Topics
This release brings new generic vault_list
plugins from a new contributor!
There are also some deprecation notices for the next major version, and some updates to documentation attributes.
- ansible-core - support for
ansible-core
versions2.11
and2.12
will be dropped in collection version5.0.0
, making2.13
the minimum supported version ofansible-core
(ansible-collections#340). - hvac - the minimum version of
hvac
to be supported in collection version5.0.0
will be at least1.0.2
; this minimum may be raised before5.0.0
is released, so please subscribe to the linked issue and look out for new notices in the changelog (ansible-collections#324).
- vault_list - Perform a list operation against HashiCorp Vault
- vault_list - Perform a list operation against HashiCorp Vault
The next major version of the collection includes previously announced breaking changes to some default values, and improvements to module documentation with attributes that describe the use of action groups and check mode support.
- modules - all modules now document their action group and support for check mode in their attributes documentation (ansible-collections#197).
- auth - the default value for
token_validate
has changed fromtrue
tofalse
, as previously announced (ansible-collections#248). - vault_kv2_get lookup - as previously announced, the default value for
engine_mount_point
in thevault_kv2_get
lookup has changed fromkv
tosecret
(ansible-collections#279).
This release includes a new module, fixes (another) requests
header issue, and updates some inaccurate documentation.
This is the last planned release before v4.0.0.
- vault_pki_generate_certificate - the documentation has been updated to match the argspec for the default values of options
alt_names
,ip_sans
,other_sans
, anduri_sans
(ansible-collections#318).
- connection options - the
namespace
connection option will be forced into a string to ensure cmpatibility with recentrequests
versions (ansible-collections#309).
- vault_kv2_delete - Delete one or more versions of a secret from HashiCorp Vault's KV version 2 secret store
No functional changes in this release, this provides updated filter documentation for the public docsite.
With the release of hvac
version 1.0.0
, we needed to update vault_token_create
's support for orphan tokens.
The collection's changelog is now viewable in the Ansible documentation site.
- vault_token_create - creation or orphan tokens uses
hvac
's new v1 method for creating orphans, or falls back to the v0 method if needed (ansible-collections#301).
This release brings support for the azure
auth method, adds 412
to the default list of HTTP status codes to be retried, and fixes a bug that causes failures in token auth with requests>=2.28.0
.
- community.hashi_vault collection - add support for
azure
auth method, for Azure service principal, managed identity, or plain JWT access token (ansible-collections#293). - community.hashi_vault retries - HTTP status code 412 has been added to the default list of codes to be retried, for the new Server Side Consistent Token feature in Vault Enterprise (ansible-collections#290).
- community.hashi_vault plugins - tokens will be cast to a string type before being sent to
hvac
to prevent errors inrequests
when values areAnsibleUnsafe
(ansible-collections#289). - modules - fix a "variable used before assignment" that cannot be reached but causes sanity test failures (ansible-collections#296).
A default value that was set incorrectly will be corrected in 4.0.0
.
A deprecation warning will be shown until then if the value is not specified explicitly.
This version also includes some fixes and improvements to the licensing in the collection, which does not affect any functionality.
- vault_kv2_get lookup - the
engine_mount_point option
in thevault_kv2_get
lookup only will change its default fromkv
tosecret
in community.hashi_vault version 4.0.0 (ansible-collections#279).
- Add SPDX license headers to individual files (ansible-collections#282).
- Add missing
BSD-2-Clause.txt
file for BSD licensed content (ansible-collections#275). - Use the correct GPL license for plugin_utils (ansible-collections#276).
Version 3.0.0 of community.hashi_vault
drops support for Ansible 2.9 and ansible-base 2.10.
Several deprecated features have been removed. See the changelog for the full list.
- token_validate options - the shared auth option
token_validate
will change its default fromtrue
tofalse
in community.hashi_vault version 4.0.0. Thevault_login
lookup and module will keep the default value oftrue
(ansible-collections#248).
- aws_iam auth - the deprecated alias
aws_iam_login
for theaws_iam
value of theauth_method
option has been removed (ansible-collections#194). - community.hashi_vault collection - support for Ansible 2.9 and ansible-base 2.10 has been removed (ansible-collections#189).
- hashi_vault lookup - the deprecated
[lookup_hashi_vault]
INI config section has been removed in favor of the collection-wide[hashi_vault_collection]
section (ansible-collections#179).
This release finally contains dedicated KV plugins and modules, and an exciting new lookup to help use plugin values in module calls.
With that, we also have a guide in the collection docsite for migrating away from the hashi_vault
lookup toward dedicated content.
