From 8c7641f9cfd3d6e732c9b80347262702e7352af7 Mon Sep 17 00:00:00 2001 From: Jiri Stransky Date: Thu, 23 Jul 2026 09:46:14 +0200 Subject: [PATCH] Restrict test log outputs This to avoid printing secrets into logs, as another layer of security, even though the CI environments are isolated and short-lived. The change does the following: * Default `use_no_log: true`. * Add `use_no_log` onto more tasks. * Disable xtrace (`set -x`) on such tasks as another precaution. This is done via a new `shell_header_no_xtrace` variable so that the behavior is not hardcoded. If debugging of the relevant tasks is necessary, it can be done by tweaking these variables for a testproject. Assisted by: goose+gemini --- tests/roles/backend_services/tasks/main.yaml | 3 +++ .../backend_services/tasks/ospdo_backend_services.yaml | 2 ++ tests/roles/barbican_adoption/tasks/main.yaml | 4 ++++ tests/roles/common_defaults/defaults/main.yaml | 8 +++++++- tests/roles/dataplane_adoption/tasks/nova_ffu.yaml | 2 ++ tests/roles/dataplane_adoption/tasks/ospdo_dataplane.yaml | 7 +++++++ .../designate_adoption/tasks/designate_cr_config.yaml | 2 ++ tests/roles/get_services_configuration/tasks/main.yaml | 7 +++++++ tests/roles/heat_adoption/tasks/main.yaml | 4 ++++ tests/roles/keystone_adoption/tasks/main.yaml | 4 ++++ tests/roles/mariadb_copy/tasks/main.yaml | 2 ++ 11 files changed, 44 insertions(+), 1 deletion(-) diff --git a/tests/roles/backend_services/tasks/main.yaml b/tests/roles/backend_services/tasks/main.yaml index 670eea236..8ea7d7c9a 100644 --- a/tests/roles/backend_services/tasks/main.yaml +++ b/tests/roles/backend_services/tasks/main.yaml @@ -1,6 +1,8 @@ - name: create osp-secret + no_log: "{{ use_no_log }}" ansible.builtin.shell: | {{ shell_header }} + {{ shell_header_no_xtrace }} {{ oc_header }} cd {{ install_yamls_path }} make input @@ -15,6 +17,7 @@ no_log: "{{ use_no_log }}" ansible.builtin.shell: | {{ shell_header }} + {{ shell_header_no_xtrace }} {{ oc_header }} {% if aodh_password %} oc set data secret/osp-secret "AodhPassword={{ aodh_password }}" diff --git a/tests/roles/backend_services/tasks/ospdo_backend_services.yaml b/tests/roles/backend_services/tasks/ospdo_backend_services.yaml index f3a9291c4..e8ea083ec 100644 --- a/tests/roles/backend_services/tasks/ospdo_backend_services.yaml +++ b/tests/roles/backend_services/tasks/ospdo_backend_services.yaml @@ -1,5 +1,7 @@ - name: get service passwords + no_log: "{{ use_no_log }}" ansible.builtin.shell: | + {{ shell_header_no_xtrace }} oc get secret tripleo-passwords -o jsonpath='{.data.*}' | base64 -d>~/tripleo-standalone-passwords.yaml cp ~/tripleo-standalone-passwords.yaml {{ tripleo_passwords['default'] | replace("~", "$HOME") }} when: get_svc_pass| default(false) | bool diff --git a/tests/roles/barbican_adoption/tasks/main.yaml b/tests/roles/barbican_adoption/tasks/main.yaml index 496023d54..ab01987d8 100644 --- a/tests/roles/barbican_adoption/tasks/main.yaml +++ b/tests/roles/barbican_adoption/tasks/main.yaml @@ -1,6 +1,8 @@ - name: patch osp-secret with kek + no_log: "{{ use_no_log }}" ansible.builtin.shell: | {{ shell_header }} + {{ shell_header_no_xtrace }} {{ oc_header }} CONTROLLER1_SSH="{{ controller1_ssh }}" oc set data secret/osp-secret "BarbicanSimpleCryptoKEK=$($CONTROLLER1_SSH \ @@ -10,8 +12,10 @@ - name: Create HSM login secret for Barbican when: barbican_hsm_enabled|default(false) + no_log: "{{ use_no_log }}" ansible.builtin.shell: | {{ shell_header }} + {{ shell_header_no_xtrace }} {{ oc_header }} cat <- }} mariadb_copy_shell_vars_src: |- {{ shell_header }} + {{ shell_header_no_xtrace }} PASSWORD_FILE="{{ tripleo_passwords['default'] | replace("~", "$HOME") }}" @@ -170,6 +175,7 @@ mariadb_copy_shell_vars_src: |- # for any tables that are created in the future as part of db sync mariadb_copy_shell_vars_dst: | {{ shell_header }} + {{ shell_header_no_xtrace }} {{ oc_header }} {{ mariadb_image_env }} {{ cells_env }} diff --git a/tests/roles/dataplane_adoption/tasks/nova_ffu.yaml b/tests/roles/dataplane_adoption/tasks/nova_ffu.yaml index a0516d263..261383787 100644 --- a/tests/roles/dataplane_adoption/tasks/nova_ffu.yaml +++ b/tests/roles/dataplane_adoption/tasks/nova_ffu.yaml @@ -1,5 +1,7 @@ - name: wait for Compute data plane services version updated for all cells + no_log: "{{ use_no_log }}" ansible.builtin.shell: | + {{ shell_header_no_xtrace }} {{ mariadb_copy_shell_vars_dst }} for CELL in $(echo $RENAMED_CELLS); do oc exec openstack-$CELL-galera-0 -c galera -- mysql -rs -uroot -p"${PODIFIED_DB_ROOT_PASSWORD[$CELL]}" \ diff --git a/tests/roles/dataplane_adoption/tasks/ospdo_dataplane.yaml b/tests/roles/dataplane_adoption/tasks/ospdo_dataplane.yaml index da0fff3fe..12d026810 100644 --- a/tests/roles/dataplane_adoption/tasks/ospdo_dataplane.yaml +++ b/tests/roles/dataplane_adoption/tasks/ospdo_dataplane.yaml @@ -1,7 +1,9 @@ # Take the private ssh key (id_ra) from the /home/cloud-admin/.ssh/ directory of the openstackclient pod and create a secret in the osp18 namespace - name: Create secret from openstackclient pod + no_log: "{{ use_no_log }}" ansible.builtin.shell: | {{ shell_header }} + {{ shell_header_no_xtrace }} {{ oc_header }} oc apply -f - < /tmp/oidc_cloudrc" <<'EOF' @@ -243,8 +245,10 @@ failed_when: after_adoption_credential.stdout != 'test' - name: get ldap user token + no_log: "{{ use_no_log }}" ansible.builtin.shell: | {{ shell_header }} + {{ shell_header_no_xtrace }} {{ oc_header }} alias openstack="oc exec -t openstackclient -- openstack" diff --git a/tests/roles/mariadb_copy/tasks/main.yaml b/tests/roles/mariadb_copy/tasks/main.yaml index 6d5307d28..5740ef1fa 100644 --- a/tests/roles/mariadb_copy/tasks/main.yaml +++ b/tests/roles/mariadb_copy/tasks/main.yaml @@ -76,6 +76,7 @@ - name: wait until podified MariaDB is reachable no_log: "{{ use_no_log }}" ansible.builtin.shell: | + {{ shell_header_no_xtrace }} {{ oc_header }} {{ mariadb_copy_shell_vars_dst }} oc rsh mariadb-copy-data mysql -rsh "${PODIFIED_MARIADB_IP['super']}" \ @@ -89,6 +90,7 @@ - name: check that the Galera database cluster(s) members are online and synced, for all cells no_log: "{{ use_no_log }}" ansible.builtin.shell: | + {{ shell_header_no_xtrace }} {{ oc_header }} {{ mariadb_members_env }} {{ mariadb_copy_shell_vars_src }}