Ceph Configuration for Agent-Based SSE-S3

>> roles/ceph-sse-s3/ceph-rgw/tasks/main.yml
---
- name: Gather facts
  setup:

- name: Add HashiCorp GPG key
  ansible.builtin.shell: "curl -fsSL https://apt.releases.hashicorp.com/gpg | gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg"

- name: Add HashiCorp APT repository
  ansible.builtin.apt_repository:
    repo: "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com {{ ansible_facts['lsb']['codename'] }} main"
    state: present

- name: Update APT cache
  ansible.builtin.apt:
    update_cache: yes

- name: Install Vault agent
  apt:
    name: vault
    state: present

- name: Create Vault agent configuration
  template:
    src: vault-agent.hcl.j2
    dest: /etc/vault-agent.hcl

- name: Save Role ID to file
  copy:
    content: "{{ hostvars['jupddvult001'].role_id.stdout }}"
    dest: /etc/vault-agent.d/role_id

- name: Save Secret ID to file
  copy:
    content: "{{ hostvars['jupddvult001'].secret_id.stdout }}"
    dest: /etc/vault-agent.d/secret_id

- name: Start Vault agent
  systemd:
    name: vault-agent
    enabled: yes
    state: started
    daemon_reload: yes
    exec_start: /usr/bin/vault agent -config=/etc/vault-agent.hcl

- name: Retrieve Encryption Key ID from Vault
  command: vault read -field=key_id transit/keys/s3-key
  register: vault_key_id
  environment:
    VAULT_ADDR: "{{ hostvars['jupddvult001'].vault_addr }}"
    VAULT_TOKEN: "{{ hostvars['jupddvult001'].vault_token }}"

- name: Set Encryption Key ID
  set_fact:
    encryption_key_id: "{{ vault_key_id.stdout }}"

- name: Configure Ceph RGW to use Vault for SSE
  shell: |
    ceph config set client.rgw crypt vault addr {{ hostvars['jupddvult001'].vault_addr }}
    ceph config set client.rgw crypt vault auth method agent
    ceph config set client.rgw crypt vault key name s3-key
    ceph config set client.rgw crypt vault encryption key id {{ encryption_key_id }}
  notify: restart ceph-rgw

- name: Restart Ceph RGW
  shell: ceph orch restart rgw