vault_read

# Selected token-read workflow for public parsed plays.
# Public parsed plays support token reads and bounded register conditions; documentation is not an execution receipt.
# Embedded source notices retain the earlier standalone boundary as historical provenance.
# Supply vault_url, vault_token and vault_ca_cert privately; all three scenarios keep no_log true.
# Reference generated target: Go1.25.12 linux/amd64 CGO0, exact netgo,osusergo tags, fixed source15.
# Native Linux/file/TLS/TCP/encoding/startup profiles and cumulative resources fail closed outside support.
# Use an absolute isolated HOME, an owned tokenfile/CA and the selected explicit-token profile.
# tokenfile inference is read and discarded before the explicit token wins; explicit token is not an inference bypass.
# Environment inference, tokenfile path and TLS trust are native prerequisites, not arbitrary detector/ambient success.
# Check mode still performs the actual read. token_validate true performs lookup-self before the secret read.
# Only token authentication is supported here; other authenticator metadata does not promise execution.
# Lexical bool enumeration, warning-message masking and lexical secret substitution are intentional native corrections.
# Source domains preserve original message/order/warning atoms; fatal profile/resource/cleanup/wire failures remain fatal.
# No target/native retirement follows from parent Wait, host decoder Close, result Close or generated build metadata.
# Unknown original custody retains its input/context/stage/execution anchors; do not release them on a safe diagnostic.
# url: optional string; selected URL inference and HTTP/TLS profile apply, missing URL fails.
# proxies: raw; only the selected explicit/absent proxy profile is supported.
# ca_cert: optional string, alias cacert; selected owned explicit CA profile.
# validate_certs: optional bool; source inference/defaults apply, no TLS bypass is promised.
# namespace: optional string; selected namespace header rules apply.
# timeout: optional integer; source conversion and bounded native timeout apply.
# retries: raw; selected retry profile only, no broad retries adapter.
# retry_action: string default warn; metadata does not expand the selected retry profile.
# auth_method: string default token; only token execution is selected.
# mount_point: optional string; alternate-auth metadata only.
# token: optional secret string; raw no_log field, explicit value follows inference.
# token_path: optional string; source tokenfile directory inference applies.
# token_file: string default .vault-token; owned path/file profile and one cumulative budget.
# token_validate: bool default false; true performs lookup-self before read.
# username: optional string; alternate-auth metadata only.
# password: optional secret string; raw no_log field, alternate authentication unavailable.
# role_id: optional string; alternate-auth metadata only.
# secret_id: optional secret string; raw no_log field, alternate authentication unavailable.
# jwt: optional secret string; raw no_log field, alternate authentication unavailable.
# aws_profile: optional string, alias boto_profile; alternate-auth metadata only.
# aws_access_key: optional string, alias aws_access_key_id; alternate-auth metadata only.
# aws_secret_key: optional secret string, alias aws_secret_access_key; raw no_log metadata.
# aws_security_token: optional string; alternate-auth metadata only.
# region: optional string; alternate-auth metadata only.
# aws_iam_server_id: optional string; alternate-auth metadata only.
# azure_tenant_id: optional string; alternate-auth metadata only.
# azure_client_id: optional string; alternate-auth metadata only.
# azure_client_secret: optional secret string; raw no_log metadata, alternate authentication unavailable.
# azure_resource: string default https://management.azure.com/; alternate-auth metadata only.
# cert_auth_private_key: optional path; alternate-auth metadata only, no certificate login claimed.
# cert_auth_public_key: optional path; alternate-auth metadata only, no certificate login claimed.
# path: required string; fixed read endpoint/source error templates and raw JSON result profile apply.
- name: Read one secret using the selected token profile
  community.hashi_vault.vault_read:
    url: "{{ vault_url }}"
    token: "{{ vault_token }}"
    ca_cert: "{{ vault_ca_cert }}"
    path: secret/data/app
  no_log: true

- name: Read the same secret in check mode
  community.hashi_vault.vault_read:
    url: "{{ vault_url }}"
    token: "{{ vault_token }}"
    ca_cert: "{{ vault_ca_cert }}"
    path: secret/data/app
  check_mode: true
  no_log: true

- name: Validate the token before reading
  community.hashi_vault.vault_read:
    url: "{{ vault_url }}"
    token: "{{ vault_token }}"
    ca_cert: "{{ vault_ca_cert }}"
    token_validate: true
    path: secret/data/app
  no_log: true