Repository: ansible/awx-plugins (language: python)

Issue:
Initial pre-commit conformity
I ran `tox -e pre-commit` locally and these are the changes it made. Once this lands, other PR's shouldn't get the additional pre-commit github job generated commit.


Discussion / hints:

Fix patch:
diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
new file mode 100644
index 0000000000..647f4ec317
--- /dev/null
+++ b/.git-blame-ignore-revs
@@ -0,0 +1,71 @@
+# `git blame` master ignore list.
+#
+# This file contains a list of git hashes of revisions to be ignored
+# by `git blame`. These revisions are considered "unimportant" in
+# that they are unlikely to be what you are interested in when blaming.
+# They are typically expected to be formatting-only changes.
+#
+# It can be used for `git blame` using `--ignore-revs-file` or by
+# setting `blame.ignoreRevsFile` in the `git config`[1].
+#
+# Ignore these commits when reporting with blame. Calling
+#
+#   git blame --ignore-revs-file .git-blame-ignore-revs
+#
+# will tell `git blame` to ignore changes made by these revisions when
+# assigning blame, as if the change never happened.
+#
+# You can enable this as a default for your local repository by
+# running
+#
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+#
+# This will probably be automatically picked by your IDE
+# (VSCode+GitLens and JetBrains products are confirmed to do this).
+#
+# Important: if you are switching to a branch without this file,
+# `git blame` will fail with an error.
+#
+# GitHub also excludes the commits listed below from its "Blame"
+# views[2][3].
+#
+# [1]: https://git-scm.com/docs/git-blame#Documentation/git-blame.txt-blameignoreRevsFile
+# [2]: https://github.blog/changelog/2022-03-24-ignore-commits-in-the-blame-view-beta/
+# [3]: https://docs.github.com/en/repositories/working-with-files/using-files/viewing-a-file#ignore-commits-in-the-blame-view
+#
+# Guidelines:
+# - Only large (generally automated) reformatting or renaming PRs
+#   should be added to this list. Do not put things here just because
+#   you feel they are trivial or unimportant. If in doubt, do not put
+#   it on this list.
+# - When adding a single revision, use inline comment to link relevant
+#   issue/PR. Alternatively, paste the commit title instead.
+#   Example:
+#     d4a8b7307acc2dc8a8833ccfa65426ad28b3ffc9  # https://github.com/sanitizers/octomachinery/issues/1
+# - When adding multiple revisions (like a bulk of work over many
+#   commits), organize them in blocks. Precede each such block with a
+#   comment starting with the word "START", followed by a link to the
+#   relevant issue or PR. Add a similar comment after the last block
+#   line but use the word "END", followed by the same link.
+#   Alternatively, add or augment the link with a text motivation and
+#   description of work performed in each commit.
+#   After each individual commit in the block, add an inline comment
+#   with the commit title line.
+#   Example:
+#     # START https://github.com/sanitizers/octomachinery/issues/1
+#     6f0bd2d8a1e6cd2e794cd39976e9756e0c85ac66  # Bulk-replace smile emojis with unicorns
+#     d53974df11dbc22cbea9dc7dcbc9896c25979a27  # Replace double with single quotes
+#     ... <rest of the list>
+#     # END https://github.com/sanitizers/octomachinery/issues/1
+# - Only put full 40-character hashes on this list (not short hashes
+#   or any other revision reference).
+# - Append to the bottom of the file, regardless of the chronological
+#   order of the revisions. Revisions within blocks should be in
+#   chronological order from oldest to newest.
+# - Because you must use a hash, you need to append to this list in a
+#   follow-up PR to the actual reformatting PR that you are trying to
+#   ignore. This approach helps avoid issues with arbitrary rebases
+#   and squashes while the pull request is in progress.
+
+
+6a5f31597a8ffb5b58c1ff956bb7e9da20c77f62  # 💅 Auto-format the initial repository state
diff --git a/src/awx_plugins/credentials/aim.py b/src/awx_plugins/credentials/aim.py
index dc06b0ea6f..ce5b2d2f8d 100644
--- a/src/awx_plugins/credentials/aim.py
+++ b/src/awx_plugins/credentials/aim.py
@@ -1,10 +1,15 @@
-from .plugin import CredentialPlugin, CertFiles, raise_for_status
-
 from urllib.parse import quote, urlencode, urljoin
 
-from .plugin import translate_function as _
 import requests
 
+from .plugin import (
+    CertFiles,
+    CredentialPlugin,
+    raise_for_status,
+    translate_function as _,
+)
+
+
 aim_inputs = {
     'fields': [
         {
@@ -116,11 +121,17 @@ def aim_backend(**kwargs):
     elif object_property.lower() == 'address':
         object_property = 'Address'
     elif object_property not in res:
-        raise KeyError('Property {} not found in object, available properties: Username, Password and Address'.format(object_property))
+        raise KeyError(
+            f'Property {object_property} not found in object, available properties: Username, Password and Address',
+        )
     else:
         object_property = object_property.capitalize()
 
     return res.json()[object_property]
 
 
-aim_plugin = CredentialPlugin('CyberArk Central Credential Provider Lookup', inputs=aim_inputs, backend=aim_backend)
+aim_plugin = CredentialPlugin(
+    'CyberArk Central Credential Provider Lookup',
+    inputs=aim_inputs,
+    backend=aim_backend,
+)
diff --git a/src/awx_plugins/credentials/aws_secretsmanager.py b/src/awx_plugins/credentials/aws_secretsmanager.py
index 335113b2a8..3ce0aeeb5a 100644
--- a/src/awx_plugins/credentials/aws_secretsmanager.py
+++ b/src/awx_plugins/credentials/aws_secretsmanager.py
@@ -1,8 +1,7 @@
 import boto3
 from botocore.exceptions import ClientError
 
-from .plugin import CredentialPlugin
-from .plugin import translate_function as _
+from .plugin import CredentialPlugin, translate_function as _
 
 
 secrets_manager_inputs = {
@@ -32,7 +31,12 @@
             'type': 'string',
         },
     ],
-    'required': ['aws_access_key', 'aws_secret_key', 'region_name', 'secret_name'],
+    'required': [
+        'aws_access_key',
+        'aws_secret_key',
+        'region_name',
+        'secret_name',
+    ],
 }
 
 
@@ -44,15 +48,21 @@ def aws_secretsmanager_backend(**kwargs):
 
     session = boto3.session.Session()
     client = session.client(
-        service_name='secretsmanager', region_name=region_name, aws_secret_access_key=aws_secret_access_key, aws_access_key_id=aws_access_key_id
+        service_name='secretsmanager',
+        region_name=region_name,
+        aws_secret_access_key=aws_secret_access_key,
+        aws_access_key_id=aws_access_key_id,
     )
 
     try:
-        get_secret_value_response = client.get_secret_value(SecretId=secret_name)
+        get_secret_value_response = client.get_secret_value(
+            SecretId=secret_name,
+        )
     except ClientError as e:
         raise e
     # Secrets Manager decrypts the secret value using the associated KMS CMK
-    # Depending on whether the secret was a string or binary, only one of these fields will be populated
+    # Depending on whether the secret was a string or binary, only one of
+    # these fields will be populated
     if 'SecretString' in get_secret_value_response:
         secret = get_secret_value_response['SecretString']
 
@@ -62,4 +72,8 @@ def aws_secretsmanager_backend(**kwargs):
     return secret
 
 
-aws_secretmanager_plugin = CredentialPlugin('AWS Secrets Manager lookup', inputs=secrets_manager_inputs, backend=aws_secretsmanager_backend)
+aws_secretmanager_plugin = CredentialPlugin(
+    'AWS Secrets Manager lookup',
+    inputs=secrets_manager_inputs,
+    backend=aws_secretsmanager_backend,
+)
diff --git a/src/awx_plugins/credentials/azure_kv.py b/src/awx_plugins/credentials/azure_kv.py
index 7579dbee3d..1e7893058d 100644
--- a/src/awx_plugins/credentials/azure_kv.py
+++ b/src/awx_plugins/credentials/azure_kv.py
@@ -1,15 +1,16 @@
-from azure.keyvault.secrets import SecretClient
 from azure.identity import ClientSecretCredential
+from azure.keyvault.secrets import SecretClient
 from msrestazure import azure_cloud
 
-from .plugin import CredentialPlugin
-
-from .plugin import translate_function as _
+from .plugin import CredentialPlugin, translate_function as _
 
 
 # https://github.com/Azure/msrestazure-for-python/blob/master/msrestazure/azure_cloud.py
-clouds = [vars(azure_cloud)[n] for n in dir(azure_cloud) if n.startswith("AZURE_") and n.endswith("_CLOUD")]
-default_cloud = vars(azure_cloud)["AZURE_PUBLIC_CLOUD"]
+clouds = [
+    vars(azure_cloud)[n] for n in dir(azure_cloud)
+    if n.startswith('AZURE_') and n.endswith('_CLOUD')
+]
+default_cloud = vars(azure_cloud)['AZURE_PUBLIC_CLOUD']
 
 
 azure_keyvault_inputs = {
@@ -20,19 +21,27 @@
             'type': 'string',
             'format': 'url',
         },
-        {'id': 'client', 'label': _('Client ID'), 'type': 'string'},
+        {
+            'id': 'client',
+            'label': _('Client ID'),
+            'type': 'string',
+        },
         {
             'id': 'secret',
             'label': _('Client Secret'),
             'type': 'string',
             'secret': True,
         },
-        {'id': 'tenant', 'label': _('Tenant ID'), 'type': 'string'},
+        {
+            'id': 'tenant',
+            'label': _('Tenant ID'),
+            'type': 'string',
+        },
         {
             'id': 'cloud_name',
             'label': _('Cloud Environment'),
             'help_text': _('Specify which azure cloud environment to use.'),
-            'choices': list(set([default_cloud.name] + [c.name for c in clouds])),
+            'choices': list({default_cloud.name} | {c.name for c in clouds}),
             'default': default_cloud.name,
         },
     ],
@@ -47,17 +56,37 @@
             'id': 'secret_version',
             'label': _('Secret Version'),
             'type': 'string',
-            'help_text': _('Used to specify a specific secret version (if left empty, the latest version will be used).'),
+            'help_text': _(
+                'Used to specify a specific secret version (if left empty, '
+                'the latest version will be used).',
+            ),
         },
     ],
-    'required': ['url', 'client', 'secret', 'tenant', 'secret_field'],
+    'required': [
+        'url',
+        'client',
+        'secret',
+        'tenant',
+        'secret_field',
+    ],
 }
 
 
 def azure_keyvault_backend(**kwargs):
-    csc = ClientSecretCredential(tenant_id=kwargs['tenant'], client_id=kwargs['client'], client_secret=kwargs['secret'])
+    csc = ClientSecretCredential(
+        tenant_id=kwargs['tenant'],
+        client_id=kwargs['client'],
+        client_secret=kwargs['secret'],
+    )
     kv = SecretClient(credential=csc, vault_url=kwargs['url'])
-    return kv.get_secret(name=kwargs['secret_field'], version=kwargs.get('secret_version', '')).value
+    return kv.get_secret(
+        name=kwargs['secret_field'],
+        version=kwargs.get('secret_version', ''),
+    ).value
 
