hcp-ansible/playbooks/tasks/vault/vault_control_plane.yml

---
- name: "Vault control plane"
  block:
    - name: "Vault | Create consul token for service registration"
      when:
        - vault_init_server
        - enable_consul
        - vault_enable_service_registration
      vars:
        _consul_vault_sr_host: "{{ hostvars[groups['consul_servers'][0]].api_interface_address }}"
        _consul_vault_sr_port: "{{ hostvars[groups['consul_servers'][0]].consul_api_port[hostvars[groups['consul_servers'][0]].consul_api_scheme] }}"
        _consul_vault_sr_scheme: "{{ hostvars[groups['consul_servers'][0]].consul_api_scheme }}"
      block:
        - name: "Vault | Create consul vault policy"
          community.general.consul_policy:
            token: "{{ _credentials.consul.root_token.secret_id }}"
            host: "{{ _consul_vault_sr_host }}"
            port: "{{ _consul_vault_sr_port }}"
            scheme: "{{ _consul_vault_sr_scheme }}"
            validate_certs: false
            state: present
            name: vault-policy
            rules: "{{ vault_service_registration_policy }}"
          register: _consul_vault_policy

        - name: "Vault | Create consul vault token" # noqa: no-handler
          community.general.consul_token:
            token: "{{ _credentials.consul.root_token.secret_id }}"
            host: "{{ _consul_vault_sr_host }}"
            port: "{{ _consul_vault_sr_port }}"
            scheme: "{{ _consul_vault_sr_scheme }}"
            validate_certs: false
            accessor_id: "{{ _credentials.consul.tokens.vault.accessor_id }}"
            secret_id: "{{ _credentials.consul.tokens.vault.secret_id }}"
            policies:
              - id: "{{ _consul_vault_policy.policy.ID }}"
            state: present
          when: _consul_vault_policy.changed

    - name: "Vault | Stat vault secret file"
      ansible.builtin.stat:
        path: "{{ hashistack_sub_configuration_directories.secrets }}/vault.yml"
      register: _vault_needs_early_unseal

    - name: "Include ednz_cloud.hashistack.vault"
      ansible.builtin.include_role:
        name: ednz_cloud.hashistack.vault
      vars:
        vault_enable_auto_unseal: true
        vault_unseal_url: "{{ vault_configuration['api_addr'] }}"
        vault_unseal_tls_verify: false
        vault_unseal_keys: "{{ _credentials.vault['keys'] | default([]) }}"

    - name: "Vault | Initialize vault cluster" # noqa: run-once[task]
      ednz_cloud.hashistack.vault_init:
        api_url: "{{ vault_configuration['api_addr'] }}"
        tls_verify: false
        key_shares: "{{ vault_seal_configuration['key_shares'] }}"
        key_threshold: "{{ vault_seal_configuration['key_threshold'] }}"
      retries: 5
      delay: 5
      register: _vault_init_secret
      until: not _vault_init_secret.failed
      when: vault_init_server

    - name: "Vault | Write vault configuration to file" # noqa: run-once[task] no-handler
      ansible.builtin.copy:
        content: "{{ _vault_init_secret.state | to_nice_yaml(indent=2) }}"
        dest: "{{ hashistack_sub_configuration_directories.secrets }}/vault.yml"
        owner: "{{ lookup('env', 'USER') }}"
        group: "{{ lookup('env', 'USER') }}"
        mode: "0644"
      when:
        - vault_init_server
        - _vault_init_secret.changed
      delegate_to: localhost

    - name: "Load vault cluster variables necessary for unseal operation"
      ansible.builtin.import_role:
        name: ednz_cloud.hashistack.hashistack
      vars:
        hashistack_only_load_credentials: true

    - name: "Vault | Unseal the bootstrap node" # noqa: run-once[task] no-handler
      ednz_cloud.hashistack.vault_unseal:
        api_url: "{{ vault_configuration['api_addr'] }}"
        tls_verify: false
        key_shares: "{{ _credentials.vault['keys'] }}"
      when:
        - vault_init_server
        - _vault_init_secret.changed
      register: _vault_unseal_secret

    - name: "Vault | Unseal all vault nodes"
      ednz_cloud.hashistack.vault_unseal:
        api_url: "{{ vault_configuration['api_addr'] }}"
        tls_verify: false
        key_shares: "{{ _credentials.vault['keys'] }}"
      retries: 5
      delay: 5
      until: _unseal_status.changed or not _unseal_status.failed
      register: _unseal_status