Commit graph

14 commits

Author SHA1 Message Date
Sam Doran
3cd98a9fcc Use ansible.module_utils.six in inventory scripts (#55000)
* Use six from ansible.module_utils for inventory scripts

Remove skips from sanity test

* Change all imports of ConfigParser to use module_utils.six.moves

* Remove commented out lines

* Fix six imports
2019-04-09 13:17:59 -04:00
Matt Clay
3e778d3f8f Fix pycodestyle E117 issues. 2019-02-13 23:35:39 -08:00
Toshio Kuratomi
3fba006207 Update bare exceptions to specify Exception.
This will keep us from accidentally catching program-exiting exceptions
like KeyboardInterupt and SystemExit.
2018-12-16 15:03:19 -08:00
Austin Hobbs
6c94c28a12 Ansible Vault and Azure Key Vault vault password script (#44544)
* added new vault password files that can be used with Azure Key Vault

* fixed pylint errors

* fixed pep 8 violations
2018-11-06 15:07:28 -05:00
Yves Martin
2f9a5a75a8 Update vault-keyring to ConfigManager internals (#41967)
Fix failure since ConfigManager changes
2018-08-22 13:09:22 -04:00
Jon Dufresne
1d640182c6 Update all pypi.python.org URLs to pypi.org (#38988)
For details on the new PyPI, see the blog post:

https://pythoninsider.blogspot.ca/2018/04/new-pypi-launched-legacy-pypi-shutting.html
2018-05-14 17:41:47 -05:00
Matt Clay
797664d9cb Python 2.6 str.format() compatibility fixes. 2018-01-10 14:08:11 -08:00
Adrian Likins
297dfb1d50 Vault secrets script client inc new 'keyring' client (#27669)
This adds a new type of vault-password script  (a 'client') that takes advantage of and enhances the 
multiple vault password support.

If a vault password script basename ends with the name '-client', consider it a vault password script client. 

A vault password script 'client' just means that the script will take a '--vault-id' command line arg.

The previous vault password script (as invoked by --vault-password-file pointing to an executable) takes
no args and returns the password on stdout. But it doesnt know anything about --vault-id or multiple vault
passwords.

The new 'protocol' of the vault password script takes a cli arg ('--vault-id') so that it can lookup that specific
vault-id and return it's password.

Since existing vault password scripts don't know the new 'protocol', a way to distinguish password scripts
that do understand the protocol was needed.  The convention now is to consider password scripts that are
named like 'something-client.py' (and executable) to be vault password client scripts.

The new client scripts get invoked with the '--vault-id' they were requested for. An example:

     ansible-playbook --vault-id my_vault_id@contrib/vault/vault-keyring-client.py some_playbook.yml

That will cause the 'contrib/vault/vault-keyring-client.py' script to be invoked as:

     contrib/vault/vault-keyring-client.py --vault-id my_vault_id

The previous vault-keyring.py password script was extended to become vault-keyring-client.py. It uses
the python 'keyring' module to request secrets from various backends. The plain 'vault-keyring.py' script
would determine which key id and keyring name to use based on values that had to be set in ansible.cfg.
So it was also limited to one keyring name.

The new vault-keyring-client.py will request the secret for the vault id provided via the '--vault-id' option.
The script can be used without config and can be used for multiple keyring ids (and keyrings).

On success, a vault password client script will print the password to stdout and exit with a return code of 0.
If the 'client' script can't find a secret for the --vault-id, the script will exit with return code of 2 and print an error to stderr.
2017-10-13 15:23:08 -04:00
Matt Martz
e2f16cfaf7 Port vault-keyring.py to properly load the config. Fixes #31304 (#31315) 2017-10-13 13:46:24 -04:00
Justin Mayer
fda131504b Support multiple vault passwords in keyring script
Allows users to specify a key name in a given project’s `ansible.cfg`
file and thus handle keyring integration with vaults with different
passwords. If no key name is specified, the original default `ansible`
key name will be used.

Other improvements:

* `username` is now optional; defaults to user that invokes the script
* change string interpolation to new `.format()` style
* clean up and expand upon documentation
* enforce PEP 8 compliance
2017-02-08 16:05:36 -05:00
Brian Coca
18214e5948 added metadata to vault scrypt 2017-01-17 14:37:06 -05:00
Adrian Likins
675561e116 fix vault-keyring.py 'No [vault] section' error
vault-keyring.py was using an older version of
the ansible.constants.load_config_file() API.
The newer version returns a tuple, which caused
the config load to fail and a catch all exception
to blame it on a missing section.

Update to new API, and catch the ConfigParser error
specifically.

Fixes #15984
2016-05-24 18:47:56 -04:00
Matt Martz
bf52e541fb Add newline when printing the password 2016-01-28 16:20:59 -06:00
Matt Martz
6d1a834b81 Add vault-keyring.py contrib script that can be used with --vault-password-file 2016-01-28 16:17:57 -06:00