Extra vars poc

CHANGELOG.md

@@ -6,6 +6,11 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## [1.2.3] - 2024-04-30
+
+### Changed
+- Enhancement for the lookup plugin to support the extra-vars
+
 ## [1.2.2] - 2023-09-28
 
 ### Changed

plugins/lookup/conjur_variable.py

@@ -15,9 +15,10 @@
     author:
       - CyberArk BizDev (@cyberark-bizdev)
     description:
-      Retrieves credentials from Conjur using the controlling host's Conjur identity
-      or environment variables.
+      Retrieves credentials from Conjur using the controlling host's Conjur identity,
+      environment variables, or extra-vars.
       Environment variables could be CONJUR_ACCOUNT, CONJUR_APPLIANCE_URL, CONJUR_CERT_FILE, CONJUR_AUTHN_LOGIN, CONJUR_AUTHN_API_KEY, CONJUR_AUTHN_TOKEN_FILE
+      Extra-vars could be conjur_account, conjur_appliance_url, conjur_cert_file, conjur_authn_login, conjur_authn_api_key, conjur_authn_token_file
       Conjur info - U(https://www.conjur.org/).
     requirements:
       - 'The controlling host running Ansible has a Conjur identity.
@@ -46,16 +47,6 @@
             key: identity_file_path
         env:
           - name: CONJUR_IDENTITY_FILE
-      authn_token_file:
-        description: Path to the access token file.
-        type: path
-        default: /var/run/conjur/access-token
-        required: False
-        ini:
-          - section: conjur,
-            key: authn_token_file
-        env:
-          - name: CONJUR_AUTHN_TOKEN_FILE
       config_file:
         description: Path to the Conjur configuration file. The configuration file is a YAML file.
         type: path
@@ -66,6 +57,72 @@
             key: config_file_path
         env:
           - name: CONJUR_CONFIG_FILE
+      conjur_appliance_url:
+        description: Conjur appliance url
+        type: string
+        required: False
+        ini:
+          - section: conjur,
+            key: conjur_appliance_url
+        vars:
+          - name: conjur_appliance_url
+        env:
+          - name: CONJUR_APPLIANCE_URL
+      conjur_authn_login:
+        description: Conjur authn login
+        type: string
+        required: False
+        ini:
+          - section: conjur,
+            key: conjur_authn_login
+        vars:
+          - name: conjur_authn_login
+        env:
+          - name: CONJUR_AUTHN_LOGIN
+      conjur_account:
+        description: Conjur account
+        type: string
+        required: False
+        ini:
+          - section: conjur,
+            key: conjur_account
+        vars:
+          - name: conjur_account
+        env:
+          - name: CONJUR_ACCOUNT
+      conjur_authn_api_key:
+        description: Conjur authn api key
+        type: string
+        required: False
+        ini:
+          - section: conjur,
+            key: conjur_authn_api_key
+        vars:
+          - name: conjur_authn_api_key
+        env:
+          - name: CONJUR_AUTHN_API_KEY
+      conjur_cert_file:
+        description: Path to the Conjur cert file
+        type: path
+        required: False
+        ini:
+          - section: conjur,
+            key: conjur_cert_file
+        vars:
+          - name: conjur_cert_file
+        env:
+          - name: CONJUR_CERT_FILE
+      conjur_authn_token_file:
+        description: Path to the access token file
+        type: path
+        required: False
+        ini:
+          - section: conjur,
+            key: conjur_authn_token_file
+        vars:
+          - name: conjur_authn_token_file
+        env:
+          - name: CONJUR_AUTHN_TOKEN_FILE
 """
 
 EXAMPLES = """
@@ -263,43 +320,60 @@ def _store_secret_in_file(value):
 
     return [secrets_file.name]
 
