kubespray/roles/vault/tasks/cluster/unseal.yml

---

- name: cluster/unseal | Current sealed state
  debug:
    msg: "Sealed? {{ vault_is_sealed }}"

- name: cluster/unseal | Unseal Vault
  hashivault_unseal:
    url: "https://localhost:{{ vault_port }}/"
    token: "{{ vault_root_token }}"
    ca_cert: "{{ vault_cert_dir }}/ca.pem"
    keys: "{{ item }}"
  no_log: true
  with_items: "{{ vault_unseal_keys|default([]) }}"
  notify: wait for vault up
  when: vault_is_sealed