Open FooBarTrixibell opened 1 year ago
Hi @FooBarTrixibell ! Thank you for opening this issue. I started investigating it today, and this is first and foremost an issue in hvac
, so I've opened the issue over there:
Once we decide how to handle it in the hvac
library, I will return to this on the collection side and see how we can improve the experience further.
From the options you provided:
- The data from the deleted version (including deletion_time) passed and a successful status or
- The latest non-deleted version returned (and a successful status) or
- A differect option available for version other than latest, ie. latest-live
I believe we'd end up with 1) being the default behavior once there's support in hvac
, and possibly introducing 3) or something like it that would handle iterating down in versions until it found a live one, if one exists.
But we'll see how it plays out.
One thing to note is that the next major version (4.0.0) of this collection will probably be released within a week or so, and I'm not sure if this can be addressed before that time.
Just to update this, I do have a PR open in hvac
to address it on that side:
Once that gets released, we'll be able to use it within this collection, I just have to give some thought to how we might also accommodate older versions of hvac
that don't have the update because it's conditional and requires a specific parameter.
SUMMARY
When trying to pull the latest secret in ansible on a playbook which works if the latest version of a secret is still live, if the version has been deleted it will fail with the following -
Invalid or missing path ['SECRET-NAME'] with secret version 'latest'. Check the path or secret version.
ISSUE TYPE
COMPONENT NAME
community.hashi_vault.vault_kv2_get
ANSIBLE VERSION
COLLECTION VERSION
CONFIGURATION
OS / ENVIRONMENT
Centos 7
STEPS TO REPRODUCE
Create a secret, make a number of versions, delete the latest version. Create a playbook to pull the latest version of the secret and run it.
EXPECTED RESULTS
Either - The data from the deleted version (including deletion_time) passed and a successful status or The latest non-deleted version returned (and a successful status) or A differect option available for version other than latest, ie. latest-live
ACTUAL RESULTS
The latest version is pulled and the details come across in the JSON output but the status of the run is set to FAILED.