Skip to content

Add parameter to customize Terraform/OpenTofu log level #1810

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
NamelessOne91 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add parameter to customize Terraform/OpenTofu log level #1810

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions jenkins_pipelines/environments/common/pipeline-aws.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ def run(params) {
// Copy minimum repo list to mirror
sh "cp ${local_mirror_dir}/salt/mirror/etc/minimum_repositories_testsuite.yaml ${local_mirror_dir}/salt/mirror/etc/minima-customize.yaml"
// Deploy local mirror
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${local_mirror_params} --logfile ${resultdirbuild}/sumaform-mirror-local.log --init --taint '.*(domain|main_disk|data_disk|database_disk).*' --runstep provision --sumaform-backend libvirt"
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_LOG=${params.extra_logs_level}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${local_mirror_params} --logfile ${resultdirbuild}/sumaform-mirror-local.log --init --taint '.*(domain|main_disk|data_disk|database_disk).*' --runstep provision --sumaform-backend libvirt"
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using TF_LOG configured from the extra_logs_level build parameter can cause Terraform/OpenTofu to emit highly verbose logs, including provider configuration and secrets, into the Terraform log files and Jenkins console output. Anyone with permission to trigger this job and read its logs, but without direct access to the underlying credentials (such as those loaded from /home/jenkins/.credentials), can exfiltrate cloud keys or tokens by selecting DEBUG or TRACE. To avoid leaking secrets, gate high log levels behind an admin-only mechanism, restrict extra_logs_level to safe values in shared jobs (e.g., OFF/ERROR), or ensure that logs produced at debug levels are stored and accessed only within the same security boundary as the credentials themselves.

Copilot uses AI. Check for mistakes.
deployed_local = true

}
Expand All @@ -132,7 +132,7 @@ def run(params) {
env.aws_configuration = aws_configuration + "]\n"
writeFile file: "${aws_mirror_dir}/terraform.tfvars", text: aws_configuration, encoding: "UTF-8"
// Deploy empty AWS mirror
sh "set +x; source /home/jenkins/.credentials set -x; source /home/jenkins/.registration set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${aws_mirror_params} --logfile ${resultdirbuild}/sumaform-mirror-aws.log --init --taint '.*(domain|main_disk|data_disk|database_disk).*' --runstep provision --sumaform-backend aws"
sh "set +x; source /home/jenkins/.credentials set -x; source /home/jenkins/.registration set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_LOG=${params.extra_logs_level}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${aws_mirror_params} --logfile ${resultdirbuild}/sumaform-mirror-aws.log --init --taint '.*(domain|main_disk|data_disk|database_disk).*' --runstep provision --sumaform-backend aws"
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using TF_LOG configured from the extra_logs_level build parameter can cause Terraform/OpenTofu to emit highly verbose logs, including provider configuration and secrets, into the Terraform log files and Jenkins console output. Anyone with permission to trigger this job and read its logs, but without direct access to the underlying credentials (such as those loaded from /home/jenkins/.credentials), can exfiltrate cloud keys or tokens by selecting DEBUG or TRACE. To avoid leaking secrets, gate high log levels behind an admin-only mechanism, restrict extra_logs_level to safe values in shared jobs (e.g., OFF/ERROR), or ensure that logs produced at debug levels are stored and accessed only within the same security boundary as the credentials themselves.

Copilot uses AI. Check for mistakes.

}
}
Expand Down Expand Up @@ -181,7 +181,7 @@ def run(params) {
// Deploying AWS server using MU repositories
sh "echo \"export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_VAR_MIRROR=${env.mirror_hostname_aws_private}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; export TF_VAR_SERVER_AMI=${env.server_ami}; export TF_VAR_PROXY_AMI=${env.proxy_ami}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform-aws.log --init --taint '.*(domain|main_disk|data_disk|database_disk).*' --runstep provision --custom-repositories ${WORKSPACE}/custom_repositories.json --sumaform-backend aws\""
retry(count: 3) {
sh "set +x; source /home/jenkins/.credentials set -x; source /home/jenkins/.registration set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_VAR_MIRROR=${env.mirror_hostname_aws_private}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; export TF_VAR_SERVER_AMI=${env.server_ami}; export TF_VAR_PROXY_AMI=${env.proxy_ami}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform-aws.log --init --taint '.*(domain|main_disk|data_disk|database_disk).*' --runstep provision --sumaform-backend aws"
sh "set +x; source /home/jenkins/.credentials set -x; source /home/jenkins/.registration set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_VAR_MIRROR=${env.mirror_hostname_aws_private}; export TF_LOG=${params.extra_logs_level}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; export TF_VAR_SERVER_AMI=${env.server_ami}; export TF_VAR_PROXY_AMI=${env.proxy_ami}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform-aws.log --init --taint '.*(domain|main_disk|data_disk|database_disk).*' --runstep provision --sumaform-backend aws"
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TF_LOG environment variable should not be set to 'OFF'. According to Terraform/OpenTofu documentation, TF_LOG should either be unset or set to one of the valid log levels (TRACE, DEBUG, INFO, WARN, ERROR). Setting it to 'OFF' is not a recognized value and may not behave as expected. Consider conditionally exporting TF_LOG only when a valid log level is selected, or use an empty string for the default case.

