已安装hashivault集合与hvac包，Ansible hashi_vault lookup仍报错如何解决？

问题背景 #

已在虚拟环境中安装community.hashi_vault集合（v5.0.0）和hvac包（v1.1.0），但执行lookup查询Vault时，剧本仍提示需安装hvac。该问题仅出现在arm64架构的Amazon Linux 2镜像中，x86架构的CentOS镜像可正常运行。

环境验证信息 #

虚拟环境创建命令 #

/usr/bin/python3.8  -m venv playbook/env

调试输出 #

# Python版本
python3 --version
# Python 3.8.16

# hvac安装信息
pip show hvac
# Name: hvac
# Version: 1.1.0
# Summary: HashiCorp Vault API client
# Location: /root/playbook/env/lib/python3.8/site-packages
# Requires: pyhcl, requests

# Ansible版本
ansible --version
# ansible [core 2.13.10]
#   config file = /etc/ansible/ansible.cfg
#   ansible python module location = /root/playbook/env/lib64/python3.8/site-packages/ansible
#   executable location = /root/playbook/env/bin/ansible
#   python version = 3.8.16

# Python解释器验证
ansible -m debug -a 'var=ansible_python_interpreter' localhost
# localhost | SUCCESS => {
#     "ansible_python_interpreter": "/root/playbook/env/bin/python3.8"
# }

ansible -m debug -a 'var=ansible_playbook_python' localhost
# localhost | SUCCESS => {
#     "ansible_playbook_python": "/root/playbook/env/bin/python3.8"
# }

# 集合安装信息
ansible-galaxy collection list | grep hashi
# community.hashi_vault 5.0.0

失败的Lookup语句 #

consul_gossip_key: "{{ lookup('community.hashi_vault.hashi_vault', 'secret=secret_path url=vault_url').data.gossip_key }}"

报错信息 #

TASK [consul : consul | Configure Consul] **************************************
fatal: [hostname]: FAILED! => {"msg": "An unhandled exception occurred while running the lookup plugin 'template'. Error was a <class 'ansible.errors.AnsibleError'>, original message:An unhandled exception occurred while templating '{{ lookup('community.hashi_vault.hashi_vault', 'secret/data/some_path url=https://vault.url').data.gossip_key }}'. Error was a <class 'ansible.errors.AnsibleError'>, original message: An unhandled exception occurred while running the lookup plugin 'community.hashi_vault.hashi_vault'. Error was a <class 'ansible.errors.AnsibleError'>, original message: Please pip install hvac to use the hashi_vault lookup module.. Please pip install hvac to use the hashi_vault lookup module.. An unhandled exception occurred while templating '{{ lookup('community.hashi_vault.hashi_vault', 'secret/data/some_path url=https://vault.url').data.gossip_key }}'. Error was a <class 'ansible.errors.AnsibleError'>, original message: An unhandled exception occurred while running the lookup plugin 'community.hashi_vault.hashi_vault'. Error was a <class 'ansible.errors.AnsibleError'>, original message: Please pip install hvac to use the hashi_vault lookup module.. Please pip install hvac to use the hashi_vault lookup module."}

解决步骤 #

1. 验证hvac模块可导入性 #

先确认虚拟环境中的Python能正常导入hvac，排除架构相关的安装损坏：

source /root/playbook/env/bin/activate
python -c "import hvac; print(hvac.__version__)"

若报错，说明hvac安装不完整，需先安装arm64编译依赖后重装：

# Amazon Linux 2 arm64 安装编译依赖
sudo yum install gcc python38-devel -y
# 重装hvac
pip uninstall -y hvac
pip install hvac==1.1.0 --no-cache-dir

2. 强制指定Ansible使用的Python解释器 #

尽管已验证解释器路径，仍需确保playbook执行时强制使用虚拟环境的Python：

• 在playbook中添加变量：

- name: 你的Play名称
  hosts: hostname
  vars:
    ansible_python_interpreter: "/root/playbook/env/bin/python3.8"
  tasks:
    # 后续任务

• 或运行playbook时通过参数指定：

ansible-playbook -i inventory your_playbook.yml -e "ansible_python_interpreter=/root/playbook/env/bin/python3.8"

3. 检查版本兼容性 #

community.hashi_vault 5.0.0与hvac 1.1.0可能存在兼容性问题，尝试调整版本：

# 升级hvac到最新兼容版本
pip install hvac --upgrade
# 或降级community.hashi_vault到4.x稳定版
ansible-galaxy collection install community.hashi_vault:4.1.0 --force

4. 检查虚拟环境权限 #

确保Ansible运行用户（此处为root）对虚拟环境的site-packages目录有读取权限，避免因权限不足无法加载hvac模块。

内容的提问来源于stack exchange，提问作者Eitan Segel-Lion