Added ipa vault lookup plugin

[mvazquezc]

SUMMARY

Added IPA Vault lookup plugin. With this lookup you can:

• list existing vaults
• show information about vaults
• retrieve information for standard, symmetric and asymmetric vaults (data will be returned b64 encoded)

ISSUE TYPE

• Feature Pull Request

COMPONENT NAME

ipa_vault

ANSIBLE VERSION

ansible 2.5.5
  config file = None
  configured module search path = [u'/home/cloud-user/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /home/cloud-user/ipa_vault/venv/lib/python2.7/site-packages/ansible
  executable location = /home/cloud-user/ipa_vault/venv/bin/ansible
  python version = 2.7.5 (default, Feb 20 2018, 09:19:12) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)]

ADDITIONAL INFORMATION

TASK [Query ipa for all vaults availabe for the krb token] **********************************************************************************************************************************************************
ok: [localhost] => {
    "msg": [
        [
            {
                "Type": "standard", 
                "Vault name": "test01", 
                "Vault user": "admin"
            }
        ], 
        [
            {
                "Type": "symmetric", 
                "Vault name": "test02", 
                "Vault user": "admin"
            }
        ], 
        [
            {
                "Type": "asymmetric", 
                "Vault name": "test03", 
                "Vault user": "admin"
            }
        ]
    ]
}

TASK [Query ipa for details about an specific vault] ****************************************************************************************************************************************************************
ok: [localhost] => {
    "msg": [
        {
            "Owner users": "admin", 
            "Type": "standard", 
            "Vault name": "test01", 
            "Vault user": "admin"
        }
    ]
}

TASK [Retrieve vault content for a standard vault] ******************************************************************************************************************************************************************
ok: [localhost] => {
    "msg": [
        {
            "Data": "dGVzdDAxCg=="
        }
    ]
}

TASK [Retrieve vault content for a symmetric vault] *****************************************************************************************************************************************************************
ok: [localhost] => {
    "msg": [
        {
            "Data": "dGVzdDAyCg=="
        }
    ]
}

TASK [Retrieve vault content for an asymmetric vault] ***************************************************************************************************************************************************************
ok: [localhost] => {
    "msg": [
        {
            "Data": "dGVzdDAzCg=="
        }
    ]
}

TASK [Retrieve vault content for a symmetric vault using a non-default location for ipa binary] *********************************************************************************************************************
ok: [localhost] => {
    "msg": [
        {
            "Data": "dGVzdDAyCg=="
        }
    ]
}

[ansibot]

The test ansible-test sanity --test ansible-doc --python 2.6 [explain] failed with 1 error:

lib/ansible/plugins/lookup/ipa_vault.py:0:0: has a documentation error formatting or is missing documentation.

The test ansible-test sanity --test compile --python 2.6 [explain] failed with 1 error:

lib/ansible/plugins/lookup/ipa_vault.py:102:33: SyntaxError: _list = {k: v for k, v in temp_list}

click here for bot help

[ansibot]

The test ansible-test sanity --test ansible-doc --python 2.6 [explain] failed with 1 error:

lib/ansible/plugins/lookup/ipa_vault.py:0:0: has a documentation error formatting or is missing documentation.

The test ansible-test sanity --test compile --python 2.6 [explain] failed with 1 error:

lib/ansible/plugins/lookup/ipa_vault.py:102:33: SyntaxError: _list = {k: v for k, v in temp_list}

click here for bot help

[ansibot]

@mvazquezc this PR contains the following merge commits:

• c10b86f

Please rebase your branch to remove these commits.

click here for bot help

[mvazquezc]

The only test that failed seems that was due to a connectivity error. Could tests be re-run?

[mvazquezc]

@samdoran Is there anything I could do in order to re-run the failed test?

[samdoran]

I just re-ran the failed test.

[fxfitz]

I'm surprised you implemented this as a lookup plugin instead of a module. Any reason not to go the module route?

I ask because there's another very similar PR open right now (#41902).

