Agent unable to connect to Vault because of cert issue about puppet-vault_lookup HOT 4 CLOSED

I think you need to use actual values where you have 'nil' or at least use '', but I don't think the .nil checks in the code will handle that right.

I think the code needs something like this:
if name.nil? || name.empty?

from puppet-vault_lookup.

@BobSF67
i'm fairly certain that the function is getting to the api call in get_token. i have added more info in the OP

from puppet-vault_lookup.

@andrewjkeith nil in Puppet is treated as the literal string "nil". Since the lookup function takes positional arguments, you'll want to use undef instead.

For example, try this:

$role_id = 'xxxxxx'
$secret_id = 'yyyyy'

$d = Deferred('vault_lookup::lookup', ['aws/creds/build_role', 'https://vault:8200', undef, undef, undef, undef, 'approle', $role_id, $secret_id])

notify { 'vault':
  message => $d,
}

Also note that as of PR #64 , you can use a hash of options rather than positional arguments. Which would make this simpler for you.
However that change hasn't been released yet, so you'll need to wait for the next version of this module after 0.6.0.

$role_id = 'xxxxxx'
$secret_id = 'yyyyy'

# This will only work after version 0.6.0 of the module:
$d = Deferred('vault_lookup::lookup', ['aws/creds/build_role', {
  'vault_addr'  => 'https://vault:8200',
  'auth_method' => 'approle',
  'role_id'     => $role_id,
  'secret_id'   => $secret_id,
}])

notify { 'vault':
  message => $d,
}

from puppet-vault_lookup.

Closing this issue as the problem was due to improperly calling the function with positional arguments. Use undef instead of nil. Or even better, use the options hash as the 2nd argument like in the example from my comment above.

The options hash feature is available as of version 0.7.0.

from puppet-vault_lookup.