From 9e8b2c4661416e7812afa70bad144201ea410fe9 Mon Sep 17 00:00:00 2001 From: Piotr Milewski Date: Mon, 11 Aug 2025 16:29:04 +0200 Subject: security: hide sensitive auth_password in kolla_container module logs Added no_log=True to the 'common_options' argument in generate_module() to prevent the auth_password and other sensitive data from being printed in Ansible logs during container operations. This improves security by hiding credentials from logs. This change addresses the issue where auth_password was visible in logs despite already having no_log=True on the auth_password parameter itself, because it was nested inside common_options dict without no_log protection. Closes-Bug: #2120302 Change-Id: I2064f822bda1c2618605ecfb9bf26ad820ccbbf2 Signed-off-by: Piotr Milewski --- ansible/library/kolla_container.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'ansible/library') diff --git a/ansible/library/kolla_container.py b/ansible/library/kolla_container.py index c6a0ea5d1..ad32369ba 100644 --- a/ansible/library/kolla_container.py +++ b/ansible/library/kolla_container.py @@ -268,7 +268,8 @@ def generate_module(): # NOTE(r-krcek): arguments_spec should also be reflected in the list of # arguments in service-check-containers role argument_spec = dict( - common_options=dict(required=False, type='dict', default=dict()), + common_options=dict(required=False, type='dict', + default=dict(), no_log=True), action=dict(required=True, type='str', choices=['compare_container', 'compare_image', -- cgit v1.2.3