cli.administration.secrets.seal package

Module contents

Compatibility wrapper.

This package was migrated from a flat module (inventory/__main__.py) to a package layout:

inventory/__main__.py contains the original implementation.

We re-export the public API so existing imports keep working.

class cli.administration.secrets.seal.Any(*args, **kwargs)

Bases: object

Special type indicating an unconstrained type.

  • Any is assignable to every type.

  • Any assumed to have all methods and attributes.

  • All values are assignable to Any.

Note that all the above statements are true from the point of view of static type checkers. At runtime, Any cannot be used with instance checks.

class cli.administration.secrets.seal.Path(*args, **kwargs)

Bases: PathBase, PurePath

PurePath subclass that can make system calls.

Path represents a filesystem path but unlike PurePath, also offers methods to do system calls on path objects. Depending on your system, instantiating a Path will return either a PosixPath or a WindowsPath object. You can also instantiate a PosixPath or WindowsPath directly, but cannot instantiate a WindowsPath on a POSIX system or vice versa.

absolute()

Return an absolute version of this path No normalization or symlink resolution is performed.

Use resolve() to resolve symlinks and remove ‘..’ segments.

as_uri()

Return the path as a URI.

chmod(mode, *, follow_symlinks=True)

Change the permissions of the path, like os.chmod().

expanduser()

Return a new path with expanded ~ and ~user constructs (as returned by os.path.expanduser)

classmethod from_uri(uri)

Return a new path from the given ‘file’ URI.

glob(pattern, *, case_sensitive=None, recurse_symlinks=False)

Iterate over this subtree and yield all existing files (of any kind, including directories) matching the given relative pattern.

group(*, follow_symlinks=True)

Return the group name of the file gid.

Make this path a hard link pointing to the same file as target.

Note the order of arguments (self, target) is the reverse of os.link’s.

is_junction()

Whether this path is a junction.

is_mount()

Check if this path is a mount point

iterdir()

Yield path objects of the directory contents.

The children are yielded in arbitrary order, and the special entries ‘.’ and ‘..’ are not included.

mkdir(mode=511, parents=False, exist_ok=False)

Create a new directory at this given path.

open(mode='r', buffering=-1, encoding=None, errors=None, newline=None)

Open the file pointed to by this path and return a file object, as the built-in open() function does.

owner(*, follow_symlinks=True)

Return the login name of the file owner.

read_text(encoding=None, errors=None, newline=None)

Open the file in text mode, read it, and close the file.

Return the path to which the symbolic link points.

rename(target)

Rename this path to the target path.

The target path may be absolute or relative. Relative paths are interpreted relative to the current working directory, not the directory of the Path object.

Returns the new Path instance pointing to the target path.

replace(target)

Rename this path to the target path, overwriting if that path exists.

The target path may be absolute or relative. Relative paths are interpreted relative to the current working directory, not the directory of the Path object.

Returns the new Path instance pointing to the target path.

resolve(strict=False)

Make the path absolute, resolving all symlinks on the way and also normalizing it.

rglob(pattern, *, case_sensitive=None, recurse_symlinks=False)

Recursively yield all existing files (of any kind, including directories) matching the given relative pattern, anywhere in this subtree.

rmdir()

Remove this directory. The directory must be empty.

stat(*, follow_symlinks=True)

Return the result of the stat() system call on this path, like os.stat() does.

Make this path a symlink pointing to the target path. Note the order of arguments (link, target) is the reverse of os.symlink.

touch(mode=438, exist_ok=True)

Create this file with the given access mode, if it doesn’t exist.

Remove this file or link. If the path is a directory, use rmdir() instead.

walk(top_down=True, on_error=None, follow_symlinks=False)

Walk the directory tree from this directory, similar to os.walk().

write_text(data, encoding=None, errors=None, newline=None)

Open the file in text mode, write to it, and close the file.

class cli.administration.secrets.seal.SafeDumper(stream, default_style=None, default_flow_style=False, canonical=None, indent=None, width=None, allow_unicode=None, line_break=None, encoding=None, explicit_start=None, explicit_end=None, version=None, tags=None, sort_keys=True)

Bases: Emitter, Serializer, SafeRepresenter, Resolver

yaml_representers = {<class 'NoneType'>: <function SafeRepresenter.represent_none>, <class 'bool'>: <function SafeRepresenter.represent_bool>, <class 'bytes'>: <function SafeRepresenter.represent_binary>, <class 'datetime.date'>: <function SafeRepresenter.represent_date>, <class 'datetime.datetime'>: <function SafeRepresenter.represent_datetime>, <class 'dict'>: <function SafeRepresenter.represent_dict>, <class 'float'>: <function SafeRepresenter.represent_float>, <class 'int'>: <function SafeRepresenter.represent_int>, <class 'list'>: <function SafeRepresenter.represent_list>, <class 'set'>: <function SafeRepresenter.represent_set>, <class 'str'>: <function SafeRepresenter.represent_str>, <class 'tuple'>: <function SafeRepresenter.represent_list>, <class 'utils.handler.vault.VaultScalar'>: <function _vault_representer>, None: <function SafeRepresenter.represent_undefined>}
class cli.administration.secrets.seal.VaultHandler(vault_password_file: str)

Bases: object

encrypt_leaves(branch: dict[str, Any], vault_pw: str)

Recursively encrypt all leaves (plain text values) under the credentials section.

encrypt_string(value: str, name: str) → str

Return the name: !vault | snippet as ansible-vault lays it out.

Parameters:

  • value – plaintext to encrypt.

  • name – key the snippet is emitted under.

class cli.administration.secrets.seal.VaultScalar

Bases: str

A subclass of str to represent vault-encrypted strings.

class cli.administration.secrets.seal.YamlHandler

Bases: object

static load_yaml(path) → dict

Load the YAML file and wrap existing !vault entries.

static wrap_existing_vaults(node: Any) → Any

Recursively wrap any str that begins with ‘$ANSIBLE_VAULT’ in a VaultScalar so it dumps as a literal block.

cli.administration.secrets.seal.ask_for_confirmation(key: str) → bool

Prompt the user for confirmation to overwrite an existing value.

cli.administration.secrets.seal.encrypt_recursively(data: Any, vault_handler: VaultHandler, ask_confirmation: bool = True, prefix: str = '') → Any

Recursively encrypt values in the data.

cli.administration.secrets.seal.main()