如何捕获未找到密钥的Ansible credstash查找插件的异常？

Question

I have the following code

 app_key:   "{{ lookup('credstash', 'aws/project/'+app_name+'/'+app_env+'/app_key') | default('not-set') }}"

And was expecting to be able set a default value based on lookup failing with a key not found, and then generate and store a key later in my playbook.

However, I found that the plugin raises an Exception which makes the entire playbook run fail. Obviously this is not what I was looking for (pre-storing app-keys for non production branches)

(see credstash code: You can find the credstash plugidn code here https://github.com/ansible/ansible/blob/ec701c4b82e570371af7c3999ffb587d870a5b37/lib/ansible/plugins/lookup/credstash.py )

What are my options?

Answer 1

What are my options?

For example (I don't know what task you define app_key in, so I use set_fact in the second task below):

- set_fact:
    app_key_candidate: "{{ lookup('credstash', 'aws/project/'+app_name+'/'+app_env+'/app_key')"
  ignore_errors: true

- set_fact:
    app_key: "{{ app_key_candidate | default('not-set') }}"