Adding example usage for hashivault_token_lookup
path "secret/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
- path "auth/token/create" {
+ path "auth/token/create*" {
capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}
- path "sys/policy" {
+ path "auth/token/lookup*" {
+ capabilities = ["read", "list"]
+ }
+ path "auth/token/lookup/*" {
capabilities = ["read", "list"]
}
+ path "sys/policy" {
+ capabilities = ["read"]
+ }
path "sys/policy/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
- name: "Create a {{admin_name}} token, so we can stop using root token"
hashivault_token_create:
display_name: "{{admin_name}}"
- policies: "{{admin_name}}"
+ policies: ["{{admin_name}}"]
+ renewable: True
token: "{{vault_root_token}}"
register: "vault_token_admin"
+ - assert:
+ that:
+ - "{{vault_token_admin.changed}} == True"
+ - "{{vault_token_admin.rc}} == 0"
- name: "Create a read-only policy"
hashivault_policy_set:
- "{{vault_policy_list.changed}} == False"
- "{{vault_policy_list.rc}} == 0"
- - name: "Create a {{readonly_name}} token, so we can stop using root token"
+ - name: "Create a {{readonly_name}} token"
hashivault_token_create:
display_name: "{{readonly_name}}"
- policies: "{{readonly_name}}"
+ policies: ["{{readonly_name}}"]
+ no_default_policy: True
+ orphan: True
token: "{{vault_token_admin['token']['auth']['client_token']}}"
register: "vault_token_readonly"
+ - assert:
+ that:
+ - "{{vault_token_readonly.changed}} == True"
+ - "{{vault_token_readonly.rc}} == 0"
+
+ - name: "Lookup {{readonly_name}} token"
+ hashivault_token_lookup:
+ token: "{{vault_token_admin['token']['auth']['client_token']}}"
+ register: "vault_token_lookup"
+ - assert:
+ that:
+ - "{{vault_token_lookup.changed}} == False"
+ - "{{vault_token_lookup.rc}} == 0"
