Salt read vault secret or revert to empty

[s4mur4i]

Description of Issue/Question

I would like to set up a fallback possibility for missing vault keys

for example
lets say we have secret/very/big/secret with key of 'something'

{% set something = salt['vault'].read_secret('secret/very/big/secret','something') %}

But if that key is missing I would like to be an empty string like ""

I tried with adding | default("") but it fails with not able to reach the vault secret and throwing exception.

I could not find example or docs to be able to work around this issue.

Versions Report

(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)

Salt Version:
           Salt: 2018.3.2

Dependency Versions:
           cffi: 1.6.0
       cherrypy: Not Installed
       dateutil: 2.7.3
      docker-py: Not Installed
          gitdb: Not Installed
      gitpython: Not Installed
          ioflo: Not Installed
         Jinja2: 2.7.2
        libgit2: Not Installed
        libnacl: Not Installed
       M2Crypto: Not Installed
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.4.8
   mysql-python: Not Installed
      pycparser: 2.14
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: Not Installed
         Python: 2.7.5 (default, Aug  4 2017, 00:39:18)
   python-gnupg: Not Installed
         PyYAML: 3.11
          PyZMQ: 15.3.0
           RAET: Not Installed
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.2.1
            ZMQ: 4.1.4

System Versions:
           dist: centos 7.4.1708 Core
         locale: UTF-8
        machine: x86_64
        release: 4.9.63-29.el7.x86_64
         system: Linux
        version: CentOS Linux 7.4.1708 Core

[garethgreenaway]

@s4mur4i Thanks for the report. Approving for a future feature addition.

[mgriffin13]

This used to be the default behavior before salt-2017 and the vault module re-write. To recover the old behavior, I created a new custom vault module (https://docs.saltstack.com/en/latest/ref/modules/) called vault_ext that contains:

def read_secret(path, key=None):
    '''
    if --local option is defined, return full path
    else call vault.read_secret
    '''

    ret = "sdb://vault/%s?%s" % (path, key)

    if __opts__.get('local', False):
      return ret
    else:
      try:
        return __salt__['vault.read_secret'](path, key)
      except:
        return ret

Given this, you will change your vault sdb calls to instead say something like

salt['vault_ext'].read_secret('/path/to/secret', 'key')

You can change ret to whatever you like, but this was the old behavior so I kept it the same. I also don't attempt vault calls if running locally, since my salt-masterless applies do not have access to a vault token.

[mgriffin13]

Also looks like it'll be fixed in an upcoming release

#46829

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

If this issue is closed prematurely, please leave a comment and we will gladly reopen the issue.

[stale[bot]]

Thank you for updating this issue. It is no longer marked as stale.