1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2024-09-14 20:13:21 +02:00
community.general/test/units
Adrian Likins 297dfb1d50 Vault secrets script client inc new 'keyring' client (#27669)
This adds a new type of vault-password script  (a 'client') that takes advantage of and enhances the 
multiple vault password support.

If a vault password script basename ends with the name '-client', consider it a vault password script client. 

A vault password script 'client' just means that the script will take a '--vault-id' command line arg.

The previous vault password script (as invoked by --vault-password-file pointing to an executable) takes
no args and returns the password on stdout. But it doesnt know anything about --vault-id or multiple vault
passwords.

The new 'protocol' of the vault password script takes a cli arg ('--vault-id') so that it can lookup that specific
vault-id and return it's password.

Since existing vault password scripts don't know the new 'protocol', a way to distinguish password scripts
that do understand the protocol was needed.  The convention now is to consider password scripts that are
named like 'something-client.py' (and executable) to be vault password client scripts.

The new client scripts get invoked with the '--vault-id' they were requested for. An example:

     ansible-playbook --vault-id my_vault_id@contrib/vault/vault-keyring-client.py some_playbook.yml

That will cause the 'contrib/vault/vault-keyring-client.py' script to be invoked as:

     contrib/vault/vault-keyring-client.py --vault-id my_vault_id

The previous vault-keyring.py password script was extended to become vault-keyring-client.py. It uses
the python 'keyring' module to request secrets from various backends. The plain 'vault-keyring.py' script
would determine which key id and keyring name to use based on values that had to be set in ansible.cfg.
So it was also limited to one keyring name.

The new vault-keyring-client.py will request the secret for the vault id provided via the '--vault-id' option.
The script can be used without config and can be used for multiple keyring ids (and keyrings).

On success, a vault password client script will print the password to stdout and exit with a return code of 0.
If the 'client' script can't find a secret for the --vault-id, the script will exit with return code of 2 and print an error to stderr.
2017-10-13 15:23:08 -04:00
..
cli Don't ask for password confirm on 'ansible-vault edit' (#30514) 2017-09-19 17:39:51 -04:00
config config tests 2017-10-12 19:26:39 -04:00
contrib Update vmware_inventory (#26308) 2017-07-18 07:20:23 -04:00
errors test/: PEP8 compliancy (#24803) 2017-05-30 18:05:19 +01:00
executor move from with_<lookup>: to loop: 2017-10-10 15:43:49 -04:00
inventory_test_data/group_vars Merge branch 'v2_final' into devel_switch_v2 2015-05-28 15:26:03 -05:00
mock Fix dangerous default args. (#29839) 2017-09-12 00:11:13 -07:00
module_utils Make ansible_selinux facts a consistent type (#31065) 2017-10-05 09:19:08 -04:00
modules This patch fixes a number of outstanding bugs and code convention problems. (#31618) 2017-10-13 09:47:49 -07:00
parsing Vault secrets script client inc new 'keyring' client (#27669) 2017-10-13 15:23:08 -04:00
playbook less confusing 'args' message (#29053) 2017-09-06 18:20:06 -04:00
plugins Feature/test inventory (#30707) 2017-10-02 23:01:25 -07:00
template template: fix KeyError: 'undefined variable: 0 (#27972) 2017-08-09 18:50:53 -04:00
utils test/: PEP8 compliancy (#24803) 2017-05-30 18:05:19 +01:00
vars Miscellaneous pylint fixes. 2017-09-13 01:53:08 -07:00
__init__.py Add empty-init code-smell script. (#18406) 2016-11-07 15:02:13 -08:00
ansible.cfg Fix ansible-test config management. 2017-10-04 12:52:36 -07:00
conftest.py Fix bugs in ansible-test units command. (#24044) 2017-04-27 11:21:11 +08:00
test_constants.py 1st part of ansible config, adds ansible-config to view/manage configs (#12797) 2017-06-14 11:08:34 -04:00