Cannot use conjur_variable Lookup Plugin with HTTP

[infamousjoeg]

Summary

When attempting to use the conjur_variable lookup plugin for Ansible with Conjur OSS in non-HTTPS mode for demo, POC, and lab testing, an error is returned.

Steps to Reproduce

1. Deploy Conjur OSS without a reverse proxy frontend providing SSL/TLS.
2. Using Ansible OSS, run an Ansible playbook utilizing conjur_variable to fetch a secret from Conjur OSS using HTTP.

Expected Results

The secret should be successfully fetched and returned to the Ansible playbook by the conjur_variable lookup plugin.

Actual Results

The following error is returned:

An attempt to explore Conjur OSS logs using docker logs root_conjur_1 returns no connection attempted by Ansible to the service. The request does not make it past our conjur_variable lookup plugin.

Here is the playbook that is being run:

Reproducible

• ✅ Always
• [ ] Sometimes
• [ ] Non-Reproducible

Version/Tag number

• Conjur OSS v1.15.0
• Ansible OSS v2.9.6
• Python v3.8.10
• Docker CE v20.10.12, build e91ed57
• Docker-Compose v1.28.6, build 5db8d86f
• Ubuntu v20.04.1
• Linux kernel v5.11.0

Environment setup

• Can you describe the environment in which this product is running? Is it running on a VM / in a container / in a cloud?

It is running on a Google Cloud Platform VM. Using the Ubuntu version and Linux kernel version provided above.

• Which cloud provider? Which container orchestrator (including version)?

Google Cloud Platform Compute Engine, Docker-Compose - versions provided above.

• The more info you can share about your runtime environment, the better we may be able to reproduce the issue.

I believe I've provided sufficient information.

Additional Information

This problem has been recognized and reported by the community through CyberArk Commons. It was identified in July 2020 and was met with no resolution. The original poster apparently gave up on any support and moved to a different solution all together. You can see the original post at https://discuss.cyberarkcommons.org/t/ansible-fetching-secrets-from-conjur-faces-error-error-was-a-class-urllib2-httperror-original-message-http-error-404-not-found-which-is-fetched-by-api/861.

[szh]

There is an optional parameter, validate_certs which can be set to false to allow self-signed (invalid) certificates. The value of this parameter is passed to all calls to the Ansible open_url function. However until Ansible 1.9.2 this was treated as false by default. This change is noted in the Ansible docs.

[szh]

Here's a working example of the plugin working with an HTTP (no TLS proxy) setup. The test can be run by cloning the git repo at that commit and running the command cd tests/conjur_variable && ./test.sh