-
Notifications
You must be signed in to change notification settings - Fork 59
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
hashi_vault lookup plugin require auth/token/lookup-self policy on the Vault token to read secrets #18
Comments
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Thanks @rasta-rocket this is a good find. By the way, the I've requested that this issue be moved there, so that should hopefully happen without you needing to resubmit it. As for the issue at hand, first I want to sincerely thank you for the in-depth investigation; extremely helpful. I looked back and found some relevant discussion in this issue raised in hvac (in 2015): hvac/hvac#29 It seems the issue was even worse at that time because Vault itself did not include lookup-self in default policies, but even then they declined to change That leads us to figure out what to do with it here. I agree that we shouldn't completely stop a valid token from working just for the sake of trying to give a better error message.
Let me know what you think and if you have any additional ideas. |
Hi @rasta-rocket, FYI I've moved this issue to the community.hashi_vault collection repository. |
Hi @briantist thanks for your quick answer Your analysis of the situation sounds good to me 👍 I would say that the 3rd option (= extra option to disable the check) might be the best because as you said: it will fit all the use cases 😜 Let me know if it is doable for you and if you need a hand on that. Cheers |
SUMMARY
Hello folks 👋
I found a behavior that seems weird to me: I'm using the hashi_vault lookup plugin with the token auth_method, I'm just setting a Vault token with a minimal set of vault policies (principle of least privilege) to my CI/CD to run the playbook that fetches secrets and the CI/CD system cannot fetches the secrets.
By using the token (with the given policies) with the Vault CLI I don't get any trouble.
My policies contains only sufficient rules to fetch the secrets that I want (read and list on specific vault path).
By investigating the code I came to that:
When using the token auth_method, the function auth_token is called.
This function call is_authenticated
That latest function only return True if the token have the capability to lookup-itself
So I came to the conclusion that if I want my playbook to run I have to add the lookup-itself capability in my token policies. I made the test and it works.
However Vault gives the capability to request its API by just setting the VAULT_TOKEN env variable, so why do we need that
is_authenticated
check for the token part ?Thanks for your reply 🙏
ISSUE TYPE
COMPONENT NAME
hashi_vault
ANSIBLE VERSION
CONFIGURATION
OS / ENVIRONMENT
STEPS TO REPRODUCE
EXPECTED RESULTS
ACTUAL RESULTS
The text was updated successfully, but these errors were encountered: