c12s-kubespray/roles/vault/tasks/cluster/unseal.yml

---

- name: cluster/unseal | Current sealed state
  debug:
    msg: "Sealed? {{ vault_is_sealed }}"

- name: cluster/unseal | Unseal Vault
  hashivault_unseal:
    url: "https://localhost:{{ vault_port }}/"
    token: "{{ vault_root_token }}"
    ca_cert: "{{ vault_cert_dir }}/ca.pem"
    keys: "{{ item }}"
  no_log: true
  with_items: "{{ vault_unseal_keys|default([]) }}"
  notify: wait for vault up
  when: vault_is_sealed
Adding the Vault role 2017-01-13 20:31:10 +00:00			`---`

Fix vault setup partially (#1531) This does not address per-node certs and scheduler/proxy/controller-manager component certs which are now required. This should be handled in a follow-up patch. 2017-08-18 12:09:45 +00:00			`- name: cluster/unseal \| Current sealed state`
refactor vault role (#2733) * Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size 2018-05-11 16:11:38 +00:00			`debug:`
			`msg: "Sealed? {{ vault_is_sealed }}"`
Fix vault setup partially (#1531) This does not address per-node certs and scheduler/proxy/controller-manager component certs which are now required. This should be handled in a follow-up patch. 2017-08-18 12:09:45 +00:00
Adding the Vault role 2017-01-13 20:31:10 +00:00			`- name: cluster/unseal \| Unseal Vault`
refactor vault role (#2733) * Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size 2018-05-11 16:11:38 +00:00			`hashivault_unseal:`
			`url: "https://localhost:{{ vault_port }}/"`
			`token: "{{ vault_root_token }}"`
			`ca_cert: "{{ vault_cert_dir }}/ca.pem"`
			`keys: "{{ item }}"`
			`no_log: true`
Adding the Vault role 2017-01-13 20:31:10 +00:00			`with_items: "{{ vault_unseal_keys\|default([]) }}"`
refactor vault role (#2733) * Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size 2018-05-11 16:11:38 +00:00			`notify: wait for vault up`
Adding the Vault role 2017-01-13 20:31:10 +00:00			`when: vault_is_sealed`