We are also announcing that the token_validate
option will change its default value in version 4.0.0.
This is the last planned release before 3.0.0. See the porting guide for breaking changes and removed features in the next version.
- vault_login module & lookup - no friendly error message was given when
hvac
was missing (ansible-collections#257). - vault_pki_certificate - add
vault_pki_certificate
to thecommunity.hashi_vault.vault
action group (ansible-collections#251). - vault_read module & lookup - no friendly error message was given when
hvac
was missing (ansible-collections#257). - vault_token_create - add
vault_token_create
to thecommunity.hashi_vault.vault
action group (ansible-collections#251). - vault_token_create module & lookup - no friendly error message was given when
hvac
was missing (ansible-collections#257). - vault_write - add
vault_write
to thecommunity.hashi_vault.vault
action group (ansible-collections#251).
- token_validate options - the shared auth option
token_validate
will change its default fromTrue
toFalse
in community.hashi_vault version 4.0.0. Thevault_login
lookup and module will keep the default value ofTrue
(ansible-collections#248).
- vault_ansible_settings - Returns plugin settings (options)
- vault_kv1_get - Get a secret from HashiCorp Vault's KV version 1 secret store
- vault_kv2_get - Get a secret from HashiCorp Vault's KV version 2 secret store
- vault_kv1_get - Get a secret from HashiCorp Vault's KV version 1 secret store
- vault_kv2_get - Get a secret from HashiCorp Vault's KV version 2 secret store
Our first content for writing to Vault is now live.
- vault_write - Perform a write operation against HashiCorp Vault
- vault_write - Perform a write operation against HashiCorp Vault
This release contains new plugins and modules for creating tokens and for generating certificates with Vault's PKI secrets engine.
- vault_token_create - Create a HashiCorp Vault token
- vault_pki_generate_certificate - Generates a new set of credentials (private key and certificate) using HashiCorp Vault PKI
- vault_token_create - Create a HashiCorp Vault token
This release contains a new lookup/module combo for logging in to Vault, and includes our first filter plugin.
- The Filter guide has been added to the collection's docsite.
- vault_login_token - Extracts the client token from a Vault login response
- vault_login - Perform a login operation against HashiCorp Vault
- vault_login - Perform a login operation against HashiCorp Vault
The most important change in this release is renaming the aws_iam_login
auth method to aws_iam
and deprecating the old name. This release also announces the deprecation of Ansible 2.9 and ansible-base 2.10 support in 3.0.0.
- Support for Ansible 2.9 and ansible-base 2.10 is deprecated, and will be removed in the next major release (community.hashi_vault 3.0.0) next spring (ansible-community/community-topics#50, ansible-collections#189).
- aws_iam_login auth method - the
aws_iam_login
method has been renamed toaws_iam
. The old name will be removed in collection version3.0.0
. Until then both names will work, and a warning will be displayed when using the old name (ansible-collections#193).
- the "legacy" integration test setup has been removed; this does not affect end users and is only relevant to contributors (ansible-collections#191).
Version 2.0.0 of the collection drops support for Python 2 & Python 3.5, making Python 3.6 the minimum supported version. Some deprecated features and settings have been removed as well.
- connection options - there is no longer a default value for the
url
option (the Vault address), so a value must be supplied (ansible-collections#83).
- drop support for Python 2 and Python 3.5 (ansible-collections#81).
- support for the following deprecated environment variables has been removed:
VAULT_AUTH_METHOD
,VAULT_TOKEN_PATH
,VAULT_TOKEN_FILE
,VAULT_ROLE_ID
,VAULT_SECRET_ID
(ansible-collections#173).
This release includes a new action group for use with module_defaults
, and additional ways of specifying the mount_point
option for plugins.
This will be the last 1.x
release.
- add the
community.hashi_vault.vault
action group (ansible-collections#172). - auth methods - Add support for configuring the
mount_point
auth method option in plugins via theANSIBLE_HASHI_VAULT_MOUNT_POINT
environment variable,ansible_hashi_vault_mount_point
ansible variable, ormount_point
INI section (ansible-collections#171).
This release contains a bugfix for aws_iam_login
authentication.
- aws_iam_login auth method - fix incorrect use of
boto3
/botocore
that prevented proper loading of AWS IAM role credentials (ansible-collections#167).
This release includes bugfixes, a new auth method (cert
), and the first new content since the collection's formation, the vault_read
module and lookup plugin.
We're also announcing the deprecation of the [lookup_hashi_vault]
INI section (which will continue working up until its removal only for the hashi_vault
lookup), to be replaced by the [hashi_vault_collection]
section that will apply to all plugins in the collection.
