c12s-kubespray/roles/vault/tasks/main.yml

---
# The Vault role is typically a two step process:
# 1. Bootstrap
#    This starts a temporary Vault to generate certs for Vault itself. This
#    includes a Root CA for the cluster, assuming one doesn't exist already.
#    The temporary instance will remain running after Bootstrap, to provide a
#    running Vault for the Etcd role to generate certs against.
# 2. Cluster
#    Once Etcd is started, then the Cluster tasks can start up a long-term
#    Vault cluster using Etcd as the backend. The same Root CA is mounted as
#    used during step 1, allowing all certs to have the same chain of trust.

## Bootstrap
- include_tasks: bootstrap/main.yml
  when: cert_management == 'vault' and vault_bootstrap | d()

## Cluster
- include_tasks: cluster/main.yml
  when: cert_management == 'vault' and not vault_bootstrap | d()
Adding the Vault role 2017-01-13 20:31:10 +00:00			`---`
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`# The Vault role is typically a two step process:`
			`# 1. Bootstrap`
			`# This starts a temporary Vault to generate certs for Vault itself. This`
			`# includes a Root CA for the cluster, assuming one doesn't exist already.`
			`# The temporary instance will remain running after Bootstrap, to provide a`
			`# running Vault for the Etcd role to generate certs against.`
			`# 2. Cluster`
			`# Once Etcd is started, then the Cluster tasks can start up a long-term`
			`# Vault cluster using Etcd as the backend. The same Root CA is mounted as`
			`# used during step 1, allowing all certs to have the same chain of trust.`
Adding the Vault role 2017-01-13 20:31:10 +00:00
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`## Bootstrap`
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible. 2018-01-29 11:37:48 +00:00			`- include_tasks: bootstrap/main.yml`
Disable vault role properly on ansible 2.2.0 when condition does not seem to work correctly at playbook level for ansible 2.2.0. 2017-03-03 13:33:00 +00:00			`when: cert_management == 'vault' and vault_bootstrap \| d()`
Adding the Vault role 2017-01-13 20:31:10 +00:00
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`## Cluster`
Use include/import tasks (#2192) import_tasks will consume far less memory, so it should be used whenever it is compatible. 2018-01-29 11:37:48 +00:00			`- include_tasks: cluster/main.yml`
Disable vault role properly on ansible 2.2.0 when condition does not seem to work correctly at playbook level for ansible 2.2.0. 2017-03-03 13:33:00 +00:00			`when: cert_management == 'vault' and not vault_bootstrap \| d()`