 
-azure_keyvault_plugin = CredentialPlugin('Microsoft Azure Key Vault', inputs=azure_keyvault_inputs, backend=azure_keyvault_backend)
+azure_keyvault_plugin = CredentialPlugin(
+    'Microsoft Azure Key Vault',
+    inputs=azure_keyvault_inputs,
+    backend=azure_keyvault_backend,
+)
diff --git a/src/awx_plugins/credentials/centrify_vault.py b/src/awx_plugins/credentials/centrify_vault.py
index b2d97a1db3..6dc5aec459 100644
--- a/src/awx_plugins/credentials/centrify_vault.py
+++ b/src/awx_plugins/credentials/centrify_vault.py
@@ -1,8 +1,10 @@
-from .plugin import CredentialPlugin, raise_for_status
-from .plugin import translate_function as _
 from urllib.parse import urljoin
+
 import requests
 
+from .plugin import CredentialPlugin, raise_for_status, translate_function as _
+
+
 pas_inputs = {
     'fields': [
         {
@@ -16,27 +18,37 @@
             'id': 'client_id',
             'label': _('Centrify API User'),
             'type': 'string',
-            'help_text': _('Centrify API User, having necessary permissions as mentioned in support doc'),
+            'help_text': _(
+                'Centrify API User, having necessary permissions as mentioned '
+                'in support doc',
+            ),
         },
         {
             'id': 'client_password',
             'label': _('Centrify API Password'),
             'type': 'string',
-            'help_text': _('Password of Centrify API User with necessary permissions'),
+            'help_text': _(
+                'Password of Centrify API User with necessary permissions',
+            ),
             'secret': True,
         },
         {
             'id': 'oauth_application_id',
             'label': _('OAuth2 Application ID'),
             'type': 'string',
-            'help_text': _('Application ID of the configured OAuth2 Client (defaults to \'awx\')'),
+            'help_text': _(
+                'Application ID of the configured OAuth2 Client (defaults to '
+                "'awx')",
+            ),
             'default': 'awx',
         },
         {
             'id': 'oauth_scope',
             'label': _('OAuth2 Scope'),
             'type': 'string',
-            'help_text': _('Scope of the configured OAuth2 Client (defaults to \'awx\')'),
+            'help_text': _(
+                "Scope of the configured OAuth2 Client (defaults to 'awx')",
+            ),
             'default': 'awx',
         },
     ],
@@ -45,7 +57,10 @@
             'id': 'account-name',
             'label': _('Account Name'),
             'type': 'string',
-            'help_text': _('Local system account or Domain account name enrolled in Centrify Vault. eg. (root or DOMAIN/Administrator)'),
+            'help_text': _(
+                'Local system account or Domain account name enrolled in '
+                'Centrify Vault. eg. (root or DOMAIN/Administrator)',
+            ),
         },
         {
             'id': 'system-name',
@@ -54,14 +69,36 @@
             'help_text': _('Machine Name enrolled with in Centrify Portal'),
         },
     ],
-    'required': ['url', 'account-name', 'system-name', 'client_id', 'client_password'],
+    'required': [
+        'url',
+        'account-name',
+        'system-name',
+        'client_id',
+        'client_password',
+    ],
 }
 
 
-# generate bearer token to authenticate with PAS portal, Input : Client ID, Client Secret
+# generate bearer token to authenticate with PAS portal, Input : Client
+# ID, Client Secret
 def handle_auth(**kwargs):
-    post_data = {"grant_type": "client_credentials", "scope": kwargs['oauth_scope']}
-    response = requests.post(kwargs['endpoint'], data=post_data, auth=(kwargs['client_id'], kwargs['client_password']), verify=True, timeout=(5, 30))
+    post_data = {
+        'grant_type': 'client_credentials',
+        'scope': kwargs['oauth_scope'],
+    }
+    response = requests.post(
+        kwargs['endpoint'],
+        data=post_data,
+        auth=(
+            kwargs['client_id'],
+            kwargs['client_password'],
+        ),
+        verify=True,
+        timeout=(
+            5,
+            30,
+        ),
+    )
     raise_for_status(response)
     try:
         return response.json()['access_token']
@@ -72,28 +109,54 @@ def handle_auth(**kwargs):
 # fetch the ID of system with RedRock query, Input : System Name, Account Name
 def get_ID(**kwargs):
     endpoint = urljoin(kwargs['url'], '/Redrock/query')
-    name = " Name='{0}' and User='{1}'".format(kwargs['system_name'], kwargs['acc_name'])
-    query = 'Select ID from VaultAccount where {0}'.format(name)
-    post_headers = {"Authorization": "Bearer " + kwargs['access_token'], "X-CENTRIFY-NATIVE-CLIENT": "true"}
-    response = requests.post(endpoint, json={'Script': query}, headers=post_headers, verify=True, timeout=(5, 30))
+    name = " Name='{}' and User='{}'".format(
+        kwargs['system_name'], kwargs['acc_name'],
+    )
+    query = f'Select ID from VaultAccount where {name}'
+    post_headers = {
+        'Authorization': 'Bearer ' +
+        kwargs['access_token'],
+        'X-CENTRIFY-NATIVE-CLIENT': 'true',
+    }
+    response = requests.post(
+        endpoint,
+        json={
+            'Script': query,
+        },
+        headers=post_headers,
+        verify=True,
+        timeout=(
+            5,
+            30,
+        ),
+    )
     raise_for_status(response)
     try:
-        result_str = response.json()["Result"]["Results"]
-        return result_str[0]["Row"]["ID"]
+        result_str = response.json()['Result']['Results']
+        return result_str[0]['Row']['ID']
     except (IndexError, KeyError):
-        raise RuntimeError("Error Detected!! Check the Inputs")
+        raise RuntimeError('Error Detected!! Check the Inputs')
 
 
 # CheckOut Password from Centrify Vault, Input : ID
 def get_passwd(**kwargs):
     endpoint = urljoin(kwargs['url'], '/ServerManage/CheckoutPassword')
-    post_headers = {"Authorization": "Bearer " + kwargs['access_token'], "X-CENTRIFY-NATIVE-CLIENT": "true"}
-    response = requests.post(endpoint, json={'ID': kwargs['acc_id']}, headers=post_headers, verify=True, timeout=(5, 30))
+    post_headers = {
+        'Authorization': f"Bearer {kwargs['access_token'] !s}",
+        'X-CENTRIFY-NATIVE-CLIENT': 'true',
+    }
+    response = requests.post(
+        endpoint,
+        json={'ID': kwargs['acc_id']},
+        headers=post_headers,
+        verify=True,
+        timeout=(5, 30),
+    )
     raise_for_status(response)
     try:
-        return response.json()["Result"]["Password"]
+        return response.json()['Result']['Password']
     except KeyError:
-        raise RuntimeError("Password Not Found")
+        raise RuntimeError('Password Not Found')
 
 
 def centrify_backend(**kwargs):
@@ -104,12 +167,26 @@ def centrify_backend(**kwargs):
     client_password = kwargs.get('client_password')
     app_id = kwargs.get('oauth_application_id', 'awx')
     endpoint = urljoin(url, f'/oauth2/token/{app_id}')
-    endpoint = {'endpoint': endpoint, 'client_id': client_id, 'client_password': client_password, 'oauth_scope': kwargs.get('oauth_scope', 'awx')}
+    endpoint = {
+        'endpoint': endpoint,
+        'client_id': client_id,
+        'client_password': client_password,
+        'oauth_scope': kwargs.get('oauth_scope', 'awx'),
+    }
     token = handle_auth(**endpoint)
-    get_id_args = {'system_name': system_name, 'acc_name': acc_name, 'url': url, 'access_token': token}
+    get_id_args = {
+        'system_name': system_name,
+        'acc_name': acc_name,
+        'url': url,
+        'access_token': token,
+    }
     acc_id = get_ID(**get_id_args)
     get_pwd_args = {'url': url, 'acc_id': acc_id, 'access_token': token}
     return get_passwd(**get_pwd_args)
 
 
-centrify_plugin = CredentialPlugin('Centrify Vault Credential Provider Lookup', inputs=pas_inputs, backend=centrify_backend)
+centrify_plugin = CredentialPlugin(
+    'Centrify Vault Credential Provider Lookup',
+    inputs=pas_inputs,
+    backend=centrify_backend,
+)
diff --git a/src/awx_plugins/credentials/conjur.py b/src/awx_plugins/credentials/conjur.py
index a7fd3a3a65..35abf47996 100644
--- a/src/awx_plugins/credentials/conjur.py
+++ b/src/awx_plugins/credentials/conjur.py
@@ -1,11 +1,15 @@
-from .plugin import CredentialPlugin, CertFiles, raise_for_status
-
-from urllib.parse import urljoin, quote
-
-from .plugin import translate_function as _
-import requests
 import base64
 import binascii
+from urllib.parse import quote, urljoin
+
+import requests
+
+from .plugin import (
+    CertFiles,
+    CredentialPlugin,
+    raise_for_status,
+    translate_function as _,
+)
 
 
 conjur_inputs = {
@@ -32,29 +36,48 @@
             'label': _('Username'),
             'type': 'string',
         },
-        {'id': 'cacert', 'label': _('Public Key Certificate'), 'type': 'string', 'multiline': True},
+        {
+            'id': 'cacert',
+            'label': _('Public Key Certificate'),
+            'type': 'string',
+            'multiline': True,
+        },
     ],
     'metadata': [
         {
             'id': 'secret_path',
             'label': _('Secret Identifier'),
             'type': 'string',
-            'help_text': _('The identifier for the secret e.g., /some/identifier'),
+            'help_text': _(
+                'The identifier for the secret e.g., /some/identifier',
+            ),
         },
         {
             'id': 'secret_version',
             'label': _('Secret Version'),
             'type': 'string',
-            'help_text': _('Used to specify a specific secret version (if left empty, the latest version will be used).'),
+            'help_text': _(
+                'Used to specify a specific secret version (if left empty, '
+                'the latest version will be used).',
+            ),
         },
     ],
-    'required': ['url', 'api_key', 'account', 'username'],
+    'required': [
+        'url',
+        'api_key',
+        'account',
+        'username',
+    ],
 }
 
 
 def _is_base64(s: str) -> bool:
     try:
-        return base64.b64encode(base64.b64decode(s.encode("utf-8"))) == s.encode("utf-8")
+        return base64.b64encode(
+            base64.b64decode(
+                s.encode('utf-8'),
+            ),
+        ) == s.encode('utf-8')
     except binascii.Error:
         return False
 
@@ -78,23 +101,41 @@ def conjur_backend(**kwargs):
         # https://www.conjur.org/api.html#authentication-authenticate-post
         auth_kwargs['verify'] = cert
         try:
-            resp = requests.post(urljoin(url, '/'.join(['authn', account, username, 'authenticate'])), **auth_kwargs)
+            resp = requests.post(
+                urljoin(
+                    url, '/'.join(['authn', account, username, 'authenticate']),
+                ), **auth_kwargs,
+            )
             resp.raise_for_status()
         except requests.exceptions.HTTPError:
-            resp = requests.post(urljoin(url, '/'.join(['api', 'authn', account, username, 'authenticate'])), **auth_kwargs)
+            resp = requests.post(
+                urljoin(
+                    url, '/'.join(['api', 'authn', account, username, 'authenticate']),
+                ), **auth_kwargs,
+            )
     raise_for_status(resp)
     token = resp.content.decode('utf-8')
 
     lookup_kwargs = {
-        'headers': {'Authorization': 'Token token="{}"'.format(token if _is_base64(token) else base64.b64encode(token.encode('utf-8')).decode('utf-8'))},
+        'headers': {
+            'Authorization': 'Token token="{}"'.format(
+                token if _is_base64(token) else base64.b64encode(
+                    token.encode('utf-8'),
+                ).decode('utf-8'),
+            ),
+        },
         'allow_redirects': False,
     }
 
