Use include/import tasks (#2192)

import_tasks will consume far less memory, so it should be
used whenever it is compatible.

roles/vault/tasks/bootstrap/create_mounts.yml

@@ -1,5 +1,5 @@
 ---
-- include: ../shared/create_mount.yml
+- include_tasks: ../shared/create_mount.yml
   vars:
     create_mount_path: "{{ item.name }}"
     create_mount_default_lease_ttl: "{{ item.default_lease_ttl }}"

roles/vault/tasks/bootstrap/create_roles.yml

@@ -1,5 +1,5 @@
 ---
-- include: ../shared/create_role.yml
+- include_tasks: ../shared/create_role.yml
   vars:
     create_role_name: "{{ item.name }}"
     create_role_group: "{{ item.group }}"

roles/vault/tasks/bootstrap/gen_vault_certs.yml

@@ -1,5 +1,5 @@
 ---
-- include: ../shared/issue_cert.yml
+- import_tasks: ../shared/issue_cert.yml
   vars:
     issue_cert_common_name: "{{ vault_pki_mounts.vault.roles[0].name }}"
     issue_cert_alt_names: "{{ groups['vault'] + ['localhost'] + (vault_ca_options['vault']['alt_names'].split(','))|default() }}"

roles/vault/tasks/bootstrap/main.yml

@@ -1,20 +1,20 @@
 ---
-- include: ../shared/check_vault.yml
+- import_tasks: ../shared/check_vault.yml
   when: inventory_hostname in groups.vault
 
-- include: sync_secrets.yml
+- import_tasks: sync_secrets.yml
   when: inventory_hostname in groups.vault
 
-- include: ../shared/find_leader.yml
+- import_tasks: ../shared/find_leader.yml
   when: inventory_hostname in groups.vault and vault_cluster_is_initialized
 
-- include: sync_vault_certs.yml
+- import_tasks: sync_vault_certs.yml
   when: inventory_hostname in groups.vault
 
-- include: sync_etcd_certs.yml
+- import_tasks: sync_etcd_certs.yml
   when: inventory_hostname in groups.etcd
 
-- include: start_vault_temp.yml
+- import_tasks: start_vault_temp.yml
   when: inventory_hostname == groups.vault|first and not vault_cluster_is_initialized
 
 - name: vault | Set fact about vault leader url
@@ -22,17 +22,17 @@
     vault_leader_url: "{{ hostvars[groups.vault|first]['vault_leader_url'] }}"
   when: not vault_cluster_is_initialized
 
-- include: create_mounts.yml
+- import_tasks: create_mounts.yml
   when: inventory_hostname == groups.vault|first
 
-- include: ../shared/auth_backend.yml
+- include_tasks: ../shared/auth_backend.yml
   vars:
     auth_backend_description: A Username/Password Auth Backend primarily used for services needing to issue certificates
     auth_backend_path: userpass
     auth_backend_type: userpass
   when: inventory_hostname == groups.vault|first
 
-- include: create_roles.yml
+- include_tasks: create_roles.yml
   with_items:
     - "{{ vault_pki_mounts.vault }}"
     - "{{ vault_pki_mounts.etcd }}"
@@ -40,7 +40,7 @@
     loop_var: mount
   when: inventory_hostname in groups.vault
 
-- include: ../shared/gen_ca.yml
+- include_tasks: ../shared/gen_ca.yml
   vars:
     gen_ca_cert_dir: "{{ vault_pki_mounts.vault.cert_dir }}"
     gen_ca_mount_path: "{{ vault_pki_mounts.vault.name }}"
@@ -51,7 +51,7 @@
         and not vault_cluster_is_initialized
         and vault_ca_cert_needed
 
-- include: ../shared/gen_ca.yml
+- include_tasks: ../shared/gen_ca.yml
   vars:
     gen_ca_cert_dir: "{{ vault_pki_mounts.etcd.cert_dir }}"
     gen_ca_mount_path: "{{ vault_pki_mounts.etcd.name }}"
@@ -59,7 +59,7 @@
     gen_ca_vault_options: "{{ vault_ca_options.etcd }}"
   when: inventory_hostname in groups.etcd and vault_etcd_ca_cert_needed
 
-- include: gen_vault_certs.yml
+- import_tasks: gen_vault_certs.yml
   when: inventory_hostname in groups.vault and vault_api_cert_needed
 
-- include: ca_trust.yml
+- import_tasks: ca_trust.yml

roles/vault/tasks/bootstrap/sync_etcd_certs.yml

@@ -1,6 +1,6 @@
 ---
 
-- include: ../shared/sync_file.yml
+- include_tasks: ../shared/sync_file.yml
   vars:
     sync_file: "ca.pem"
     sync_file_dir: "{{ vault_etcd_cert_dir }}"

roles/vault/tasks/bootstrap/sync_secrets.yml

@@ -1,6 +1,6 @@
 ---
 
-- include: ../shared/sync_file.yml
+- include_tasks: ../shared/sync_file.yml
   vars:
     sync_file: "{{ item }}"
     sync_file_dir: "{{ vault_secrets_dir }}"

roles/vault/tasks/bootstrap/sync_vault_certs.yml

@@ -1,5 +1,5 @@
 ---
-- include: ../shared/sync_file.yml
+- include_tasks: ../shared/sync_file.yml
   vars:
     sync_file: "ca.pem"
     sync_file_dir: "{{ vault_cert_dir }}"
@@ -14,7 +14,7 @@
   set_fact:
     sync_file_results: []
 
