Skip to content

Conversation

@gionn
Copy link
Member

@gionn gionn commented Mar 18, 2025

Prevent ansible logging http credentials while using get_url and loop

OPSEXP-3174

@gionn gionn self-assigned this Mar 18, 2025
@gionn gionn requested a review from alxgomz March 18, 2025 15:50
@gionn gionn marked this pull request as ready for review March 18, 2025 15:50
Copy link
Contributor

@alxgomz alxgomz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would also add a no_log param to the repsitory role arguments below:

  • repository_identity_client_secret
  • repository_extra_war_downloads
  • repository_amp_downloads
  • repository_extra_amp_downloads
    As I would expect they also get logged in case of a more verbose play

@gionn
Copy link
Member Author

gionn commented Mar 19, 2025

  • As I would expect they also get logged in case of a more verbose play

not going to help as no_log lose any effect when ansible run in verbose/debug mode

https://docs.ansible.com/ansible/latest/reference_appendices/logging.html#protecting-sensitive-data-with-no-log

and in general no_log make really hard to debug failures, I would avoid using it unless really needed (e.g. executing a shell command with a sensitive argument)

@gionn gionn requested a review from alxgomz March 19, 2025 08:52
@gionn gionn merged commit 07d99b9 into master Mar 19, 2025
64 checks passed
@gionn gionn deleted the OPSEXP-3174-fix-cred-logs branch March 19, 2025 09:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants