Repository: ansible-collections/community.general

Issue:
`lookup_hashi_vault.token_path` in config file being overridden by env HOME
<!--- Verify first that your issue is not already reported on GitHub -->
<!--- Also test if the latest release and devel branch are affected too -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
<!--- Explain the problem briefly below -->
In #23, one of the (very welcome!) changes made is to have the `hashi_vault` lookup plugin read the token for you, if you configure a file name and path. I have these set in `ansible.cfg`:

```ini
[lookup_hashi_vault]
token_path=/run/secrets/vault-agent
token_file=token
```

The `token_path` option can also be set by the `HOME` env var. I understand this is done so that the defaults token file will be `~/.vault-token`, which is also the default for the `vault` binary, but in practice `HOME` is always set, and it overrides the path our vault agent writes to.
Overriding `HOME` causes other issues so is not an option.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
<!--- Write the short name of the module, plugin, task or feature below, use your best guess if unsure -->
hashi_vault

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
```paste below
ansible 2.9.9
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/home/irogers_maxmind_com/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/dist-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.17 (default, Apr 15 2020, 17:20:14) [GCC 7.5.0]

```

##### CONFIGURATION
<!--- Paste verbatim output from "ansible-config dump --only-changed" between quotes -->
```paste below
ANSIBLE_PIPELINING(/etc/ansible/ansible.cfg) = True
ANSIBLE_SSH_ARGS(/etc/ansible/ansible.cfg) = -o ControlMaster=auto -o ControlPersist=60s
COMMAND_WARNINGS(/etc/ansible/ansible.cfg) = False
DEFAULT_FORKS(/etc/ansible/ansible.cfg) = 50
DEFAULT_GATHERING(/etc/ansible/ansible.cfg) = smart
DEFAULT_HOST_LIST(/etc/ansible/ansible.cfg) = [u'/etc/ansible/inventory']
DEFAULT_LOG_PATH(/etc/ansible/ansible.cfg) = /var/log/ansible.log
DEFAULT_STRATEGY_PLUGIN_PATH(/etc/ansible/ansible.cfg) = [u'/usr/share/ansible/plugins/strategy', u'/usr/local/lib/python2.7/dist-packages/ansible_mitogen/plugins/strategy']
DEFAULT_TIMEOUT(/etc/ansible/ansible.cfg) = 30
DISPLAY_SKIPPED_HOSTS(/etc/ansible/ansible.cfg) = False
INVENTORY_ENABLED(/etc/ansible/ansible.cfg) = [u'host_list', u'script', u'auto', u'yaml', u'ini', u'toml', u'gcp_compute']
RETRY_FILES_ENABLED(/etc/ansible/ansible.cfg) = False
```

##### OS / ENVIRONMENT
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
Ubuntu 18.04 using `ppa:ansible/ansible`

##### STEPS TO REPRODUCE
<!--- Describe exactly how to reproduce the problem, using a minimal test-case -->
Using the above ini snippet and this playbook:
<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: Test
  hosts: localhost
  gather_facts: false

  tasks:
    - debug:
        msg: "{{ item }}"
      with_hashi_vault-2.10:
        - secret/data/doesnotexist
```

<!--- HINT: You can paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- Describe what you expected to happen when running the steps above -->
Should read token file and connect to vault (but fail to read non-existent key)
```
TASK [debug] 
fatal: [localhost]: FAILED! => {"msg": "Forbidden: Permission Denied to secret 'secret/data/doesnotexist'."}
```

##### ACTUAL RESULTS
<!--- Describe what actually happened. If possible run with extra verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes -->
```paste below
fatal: [localhost]: FAILED! => {"msg": "No Vault Token specified or discovered."}

```



Discussion:
Files identified in the description:
* [`plugins/lookup/hashi_vault.py`](https://github.com/ansible-collections/community.general/blob/master/plugins/lookup/hashi_vault.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
Hi @ioanrogers , sorry for the delay I haven't looked at Ansible much int eh past few months and didn't know this issue was here.
I authored #23 so I figured I'd look into this. It definitely does seem like an issue. I can't fix it as easily as hoped though because [env vars always take precedence over config values when both are present](https://docs.ansible.com/ansible/latest/reference_appendices/general_precedence.html#configuration-settings), so this might need a more manual approach to how this param is handled.

Resolving patch:
diff --git a/plugins/lookup/hashi_vault.py b/plugins/lookup/hashi_vault.py
--- a/plugins/lookup/hashi_vault.py
+++ b/plugins/lookup/hashi_vault.py
@@ -38,13 +38,17 @@
     token_path:
       description: If no token is specified, will try to read the token file from this path.
       env:
-        - name: HOME
+        - name: VAULT_TOKEN_PATH
+          version_added: 1.2.0
       ini:
         - section: lookup_hashi_vault
           key: token_path
       version_added: '0.2.0'
     token_file:
       description: If no token is specified, will try to read the token from this file in C(token_path).
+      env:
+        - name: VAULT_TOKEN_FILE
+          version_added: 1.2.0
       ini:
         - section: lookup_hashi_vault
           key: token_file
@@ -534,6 +538,11 @@ def validate_auth_approle(self, auth_method):
 
     def validate_auth_token(self, auth_method):
         if auth_method == 'token':
+            if not self.get_option('token_path'):
+                # generally we want env vars defined in the spec, but in this case we want
+                # the env var HOME to have lower precedence than any other value source,
+                # including ini, so we're doing it here after all other processing has taken place
+                self.set_option('token_path', os.environ.get('HOME'))
             if not self.get_option('token') and self.get_option('token_path'):
                 token_filename = os.path.join(
                     self.get_option('token_path'),


Test patch: