hashi_vault - [env] INI value for vault URL should take precedence over VAULT_ADDR env var

[briantist]

SUMMARY

This is similar to ansible-collections/community.general#373

We take the value of VAULT_ADDR in the plugin to emulate the vault CLI and use the env var, which is commonly set. In ansible-collections/community.general#23 an INI entry was added, but if VAULT_ADDR is set the INI value won't be used.

Since VAULT_ADDR is a more general value, in the context of Ansible, we should prefer the INI value if both are set.

The fix would be similar to that in ansible-collections/community.general#902 , manually loading the value. Also adding an additional (spec defined) env var, ANSIBLE_HASHI_VAULT_ADDR which could override the INI.

General env var guidance for this plugin: #10

Plan:

• ANSIBLE_HASHI_VAULT_ADDR was introduced in v0.2.0
• VAULT_ADDR will had its precedence lowered in v1.0.0

⚠This is technically a breaking change
📝Impact Notes:

• It is unlikely to break most existing configurations, but it is possible. All of the following conditions must be met for a configuration to break:
  • The url parameter is not being passed explicitly to the plugin in the lookup() call
  • url is set in both the INI file and via the VAULT_ADDR env var
  • the values of the url in the above places are different
• With those conditions, the value of VAULT_ADDR is used before this change, and the other different value set in INI is used after this change.
• For users who are aware of this change before they consume it, it can be worked around in advance via the following remediations:
  • If the mismatched env and INI values are unintentional, setting them to be the same (or choosing one place to set them) can be done with no ill effects before and after the change.
  • If the mismatch is intentional (in one environment the INI value is used, while in another invocation the env var is being used to intentionally override INI), then this can be worked around:
    • In community.hashi_vault v0.1.0: ideally upgrade to v0.2.0 then follow the next step, otherwise: set both VAULT_ADDR and the not-yet-used ANSIBLE_HASHI_VAULT_ADDR to the same value in those invocations. After updating to a post-change collection (either v0.2.0 or v1.0.0), remove the VAULT_ADDR setting.
    • In community.hashi_vault v0.2.0: set ANSIBLE_HASHI_VAULT_ADDR instead of VAULT_ADDR. No other changes are needed for v1.0.0.

ISSUE TYPE

• Bug Report

COMPONENT NAME

hashi_vault.py

ANSIBLE VERSION

CONFIGURATION

OS / ENVIRONMENT

STEPS TO REPRODUCE

EXPECTED RESULTS

INI value is specific to ansible, and should be used over the more system wide VAULT_ADDR.

ACTUAL RESULTS

INI value will never be used if VAULT_ADDR is set.