-
Notifications
You must be signed in to change notification settings - Fork 381
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
No way to check if a secret path exists #381
Comments
I'm with @viralpoetry on this issue. That said, would having an optional parameter (or something similar) on the implicated methods that would toggle returning |
@jeffwecan that would absolutely solve my concern. I've been able to get around this using a try catch block. was just looking for a nicer way to ensure that I'm not overwriting existing secrets. |
I've had the same concern from time to time! I'll queue this issue up for the next release and see if we can get something sorted... |
Oh and to be clear, is your particular use case tied to KV v1, v2, or just a general secrets engines concern? |
its the same for KV1 and KV2 but currently using KV2 |
Wouldn't it be better to use a construct such as below instead? After this, you can either use patch() or create_or_update_secret() to update the secret. Creating the path is obviously not required and depends on your use case, but returning None instead of an exception may create confusion as to whether the value is None, or the value doesn't exist. # see if the path exists
try:
data = client.secrets.kv.v2.read_secret_version(
path='your/path/here',
)
# if not, it will throw an exception
except hvac.exceptions.InvalidPath:
client.secrets.kv.v2.create_or_update_secret(
path='your/path/here',
secret=dict(pssst=None),
)
pass |
I have to agree that this is a bit outside the library's control. Vault returns a 404, and so that is the exception we raise. We recently made a change to optionally not raise an exception for a specific type of 404 (see also: #955) but that is a different case since that 404 returns useful data with it. 404 is an appropriate response for a path that doesn't exist. I recommend using the |
I need to programatically verify if a path exists before writing a secret to it. a simple read to check the path throws and exception "path doesn't exist"
The text was updated successfully, but these errors were encountered: