---
# Read the shared postgres owner password from Vault; generate and store it if missing.
# Sets __cloudnativepg_operator_password, consumed by the K8s secret tasks in main.yml.

- name: Read cloudnativepg postgres password from Vault
  community.hashi_vault.vault_kv2_get:
    path: "{{ cloudnativepg_operator_vault_path }}"
    engine_mount_point: "{{ cloudnativepg_operator_vault_mount }}"
  register: __cloudnativepg_operator_vault_read
  failed_when: false
  no_log: "{{ cloudnativepg_operator_no_log }}"

- name: Resolve postgres password (generate if missing)
  ansible.builtin.set_fact:
    __cloudnativepg_operator_password: >-
      {{ (__cloudnativepg_operator_vault_read.secret | default({})).password
         | default(lookup('community.general.random_string', length=32, special=false)) }}
  no_log: "{{ cloudnativepg_operator_no_log }}"

- name: Write postgres password to Vault
  community.hashi_vault.vault_kv2_write:
    path: "{{ cloudnativepg_operator_vault_path }}"
    engine_mount_point: "{{ cloudnativepg_operator_vault_mount }}"
    data:
      password: "{{ __cloudnativepg_operator_password }}"
  no_log: "{{ cloudnativepg_operator_no_log }}"