community.hashi_vault.vault_login lookup – Perform a login operation against HashiCorp Vault
Note
This lookup plugin is part of the community.hashi_vault collection (version 5.0.1).
You might already have this collection installed if you are using the ansible package.
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install community.hashi_vault.
You need further requirements to be able to use this lookup plugin,
see Requirements for details.
To use it in a playbook, specify: community.hashi_vault.vault_login.
New in community.hashi_vault 2.2.0
Synopsis
Performs a login operation against a given path in HashiCorp Vault, returning the login response, including the token.
Requirements
The below requirements are needed on the local controller node that executes this lookup.
hvac(Python library)For detailed requirements, see the collection requirements page.
Terms
Parameter |
Comments |
|---|---|
This is unused and any terms supplied will be ignored. |
Keyword parameters
This describes keyword parameters of the lookup. These are the values key1=value1, key2=value2 and so on in the following
examples: lookup('community.hashi_vault.vault_login', key1=value1, key2=value2, ...) and query('community.hashi_vault.vault_login', key1=value1, key2=value2, ...)
Parameter |
Comments |
|---|---|
Authentication method to be used.
Choices:
Configuration:
|
|
The AWS access key to use. Configuration:
|
|
If specified, sets the value to use for the Configuration:
|
|
The AWS profile Configuration:
|
|
The AWS secret key that corresponds to the access key. Configuration:
|
|
The AWS security token if using temporary access and secret keys. Configuration:
|
|
The client ID (also known as application ID) of the Azure AD service principal or managed identity. Should be a UUID. If not specified, will use the system assigned managed identity. Configuration:
|
|
The client secret of the Azure AD service principal. Configuration:
|
|
The resource URL for the application registered in Azure Active Directory. Usually should not be changed from the default. Default: Configuration:
|
|
The Azure Active Directory Tenant ID (also known as the Directory ID) of the service principal. Should be a UUID. Required when using a service principal to authenticate to Vault, e.g. required when both azure_client_id and azure_client_secret are specified. Optional when using managed identity to authenticate to Vault. Configuration:
|
|
Path to certificate to use for authentication. If not specified by any other means, the Configuration:
|
|
For Configuration:
|
|
For Configuration:
|
|
The JSON Web Token (JWT) to use for JWT authentication to Vault. Configuration:
|
|
Vault mount point. If not specified, the default mount point for a given auth method is used. Does not apply to token authentication. Configuration:
|
|
Vault namespace where secrets reside. This option requires HVAC 0.7.0+ and Vault 0.11+. Optionally, this may be achieved by prefixing the authentication mount point and/or secret path with the namespace (e.g If environment variable Configuration:
|
|
Authentication password. Configuration:
|
|
URL(s) to the proxies used to access the Vault service. It can be a string or a dict. If it’s a dict, provide the scheme (eg. If it’s a string, provide a single URL that will be used as the proxy for both A string that can be interpreted as a dictionary will be converted to one (see examples). You can specify a different proxy for HTTP and HTTPS resources. If not specified, environment variables from the Requests library are used. Configuration:
|
|
The AWS region for which to create the connection. Configuration:
|
|
Allows for retrying on errors, based on the Retry class in the urllib3 library. This collection defines recommended defaults for retrying connections to Vault. This option can be specified as a positive number (integer) or dictionary. If this option is not specified or the number is A number sets the total number of retries, and uses collection defaults for the other settings. A dictionary value is used directly to initialize the For detailed information on retries, see the collection User Guide. Configuration:
|
|
Controls whether and how to show messages on retries. This has no effect if a request is not retried. Choices:
Configuration:
|
|
Vault Role ID or name. Used in For For Configuration:
|
|
Secret ID to be used for Vault AppRole authentication. Configuration:
|
|
Sets the connection timeout in seconds. If not set, then the Configuration:
|
|
Vault token. Token may be specified explicitly, through the listed [env] vars, and also through the If no token is supplied, explicitly or through env, then the plugin will check for a token file, as determined by token_path and token_file. The order of token loading (first found wins) is Configuration:
|
|
If no token is specified, will try to read the token from this file in token_path. Default: Configuration:
|
|
If no token is specified, will try to read the token_file from this path. Configuration:
|
|
For token auth, will perform a Disable if your token does not have the Choices:
Configuration:
|
|
URL to the Vault service. If not specified by any other means, the value of the If Configuration:
|
|
Authentication user name. Configuration:
|
|
Controls verification and validation of SSL certificates, mostly you only want to turn off with self signed ones. Will be populated with the inverse of Will default to Choices:
Configuration:
|
Notes
Note
When keyword and positional parameters are used together, positional parameters must be listed before keyword parameters:
lookup('community.hashi_vault.vault_login', term1, term2, key1=value1, key2=value2)andquery('community.hashi_vault.vault_login', term1, term2, key1=value1, key2=value2)This lookup does not use the term string and will not work correctly in loops. Only a single response will be returned.
A login is a write operation (creating a token persisted to storage), so this module always reports
changed=True, except when used withtokenauth, because no new token is created in that case. For the purposes of Ansible playbooks however, it may be more useful to setchanged_when=falseif you’re doing idempotency checks against the target system.The
noneauth method is not valid for this plugin because there is no response to return.With
tokenauth, no actual login is performed. Instead, the given token’s additional information is returned in a structure that resembles what login responses look like.The
tokenauth method will only return full information if token_validate=True. If the token does not have thelookup-selfcapability, this will fail. If token_validate=False, only the token value itself will be returned in the structure.
See Also
See also
- community.hashi_vault.vault_login
Perform a login operation against HashiCorp Vault.
- community.hashi_vault.vault_login_token filter
The official documentation for the
community.hashi_vault.vault_login_tokenfilter plugin.
Examples
- name: Set a fact with a lookup result
set_fact:
login_data: "{{ lookup('community.hashi_vault.vault_login', url='https://vault', auth_method='userpass', username=user, password=pwd) }}"
- name: Retrieve an approle role ID (token via filter)
community.hashi_vault.vault_read:
url: https://vault:8201
auth_method: token
token: '{{ login_data | community.hashi_vault.vault_login_token }}'
path: auth/approle/role/role-name/role-id
register: approle_id
- name: Retrieve an approle role ID (token via direct dict access)
community.hashi_vault.vault_read:
url: https://vault:8201
auth_method: token
token: '{{ login_data.auth.client_token }}'
path: auth/approle/role/role-name/role-id
register: approle_id
Return Value
Key |
Description |
|---|---|
The result of the login with the given auth method. Returned: success |
|
The Returned: success |
|
Contains the token provided by the login operation (or the input token when auth_method=token). Returned: success |
|
The Returned: success, when available |