Add support for ACL policies

README.rst

@@ -24,7 +24,7 @@ Install this Ansible module:
 
   pip install ansible-modules-hashivault
 
-* via ``ansible-galaxy`` (requires ``hvac>=0.7.2``):
+* via ``ansible-galaxy`` (requires ``hvac>=2.1.0``):
 
 ::
 

ansible/modules/hashivault/hashivault_acl_policy.py

@@ -0,0 +1,118 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+from ansible.module_utils.hashivault import hashivault_argspec
+from ansible.module_utils.hashivault import hashivault_auth_client
+from ansible.module_utils.hashivault import hashivault_init
+from ansible.module_utils.hashivault import hashiwrapper
+
+ANSIBLE_METADATA = ANSIBLE_METADATA = {'status': ['stableinterface'], 'supported_by': 'community', 'version': '1.1'}
+DOCUMENTATION = '''
+---
+module: hashivault_acl_policy
+version_added: "2.1.0"
+short_description: Hashicorp Vault acl policy set module
+description:
+    - Module to set an ACL policy in Hashicorp Vault.
+options:
+    name:
+        description:
+            - policy name.
+    state:
+        type: str
+        choices: ["present", "absent"]
+        default: present
+        description:
+            - present or absent
+    rules:
+        description:
+            - policy rules.
+    rules_file:
+        description:
+            - name of local file to read for policy rules.
+extends_documentation_fragment: hashivault
+'''
+EXAMPLES = '''
+---
+- hosts: localhost
+  tasks:
+    - hashivault_acl_policy:
+        name: my_policy
+        rules: '{{rules}}'
+'''
+
+
+def main():
+    argspec = hashivault_argspec()
+    argspec['name'] = dict(required=True, type='str')
+    argspec['rules'] = dict(required=False, type='str')
+    argspec['rules_file'] = dict(required=False, type='str')
+    argspec['state'] = dict(required=False, choices=['present', 'absent'], default='present')
+    mutually_exclusive = [['rules', 'rules_file']]
+    module = hashivault_init(argspec, mutually_exclusive=mutually_exclusive, supports_check_mode=True)
+    result = hashivault_acl_policy(module)
+    if result.get('failed'):
+        module.fail_json(**result)
+    else:
+        module.exit_json(**result)
+
+
+@hashiwrapper
+def hashivault_acl_policy(module):
+    params = module.params
+    client = hashivault_auth_client(params)
+    state = params.get('state')
+    name = params.get('name')
+    exists = False
+    changed = False
+    current_state = {}
+    desired_state = {}
+
+    # get current policies
+    current_policies = client.sys.list_acl_policies()
+    if isinstance(current_policies, dict):
+        current_policies = current_policies.get('data', current_policies).get('keys', current_policies)
+    if name in current_policies:
+        exists = True
+        current_state = client.sys.read_acl_policy(name)
+        current_state = current_state.get('data', current_state).get('policy', current_state)
+
+    # Define desired rules
+    rules_file = params.get('rules_file')
+    if rules_file:
+        try:
+            desired_state = open(rules_file, 'r').read()
+        except Exception as e:
+            return {'changed': False,
+                    'failed': True,
+                    'msg': 'Error opening rules file <%s>: %s' % (rules_file, str(e))}
+    else:
+        desired_state = params.get('rules')
+
+    # Check required actions
+    if state == 'present' and not exists:
+        changed = True
+    elif state == 'absent' and exists:
+        changed = True
+    elif state == 'present' and exists:
+        if current_state != desired_state:
+            changed = True
+
+    if changed and not module.check_mode:
+        # create or update
+        if state == 'present':
+            client.sys.create_or_update_acl_policy(name, desired_state)
+        # delete
+        elif state == 'absent':
+            client.sys.delete_acl_policy(name)
+
+    return {
+        "changed": changed,
+        "diff": {
+            "before": current_state,
+            "after": desired_state,
+        },
+    }
+
+
+if __name__ == '__main__':
+    main()

