97_vault-unseal.yml

---
- name: "AT Computing - HashiCorp Demo - Vault"
  hosts: servers
  become: true

  vars_files:
    - vars/hashicorp/general.yml
    - vars/hashicorp/vault.yml
    - vars/hashicorp/ssl.yml

  tasks:
    - name: Check the Vault sealed status.
      ansible.builtin.shell: "{{ vault_binary }} status | grep -i sealed | awk '{print $2}'"
      environment:
        VAULT_ADDR: "{{ vault_address }}"
        VAULT_CACERT: "{{ vault_ssl_ca_dest }}"
        VAULT_SKIP_VERIFY: "true"
      changed_when: false
      register: vault_is_sealed

    - name: Unseal
      block:
        - name: "HashiCorp - Vault : Retrieve local token file."
          ansible.builtin.set_fact:
            token_file_output: "{{ lookup('file', vault_bootstrap_init_local_path).split('\n') }}"
          delegate_to: localhost
          run_once: true

        - name: "HashiCorp - Vault : Retrieve first unseal key from initialization info."
          ansible.builtin.set_fact:
            vault_unseal_key_1: "{{ token_file_output[0].split('Unseal Key 1: ')[1] }}"
          delegate_to: localhost
          run_once: true

        - name: "HashiCorp - Vault : Retrieve second unseal key from initialization info."
          ansible.builtin.set_fact:
            vault_unseal_key_2: "{{ token_file_output[1].split('Unseal Key 2: ')[1] }}"
          delegate_to: localhost
          run_once: true

        - name: "HashiCorp - Vault : Retrieve third unseal key from initialization info."
          ansible.builtin.set_fact:
            vault_unseal_key_3: "{{ token_file_output[2].split('Unseal Key 3: ')[1] }}"
          delegate_to: localhost
          run_once: true

        - name: "HashiCorp - Vault : Ensure the Vault is unsealed."
          ansible.builtin.command: "vault operator unseal {{ item }}"
          changed_when: false
          environment:
            VAULT_ADDR: "{{ vault_address }}"
            VAULT_CACERT: "{{ vault_ssl_ca_dest }}"
            VAULT_SKIP_VERIFY: "true"
          no_log: true
          with_items:
            - "{{ vault_unseal_key_1 }}"
            - "{{ vault_unseal_key_2 }}"
            - "{{ vault_unseal_key_3 }}"
      when:
        - vault_is_sealed.stdout == "true"