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using TF_LOG configured from the extra_logs_level build parameter can cause Terraform/OpenTofu to emit highly verbose logs, including provider configuration and secrets, into the Terraform log files and Jenkins console output. Anyone with permission to trigger this job and read its logs, but without direct access to the underlying credentials (such as those loaded from /home/jenkins/.credentials), can exfiltrate cloud keys or tokens by selecting DEBUG or TRACE. To avoid leaking secrets, gate high log levels behind an admin-only mechanism, restrict extra_logs_level to safe values in shared jobs (e.g., OFF/ERROR), or ensure that logs produced at debug levels are stored and accessed only within the same security boundary as the credentials themselves.

Copilot uses AI. Check for mistakes.
deployed_aws = true
}
}
Expand Down
6 changes: 3 additions & 3 deletions jenkins_pipelines/environments/common/pipeline-build-validation-aws.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ def run(params) {
writeFile file: "${local_mirror_dir}/salt/mirror/etc/minima-customize.yaml", text: repositories, encoding: "UTF-8"

// Deploy local mirror
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${local_mirror_params} --logfile ${resultdirbuild}/sumaform-mirror-local.log --init --taint '.*(domain|main_disk).*' --runstep provision --sumaform-backend libvirt"
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_LOG=${params.extra_logs_level}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${local_mirror_params} --logfile ${resultdirbuild}/sumaform-mirror-local.log --init --taint '.*(domain|main_disk).*' --runstep provision --sumaform-backend libvirt"
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using TF_LOG configured from the extra_logs_level build parameter can cause Terraform/OpenTofu to emit highly verbose logs, including provider configuration and secrets, into the Terraform log files and Jenkins console output. Anyone with permission to trigger this job and read its logs, but without direct access to the underlying credentials (such as those loaded from /home/jenkins/.credentials), can exfiltrate cloud keys or tokens by selecting DEBUG or TRACE. To avoid leaking secrets, gate high log levels behind an admin-only mechanism, restrict extra_logs_level to safe values in shared jobs (e.g., OFF/ERROR), or ensure that logs produced at debug levels are stored and accessed only within the same security boundary as the credentials themselves.

Copilot uses AI. Check for mistakes.
deployed_local = true
}
},
Expand All @@ -119,7 +119,7 @@ def run(params) {
env.aws_configuration = aws_configuration + "]\n"
writeFile file: "${aws_mirror_dir}/terraform.tfvars", text: aws_configuration, encoding: "UTF-8"
// Deploy empty AWS mirror
sh "set +x; source /home/jenkins/.credentials set -x; source /home/jenkins/.registration set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${aws_mirror_params} --logfile ${resultdirbuild}/sumaform-mirror-aws.log --init --taint '.*(domain|main_disk).*' --runstep provision --sumaform-backend aws"
sh "set +x; source /home/jenkins/.credentials set -x; source /home/jenkins/.registration set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_LOG=${params.extra_logs_level}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${aws_mirror_params} --logfile ${resultdirbuild}/sumaform-mirror-aws.log --init --taint '.*(domain|main_disk).*' --runstep provision --sumaform-backend aws"
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using TF_LOG configured from the extra_logs_level build parameter can cause Terraform/OpenTofu to emit highly verbose logs, including provider configuration and secrets, into the Terraform log files and Jenkins console output. Anyone with permission to trigger this job and read its logs, but without direct access to the underlying credentials (such as those loaded from /home/jenkins/.credentials), can exfiltrate cloud keys or tokens by selecting DEBUG or TRACE. To avoid leaking secrets, gate high log levels behind an admin-only mechanism, restrict extra_logs_level to safe values in shared jobs (e.g., OFF/ERROR), or ensure that logs produced at debug levels are stored and accessed only within the same security boundary as the credentials themselves.

