- Removed gitlink entries for consul_template-legacy and consul_template-org
- Converted from git submodules to regular directories
- Fixes: 'fatal: No url found for submodule path' error when downloading module
- Required for using module with git::https:// source in parent modules
- Removed provider blocks for Vault and Ansible from provider.tf
- Module now accepts provider configuration from parent module
- Updated Vault provider version from ~> 4.0 to ~> 5.3 for compatibility
- Fixes: Module is incompatible with count, for_each, and depends_on error
- Remove ansible/ from .gitignore
- Add vault_agent role (copied from terraform-vsphere-infra)
- Add vault_agent-playbook.yml for deployment
- Include ansible collections (cloud.terraform, ansible.posix, etc.)
- Archive consul_template role as consul_template-legacy
The ansible directory contains the vault-agent deployment automation
that replaces the legacy consul-template approach.
- Fix ansible_host resource: use 'name' and 'variables' instead of 'inventory_hostname' and 'vars'
- Add missing Vault authentication variables: role_id and secret_id
- Update CI/CD pipeline to provide dummy auth variables for validation
- Run terraform fmt
- Migrated Ansible integration from consul_template to vault_agent
- Copied vault_agent role from terraform-vsphere-infra module
- Created vault_agent-playbook.yml for deployment
- Archived consul_template role as consul_template-legacy
- Updated Terraform configuration:
- Changed Ansible inventory group from consul_template to vault_agent
- Added vault_secret_path variable for vault-agent
- Added ssl_certs_dir and ssl_private_dir variables
- Formatted all Terraform files
- Implemented CI/CD pipeline:
- Created .gitea/workflows/pipeline.yaml
- Added TFLint, Tfsec, and Checkov security scans
- Added Terraform validate step
- Added SonarQube integration
- Created sonar-project.properties
- Documentation updates:
- Updated README.md with vault-agent information
- Added migration section comparing consul-template vs vault-agent
- Updated CLAUDE.md with vault-agent architecture
- Added vault-agent configuration examples
Why vault-agent over consul-template:
- Full AppRole support with role_id/secret_id files
- Advanced token auto-renewal with auto_auth
- Better credential security (separate files vs config)
- Actively developed by HashiCorp
Note: The ansible/ directory changes (vault_agent role and playbook) are
not committed as the directory is in .gitignore. These files exist locally
and will be deployed during Ansible runs.
