API Address Configuration

[micchickenburger]

May 15 21:51:01 RHSSRV01 vault[1417]: ==> Vault server configuration:
May 15 21:51:01 RHSSRV01 vault[1417]:                      Cgo: disabled
May 15 21:51:01 RHSSRV01 vault[1417]:               Listener 1: tcp (addr: "127.0.0.1:8200", cluster address: "127.0.0.1:8201", max_request_duration: "1m30s", max_request_size: "33554432", tls: "disabled")
May 15 21:51:01 RHSSRV01 vault[1417]:                Log Level: info
May 15 21:51:01 RHSSRV01 vault[1417]:                    Mlock: supported: true, enabled: true
May 15 21:51:01 RHSSRV01 vault[1417]:            Recovery Mode: false
May 15 21:51:01 RHSSRV01 vault[1417]:                  Storage: file
May 15 21:51:01 RHSSRV01 vault[1417]:                  Version: Vault v1.4.1
May 15 21:51:01 RHSSRV01 vault[1417]: ==> Vault server started! Log data will stream in below:
May 15 21:51:01 RHSSRV01 vault[1417]: 2020-05-15T21:50:59.505Z [INFO]  proxy environment: http_proxy= https_proxy= no_proxy=
May 15 21:51:01 RHSSRV01 vault[1417]: 2020-05-15T21:50:59.520Z [WARN]  no `api_addr` value specified in config or in VAULT_API_ADDR; falling back to detection if possible, but this value should be manually set

Setting api_addr seems to be best practice and could help cleanup the ansible vault configuration, which uses an environment variable before each command; that approach could be unnecessary with this simple change.

[micchickenburger]

From https://learn.hashicorp.com/vault/operations/ops-deployment-guide:

The api_addr parameter configures the API address used in high availability scenarios, when client redirection is used instead of request forwarding. Client redirection is the fallback method used when request forwarding is turned off or there is an error performing the forwarding. As such, a redirect address is always required for all HA setups.

This parameter value defaults to the address specified in the listener stanza, but Vault will log a [WARN] message if it is not explicitly configured.

After making the change the warning goes away but CLI doesn't default to this value, so no shortcuts for ansible shell commands, unfortunately.