Copilot uses AI. Check for mistakes.
}
}
)
Expand Down Expand Up @@ -170,7 +170,7 @@ def run(params) {

// Deploying AWS server using MU repositories
sh "echo \"export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_VAR_MIRROR=${env.mirror_hostname_aws_private}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; export TF_VAR_SERVER_AMI=${server_ami}; export TF_VAR_PROXY_AMI=${proxy_ami}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform-aws.log --init --taint '.*(domain|main_disk).*' --runstep provision --custom-repositories ${WORKSPACE}/custom_repositories.json --sumaform-backend aws\""
sh "set +x; source /home/jenkins/.credentials set -x; source /home/jenkins/.registration set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_VAR_ARCHITECTURE=${params.architecture}; export TF_VAR_MIRROR=${env.mirror_hostname_aws_private}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; export TF_VAR_SERVER_AMI=${server_ami}; export TF_VAR_PROXY_AMI=${proxy_ami}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform-aws.log --init --taint '.*(domain|main_disk).*' --custom-repositories ${WORKSPACE}/custom_repositories.json --use-tf-resource-cleaner --tf-resources-to-keep ${params.minions_to_run.split(', ').join(' ')} --runstep provision --sumaform-backend aws"
sh "set +x; source /home/jenkins/.credentials set -x; source /home/jenkins/.registration set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_VAR_ARCHITECTURE=${params.architecture}; export TF_VAR_MIRROR=${env.mirror_hostname_aws_private}; export TF_LOG=${params.extra_logs_level}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; export TF_VAR_SERVER_AMI=${server_ami}; export TF_VAR_PROXY_AMI=${proxy_ami}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform-aws.log --init --taint '.*(domain|main_disk).*' --custom-repositories ${WORKSPACE}/custom_repositories.json --use-tf-resource-cleaner --tf-resources-to-keep ${params.minions_to_run.split(', ').join(' ')} --runstep provision --sumaform-backend aws"
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TF_LOG environment variable should not be set to 'OFF'. According to Terraform/OpenTofu documentation, TF_LOG should either be unset or set to one of the valid log levels (TRACE, DEBUG, INFO, WARN, ERROR). Setting it to 'OFF' is not a recognized value and may not behave as expected. Consider conditionally exporting TF_LOG only when a valid log level is selected, or use an empty string for the default case.

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using TF_LOG configured from the extra_logs_level build parameter can cause Terraform/OpenTofu to emit highly verbose logs, including provider configuration and secrets, into the Terraform log files and Jenkins console output. Anyone with permission to trigger this job and read its logs, but without direct access to the underlying credentials (such as those loaded from /home/jenkins/.credentials), can exfiltrate cloud keys or tokens by selecting DEBUG or TRACE. To avoid leaking secrets, gate high log levels behind an admin-only mechanism, restrict extra_logs_level to safe values in shared jobs (e.g., OFF/ERROR), or ensure that logs produced at debug levels are stored and accessed only within the same security boundary as the credentials themselves.

Copilot uses AI. Check for mistakes.
deployed = true

}
Expand Down
1 change: 1 addition & 0 deletions jenkins_pipelines/environments/common/pipeline-build-validation-cleanup.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ def run(params) {
source /home/jenkins/.credentials
export TF_VAR_SERVER_CONTAINER_REPOSITORY='unused'
export TF_VAR_PROXY_CONTAINER_REPOSITORY=${proxy_container_repository}
export TF_LOG=${params.extra_logs_level}
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TF_LOG environment variable should not be set to 'OFF'. According to Terraform/OpenTofu documentation, TF_LOG should either be unset or set to one of the valid log levels (TRACE, DEBUG, INFO, WARN, ERROR). Setting it to 'OFF' is not a recognized value and may not behave as expected. Consider conditionally exporting TF_LOG only when a valid log level is selected, or use an empty string for the default case.

