itamae/cookbooks/vault/install.rb

# apt source:
SRC = 'https://apt.releases.hashicorp.com/gpg'
DEST = '/usr/share/keyrings/hashicorp-archive-keyring.gpg'

execute "wget -O- #{SRC} | gpg --dearmor -o #{DEST}" do
  not_if "test -e #{DEST}"
end

# Retrieve the Ubuntu code:
DIST = run_command('lsb_release -cs 2>/dev/null').stdout.chomp

# Deploy the `apt` sources:
template '/etc/apt/sources.list.d/hashicorp.list' do
  action :create
  variables(distribution: DIST)

  owner 'root'
  group 'root'
end

execute 'apt update' do
  not_if 'which vault'
end

package 'vault'