- community.hashi_vault collection - add cert auth method (ansible-collections#159).
- lookup hashi_vault - the
[lookup_hashi_vault]
section in theansible.cfg
file is deprecated and will be removed in collection version3.0.0
. Instead, the section[hashi_vault_collection]
can be used, which will apply to all plugins in the collection going forward (ansible-collections#144).
- aws_iam_login auth - the
aws_security_token
option was not used, causing assumed role credentials to fail (ansible-collections#160). - hashi_vault collection - a fallback import supporting the
retries
option forurllib3
viarequests.packages.urllib3
was not correctly formed (ansible-collections#116). - hashi_vault collection - unhandled exception with
token
auth whentoken_file
exists but is a directory (ansible-collections#152).
- vault_read - Perform a read operation against HashiCorp Vault
- vault_read - Perform a read operation against HashiCorp Vault
This release adds requirements detection support for Ansible Execution Environments. It also updates and adds new guides in our collection docsite.
This release also announces the dropping of Python 3.5 support in version 2.0.0
of the collection, alongside the previous announcement dropping Python 2.x in 2.0.0
.
- hashi_vault collection - add
execution-environment.yml
and a python requirements file to better supportansible-builder
(ansible-collections#105).
- hashi_vault collection - support for Python 3.5 will be dropped in version
2.0.0
ofcommunity.hashi_vault
(ansible-collections#81).
This release fixes an error in the documentation. No functionality is changed so it's not necessary to upgrade from 1.3.0
.
This release adds two connection-based options for controlling timeouts and retrying failed Vault requests.
- hashi_vault lookup - add
retries
andretry_action
to enable built-in retry on failure (ansible-collections#71). - hashi_vault lookup - add
timeout
option to control connection timeouts (ansible-collections#100).
This release brings several new ways of accessing options, like using Ansible vars, and addng new environment variables and INI config entries.
A special none
auth type is also added, for working with certain Vault Agent configurations.
This release also announces the deprecation of Python 2 support in version 2.0.0
of the collection.
- hashi_vault lookup - add
ANSIBLE_HASHI_VAULT_CA_CERT
env var (withVAULT_CACERT
low-precedence fallback) forca_cert
option (ansible-collections#97). - hashi_vault lookup - add
ANSIBLE_HASHI_VAULT_PASSWORD
env var andansible_hashi_vault_password
ansible var forpassword
option (ansible-collections#96). - hashi_vault lookup - add
ANSIBLE_HASHI_VAULT_USERNAME
env var andansible_hashi_vault_username
ansible var forusername
option (ansible-collections#96). - hashi_vault lookup - add
ansible_hashi_vault_auth_method
Ansible vars entry to theproxies
option (ansible-collections#86). - hashi_vault lookup - add
ansible_hashi_vault_ca_cert
ansible var forca_cert
option (ansible-collections#97). - hashi_vault lookup - add
ansible_hashi_vault_namespace
Ansible vars entry to thenamespace
option (ansible-collections#86). - hashi_vault lookup - add
ansible_hashi_vault_proxies
Ansible vars entry to theproxies
option (ansible-collections#86). - hashi_vault lookup - add
ansible_hashi_vault_role_id
Ansible vars entry to theproxies
option (ansible-collections#86). - hashi_vault lookup - add
ansible_hashi_vault_secret_id
Ansible vars entry to theproxies
option (ansible-collections#86). - hashi_vault lookup - add
ansible_hashi_vault_token_file
Ansible vars entry to thetoken_file
option (ansible-collections#95). - hashi_vault lookup - add
ansible_hashi_vault_token_path
Ansible vars entry to thetoken_path
option (ansible-collections#95). - hashi_vault lookup - add
ansible_hashi_vault_token_validate
Ansible vars entry to theproxies
option (ansible-collections#86). - hashi_vault lookup - add
ansible_hashi_vault_token
Ansible vars entry to theproxies
option (ansible-collections#86). - hashi_vault lookup - add
ansible_hashi_vault_url
andansible_hashi_vault_addr
Ansible vars entries to theurl
option (ansible-collections#86). - hashi_vault lookup - add
ansible_hashi_vault_validate_certs
Ansible vars entry to thevalidate_certs
option (ansible-collections#95). - hashi_vault lookup - add
ca_cert
INI config file keyca_cert
option (ansible-collections#97). - hashi_vault lookup - add
none
auth type which allows for passive auth via a Vault agent (ansible-collections#80).
- hashi_vault collection - support for Python 2 will be dropped in version
2.0.0
ofcommunity.hashi_vault
(ansible-collections#81).