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using TF_LOG configured from the extra_logs_level build parameter can cause Terraform/OpenTofu to emit highly verbose logs, including provider configuration and secrets, into the Terraform log files and Jenkins console output. Anyone with permission to trigger this job and read its logs, but without direct access to the underlying credentials (such as those loaded from /home/jenkins/.credentials), can exfiltrate cloud keys or tokens by selecting DEBUG or TRACE. To avoid leaking secrets, gate high log levels behind an admin-only mechanism, restrict extra_logs_level to safe values in shared jobs (e.g., OFF/ERROR), or ensure that logs produced at debug levels are stored and accessed only within the same security boundary as the credentials themselves.

Copilot uses AI. Check for mistakes.
export TERRAFORM=${params.bin_path}
export TERRAFORM_PLUGINS=${params.bin_plugins_path}
"""
Expand Down
1 change: 1 addition & 0 deletions jenkins_pipelines/environments/common/pipeline-build-validation.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,7 @@ def run(params) {
export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}
export TF_VAR_PRODUCT_VERSION=${product_version}
export TF_VAR_BASE_OS=${base_os}
export TF_LOG=${params.extra_logs_level}
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TF_LOG environment variable should not be set to 'OFF'. According to Terraform/OpenTofu documentation, TF_LOG should either be unset or set to one of the valid log levels (TRACE, DEBUG, INFO, WARN, ERROR). Setting it to 'OFF' is not a recognized value and may not behave as expected. Consider conditionally exporting TF_LOG only when a valid log level is selected, or use an empty string for the default case.

Suggested change
export TF_LOG=${params.extra_logs_level}
if [ -n "${params.extra_logs_level}" ] && [ "${params.extra_logs_level}" != "OFF" ]; then
export TF_LOG=${params.extra_logs_level}
else
unset TF_LOG
fi

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using TF_LOG configured from the extra_logs_level build parameter can cause Terraform/OpenTofu to emit highly verbose logs, including provider configuration and secrets, into the Terraform log files and Jenkins console output. Anyone with permission to trigger this job and read its logs, but without direct access to the underlying credentials (such as those loaded from /home/jenkins/.credentials), can exfiltrate cloud keys or tokens by selecting DEBUG or TRACE. To avoid leaking secrets, gate high log levels behind an admin-only mechanism, restrict extra_logs_level to safe values in shared jobs (e.g., OFF/ERROR), or ensure that logs produced at debug levels are stored and accessed only within the same security boundary as the credentials themselves.

Copilot uses AI. Check for mistakes.
export TERRAFORM=${params.bin_path}
export TERRAFORM_PLUGINS=${params.bin_plugins_path}

Expand Down
4 changes: 2 additions & 2 deletions jenkins_pipelines/environments/common/pipeline-pull-request.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -272,9 +272,9 @@ def run(params) {
} else {
env.TERRAFORM_INIT = ''
}
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${cucumber_ref}; export TERRAFORM=${bin_path}; export TERRAFORM_PLUGINS=${bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} --taint '.*(domain|combustion_disk|cloudinit_disk|ignition_disk|main_disk|data_disk|database_disk|standalone_provisioning).*' --runstep provision"
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${cucumber_gitrepo}; export TF_LOG=${params.extra_logs_level}; export TF_VAR_CUCUMBER_BRANCH=${cucumber_ref}; export TERRAFORM=${bin_path}; export TERRAFORM_PLUGINS=${bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} --taint '.*(domain|combustion_disk|cloudinit_disk|ignition_disk|main_disk|data_disk|database_disk|standalone_provisioning).*' --runstep provision"
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TF_LOG environment variable should not be set to 'OFF'. According to Terraform/OpenTofu documentation, TF_LOG should either be unset or set to one of the valid log levels (TRACE, DEBUG, INFO, WARN, ERROR). Setting it to 'OFF' is not a recognized value and may not behave as expected. Consider conditionally exporting TF_LOG only when a valid log level is selected, or use an empty string for the default case.