     # https://www.conjur.org/api.html#secrets-retrieve-a-secret-get
-    path = urljoin(url, '/'.join(['secrets', account, 'variable', secret_path]))
-    path_conjurcloud = urljoin(url, '/'.join(['api', 'secrets', account, 'variable', secret_path]))
+    path = urljoin(
+        url, '/'.join(['secrets', account, 'variable', secret_path]),
+    )
+    path_conjurcloud = urljoin(
+        url, '/'.join(['api', 'secrets', account, 'variable', secret_path]),
+    )
     if version:
-        ver = "version={}".format(version)
+        ver = f"version={version}"
         path = '?'.join([path, ver])
         path_conjurcloud = '?'.join([path_conjurcloud, ver])
 
@@ -109,4 +150,8 @@ def conjur_backend(**kwargs):
     return resp.text
 
 
-conjur_plugin = CredentialPlugin('CyberArk Conjur Secrets Manager Lookup', inputs=conjur_inputs, backend=conjur_backend)
+conjur_plugin = CredentialPlugin(
+    'CyberArk Conjur Secrets Manager Lookup',
+    inputs=conjur_inputs,
+    backend=conjur_backend,
+)
diff --git a/src/awx_plugins/credentials/dsv.py b/src/awx_plugins/credentials/dsv.py
index 8296779bde..dc72de8d52 100644
--- a/src/awx_plugins/credentials/dsv.py
+++ b/src/awx_plugins/credentials/dsv.py
@@ -1,23 +1,34 @@
-from .plugin import CredentialPlugin
+from base64 import b64decode
 
-from .plugin import settings
-from .plugin import translate_function as _
 from delinea.secrets.vault import PasswordGrantAuthorizer, SecretsVault
-from base64 import b64decode
+
+from .plugin import CredentialPlugin, settings, translate_function as _
+
 
 dsv_inputs = {
     'fields': [
         {
             'id': 'tenant',
             'label': _('Tenant'),
-            'help_text': _('The tenant e.g. "ex" when the URL is https://ex.secretsvaultcloud.com'),
+            'help_text': _(
+                'The tenant e.g. "ex" when the URL is '
+                'https://ex.secretsvaultcloud.com',
+            ),
             'type': 'string',
         },
         {
             'id': 'tld',
             'label': _('Top-level Domain (TLD)'),
-            'help_text': _('The TLD of the tenant e.g. "com" when the URL is https://ex.secretsvaultcloud.com'),
-            'choices': ['ca', 'com', 'com.au', 'eu'],
+            'help_text': _(
+                'The TLD of the tenant e.g. "com" when the URL is '
+                'https://ex.secretsvaultcloud.com',
+            ),
+            'choices': [
+                'ca',
+                'com',
+                'com.au',
+                'eu',
+            ],
             'default': 'com',
         },
         {
@@ -48,13 +59,26 @@
         {
             'id': 'secret_decoding',
             'label': _('Should the secret be base64 decoded?'),
-            'help_text': _('Specify whether the secret should be base64 decoded, typically used for storing files, such as SSH keys'),
-            'choices': ['No Decoding', 'Decode Base64'],
+            'help_text': _(
+                'Specify whether the secret should be base64 decoded, '
+                'typically used for storing files, such as SSH keys',
+            ),
+            'choices': [
+                'No Decoding',
+                'Decode Base64',
+            ],
             'type': 'string',
             'default': 'No Decoding',
         },
     ],
-    'required': ['tenant', 'client_id', 'client_secret', 'path', 'secret_field', 'secret_decoding'],
+    'required': [
+        'tenant',
+        'client_id',
+        'client_secret',
+        'path',
+        'secret_field',
+        'secret_decoding',
+    ],
 }
 
 if settings.DEBUG:
@@ -64,31 +88,39 @@
             'label': _('URL template'),
             'type': 'string',
             'default': 'https://{}.secretsvaultcloud.{}',
-        }
+        },
     )
 
 
 def dsv_backend(**kwargs):
     tenant_name = kwargs['tenant']
     tenant_tld = kwargs.get('tld', 'com')
-    tenant_url_template = kwargs.get('url_template', 'https://{}.secretsvaultcloud.{}')
+    tenant_url_template = kwargs.get(
+        'url_template', 'https://{}.secretsvaultcloud.{}',
+    )
     client_id = kwargs['client_id']
     client_secret = kwargs['client_secret']
     secret_path = kwargs['path']
     secret_field = kwargs['secret_field']
-    # providing a default value to remain backward compatible for secrets that have not specified this option
+    # providing a default value to remain backward compatible for secrets that
+    # have not specified this option
     secret_decoding = kwargs.get('secret_decoding', 'No Decoding')
 
-    tenant_url = tenant_url_template.format(tenant_name, tenant_tld.strip("."))
+    tenant_url = tenant_url_template.format(tenant_name, tenant_tld.strip('.'))
 
     authorizer = PasswordGrantAuthorizer(tenant_url, client_id, client_secret)
     dsv_secret = SecretsVault(tenant_url, authorizer).get_secret(secret_path)
 
-    # files can be uploaded base64 decoded to DSV and thus decoding it only, when asked for
+    # files can be uploaded base64 decoded to DSV and thus decoding it only,
+    # when asked for
     if secret_decoding == 'Decode Base64':
         return b64decode(dsv_secret['data'][secret_field]).decode()
 
     return dsv_secret['data'][secret_field]
 
 
-dsv_plugin = CredentialPlugin(name='Thycotic DevOps Secrets Vault', inputs=dsv_inputs, backend=dsv_backend)
+dsv_plugin = CredentialPlugin(
+    name='Thycotic DevOps Secrets Vault',
+    inputs=dsv_inputs,
+    backend=dsv_backend,
+)
diff --git a/src/awx_plugins/credentials/hashivault.py b/src/awx_plugins/credentials/hashivault.py
index 81f7770f51..7643899510 100644
--- a/src/awx_plugins/credentials/hashivault.py
+++ b/src/awx_plugins/credentials/hashivault.py
@@ -4,10 +4,15 @@
 import time
 from urllib.parse import urljoin
 
-from .plugin import CredentialPlugin, CertFiles, raise_for_status
-
 import requests
-from .plugin import translate_function as _
+
+from .plugin import (
+    CertFiles,
+    CredentialPlugin,
+    raise_for_status,
+    translate_function as _,
+)
+
 
 base_inputs = {
     'fields': [
@@ -23,16 +28,27 @@
             'label': _('Token'),
             'type': 'string',
             'secret': True,
-            'help_text': _('The access token used to authenticate to the Vault server'),
+            'help_text': _(
+                'The access token used to authenticate to the Vault server',
+            ),
         },
         {
             'id': 'cacert',
             'label': _('CA Certificate'),
             'type': 'string',
             'multiline': True,
-            'help_text': _('The CA certificate used to verify the SSL certificate of the Vault server'),
+            'help_text': _(
+                'The CA certificate used to verify the SSL certificate of '
+                'the Vault server',
+            ),
+        },
+        {
+            'id': 'role_id',
+            'label': _('AppRole role_id'),
+            'type': 'string',
+            'multiline': False,
+            'help_text': _('The Role ID for AppRole Authentication'),
         },
-        {'id': 'role_id', 'label': _('AppRole role_id'), 'type': 'string', 'multiline': False, 'help_text': _('The Role ID for AppRole Authentication')},
         {
             'id': 'secret_id',
             'label': _('AppRole secret_id'),
@@ -47,8 +63,9 @@
             'type': 'string',
             'multiline': True,
             'help_text': _(
-                'The PEM-encoded client certificate used for TLS client authentication.'
-                ' This should include the certificate and any intermediate certififcates.'
+                'The PEM-encoded client certificate used for TLS client '
+                'authentication. This should include the certificate and any '
+                'intermediate certififcates.',
             ),
         },
         {
@@ -57,7 +74,10 @@
             'type': 'string',
             'multiline': True,
             'secret': True,
-            'help_text': _('The certificate private key used for TLS client authentication.'),
+            'help_text': _(
+                'The certificate private key used for TLS client '
+                'authentication.',
+            ),
         },
         {
             'id': 'client_cert_role',
@@ -65,8 +85,9 @@
             'type': 'string',
             'multiline': False,
             'help_text': _(
-                'The role configured in Hashicorp Vault for TLS client authentication.'
-                ' If not provided, Hashicorp Vault may assign roles based on the certificate used.'
+                'The role configured in Hashicorp Vault for TLS client '
+                'authentication. If not provided, Hashicorp Vault may assign '
+                'roles based on the certificate used.',
             ),
         },
         {
@@ -74,7 +95,10 @@
             'label': _('Namespace name (Vault Enterprise only)'),
             'type': 'string',
             'multiline': False,
-            'help_text': _('Name of the namespace to use when authenticate and retrieve secrets'),
+            'help_text': _(
+                'Name of the namespace to use when authenticate and retrieve '
+                'secrets',
+            ),
         },
         {
             'id': 'kubernetes_role',
@@ -82,9 +106,10 @@
             'type': 'string',
             'multiline': False,
             'help_text': _(
-                'The Role for Kubernetes Authentication.'
-                ' This is the named role, configured in Vault server, for AWX pod auth policies.'
-                ' see https://www.vaultproject.io/docs/auth/kubernetes#configuration'
+                'The Role for Kubernetes Authentication. This is the named '
+                'role, configured in Vault server, for AWX pod auth policies. '
+                'see https://www.vaultproject.io/docs/auth/kubernetes'
+                '#configuration',
             ),
         },
         {
@@ -107,7 +132,11 @@
             'type': 'string',
             'multiline': False,
             'default': 'approle',
-            'help_text': _('The Authentication path to use if one isn\'t provided in the metadata when linking to an input field. Defaults to \'approle\''),
+            'help_text': _(
+                "The Authentication path to use if one isn't provided in the "
+                'metadata when linking to an input field. '
+                "Defaults to 'approle'",
+            ),
         },
     ],
     'metadata': [
@@ -117,12 +146,16 @@
             'type': 'string',
             'help_text': _(
                 (
-                    'The path to the secret stored in the secret backend e.g, /some/secret/. It is recommended'
-                    ' that you use the secret backend field to identify the storage backend and to use this field'
-                    ' for locating a specific secret within that store. However, if you prefer to fully identify'
-                    ' both the secret backend and one of its secrets using only this field, join their locations'
-                    ' into a single path without any additional separators, e.g, /location/of/backend/some/secret.'
-                )
+                    'The path to the secret stored in the secret backend e.g, '
+                    '/some/secret/. It is recommended that you use the secret '
+                    'backend field to identify the storage backend and to use '
+                    'this field for locating a specific secret within that '
+                    'store. However, if you prefer to fully identify both the '
+                    'secret backend and one of its secrets using only this '
+                    'field, join their locations into a single path without '
+                    'any additional separators, '
+                    'e.g, /location/of/backend/some/secret.'
+                ),
             ),
         },
         {
@@ -130,10 +163,15 @@
             'label': _('Path to Auth'),
             'type': 'string',
             'multiline': False,
-            'help_text': _('The path where the Authentication method is mounted e.g, approle'),
+            'help_text': _(
+                'The path where the Authentication method is mounted e.g, approle',
+            ),
         },
     ],
-    'required': ['url', 'secret_path'],
+    'required': [
+        'url',
+        'secret_path',
+    ],
 }
 
