--- # hashistack deployment playbook - name: "Deploy" hosts: all gather_facts: true become: true tasks: - name: "Include ednxzu.hashicorp_vault" ansible.builtin.include_role: name: ednxzu.hashistack.hashicorp_vault - name: "Initialize vault cluster" ednxzu.hashistack.vault_init: api_url: "http://127.0.0.1:8200" key_shares: 3 key_threshold: 2 run_once: true delegate_to: "{{ groups['vault_servers'] | first }}" register: _vault_init_secret - name: "Write vault configuration to file" ansible.builtin.copy: content: "{{ _vault_init_secret.state | to_nice_yaml}}" dest: "{{ configuration_directory }}/vault/vault_config" mode: '0644' when: _vault_init_secret.changed run_once: true delegate_to: localhost - name: "Load vault cluster variables necessary for unseal operation" ansible.builtin.include_vars: file: "{{ configuration_directory }}/vault/vault_config" name: _vault_cluster_config - name: "Unseal the bootstrap node" ednxzu.hashistack.vault_unseal: api_url: "http://127.0.0.1:8200" key_shares: "{{ _vault_cluster_config['keys'] }}" max_retries: "{{ (_vault_cluster_config['keys'] | length) - 1 }}" run_once: true delegate_to: "{{ groups['vault_servers'] | first }}" when: _vault_init_secret.changed - name: "Unseal all vault nodes" ednxzu.hashistack.vault_unseal: api_url: "http://127.0.0.1:8200" key_shares: "{{ _vault_cluster_config['keys'] }}" max_retries: "{{ (_vault_cluster_config['keys'] | length) - 1 }}" - name: "Debug" ansible.builtin.debug: msg: "{{ _vault_cluster_config }}"