feat(vault): extract shared AppRole env helper module - #281
Merged
Conversation
Adds a thin `vault/` Dagger module exposing `WithAppRoleEnv(ctr, roleID?, secretID?, addr?)` that attaches VAULT_ROLE_ID, VAULT_SECRET_ID, VAULT_ADDR as masked secrets on a container. The helper does no Vault login itself — it's plumbing for downstream tools (vals, ansible playbooks) that read those envs. Wires the new module as a Dagger dependency in `ansible/dagger.json` and `helm/dagger.json`, then replaces the duplicated three-`if` env blocks in `ansible/execute.go` and `helm/helmfile.go` with a single `dag.Vault().WithAppRoleEnv(...)` call. Also re-pins `dagger.io/dagger` to v0.20.8 in vault/, ansible/ and helm/ go.mod — `dagger develop` had regressed all three to the pseudo-version `v0.20.6-0.20260415192040-7058e9313c72` (same bug fixed for six modules in #264). Refs #262 (P3 — extract shared Vault AppRole helper). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
patrick-hermann-sva
temporarily deployed
to
linting
May 28, 2026 06:53 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
11 tasks
patrick-hermann-sva
pushed a commit
that referenced
this pull request
May 28, 2026
# [0.115.0](v0.114.0...v0.115.0) (2026-05-28) ### Features * **ci:** add .golangci.yml and wire into per-module CI ([#274](#274)) ([bda97c9](bda97c9)), closes [#262](#262) [#262](#262) * **ci:** add per-module PR test workflow ([#273](#273)) ([dd58cae](dd58cae)), closes [#262](#262) * **crossplane:** add Verify for offline Configuration checks ([#278](#278)) ([210c6e0](210c6e0)), closes [#277](#277) * feat/add-update-vault-module ([ac9631e](ac9631e)) * **vault:** extract shared AppRole env helper module ([#281](#281)) ([8f38d23](8f38d23)), closes [#264](#264) [#262](#262)
Contributor
Author
|
🎉 This PR is included in version 0.115.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
vault/Dagger module exposingWithAppRoleEnv(ctr, roleID?, secretID?, addr?)that attachesVAULT_ROLE_ID,VAULT_SECRET_ID,VAULT_ADDRas masked secrets on a container.ansible/dagger.json+helm/dagger.jsonand replaces the duplicated three-ifenv blocks inansible/execute.goandhelm/helmfile.gowith a singledag.Vault().WithAppRoleEnv(...)call.dagger.io/dagger v0.20.8invault/,ansible/,helm/go.mod —dagger develophad regressed all three to thev0.20.6-0.20260415192040-7058e9313c72pseudo-version (same scaffold bug fixed for six modules in feat: align all modules to dagger engine + sdk v0.20.8 #264).The helper does no Vault login — it's plumbing for downstream tools (vals, ansible playbooks) that read those envs. Designed as a home for future Vault helpers (e.g.
vals get, KV2 fetch, token renewal).Refs #262 — P3 "Extract shared Vault AppRole helper".
Why a separate module
Cross-module Go imports are awkward inside Dagger; the established pattern for sharing across modules is a thin Dagger module declared as a dependency (precedent:
argocd → helm). Consumers get a typeddag.Vault()binding through generated code.Test plan
go build ./...clean invault/,ansible/,helm/go vet ./...clean invault/,ansible/,helm/(one pre-existingfmt.Println %vwarning inansible/pipeline.gois onmain, unrelated)dagger functions -m ./vaultlistswith-app-role-envdagger functions -m ./ansibleand-m ./helmstill list their full function set — no schema regressiontask test-ansible/task test-helmagainst a live Vault — requires creds, recommend running before merge🤖 Generated with Claude Code