# Path: ansible/module_utils/hashivault.py
# def hashivault_argspec():
#     argument_spec = dict(
#         url=dict(required=False, default=os.environ.get('VAULT_ADDR', ''), type='str'),
#         ca_cert=dict(required=False, default=os.environ.get('VAULT_CACERT', ''), type='str'),
#         ca_path=dict(required=False, default=os.environ.get('VAULT_CAPATH', ''), type='str'),
#         client_cert=dict(required=False, default=os.environ.get('VAULT_CLIENT_CERT', ''), type='str'),
#         client_key=dict(required=False, default=os.environ.get('VAULT_CLIENT_KEY', ''), type='str'),
#         verify=dict(required=False, default=(not os.environ.get('VAULT_SKIP_VERIFY', '')), type='bool'),
#         authtype=dict(required=False, default=os.environ.get('VAULT_AUTHTYPE', 'token'), type='str'),
#         login_mount_point=dict(required=False, default=os.environ.get('VAULT_LOGIN_MOUNT_POINT', None), type='str'),
#         token=dict(required=False, fallback=(hashivault_default_token, ''), type='str', no_log=True),
#         username=dict(required=False, default=os.environ.get('VAULT_USER', ''), type='str'),
#         password=dict(required=False, fallback=(env_fallback, ['VAULT_PASSWORD']), type='str', no_log=True),
#         role_id=dict(required=False, fallback=(env_fallback, ['VAULT_ROLE_ID']), type='str', no_log=True),
#         secret_id=dict(required=False, fallback=(env_fallback, ['VAULT_SECRET_ID']), type='str', no_log=True),
#         aws_header=dict(required=False, fallback=(env_fallback, ['VAULT_AWS_HEADER']), type='str', no_log=True),
#         namespace=dict(required=False, default=os.environ.get('VAULT_NAMESPACE', None), type='str')
#     )
#     return argument_spec
# 
# Path: ansible/module_utils/hashivault.py
# def hashivault_client(params):
#     url = params.get('url')
#     ca_cert = params.get('ca_cert')
#     ca_path = params.get('ca_path')
#     client_cert = params.get('client_cert')
#     client_key = params.get('client_key')
#     cert = (client_cert, client_key)
#     check_verify = params.get('verify')
#     namespace = params.get('namespace', None)
#     if check_verify == '' or check_verify:
#         if ca_cert:
#             verify = ca_cert
#         elif ca_path:
#             verify = ca_path
#         else:
#             verify = check_verify
#     else:
#         verify = check_verify
#     client = hvac.Client(url=url, cert=cert, verify=verify, namespace=namespace)
#     return client
# 
# Path: ansible/module_utils/hashivault.py
# def hashivault_init(argument_spec, supports_check_mode=False, required_if=None, required_together=None,
#                     required_one_of=None, mutually_exclusive=None):
#     module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=supports_check_mode,
#                            required_if=required_if, required_together=required_together,
#                            required_one_of=required_one_of, mutually_exclusive=mutually_exclusive)
#     module.no_log_values.discard('0')
#     module.no_log_values.discard(0)
#     module.no_log_values.discard('1')
#     module.no_log_values.discard(1)
#     module.no_log_values.discard(True)
#     module.no_log_values.discard(False)
#     module.no_log_values.discard('ttl')
#     return module
# 
# Path: ansible/module_utils/hashivault.py
# def hashiwrapper(function):
#     def wrapper(*args, **kwargs):
#         result = {"changed": False, "rc": 0}
#         result.update(function(*args, **kwargs))
#         return result
#     return wrapper


from ansible.module_utils.hashivault import hashivault_argspec
from ansible.module_utils.hashivault import hashivault_client
from ansible.module_utils.hashivault import hashivault_init
from ansible.module_utils.hashivault import hashiwrapper
    - Module to start rekey Hashicorp Vault.
options:
    secret_shares:
        description:
            - specifies the number of shares to split the master key into.
        default: 5
    secret_threshold:
        description:
            - specifies the number of shares required to reconstruct the master key.
        default: 3
    pgp_keys:
        description:
            - specifies an array of PGP public keys used to encrypt the output unseal keys.
        default: []
    backup:
        description:
            - specifies if using PGP-encrypted keys, whether Vault should also store a plaintext backup of the
              PGP-encrypted keys at core/unseal-keys-backup in the physical storage backend. These can then be
              retrieved and removed via the sys/rekey/backup endpoint.
        default: False
    verification_required:
        description:
            - when verification is turned on, after successful authorization with the current unseal keys, the new
              unseal keys are returned but the master key is not actually rotated. The new keys must be provided to
              authorize the actual rotation of the master key. This ensures that the new keys have been successfully
              saved and protects against a risk of the keys being lost after rotation but before they can be persisted.
        default: False
extends_documentation_fragment: hashivault
'''
EXAMPLES = '''

