From 9e8b2c4661416e7812afa70bad144201ea410fe9 Mon Sep 17 00:00:00 2001 From: Piotr Milewski Date: Mon, 11 Aug 2025 16:29:04 +0200 Subject: security: hide sensitive auth_password in kolla_container module logs Added no_log=True to the 'common_options' argument in generate_module() to prevent the auth_password and other sensitive data from being printed in Ansible logs during container operations. This improves security by hiding credentials from logs. This change addresses the issue where auth_password was visible in logs despite already having no_log=True on the auth_password parameter itself, because it was nested inside common_options dict without no_log protection. Closes-Bug: #2120302 Change-Id: I2064f822bda1c2618605ecfb9bf26ad820ccbbf2 Signed-off-by: Piotr Milewski --- tests/test_kolla_container.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'tests/test_kolla_container.py') diff --git a/tests/test_kolla_container.py b/tests/test_kolla_container.py index c1ea866c2..cb496ea39 100644 --- a/tests/test_kolla_container.py +++ b/tests/test_kolla_container.py @@ -36,7 +36,8 @@ class ModuleArgsTest(base.BaseTestCase): def test_module_args(self): argument_spec = dict( - common_options=dict(required=False, type='dict', default=dict()), + common_options=dict(required=False, type='dict', default=dict(), + no_log=True), action=dict( required=True, type='str', choices=['compare_container', -- cgit v1.2.3