Add Automation Orchestrator Install and setup

roles/cloudnativepg_operator/tasks/vault_secrets.yml

@@ -0,0 +1,26 @@
+---
+# Read the shared postgres owner password from Vault; generate and store it if missing.
+# Sets __cloudnativepg_operator_password, consumed by the K8s secret tasks in main.yml.
+
+- name: Read cloudnativepg postgres password from Vault
+  community.hashi_vault.vault_kv2_get:
+    path: "{{ cloudnativepg_operator_vault_path }}"
+    engine_mount_point: "{{ cloudnativepg_operator_vault_mount }}"
+  register: __cloudnativepg_operator_vault_read
+  failed_when: false
+  no_log: "{{ cloudnativepg_operator_no_log }}"
+
+- name: Resolve postgres password (generate if missing)
+  ansible.builtin.set_fact:
+    __cloudnativepg_operator_password: >-
+      {{ (__cloudnativepg_operator_vault_read.secret | default({})).password
+         | default(lookup('community.general.random_string', length=32, special=false)) }}
+  no_log: "{{ cloudnativepg_operator_no_log }}"
+
+- name: Write postgres password to Vault
+  community.hashi_vault.vault_kv2_write:
+    path: "{{ cloudnativepg_operator_vault_path }}"
+    engine_mount_point: "{{ cloudnativepg_operator_vault_mount }}"
+    data:
+      password: "{{ __cloudnativepg_operator_password }}"
+  no_log: "{{ cloudnativepg_operator_no_log }}"