c12s-kubespray/roles/vault/tasks/shared/pki_mount.yml

---

- name: shared/mount | Enable {{ pki_mount_path }} PKI mount
  hashivault_secret_enable:
    url: "{{ vault_leader_url }}"
    token: "{{ vault_root_token }}"
    ca_cert: "{{ vault_cert_dir }}/ca.pem"
    name: "{{ pki_mount_path }}"
    backend: "pki"
    config: "{{ pki_mount_options }}"
  register: secret_enable_result
  failed_when: 'secret_enable_result.rc !=0 and "existing mount" not in secret_enable_result.msg'
Vault security hardening and role isolation 2017-02-08 21:41:36 +00:00			`---`

refactor vault role (#2733) * Move front-proxy-client certs back to kube mount We want the same CA for all k8s certs * Refactor vault to use a third party module The module adds idempotency and reduces some of the repetitive logic in the vault role Requires ansible-modules-hashivault on ansible node and hvac on the vault hosts themselves Add upgrade test scenario Remove bootstrap-os tags from tasks * fix upgrade issues * improve unseal logic * specify ca and fix etcd check * Fix initialization check bump machine size 2018-05-11 16:11:38 +00:00			`- name: shared/mount \| Enable {{ pki_mount_path }} PKI mount`
			`hashivault_secret_enable:`
			`url: "{{ vault_leader_url }}"`
			`token: "{{ vault_root_token }}"`
			`ca_cert: "{{ vault_cert_dir }}/ca.pem"`
			`name: "{{ pki_mount_path }}"`
			`backend: "pki"`
			`config: "{{ pki_mount_options }}"`
			`register: secret_enable_result`
			`failed_when: 'secret_enable_result.rc !=0 and "existing mount" not in secret_enable_result.msg'`