From aa6de065253af3cfb663e69c852d1cb09c3a3905 Mon Sep 17 00:00:00 2001 From: Alex Fomenko Date: Wed, 15 Jan 2025 12:50:14 +0300 Subject: [PATCH 1/4] feat: use infisicalsdk --- plugins/lookup/read_secrets.py | 42 ++++++++++++---------------------- 1 file changed, 15 insertions(+), 27 deletions(-) diff --git a/plugins/lookup/read_secrets.py b/plugins/lookup/read_secrets.py index 96ff1e9..9b6d64a 100644 --- a/plugins/lookup/read_secrets.py +++ b/plugins/lookup/read_secrets.py @@ -3,7 +3,7 @@ from ansible.plugins.lookup import LookupBase HAS_INFISICAL = False try: - from infisical_client import InfisicalClient, ClientSettings, GetSecretOptions, ListSecretsOptions + from infisical_sdk import InfisicalSDKClient HAS_INFISICAL = True except ImportError as e: HAS_INFISICAL = False @@ -77,7 +77,7 @@ class LookupModule(LookupBase): self.set_options(var_options=variables, direct=kwargs) if not HAS_INFISICAL: - raise AnsibleError("Please pip install infisical-python to use the infisical_vault lookup module.") + raise AnsibleError("Please pip install infisicalsdk to use the infisical_vault lookup module.") machine_identity_client_id = self.get_option("universal_auth_client_id") machine_identity_client_secret = self.get_option("universal_auth_client_secret") @@ -87,18 +87,10 @@ class LookupModule(LookupBase): if not machine_identity_client_id or not machine_identity_client_secret: raise AnsibleError("Please provide the universal_auth_client_id and universal_auth_client_secret") - - - - # Create the client settings - settings = ClientSettings( - client_id=machine_identity_client_id, - client_secret=machine_identity_client_secret, - site_url=url - ) - # Initialize the Infisical client - client = InfisicalClient(settings=settings) + client = InfisicalSDKClient(host=url) + client.auth.universal_auth.login(client_id=machine_identity_client_id, + client_secret=machine_identity_client_secret) secretName = kwargs.get('secret_name') envSlug = kwargs.get('env_slug') @@ -112,31 +104,27 @@ class LookupModule(LookupBase): def get_single_secret(self, client, project_id, secret_name, environment, path): try: - - options = GetSecretOptions( - environment=environment, - project_id=project_id, + secret = client.secrets.get_secret_by_name( secret_name=secret_name, - path=path, - type="shared" + project_id=project_id, + environment_slug=environment, + secret_path=path, ) - secret = client.getSecret(options=options) - return [{"value": secret.secret_value, "key": secret.secret_key}] + return [[{"value": secret.secretValue, "key": secret.secretKey}]] except Exception as e: - print(e) raise AnsibleError(f"Error fetching single secret {e}") def get_all_secrets(self, client, project_id, environment="dev", path="/"): try: - options = ListSecretsOptions( - environment=environment, + secrets = client.secrets.list_secrets( project_id=project_id, - path=path, + environment_slug=environment, + secret_path=path, + tag_filters=tags ) - secrets = client.listSecrets(options=options) - return [{"value": s.secret_value, "key": s.secret_key} for s in secrets] + return [[{"value": s.secretValue, "key": s.secretKey} for s in secrets.secrets]] except Exception as e: raise AnsibleError(f"Error fetching all secrets {e}") From 3f18746c56ae29cf23b4f270416ea12e2cd8a64a Mon Sep 17 00:00:00 2001 From: Alex Fomenko Date: Wed, 15 Jan 2025 12:50:54 +0300 Subject: [PATCH 2/4] feat: add tag filtering --- plugins/lookup/read_secrets.py | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/plugins/lookup/read_secrets.py b/plugins/lookup/read_secrets.py index 9b6d64a..85ca409 100644 --- a/plugins/lookup/read_secrets.py +++ b/plugins/lookup/read_secrets.py @@ -61,6 +61,11 @@ options: required: False type: string version_added: 1.0.0 + tags: + description: The list of tags that filtering secrets + required: False + type: list[string] + version_added: 1.1.0 """ EXAMPLES = r""" @@ -68,6 +73,9 @@ vars: read_all_secrets_within_scope: "{{ lookup('infisical_vault', universal_auth_client_id='<>', universal_auth_client_secret='<>', project_id='<>', path='/', env_slug='dev', url='https://spotify.infisical.com') }}" # [{ "key": "HOST", "value": "google.com" }, { "key": "SMTP", "value": "gmail.smtp.edu" }] + read_all_secrets_within_scope_filtred_by_tags: "{{ lookup('infisical_vault', universal_auth_client_id='<>', universal_auth_client_secret='<>', project_id='<>', path='/', env_slug='dev', url='https://spotify.infisical.com', tags=['smtp']) }}" + # [{ "key": "SMTP", "value": "gmail.smtp.edu" }] + read_secret_by_name_within_scope: "{{ lookup('infisical_vault', universal_auth_client_id='<>', universal_auth_client_secret='<>', project_id='<>', path='/', env_slug='dev', secret_name='HOST', url='https://spotify.infisical.com') }}" # [{ "key": "HOST", "value": "google.com" }] """ @@ -96,11 +104,12 @@ class LookupModule(LookupBase): envSlug = kwargs.get('env_slug') path = kwargs.get('path') project_id = kwargs.get('project_id') + tags = kwargs.get('tags') if secretName: return self.get_single_secret(client, project_id, secretName, envSlug, path) else: - return self.get_all_secrets(client, project_id, envSlug, path) + return self.get_all_secrets(client, project_id, envSlug, path, tags) def get_single_secret(self, client, project_id, secret_name, environment, path): try: @@ -115,7 +124,7 @@ class LookupModule(LookupBase): except Exception as e: raise AnsibleError(f"Error fetching single secret {e}") - def get_all_secrets(self, client, project_id, environment="dev", path="/"): + def get_all_secrets(self, client, project_id, environment="dev", path="/", tags=[]): try: secrets = client.secrets.list_secrets( project_id=project_id, From 69bd9d598720059ea7fc7fd8428076850e91b8fd Mon Sep 17 00:00:00 2001 From: Alex Fomenko Date: Wed, 15 Jan 2025 12:52:06 +0300 Subject: [PATCH 3/4] docs: version update --- galaxy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/galaxy.yml b/galaxy.yml index 1fb2fe0..c2960fe 100644 --- a/galaxy.yml +++ b/galaxy.yml @@ -8,7 +8,7 @@ namespace: infisical name: vault # The version of the collection. Must be compatible with semantic versioning -version: 1.0.0 +version: 1.1.0 # The path to the Markdown (.md) readme file. This path is relative to the root of the collection readme: README.md From 93ce7b1a7a4501dc2b294e995d02bca473881ec6 Mon Sep 17 00:00:00 2001 From: Alex Fomenko Date: Wed, 15 Jan 2025 12:52:19 +0300 Subject: [PATCH 4/4] docs: update README --- README.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index aec7583..658d89e 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ Tested with the Ansible Core >= 2.12.0 versions, and the current development ver ## Python version compatibility -This collection depends on the Infisical SDK for Python. +This collection depends on the [Infisical SDK for Python](https://github.com/Infisical/python-sdk-official). Requires Python 3.7 or greater. @@ -22,7 +22,7 @@ You can install the Infisical collection with the Ansible Galaxy CLI: The python module dependencies are not installed by `ansible-galaxy`. They can be manually installed using pip: - pip install infisical-python + pip install infisicalsdk ## Using this collection @@ -34,6 +34,9 @@ vars: read_all_secrets_within_scope: "{{ lookup('infisical.vault.read_secrets', universal_auth_client_id='<>', universal_auth_client_secret='<>', project_id='<>', path='/', env_slug='dev', url='https://spotify.infisical.com') }}" # [{ "key": "HOST", "value": "google.com" }, { "key": "SMTP", "value": "gmail.smtp.edu" }] + read_all_secrets_within_scope_filtred_by_tags: "{{ lookup('infisical_vault', universal_auth_client_id='<>', universal_auth_client_secret='<>', project_id='<>', path='/', env_slug='dev', url='https://spotify.infisical.com', tags=['smtp']) }}" + # [{ "key": "SMTP", "value": "gmail.smtp.edu" }] + read_secret_by_name_within_scope: "{{ lookup('infisical.vault.read_secrets', universal_auth_client_id='<>', universal_auth_client_secret='<>', project_id='<>', path='/', env_slug='dev', secret_name='HOST', url='https://spotify.infisical.com') }}" # [{ "key": "HOST", "value": "google.com" }] ```