-
Notifications
You must be signed in to change notification settings - Fork 155
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
database secrets engine config #133
Changes from all commits
3b31b19
7261209
e6c3914
d5b3d4d
851ea04
bb3310d
4684e46
0d4725a
8e25519
2220906
9d17e88
7fdd60e
a283ca0
c892e4f
79a8868
225acfe
0bd59ab
d29a420
de33a46
a8f02ff
723f695
41d0101
0fc7868
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,2 +1,3 @@ | ||
[defaults] | ||
retry_files_enabled = False | ||
nocows = 1 |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -133,9 +133,9 @@ def main(): | |
argspec['num_uses'] = dict(required=False, type='int', default=0) | ||
|
||
supports_check_mode=True | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Should this really be gone? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. so for some reason, python 36 and 27 fail on this line... something about "too many arguments". however, 37 it works... i removed it but left it for future re-integration. i probably should have included a note on that though |
||
required_one_of=[['bound_service_principal_ids', 'bound_group_ids', 'bound_locations', 'bound_subscription_ids', 'bound_resource_groups', 'bound_scale_sets', 'role_file', 'state']] | ||
# required_one_of=[['bound_service_principal_ids', 'bound_group_ids', 'bound_locations', 'bound_subscription_ids', 'bound_resource_groups', 'bound_scale_sets', 'role_file', 'state']] | ||
|
||
module = hashivault_init(argspec, supports_check_mode, required_one_of) | ||
module = hashivault_init(argspec, supports_check_mode) #, required_one_of) | ||
result = hashivault_azure_auth_role(module) | ||
if result.get('failed'): | ||
module.fail_json(**result) | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -59,7 +59,7 @@ | |
mount_point: | ||
description: | ||
- name of the secret engine mount name. | ||
default: azure | ||
default: 'azure' | ||
subscription_id: | ||
description: | ||
- azure SPN subscription id | ||
|
@@ -87,12 +87,12 @@ | |
- hashivault_azure_secret_engine_config: | ||
subscription_id: 1234 | ||
tenant_id: 5689-1234 | ||
tenant_id: 5689-1234 | ||
client_id: 1012-1234 | ||
client_secret: 1314-1234 | ||
|
||
- hashivault_azure_secret_engine_config: | ||
config_file: /home/drewbuntu/azure-config.json | ||
mount_point: azure | ||
''' | ||
|
||
|
||
|
@@ -105,9 +105,10 @@ def main(): | |
argspec['client_secret'] = dict(required=False, type='str') | ||
argspec['environment'] = dict(required=False, type='str', default='AzurePublicCloud') | ||
argspec['config_file'] = dict(required=False, type='str', default=None) | ||
supports_check_mode=True | ||
required_together=[['subscription_id', 'client_id', 'client_secret', 'tenant_id']] | ||
|
||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. required_together is actually the 4th arg, so I'm going to change this back. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. thanks! There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Connect with me on https://www.linkedin.com/in/terrylhowe/ if you like |
||
module = hashivault_init(argspec, supports_check_mode=True, required_together=required_together) | ||
module = hashivault_init(argspec, supports_check_mode, required_together) | ||
result = hashivault_azure_secret_engine_config(module) | ||
if result.get('failed'): | ||
module.fail_json(**result) | ||
|
@@ -119,48 +120,41 @@ def main(): | |
def hashivault_azure_secret_engine_config(module): | ||
params = module.params | ||
client = hashivault_auth_client(params) | ||
changed = True | ||
changed = False | ||
config_file = params.get('config_file') | ||
mount_point = params.get('mount_point') | ||
desired_state = dict() | ||
|
||
# do not want a trailing slash in mount_point | ||
if mount_point: | ||
if mount_point[-1]: | ||
mount_point = mount_point.strip('/') | ||
|
||
# if config_file is set, set sub_id, ten_id, client_id, client_secret from file | ||
# else set from passed args | ||
if config_file: | ||
config = json.loads(open(params.get('config_file'), 'r').read()) | ||
tenant_id = config.get('tenant_id') | ||
subscription_id = config.get('subscription_id') | ||
client_id = config.get('client_id') | ||
client_secret = config.get('client_secret') | ||
desired_state = json.loads(open(params.get('config_file'), 'r').read()) | ||
if 'environment' not in desired_state: | ||
desired_state['environment'] = 'AzurePublicCloud' | ||
else: | ||
tenant_id = params.get('tenant_id') | ||
subscription_id = params.get('subscription_id') | ||
client_id = params.get('client_id') | ||
client_secret = params.get('client_secret') | ||
desired_state['tenant_id'] = params.get('tenant_id') | ||
desired_state['subscription_id'] = params.get('subscription_id') | ||
desired_state['client_id'] = params.get('client_id') | ||
desired_state['client_secret'] = params.get('client_secret') | ||
desired_state['environment'] = params.get('environment') | ||
|
||
# check if engine is enabled | ||
if (mount_point + "/") not in client.sys.list_mounted_secrets_engines()['data'].keys(): | ||
return {'failed': True, 'msg': 'secret engine is not enabled', 'rc': 1} | ||
|
||
# check if current config matches desired config values, if they match, set changed to false to prevent action | ||
current = client.secrets.azure.read_config() | ||
if sys.version_info[0] < 3: | ||
changed = False | ||
mismatched = {k:v for k, v in current.items() if params[k] != v} | ||
if mismatched: | ||
current_state = client.secrets.azure.read_config() | ||
for k, v in current_state.items(): | ||
if v != desired_state[k]: | ||
changed = True | ||
else: | ||
if current.items() < params.items(): | ||
changed = False | ||
|
||
# if configs dont match and checkmode is off, complete the change | ||
if changed == True and not module.check_mode: | ||
result = client.secrets.azure.configure(tenant_id=tenant_id, subscription_id=subscription_id, | ||
client_id=client_id, client_secret=client_secret, | ||
mount_point=mount_point) | ||
result = client.secrets.azure.configure(mount_point=mount_point, **desired_state) | ||
|
||
return {'changed': changed} | ||
|
||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This document seems wrong to me like this should be a yaml dictionary rather than a string.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
you talking about the
default
line? yeah, interestingly it works either way. when i first submitted the PR it was in standard{}
format but after i started getting the sphinx issues i was messing with the format because i didnt know what was borking it.i agree though, the doc example should show without the
"
, though it does work either way