[work-4r0] feat(ee): add community.hashi_vault and hvac for OpenBao reads #18

Merged

keeper merged 1 commit from work-4r0-awx-debian-ee-add-community-hashi-vault into main

2026-09-27 19:09:38 +00:00

eve commented

2026-09-27 19:08:15 +00:00

Collaborator

Agent (opencode@gl4ssb0x): bead work-4r0. Prerequisite for the fractal agent_users role (work-or3, daniel/fractal#8), which now reads OpenBao with the community.hashi_vault collection.

Why

community.hashi_vault is the Vault/OpenBao collection; there is no OpenBao-specific collection. The collection needs the hvac Python library on the controller, and the old EE did not ship it (ModuleNotFoundError), so the role would fail inside AWX.
Daniel's direction: do not vendor collections in daniel/fractal; install and maintain them in the execution environment instead.

Changes

requirements.yml: add community.hashi_vault explicitly (the pip ansible package already provides it, but making it explicit here is the maintainable place).
requirements.txt: add hvac (the essential change; without it every community.hashi_vault module fails).
README.md: list the collection and hvac.
tests/playbook.yml: assert community.hashi_vault is present and hvac imports.

Validation

podman build -t awx-debian-ee:work-4r0 . succeeds.
Smoke test passes: all assertions, hvac 2.4.0, ansible-runner works.
Confirmed the old :13-latest image had community.hashi_vault but no hvac; the rebuilt image has both.
With ANSIBLE_COLLECTIONS_PATH pointed elsewhere, ansible-doc community.hashi_vault.vault_kv2_get still resolves (found via the ansible package on sys.path), so the fractal project's collections_path=collections setting does not hide it.

After merge the :13 image rebuilds via .gitea/workflows/build.yml.

Agent (opencode@gl4ssb0x): bead work-4r0. Prerequisite for the fractal `agent_users` role (work-or3, daniel/fractal#8), which now reads OpenBao with the `community.hashi_vault` collection. ## Why - `community.hashi_vault` is the Vault/OpenBao collection; there is no OpenBao-specific collection. The collection needs the `hvac` Python library on the controller, and the old EE did not ship it (`ModuleNotFoundError`), so the role would fail inside AWX. - Daniel's direction: do not vendor collections in `daniel/fractal`; install and maintain them in the execution environment instead. ## Changes - `requirements.yml`: add `community.hashi_vault` explicitly (the pip `ansible` package already provides it, but making it explicit here is the maintainable place). - `requirements.txt`: add `hvac` (the essential change; without it every `community.hashi_vault` module fails). - `README.md`: list the collection and `hvac`. - `tests/playbook.yml`: assert `community.hashi_vault` is present and `hvac` imports. ## Validation - `podman build -t awx-debian-ee:work-4r0 .` succeeds. - Smoke test passes: all assertions, `hvac 2.4.0`, ansible-runner works. - Confirmed the old `:13-latest` image had `community.hashi_vault` but no `hvac`; the rebuilt image has both. - With `ANSIBLE_COLLECTIONS_PATH` pointed elsewhere, `ansible-doc community.hashi_vault.vault_kv2_get` still resolves (found via the `ansible` package on `sys.path`), so the fractal project's `collections_path=collections` setting does not hide it. After merge the `:13` image rebuilds via `.gitea/workflows/build.yml`.

eve added 1 commit

2026-09-27 19:08:15 +00:00

feat(ee): add community.hashi_vault and hvac for OpenBao reads (work-4r0)

Close bead / close (pull_request) Successful in 4s

Details

875e45bab2

The fractal agent_users role (work-or3) reads persona SSH public keys from
OpenBao through community.hashi_vault. Add the collection explicitly to the
execution environment and, more importantly, the hvac Python library it
needs on the controller (the collection fails without it).

Extend the smoke test to assert community.hashi_vault is present and hvac
is importable.

keeper reviewed

2026-09-27 19:09:37 +00:00

keeper left a comment

No description provided.

Routine change: adds community.hashi_vault and the hvac Python library to the execution environment. Reviewed the diff; the image builds and the smoke test passes locally, and the collection resolves even when collections_path is overridden. Approved.

keeper merged commit d3e046674a into main

2026-09-27 19:09:38 +00:00

keeper deleted branch work-4r0-awx-debian-ee-add-community-hashi-vault

2026-09-27 19:09:38 +00:00

keeper referenced this pull request from a commit

2026-09-27 19:09:40 +00:00

[work-4r0] feat(ee): add community.hashi_vault and hvac for OpenBao reads (#18)