Support hcp vault secrets

[xrow]

SUMMARY

https://developer.hashicorp.com/vault/tutorials/hcp-vault-secrets-get-started

I did some testing. I looks like the ansible modules are not designed to work with hcp-vault-secrets out of the box.

ISSUE TYPE

• Feature Idea

COMPONENT NAME

community.hashi_vault.vault_login <- seems to not able to use the oauth endpoint https://auth.hashicorp.com/oauth/token
community.hashi_vault.vault_read <- seems to not able to read secrets endpoint https://api.hashicorp.cloud

[briantist]

Hi @xrow , I don't have access to HCP Vault to run any tests myself, and you haven't included the actual Ansible tasks you're running so it's a bit hard to tell, but my first guess would be that you're missing the namespace.

HCP Vault uses namespaces, and I think the default namespace is admin. Otherwise, HCP Vault, under the hood, is still Vault, and thus uses the same API, and so it should work with this collection, as long as the library we use (hvac) works with it.

All of the content in this collection that interacts with Vault takes a namespace parameter which you can set to the namespace name.

If you have some further information to go on, I can try to help from there.

[xrow]

@briantist

Hi,

you might be right the issue might be a documentation issue. The3 good thing is HCP Vault is free for testing and a small about of serects. You can try it on your own without issues. Would you mind diving it a try? The setup of the cloud hosted hcp vault secrets takes about 5 minutes.

[briantist]

Unfortunately I can't do that at the moment, I've got a lot going on and very limited time in the next several weeks. I wouldn't mind giving it a try once I have some more time.

[xrow]

Do not worry. It was worth trying for me. I just wanted to leave you a note.

[xrow]

About the namespace parameter:

This is the url to get a serect. it looks like i would need to set export ANSIBLE_HASHI_VAULT_NAMESPACE="/secrets/2023-06-13/organizations/147d4839-53ce-41bc-910e-4a4c3cce9ec6/projects/8eda565f-d207-45f6-adb3-a8b7f08ee338"
, but i do not know.

curl \
--location "https://api.cloud.hashicorp.com/secrets/2023-06-13/organizations/147d4839-53ce-41bc-910e-4a4c3cce9ec6/projects/8eda565f-d207-45f6-adb3-a8b7f08ee338/apps/infrastructure/open" \
--request GET \
--header "Authorization: Bearer $HCP_API_TOKEN" | jq

[briantist]

Interesting... that URL looks very foreign to me. Offhand, that URL looks nothing like the standard Vault API, notice the lack of /v1/ anywhere.

Unfortunately HashiCorp's documentation is kind of a mess; I spent a little while before replying above trying to figure it out but was not able to get a definitive answer.

It may be best to reach out to HashiCorp and ask them how you can use the standard Vault API with HCP Vault. As long as you can do that, you should be able to use any of the various tools and libraries out there, including this one.

If this is some new API they've wrapped around Vault, then I'm not sure where to go from there, that would be a baffling decision on their part from my POV but perhaps that's the case.

[xrow]

HCP Vault is some API around vault I guess. At the new API least it is documented ;-) https://developer.hashicorp.com/hcp/api-docs/vault-secrets

[briantist]

I am now seeing that HCP Vault and HCP Vault Secrets are two completely different things 🤦 this naming is pretty terrible: https://www.hashicorp.com/products/vault/pricing

It seems to indeed be a completely different set of APIs unfortunately.

[xrow]

@briantist
Would you maybe recommend this is out of scope for this project? That one shall create a new ansible module?

[briantist]

Support for HCP Vault Secrets is something I would consider in-scope for this collection, but because it's a completely new API, that does add a considerable amount of work for properly adding support. By contrast, adding additional Vault features in the standard Vault API is relatively lightweight since we have so much supporting code around it.

That being said, this collection is essentially a wrapper around the hvac python package, so that is where the support should actually be added first. I also maintain that package, and much of what I said above about there being a fair bit of initial work to support it also holds true in adding the support to hvac, but that would be the way to go. Feel free to open an issue there to request the support; it's something we'll have to give some thought to in any case.

---

You're always free to create your own Ansible content of course, and having something you write locally that's scoped to your own use case will probably be the quickest way forward for your project.

[xrow]

hvac/hvac#1106

[xrow]

Ok to let you know for my current case I will swtich back to the normal vault for now.