Open
Conversation
ideaship
force-pushed
the
rl_graceful_non-vault_deployment
branch
2 times, most recently
from
61417df to
d021d66
Compare
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- In
load_yaml_file, the initialos.path.existscheck duplicates existence checks already done in some callers and always logs an error; consider either removing the internal existence check or returning a more specific error to avoid double logging for the same missing file. load_yaml_filecurrently catches a broadExceptionand converts all failures intoNone; consider narrowing the exception handling (e.g., separate decryption vs. I/O errors) or propagating specific exceptions so callers can distinguish between missing files, decryption errors, and invalid YAML content.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In `load_yaml_file`, the initial `os.path.exists` check duplicates existence checks already done in some callers and always logs an error; consider either removing the internal existence check or returning a more specific error to avoid double logging for the same missing file.
- `load_yaml_file` currently catches a broad `Exception` and converts all failures into `None`; consider narrowing the exception handling (e.g., separate decryption vs. I/O errors) or propagating specific exceptions so callers can distinguish between missing files, decryption errors, and invalid YAML content.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Add load_yaml_file and reuse it in the CLI paths that read OpenStack, RabbitMQ, Octavia, and database secrets from YAML files. Several commands called get_vault() before checking whether the file was actually vault-encrypted. In deployments that keep secrets as plain YAML, this produced repeated 'Unable to get ansible vault password' errors for a path that is never needed. Read the file first and only initialize the vault when the content is encrypted. This removes noisy false-error output during checks and deployments while preserving decryption for encrypted secrets. AI-assisted: Codex Signed-off-by: Roger Luethi <luethi@osism.tech>
Callers already log at their own preferred level (error or warning) when load_yaml_file returns None. Having load_yaml_file also log at error produced double logging for the same failure. Downgrade the messages in load_yaml_file to debug so that callers remain in control of the log level. This matters because not all callers treat a failure the same way: get_cloud_password has a fallback to secure.yml, so a missing secrets.yml is not an error there. An alternative would be to raise specific exceptions from load_yaml_file instead of returning None so that callers can distinguish file-not-found, decryption errors, and YAML parse errors. That would require a larger refactoring of all call sites. AI-assisted: Claude Code Signed-off-by: Roger Luethi <luethi@osism.tech>
Replace the broad except Exception with specific catches for yaml.YAMLError, AnsibleError (vault decryption), and OSError (file I/O). Unexpected exceptions now propagate to the caller, which is the Pythonic convention -- all callers already have their own except Exception safety nets with context-appropriate messages. AI-assisted: Claude Code Signed-off-by: Roger Luethi <luethi@osism.tech>
ideaship
force-pushed
the
rl_graceful_non-vault_deployment
branch
from
d021d66 to
dbdb131
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add load_yaml_file and reuse it in the CLI paths that read OpenStack, RabbitMQ, Octavia, and database secrets from YAML files.
Several commands called get_vault() before checking whether the file was actually vault-encrypted. In deployments that keep secrets as plain YAML, this produced repeated 'Unable to get ansible vault password' errors for a path that is never needed.
Read the file first and only initialize the vault when the content is encrypted. This removes noisy false-error output during checks and deployments while preserving decryption for encrypted secrets.
AI-assisted: Codex