You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We take the value of VAULT_ADDR in the plugin to emulate the vault CLI and use the env var, which is commonly set. In ansible-collections/community.general#23 an INI entry was added, but if VAULT_ADDR is set the INI value won't be used.
Since VAULT_ADDR is a more general value, in the context of Ansible, we should prefer the INI value if both are set.
The fix would be similar to that in ansible-collections/community.general#902 , manually loading the value. Also adding an additional (spec defined) env var, ANSIBLE_HASHI_VAULT_ADDR which could override the INI.
VAULT_ADDR will had its precedence lowered in v1.0.0
⚠This is technically a breaking change
📝Impact Notes:
It is unlikely to break most existing configurations, but it is possible. All of the following conditions must be met for a configuration to break:
The url parameter is not being passed explicitly to the plugin in the lookup() call
url is set in both the INI file and via the VAULT_ADDR env var
the values of the url in the above places are different
With those conditions, the value of VAULT_ADDR is used before this change, and the other different value set in INI is used after this change.
For users who are aware of this change before they consume it, it can be worked around in advance via the following remediations:
If the mismatched env and INI values are unintentional, setting them to be the same (or choosing one place to set them) can be done with no ill effects before and after the change.
If the mismatch is intentional (in one environment the INI value is used, while in another invocation the env var is being used to intentionally override INI), then this can be worked around:
In community.hashi_vaultv0.1.0: ideally upgrade to v0.2.0 then follow the next step, otherwise: set both VAULT_ADDR and the not-yet-used ANSIBLE_HASHI_VAULT_ADDR to the same value in those invocations. After updating to a post-change collection (either v0.2.0 or v1.0.0), remove the VAULT_ADDR setting.
In community.hashi_vaultv0.2.0: set ANSIBLE_HASHI_VAULT_ADDRinstead ofVAULT_ADDR. No other changes are needed for v1.0.0.
ISSUE TYPE
Bug Report
COMPONENT NAME
hashi_vault.py
ANSIBLE VERSION
CONFIGURATION
OS / ENVIRONMENT
STEPS TO REPRODUCE
EXPECTED RESULTS
INI value is specific to ansible, and should be used over the more system wide VAULT_ADDR.
ACTUAL RESULTS
INI value will never be used if VAULT_ADDR is set.
The text was updated successfully, but these errors were encountered:
briantist
changed the title
hashi_vault - INI value for vault URL should take precedence over VAULT_ADDR env var
hashi_vault - [env] INI value for vault URL should take precedence over VAULT_ADDR env var
Dec 6, 2020
SUMMARY
This is similar to ansible-collections/community.general#373
We take the value of
VAULT_ADDR
in the plugin to emulate the vault CLI and use the env var, which is commonly set. In ansible-collections/community.general#23 an INI entry was added, but ifVAULT_ADDR
is set the INI value won't be used.Since
VAULT_ADDR
is a more general value, in the context of Ansible, we should prefer the INI value if both are set.The fix would be similar to that in ansible-collections/community.general#902 , manually loading the value. Also adding an additional (spec defined) env var,
ANSIBLE_HASHI_VAULT_ADDR
which could override the INI.General env var guidance for this plugin: #10
Plan:
ANSIBLE_HASHI_VAULT_ADDR
was introduced in v0.2.0VAULT_ADDR
will had its precedence lowered in v1.0.0⚠This is technically a breaking change
📝Impact Notes:
url
parameter is not being passed explicitly to the plugin in thelookup()
callurl
is set in both the INI file and via theVAULT_ADDR
env varVAULT_ADDR
is used before this change, and the other different value set in INI is used after this change.community.hashi_vault
v0.1.0
: ideally upgrade tov0.2.0
then follow the next step, otherwise: set bothVAULT_ADDR
and the not-yet-usedANSIBLE_HASHI_VAULT_ADDR
to the same value in those invocations. After updating to a post-change collection (eitherv0.2.0
orv1.0.0
), remove theVAULT_ADDR
setting.community.hashi_vault
v0.2.0
: setANSIBLE_HASHI_VAULT_ADDR
instead ofVAULT_ADDR
. No other changes are needed forv1.0.0
.ISSUE TYPE
COMPONENT NAME
hashi_vault.py
ANSIBLE VERSION
CONFIGURATION
OS / ENVIRONMENT
STEPS TO REPRODUCE
EXPECTED RESULTS
INI value is specific to ansible, and should be used over the more system wide
VAULT_ADDR
.ACTUAL RESULTS
INI value will never be used if
VAULT_ADDR
is set.The text was updated successfully, but these errors were encountered: