Bug 2143816

Summary: ha_cluster - use no_log in tasks looping over pot. secret parameters
Product: Red Hat Enterprise Linux 9 Reporter: Rich Megginson <rmeggins>
Component: rhel-system-rolesAssignee: Rich Megginson <rmeggins>
Status: CLOSED ERRATA QA Contact: michal novacek <mnovacek>
Severity: unspecified Docs Contact: Steven J. Levine <slevine>
Priority: unspecified    
Version: 9.2CC: djez, efedin, jfuchs, mnovacek, rhel-cs-system-management-subsystem-qe, rmeggins, spetrosi
Target Milestone: rcKeywords: Triaged
Target Release: 9.2   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: role:ha_cluster
Fixed In Version: rhel-system-roles-1.21.0-0.14.el9 Doc Type: Bug Fix
Doc Text:
.The `ha_cluster` System Role logs no longer display unencrypted passwords and secrets The `ha_cluster` System Role accepts parameters that can be passwords or other secrets. Previously, some of the tasks would log their inputs and outputs. As a result, the role logs could contain unencrypted passwords and other secrets. With this update, the tasks have been changed to use the Ansible `no_log: true` directive and the task output is no longer displayed in the role logs. The `ha_cluster` System Role logs no longer contain passwords and other secrets. While this update protects secure information, the role logs now provide less information that you can use when debugging your configuration.
 Story Points: ---
Clone Of: 2127497 Environment:
Last Closed: 2023-05-09 07:38:23 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1803995, 2127497    
Bug Blocks:    

Comment 20 michal novacek 2023-02-20 08:20:41 UTC 
I have verified that no secret parameters are leaked from the role secrets. 

This have been verified by setting known plaintext secret and setting maximum
verbosity. Running all rhel-system-roles and regression playbooks did not leak
that secret to the log or standard output.
Comment 24 errata-xmlrpc 2023-05-09 07:38:23 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (rhel-system-roles bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2023:2246