Place vault role credentials only to vault group hosts

roles/vault/tasks/shared/gen_userpass.yml

@@ -10,13 +10,13 @@
       password: "{{ gen_userpass_password }}"
       policies: "{{ gen_userpass_role }}"
     status_code: 204
-  when: inventory_hostname == groups[gen_userpass_group]|first
+  delegate_to: "{{ groups.vault|first }}"
+  run_once: true
 
 - name: shared/gen_userpass | Ensure destination directory exists
   file:
     path: "{{ vault_roles_dir }}/{{ gen_userpass_role }}"
     state: directory
-  when: inventory_hostname in groups[gen_userpass_group]
 
 - name: shared/gen_userpass | Copy credentials to all hosts in the group
   copy:
@@ -26,4 +26,3 @@
               'password': gen_userpass_password} | to_nice_json(indent=4)
              }}
     dest: "{{ vault_roles_dir }}/{{ gen_userpass_role }}/userpass"
-  when: inventory_hostname in groups[gen_userpass_group]