[mvazquezc]

Well, I thought that since the main functionality is gathering data from a vault, a lookup would be "a better choice". For me, it works like the "file" lookup which gets the content of a file. Does that make sense? @fxfitz

[jparrill]

@fxfitz regarding your question, a module purpose will perform an action (create vault, archive vault data, etc...) into the destination system and this just will catch the vault information/data. Time ago many PR's was rejected because of that fact. Ansible people always tries to separate the lookup purposes from the modules ones.

[fxfitz]

@jparrill @mvazquezc Thanks for the clarification! To be honest I hadn't dived into a full-blown review yet to catch the difference (woops; my bad. I spoke too soon! 😄), I just noticed the similarity in the PR list.

I'll dive in on this ASAP.

[fxfitz]

What do you think about using IPAClient to achieve the same results? That way you're not parsing stdout, you'll have json results, you won't have the ipa client utility, etc etc etc

[fxfitz]

This should be 1.1. Ref: https://docs.ansible.com/ansible/2.6/dev_guide/developing_modules_documenting.html#ansible-metadata-block

[fxfitz]

Hmm. On second thought, I'm not even sure if ANSIBLE_METADATA is used in lookup plugins? I think that's only for modules specifically.

[mvazquezc]

Fixed.

[fxfitz]

I think this would be 2.7.

[mvazquezc]

Fixed.

[fxfitz]

Typo: s/controll/control

[fxfitz]

Typo: s/againg/again

[mvazquezc]

Fixed

[fxfitz]

just an idea: While I know this isn't module, you could get around this requirement by using IPAClient and pull the same information from the IPA Web API.

[mvazquezc]

This was my first approach, but sadly IPAClient should change the way it works in order to be able to take advantage of it within a lookup plugin.

Basically their post_json method needs a module object to work, in this lookup we don't use this kind of objects. I tried initializing an empty module object and it didn't work because post_json method needs some information present in the object.

On top of that, they should implement cryptographic functions in order to generate the session key needed to interact with the Vault API.

As a first step we opened an Issue[1] so maybe they can fix the first problem (post_json needing a module object), once this issue is solved we can try to implement this using IPAClient rather than using ipa cli.

[1] #42616

[fxfitz]

Typo: s/availabe/available

[mvazquezc]

Solved.

[mvazquezc]

Changes pushed.

[mvazquezc]

Solved.

[mvazquezc]

Fixed

[mvazquezc]

Fixed.

[mvazquezc]

Fixed.

[mvazquezc]

This was my first approach, but sadly IPAClient should change the way it works in order to be able to take advantage of it within a lookup plugin.

Basically their post_json method needs a module object to work, in this lookup we don't use this kind of objects. I tried initializing an empty module object and it didn't work because post_json method needs some information present in the object.

On top of that, they should implement cryptographic functions in order to generate the session key needed to interact with the Vault API.

As a first step we opened an Issue[1] so maybe they can fix the first problem (post_json needing a module object), once this issue is solved we can try to implement this using IPAClient rather than using ipa cli.

[1] #42616

[ansibot]

@mvazquezc this PR contains the following merge commits:

• f25dbb5

Please rebase your branch to remove these commits.

click here for bot help

[mvazquezc]

Hey @fxfitz,

Have you seen the pushed changes?

Thanks,

[schegi]

I added some ipa_vault related modules recently (cf. #44631). Together with the modules i added IPAVaultClient (ipa_vault.py in module_utils) as extention to IPAClient which adds all necessray transport, symmetric and asymmetric en/decryption functionality necessary to handle vault data. Maybe this is interessting for you to get rid of all cli calls in your lookup. But it has to pass review first.

[Akasurde]

Hi @mvazquezc, Thank you very much for your interest in Ansible. This plugin/module is no longer maintained in this repository and has been migrated to https://github.com/ansible-collections/community.general

If you have further questions please stop by IRC or the mailing list:

* IRC: #ansible on irc.freenode.net
* mailing list: https://groups.google.com/forum/#!forum/ansible-project

needs_info