Module Fails with Self-Signed Vault Certificate

[fia5000]

Module Fails with Self-Signed Vault Certificate

[TerryHowe]

I thought there was a way to do this, but I'll have to investigate.

[TerryHowe]

This should do it https://github.com/TerryHowe/ansible-modules-hashivault/blob/master/ansible/modules/hashivault/hashivault_read.py#L14

[rattermeyer]

The verify = False removes the error, but does not resolve the problem.
Especially as this is a security related module, I would like not to turn off verification, but enable to specify / whitelist the CA cert. This could be done using VAULT_CACERT or _CAPATH (see https://www.vaultproject.io/docs/commands/environment.html).
Haven't tested the lookup module, but it seems you are using there the VAULT_CAPATH already.

[TerryHowe]

Okay, maybe it isn't documented clearly enough, but this module uses hvac to access vaulty and hvac uses requests. Requests takes verify as a boolean or a string to the capath. I haven't tested it, but it should work:

http://docs.python-requests.org/en/master/user/advanced/#ssl-cert-verification

[TerryHowe]

The lookup plugin is a little nicer about defaulting verify: https://github.com/TerryHowe/ansible-modules-hashivault/blob/master/ansible/plugins/lookup/hashivault.py#L37

Maybe a good enhancement here would be to use a similar logic that the lookup plugin uses in the regular module

[rattermeyer]

Hi,
that's what I understood as well, so I tried:

hashivault_status:
  verify: /etc/ssl/certs/cluster-ca.pem

But this results in /etc/ssl/certs/cluster-ca.pem is not a valid boolean. Valid booleans include: y,yes,on,1,true,1,True,n,no,off,0,false,0,False"

which might come from hashivault_argspec / _init:
verify = dict(required=False, default=(not os.environ.get('VAULT_SKIP_VERIFY', '')), type='bool'),

or maybe I am missing something.

[TerryHowe]

Could you do my a favor and remove the type specified in that line from within you venv and let me know if it works. If that doesn't work, tryp type='str'. I don't have anything to test that right now and setting up a system to test that would be time consuming.

[rattermeyer]

Hi,
will give it a try. Need to understand how to "develop" ansible module. Might take some days until I find time...

[TerryHowe]

No need to do real development, just edit the file in your venv directly most likely something like editing the file $VIRTUAL_ENV/lib/python2.7/site-packages/ansible/module_utils/hashivault.py and edited line 12 I think:
verify = dict(required=False, default=(not os.environ.get('VAULT_SKIP_VERIFY', '')), type='str'),

[dizzler]

Improved support for TLS via hvac is in PR #32 https://github.com/TerryHowe/ansible-modules-hashivault/pull/32

[TerryHowe]

https://pypi.python.org/pypi/ansible-modules-hashivault it is live