Use $log.log_hashes to filter out sensitive data.

[lfu]

Use $log.log_hashes to filter out sensitive data.

Depends on #manageiq-gems-pending/pull/135.

https://bugzilla.redhat.com/show_bug.cgi?id=1458381

@miq-bot assign @gmcculloug
@miq-bot add_label fine/yes

[miq-bot]

Checked commit lfu@e9f0154 with ruby 2.2.6, rubocop 0.47.1, and haml-lint 0.20.0
1 file checked, 0 offenses detected
Everything looks good. 👍

[bzwei]

Feel strange we have to mix the use of _log and $log. Can we make _log to support #log_hashes?

[lfu]

That is how it is being used:

manageiq/app/models/miq_worker/runner.rb

Line 296 in 16c4345

$log.log_hashes(@worker_settings)

[bdunne]

@lfu You can probably add the following method to the log proxy to achieve _log.log_hashes

  def log_hashes(h, options = {})
    VMDBLogger.log_hashes(self, h, options)
  end

[lfu]

@bdunne @bzwei
_log would print out the calling method name as the log prefix while $log does not.
Do we really want to print the log prefix for each line of the hash?

[bzwei]

I am ok with the log prefix

[bdunne]

Honestly I don't know why we want any log header (with or without the prefix).

[gmcculloug]

The prefix used when logging is called for within log_hashes would be "log_hashes" and not our method, correct? That would not be useful.

[lfu]

The messages with $log:

[----] I, [2017-04-26T17:51:43.127878 #24613:3fc68885e204]  INFO -- : MIQ(ServiceAnsiblePlaybook#preprocess) Override with new options:
[----] I, [2017-04-26T17:51:43.128251 #24613:3fc68885e204]  INFO -- :   :password: [FILTERED]
[----] I, [2017-04-26T17:51:43.128286 #24613:3fc68885e204]  INFO -- :   :name: test
[----] I, [2017-04-26T17:51:43.128332 #24613:3fc68885e204]  INFO -- :   :location: mahwah
[----] I, [2017-04-26T17:51:43.128351 #24613:3fc68885e204]  INFO -- :   :phone: [FILTERED]
[----] I, [2017-04-26T17:51:43.128370 #24613:3fc68885e204]  INFO -- :   :my_password_2:

When with _log:

[----] I, [2017-04-26T17:53:50.717718 #24613:3fc68885e204]  INFO -- : MIQ(ServiceAnsiblePlaybook#preprocess) Override with new options:
[----] I, [2017-04-26T17:53:50.718242 #24613:3fc68885e204]  INFO -- : MIQ(ServiceAnsiblePlaybook#log_hashes)   :password: [FILTERED]
[----] I, [2017-04-26T17:53:50.718285 #24613:3fc68885e204]  INFO -- : MIQ(ServiceAnsiblePlaybook#log_hashes)   :name: test
[----] I, [2017-04-26T17:53:50.718313 #24613:3fc68885e204]  INFO -- : MIQ(ServiceAnsiblePlaybook#log_hashes)   :location: mahwah
[----] I, [2017-04-26T17:53:50.718343 #24613:3fc68885e204]  INFO -- : MIQ(ServiceAnsiblePlaybook#log_hashes)   :phone: [FILTERED]
[----] I, [2017-04-26T17:53:50.718369 #24613:3fc68885e204]  INFO -- : MIQ(ServiceAnsiblePlaybook#log_hashes)   :my_password_2:
[----] I, [2017-04-26T17:53:50.718397 #24613:3fc68885e204]  INFO -- : MIQ(ServiceAnsiblePlaybook#log_hashes)   :host: localhost

[gmcculloug]

I would agree that it makes sense as is. No need to include the header from within log_hashes.

@bzwei You good with the current changes?

[bzwei]

I agree a header with log_hashes is not helpful. So let's stick with the mixture of both types of logger for now.

[simaishi]

@lfu Is there a BZ for this? Can you please create if it doesn't exist?

[lfu]

@simaishi BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1458381

[simaishi]

Fine backport details:

$ git log -1
commit d795d2047afee4d73e4733a6569a1b3f49d95e55
Author: Greg McCullough <gmccullo@redhat.com>
Date:   Thu Apr 27 14:26:44 2017 -0400

    Merge pull request #14878 from lfu/ansible_log_hashes
    
    Use $log.log_hashes to filter out sensitive data.
    (cherry picked from commit 6973bdac2e159bbe836e86d851bdd430ca7a2979)
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1458434