cloudera.cloud.dw_secret module – Create, register, and delete CDP Data Warehouse secrets

Note

This module is part of the cloudera.cloud collection (version 3.3.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install cloudera.cloud.

To use it in a playbook, specify: cloudera.cloud.dw_secret.

New in cloudera.cloud 3.4.0

Synopsis

• Manage secrets for a CDP Data Warehouse (CDW) cluster.

• A secret is provisioned by one of two mutually exclusive approaches.

• Creation stores the secret value in the cluster’s Kubernetes metadata via secret_value.

• Registration references a secret already held in the cloud provider’s vault via secret_provider_key.

• Secrets are immutable; an existing secret is left unchanged. To alter one, delete it and provision it again.

• The module supports check_mode.

Parameters

Parameter	Comments
access_key string	If provided, the Cloudera on cloud API will use this value as its access key. If not provided, the API will attempt to use the value from the environment variable CDP_ACCESS_KEY_ID. Required if private_key is provided. Mutually exclusive with credentials_path.
azure_vault_name string	The name of the Azure Key Vault holding the secret. Only used with secret_provider_key when registering an Azure secret.
cluster_id aliases: id string / required	The identifier of the Data Warehouse Cluster.
credentials_path string	If provided, the Cloudera on cloud API will use this value as its credentials path. If not provided, the API will attempt to use the value from the environment variable CDP_CREDENTIALS_PATH. Default: "~/.cdp/credentials"
debug aliases: debug_endpoints boolean	If true, the module will capture the Cloudera on cloud HTTP log and return it in the sdk_out and sdk_out_lines fields. Choices: false ← (default) true
endpoint aliases: endpoint_url, url string	The Cloudera on cloud API endpoint to use. If not provided, the API will attempt to use the value from the environment variable CDP_ENDPOINT_URL. Mutually exclusive with endpoint_region.
endpoint_region aliases: cdp_endpoint_region, cdp_region, region string	Specify the Cloudera on cloud API endpoint region. See Cloudera Control Plane regions for more information. If not provided, the API will attempt to use the value from the environment variable CDP_REGION. default is an alias for the us-west-1 region. Mutually exclusive with endpoint. Choices: "default" "us-west-1" ← (default) "eu-1" "ap-1"
endpoint_tls aliases: verify_endpoint_tls, verify_tls, verify_api_tls boolean	Verify the TLS certificates for the Cloudera on cloud API endpoint. Choices: false true ← (default)
http_agent aliases: agent_header string	The HTTP user agent to use for Cloudera on cloud API requests. Default: "cloudera.cloud"
name aliases: secret_name string / required	The name of the secret.
private_key string	If provided, the Cloudera on cloud API will use this value as its private key. If not provided, the API will attempt to use the value from the environment variable CDP_PRIVATE_KEY. Required if access_key is provided.
profile string	If provided, the Cloudera on cloud API will use this value as its profile. If not provided, the API will attempt to use the value from the environment variable CDP_PROFILE. Default: "default"
secret_provider_key aliases: provider_key string	The key of a secret already stored in the cloud provider’s vault. Selects the registration approach and is mutually exclusive with secret_value. Required for state=present if secret_value is not set.
secret_value string	The value (contents) of the secret to store in the cluster’s Kubernetes metadata. Selects the creation approach and is mutually exclusive with secret_provider_key. Required for state=present if secret_provider_key is not set.
state string	The declarative state of the secret. present provisions the secret if it does not exist (idempotent); existing secrets are left unchanged because secrets are immutable. absent deletes the secret if it exists (idempotent). Choices: "present" ← (default) "absent"
strict aliases: strict_errors boolean	Legacy CDPy SDK error handling. Choices: false ← (default) true

Attributes

Attribute	Support	Description
check_mode	Support: full	Can run in check_mode and return changed status prediction without modifying target, if not supported the action will be skipped.
diff_mode	Support: full	Will return details on what has changed (or possibly needs changing in check_mode), when in diff mode
platform	Platforms: all	Target OS/families that can be operated against

Examples

# Note: These examples do not set authentication details.

- name: Create a Kubernetes-stored secret
  cloudera.cloud.dw_secret:
    cluster_id: example-cluster-id
    name: mydbpassword
    secret_value: "{{ vaulted_db_password }}"
    state: present

- name: Register a secret from an Azure Key Vault
  cloudera.cloud.dw_secret:
    cluster_id: example-cluster-id
    name: myregisteredsecret
    secret_provider_key: my-provider-key
    azure_vault_name: my-key-vault
    state: present

- name: Register a secret from a cloud provider vault (non-Azure)
  cloudera.cloud.dw_secret:
    cluster_id: example-cluster-id
    name: awssecret
    secret_provider_key: "arn:aws:secretsmanager:us-west-2:1234567890:secret:my-secret"

- name: Delete a secret
  cloudera.cloud.dw_secret:
    cluster_id: example-cluster-id
    name: mydbpassword
    state: absent

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
sdk_out string	Returns the captured CDP SDK log. Returned: when debug is true
sdk_out_lines list / elements=string	Returns a list of each line of the captured CDP SDK log. Returned: when debug is true
secret dictionary	The details of the CDP Data Warehouse secret. Returned: always
createdBy string	The CRN of the user who created the secret. Returned: when available
properties dictionary	The properties of the secret. Returned: when available
azureVaultName string	The name of the Azure Key Vault. Returned: when available
cloudProvider string	The cloud provider associated with the secret. Returned: when available
version string	The version of the secret. Returned: when available
secretName string	The user-facing name of the secret. Returned: when available
secretProviderKey string	The provider key name associated with the secret. Returned: when available

Authors

• Webster Mudge (@wmudge)

Collection Links

• Issue Tracker
• Repository (Sources)
• Submit a bug report
• Request a feature