Suggested change
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${cucumber_gitrepo}; export TF_LOG=${params.extra_logs_level}; export TF_VAR_CUCUMBER_BRANCH=${cucumber_ref}; export TERRAFORM=${bin_path}; export TERRAFORM_PLUGINS=${bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} --taint '.*(domain|combustion_disk|cloudinit_disk|ignition_disk|main_disk|data_disk|database_disk|standalone_provisioning).*' --runstep provision"
def allowedTfLogLevels = ['TRACE', 'DEBUG', 'INFO', 'WARN', 'ERROR']
def tfLogExport = ''
if (params.extra_logs_level && allowedTfLogLevels.contains(params.extra_logs_level)) {
tfLogExport = "export TF_LOG=${params.extra_logs_level}; "
}
sh """set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${cucumber_gitrepo}; ${tfLogExport}export TF_VAR_CUCUMBER_BRANCH=${cucumber_ref}; export TERRAFORM=${bin_path}; export TERRAFORM_PLUGINS=${bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} --taint '.*(domain|combustion_disk|cloudinit_disk|ignition_disk|main_disk|data_disk|database_disk|standalone_provisioning).*' --runstep provision"""

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using TF_LOG configured from the extra_logs_level build parameter can cause Terraform/OpenTofu to emit highly verbose logs, including provider configuration and secrets, into the sumaform log file and Jenkins console output. Anyone with permission to trigger this job and read its logs, but without direct access to the underlying credentials (such as those loaded from /home/jenkins/.credentials), can exfiltrate cloud keys or tokens by selecting DEBUG or TRACE. To avoid leaking secrets, gate high log levels behind an admin-only mechanism, restrict extra_logs_level to safe values in shared jobs (e.g., OFF/ERROR), or ensure that logs produced at debug levels are stored and accessed only within the same security boundary as the credentials themselves.

Suggested change
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${cucumber_gitrepo}; export TF_LOG=${params.extra_logs_level}; export TF_VAR_CUCUMBER_BRANCH=${cucumber_ref}; export TERRAFORM=${bin_path}; export TERRAFORM_PLUGINS=${bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} --taint '.*(domain|combustion_disk|cloudinit_disk|ignition_disk|main_disk|data_disk|database_disk|standalone_provisioning).*' --runstep provision"
def safeExtraLogsLevel = (params.extra_logs_level in ['OFF', 'ERROR'] ? params.extra_logs_level : 'ERROR')
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${cucumber_gitrepo}; export TF_LOG=${safeExtraLogsLevel}; export TF_VAR_CUCUMBER_BRANCH=${cucumber_ref}; export TERRAFORM=${bin_path}; export TERRAFORM_PLUGINS=${bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} --taint '.*(domain|combustion_disk|cloudinit_disk|ignition_disk|main_disk|data_disk|database_disk|standalone_provisioning).*' --runstep provision"

Copilot uses AI. Check for mistakes.
deployed = true

// Collect and tag Flaky tests from the GitHub Board
def statusCode = sh script:"./terracumber-cli ${common_params} --logfile ${resultdirbuild}/testsuite.log --runstep cucumber --cucumber-cmd 'cd /root/spacewalk/testsuite; export BUILD_NUMBER=${BUILD_NUMBER}; rake utils:collect_and_tag_flaky_tests'", returnStatus:true
sh "exit 0"
Expand Down
2 changes: 1 addition & 1 deletion jenkins_pipelines/environments/common/pipeline-reference-new.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ def run(params) {
break;
}
}
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_LOG=${params.extra_logs_level}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TF_LOG environment variable should not be set to 'OFF'. According to Terraform/OpenTofu documentation, TF_LOG should either be unset or set to one of the valid log levels (TRACE, DEBUG, INFO, WARN, ERROR). Setting it to 'OFF' is not a recognized value and may not behave as expected. Consider conditionally exporting TF_LOG only when a valid log level is selected, or use an empty string for the default case.

Suggested change
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_LOG=${params.extra_logs_level}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"
def tfLogExport = ""
if (params.extra_logs_level && !params.extra_logs_level.equalsIgnoreCase('OFF')) {
tfLogExport = "export TF_LOG=${params.extra_logs_level}; "
}
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; ${tfLogExport}export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using TF_LOG configured from the extra_logs_level build parameter can cause Terraform/OpenTofu to emit highly verbose logs, including provider configuration and secrets, into the sumaform log file and Jenkins console output. Anyone with permission to trigger this job and read its logs, but without direct access to the underlying credentials (such as those loaded from /home/jenkins/.credentials), can exfiltrate cloud keys or tokens by selecting DEBUG or TRACE. To avoid leaking secrets, gate high log levels behind an admin-only mechanism, restrict extra_logs_level to safe values in shared jobs (e.g., OFF/ERROR), or ensure that logs produced at debug levels are stored and accessed only within the same security boundary as the credentials themselves.

