Vault Secret Engine 2

[terryhowe]

Vault Secret Engine 2

[willwh]

@drewmullen pounding on the keyboard too hard, I didn't realize I had created an issue with no detail;)

[drewmullen]

whats the problem

[drewmullen]

kv 2 requires you start using either data/ or metadata/ right after your secret engine. you can find the hashi docs: https://www.vaultproject.io/docs/secrets/kv/kv-v2.html#acl-rules

i had some issues with using this custom plugin too but we found some workarounds. try tinkering with these as examples and lmk what you find: #62

first thing i recommend you try is secret/data/certifications

[willwh]

Indeed, and that works in some cases, i.e. setting a variable can be done like this:

{{ lookup('hashivault', '/secret/data/certificates/cert1.domain.com', 'data')[\"crt\"] }} // this would fetch the `crt` key's value

The above syntax does not work in jinja templates......

It also looks like hashivault_read and hashivault_list do no work in this situation at all.......

If you've had success, I'd love to hear more about said workarounds. I'm willwh on Freenode IRC if you are there too and want to chat.....

[willwh]

i.e. the following doesn't produce a list:

tasks:
    - hashivault_list:
        secret: 'secret/data/certificates'
      register: cert_list
      delegate_to: localhost
    - debug:
        var: cert_list

Which based on my provided vault CLI command at the top, I'd expect the module to be able to handle this too.

[willwh]

I'm just using syntax like this in my jinja templates:

{{ lookup('hashivault', '/secret/data/certificates/STAR.domain.com', 'data')["key"] }}

I don't have time to debug the hashivault_list issue currently, maybe I can get back to that in a week.

[TerryHowe]

For true compatibility, sounds like this module needs to use https://hvac.readthedocs.io/en/latest/usage/secrets_engines/kv_v2.html

[TerryHowe]

Closing as dup #68