This release fixes a bug with userpass
authentication and hvac
versions 0.9.6 and higher.
- hashi_vault - userpass authentication did not work with hvac 0.9.6 or higher (ansible-collections#68).
This release contains the same functionality as 1.1.1. The only change is to mark some code as internal to the collection. If you are already using 1.1.1 as an end user you do not need to update.
This bugfix release restores the use of the VAULT_ADDR
environment variable for setting the url
option.
See the PR linked from the changelog entry for details and workarounds if you cannot upgrade.
- hashi_vault - restore use of
VAULT_ADDR
environment variable as a low preference env var (ansible-collections#61).
This release contains a new proxies
option for the hashi_vault
lookup.
- hashi_vault - add
proxies
option (ansible-collections#50).
Our first major release contains a single breaking change that will affect only a small subset of users. No functionality is removed. See the details in the changelog to determine if you're affected and if so how to transition to remediate.
- hashi_vault - the
VAULT_ADDR
environment variable is now checked last for theurl
parameter. For details on which use cases are impacted, see (ansible-collections#8).
Several backwards-compatible bugfixes and enhancements in this release. Some environment variables are deprecated and have standardized replacements.
- Add optional
aws_iam_server_id
parameter as the value forX-Vault-AWS-IAM-Server-ID
header (ansible-collections#27). - hashi_vault -
ANSIBLE_HASHI_VAULT_ADDR
environment variable added for optionurl
(ansible-collections#8). - hashi_vault -
ANSIBLE_HASHI_VAULT_AUTH_METHOD
environment variable added for optionauth_method
(ansible-collections#17). - hashi_vault -
ANSIBLE_HASHI_VAULT_ROLE_ID
environment variable added for optionrole_id
(ansible-collections#20). - hashi_vault -
ANSIBLE_HASHI_VAULT_SECRET_ID
environment variable added for optionsecret_id
(ansible-collections#20). - hashi_vault -
ANSIBLE_HASHI_VAULT_TOKEN_FILE
environment variable added for optiontoken_file
(ansible-collections#15). - hashi_vault -
ANSIBLE_HASHI_VAULT_TOKEN_PATH
environment variable added for optiontoken_path
(ansible-collections#15). - hashi_vault -
namespace
parameter can be specified in INI or via env varsANSIBLE_HASHI_VAULT_NAMESPACE
(new) andVAULT_NAMESPACE
(lower preference) (ansible-collections#14). - hashi_vault -
token
parameter can now be specified viaANSIBLE_HASHI_VAULT_TOKEN
as well as viaVAULT_TOKEN
(the latter with lower preference) (ansible-collections#16). - hashi_vault - add
token_validate
option to control token validation (ansible-collections#24). - hashi_vault - uses new AppRole method in hvac 0.10.6 with fallback to deprecated method with warning (ansible-collections#33).
- hashi_vault -
VAULT_ADDR
environment variable for optionurl
will have its precedence lowered in 1.0.0; useANSIBLE_HASHI_VAULT_ADDR
to intentionally override a config value (ansible-collections#8). - hashi_vault -
VAULT_AUTH_METHOD
environment variable for optionauth_method
will be removed in 2.0.0, useANSIBLE_HASHI_VAULT_AUTH_METHOD
instead (ansible-collections#17). - hashi_vault -
VAULT_ROLE_ID
environment variable for optionrole_id
will be removed in 2.0.0, useANSIBLE_HASHI_VAULT_ROLE_ID
instead (ansible-collections#20). - hashi_vault -
VAULT_SECRET_ID
environment variable for optionsecret_id
will be removed in 2.0.0, useANSIBLE_HASHI_VAULT_SECRET_ID
instead (ansible-collections#20). - hashi_vault -
VAULT_TOKEN_FILE
environment variable for optiontoken_file
will be removed in 2.0.0, useANSIBLE_HASHI_VAULT_TOKEN_FILE
instead (ansible-collections#15). - hashi_vault -
VAULT_TOKEN_PATH
environment variable for optiontoken_path
will be removed in 2.0.0, useANSIBLE_HASHI_VAULT_TOKEN_PATH
instead (ansible-collections#15).
- hashi_vault -
mount_point
parameter did not work withaws_iam_login
auth method (ansible-collections#7) - hashi_vault - fallback logic for handling deprecated style of auth in hvac was not implemented correctly (ansible-collections#33).
- hashi_vault - parameter
mount_point
does not work with JWT auth (ansible-collections#29). - hashi_vault - tokens without
lookup-self
ability can't be used because of validation (ansible-collections#18).
Our first release matches the hashi_vault
lookup functionality provided by community.general
version 1.3.0
.