Suggested change
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_LOG=${params.extra_logs_level}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"
// Sanitize TF_LOG to avoid enabling highly verbose levels (e.g. DEBUG/TRACE) in shared jobs
def allowedTfLogLevels = ['', 'ERROR', 'WARN', 'INFO']
def requestedTfLogLevel = (params.extra_logs_level ?: '').toUpperCase()
if (!allowedTfLogLevels.contains(requestedTfLogLevel)) {
requestedTfLogLevel = 'ERROR'
}
env.TF_LOG = requestedTfLogLevel
sh "set +x; source /home/jenkins/.credentials set -x; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_LOG=${env.TF_LOG}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"

Copilot uses AI. Check for mistakes.
deployed = true
}
stage('Core - Setup') {
Expand Down
2 changes: 1 addition & 1 deletion jenkins_pipelines/environments/common/pipeline-reference.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ def run(params) {
break;
}
}
sh "set +x; source /home/jenkins/.credentials set -x; TERRAFORM=${params.bin_path} TERRAFORM_PLUGINS=${params.bin_plugins_path} ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"
sh "set +x; source /home/jenkins/.credentials set -x; export TF_LOG=${params.extra_logs_level}; TERRAFORM=${params.bin_path} TERRAFORM_PLUGINS=${params.bin_plugins_path} ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TF_LOG environment variable should not be set to 'OFF'. According to Terraform/OpenTofu documentation, TF_LOG should either be unset or set to one of the valid log levels (TRACE, DEBUG, INFO, WARN, ERROR). Setting it to 'OFF' is not a recognized value and may not behave as expected. Consider conditionally exporting TF_LOG only when a valid log level is selected, or use an empty string for the default case.

Suggested change
sh "set +x; source /home/jenkins/.credentials set -x; export TF_LOG=${params.extra_logs_level}; TERRAFORM=${params.bin_path} TERRAFORM_PLUGINS=${params.bin_plugins_path} ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"
sh """set +x; source /home/jenkins/.credentials set -x; if [ "${params.extra_logs_level}" != "OFF" ] && [ -n "${params.extra_logs_level}" ]; then export TF_LOG=${params.extra_logs_level}; else unset TF_LOG; fi; TERRAFORM=${params.bin_path} TERRAFORM_PLUGINS=${params.bin_plugins_path} ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"""

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using TF_LOG configured from the extra_logs_level build parameter can cause Terraform/OpenTofu to emit highly verbose logs, including provider configuration and secrets, into the sumaform log file and Jenkins console output. Anyone with permission to trigger this job and read its logs, but without direct access to the underlying credentials (such as those loaded from /home/jenkins/.credentials), can exfiltrate cloud keys or tokens by selecting DEBUG or TRACE. To avoid leaking secrets, gate high log levels behind an admin-only mechanism, restrict extra_logs_level to safe values in shared jobs (e.g., OFF/ERROR), or ensure that logs produced at debug levels are stored and accessed only within the same security boundary as the credentials themselves.

Suggested change
sh "set +x; source /home/jenkins/.credentials set -x; export TF_LOG=${params.extra_logs_level}; TERRAFORM=${params.bin_path} TERRAFORM_PLUGINS=${params.bin_plugins_path} ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"
// Sanitize Terraform log level to avoid leaking secrets via overly verbose logs
def allowedTfLogLevels = ['', 'OFF', 'ERROR', 'WARN', 'INFO']
def requestedTfLogLevel = (params.extra_logs_level ?: '').toString().toUpperCase()
if (!allowedTfLogLevels.contains(requestedTfLogLevel)) {
// Fallback to a safe default if an unsafe or unknown level is requested
requestedTfLogLevel = 'ERROR'
}
def tfLogExportCmd = ''
if (requestedTfLogLevel && requestedTfLogLevel != 'OFF') {
tfLogExportCmd = "export TF_LOG=${requestedTfLogLevel}; "
}
sh "set +x; source /home/jenkins/.credentials set -x; ${tfLogExportCmd}TERRAFORM=${params.bin_path} TERRAFORM_PLUGINS=${params.bin_plugins_path} ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"

Copilot uses AI. Check for mistakes.
deployed = true
}
}
Expand Down
2 changes: 1 addition & 1 deletion jenkins_pipelines/environments/common/pipeline-salt-shaker.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ def run(params) {
}
}
retry(count: 3) {
sh "set +x; source /home/jenkins/.credentials set -x; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"
sh "set +x; source /home/jenkins/.credentials set -x; export TF_LOG=${params.extra_logs_level}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TF_LOG environment variable should not be set to 'OFF'. According to Terraform/OpenTofu documentation, TF_LOG should either be unset or set to one of the valid log levels (TRACE, DEBUG, INFO, WARN, ERROR). Setting it to 'OFF' is not a recognized value and may not behave as expected. Consider conditionally exporting TF_LOG only when a valid log level is selected, or use an empty string for the default case.

