kubespray/roles/vault/tasks/shared/pki_mount.yml

---

- name: shared/mount | Enable {{ pki_mount_path }} PKI mount
  hashivault_secret_enable:
    url: "{{ vault_leader_url }}"
    token: "{{ vault_root_token }}"
    ca_cert: "{{ vault_cert_dir }}/ca.pem"
    name: "{{ pki_mount_path }}"
    backend: "pki"
    config: "{{ pki_mount_options }}"
  register: secret_enable_result
  failed_when: 'secret_enable_result.rc !=0 and "existing mount" not in secret_enable_result.msg'