voxpupuli / puppet-vault_lookup

Apache License 2.0
26 stars 42 forks source link

Allow for setting lookup options with a hash instead of positional arguments #64

Closed natemccurdy closed 2 years ago

natemccurdy commented 2 years ago

Before this change

Prior to this, options for the Vault lookup had to be set via positional arguments to the vault::vault_lookup() function. That made it rather clunky to do simple changes like switch which auth method you wanted to use or specify a specific field to extract from the lookup.

For example, before this change, using positional arguments meant doing something like this:

# The explicit undef's are neccessary and clunky here.
$data_auth_method_approle = Deferred('vault_lookup::lookup', ['secret/test', undef, undef, undef, undef, 'approle', 'team_a', 'abcd1234!@#'])

$data_specific_field = Deferred('vault_lookup::lookup', ['secret/test', undef, undef, undef, undef, 'message'])

After this change

After this, all options other than the path can be specified in a hash as named parameters. The benefit of using a hash for options is that it's much simpler and clearer to configure the lookup.

Now, lookups can use an options hash which clarifies the intent of each lookup:

$data_auth_method_approle = Deferred('vault_lookup::lookup', ['secret/test', {
  'auth_method' => 'approle',
  'role_id'     => 'team_a',
  'secret_id'   => 'abcd1234!@#',
}])

$data_specific_field = Deferred('vault_lookup::lookup', ['secret/test', {'field' => 'message'}])

Note that as part of this change, I updated the name of the internal function's parameters to shorten and simplify them. For example, the internal function's parameter called vault_url was changed to vault_addr to match standard Vault naming convention, and vault_namespace was changed to just namespace as that makes it simpler to use the options hash since there's fewer letters to type.