docker_secret, docker_config: allow to base64-decode data (#49688)

* Adjust docker_config and docker_secret to be more similar.

* Add data_is_b64 parameter to docker_secret and docker_config.

* Add changelog.
This commit is contained in:
Felix Fontein 2019-01-01 17:06:45 +01:00 committed by John R Barker
parent e761ea3f9d
commit 26e3240315
5 changed files with 81 additions and 10 deletions

View file

@ -0,0 +1,3 @@
minor_changes:
- "docker_secret - ``data`` can now accept Base64-encoded data via the new ``data_is_b64`` option.
This allows to pass binary data or JSON data in unmodified form. (https://github.com/ansible/ansible/issues/35119)"

View file

@ -32,6 +32,14 @@ options:
- The value of the config. Required when state is C(present). - The value of the config. Required when state is C(present).
required: false required: false
type: str type: str
data_is_b64:
description:
- If set to C(true), the data is assumed to be Base64 encoded and will be
decoded before being used.
- To use binary C(data), it is better to keep it Base64 encoded and let it
be decoded by this option.
default: false
type: bool
labels: labels:
description: description:
- "A map of key:value meta data, where both the I(key) and I(value) are expected to be a string." - "A map of key:value meta data, where both the I(key) and I(value) are expected to be a string."
@ -80,7 +88,11 @@ EXAMPLES = '''
- name: Create config foo (from a file on the control machine) - name: Create config foo (from a file on the control machine)
docker_config: docker_config:
name: foo name: foo
data: "{{ lookup('file', '/path/to/config/file') }}" # If the file is JSON or binary, Ansible might modify it (because
# it is first decoded and later re-encoded). Base64-encoding the
# file directly after reading it prevents this to happen.
data: "{{ lookup('file', '/path/to/config/file') | base64 }}"
data_is_b64: true
state: present state: present
- name: Change the config data - name: Change the config data
@ -144,12 +156,13 @@ config_id:
sample: 'hzehrmyjigmcp2gb6nlhmjqcv' sample: 'hzehrmyjigmcp2gb6nlhmjqcv'
''' '''
import base64
import hashlib import hashlib
try: try:
from docker.errors import APIError from docker.errors import APIError
except ImportError: except ImportError:
# missing docker-py handled in ansible.module_utils.docker # missing docker-py handled in ansible.module_utils.docker_common
pass pass
from ansible.module_utils.docker_common import AnsibleDockerClient, DockerBaseClass, compare_generic from ansible.module_utils.docker_common import AnsibleDockerClient, DockerBaseClass, compare_generic
@ -170,13 +183,18 @@ class ConfigManager(DockerBaseClass):
self.name = parameters.get('name') self.name = parameters.get('name')
self.state = parameters.get('state') self.state = parameters.get('state')
self.data = parameters.get('data') self.data = parameters.get('data')
if self.data is not None:
if parameters.get('data_is_b64'):
self.data = base64.b64decode(self.data)
else:
self.data = to_bytes(self.data)
self.labels = parameters.get('labels') self.labels = parameters.get('labels')
self.force = parameters.get('force') self.force = parameters.get('force')
self.data_key = None self.data_key = None
def __call__(self): def __call__(self):
if self.state == 'present': if self.state == 'present':
self.data_key = hashlib.sha224(to_bytes(self.data)).hexdigest() self.data_key = hashlib.sha224(self.data).hexdigest()
self.present() self.present()
elif self.state == 'absent': elif self.state == 'absent':
self.absent() self.absent()
@ -252,6 +270,7 @@ def main():
name=dict(type='str', required=True), name=dict(type='str', required=True),
state=dict(type='str', choices=['absent', 'present'], default='present'), state=dict(type='str', choices=['absent', 'present'], default='present'),
data=dict(type='str'), data=dict(type='str'),
data_is_b64=dict(type='bool', default=False),
labels=dict(type='dict'), labels=dict(type='dict'),
force=dict(type='bool', default=False) force=dict(type='bool', default=False)
) )

