-
Notifications
You must be signed in to change notification settings - Fork 381
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Missing parameters for token.create_or_update_role #1012
Comments
Hi @bendem , welcome back! Thank you for opening this issue. Are you working on or interested in posting a PR, or is this up-for-grabs? |
I'm not working on this at the moment no. I have been wondering if it would make sense to use add some kwargs to vault methods to avoid blocking users when hvac is lagging behind on new parameters. I have implemented something similar in the ansible module we use on top of hvac, but I don't think I'll have time to look into hvac for the following weeks. TerryHowe/ansible-modules-hashivault@6cffb8d Another solution I was thinking about that would allow hvac to keep validating parameters would be to use kwargs, but delegate to stubs generated from the OpenAPI spec (https://developer.hashicorp.com/vault/api-docs/system/internal-specs-openapi). This would make updating much faster and could even be automated so that hvac is always up to date with the latest vault API. |
Partially resolved by #842
No worrieds thanks anyway for reporting it.
Thanks, the main thing I would be concerned about with an approach like that is doing meaningful testing. In units we can mostly just check to see if those parameters are passed through the methods, but in integration tests we probably want some awareness of what parameters mean so we can test those. It also means we would lack documentation. We could still go back and these as explicit parameters as we find them, but with a workaround, those reports may never come either. I might also be misunderstanding the solution somewhat. I guess my current feeling is that I'd rather add parameters more intentionally and have it be clear what the library intends to support. It does mean we can lag behind (especially if we're lacking in contributors and maintainers) but I'm hoping to solve for that with more participation: #994 btw I haven't used those Ansible modules, but I do also maintain the
This is possible, but I think it would represent a pretty large change in the structure of I heard about a possible python library being built from the ground up to do this for Vault (auto-generated based on API spec), but I'm not involved in that and don't know if it was ever started or what the status is. Please feel free to submit either of these suggestions as separate proposals that could be discussed independently: |
A bunch of restrictions are now available for token roles that aren't supported by hvac yet:
allowed_policies_glob
disallowed_policies_glob
token_bound_cidrs
token_explicit_max_ttl
token_no_default_policy
token_num_uses
token_period
token_type
The text was updated successfully, but these errors were encountered: