search

ansible-collections / community.hashi_vault

Ansible collection for managing and working with HashiCorp Vault.
https://docs.ansible.com/ansible/devel/collections/community/hashi_vault/index.html
GNU General Public License v3.0
80 stars 59 forks source link

community.hashi_vault module not interpolate {{inventory_dir|basename}} #431

Closed apenadiazApk closed 6 months ago

apenadiazApk commented 6 months ago
SUMMARY

community.hashi_vault module not interpolate {{inventory_dir|basename}}

ISSUE TYPE
COMPONENT NAME

community.hashi_vault

ANSIBLE VERSION
ansible [core 2.14.7]
  config file = /home/user/iac/apkappa/apkappa-ansible/ansible.cfg
  configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/ansible
  ansible collection location = /home/user/ansible/collections
  executable location = /usr/local/bin/python_virtualenvs/ansible-7.5.0/bin/ansible
  python version = 3.9.13 (main, Nov 16 2022, 10:51:39) [GCC 8.5.0 20210514 (Red Hat 8.5.0-15)] (/usr/local/bin/python_virtualenvs/ansible-7.5.0/bin/python)
  jinja version = 3.1.2
  libyaml = True
COLLECTION VERSION
# /home/user/iac/ansible/collections/ansible_collections
Collection            Version
--------------------- -------
community.hashi_vault 6.1.0

# /usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/ansible_collections
Collection            Version
--------------------- -------
community.hashi_vault 4.2.0
CONFIGURATION
CALLBACKS_ENABLED(/home/user/ansible/ansible.cfg) = ['ansible.posix.profile_tasks']
COLLECTIONS_PATHS(/home/user/ansible/ansible.cfg) = ['/home/user/ansible/collections']
CONFIG_FILE() = /home/user/ansible/ansible.cfg
DEFAULT_HOST_LIST(/home/user/ansible/ansible.cfg) = ['/home/user/ansible/inventories/devel/hosts']
DEFAULT_LOAD_CALLBACK_PLUGINS(/home/user/ansible/ansible.cfg) = True
DEFAULT_STDOUT_CALLBACK(env: ANSIBLE_STDOUT_CALLBACK) = yaml
HOST_KEY_CHECKING(/home/user/ansible/ansible.cfg) = False
VARIABLE_PLUGINS_ENABLED(/home/user/ansible/ansible.cfg) = ['host_group_vars', 'community.sops.sops']
OS / ENVIRONMENT

OS: Almalinux 8.7

STEPS TO REPRODUCE

1- write a simple secret into K/V on vault 2- use the test yaml 3- try to use inventory_dir

my inventory_dir on file system is starting from this dirpath /home/user/ansible/

inventories/devel/ to load secrets from vault devel inventories/prod/ to load secrets from vault prod

test_playbook.yaml

ansible-playbook test_hashi_vault.yml -i inventories/devel (must be subsitute inventories_dir|basenema with devel) to connect with https://vaultdevel.domain.tld

or

ansible-playbook test_hashi_vault.yml -i inventories/prod (must be subsitute inventories_dir|basenema with prod) to connect with https://vaultprod.domain.tld

---
# This file is the main build configuration

- name: Configure ansible control machine
  hosts: localhost
  become: false

  vars:
    ansible_hashi_vault_url: "https://vault{{inventory_dir|basename}}.domain.tld"

  vars_files:

  tasks:

   - debug:
        msg: "{{ansible_hashi_vault_url}}"

    - debug:
        msg: "Test module: {{ lookup('community.hashi_vault.hashi_vault', secret=iac/data/infra/mysql/test_module_hashi_vault:test_secret') }}"
EXPECTED RESULTS

must be output the secret value on debug message like 1.1.3 version of the same module.

ACTUAL RESULTS
TASK [debug] ****************************************************************************************************************************************************************************************************************[27/1826]
task path: /home/user/ansible/test_hashi_vault.yml:19
Monday 18 March 2024  09:22:13 +0100 (0:00:00.069)       0:00:01.667 **********
Loading collection community.hashi_vault from /home/user/ansible/collections/ansible_collections/community/hashi_vault
exception during Jinja2 execution: Traceback (most recent call last):
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/urllib3/connection.py", line 174, in _new_conn
    conn = connection.create_connection(
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/urllib3/util/connection.py", line 72, in create_connection
    for res in socket.getaddrinfo(host, port, family, socket.SOCK_STREAM):
  File "/usr/lib64/python3.9/socket.py", line 954, in getaddrinfo
    for res in _socket.getaddrinfo(host, port, family, type, proto, flags):
socket.gaierror: [Errno -2] Name or service not known