Suggested change
sh "set +x; source /home/jenkins/.credentials set -x; export TF_LOG=${params.extra_logs_level}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"
sh """set +x; source /home/jenkins/.credentials; set -x;
TF_LOG_VALUE=${params.extra_logs_level}
if [ -n "$TF_LOG_VALUE" ] && [ "$TF_LOG_VALUE" != "OFF" ]; then
export TF_LOG="$TF_LOG_VALUE"
else
unset TF_LOG
fi
export TERRAFORM=${params.bin_path}
export TERRAFORM_PLUGINS=${params.bin_plugins_path}
./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision"""

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using TF_LOG configured from the extra_logs_level build parameter can cause Terraform/OpenTofu to emit highly verbose logs, including provider configuration and secrets, into the sumaform log file and Jenkins console output. Anyone with permission to trigger this job and read its logs, but without direct access to the underlying credentials (such as those loaded from /home/jenkins/.credentials), can exfiltrate cloud keys or tokens by selecting DEBUG or TRACE. To avoid leaking secrets, gate high log levels behind an admin-only mechanism, restrict extra_logs_level to safe values in shared jobs (e.g., OFF/ERROR), or ensure that logs produced at debug levels are stored and accessed only within the same security boundary as the credentials themselves.

Copilot uses AI. Check for mistakes.
deployed = true
if (params.wait_after_deploy) {
echo "Waiting ${params.wait_after_deploy} seconds after sumaform deployment (usually to allow transactional system to reboot)"
Expand Down
2 changes: 1 addition & 1 deletion jenkins_pipelines/environments/common/pipeline.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ def run(params) {
break;
}
}
sh "set +x; source /home/jenkins/.credentials set -x; set -o pipefail; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision | sed -E 's/([^.]+)module\\.([^.]+)\\.module\\.([^.]+)(\\.module\\.[^.]+)?(\\[[0-9]+\\])?(\\.module\\.[^.]+)?(\\.[^.]+)?(.*)/\\1\\2.\\3\\8/'"
sh "set +x; source /home/jenkins/.credentials set -x; set -o pipefail; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_LOG=${params.extra_logs_level}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision | sed -E 's/([^.]+)module\\.([^.]+)\\.module\\.([^.]+)(\\.module\\.[^.]+)?(\\[[0-9]+\\])?(\\.module\\.[^.]+)?(\\.[^.]+)?(.*)/\\1\\2.\\3\\8/'"
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TF_LOG environment variable should not be set to 'OFF'. According to Terraform/OpenTofu documentation, TF_LOG should either be unset or set to one of the valid log levels (TRACE, DEBUG, INFO, WARN, ERROR). Setting it to 'OFF' is not a recognized value and may not behave as expected. Consider conditionally exporting TF_LOG only when a valid log level is selected, or use an empty string for the default case.

Suggested change
sh "set +x; source /home/jenkins/.credentials set -x; set -o pipefail; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; export TF_LOG=${params.extra_logs_level}; export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision | sed -E 's/([^.]+)module\\.([^.]+)\\.module\\.([^.]+)(\\.module\\.[^.]+)?(\\[[0-9]+\\])?(\\.module\\.[^.]+)?(\\.[^.]+)?(.*)/\\1\\2.\\3\\8/'"
def tfLogLevel = params.extra_logs_level
def tfLogExport = ''
if (tfLogLevel) {
def tfLogLevelNormalized = tfLogLevel.toString().toUpperCase()
if (['TRACE', 'DEBUG', 'INFO', 'WARN', 'ERROR'].contains(tfLogLevelNormalized)) {
tfLogExport = "export TF_LOG=${tfLogLevelNormalized}; "
}
}
sh "set +x; source /home/jenkins/.credentials set -x; set -o pipefail; export TF_VAR_CUCUMBER_GITREPO=${params.cucumber_gitrepo}; export TF_VAR_CUCUMBER_BRANCH=${params.cucumber_ref}; ${tfLogExport}export TERRAFORM=${params.bin_path}; export TERRAFORM_PLUGINS=${params.bin_plugins_path}; ./terracumber-cli ${common_params} --logfile ${resultdirbuild}/sumaform.log ${env.TERRAFORM_INIT} ${env.TERRAFORM_TAINT} --sumaform-backend ${params.sumaform_backend} --runstep provision | sed -E 's/([^.]+)module\\.([^.]+)\\.module\\.([^.]+)(\\.module\\.[^.]+)?(\\[[0-9]+\\])?(\\.module\\.[^.]+)?(\\.[^.]+)?(.*)/\\1\\2.\\3\\8/'"

