ansible-collections / ansible-collections/google.cloud
Bug: google.cloud.gcp_secret_manager fails with 409 ALREADY_EXISTS when secret container already exists
- Dominant language
- Python
- Stars
- 105
- Forks
- 144
- Avg merge
- 5d 10h
- Merged PRs (30d)
- 4
Description
##### SUMMARY
The `google.cloud.gcp_secret_manager` module fails with a `409 ALREADY_EXISTS` error when trying to ensure a secret exists (`state: present`) with a specific `value`, if the secret container itself was already created externally (e.g., via Terraform).
Instead of checking the secret's existence via a GET request and adding a new secret version as specified in the documentation ("If the secret value is not this, a new version will be added with this value"), the module attempts to recreate the secret container via a POST request, causing the API to reject it.
##### ISSUE TYPE
- Bug Report
##### COMPONENT NAME
`google.cloud.gcp_secret_manager`
##### ANSIBLE VERSION
ansible [core 2.17.14]
##### COLLECTION VERSION
google.cloud 1.13.0
##### CONFIGURATION
No custom configuration applied. Running with default ansible.cfg settings.
##### OS / ENVIRONMENT
Host OS: Ubuntu 22.04 LTS / Linux
Target Cloud: Google Cloud Platform (GCP) Secret Manager API v1
##### STEPS TO REPRODUCE
1. Create a secret container named `postgres-db-password` via Terraform or GCP Console manually.
2. Run an Ansible playbook that uses `google.cloud.gcp_secret_manager` to push a value to this existing secret container.
```yaml
- name: Push password to GCP Secret Manager
google.cloud.gcp_secret_manager:
name: "postgres-db-password"
value: "super-secure-vault-password"
project: "your-gcp-project-id"
auth_kind: "serviceaccount"
service_account_file: "/path/to/sa.json"
state: present
```
##### EXPECTED RESULTS
The module should detect that the secret container already exists, skip the creation of the container metadata, and successfully create/append a new secret version containing the string "super-secure-vault-password".
##### ACTUAL RESULTS
fatal: [localhost]: FAILED! => {
"changed": false,
"msg": "GCP returned error: 409 ALREADY_EXISTS: Secret already exists"
}
Contributor guide
Research direction
Start with the google.cloud.gcp_secret_manager module entry point and reproduce the documented state: present workflow using an externally created secret container. Trace the existing-container check and version creation behavior; done means an existing container no longer triggers 409 ALREADY_EXISTS and the supplied value is stored as a new secret version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ansible, google-cloud, python
- Domain
- cloud, devops
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 74/100