4.2.0 fails to use VAULT_ADDR environment variable

[ghferrari]

SUMMARY

According to the hashi_vault Ansible docs:

If not specified by any other means, the value of the VAULT_ADDR environment variable will be used. If VAULT_ADDR is also not defined then an error will be raised.

Version 4.1.0 would indeed use the environment variable. In my testing, version 4.2.0 satisfies neither of the conditions above:

• It does not use the VAULT_ADDR environment variable
• It does not raise an error if this is not defined. Instead, it reverts to assuming that the vault server will be on 127.0.0.1.

I appreciate that hashi_vault 4.2.0 warns that it does not support Ansible 2.10.17, however, I thought it worth reporting this in case the bug is unrelated.

ISSUE TYPE

• Bug Report

COMPONENT NAME

hashi_vault

ANSIBLE VERSION

ansible 2.10.17
  config file = None
  configured module search path = ['/home/stack/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/stack/geoff/venvs/bmrc-config/lib64/python3.6/site-packages/ansible
  executable location = /home/stack/geoff/venvs/bmrc-config/bin/ansible
  python version = 3.6.8 (default, Jan 25 2023, 15:03:30) [GCC 8.5.0 20210514 (Red Hat 8.5.0-18)]

COLLECTION VERSION

# /home/stack/geoff/venvs/bmrc-config/lib64/python3.6/site-packages/ansible_collections
Collection        Version
----------------- -------
community.general 1.3.6  

# /home/stack/.ansible/collections/ansible_collections
Collection        Version
----------------- -------
community.general 6.5.0  

# /home/stack/geoff/venvs/bmrc-config/lib/python3.6/site-packages/ansible_collections
Collection        Version
----------------- -------
community.general 1.3.6  

CONFIGURATION

[No output]

OS / ENVIRONMENT

OS: CentOS 8 Stream
Python 3.6.8

STEPS TO REPRODUCE

Ensure that VAULT_ADDR is defined as an environment variable then attempt to lookup a vault parameter without specifying the vault address in Ansible, so that the hashi_vault should use the environment variable.

EXPECTED RESULTS

hashi_vault should use the VAULT_ADDR environment variable or if not defined, it should raise an error.

ACTUAL RESULTS

The environment variable is not used and instead hashi_vault uses 127.0.0.1

Error was a <class 'ansible.errors.AnsibleError'>, original message: An unhandled exception occurred while running the lookup plugin 'hashi_vault'. Error was a <class 'requests
.exceptions.ConnectionError'>, original message: HTTPConnectionPool(host='127.0.0.1', port=8200): Max retries exceeded with url: /v1/auth/token/lookup-self (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f9101764b00>: Failed
 to establish a new connection: [Errno 111] Connection refused

[briantist]

Hi @ghferrari this certainly is strange. There aren't any changes in 4.2.0 I can think of that would've affected this.

Could you show the actual call you're making to reproduce it?

[ghferrari]

Hi @briantist , I see this bug with any standard lookup e.g. in this format

password: "{{ lookup('hashi_vault', 'secret=path/to/secret:value cacert=' + lookup('env', 'VAULT_CACERT')) }}"

If I revert to hashi_vault 4.1.0 then it works fine, but not with 4.2.0.

[briantist]

So, I cannot reproduce this myself, but I have some ideas.

First, you are using the short name hashi_vault instead of the FQCN community.hashi_vault.hashi_vault, and this makes me wonder if you're getting some older version of the plugin.

Your collection listing doesn't actually show any versions of community.hashi_vault for some reason, showing only community.general, and some pretty large version differences at that, in different collection locations.

The hashi_vault lookup was originally in Ansible before the collection split, and so I believe it therefore got a redirect after the split. However, it first went to the community.general collection, before this community.hashi_vault collection was formed.

Perhaps making matters more confusing is that the first Ansible community package after the collection split had a version of 2.10, which matches the version of ansible-core which become a separate package at that point. Releases after that use semver for the community package.

I bring this up because the community package would include community.general, and the output of ansible-galaxy collection list may not have shown collections included with the package at that point.

So I think there's some combination of redirect issues + old versions of the plugin and/or collection(s) involved.

I would encourage you to try the following things, in various combinations:

• use the FQCN community.hashi_vault.hashi_vault for the lookup name
• use a modern version of the ansible package or ansible-core+manually installed collections

Then give it a try again.