice any issues in this documentation you can edit this document to improve it.