Fix capitalisation and add instructions to encrypt pulp key

Author: technowhizz

doc/source/configuration/vault.rst

@@ -379,30 +379,42 @@ Pulp TLS with Vault
 ===================
 .. warning::
 
-   These steps are intended for enabling tls for pulp on an existing deployment as on a new deployment the overcloud vaults may not be up at this point.
+   These steps are intended for enabling TLS for pulp on an existing deployment as on a new deployment the overcloud vaults may not be up at this point.
 
-To enable tls for pulp using vault generated certificates, we first need to generate the certificates using vault and then configure the seed + seed-hypervisor + overcloud nodes to add the root CA to their trust.
+To enable TLS for pulp using vault generated certificates, we first need to generate the certificates using vault and then configure the seed + seed-hypervisor + overcloud nodes to add the root CA to their trust.
 
 1. Run the playbook which will generate the certificates and add the root CA to the seed + seed-hypervisor + overcloud nodes
 
    .. code-block::
 
       kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/vault-generate-pulp-tls.yml
 
-2. Next, enable tls for pulp in pulp.yml
+2. Encrypt the generated private key with ansible-vault (use the correct path to your vault password file).
+
+   .. code-block::
+
+      ansible-vault encrypt --vault-password-file ~/vault.pass $KAYOBE_CONFIG_PATH/pulp/certificates/pulp.key
+
+   Or if environments are being used
+
+   .. code-block::
+
+      ansible-vault encrypt --vault-password-file ~/vault.pass $KAYOBE_CONFIG_PATH/environments/$KAYOBE_ENVIRONMENT/pulp/certificates/pulp.key
+
+3. Next, enable TLS for pulp in pulp.yml
 
    .. code-block::
 
       # Whether to enable TLS for Pulp.
       pulp_enable_tls: true
 
-3. Redeploy pulp
+4. Redeploy pulp
 
    .. code-block::
 
       kayobe seed service reconfigure -t seed-deploy-containers -kt none
 
-You should now have pulp running with tls enabled using the certificates generated by vault.
+You should now have pulp running with TLS enabled using the certificates generated by vault.
 
 Barbican integration
 ====================