Skip to content

Conversation

@khawarizmus
Copy link

@khawarizmus khawarizmus commented Nov 6, 2025

Currently using the role variables as such

vault_transit_tls_ca_cert: "vault-transit-ca-chain.crt"
vault_transit_tls_client_cert: "vault-autounseal.crt"
vault_transit_tls_client_key: "vault-autounseal.key"

Will totally ignore the values and will always yield the following config. the jinja template looks fine but the issue is that the variables are overridden by the defaults as you can see below

seal "transit" {
  //... stuff here
  
  // TLS Configuration
  tls_ca_cert        = "/etc/vault.d/tls/supporting-ca-chain.crt"
  tls_client_cert    = "/etc/vault.d/tls/autounseal_client_cert.pem"
  tls_client_key     = "/etc/vault.d/tls/autounseal_client_key.pem"
}

This pr fixes this

@khawarizmus khawarizmus changed the title fix: pass transit tls cert and key instead of hardcoded default fix: allow user defined tls variables to be set instead of hardcoded default values Nov 7, 2025
Copy link
Contributor

@lakrass lakrass left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changes itself lgtm! :)
Can you please reword your commit messages using conventional commits and rebase your branch? Then I'll approve the PR.

@khawarizmus
Copy link
Author

@lakrass I have done as requested. didn't realize that commit didn't follow convention.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants