Closed sguarin closed 1 year ago
Thank you for submitting this!
This is most likely the same issue as seen in:
And fixed in:
This should be a matter of similarly forcing the type for this parameter to str
/bytes
.
I will be busy with AnsibleFest for the next week+ so it may take some time for me to get to this, but it should be a straightforward fix.
@sguarin @tobiicerb I believe I have a fix:
Would you be able to try it out by any chance? Use of namespace
is a Vault enterprise feature so even though we have unit tests, I cannot test it with integration.
You can install the collection from the fix branch like this:
ansible-galaxy collection install git+https://github.com/briantist/community.hashi_vault.git,unsafe-namespace
@briantist Hi, I tried it out and it is working perfectly. I installed the collection like you suggested and ran the following playbook successfully:
- hosts: localhost
vars:
ansible_hashi_vault_namespace: namespacename
secrettest: "{{ lookup('community.hashi_vault.vault_kv2_get', 'secretpath', engine_mount_point='kv').secret.secretname }}"
tasks:
- name: Debug
ansible.builtin.debug:
msg: "{{ secrettest }}"
Thank you so much for this very quick response and fix!
@tobiicerb thanks for trying that out! Could you confirm that the same test playbook you used does indeed fail on the current release?
I ask because as it's written here (I assume it's somewhat redacted), with a literal string namespace name, I would have expected it not to fail, because it should only fail if the namespace value is "unsafe" (usually this is the case when the value was the result of a lookup plugin).
One way to force that without having to use a lookup, is to mark it unsafe in YAML:
- hosts: localhost
vars:
ansible_hashi_vault_namespace: !unsafe namespacename
secrettest: "{{ lookup('community.hashi_vault.vault_kv2_get', 'secretpath', engine_mount_point='kv').secret.secretname }}"
tasks:
- name: Debug
ansible.builtin.debug:
msg: "{{ secrettest }}"
If you have an example that actually uses a static string and triggers the issues, or your namespace string is not static but comes from something other than a lookup, I would really appreciate knowing about that!
@tobiicerb can you confirm the above?
@briantist I was not certain what you meant with "current" release, so I tried out the version on galaxy first:
Here when it is marked as unsafe the error is Header part ('Namespace') from {'X-Vault_Namespace:' 'Namespace'} must be of type str or bytes, not <class 'ansible.untils.unsafe_proxy.AnsibleUnsafeText'>"
Not marked as unsafe the error is Header part ('Namespace') from {'X-Vault-Namespace': 'Namespace'} must be of type str or bytes, not <class 'ansible.parsing.yaml.objects.AnsibleUnicode'>"
Afterwards I tried your unsafe-namespace branch:
Here when it is marked as unsafe there is no error.
Not marked as unsafe there is also no error.
Thank you @tobiicerb that's very interesting, what is your output from ansible --version
?
@briantist ansible [core 2.13.5], python version = 3.8.10
@sguarin @tobiicerb this is now released in version 3.4.0!
@briantist I meant to write this earlier. Awesome work!
SUMMARY
When running a simple test of lookup plugin using requests==2.27.1 works as expected. But using last requests: 2.28.1 I got an unhandled exception.
ISSUE TYPE
COMPONENT NAME
lookup hashi_vault plugin
ANSIBLE VERSION
COLLECTION VERSION
Tested with community.hashi_vault 3.2.0 and 3.3.1
CONFIGURATION
OS / ENVIRONMENT
STEPS TO REPRODUCE
Tested with various ansible version and the issue seems to work with:
pip install 'requests==2.27.1' but not with: pip install 'requests==2.28.1'
EXPECTED RESULTS
Work retrieving the kv content as it works with previous requests library version.
ACTUAL RESULTS