-- include: ../shared/sync_file.yml
+- include_tasks: ../shared/sync_file.yml
   vars:
     sync_file: "api.pem"
     sync_file_dir: "{{ vault_cert_dir }}"

roles/vault/tasks/cluster/create_mounts.yml

@@ -1,5 +1,5 @@
 ---
-- include: ../shared/create_mount.yml
+- include_tasks: ../shared/create_mount.yml
   vars:
     create_mount_path: "{{ item.name }}"
     create_mount_default_lease_ttl: "{{ item.default_lease_ttl }}"

roles/vault/tasks/cluster/create_roles.yml

@@ -1,5 +1,5 @@
 ---
-- include: ../shared/create_role.yml
+- include_tasks: ../shared/create_role.yml
   vars:
     create_role_name: "{{ item.name }}"
     create_role_group: "{{ item.group }}"

roles/vault/tasks/cluster/main.yml

@@ -1,32 +1,32 @@
 ---
-- include: ../shared/check_vault.yml
+- import_tasks: ../shared/check_vault.yml
   when: inventory_hostname in groups.vault
 
-- include: ../shared/check_etcd.yml
+- import_tasks: ../shared/check_etcd.yml
   when: inventory_hostname in groups.vault
 
-- include: configure.yml
+- import_tasks: configure.yml
   when: inventory_hostname in groups.vault
 
-- include: binary.yml
+- import_tasks: binary.yml
   when: inventory_hostname in groups.vault and vault_deployment_type == "host"
 
-- include: systemd.yml
+- import_tasks: systemd.yml
   when: inventory_hostname in groups.vault
 
-- include: init.yml
+- import_tasks: init.yml
   when: inventory_hostname in groups.vault
 
-- include: unseal.yml
+- import_tasks: unseal.yml
   when: inventory_hostname in groups.vault
 
-- include: ../shared/find_leader.yml
+- import_tasks: ../shared/find_leader.yml
   when: inventory_hostname in groups.vault
 
-- include: create_mounts.yml
+- import_tasks: create_mounts.yml
   when: inventory_hostname == groups.vault|first
 
-- include: ../shared/gen_ca.yml
+- include_tasks: ../shared/gen_ca.yml
   vars:
     gen_ca_cert_dir: "{{ vault_pki_mounts.kube.cert_dir }}"
     gen_ca_mount_path: "{{ vault_pki_mounts.kube.name }}"
@@ -34,14 +34,14 @@
     gen_ca_vault_options: "{{ vault_ca_options.kube }}"
   when: inventory_hostname in groups.vault
 
-- include: ../shared/auth_backend.yml
+- include_tasks: ../shared/auth_backend.yml
   vars:
     auth_backend_description: A Username/Password Auth Backend primarily used for services needing to issue certificates
     auth_backend_path: userpass
     auth_backend_type: userpass
   when: inventory_hostname == groups.vault|first
 
-- include: create_roles.yml
+- include_tasks: create_roles.yml
   with_items:
     - "{{ vault_pki_mounts.vault }}"
     - "{{ vault_pki_mounts.etcd }}"

roles/vault/tasks/main.yml

@@ -11,9 +11,9 @@
 #    used during step 1, allowing all certs to have the same chain of trust.
 
 ## Bootstrap
-- include: bootstrap/main.yml
+- include_tasks: bootstrap/main.yml
   when: cert_management == 'vault' and vault_bootstrap | d()
 
 ## Cluster
-- include: cluster/main.yml
+- include_tasks: cluster/main.yml
   when: cert_management == 'vault' and not vault_bootstrap | d()

roles/vault/tasks/shared/cert_auth_mount.yml

@@ -1,6 +1,6 @@
 ---
 
-- include: ../shared/pki_mount.yml
+- include_tasks: ../shared/pki_mount.yml
   vars:
     pki_mount_path: auth-pki
     pki_mount_options:

roles/vault/tasks/shared/create_mount.yml

@@ -1,5 +1,5 @@
 ---
-- include: ../shared/pki_mount.yml
+- include_tasks: ../shared/pki_mount.yml
   vars:
     pki_mount_path: "{{ create_mount_path }}"
     pki_mount_options:
@@ -8,7 +8,7 @@
         max_lease_ttl: "{{ create_mount_max_lease_ttl }}"
       description: "{{ create_mount_description }}"
 
-- include: ../shared/config_ca.yml
+- include_tasks: ../shared/config_ca.yml
   vars:
     config_ca_ca_pem: "{{ create_mount_cert_dir }}/ca.pem"
     config_ca_ca_key: "{{ create_mount_cert_dir }}/ca-key.pem"

roles/vault/tasks/shared/create_role.yml

@@ -40,7 +40,7 @@
 
 ## Userpass based auth method
 
-- include: gen_userpass.yml
+- include_tasks: gen_userpass.yml
   vars:
     gen_userpass_password: "{{ create_role_password }}"
     gen_userpass_policies: "{{ create_role_name }}"

roles/vault/tasks/shared/sync_auth_certs.yml

@@ -1,6 +1,6 @@
 ---
 
-- include: sync_file.yml
+- include_tasks: sync_file.yml
   vars:
     sync_file: "auth-ca.pem"
     sync_file_dir: "{{ vault_cert_dir }}"

roles/vault/tasks/shared/sync_file.yml

@@ -80,7 +80,7 @@
   set_fact:
     sync_file_results: "{{ sync_file_results|default([]) + [sync_file_result] }}"
 
-- include: sync.yml
+- include_tasks: sync.yml
   when: not (sync_file_no_srcs or sync_file_unneeded)
 
 - name: "Unset local vars to avoid variable bleed into next iteration"