Modernize vaultlocker for python 3.12+ and current hvac APIs - #24
Merged
Conversation
- Replace deprecated `Client.auth_approle()` call with `Client.auth.approle.login()`. - Require `hvac>=0.10.6` at minimum, this adds support for `Client.auth.approle.login()`. - Replace `six.moves.configparser` with `configparser`. Signed-off-by: Raven Kaur <raven.kaur@canonical.com>
- Drop python 2 and legacy python 3 test environments and require Python 3.12 or newer. - Add tox and CI coverage for noble, resolute, and latest dependencies on python 3.12 and 3.14 - Remove the OpenStack upper constraints for dependencies - Test each dependency set against Vault 1.8, 1.18, and 2.0 - Update github action versions Signed-off-by: Raven Kaur <raven.kaur@canonical.com>
Raven-182
force-pushed
the
vaultlocker-updates
branch
from
July 17, 2026 17:38
02b7194 to
c4e8617
Compare
Raven-182
marked this pull request as draft
July 17, 2026 17:41
- Replace testcase.TestSkipped(), removed from testtools, with the standard self.skipTest(). - Replace deprecated Client methods with supported sys and auth.approle APRs - Remove approle CIDR restriction causing jobs to fail with `InvalidRequest unauthorized CIDR` - Set PIFPAF_VAULT_ADDR and PIFPAF_ROOT_TOKEN so functional tests are exercised instead of skipping Assisted by: Claude Sonnet 5 Signed-off-by: Raven Kaur <raven.kaur@canonical.com>
Raven-182
force-pushed
the
vaultlocker-updates
branch
from
July 17, 2026 19:25
01cc41e to
d52a799
Compare
Raven-182
marked this pull request as ready for review
July 17, 2026 19:38
freyes
self-requested a review
July 17, 2026 22:00
freyes
reviewed
Jul 17, 2026
freyes
left a comment
freyes
left a comment
Member
There was a problem hiding this comment.
LGTM. Waiting for the CI results
| deps = -r{toxinidir}/test-requirements.txt | ||
| commands = stestr run "^vaultlocker.tests.unit.*" {posargs} | ||
|
|
||
| [testenv:noble] |
| - name: "run functional tests" | ||
| env: | ||
| PIFPAF_VAULT_ADDR: "http://127.0.0.1:8200" | ||
| PIFPAF_ROOT_TOKEN: "testing" |
freyes
reviewed
Jul 17, 2026
|
|
||
| pbr>=2.0 # Apache-2.0 | ||
| hvac | ||
| hvac>=0.10.6 # client.auth.approle.login() requires this API |
Member
There was a problem hiding this comment.
ubuntu versions have this
python3-hvac | 0.5.0-0ubuntu1~ubuntu18.04.1 | bionic-backports/universe | all
python3-hvac | 0.5.0-0ubuntu3 | focal/universe | all
python3-hvac | 0.11.2-1 | jammy/universe | all
python3-hvac | 0.11.2-3 | noble/universe | all
python3-hvac | 2.3.0-5 | resolute/universe | all
python3-hvac | 2.4.0-2 | stonking/universe | all
Contributor
Author
There was a problem hiding this comment.
I pinned 0.10.6 as the minimum because it's the first release that introduced client.auth.approle.login() which is the only new API this PR relies on. The distro specific versions are pinned already in distro specific requirements files.
That said, I can raise the general minimum to 0.11.2 if we'd prefer it to align with the oldest supported Ubuntu package rather than the earliest compatible upstream release.
gboutry
approved these changes
Jul 20, 2026
Contributor
Author
|
@freyes The current CI jobs have completed, but the remaining checks are from the previous test matrix. Do we need to update the |
freyes
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates vaultlocker to support python 3.12+ and current hvac releases.
Context: HVAC is the official python client library for HashiCorp Vault, used to authenticate Vault and interact with its API.
Changes
hvac
Replace
Client.auth_approle()withClient.auth.approle.login().The old
auth_approle()method is not available in hvac 1.x or 2.x. hvac 0.10.6 introduced the namespaced AppRole API used here.The other hvac calls currently used by vaultlocker still work with hvac 2.x. KV API changes will be handled separately as part of the KV v2 work.
Set
hvac>=0.10.6as the minimum supported version.Add a regression test for the AppRole login call.
Remove the undeclared
sixdependency. A clean installation was failing with withModuleNotFoundError: No module named 'six'Tests
sysandauth.approleAPIs and remove deprecated functions hvac.v1Manual Testing
Manually verified the vaultlocker
encryptanddecryptflows against a vault instance.OPEN-4605