# Path: ansible/module_utils/hashivault.py
# def hashivault_argspec():
#     argument_spec = dict(
#         url=dict(required=False, default=os.environ.get('VAULT_ADDR', ''), type='str'),
#         ca_cert=dict(required=False, default=os.environ.get('VAULT_CACERT', ''), type='str'),
#         ca_path=dict(required=False, default=os.environ.get('VAULT_CAPATH', ''), type='str'),
#         client_cert=dict(required=False, default=os.environ.get('VAULT_CLIENT_CERT', ''), type='str'),
#         client_key=dict(required=False, default=os.environ.get('VAULT_CLIENT_KEY', ''), type='str'),
#         verify=dict(required=False, default=(not os.environ.get('VAULT_SKIP_VERIFY', '')), type='bool'),
#         authtype=dict(required=False, default=os.environ.get('VAULT_AUTHTYPE', 'token'), type='str'),
#         login_mount_point=dict(required=False, default=os.environ.get('VAULT_LOGIN_MOUNT_POINT', None), type='str'),
#         token=dict(required=False, fallback=(hashivault_default_token, ''), type='str', no_log=True),
#         username=dict(required=False, default=os.environ.get('VAULT_USER', ''), type='str'),
#         password=dict(required=False, fallback=(env_fallback, ['VAULT_PASSWORD']), type='str', no_log=True),
#         role_id=dict(required=False, fallback=(env_fallback, ['VAULT_ROLE_ID']), type='str', no_log=True),
#         secret_id=dict(required=False, fallback=(env_fallback, ['VAULT_SECRET_ID']), type='str', no_log=True),
#         aws_header=dict(required=False, fallback=(env_fallback, ['VAULT_AWS_HEADER']), type='str', no_log=True),
#         namespace=dict(required=False, default=os.environ.get('VAULT_NAMESPACE', None), type='str')
#     )
#     return argument_spec
# 
# Path: ansible/module_utils/hashivault.py
# def hashivault_client(params):
#     url = params.get('url')
#     ca_cert = params.get('ca_cert')
#     ca_path = params.get('ca_path')
#     client_cert = params.get('client_cert')
#     client_key = params.get('client_key')
#     cert = (client_cert, client_key)
#     check_verify = params.get('verify')
#     namespace = params.get('namespace', None)
#     if check_verify == '' or check_verify:
#         if ca_cert:
#             verify = ca_cert
#         elif ca_path:
#             verify = ca_path
#         else:
#             verify = check_verify
#     else:
#         verify = check_verify
#     client = hvac.Client(url=url, cert=cert, verify=verify, namespace=namespace)
#     return client
# 
# Path: ansible/module_utils/hashivault.py
# def hashivault_init(argument_spec, supports_check_mode=False, required_if=None, required_together=None,
#                     required_one_of=None, mutually_exclusive=None):
#     module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=supports_check_mode,
#                            required_if=required_if, required_together=required_together,
#                            required_one_of=required_one_of, mutually_exclusive=mutually_exclusive)
#     module.no_log_values.discard('0')
#     module.no_log_values.discard(0)
#     module.no_log_values.discard('1')
#     module.no_log_values.discard(1)
#     module.no_log_values.discard(True)
#     module.no_log_values.discard(False)
#     module.no_log_values.discard('ttl')
#     return module
# 
# Path: ansible/module_utils/hashivault.py
# def hashiwrapper(function):
#     def wrapper(*args, **kwargs):
#         result = {"changed": False, "rc": 0}
#         result.update(function(*args, **kwargs))
#         return result
#     return wrapper


# Path: ansible/modules/hashivault/hashivault_rekey_init.py
from ansible.module_utils.hashivault import hashivault_argspec
from ansible.module_utils.hashivault import hashivault_client
from ansible.module_utils.hashivault import hashivault_init
from ansible.module_utils.hashivault import hashiwrapper

    - Module to start rekey Hashicorp Vault.
options:
    secret_shares:
        description:
            - specifies the number of shares to split the master key into.
        default: 5
    secret_threshold:
        description:
            - specifies the number of shares required to reconstruct the master key.
        default: 3
    pgp_keys:
        description:
            - specifies an array of PGP public keys used to encrypt the output unseal keys.
        default: []
    backup:
        description:
            - specifies if using PGP-encrypted keys, whether Vault should also store a plaintext backup of the
              PGP-encrypted keys at core/unseal-keys-backup in the physical storage backend. These can then be
              retrieved and removed via the sys/rekey/backup endpoint.
        default: False
    verification_required:
        description:
            - when verification is turned on, after successful authorization with the current unseal keys, the new
              unseal keys are returned but the master key is not actually rotated. The new keys must be provided to
              authorize the actual rotation of the master key. This ensures that the new keys have been successfully
              saved and protects against a risk of the keys being lost after rotation but before they can be persisted.
        default: False
extends_documentation_fragment: hashivault
'''
EXAMPLES = '''

---