 hashi_kv_inputs = copy.deepcopy(base_inputs)
@@ -142,9 +180,12 @@
         'id': 'api_version',
         'label': _('API Version'),
         'choices': ['v1', 'v2'],
-        'help_text': _('API v1 is for static key/value lookups.  API v2 is for versioned key/value lookups.'),
+        'help_text': _(
+            'API v1 is for static key/value lookups.  API v2 is for versioned '
+            'key/value lookups.',
+        ),
         'default': 'v1',
-    }
+    },
 )
 hashi_kv_inputs['metadata'] = (
     [
@@ -152,8 +193,11 @@
             'id': 'secret_backend',
             'label': _('Name of Secret Backend'),
             'type': 'string',
-            'help_text': _('The name of the kv secret backend (if left empty, the first segment of the secret path will be used).'),
-        }
+            'help_text': _(
+                'The name of the kv secret backend (if left empty, the first '
+                'segment of the secret path will be used).',
+            ),
+        },
     ]
     + hashi_kv_inputs['metadata']
     + [
@@ -167,7 +211,10 @@
             'id': 'secret_version',
             'label': _('Secret Version (v2 only)'),
             'type': 'string',
-            'help_text': _('Used to specify a specific secret version (if left empty, the latest version will be used).'),
+            'help_text': _(
+                'Used to specify a specific secret version (if left empty, '
+                'the latest version will be used).',
+            ),
         },
     ]
 )
@@ -181,16 +228,24 @@
             'label': _('Unsigned Public Key'),
             'type': 'string',
             'multiline': True,
-        }
+        },
     ]
     + hashi_ssh_inputs['metadata']
     + [
-        {'id': 'role', 'label': _('Role Name'), 'type': 'string', 'help_text': _('The name of the role used to sign.')},
+        {
+            'id': 'role',
+            'label': _('Role Name'),
+            'type': 'string',
+            'help_text': _('The name of the role used to sign.'),
+        },
         {
             'id': 'valid_principals',
             'label': _('Valid Principals'),
             'type': 'string',
-            'help_text': _('Valid principals (either usernames or hostnames) that the certificate should be signed for.'),
+            'help_text': _(
+                'Valid principals (either usernames or hostnames) that the '
+                'certificate should be signed for.',
+            ),
         },
     ]
 )
@@ -207,10 +262,14 @@ def handle_auth(**kwargs):
         token = method_auth(**kwargs, auth_param=approle_auth(**kwargs))
     elif kwargs.get('kubernetes_role'):
         token = method_auth(**kwargs, auth_param=kubernetes_auth(**kwargs))
-    elif kwargs.get('client_cert_public') and kwargs.get('client_cert_private'):
+    elif kwargs.get('client_cert_public') and kwargs.get(
+        'client_cert_private',
+    ):
         token = method_auth(**kwargs, auth_param=client_cert_auth(**kwargs))
     else:
-        raise Exception('Token, Username/Password, AppRole, Kubernetes, or TLS authentication parameters must be set')
+        raise Exception(
+            'Token, Username/Password, AppRole, Kubernetes, or TLS authentication parameters must be set',
+        )
     return token
 
 
@@ -223,7 +282,9 @@ def approle_auth(**kwargs):
 
 
 def kubernetes_auth(**kwargs):
-    jwt_file = pathlib.Path('/var/run/secrets/kubernetes.io/serviceaccount/token')
+    jwt_file = pathlib.Path(
+        '/var/run/secrets/kubernetes.io/serviceaccount/token',
+    )
     with jwt_file.open('r') as jwt_fo:
         jwt = jwt_fo.read().rstrip()
     return {'role': kwargs['kubernetes_role'], 'jwt': jwt}
@@ -256,7 +317,9 @@ def method_auth(**kwargs):
     with CertFiles(cacert) as cert:
         request_kwargs['verify'] = cert
         # TLS client certificate support
-        if kwargs.get('client_cert_public') and kwargs.get('client_cert_private'):
+        if kwargs.get('client_cert_public') and kwargs.get(
+                'client_cert_private',
+        ):
             # Add client cert to requests Session before making call
             with CertFiles(kwargs['client_cert_public'], key=kwargs['client_cert_private']) as client_cert:
                 sess.cert = client_cert
@@ -285,7 +348,7 @@ def kv_backend(**kwargs):
 
     sess = requests.Session()
     sess.mount(url, requests.adapters.HTTPAdapter(max_retries=5))
-    sess.headers['Authorization'] = 'Bearer {}'.format(token)
+    sess.headers['Authorization'] = f'Bearer {token}'
     # Compatibility header for older installs of Hashicorp Vault
     sess.headers['X-Vault-Token'] = token
     if kwargs.get('namespace'):
@@ -298,7 +361,8 @@ def kv_backend(**kwargs):
             path_segments = [secret_backend, 'data', secret_path]
         else:
             try:
-                mount_point, *path = pathlib.Path(secret_path.lstrip(os.sep)).parts
+                mount_point, * \
+                    path = pathlib.Path(secret_path.lstrip(os.sep)).parts
                 '/'.join(path)
             except Exception:
                 mount_point, path = secret_path, []
@@ -330,11 +394,13 @@ def kv_backend(**kwargs):
 
     if secret_key:
         try:
-            if (secret_key != 'data') and (secret_key not in json['data']) and ('data' in json['data']):
+            if (secret_key != 'data') and (
+                    secret_key not in json['data']
+            ) and ('data' in json['data']):
                 return json['data']['data'][secret_key]
             return json['data'][secret_key]
         except KeyError:
-            raise RuntimeError('{} is not present at {}'.format(secret_key, secret_path))
+            raise RuntimeError(f'{secret_key} is not present at {secret_path}')
     return json['data']
 
 
@@ -356,7 +422,7 @@ def ssh_backend(**kwargs):
 
     sess = requests.Session()
     sess.mount(url, requests.adapters.HTTPAdapter(max_retries=5))
-    sess.headers['Authorization'] = 'Bearer {}'.format(token)
+    sess.headers['Authorization'] = f'Bearer {token}'
     if kwargs.get('namespace'):
         sess.headers['X-Vault-Namespace'] = kwargs['namespace']
     # Compatability header for older installs of Hashicorp Vault
@@ -379,6 +445,14 @@ def ssh_backend(**kwargs):
     return resp.json()['data']['signed_key']
 
 
-hashivault_kv_plugin = CredentialPlugin('HashiCorp Vault Secret Lookup', inputs=hashi_kv_inputs, backend=kv_backend)
+hashivault_kv_plugin = CredentialPlugin(
+    'HashiCorp Vault Secret Lookup',
+    inputs=hashi_kv_inputs,
+    backend=kv_backend,
+)
 
-hashivault_ssh_plugin = CredentialPlugin('HashiCorp Vault Signed SSH', inputs=hashi_ssh_inputs, backend=ssh_backend)
+hashivault_ssh_plugin = CredentialPlugin(
+    'HashiCorp Vault Signed SSH',
+    inputs=hashi_ssh_inputs,
+    backend=ssh_backend,
+)
diff --git a/src/awx_plugins/credentials/injectors.py b/src/awx_plugins/credentials/injectors.py
index 29a438f919..4f966d0994 100644
--- a/src/awx_plugins/credentials/injectors.py
+++ b/src/awx_plugins/credentials/injectors.py
@@ -1,12 +1,12 @@
 import json
-import yaml
 import os
 import stat
 import tempfile
 
+from awx.main.utils.execution_environments import to_container_path
 from django.conf import settings
 
-from awx.main.utils.execution_environments import to_container_path
+import yaml
 
 
 def aws(cred, env, private_data_dir):
@@ -14,7 +14,9 @@ def aws(cred, env, private_data_dir):
     env['AWS_SECRET_ACCESS_KEY'] = cred.get_input('password', default='')
 
     if cred.has_input('security_token'):
-        env['AWS_SECURITY_TOKEN'] = cred.get_input('security_token', default='')
+        env['AWS_SECURITY_TOKEN'] = cred.get_input(
+            'security_token', default='',
+        )
         env['AWS_SESSION_TOKEN'] = env['AWS_SECURITY_TOKEN']
 
 
@@ -22,7 +24,15 @@ def gce(cred, env, private_data_dir):
     project = cred.get_input('project', default='')
     username = cred.get_input('username', default='')
 
-    json_cred = {'type': 'service_account', 'private_key': cred.get_input('ssh_key_data', default=''), 'client_email': username, 'project_id': project}
+    json_cred = {
+        'type': 'service_account',
+        'private_key': cred.get_input(
+            'ssh_key_data',
+            default='',
+        ),
+        'client_email': username,
+        'project_id': project,
+    }
     if 'INVENTORY_UPDATE_ID' not in env:
         env['GCE_EMAIL'] = username
         env['GCE_PROJECT'] = project
@@ -80,7 +90,9 @@ def _openstack_data(cred):
         project_name=cred.get_input('project', default=''),
     )
     if cred.has_input('project_domain_name'):
-        openstack_auth['project_domain_name'] = cred.get_input('project_domain_name', default='')
+        openstack_auth['project_domain_name'] = cred.get_input(
+            'project_domain_name', default='',
+        )
     if cred.has_input('domain'):
         openstack_auth['domain_name'] = cred.get_input('domain', default='')
     verify_state = cred.get_input('verify_ssl', default=True)
@@ -95,7 +107,9 @@ def _openstack_data(cred):
     }
 
     if cred.has_input('region'):
-        openstack_data['clouds']['devstack']['region_name'] = cred.get_input('region', default='')
+        openstack_data['clouds']['devstack']['region_name'] = cred.get_input(
+            'region', default='',
+        )
 
