Browse Source

Do not log ssh keys by default

This patch adds a no_log clause to tasks that might dump ssh key
information to the ansible logs on deployment. Logging can be re-enabled
by setting hide_sensitive_logs to false.

Conflicts:
    tripleo_ansible/roles/octavia_undercloud/tasks/main.yml

Related-bug: #1918138
Change-Id: I89dccbac7c450b16956edf6a136aed6f4a21214d
(cherry picked from commit 06db51b27d)
changes/81/787181/1
Brent Eagles 2 months ago
committed by Carlos Goncalves
parent
commit
fb2fd1a58b
2 changed files with 21 additions and 0 deletions
  1. +19
    -0
      tripleo_ansible/roles/octavia_undercloud/defaults/main.yml
  2. +2
    -0
      tripleo_ansible/roles/octavia_undercloud/tasks/main.yml

+ 19
- 0
tripleo_ansible/roles/octavia_undercloud/defaults/main.yml View File

@ -0,0 +1,19 @@
---
# Copyright 2020 Red Hat, Inc.
# All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
# All variables intended for modification should be placed in this file.
octavia_undercloud_config_hide_sensitive_logs: "{{ hide_sensitive_logs | default(true) }}"

+ 2
- 0
tripleo_ansible/roles/octavia_undercloud/tasks/main.yml View File

@ -62,6 +62,7 @@
- name: Set final key fact
set_fact:
amp_ssh_key_path_final: "{{ ssh_key_tmp_file.path }}"
no_log: "{{ octavia_undercloud_config_hide_sensitive_logs | bool }}"
when:
- amp_ssh_key_path is not defined or ((amp_ssh_key_path | length) < 1)
@ -69,6 +70,7 @@
shell: |-
openstack keypair show {{ amp_ssh_key_name }} || \
openstack keypair create --public-key {{ amp_ssh_key_path_final }} {{ amp_ssh_key_name }}
no_log: "{{ octavia_undercloud_config_hide_sensitive_logs | bool }}"
environment:
OS_USERNAME: "{{ auth_username }}"
OS_PASSWORD: "{{ auth_password }}"


Loading…
Cancel
Save