Passwords not masked in playbook output

[minatoyama]

In my ansible configuration we either use Ansible Vault or a gpg plugin to encrypt passwords. However these passwords are fully printed in clear text in some of the configuration steps, even if they are skipped. Some examples:

• icinga.icinga.icinga2 : enable features
• icinga.icinga.icingaweb2 : Check each icingaweb2_modules key against known modules
• icinga.icinga.icingaweb2 : Configure modules
• icinga.icinga.icingaweb2 : Manage enabled module daemons

Example of output in skipped task:

 TASK [icinga.icinga.icingaweb2 : Manage enabled module daemons] **********************************************************************************************************************************
skipping: [icingaweb2] => (item={'key': 'icingadb', 'value': {'enabled': True, 'source': 'package', 'commandtransports': {'icingadb-web': {'transport': 'api', 'host': 'icingaweb2', 'username': 'api-user', 'password': 'api password in clear text'}}, 'config': {'icingadb': {'resource': 'icingadb-database'}, 'redis': {'tls': 0}}, 'redis': {'redis1': {'host': 'master1', 'password': 'redis password in clear text'}, 'redis2': {'host': 'master2', 'password': 'redis password in clear text'}}}})

[mkayontour]

Hi, thanks for the issue. This can be solved using loop control.

   - shell: echo 'doesnt matter'
     with_dict: "{{ useless }}"
     loop_control:
       label: "{{ item.key }}"

[Donien]

Hi, thanks for the issue. This can be solved using loop control.

   - shell: echo 'doesnt matter'
     with_dict: "{{ useless }}"
     loop_control:
       label: "{{ item.key }}"

As soon as you run with verbosity, the full variable is shown again.

I believe only no_log: true is secure here.

[Donien]

Hi @minatoyama

I have added labels to a few loops to restrict what is being printed on screen.
This however does not fully solve the issue.

If you run Ansible with any level of verbosity, you can still see the full loop item that is being processed.

Sadly, I don't see any real fix for this as of now.
Verbosity is nice for troubleshooting / development / simply knowing what is going on.

We have so many places where secrets could be, e.g. database connections, user credentials, or even simply in a Icinga2 host object (snmp credentials come to mind).

Using no_log: true on all of these makes troubleshooting way harder than what it's worth.

If you still need every possible secret to be hidden, I suggest using no_log: true on the play or role level.

- name: Play
  # Either here
  no_log: true
  hosts: all
  
  roles:
    - role: icinga2
      # or here
      no_log: true