-
 class LookupModule(LookupBase):
 
     def run(self, terms, variables=None, **kwargs):
         if terms == []:
             raise AnsibleError("Invalid secret path: no secret path provided.")
         elif not terms[0] or terms[0].isspace():
             raise AnsibleError("Invalid secret path: empty secret path not accepted.")
+
+        # We should register the variables as LookupModule options.
+        #
+        # Doing this has some nice advantages if we're considering supporting
+        # a set of Ansible variables that could sometimes replace environment
+        # variables.
+        #
+        # Registering the variables as options forces them to adhere to the
+        # behavior described in the DOCUMENTATION variable. An option can have
+        # both a Ansible variable and environment variable source, which means
+        # Ansible will do some juggling on our behalf.
+        self.set_options(var_options=variables, direct=kwargs)
+
+        appliance_url = self.get_var_value("conjur_appliance_url")
+        account = self.get_var_value("conjur_account")
+        authn_login = self.get_var_value("conjur_authn_login")
+        authn_api_key = self.get_var_value("conjur_authn_api_key")
+        cert_file = self.get_var_value("conjur_cert_file")
+        authn_token_file = self.get_var_value("conjur_authn_token_file")
 
-        self.set_options(direct=kwargs)
         validate_certs = self.get_option('validate_certs')
         conf_file = self.get_option('config_file')
         as_file = self.get_option('as_file')
 
         if validate_certs is False:
             display.warning('Certificate validation has been disabled. Please enable with validate_certs option.')
 
-        if 'http://' in str(environ.get("CONJUR_APPLIANCE_URL")):
+        if 'http://' in str(appliance_url):
             raise AnsibleError(('[WARNING]: Conjur URL uses insecure connection. Please consider using HTTPS.'))
 
         conf = _merge_dictionaries(
             _load_conf_from_file(conf_file),
             {
-                "account": environ.get('CONJUR_ACCOUNT'),
-                "appliance_url": environ.get("CONJUR_APPLIANCE_URL")
+                "account": account,
+                "appliance_url": appliance_url
             } if (
-                environ.get('CONJUR_ACCOUNT') is not None
-                and environ.get('CONJUR_APPLIANCE_URL') is not None
+                account is not None
+                and appliance_url is not None
             )
             else {},
             {
-                "cert_file": environ.get('CONJUR_CERT_FILE')
-            } if (environ.get('CONJUR_CERT_FILE') is not None)
+                "cert_file": cert_file
+            } if (cert_file is not None)
             else {},
             {
-                "authn_token_file": environ.get('CONJUR_AUTHN_TOKEN_FILE')
-            } if (environ.get('CONJUR_AUTHN_TOKEN_FILE') is not None)
+                "authn_token_file": authn_token_file
+            } if authn_token_file is not None
             else {}
         )
 
@@ -308,10 +382,10 @@ def run(self, terms, variables=None, **kwargs):
             identity = _merge_dictionaries(
                 _load_identity_from_file(identity_file, conf['appliance_url']),
                 {
-                    "id": environ.get('CONJUR_AUTHN_LOGIN'),
-                    "api_key": environ.get('CONJUR_AUTHN_API_KEY')
-                } if (environ.get('CONJUR_AUTHN_LOGIN') is not None
-                      and environ.get('CONJUR_AUTHN_API_KEY') is not None)
+                    "id": authn_login,
+                    "api_key": authn_api_key
+                } if authn_login is not None
+                      and authn_api_key is not None
                 else {}
             )
 
@@ -364,3 +438,14 @@ def run(self, terms, variables=None, **kwargs):
             return _store_secret_in_file(conjur_variable)
 
         return conjur_variable
+
+    def get_var_value(self, key):
+        try:
+            variable_value = self.get_option(key)
+        except KeyError:
+            raise AnsibleError("{0} was not defined in configuration".format(key))
+
+        if not variable_value and key != "conjur_authn_token_file":
+            raise AnsibleError("The value of the {0} variable is not set".format(key))
+
+        return variable_value

tests/conjur_variable/test.sh

@@ -26,7 +26,8 @@ function run_test_case {
     fi
 
     # You can add -vvvvv here for debugging
-    ansible-playbook 'test_cases/${test_case}/playbook.yml'
+    export SAMPLE_KEY='set_in_env'
+    ansible-playbook --extra-vars 'sample_key=set_in_extravars' 'test_cases/${test_case}/playbook.yml'
 
     py.test --junitxml='./junit/${test_case}' \
       --connection docker \