     return openstack_data
 
@@ -104,7 +118,12 @@ def openstack(cred, env, private_data_dir):
     handle, path = tempfile.mkstemp(dir=os.path.join(private_data_dir, 'env'))
     f = os.fdopen(handle, 'w')
     openstack_data = _openstack_data(cred)
-    yaml.safe_dump(openstack_data, f, default_flow_style=False, allow_unicode=True)
+    yaml.safe_dump(
+        openstack_data,
+        f,
+        default_flow_style=False,
+        allow_unicode=True,
+    )
     f.close()
     os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)
     env['OS_CLIENT_CONFIG_FILE'] = to_container_path(path, private_data_dir)
@@ -115,7 +134,9 @@ def kubernetes_bearer_token(cred, env, private_data_dir):
     env['K8S_AUTH_API_KEY'] = cred.get_input('bearer_token', default='')
     if cred.get_input('verify_ssl') and 'ssl_ca_cert' in cred.inputs:
         env['K8S_AUTH_VERIFY_SSL'] = 'True'
-        handle, path = tempfile.mkstemp(dir=os.path.join(private_data_dir, 'env'))
+        handle, path = tempfile.mkstemp(
+            dir=os.path.join(private_data_dir, 'env'),
+        )
         with os.fdopen(handle, 'w') as f:
             os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)
             f.write(cred.get_input('ssl_ca_cert'))
@@ -132,8 +153,12 @@ def terraform(cred, env, private_data_dir):
     env['TF_BACKEND_CONFIG_FILE'] = to_container_path(path, private_data_dir)
     # Handle env variables for GCP account credentials
     if 'gce_credentials' in cred.inputs:
-        handle, path = tempfile.mkstemp(dir=os.path.join(private_data_dir, 'env'))
+        handle, path = tempfile.mkstemp(
+            dir=os.path.join(private_data_dir, 'env'),
+        )
         with os.fdopen(handle, 'w') as f:
             os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)
             f.write(cred.get_input('gce_credentials'))
-        env['GOOGLE_BACKEND_CREDENTIALS'] = to_container_path(path, private_data_dir)
+        env['GOOGLE_BACKEND_CREDENTIALS'] = to_container_path(
+            path, private_data_dir,
+        )
diff --git a/src/awx_plugins/credentials/plugin.py b/src/awx_plugins/credentials/plugin.py
index b8aa294544..8df771eb84 100644
--- a/src/awx_plugins/credentials/plugin.py
+++ b/src/awx_plugins/credentials/plugin.py
@@ -1,11 +1,15 @@
 import os
 import tempfile
-
 from collections import namedtuple
 
 from requests.exceptions import HTTPError
 
-CredentialPlugin = namedtuple('CredentialPlugin', ['name', 'inputs', 'backend'])
+
+CredentialPlugin = namedtuple(
+    'CredentialPlugin', [
+        'name', 'inputs', 'backend',
+    ],
+)
 
 
 try:
@@ -30,9 +34,8 @@ def raise_for_status(resp):
 
 
 class CertFiles:
-    """
-    A context manager used for writing a certificate and (optional) key
-    to $TMPDIR, and cleaning up afterwards.
+    """A context manager used for writing a certificate and (optional) key to
+    $TMPDIR, and cleaning up afterwards.
 
     This is particularly useful as a shared resource for credential plugins
     that want to pull cert/key data out of the database and persist it
diff --git a/src/awx_plugins/credentials/plugins.py b/src/awx_plugins/credentials/plugins.py
index debc5c7032..8f9ff044f5 100644
--- a/src/awx_plugins/credentials/plugins.py
+++ b/src/awx_plugins/credentials/plugins.py
@@ -1,8 +1,7 @@
 # Django
-from django.utils.translation import gettext_noop
-
 # AWX
 from awx.main.models.credential import ManagedCredentialType
+from django.utils.translation import gettext_noop
 
 
 ManagedCredentialType(
@@ -11,9 +10,26 @@
     name=gettext_noop('Machine'),
     inputs={
         'fields': [
-            {'id': 'username', 'label': gettext_noop('Username'), 'type': 'string'},
-            {'id': 'password', 'label': gettext_noop('Password'), 'type': 'string', 'secret': True, 'ask_at_runtime': True},
-            {'id': 'ssh_key_data', 'label': gettext_noop('SSH Private Key'), 'type': 'string', 'format': 'ssh_private_key', 'secret': True, 'multiline': True},
+            {
+                'id': 'username',
+                'label': gettext_noop('Username'),
+                'type': 'string',
+            },
+            {
+                'id': 'password',
+                'label': gettext_noop('Password'),
+                'type': 'string',
+                'secret': True,
+                'ask_at_runtime': True,
+            },
+            {
+                'id': 'ssh_key_data',
+                'label': gettext_noop('SSH Private Key'),
+                'type': 'string',
+                'format': 'ssh_private_key',
+                'secret': True,
+                'multiline': True,
+            },
             {
                 'id': 'ssh_public_key_data',
                 'label': gettext_noop('Signed SSH Certificate'),
@@ -21,19 +37,35 @@
                 'multiline': True,
                 'secret': True,
             },
-            {'id': 'ssh_key_unlock', 'label': gettext_noop('Private Key Passphrase'), 'type': 'string', 'secret': True, 'ask_at_runtime': True},
+            {
+                'id': 'ssh_key_unlock',
+                'label': gettext_noop('Private Key Passphrase'),
+                'type': 'string',
+                'secret': True,
+                'ask_at_runtime': True,
+            },
             {
                 'id': 'become_method',
                 'label': gettext_noop('Privilege Escalation Method'),
                 'type': 'string',
-                'help_text': gettext_noop('Specify a method for "become" operations. This is equivalent to specifying the --become-method Ansible parameter.'),
+                'help_text': gettext_noop(
+                    'Specify a method for "become" operations. This is '
+                    'equivalent to specifying the --become-method Ansible '
+                    'parameter.',
+                ),
             },
             {
                 'id': 'become_username',
                 'label': gettext_noop('Privilege Escalation Username'),
                 'type': 'string',
             },
-            {'id': 'become_password', 'label': gettext_noop('Privilege Escalation Password'), 'type': 'string', 'secret': True, 'ask_at_runtime': True},
+            {
+                'id': 'become_password',
+                'label': gettext_noop('Privilege Escalation Password'),
+                'type': 'string',
+                'secret': True,
+                'ask_at_runtime': True,
+            },
         ],
     },
 )
@@ -45,10 +77,31 @@
     managed=True,
     inputs={
         'fields': [
-            {'id': 'username', 'label': gettext_noop('Username'), 'type': 'string'},
-            {'id': 'password', 'label': gettext_noop('Password'), 'type': 'string', 'secret': True},
-            {'id': 'ssh_key_data', 'label': gettext_noop('SCM Private Key'), 'type': 'string', 'format': 'ssh_private_key', 'secret': True, 'multiline': True},
-            {'id': 'ssh_key_unlock', 'label': gettext_noop('Private Key Passphrase'), 'type': 'string', 'secret': True},
+            {
+                'id': 'username',
+                'label': gettext_noop('Username'),
+                'type': 'string',
+            },
+            {
+                'id': 'password',
+                'label': gettext_noop('Password'),
+                'type': 'string',
+                'secret': True,
+            },
+            {
+                'id': 'ssh_key_data',
+                'label': gettext_noop('SCM Private Key'),
+                'type': 'string',
+                'format': 'ssh_private_key',
+                'secret': True,
+                'multiline': True,
+            },
+            {
+                'id': 'ssh_key_unlock',
+                'label': gettext_noop('Private Key Passphrase'),
+                'type': 'string',
+                'secret': True,
+            },
         ],
     },
 )
@@ -60,7 +113,13 @@
     managed=True,
     inputs={
         'fields': [
-            {'id': 'vault_password', 'label': gettext_noop('Vault Password'), 'type': 'string', 'secret': True, 'ask_at_runtime': True},
+            {
+                'id': 'vault_password',
+                'label': gettext_noop('Vault Password'),
+                'type': 'string',
+                'secret': True,
+                'ask_at_runtime': True,
+            },
             {
                 'id': 'vault_id',
                 'label': gettext_noop('Vault Identifier'),
@@ -71,11 +130,13 @@
                     'equivalent to specifying the --vault-id '
                     'Ansible parameter for providing multiple Vault '
                     'passwords.  Note: this feature only works in '
-                    'Ansible 2.4+.'
+                    'Ansible 2.4+.',
                 ),
             },
         ],
-        'required': ['vault_password'],
+        'required': [
+            'vault_password',
+        ],
     },
 )
 
@@ -86,14 +147,25 @@
     managed=True,
     inputs={
         'fields': [
-            {'id': 'username', 'label': gettext_noop('Username'), 'type': 'string'},
+            {
+                'id': 'username',
+                'label': gettext_noop('Username'),
+                'type': 'string',
+            },
             {
                 'id': 'password',
                 'label': gettext_noop('Password'),
                 'type': 'string',
                 'secret': True,
             },
-            {'id': 'ssh_key_data', 'label': gettext_noop('SSH Private Key'), 'type': 'string', 'format': 'ssh_private_key', 'secret': True, 'multiline': True},
+            {
+                'id': 'ssh_key_data',
+                'label': gettext_noop('SSH Private Key'),
+                'type': 'string',
+                'format': 'ssh_private_key',
+                'secret': True,
+                'multiline': True,
+            },
             {
                 'id': 'ssh_key_unlock',
                 'label': gettext_noop('Private Key Passphrase'),
@@ -113,9 +185,13 @@
             },
         ],
         'dependencies': {
-            'authorize_password': ['authorize'],
+            'authorize_password': [
+                'authorize',
+            ],
         },
-        'required': ['username'],
+        'required': [
+            'username',
+        ],
     },
 )
 
@@ -126,7 +202,11 @@
     managed=True,
     inputs={
         'fields': [
-            {'id': 'username', 'label': gettext_noop('Access Key'), 'type': 'string'},
+            {
+                'id': 'username',
+                'label': gettext_noop('Access Key'),
+                'type': 'string',
+            },
             {
                 'id': 'password',
                 'label': gettext_noop('Secret Key'),
@@ -142,11 +222,14 @@
                     'Security Token Service (STS) is a web service '
                     'that enables you to request temporary, '
                     'limited-privilege credentials for AWS Identity '
-                    'and Access Management (IAM) users.'
+                    'and Access Management (IAM) users.',
                 ),
             },
         ],
-        'required': ['username', 'password'],
+        'required': [
+            'username',
+            'password',
+        ],
     },
 )
 
@@ -157,7 +240,11 @@
     managed=True,
     inputs={
         'fields': [
-            {'id': 'username', 'label': gettext_noop('Username'), 'type': 'string'},
+            {
+                'id': 'username',
+                'label': gettext_noop('Username'),
+                'type': 'string',
+            },
             {
                 'id': 'password',
                 'label': gettext_noop('Password (API Key)'),
@@ -168,7 +255,10 @@
                 'id': 'host',
                 'label': gettext_noop('Host (Authentication URL)'),
                 'type': 'string',
-                'help_text': gettext_noop('The host to authenticate with.  For example, https://openstack.business.com/v2.0/'),
+                'help_text': gettext_noop(
+                    'The host to authenticate with.  For example, '
+                    'https://openstack.business.com/v2.0/',
+                ),
             },
             {
                 'id': 'project',
@@ -188,14 +278,17 @@
                     'OpenStack domains define administrative boundaries. '
                     'It is only needed for Keystone v3 authentication '
                     'URLs. Refer to the documentation for '
-                    'common scenarios.'
+                    'common scenarios.',
                 ),
             },
             {
                 'id': 'region',
                 'label': gettext_noop('Region Name'),
                 'type': 'string',
-                'help_text': gettext_noop('For some cloud providers, like OVH, region must be specified'),
+                'help_text': gettext_noop(
+                    'For some cloud providers, like OVH, region must be '
+                    'specified',
+                ),
             },
             {
                 'id': 'verify_ssl',
@@ -204,7 +297,12 @@
                 'default': True,
             },
         ],
-        'required': ['username', 'password', 'host', 'project'],
+        'required': [
+            'username',
+            'password',
+            'host',
+            'project',
+        ],
     },
 )
 