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/urllib3/connectionpool.py", line 714, in urlopen
    httplib_response = self._make_request(
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/urllib3/connectionpool.py", line 403, in _make_request
    self._validate_conn(conn)
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/urllib3/connectionpool.py", line 1053, in _validate_conn
    conn.connect()
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/urllib3/connection.py", line 363, in connect
    self.sock = conn = self._new_conn()
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/urllib3/connection.py", line 186, in _new_conn
    raise NewConnectionError(
urllib3.exceptions.NewConnectionError: <urllib3.connection.HTTPSConnection object at 0x7fd1eb57dbb0>: Failed to establish a new connection: [Errno -2] Name or service not known

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/requests/adapters.py", line 486, in send
    resp = conn.urlopen(
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/urllib3/connectionpool.py", line 798, in urlopen
    retries = retries.increment(
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/urllib3/util/retry.py", line 592, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='vault%7b%7binventory_dir%7cbasename%7d%7d.domain.tld', port=443): Max retries exceeded with url: /v1/iac/data/infra/mysql/databases/test_module_hashi_vault (Caused by NewConnectionError('<u
rllib3.connection.HTTPSConnection object at 0x7fd1eb57dbb0>: Failed to establish a new connection: [Errno -2] Name or service not known'))

During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/ansible/template/__init__.py", line 831, in _lookup
    ran = instance.run(loop_terms, variables=self._available_variables, **kwargs)
  File "/home/user/ansible/collections/ansible_collections/community/hashi_vault/plugins/lookup/hashi_vault.py", line 278, in run
    ret.extend(self.get())
  File "/home/user/ansible/collections/ansible_collections/community/hashi_vault/plugins/lookup/hashi_vault.py", line 319, in get
    data = self.client.read(secret)
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/hvac/v1/__init__.py", line 236, in read
    return self._adapter.get(f"/v1/{path}", wrap_ttl=wrap_ttl)
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/hvac/adapters.py", line 110, in get
    return self.request("get", url, **kwargs)
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/hvac/adapters.py", line 372, in request
    response = super().request(*args, **kwargs)
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/hvac/adapters.py", line 331, in request
    response = self.session.request(
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/requests/sessions.py", line 589, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/requests/sessions.py", line 703, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/bin/python_virtualenvs/ansible-7.5.0/lib/python3.9/site-packages/requests/adapters.py", line 519, in send
    raise ConnectionError(e, request=request)
requests.exceptions.ConnectionError: HTTPSConnectionPool(host='vault%7b%7binventory_dir%7cbasename%7d%7d.domain.tld', port=443): Max retries exceeded with url: /v1/iac/data/infra/mysql/databases/test_module_hashi_vault (Caused by NewConnectionError(
'<urllib3.connection.HTTPSConnection object at 0x7fd1eb57dbb0>: Failed to establish a new connection: [Errno -2] Name or service not known'))
fatal: [localhost]: FAILED! =>
  msg: 'An unhandled exception occurred while running the lookup plugin ''community.hashi_vault.hashi_vault''. Error was a <class ''requests.exceptions.ConnectionError''>, original message: HTTPSConnectionPool(host=''vault%7b%7bin
ventory_dir%7cbasename%7d%7d.domain.tld'', port=443): Max retries exceeded with url: /v1/iac/data/infra/mysql/databases/test_module_hashi_vault (Caused by NewConnectionError(''<urllib3.connection.HTTPSConnection object at 0x7fd1eb57dbb0>: Failed to
establish a new connection: [Errno -2] Name or service not known'')). HTTPSConnectionPool(host=''vault%7b%7binventory_dir%7cbasename%7d%7d.domain.tld'', port=443): Max retries exceeded with url: /v1/iac/data/infra/mysql/databases
/sia (Caused by NewConnectionError(''<urllib3.connection.HTTPSConnection object at 0x7fd1eb57dbb0>: Failed to establish a new connection: [Errno -2] Name or service not known''))'
apenadiazApk commented 6 months ago

I solved adding this option after breaking changes from module

- debug:
    msg: "Test module: {{ lookup('community.hashi_vault.hashi_vault', secret=iac/data/infra/mysql/test_module_hashi_vault:test_secret, url=ansible_hashi_vault_url') }}"
briantist commented 6 months ago

Hi @apenadiazApk , the way you handled it is correct. This is a limitation of Ansible itself though unfortunately, we cannot fix it in the collection, see: