password hashing mechanism used in the Alertmanager and Prometheus

[hamdiazz]

Description

The password hashing mechanism used in the Alertmanager and Prometheus roles (located in tosit/tdp-observability) breaks when the Ansible controller runs on Python 3.12 or 3.13.

This affects the following tasks:

roles/prometheus/alertmanager/tasks/config_set_web_config.yml

roles/prometheus/server/tasks/config_set_web_config.yml

The issue makes the entire role fail during:

Generate new hashed password if we don't have one

Environment

• Ansible: 2.15.x

• Python (controller): 3.13 (or 3.12)

• tdp-observability: latest

• bcrypt: 5.0.0 (auto-installed by pip)

• passlib: 1.7.4

Error 1 — Missing backend
passlib.exc.MissingBackendError: bcrypt: no backends available

Error 2 — Password incorrectly considered >72 bytes
password cannot be longer than 72 bytes

(even when password is only “admin”)

Root Cause Analysis

🔴 1) Passlib blowfish backend is not compatible with Python 3.13
🔴 2) pip installs bcrypt 5.0.0, which is incompatible with Passlib
🔴 3) Passlib is effectively unmaintained

Proposed Fix

Replace password_hash('blowfish') with native bcrypt hashing using Python

Use:

import bcrypt
bcrypt.hashpw(pwd, bcrypt.gensalt()).decode()