@@ -219,9 +317,16 @@
                 'id': 'host',
                 'label': gettext_noop('VCenter Host'),
                 'type': 'string',
-                'help_text': gettext_noop('Enter the hostname or IP address that corresponds to your VMware vCenter.'),
+                'help_text': gettext_noop(
+                    'Enter the hostname or IP address that corresponds to '
+                    'your VMware vCenter.',
+                ),
+            },
+            {
+                'id': 'username',
+                'label': gettext_noop('Username'),
+                'type': 'string',
             },
-            {'id': 'username', 'label': gettext_noop('Username'), 'type': 'string'},
             {
                 'id': 'password',
                 'label': gettext_noop('Password'),
@@ -229,7 +334,11 @@
                 'secret': True,
             },
         ],
-        'required': ['host', 'username', 'password'],
+        'required': [
+            'host',
+            'username',
+            'password',
+        ],
     },
 )
 
@@ -244,9 +353,16 @@
                 'id': 'host',
                 'label': gettext_noop('Satellite 6 URL'),
                 'type': 'string',
-                'help_text': gettext_noop('Enter the URL that corresponds to your Red Hat Satellite 6 server. For example, https://satellite.example.org'),
+                'help_text': gettext_noop(
+                    'Enter the URL that corresponds to your Red Hat Satellite '
+                    '6 server. For example, https://satellite.example.org',
+                ),
+            },
+            {
+                'id': 'username',
+                'label': gettext_noop('Username'),
+                'type': 'string',
             },
-            {'id': 'username', 'label': gettext_noop('Username'), 'type': 'string'},
             {
                 'id': 'password',
                 'label': gettext_noop('Password'),
@@ -254,7 +370,11 @@
                 'secret': True,
             },
         ],
-        'required': ['host', 'username', 'password'],
+        'required': [
+            'host',
+            'username',
+            'password',
+        ],
     },
 )
 
@@ -269,7 +389,10 @@
                 'id': 'username',
                 'label': gettext_noop('Service Account Email Address'),
                 'type': 'string',
-                'help_text': gettext_noop('The email address assigned to the Google Compute Engine service account.'),
+                'help_text': gettext_noop(
+                    'The email address assigned to the Google Compute Engine '
+                    'service account.',
+                ),
             },
             {
                 'id': 'project',
@@ -278,8 +401,8 @@
                 'help_text': gettext_noop(
                     'The Project ID is the GCE assigned identification. '
                     'It is often constructed as three words or two words '
-                    'followed by a three-digit number. Examples: project-id-000 '
-                    'and another-project-id'
+                    'followed by a three-digit number. Examples: '
+                    'project-id-000 and another-project-id',
                 ),
             },
             {
@@ -289,10 +412,16 @@
                 'format': 'ssh_private_key',
                 'secret': True,
                 'multiline': True,
-                'help_text': gettext_noop('Paste the contents of the PEM file associated with the service account email.'),
+                'help_text': gettext_noop(
+                    'Paste the contents of the PEM file associated with the '
+                    'service account email.',
+                ),
             },
         ],
-        'required': ['username', 'ssh_key_data'],
+        'required': [
+            'username',
+            'ssh_key_data',
+        ],
     },
 )
 
@@ -307,31 +436,51 @@
                 'id': 'subscription',
                 'label': gettext_noop('Subscription ID'),
                 'type': 'string',
-                'help_text': gettext_noop('Subscription ID is an Azure construct, which is mapped to a username.'),
+                'help_text': gettext_noop(
+                    'Subscription ID is an Azure construct, which is mapped '
+                    'to a username.',
+                ),
+            },
+            {
+                'id': 'username',
+                'label': gettext_noop('Username'),
+                'type': 'string',
             },
-            {'id': 'username', 'label': gettext_noop('Username'), 'type': 'string'},
             {
                 'id': 'password',
                 'label': gettext_noop('Password'),
                 'type': 'string',
                 'secret': True,
             },
-            {'id': 'client', 'label': gettext_noop('Client ID'), 'type': 'string'},
+            {
+                'id': 'client',
+                'label': gettext_noop('Client ID'),
+                'type': 'string',
+            },
             {
                 'id': 'secret',
                 'label': gettext_noop('Client Secret'),
                 'type': 'string',
                 'secret': True,
             },
-            {'id': 'tenant', 'label': gettext_noop('Tenant ID'), 'type': 'string'},
+            {
+                'id': 'tenant',
+                'label': gettext_noop('Tenant ID'),
+                'type': 'string',
+            },
             {
                 'id': 'cloud_environment',
                 'label': gettext_noop('Azure Cloud Environment'),
                 'type': 'string',
-                'help_text': gettext_noop('Environment variable AZURE_CLOUD_ENVIRONMENT when using Azure GovCloud or Azure stack.'),
+                'help_text': gettext_noop(
+                    'Environment variable AZURE_CLOUD_ENVIRONMENT when using '
+                    'Azure GovCloud or Azure stack.',
+                ),
             },
         ],
-        'required': ['subscription'],
+        'required': [
+            'subscription',
+        ],
     },
 )
 
@@ -347,10 +496,15 @@
                 'label': gettext_noop('Token'),
                 'type': 'string',
                 'secret': True,
-                'help_text': gettext_noop('This token needs to come from your profile settings in GitHub'),
-            }
+                'help_text': gettext_noop(
+                    'This token needs to come from your profile settings '
+                    'in GitHub',
+                ),
+            },
+        ],
+        'required': [
+            'token',
         ],
-        'required': ['token'],
     },
 )
 
@@ -366,8 +520,11 @@
                 'label': gettext_noop('Token'),
                 'type': 'string',
                 'secret': True,
-                'help_text': gettext_noop('This token needs to come from your profile settings in GitLab'),
-            }
+                'help_text': gettext_noop(
+                    'This token needs to come from your profile settings in '
+                    'GitLab',
+                ),
+            },
         ],
         'required': ['token'],
     },
@@ -385,10 +542,15 @@
                 'label': gettext_noop('Token'),
                 'type': 'string',
                 'secret': True,
-                'help_text': gettext_noop('This token needs to come from your user settings in Bitbucket'),
-            }
+                'help_text': gettext_noop(
+                    'This token needs to come from your user settings in '
+                    'Bitbucket',
+                ),
+            },
+        ],
+        'required': [
+            'token',
         ],
-        'required': ['token'],
     },
 )
 
@@ -399,15 +561,19 @@
     managed=True,
     inputs={
         'fields': [
-            {'id': 'username', 'label': gettext_noop('Username'), 'type': 'string'},
-            {'id': 'password', 'label': gettext_noop('Password'), 'type': 'string', 'secret': True},
+            {
+                'id': 'username', 'label': gettext_noop('Username'), 'type': 'string',
+            },
+            {
+                'id': 'password', 'label': gettext_noop('Password'), 'type': 'string', 'secret': True,
+            },
         ],
         'required': ['username', 'password'],
     },
     injectors={
         'extra_vars': {
-            "scm_username": "{{username}}",
-            "scm_password": "{{password}}",
+            'scm_username': '{{username}}',
+            'scm_password': '{{password}}',
         },
         'env': {
             'INSIGHTS_USER': '{{username}}',
@@ -423,8 +589,12 @@
     managed=True,
     inputs={
         'fields': [
-            {'id': 'host', 'label': gettext_noop('Host (Authentication URL)'), 'type': 'string', 'help_text': gettext_noop('The host to authenticate with.')},
-            {'id': 'username', 'label': gettext_noop('Username'), 'type': 'string'},
+            {
+                'id': 'host', 'label': gettext_noop('Host (Authentication URL)'), 'type': 'string', 'help_text': gettext_noop('The host to authenticate with.'),
+            },
+            {
+                'id': 'username', 'label': gettext_noop('Username'), 'type': 'string',
+            },
             {
                 'id': 'password',
                 'label': gettext_noop('Password'),
@@ -453,10 +623,15 @@
                     'ovirt_username={{username}}',
                     'ovirt_password={{password}}',
                     '{% if ca_file %}ovirt_ca_file={{ca_file}}{% endif %}',
-                ]
-            )
+                ],
+            ),
+        },
+        'env': {
+            'OVIRT_INI_PATH': '{{tower.filename}}',
+            'OVIRT_URL': '{{host}}',
+            'OVIRT_USERNAME': '{{username}}',
+            'OVIRT_PASSWORD': '{{password}}',
         },
-        'env': {'OVIRT_INI_PATH': '{{tower.filename}}', 'OVIRT_URL': '{{host}}', 'OVIRT_USERNAME': '{{username}}', 'OVIRT_PASSWORD': '{{password}}'},
     },
 )
 
@@ -471,14 +646,19 @@
                 'id': 'host',
                 'label': gettext_noop('Red Hat Ansible Automation Platform'),
                 'type': 'string',
-                'help_text': gettext_noop('Red Hat Ansible Automation Platform base URL to authenticate with.'),
+                'help_text': gettext_noop(
+                    'Red Hat Ansible Automation Platform base URL to '
+                    'authenticate with.',
+                ),
             },
             {
                 'id': 'username',
                 'label': gettext_noop('Username'),
                 'type': 'string',
                 'help_text': gettext_noop(
-                    'Red Hat Ansible Automation Platform username id to authenticate as.This should not be set if an OAuth token is being used.'
+                    'Red Hat Ansible Automation Platform username id to '
+                    'authenticate as.This should not be set if an OAuth token '
+                    'is being used.',
                 ),
             },
             {
@@ -492,9 +672,17 @@
                 'label': gettext_noop('OAuth Token'),
                 'type': 'string',
                 'secret': True,
-                'help_text': gettext_noop('An OAuth token to use to authenticate with.This should not be set if username/password are being used.'),
+                'help_text': gettext_noop(
+                    'An OAuth token to use to authenticate with.This should '
+                    'not be set if username/password are being used.',
+                ),
+            },
+            {
+                'id': 'verify_ssl',
+                'label': gettext_noop('Verify SSL'),
+                'type': 'boolean',
+                'secret': False,
             },
-            {'id': 'verify_ssl', 'label': gettext_noop('Verify SSL'), 'type': 'boolean', 'secret': False},
         ],
         'required': ['host'],
     },
@@ -510,7 +698,7 @@
             'CONTROLLER_PASSWORD': '{{password}}',
             'CONTROLLER_VERIFY_SSL': '{{verify_ssl}}',
             'CONTROLLER_OAUTH_TOKEN': '{{oauth_token}}',
-        }
+        },
     },
 )
 
