If Create Vault upstart configuration would be run then it will work on centos7 as well.

In order to implement support for centos7 the when attributes of the two Create Vault systemd configuration have to be adjusted.

As per the 0.6.1 and 0.6.2 changelogs, HA is disabled by default for DynamoDB and etcd backends.

For upgrading DynamoDB it is extremely important to enable HA before upgrading if it is in use. The same goes for etcd now with 0.6.2.

Recommending adding a etcd_ha_enabled and dynamodb_ha_enabled option for their respective backend configs, defaulting to false.

Although the version is greater than the installed one, a newer version is not downloaded.

TASK [kbrebanov.vault : Download Vault] *****************************************************************
ok: [localhost]

TASK [kbrebanov.vault : Remove Vault files if version is different] *************************************
changed: [localhost] => (item=/usr/local/bin/vault)

TASK [kbrebanov.vault : Unzip Vault to installation directory] ******************************************
changed: [localhost]

When increasing the vault version on subsequent runs, ansible-vault will download the new version and unzip it correctly but will fail silently when trying to move it to vault_install_dir

In order to use mlock you need to be root, but by default the role sets disable_mlock to false but tries to run vault as the vault user/group in the upstart template, which prevents vault from starting (Ubuntu 12.04):

Error initializing core: Failed to lock memory: cannot allocate memory

This usually means that the mlock syscall is not available.
Vault uses mlock to prevent memory from being swapped to
disk. This requires root privileges as well as a machine
that supports mlock. Please enable mlock on your system or
disable Vault from using it. To disable Vault from using it,
set the `disable_mlock` configuration option in your configuration
file.

Setting vault_user and vault_group to root created system accounts called root, which broke the world.

Suggest that by:

• Default vault is run as root
• Don't try and create user and group if set to root
• If user != root set disable_mlock: true