ansible/modules/hashivault/hashivault_acl_policy_get.py

@@ -0,0 +1,59 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+from ansible.module_utils.hashivault import hashivault_argspec
+from ansible.module_utils.hashivault import hashivault_auth_client
+from ansible.module_utils.hashivault import hashivault_init
+from ansible.module_utils.hashivault import hashiwrapper
+
+ANSIBLE_METADATA = {'status': ['stableinterface'], 'supported_by': 'community', 'version': '1.1'}
+DOCUMENTATION = '''
+---
+module: hashivault_acl_policy_get
+version_added: "2.1.0"
+short_description: Hashicorp Vault ACL policy get module
+description:
+    - Module to get an ACL policy from Hashicorp Vault.
+options:
+    name:
+        description:
+            - policy name.
+extends_documentation_fragment: hashivault
+'''
+EXAMPLES = '''
+---
+- hosts: localhost
+  tasks:
+    - hashivault_acl_policy_get:
+      name: 'annie'
+      register: 'vault_acl_policy_get'
+    - debug: msg="User policy is {{vault_acl_policy_get.policy}}"
+'''
+
+
+def main():
+    argspec = hashivault_argspec()
+    argspec['name'] = dict(required=True, type='str')
+    module = hashivault_init(argspec)
+    result = hashivault_acl_policy_get(module.params)
+    if result.get('failed'):
+        module.fail_json(**result)
+    else:
+        module.exit_json(**result)
+
+
+@hashiwrapper
+def hashivault_acl_policy_get(params):
+    name = params.get('name')
+    client = hashivault_auth_client(params)
+    policy = client.sys.read_acl_policy(name)
+    policy = policy.get('data', policy).get('policy', policy)
+    if policy is None:
+        result = {"changed": False, "rc": 1, "failed": True}
+        result['msg'] = u"Policy \"%s\" does not exist." % name
+        return result
+    else:
+        return {'rules': policy}
+
+
+if __name__ == '__main__':
+    main()

ansible/modules/hashivault/hashivault_acl_policy_list.py

@@ -0,0 +1,49 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+from ansible.module_utils.hashivault import hashivault_argspec
+from ansible.module_utils.hashivault import hashivault_auth_client
+from ansible.module_utils.hashivault import hashivault_init
+from ansible.module_utils.hashivault import hashiwrapper
+
+ANSIBLE_METADATA = {'status': ['stableinterface'], 'supported_by': 'community', 'version': '1.1'}
+DOCUMENTATION = '''
+---
+module: hashivault_acl_policy_list
+version_added: "2.1.0"
+short_description: Hashicorp Vault ACL policy list module
+description:
+    - Module to list ACL policies in Hashicorp Vault.
+extends_documentation_fragment: hashivault
+'''
+EXAMPLES = '''
+---
+- hosts: localhost
+  tasks:
+    - hashivault_acl_policy_list:
+      register: 'vault_acl_policy_list'
+    - debug: msg="Policies are {{vault_acl_policy_list.policy}}"
+'''
+
+
+def main():
+    argspec = hashivault_argspec()
+    module = hashivault_init(argspec)
+    result = hashivault_acl_policy_list(module.params)
+    if result.get('failed'):
+        module.fail_json(**result)
+    else:
+        module.exit_json(**result)
+
+
+@hashiwrapper
+def hashivault_acl_policy_list(params):
+    client = hashivault_auth_client(params)
+    current_policies = client.sys.list_acl_policies()
+    if isinstance(current_policies, dict):
+        current_policies = current_policies.get('data', current_policies)
+        current_policies = current_policies.get('keys', current_policies)
+    return {'policies': current_policies}
+
+
+if __name__ == '__main__':
+    main()

ansible/modules/hashivault/hashivault_write.py

@@ -133,7 +133,7 @@ def hashivault_write(module):
                     returned_data = client.secrets.kv.v2.create_or_update_secret(mount_point=mount_point, cas=cas,
                                                                                  path=secret, secret=write_data)
                 else:
-                    returned_data = client.write(secret_path, **write_data)
+                    returned_data = client.write_data(secret_path, **write_data)
                 if returned_data:
                     from requests.models import Response
                     if isinstance(returned_data, Response):

ansible/plugins/doc_fragments/hashivault.py

@@ -2,8 +2,8 @@ class ModuleDocFragment(object):
     # Standard documentation
     DOCUMENTATION = r'''
     requirements:
-        - hvac>=0.10.1
-        - ansible>=2.0.0
+        - hvac>=2.1.0
+        - ansible>=2.12.0
         - requests
     options:
         url:

functional/run.sh

@@ -39,6 +39,7 @@ ansible-playbook -vvv test_consul_role.yml
 # ansible-playbook -v test_azure_config.yml
 # ansible-playbook -v test_azure_role.yml cannot run without true azure connectivity
 ansible-playbook -v test_policy.yml
+ansible-playbook -v test_acl_policy.yml
 ansible-playbook -v test_status.yml
 ansible-playbook -v test_not_there.yml
 ansible-playbook -v test_ephemeral.yml