diff options
| author | Piotr Milewski <vurmil@gmail.com> | 2025-08-11 16:29:04 +0200 |
|---|---|---|
| committer | Michal Nasiadka <mnasiadka@gmail.com> | 2025-08-12 07:01:51 +0000 |
| commit | 9e8b2c4661416e7812afa70bad144201ea410fe9 (patch) | |
| tree | 0ac544d5e4094f3de8206393be2e4c4ed7dc466c | |
| parent | f5d6bf6e61cea7b8935441dec6233883f9f656a9 (diff) | |
| download | kolla-ansible-9e8b2c4661416e7812afa70bad144201ea410fe9.tar.gz kolla-ansible-9e8b2c4661416e7812afa70bad144201ea410fe9.zip | |
security: hide sensitive auth_password in kolla_container module logs
Added no_log=True to the 'common_options' argument in generate_module()
to prevent the auth_password and other sensitive data from being printed
in Ansible logs during container operations. This improves security by
hiding credentials from logs.
This change addresses the issue where auth_password was visible in logs
despite already having no_log=True on the auth_password parameter itself,
because it was nested inside common_options dict without no_log protection.
Closes-Bug: #2120302
Change-Id: I2064f822bda1c2618605ecfb9bf26ad820ccbbf2
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
| -rw-r--r-- | ansible/library/kolla_container.py | 3 | ||||
| -rw-r--r-- | releasenotes/notes/bug-2120302-824ede145936a6eb.yaml | 13 | ||||
| -rw-r--r-- | tests/test_kolla_container.py | 3 |
3 files changed, 17 insertions, 2 deletions
diff --git a/ansible/library/kolla_container.py b/ansible/library/kolla_container.py index c6a0ea5d1..ad32369ba 100644 --- a/ansible/library/kolla_container.py +++ b/ansible/library/kolla_container.py @@ -268,7 +268,8 @@ def generate_module(): # NOTE(r-krcek): arguments_spec should also be reflected in the list of # arguments in service-check-containers role argument_spec = dict( - common_options=dict(required=False, type='dict', default=dict()), + common_options=dict(required=False, type='dict', + default=dict(), no_log=True), action=dict(required=True, type='str', choices=['compare_container', 'compare_image', diff --git a/releasenotes/notes/bug-2120302-824ede145936a6eb.yaml b/releasenotes/notes/bug-2120302-824ede145936a6eb.yaml new file mode 100644 index 000000000..3f9434272 --- /dev/null +++ b/releasenotes/notes/bug-2120302-824ede145936a6eb.yaml @@ -0,0 +1,13 @@ +--- +security: + - | + Added no_log=True to the ``common_options`` argument in generate_module() + to prevent the auth_password and other sensitive data from being printed + in Ansible logs during container operations when + ``docker_registry_password`` was set. This improves security by hiding + credentials from logs. + + This change addresses the issue where auth_password was visible in log + despite already having no_log=True on the auth_password parameter itself, + because it was nested inside common_options dict without no_log protection. + `LP#2120302 <https://launchpad.net/bugs/2120302>`__ diff --git a/tests/test_kolla_container.py b/tests/test_kolla_container.py index c1ea866c2..cb496ea39 100644 --- a/tests/test_kolla_container.py +++ b/tests/test_kolla_container.py @@ -36,7 +36,8 @@ class ModuleArgsTest(base.BaseTestCase): def test_module_args(self): argument_spec = dict( - common_options=dict(required=False, type='dict', default=dict()), + common_options=dict(required=False, type='dict', default=dict(), + no_log=True), action=dict( required=True, type='str', choices=['compare_container', |