Fix vault setup partially (#1531)

This does not address per-node certs and scheduler/proxy/controller-manager
component certs which are now required. This should be handled in a
follow-up patch.

roles/vault/tasks/cluster/unseal.yml

@@ -1,5 +1,8 @@
 ---
 
+- name: cluster/unseal | Current sealed state
+  debug: " Sealed? {{vault_is_sealed}}"
+
 - name: cluster/unseal | Unseal Vault
   uri:
     url: "https://localhost:{{ vault_port }}/v1/sys/unseal"