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using TF_LOG configured from the extra_logs_level build parameter can cause Terraform/OpenTofu to emit highly verbose logs, including provider configuration and secrets, into the sumaform log file and Jenkins console output. Anyone with permission to trigger this job and read its logs, but without direct access to the underlying credentials (such as those loaded from /home/jenkins/.credentials), can exfiltrate cloud keys or tokens by selecting DEBUG or TRACE. To avoid leaking secrets, gate high log levels behind an admin-only mechanism, restrict extra_logs_level to safe values in shared jobs (e.g., OFF/ERROR), or ensure that logs produced at debug levels are stored and accessed only within the same security boundary as the credentials themselves.

Copilot uses AI. Check for mistakes.
deployed = true
// Collect and tag Flaky tests from the GitHub Board
def statusCode = sh script:"./terracumber-cli ${common_params} --logfile ${resultdirbuild}/testsuite.log --runstep cucumber --cucumber-cmd 'cd /root/spacewalk/testsuite; ${env.exports} rake utils:collect_and_tag_flaky_tests'", returnStatus:true
Expand Down
1 change: 1 addition & 0 deletions jenkins_pipelines/environments/manager-4.3-dev-acceptance-tests-AWS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ node('sumaform-cucumber-slc1') {
string(name: 'deploy_parallelism', defaultValue: '', description: 'Advanced: Define the number of parallel resource operations for the executable binary/OpenTofu'),
string(name: 'terracumber_gitrepo', defaultValue: 'https://github.com/uyuni-project/terracumber.git', description: 'Terracumber Git Repository'),
string(name: 'terracumber_ref', defaultValue: 'master', description: 'Terracumber Git ref (branch, tag...)'),
choice(name: 'extra_logs_level', choices: ['OFF', 'INFO', 'DEBUG', 'TRACE', 'WARN', 'ERROR'], description: 'Terraform/OpenTofu additional logs level'),
choice(name: 'rake_namespace', choices: ['cucumber', 'parallel'], description: 'Choose [parallel] (Clients and some features will run in parallel) or [cucumber] (all sequential)'),
booleanParam(name: 'use_previous_terraform_state', defaultValue: false, description: 'Use previous Terraform state'),
booleanParam(name: 'prepare_aws_env', defaultValue: true, description: 'Create local and AWS mirror and upload data to AWS mirror'),
Expand Down
1 change: 1 addition & 0 deletions jenkins_pipelines/environments/manager-4.3-dev-acceptance-tests-NUE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ node('sumaform-cucumber') {
string(name: 'deploy_parallelism', defaultValue: '', description: 'Advanced: Define the number of parallel resource operations for the executable binary'),
string(name: 'terracumber_gitrepo', defaultValue: 'https://github.com/uyuni-project/terracumber.git', description: 'Terracumber Git Repository'),
string(name: 'terracumber_ref', defaultValue: 'master', description: 'Terracumber Git ref (branch, tag...)'),
choice(name: 'extra_logs_level', choices: ['OFF', 'INFO', 'DEBUG', 'TRACE', 'WARN', 'ERROR'], description: 'Terraform/OpenTofu additional logs level'),
booleanParam(name: 'terraform_init', defaultValue: true, description: 'Call terraform init (needed if modules are added or changes)'),
booleanParam(name: 'terraform_taint', defaultValue: true, description: 'Call terraform taint (so the resources, except volumes, are recreated)'),
booleanParam(name: 'use_previous_terraform_state', defaultValue: true, description: 'Use previous Terraform state'),
Expand Down
Loading