diff --git a/plugins/module_utils/utils.py b/plugins/module_utils/utils.py new file mode 100644 index 0000000..85f3cff --- /dev/null +++ b/plugins/module_utils/utils.py @@ -0,0 +1,29 @@ +from ansible_collections.devolutions.dvls.plugins.module_utils.vaults import get_vault_entry +import requests +import json + +def get_sensible_value(server_base_url, token, vault_id, entries): + fetched_secrets = {} + + if isinstance(entries, dict) and 'data' in entries: + entries = entries.get('data', []) + + if not isinstance(entries, list): + return {"error": f"Expected list of entries, got {type(entries).__name__}"} + + for secret in entries: + if not isinstance(secret, dict): + continue + + entry_name = secret.get('name') + if not entry_name or 'id' not in secret: + continue + + try: + entry = get_vault_entry(server_base_url, token, vault_id, secret['id']) + if isinstance(entry, dict) and 'data' in entry: + fetched_secrets[entry_name] = entry['data'] + except Exception as e: + fetched_secrets[entry_name] = {"error": str(e)} + + return fetched_secrets diff --git a/plugins/module_utils/vaults.py b/plugins/module_utils/vaults.py index 5722841..56eab9b 100644 --- a/plugins/module_utils/vaults.py +++ b/plugins/module_utils/vaults.py @@ -35,6 +35,67 @@ def get_vault_entry(server_base_url, token, vault_id, entry_id): except Exception as e: raise Exception(f"An error occurred while getting a vault entry: {e}") +def get_vault_entry_from_name(server_base_url, token, vault_id, entry_name): + vault_url = f"{server_base_url}/api/v1/vault/{vault_id}/entry" + vault_headers = { + "Content-Type": "application/json", + "tokenId": token + } + + try: + response = requests.get(vault_url, headers=vault_headers, params={'name': entry_name}) + response.raise_for_status() + + return response.json() + except Exception as e: + raise Exception(f"An error occurred while getting a vault entry: {e}") + +def get_vault_entry_from_tag(server_base_url, token, vault_id, entry_tag): + vault_url = f"{server_base_url}/api/v1/vault/{vault_id}/entry" + vault_headers = { + "Content-Type": "application/json", + "tokenId": token + } + + try: + response = requests.get(vault_url, headers=vault_headers, params={'tag': entry_tag}) + response.raise_for_status() + + return response.json() + except Exception as e: + raise Exception(f"An error occurred while getting a vault entry: {e}") + +def get_vault_entry_from_path(server_base_url, token, vault_id, entry_path): + vault_url = f"{server_base_url}/api/v1/vault/{vault_id}/entry" + vault_headers = { + "Content-Type": "application/json", + "tokenId": token + } + + try: + response = requests.get(vault_url, headers=vault_headers, params={'path': entry_path}) + response.raise_for_status() + + return response.json() + except Exception as e: + raise Exception(f"An error occurred while getting a vault entry: {e}") + +def get_vault_entry_from_type(server_base_url, token, vault_id, entry_type): + vault_url = f"{server_base_url}/api/v1/vault/{vault_id}/entry" + vault_headers = { + "Content-Type": "application/json", + "tokenId": token + } + + try: + response = requests.get(vault_url, headers=vault_headers, params={'type': entry_type}) + response.raise_for_status() + + return response.json() + except Exception as e: + raise Exception(f"An error occurred while getting a vault entry: {e}") + + def get_vault_entries(server_base_url, token, vault_id): vault_url = f"{server_base_url}/api/v1/vault/{vault_id}/entry" vault_headers = { diff --git a/plugins/modules/fetch_secrets.py b/plugins/modules/fetch_secrets.py index 3a06a8c..3ef6618 100644 --- a/plugins/modules/fetch_secrets.py +++ b/plugins/modules/fetch_secrets.py @@ -72,7 +72,8 @@ from ansible.module_utils.basic import AnsibleModule from ansible_collections.devolutions.dvls.plugins.module_utils.auth import login, logout -from ansible_collections.devolutions.dvls.plugins.module_utils.vaults import get_vaults, get_vault_entry, get_vault_entries, find_entry_by_name +from ansible_collections.devolutions.dvls.plugins.module_utils.utils import get_sensible_value +from ansible_collections.devolutions.dvls.plugins.module_utils.vaults import get_vaults, get_vault_entry, get_vault_entry_from_name, get_vault_entry_from_tag, get_vault_entry_from_type, get_vault_entry_from_path, get_vault_entries import os import json import requests @@ -88,7 +89,10 @@ def run_module(): elements='dict', options=dict( secret_name=dict(type='str', required=False), - secret_id=dict(type='str', required=False) + secret_id=dict(type='str', required=False), + secret_path=dict(type='str', required=False), + secret_type=dict(type='str', required=False), + secret_tag=dict(type='str', required=False) ), required=False ) @@ -124,25 +128,31 @@ def run_module(): for secret in secrets: secret_name = secret.get('secret_name') secret_id = secret.get('secret_id') + secret_tag = secret.get('secret_tag') + secret_type = secret.get('secret_type') + secret_path = secret.get('secret_path') - if not secret_name and not secret_id: - module.fail_json(msg="Each secret must have either a secret_name or a secret_id", **result) + if not secret_name and not secret_id and not secret_tag and not secret_type and not secret_path: + module.fail_json(msg="Each secret must have either a secret_name or a secret_id or a secret_tag or a secret_type or a secret_path", **result) if secret_id: entry = get_vault_entry(server_base_url, token, vault_id, secret_id) fetched_secrets[secret_id] = entry['data'] - else: - entry = find_entry_by_name(entries, secret_name) - if not entry: - module.fail_json(msg=f"Secret '{secret_name}' not found", **result) - secret_id = entry['id'] - entry = get_vault_entry(server_base_url, token, vault_id, secret_id) - fetched_secrets[secret_name] = entry['data'] + elif secret_name: + entries = get_vault_entry_from_name(server_base_url, token, vault_id, secret_name) + name_results = get_sensible_value(server_base_url, token, vault_id, entries) + fetched_secrets.update(name_results) + elif secret_tag: + entries = get_vault_entry_from_tag(server_base_url, token, vault_id, secret_tag) + fetched_secrets = get_sensible_value(server_base_url, token, vault_id, entries) + elif secret_path: + entries = get_vault_entry_from_path(server_base_url, token, vault_id, secret_path) + fetched_secrets = get_sensible_value(server_base_url, token, vault_id, entries) + elif secret_type: + entries = get_vault_entry_from_type(server_base_url, token, vault_id, secret_type) + fetched_secrets = get_sensible_value(server_base_url, token, vault_id, entries) else: - for secret in entries: - entry_name = secret['name'] - entry = get_vault_entry(server_base_url, token, vault_id, secret['id']) - fetched_secrets[entry_name] = entry['data'] + fetched_secrets = get_sensible_value(server_base_url, token, vault_id, entries) result = fetched_secrets