ansible-collections / ansible-collections/google.cloud

Bug: google.cloud.gcp_secret_manager fails with 409 ALREADY_EXISTS when secret container already exists

Open
#768 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
105
Forks
144
Avg merge
5d 10h
Merged PRs (30d)
4

Description

##### SUMMARY
The `google.cloud.gcp_secret_manager` module fails with a `409 ALREADY_EXISTS` error when trying to ensure a secret exists (`state: present`) with a specific `value`, if the secret container itself was already created externally (e.g., via Terraform).

Instead of checking the secret's existence via a GET request and adding a new secret version as specified in the documentation ("If the secret value is not this, a new version will be added with this value"), the module attempts to recreate the secret container via a POST request, causing the API to reject it.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
`google.cloud.gcp_secret_manager`

##### ANSIBLE VERSION
ansible [core 2.17.14]

##### COLLECTION VERSION
google.cloud 1.13.0

##### CONFIGURATION
No custom configuration applied. Running with default ansible.cfg settings.

##### OS / ENVIRONMENT
Host OS: Ubuntu 22.04 LTS / Linux
Target Cloud: Google Cloud Platform (GCP) Secret Manager API v1

##### STEPS TO REPRODUCE
1. Create a secret container named `postgres-db-password` via Terraform or GCP Console manually.
2. Run an Ansible playbook that uses `google.cloud.gcp_secret_manager` to push a value to this existing secret container.

```yaml
- name: Push password to GCP Secret Manager
google.cloud.gcp_secret_manager:
name: "postgres-db-password"
value: "super-secure-vault-password"
project: "your-gcp-project-id"
auth_kind: "serviceaccount"
service_account_file: "/path/to/sa.json"
state: present
```

##### EXPECTED RESULTS
The module should detect that the secret container already exists, skip the creation of the container metadata, and successfully create/append a new secret version containing the string "super-secure-vault-password".

##### ACTUAL RESULTS
fatal: [localhost]: FAILED! => {
"changed": false,
"msg": "GCP returned error: 409 ALREADY_EXISTS: Secret already exists"
}

Contributor guide

Open the contributing guide

Research direction

Start with the google.cloud.gcp_secret_manager module entry point and reproduce the documented state: present workflow using an externally created secret container. Trace the existing-container check and version creation behavior; done means an existing container no longer triggers 409 ALREADY_EXISTS and the supplied value is stored as a new secret version.

Written by the indexing model from the issue text.

Assessment

Tech stack
ansible, google-cloud, python
Domain
cloud, devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.