Broken Compatibility for write for pki

[terryhowe]

Broken Compatibility for write for pki

[TerryHowe]

I could use a pip list, environment you are working in, what command you are running and the output

[seeder]

We have used this construct :

  hashivault_write:
    token: "{{vault_pki_token}}"
    url: "{{vault_pki_url}}"
    secret: "/{{vault_pki_path}}/issue/{{vault_pki_role}}"
    data: "{{vault_pki_issue_}}"
  register: vault_pki_issue_result
  run_once: yes

and inside vault_pki_issue_result was data with certificate and key now there is only msg. :(

in data is {"cn": "our-lovely-cn.com"}

[TerryHowe]

And the message is?

[TerryHowe]

I also need the version of ansible-module-hashivault you are running

[TerryHowe]

it may be that leading '/' on your secret name. Is that secret on the mount point /secret or /{{vault_pki_path}}?

[seeder]

What gets returned is { "changed": true, "msg": "Secret /devops-pki/issue/config-uksouth-staging written", "rc": 0 }

vault_pki_path is a path to mounted PKI backed https://www.vaultproject.io/docs/secrets/pki/index.html

[seeder]

Tried with latest version from this repo also using hvac 0.2.16

[seeder]

btw we actually have forked your repo and made improvements to previous version.

So it looks like this functionality was never in your version https://github.com/generiklimited/ansible-modules-hashivault , sorry!

[TerryHowe]

I'm not following on what the problem is with { "changed": true, "msg": "Secret /devops-pki/issue/config-uksouth-staging written", "rc": 0 } is that the incorrect mount point?

There was a change around 2.9 where if the secret name starts with / it is assumed absolute path meaning you are specifying the mount point. It doesn't assume that the mount point ins /secret anymore. I assume this is what you are seeing.

[TerryHowe]

If you have any more PRs, that'd probably make life easier for both of us.

[seeder]

Mount point is correct, however, client.write returns data from vault response, and it is required for use with PKI. ( as when you write to pki/issue/role it returns the certificate and key )

I will write the patch it requires for your latest version when I get a spare time.

[TerryHowe]

https://pypi.python.org/pypi/ansible-modules-hashivault/2.10.0 new release should have what you want

[TerryHowe]

I'm going to close this out, if you have something else, reopen or make a new issue, thanks for the PR!