Motivation
Follow-up to #195: the argument validation task echoes parameter values on validation errors and in verbose mode, so passwords and tokens can leak into CI logs. Setting no_log: true masks them.
Proposal
Convention: every secret parameter (password, token, key) in an argument_specs.yml sets no_log: true.
Affected: redis_password, redis_sentinel_password (redis), gitlab_redis_password, gitlab_gitaly_token, gitlab_secret_token, gitlab_postgresql_db_password (gitlab), authentication_token, cache_secret_key (gitlab_runner), keepalived_auth_pass (keepalived), haproxy_stats_admin_user_password (haproxy).
Note: this only masks Ansible output; it is no substitute for Vault.
Motivation
Follow-up to #195: the argument validation task echoes parameter values on validation errors and in verbose mode, so passwords and tokens can leak into CI logs. Setting
no_log: truemasks them.Proposal
Convention: every secret parameter (password, token, key) in an
argument_specs.ymlsetsno_log: true.Affected:
redis_password,redis_sentinel_password(redis),gitlab_redis_password,gitlab_gitaly_token,gitlab_secret_token,gitlab_postgresql_db_password(gitlab),authentication_token,cache_secret_key(gitlab_runner),keepalived_auth_pass(keepalived),haproxy_stats_admin_user_password(haproxy).Note: this only masks Ansible output; it is no substitute for Vault.