Vault Configuration for Ceph SSE-S3

>> roles/ceph-sse-s3/vault/tasks/main.yml
---
- name: Set VAULT_ADDR and VAULT_TOKEN
  set_fact:
    vault_addr: "http://10.20.28.105:8200"
    vault_token: "hvs.No8JDWBSykjVrov5bjM6s4NP"

- name: Check if Transit Secrets Engine is enabled
  command: vault secrets list -format=json
  register: vault_secrets
  environment:
    VAULT_ADDR: "{{ vault_addr }}"
    VAULT_TOKEN: "{{ vault_token }}"

- name: Enable Transit Secrets Engine if not enabled
  command: vault secrets enable transit
  when: "'transit/' not in vault_secrets.stdout"
  environment:
    VAULT_ADDR: "{{ vault_addr }}"
    VAULT_TOKEN: "{{ vault_token }}"

- name: Check if Encryption Key is created
  command: vault list transit/keys
  register: vault_keys
  environment:
    VAULT_ADDR: "{{ vault_addr }}"
    VAULT_TOKEN: "{{ vault_token }}"

- name: Create Encryption Key if not exists
  command: vault write -f transit/keys/s3-key
  when: "'s3-key' not in vault_keys.stdout"
  environment:
    VAULT_ADDR: "{{ vault_addr }}"
    VAULT_TOKEN: "{{ vault_token }}"

- name: Enable AppRole Authentication
  command: vault auth enable approle
  environment:
    VAULT_ADDR: "{{ vault_addr }}"
    VAULT_TOKEN: "{{ vault_token }}"

- name: Create AppRole Role
  command: vault write auth/approle/role/ceph-rgw policies=default
  environment:
    VAULT_ADDR: "{{ vault_addr }}"
    VAULT_TOKEN: "{{ vault_token }}"

- name: Retrieve Role ID
  command: vault read -field=role_id auth/approle/role/ceph-rgw/role-id
  register: role_id
  environment:
    VAULT_ADDR: "{{ vault_addr }}"
    VAULT_TOKEN: "{{ vault_token }}"

- name: Retrieve Secret ID
  command: vault write -field=secret_id -f auth/approle/role/ceph-rgw/secret-id
  register: secret_id
  environment:
    VAULT_ADDR: "{{ vault_addr }}"
    VAULT_TOKEN: "{{ vault_token }}"