View file

@ -23,19 +23,30 @@ version_added: "2.4"
description: description:
- Create and remove Docker secrets in a Swarm environment. Similar to `docker secret create` and `docker secret rm`. - Create and remove Docker secrets in a Swarm environment. Similar to `docker secret create` and `docker secret rm`.
- Adds to the metadata of new secrets 'ansible_key', an encrypted hash representation of the data, which is then used - Adds to the metadata of new secrets 'ansible_key', an encrypted hash representation of the data, which is then used
- in future runs to test if a secret has changed. in future runs to test if a secret has changed. If 'ansible_key is not present, then a secret will not be updated
- If 'ansible_key is not present, then a secret will not be updated unless the C(force) option is set. unless the C(force) option is set.
- Updates to secrets are performed by removing the secret and creating it again. - Updates to secrets are performed by removing the secret and creating it again.
options: options:
data: data:
description: description:
- String. The value of the secret. Required when state is C(present). - The value of the secret. Required when state is C(present).
required: false required: false
type: str
data_is_b64:
description:
- If set to C(true), the data is assumed to be Base64 encoded and will be
decoded before being used.
- To use binary C(data), it is better to keep it Base64 encoded and let it
be decoded by this option.
default: false
type: bool
version_added: "2.8"
labels: labels:
description: description:
- "A map of key:value meta data, where both the I(key) and I(value) are expected to be a string." - "A map of key:value meta data, where both the I(key) and I(value) are expected to be a string."
- If new meta data is provided, or existing meta data is modified, the secret will be updated by removing it and creating it again. - If new meta data is provided, or existing meta data is modified, the secret will be updated by removing it and creating it again.
required: false required: false
type: dict
force: force:
description: description:
- Use with state C(present) to always remove and recreate an existing secret. - Use with state C(present) to always remove and recreate an existing secret.
@ -46,6 +57,7 @@ options:
description: description:
- The name of the secret. - The name of the secret.
required: true required: true
type: str
state: state:
description: description:
- Set to C(present), if the secret should exist, and C(absent), if it should not. - Set to C(present), if the secret should exist, and C(absent), if it should not.
@ -72,10 +84,14 @@ author:
EXAMPLES = ''' EXAMPLES = '''
- name: Create secret foo - name: Create secret foo (from a file on the control machine)
docker_secret: docker_secret:
name: foo name: foo
data: Hello World! # If the file is JSON or binary, Ansible might modify it (because
# it is first decoded and later re-encoded). Base64-encoding the
# file directly after reading it prevents this to happen.
data: "{{ lookup('file', '/path/to/secret/file') | base64 }}"
data_is_b64: true
state: present state: present
- name: Change the secret data - name: Change the secret data
@ -134,11 +150,12 @@ RETURN = '''
secret_id: secret_id:
description: description:
- The ID assigned by Docker to the secret object. - The ID assigned by Docker to the secret object.
returned: success returned: success and C(state == "present")
type: str type: str
sample: 'hzehrmyjigmcp2gb6nlhmjqcv' sample: 'hzehrmyjigmcp2gb6nlhmjqcv'
''' '''
import base64
import hashlib import hashlib
try: try:
@ -165,13 +182,18 @@ class SecretManager(DockerBaseClass):
self.name = parameters.get('name') self.name = parameters.get('name')
self.state = parameters.get('state') self.state = parameters.get('state')
self.data = parameters.get('data') self.data = parameters.get('data')
if self.data is not None:
if parameters.get('data_is_b64'):
self.data = base64.b64decode(self.data)
else:
self.data = to_bytes(self.data)
self.labels = parameters.get('labels') self.labels = parameters.get('labels')
self.force = parameters.get('force') self.force = parameters.get('force')
self.data_key = None self.data_key = None
def __call__(self): def __call__(self):
if self.state == 'present': if self.state == 'present':
self.data_key = hashlib.sha224(to_bytes(self.data)).hexdigest() self.data_key = hashlib.sha224(self.data).hexdigest()
self.present() self.present()
elif self.state == 'absent': elif self.state == 'absent':
self.absent() self.absent()
@ -247,6 +269,7 @@ def main():
name=dict(type='str', required=True), name=dict(type='str', required=True),
state=dict(type='str', choices=['absent', 'present'], default='present'), state=dict(type='str', choices=['absent', 'present'], default='present'),
data=dict(type='str', no_log=True), data=dict(type='str', no_log=True),
data_is_b64=dict(type='bool', default=False),
labels=dict(type='dict'), labels=dict(type='dict'),
force=dict(type='bool', default=False) force=dict(type='bool', default=False)
) )

View file

@ -70,6 +70,19 @@
that: that:
- not output.changed - not output.changed
- name: Create config again (base64)
docker_config:
name: db_password
data: b3BlbnNlc2FtZSE=
data_is_b64: true
state: present
register: output
- name: assert create config (base64) is idempotent
assert:
that:
- not output.changed
- name: Update config - name: Update config
docker_config: docker_config:
name: db_password name: db_password

View file

@ -70,6 +70,19 @@
that: that:
- not output.changed - not output.changed
- name: Create secret again (base64)
docker_secret:
name: db_password
data: b3BlbnNlc2FtZSE=
data_is_b64: true
state: present
register: output
- name: assert create secret (base64) is idempotent
assert:
that:
- not output.changed
- name: Update secret - name: Update secret
docker_secret: docker_secret:
name: db_password name: db_password