diff options
| author | Piotr Milewski <vurmil@gmail.com> | 2025-08-11 16:29:04 +0200 |
|---|---|---|
| committer | Michal Nasiadka <mnasiadka@gmail.com> | 2025-08-12 07:01:51 +0000 |
| commit | 9e8b2c4661416e7812afa70bad144201ea410fe9 (patch) | |
| tree | 0ac544d5e4094f3de8206393be2e4c4ed7dc466c /ansible/library | |
| parent | f5d6bf6e61cea7b8935441dec6233883f9f656a9 (diff) | |
| download | kolla-ansible-9e8b2c4661416e7812afa70bad144201ea410fe9.tar.gz kolla-ansible-9e8b2c4661416e7812afa70bad144201ea410fe9.zip | |
security: hide sensitive auth_password in kolla_container module logs
Added no_log=True to the 'common_options' argument in generate_module()
to prevent the auth_password and other sensitive data from being printed
in Ansible logs during container operations. This improves security by
hiding credentials from logs.
This change addresses the issue where auth_password was visible in logs
despite already having no_log=True on the auth_password parameter itself,
because it was nested inside common_options dict without no_log protection.
Closes-Bug: #2120302
Change-Id: I2064f822bda1c2618605ecfb9bf26ad820ccbbf2
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
Diffstat (limited to 'ansible/library')
| -rw-r--r-- | ansible/library/kolla_container.py | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/ansible/library/kolla_container.py b/ansible/library/kolla_container.py index c6a0ea5d1..ad32369ba 100644 --- a/ansible/library/kolla_container.py +++ b/ansible/library/kolla_container.py @@ -268,7 +268,8 @@ def generate_module(): # NOTE(r-krcek): arguments_spec should also be reflected in the list of # arguments in service-check-containers role argument_spec = dict( - common_options=dict(required=False, type='dict', default=dict()), + common_options=dict(required=False, type='dict', + default=dict(), no_log=True), action=dict(required=True, type='str', choices=['compare_container', 'compare_image', |