@@ -524,7 +712,10 @@
                 'id': 'host',
                 'label': gettext_noop('OpenShift or Kubernetes API Endpoint'),
                 'type': 'string',
-                'help_text': gettext_noop('The OpenShift or Kubernetes API Endpoint to authenticate with.'),
+                'help_text': gettext_noop(
+                    'The OpenShift or Kubernetes API Endpoint to authenticate '
+                    'with.',
+                ),
             },
             {
                 'id': 'bearer_token',
@@ -560,7 +751,9 @@
                 'id': 'host',
                 'label': gettext_noop('Authentication URL'),
                 'type': 'string',
-                'help_text': gettext_noop('Authentication endpoint for the container registry.'),
+                'help_text': gettext_noop(
+                    'Authentication endpoint for the container registry.',
+                ),
                 'default': 'quay.io',
             },
             {
@@ -573,7 +766,9 @@
                 'label': gettext_noop('Password or Token'),
                 'type': 'string',
                 'secret': True,
-                'help_text': gettext_noop('A password or token used to authenticate with'),
+                'help_text': gettext_noop(
+                    'A password or token used to authenticate with',
+                ),
             },
             {
                 'id': 'verify_ssl',
@@ -597,20 +792,28 @@
                 'id': 'url',
                 'label': gettext_noop('Galaxy Server URL'),
                 'type': 'string',
-                'help_text': gettext_noop('The URL of the Galaxy instance to connect to.'),
+                'help_text': gettext_noop(
+                    'The URL of the Galaxy instance to connect to.',
+                ),
             },
             {
                 'id': 'auth_url',
                 'label': gettext_noop('Auth Server URL'),
                 'type': 'string',
-                'help_text': gettext_noop('The URL of a Keycloak server token_endpoint, if using SSO auth.'),
+                'help_text': gettext_noop(
+                    'The URL of a Keycloak server token_endpoint, '
+                    'if using SSO auth.',
+                ),
             },
             {
                 'id': 'token',
                 'label': gettext_noop('API Token'),
                 'type': 'string',
                 'secret': True,
-                'help_text': gettext_noop('A token to use for authentication against the Galaxy instance.'),
+                'help_text': gettext_noop(
+                    'A token to use for authentication against the Galaxy '
+                    'instance.',
+                ),
             },
         ],
         'required': ['url'],
@@ -629,7 +832,9 @@
                 'type': 'string',
                 'secret': True,
                 'multiline': True,
-                'help_text': gettext_noop('GPG Public Key used to validate content signatures.'),
+                'help_text': gettext_noop(
+                    'GPG Public Key used to validate content signatures.',
+                ),
             },
         ],
         'required': ['gpg_public_key'],
@@ -649,15 +854,23 @@
                 'type': 'string',
                 'secret': True,
                 'multiline': True,
-                'help_text': gettext_noop('Terraform backend config as Hashicorp configuration language.'),
+                'help_text': gettext_noop(
+                    'Terraform backend config as Hashicorp configuration '
+                    'language.',
+                ),
             },
             {
                 'id': 'gce_credentials',
-                'label': gettext_noop('Google Cloud Platform account credentials'),
+                'label': gettext_noop(
+                    'Google Cloud Platform account credentials',
+                ),
                 'type': 'string',
                 'secret': True,
                 'multiline': True,
-                'help_text': gettext_noop('Google Cloud Platform account credentials in JSON format.'),
+                'help_text': gettext_noop(
+                    'Google Cloud Platform account credentials '
+                    'in JSON format.',
+                ),
             },
         ],
         'required': ['configuration'],
diff --git a/src/awx_plugins/credentials/tss.py b/src/awx_plugins/credentials/tss.py
index e295072233..fced61450c 100644
--- a/src/awx_plugins/credentials/tss.py
+++ b/src/awx_plugins/credentials/tss.py
@@ -1,17 +1,31 @@
-from .plugin import CredentialPlugin
-from .plugin import translate_function as _
+from .plugin import CredentialPlugin, translate_function as _
+
 
 try:
-    from delinea.secrets.server import DomainPasswordGrantAuthorizer, PasswordGrantAuthorizer, SecretServer, ServerSecret
+    from delinea.secrets.server import (
+        DomainPasswordGrantAuthorizer,
+        PasswordGrantAuthorizer,
+        SecretServer,
+        ServerSecret,
+    )
 except ImportError:
-    from thycotic.secrets.server import DomainPasswordGrantAuthorizer, PasswordGrantAuthorizer, SecretServer, ServerSecret
+    from thycotic.secrets.server import (
+        DomainPasswordGrantAuthorizer,
+        PasswordGrantAuthorizer,
+        SecretServer,
+        ServerSecret,
+    )
 
 tss_inputs = {
     'fields': [
         {
             'id': 'server_url',
             'label': _('Secret Server URL'),
-            'help_text': _('The Base URL of Secret Server e.g. https://myserver/SecretServer or https://mytenant.secretservercloud.com'),
+            'help_text': _(
+                'The Base URL of Secret Server e.g. '
+                'https://myserver/SecretServer or '
+                'https://mytenant.secretservercloud.com',
+            ),
             'type': 'string',
         },
         {
@@ -48,17 +62,28 @@
             'type': 'string',
         },
     ],
-    'required': ['server_url', 'username', 'password', 'secret_id', 'secret_field'],
+    'required': [
+        'server_url',
+        'username',
+        'password',
+        'secret_id',
+        'secret_field',
+    ],
 }
 
 
 def tss_backend(**kwargs):
-    if kwargs.get("domain"):
+    if kwargs.get('domain'):
         authorizer = DomainPasswordGrantAuthorizer(
-            base_url=kwargs['server_url'], username=kwargs['username'], domain=kwargs['domain'], password=kwargs['password']
+            base_url=kwargs['server_url'],
+            username=kwargs['username'],
+            domain=kwargs['domain'],
+            password=kwargs['password'],
         )
     else:
-        authorizer = PasswordGrantAuthorizer(kwargs['server_url'], kwargs['username'], kwargs['password'])
+        authorizer = PasswordGrantAuthorizer(
+            kwargs['server_url'], kwargs['username'], kwargs['password'],
+        )
     secret_server = SecretServer(kwargs['server_url'], authorizer)
     secret_dict = secret_server.get_secret(kwargs['secret_id'])
     secret = ServerSecret(**secret_dict)
diff --git a/src/awx_plugins/inventory/plugins.py b/src/awx_plugins/inventory/plugins.py
index 9a42173482..ffb7ff0173 100644
--- a/src/awx_plugins/inventory/plugins.py
+++ b/src/awx_plugins/inventory/plugins.py
@@ -1,16 +1,16 @@
-import yaml
+import os.path
 import stat
 import tempfile
 
-import os.path
-
-from awx_plugins.credentials.injectors import _openstack_data
 from awx.main.utils.execution_environments import to_container_path
-
 from awx.main.utils.licensing import server_product_name
 
+import yaml
 
-class PluginFileInjector(object):
+from awx_plugins.credentials.injectors import _openstack_data
+
+
+class PluginFileInjector:
     plugin_name = None  # Ansible core name used to reference plugin
     # base injector should be one of None, "managed", or "template"
     # this dictates which logic to borrow from playbook injectors
@@ -30,67 +30,125 @@ def get_proper_name(cls):
 
     @property
     def filename(self):
-        """Inventory filename for using the inventory plugin
-        This is created dynamically, but the auto plugin requires this exact naming
-        """
-        return '{0}.yml'.format(self.plugin_name)
+        """Inventory filename for using the inventory plugin This is created
+        dynamically, but the auto plugin requires this exact naming."""
+        return f'{self.plugin_name}.yml'
 
     def inventory_contents(self, inventory_update, private_data_dir):
-        """Returns a string that is the content for the inventory file for the inventory plugin"""
-        return yaml.safe_dump(self.inventory_as_dict(inventory_update, private_data_dir), default_flow_style=False, width=1000)
+        """Returns a string that is the content for the inventory file for the
+        inventory plugin."""
+        return yaml.safe_dump(
+            self.inventory_as_dict(
+                inventory_update,
+                private_data_dir,
+            ),
+            default_flow_style=False,
+            width=1000,
+        )
 
     def inventory_as_dict(self, inventory_update, private_data_dir):
         source_vars = dict(inventory_update.source_vars_dict)  # make a copy
-        '''
-        None conveys that we should use the user-provided plugin.
+        """None conveys that we should use the user-provided plugin.
+
         Note that a plugin value of '' should still be overridden.
-        '''
+        """
         if self.plugin_name is not None:
-            if hasattr(self, 'downstream_namespace') and server_product_name() != 'AWX':
-                source_vars['plugin'] = f'{self.downstream_namespace}.{self.downstream_collection}.{self.plugin_name}'
+            if hasattr(
+                    self,
+                    'downstream_namespace',
+            ) and server_product_name() != 'AWX':
+                source_vars['plugin'] = f'{
+                    self.downstream_namespace
+                }.{
+                    self.downstream_collection
+                }.{
+                    self.plugin_name
+                }'
             elif self.use_fqcn:
-                source_vars['plugin'] = f'{self.namespace}.{self.collection}.{self.plugin_name}'
+                source_vars['plugin'] = f'{
+                    self.namespace
+                }.{
+                    self.collection
+                }.{
+                    self.plugin_name
+                }'
             else:
                 source_vars['plugin'] = self.plugin_name
         return source_vars
 
-    def build_env(self, inventory_update, env, private_data_dir, private_data_files):
-        injector_env = self.get_plugin_env(inventory_update, private_data_dir, private_data_files)
+    def build_env(
+            self,
+            inventory_update,
+            env,
+            private_data_dir,
+            private_data_files,
+    ):
+        injector_env = self.get_plugin_env(
+            inventory_update, private_data_dir, private_data_files,
+        )
         env.update(injector_env)
-        # All CLOUD_PROVIDERS sources implement as inventory plugin from collection
+        # All CLOUD_PROVIDERS sources implement as inventory plugin from
+        # collection
         env['ANSIBLE_INVENTORY_ENABLED'] = 'auto'
         return env
 
-    def _get_shared_env(self, inventory_update, private_data_dir, private_data_files):
-        """By default, we will apply the standard managed injectors"""
+    def _get_shared_env(
+            self,
+            inventory_update,
+            private_data_dir,
+            private_data_files,
+    ):
+        """By default, we will apply the standard managed injectors."""
         injected_env = {}
         credential = inventory_update.get_cloud_credential()
         # some sources may have no credential, specifically ec2
         if credential is None:
             return injected_env
         if self.base_injector in ('managed', 'template'):
-            injected_env['INVENTORY_UPDATE_ID'] = str(inventory_update.pk)  # so injector knows this is inventory
+            injected_env['INVENTORY_UPDATE_ID'] = str(
+                inventory_update.pk,
+            )  # so injector knows this is inventory
         if self.base_injector == 'managed':
             from awx_plugins.credentials import injectors as builtin_injectors
 
             cred_kind = inventory_update.source.replace('ec2', 'aws')
             if cred_kind in dir(builtin_injectors):
-                getattr(builtin_injectors, cred_kind)(credential, injected_env, private_data_dir)
+                getattr(
+                    builtin_injectors,
+                    cred_kind,
+                )(
+                    credential,
+                    injected_env,
+                    private_data_dir,
+                )
         elif self.base_injector == 'template':
             safe_env = injected_env.copy()
             args = []
-            credential.credential_type.inject_credential(credential, injected_env, safe_env, args, private_data_dir)
+            credential.credential_type.inject_credential(
+                credential, injected_env, safe_env, args, private_data_dir,
+            )
             # NOTE: safe_env is handled externally to injector class by build_safe_env static method
             # that means that managed injectors must only inject detectable env keys
             # enforcement of this is accomplished by tests
         return injected_env
 
-    def get_plugin_env(self, inventory_update, private_data_dir, private_data_files):
-        env = self._get_shared_env(inventory_update, private_data_dir, private_data_files)
+    def get_plugin_env(
+            self,
+            inventory_update,
+            private_data_dir,
+            private_data_files,
+    ):
+        env = self._get_shared_env(
+            inventory_update,
+            private_data_dir,
+            private_data_files,
+        )
         return env
 
     def build_private_data(self, inventory_update, private_data_dir):
-        return self.build_plugin_private_data(inventory_update, private_data_dir)
+        return self.build_plugin_private_data(
+            inventory_update, private_data_dir,
+        )
 
     def build_plugin_private_data(self, inventory_update, private_data_dir):
         return None
@@ -103,7 +161,7 @@ class azure_rm(PluginFileInjector):
     collection = 'azcollection'
 
     def get_plugin_env(self, *args, **kwargs):
-        ret = super(azure_rm, self).get_plugin_env(*args, **kwargs)
+        ret = super().get_plugin_env(*args, **kwargs)
         # We need native jinja2 types so that tags can give JSON null value
         ret['ANSIBLE_JINJA2_NATIVE'] = str(True)
         return ret
@@ -116,7 +174,7 @@ class ec2(PluginFileInjector):
     collection = 'aws'
 
     def get_plugin_env(self, *args, **kwargs):
-        ret = super(ec2, self).get_plugin_env(*args, **kwargs)
+        ret = super().get_plugin_env(*args, **kwargs)
         # We need native jinja2 types so that ec2_state_code will give integer
         ret['ANSIBLE_JINJA2_NATIVE'] = str(True)
         return ret
@@ -129,8 +187,9 @@ class gce(PluginFileInjector):
     collection = 'cloud'
 
     def get_plugin_env(self, *args, **kwargs):
-        ret = super(gce, self).get_plugin_env(*args, **kwargs)
-        # We need native jinja2 types so that ip addresses can give JSON null value
+        ret = super().get_plugin_env(*args, **kwargs)
+        # We need native jinja2 types so that ip addresses can give JSON null
+        # value
         ret['ANSIBLE_JINJA2_NATIVE'] = str(True)
         return ret
 
@@ -158,7 +217,8 @@ class openstack(PluginFileInjector):
     def _get_clouds_dict(self, inventory_update, cred, private_data_dir):
         openstack_data = _openstack_data(cred)
 
-        openstack_data['clouds']['devstack']['private'] = inventory_update.source_vars_dict.get('private', True)
+        openstack_data['clouds']['devstack']['private'] = inventory_update.source_vars_dict.get(
+            'private', True, )
         ansible_variables = {
             'use_hostnames': True,
             'expand_hostvars': False,
@@ -179,20 +239,35 @@ def build_plugin_private_data(self, inventory_update, private_data_dir):
         credential = inventory_update.get_cloud_credential()
         private_data = {'credentials': {}}
 
-        openstack_data = self._get_clouds_dict(inventory_update, credential, private_data_dir)
-        private_data['credentials'][credential] = yaml.safe_dump(openstack_data, default_flow_style=False, allow_unicode=True)
+        openstack_data = self._get_clouds_dict(
+            inventory_update, credential, private_data_dir,
+        )
+        private_data['credentials'][credential] = yaml.safe_dump(
+            openstack_data, default_flow_style=False, allow_unicode=True,
+        )
         return private_data
 
-    def get_plugin_env(self, inventory_update, private_data_dir, private_data_files):
-        env = super(openstack, self).get_plugin_env(inventory_update, private_data_dir, private_data_files)
+    def get_plugin_env(
+            self,
+            inventory_update,
+            private_data_dir,
+            private_data_files,
+    ):
+        env = super().get_plugin_env(
+            inventory_update,
+            private_data_dir,
+            private_data_files,
+        )
         credential = inventory_update.get_cloud_credential()
         cred_data = private_data_files['credentials']
-        env['OS_CLIENT_CONFIG_FILE'] = to_container_path(cred_data[credential], private_data_dir)
+        env['OS_CLIENT_CONFIG_FILE'] = to_container_path(
+            cred_data[credential], private_data_dir,
+        )
         return env
 
 
 class rhv(PluginFileInjector):
-    """ovirt uses the custom credential templating, and that is all"""
+    """Ovirt uses the custom credential templating, and that is all."""
 
     plugin_name = 'ovirt'
     base_injector = 'template'
@@ -212,15 +287,26 @@ class satellite6(PluginFileInjector):
     downstream_collection = 'satellite'
     use_fqcn = True
 
-    def get_plugin_env(self, inventory_update, private_data_dir, private_data_files):
+    def get_plugin_env(
+            self,
+            inventory_update,
+            private_data_dir,
+            private_data_files,
+    ):
         # this assumes that this is merged
         # https://github.com/ansible/ansible/pull/52693
         credential = inventory_update.get_cloud_credential()
-        ret = super(satellite6, self).get_plugin_env(inventory_update, private_data_dir, private_data_files)
+        ret = super().get_plugin_env(
+            inventory_update,
+            private_data_dir,
+            private_data_files,
+        )
         if credential:
             ret['FOREMAN_SERVER'] = credential.get_input('host', default='')
             ret['FOREMAN_USER'] = credential.get_input('username', default='')
-            ret['FOREMAN_PASSWORD'] = credential.get_input('password', default='')
+            ret['FOREMAN_PASSWORD'] = credential.get_input(
+                'password', default='',
+            )
         return ret
 
 
@@ -235,11 +321,15 @@ def inventory_as_dict(self, inventory_update, private_data_dir):
         credential = inventory_update.get_cloud_credential()
         config_cred = credential.get_input('configuration')
         if config_cred:
-            handle, path = tempfile.mkstemp(dir=os.path.join(private_data_dir, 'env'))
+            handle, path = tempfile.mkstemp(
+                dir=os.path.join(private_data_dir, 'env'),
+            )
             with os.fdopen(handle, 'w') as f:
                 os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)
                 f.write(config_cred)
-            ret['backend_config_files'] = to_container_path(path, private_data_dir)
+            ret['backend_config_files'] = to_container_path(
+                path, private_data_dir,
+            )
         return ret
 
     def build_plugin_private_data(self, inventory_update, private_data_dir):
@@ -251,17 +341,30 @@ def build_plugin_private_data(self, inventory_update, private_data_dir):
             private_data['credentials'][credential] = gce_cred
         return private_data
 
-    def get_plugin_env(self, inventory_update, private_data_dir, private_data_files):
-        env = super(terraform, self).get_plugin_env(inventory_update, private_data_dir, private_data_files)
+    def get_plugin_env(
+            self,
+            inventory_update,
+            private_data_dir,
+            private_data_files,
+    ):
+        env = super().get_plugin_env(
+            inventory_update,
+            private_data_dir,
+            private_data_files,
+        )
         credential = inventory_update.get_cloud_credential()
         cred_data = private_data_files['credentials']
         if credential in cred_data:
-            env['GOOGLE_BACKEND_CREDENTIALS'] = to_container_path(cred_data[credential], private_data_dir)
+            env['GOOGLE_BACKEND_CREDENTIALS'] = to_container_path(
+                cred_data[credential], private_data_dir,
+            )
         return env
 
 
 class controller(PluginFileInjector):
-    plugin_name = 'tower'  # TODO: relying on routing for now, update after EEs pick up revised collection
+    # TODO: relying on routing for now, update after EEs pick up revised
+    # collection
+    plugin_name = 'tower'
     base_injector = 'template'
     namespace = 'awx'
     collection = 'awx'
@@ -296,7 +399,8 @@ class constructed(PluginFileInjector):
 
     def build_env(self, *args, **kwargs):
         env = super().build_env(*args, **kwargs)
-        # Enable script inventory plugin so we pick up the script files from source inventories
+        # Enable script inventory plugin so we pick up the script files from
+        # source inventories
         env['ANSIBLE_INVENTORY_ENABLED'] += ',script'
         env['ANSIBLE_INVENTORY_ANY_UNPARSED_IS_FAILED'] = 'True'
         return env


Test patch:
diff --git a/tests/test_credential_plugins.py b/tests/test_credential_plugins.py
index 660fdf756b..3d1cc39353 100644
--- a/tests/test_credential_plugins.py
+++ b/tests/test_credential_plugins.py
@@ -1,5 +1,7 @@
-import pytest
 from unittest import mock
+
+import pytest
+
 from awx_plugins.credentials import hashivault
 
 
@@ -36,7 +38,9 @@ def test_hashivault_kubernetes_auth():
     with mock.patch('pathlib.Path') as path_mock:
         mock.mock_open(path_mock.return_value.open, read_data='the_jwt')
         res = hashivault.kubernetes_auth(**kwargs)
-        path_mock.assert_called_with('/var/run/secrets/kubernetes.io/serviceaccount/token')
+        path_mock.assert_called_with(
+            '/var/run/secrets/kubernetes.io/serviceaccount/token',
+        )
         assert res == expected_res
 
 
@@ -96,14 +100,20 @@ def test_hashivault_handle_auth_kubernetes():
             mock.mock_open(path_mock.return_value.open, read_data='the_jwt')
             method_mock.return_value = 'the_token'
             token = hashivault.handle_auth(**kwargs)
-            method_mock.assert_called_with(**kwargs, auth_param={'role': 'the_kubernetes_role', 'jwt': 'the_jwt'})
+            method_mock.assert_called_with(
+                **kwargs,
+                auth_param={
+                    'role': 'the_kubernetes_role',
+                    'jwt': 'the_jwt',
+                },
+            )
             assert token == 'the_token'
 
 
 def test_hashivault_handle_auth_client_cert():
     kwargs = {
-        'client_cert_public': "foo",
-        'client_cert_private': "bar",
+        'client_cert_public': 'foo',
+        'client_cert_private': 'bar',
         'client_cert_role': 'test-cert-1',
     }
     auth_params = {
@@ -122,21 +132,24 @@ def test_hashivault_handle_auth_not_enough_args():
 
 
 class TestDelineaImports:
-    """
-    These module have a try-except for ImportError which will allow using the older library
-    but we do not want the awx_devel image to have the older library,
-    so these tests are designed to fail if these wind up using the fallback import
-    """
+    """These module have a try-except for ImportError which will allow using
+    the older library but we do not want the awx_devel image to have the older
+    library, so these tests are designed to fail if these wind up using the
+    fallback import."""
 
     def test_dsv_import(self):
         from awx_plugins.credentials.dsv import SecretsVault  # noqa
-
         # assert this module as opposed to older thycotic.secrets.vault
         assert SecretsVault.__module__ == 'delinea.secrets.vault'
 
     def test_tss_import(self):
         from awx_plugins.credentials.tss import DomainPasswordGrantAuthorizer, PasswordGrantAuthorizer, SecretServer, ServerSecret  # noqa
 
-        for cls in (DomainPasswordGrantAuthorizer, PasswordGrantAuthorizer, SecretServer, ServerSecret):
+        for cls in (
+                DomainPasswordGrantAuthorizer,
+                PasswordGrantAuthorizer,
+                SecretServer,
+                ServerSecret,
+        ):
             # assert this module as opposed to older thycotic.secrets.server
             assert cls.__module__ == 'delinea.secrets.server'