Description of problem: Current version of [1] allows setting he_filtered_tokens_vars in the playbook to a list and adding to it variables that we want to filter out their content in the generated log. But if we want to allow passing such a variable on the command line, this does not work: OTOPI_CALLBACK_OF=logs/otopi-$(date +%s).log ANSIBLE_STDOUT_CALLBACK=2_ovirt_logger HE_ANSIBLE_LOG_PATH=logs/ans$(date +%s).log ansible-playbook --module-path=/usr/share/ovirt-hosted-engine-setup/ansible --inventory=./inventory -e somevar=somevalue -e secret_var_cli1=secret_data_1 -e '{"he_filtered_tokens_vars":["secret_var_cli1"]}' test_filtering.yml This is because if he_filtered_tokens_vars it has a higher precedence than set_fact, so the following code will not be able to change it. Not sure it's important to fix. A possible solution is probably to have a different way to pass such things in the command line, such as a new environment variable or a different ansible variable. [1] https://gerrit.ovirt.org/86238
87016 is not fixing this bug, it only mentions it. Our bot is too greedy...
The linked patch do not fix current bug, it only mentions it. Some hook is too greedy and linked it. I discussed with Simone how to handle current bug but didn't try anything yet. For now, we simply add all filtered keys by passing on the command line, so should be safe. The drawback is that we can't _also_ add keys in the middle (inside the playbook), due to the way ansible vars work. But this isn't a problem for now.
(In reply to Yedidyah Bar David from comment #2) > The linked patch do not fix current bug, it only mentions it. Some hook is > too greedy and linked it. > > I discussed with Simone how to handle current bug but didn't try anything > yet. For now, we simply add all filtered keys by passing on the command > line, so should be safe. The drawback is that we can't _also_ add keys in > the middle (inside the playbook), due to the way ansible vars work. But this > isn't a problem for now. re targeting to 4.3 accordingly
Closing old bugs. Please reopen if still relevant. Patches are welcomed.