Comments (3)
Thanks @eqrx ! As of 1.4.0
we have the first new content in the collection, including the first module. I do expect soon that we'll have vault_login
or something similar that can be used to authenticate and return a token, so that may be useful to you, although they won't quite use the helper system. I will still keep these things in mind. I'll also reopen this, both to keep it for continued tracking, and also so that anyone else who has the same idea can more easily find it.
Thanks again for opening it!
from community.hashi_vault.
Hi @eqrx , thanks for submitting!
Part of the difficulty in implementing this for the moment will be that, at the moment, the plugin always assumes it has to authenticate. To properly support the helper, it has to be able to auth, store the token, and retrieve the token to re-use. But the challenge is that the helper design doesn't have any provision for storing metadata about the token itself, so there's no way to know before using it (or rather without a roundtrip) whether the token is valid. Retrying auth on failure isn't always the right behavior either. The Vault CLI doesn't have this issue as auth (login
) commands are issued explicitly.
If we're talking about support get
only for the helper, for use with the token
auth method, it's a bit more feasible (presumably you'd be doing a vault login
outside of Ansible, then running Ansible with the assumption that the token will be valid for the lifetime for the play. But it feels somewhat incomplete.
One other thing is that we're looking to expand the plugins available in this collection, while keeping the common stuff like auth central so that it works the same across all. So it'll take some thought about how a helper interface would be implemented.
But I do like the idea of being able to support that, just need to think about how it would best within the (future) ecosystem. I had been thinking about options for token persistence within Ansible already, it's somewhat tricky, but I'll surely keep helpers in mind during that planning and experimentation.
One of the things planned is a plugin (and module!) just for doing auth against Vault; that might be a good place to put helper implementation; where it wouldn't be shared with the rest of the plugins, but it'll be highly dependent on the intended use case. For example, the sample helper script shown in the Vault docs relies on an environment variable being set, independent of the data sent into the script (so it doesn't even work correctly with the Vault CLI in all cases, like if you use -address=
to set your Vault address instead of the environment, there's no way for the helper script to know it.
I would love to know more about your specific token helper, what it does, whether it relies on outside information, what problem it solves for you, etc.
Also I'm not sure which workaround(s) you're using right now but I'll post some possible ones.
Outside Ansible the easiest is probably
ANSIBLE_HASHI_VAULT_TOKEN=$(/path/helper get) ansible-playbook playbook.yml
Within, you can use the pipe
lookup within your lookup calls:
- debug:
msg: "{{ lookup('community.hashi_vault.hashi_vault', 'secret/data/pwd', token=lookup('pipe', '/path/helper get')) }}"
With #86 (note: not released as of this writing, it'll be in 1.2.0) you could do this a little more cleanly with an Ansible var within set_fact
:
- set_fact:
ansible_hashi_vault_token: "{{ lookup('pipe', '/path/helper get') }}"
- debug:
msg: "{{ lookup('community.hashi_vault.hashi_vault', 'secret/data/pwd') }}"
Looking forward to your thoughts!
from community.hashi_vault.
Wow, it really took me some time to respond here @briantist , please take my apologies. I am using the "Within" workaround you posted and I am very happy with that. Thank you very much for the detailed explaination!
Closing this issue since it resolved my problem but please feel free to reopen if you use this issue for tracking or smt.
from community.hashi_vault.
Related Issues (20)
- Add ability to delete an entire secret kv2 secret (delete metadata, not a secret version) HOT 2
- ERROR! couldn't resolve module/action 'community.hashi_vault'.
- USER_SITE path not included with lookups if the directory didn't exist when starting the playbook HOT 1
- Support hcp vault secrets
- Lookup failures
- CA verification does not work at all with hvac 2.0 on FreeBSD HOT 13
- No tilde expansion of token_path when configured in ansible.cfg HOT 1
- Setting options that don't exist in configuration fails now
- Allow token auto renew when playbook is executing
- Database Secrets Engine: Connection Management and Role Management from Ansible HOT 10
- Negative version numbers for accessing previous versions of a secret HOT 2
- Add the option to set the cert_auth_public/private_key parameter using variables HOT 3
- community.hashi_vault module not interpolate {{inventory_dir|basename}} HOT 2
- Update github release workflow
- vault_kv2_get lookup plugin variables interpolation HOT 4
- CI is failing sometimes(?) trying to use docker compose
- Where is url in with_community.hashi_vault.vault_read? HOT 1
- VAULT_ADDR regression HOT 12
- Config via Ansible vars not resolving templating HOT 1
- add a vault_kv2_destroy module HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from community.hashi_vault.