Just refactoring. No more using fail. I negated the logic in their check and added it as an assert condition.
- hosts: localhost
gather_facts: no
vars:
- deleteme_name: 'terry'
- deleteme_rules: >
- path "secret/{{deleteme_name}}/*" {
+ name: 'terry'
+ rules: >
+ path "secret/{{name}}/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
- path "secret/{{deleteme_name}}" {
+ path "secret/{{name}}" {
capabilities = ["list"]
}
+
tasks:
- - name: "Create a policy"
+ - name: "Create a policy (that we're going to delete at the end)"
hashivault_policy_set:
- name: "{{deleteme_name}}"
- rules: "{{deleteme_rules}}"
+ name: "{{name}}"
+ rules: "{{rules}}"
token: "{{vault_root_token}}"
register: 'vault_policy_set'
- assert:
- "{{vault_policy_set.changed}} == True"
- "{{vault_policy_set.rc}} == 0"
- - name: "Get '{{deleteme_name}}' policy"
+ - name: "Get '{{name}}' policy"
hashivault_policy_get:
- name: '{{deleteme_name}}'
+ name: '{{name}}'
token: "{{ vault_root_token }}"
register: 'vault_policy_get'
- assert:
that:
- "{{vault_policy_get.changed}} == False"
- - "'{{vault_policy_get.rules}}' == '{{deleteme_rules}}'"
+ - "'{{vault_policy_get.rules}}' == '{{rules}}'"
- "{{vault_policy_get.rc}} == 0"
- - name: "List the policies, check if '{{deleteme_name}}' policy is listed"
+ - name: "List the policies, check if '{{name}}' policy is listed"
hashivault_policy_list:
token: "{{ vault_root_token }}"
register: 'vault_policy_list'
+
- assert:
that:
- "{{vault_policy_list.changed}} == False"
- "{{vault_policy_list.rc}} == 0"
- - fail:
- msg: "policy {{deleteme_name}} not in list"
- when: deleteme_name not in vault_policy_list.policies
+ - "{{name in vault_policy_list['policies']}}"
- - name: "Delete '{{deleteme_name}}' policy"
+ - name: "Delete '{{name}}' policy"
hashivault_policy_delete:
- name: '{{deleteme_name}}'
+ name: '{{name}}'
token: "{{ vault_root_token }}"
register: 'vault_policy_delete'
- assert:
- "{{vault_policy_delete.changed}} == True"
- "{{vault_policy_delete.rc}} == 0"
- - name: "List the policies, check that '{{deleteme_name}}' is no longer listed"
+ - name: "List the policies, check that '{{name}}' is no longer listed"
hashivault_policy_list:
token: "{{ vault_root_token }}"
register: 'vault_policy_list'
+
- assert:
that:
- "{{vault_policy_list.changed}} == False"
- "{{vault_policy_list.rc}} == 0"
- - fail:
- msg: "policy {{deleteme_name}} in list"
- when: deleteme_name in vault_policy_list.policies
+ - "{{name not in vault_policy_list['policies']}}"
