Revert "security: hide sensitive auth_password in kolla_container module logs"

This reverts commit 9e8b2c4661.

Reason for revert: no_log=True on common_options over-redacts,
including parsed stdout, breaking CI. Different approach needed.

Change-Id: Ia1a1a247c72b0edb13a26f3f73259abe4f92b762
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
This commit is contained in:
Michal Nasiadka
2025-08-13 12:27:41 +00:00
committed by Bartosz Bezak
parent 9e8b2c4661
commit f5c4a627b6
3 changed files with 2 additions and 17 deletions

View File

@@ -268,8 +268,7 @@ def generate_module():
# NOTE(r-krcek): arguments_spec should also be reflected in the list of
# arguments in service-check-containers role
argument_spec = dict(
common_options=dict(required=False, type='dict',
default=dict(), no_log=True),
common_options=dict(required=False, type='dict', default=dict()),
action=dict(required=True, type='str',
choices=['compare_container',
'compare_image',

View File

@@ -1,13 +0,0 @@
---
security:
- |
Added no_log=True to the ``common_options`` argument in generate_module()
to prevent the auth_password and other sensitive data from being printed
in Ansible logs during container operations when
``docker_registry_password`` was set. This improves security by hiding
credentials from logs.
This change addresses the issue where auth_password was visible in log
despite already having no_log=True on the auth_password parameter itself,
because it was nested inside common_options dict without no_log protection.
`LP#2120302 <https://launchpad.net/bugs/2120302>`__

View File

@@ -36,8 +36,7 @@ class ModuleArgsTest(base.BaseTestCase):
def test_module_args(self):
argument_spec = dict(
common_options=dict(required=False, type='dict', default=dict(),
no_log=True),
common_options=dict(required=False, type='dict', default=dict()),
action=dict(
required=True, type='str',
choices=['compare_container',