diff --git a/modules/install-vault/install-vault b/modules/install-vault/install-vault index e1564049..0904b43e 100755 --- a/modules/install-vault/install-vault +++ b/modules/install-vault/install-vault @@ -156,6 +156,7 @@ function create_vault_install_paths { sudo mkdir -p "$path/data" sudo mkdir -p "$path/tls" sudo mkdir -p "$path/scripts" + sudo mkdir -p "$path/raft" sudo chmod 755 "$path" sudo chmod 755 "$path/bin" sudo chmod 755 "$path/data" diff --git a/modules/run-vault/run-vault b/modules/run-vault/run-vault index c7982409..521e2c00 100755 --- a/modules/run-vault/run-vault +++ b/modules/run-vault/run-vault @@ -47,6 +47,8 @@ function print_usage { echo -e " --enable-dynamo-backend\tIf this flag is set, DynamoDB will be enabled as the backend storage (HA)" echo -e " --dynamo-region\tSpecifies the AWS region where --dynamo-table lives. Only used if '--enable-dynamo-backend is on'" echo -e " --dynamo--table\tSpecifies the DynamoDB table to use for HA Storage. Only used if '--enable-dynamo-backend is on'" + echo -e " --enable-raft-backend\tIf this flag is set, Vault's Integrated Storage will be enabled as the backend storage (HA)" + echo -e " --raft-dir\t\tSpecifies the path to store Vault's Integrated Storage data. Optional. Default is the absolute path of '../raft', relative to this script." echo echo "Options for Vault Agent:" echo @@ -244,6 +246,8 @@ function generate_vault_config { local -r auto_unseal_kms_key_id="${16}" local -r auto_unseal_kms_key_region="${17}" local -r auto_unseal_endpoint="${18}" + local -r enable_raft_backend="${19}" + local -r raft_dir="${20}" local -r config_path="$config_dir/$VAULT_CONFIG_FILE" local instance_ip_address @@ -301,8 +305,19 @@ EOF dynamodb_storage_type="ha_storage" fi + if [[ "$enable_raft_backend" == "true" ]]; then + vault_storage_backend=$(cat <