puppet lookup does not work as desired

[petems]

puppet lookup does not work as desired

[saini01]

Thank you Peter for your swift reply. This was exactly the missing piece of information with default_field: value

Now with hiera-vault it works like a charm both from puppet master and agent. You saved me :).

I still need to figure out how to use it with the deferred function and vault_lookup module. Trying the same with vault_lookup module does not work.

$vault_second_test = Deferred('vault_lookup::lookup', ['puppet_secret/certname/my_password', 'https://VAULT_SERVER:8200'])
  notify {"second test vault ${vault_second_test}":}

Many Thanks.

[petems]

So you're mixing up two things here, both vault_lookup and hiera_vault

Right now, you're not using hiera-vault at all, because that doesn't use an explicit lookup unless you do a looku call or for automatic parameter lookup.

So you'd need some code like:

$vault_notify = lookup({"name" => "my_password", "default_value" => "No Vault Secret Found"})  
notify { "testing vault ${vault_notify}":}

You'd also need to change your hiera.yaml or the key you want to send:

default_field: value means that the value will look for the value within the KV data json at value, but right now your secret is my_password=foo123. The path also needs to have the key you want to lookup. So you probably wantto change that to value=foo123:

vault kv put puppet_secret/certname/my_password value=foo123

If you want to use hiera_vault, check out this repo with a Vagrant setup: https://github.com/petems/puppet-hiera-vault-vagrant

Let me know how that goes