[WARNING]: Module did not set no_log for pass_credentials

[erikgb]

SUMMARY

It seems like Ansible emits this warning based on the name pass_credentials within the kubernetes.core.helm_repository module. We don't use credentials, and would prefer not to add no_log to our tasks.

ISSUE TYPE

• Bug Report

COMPONENT NAME

kubernetes.core.helm_repository

ANSIBLE VERSION

ansible [core 2.12.3]
  config file = None
  configured module search path = ['/home/ansible/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.9/site-packages/ansible
  ansible collection location = /home/ansible/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/local/bin/ansible
  python version = 3.9.11 (main, Mar 18 2022, 16:45:24) [GCC 10.2.1 20210110]
  jinja version = 3.0.3
  libyaml = True

COLLECTION VERSION

# /usr/local/lib/python3.9/site-packages/ansible_collections
Collection      Version
--------------- -------
kubernetes.core 2.3.0

CONFIGURATION

ANSIBLE_FORCE_COLOR(env: ANSIBLE_FORCE_COLOR) = True
DEFAULT_LOAD_CALLBACK_PLUGINS(env: ANSIBLE_LOAD_CALLBACK_PLUGINS) = True
DEFAULT_STDOUT_CALLBACK(env: ANSIBLE_STDOUT_CALLBACK) = yaml
HOST_KEY_CHECKING(env: ANSIBLE_HOST_KEY_CHECKING) = False
INTERPRETER_PYTHON(env: ANSIBLE_PYTHON_INTERPRETER) = auto

OS / ENVIRONMENT

Debian-flavoured container image from based on official python image.

STEPS TO REPRODUCE

kubernetes.core.helm_repository:
  name: <any name>
  repo_url: <any helm repository url>

EXPECTED RESULTS

Task runs successfully, with no warnings.

ACTUAL RESULTS

[WARNING]: Module did not set no_log for pass_credentials

[Akasurde]

@erikgb Thanks for reporting this issue. The warning presented here is emitted by Ansible Core Engine and not by kubernetes.core collection and also there is no way to disable this warning from the collection side.

So I would recommend you open a RFE against ansible/ansible to disable or provide a module-level parameter setting to disable this.

Thanks.

[gravesm]

@Akasurde We can just add no_log=False to the arg spec for pass_credentials. Since the parameter itself doesn't contain any credentials, this should be fine.

[erikgb]

@Akasurde We can just add no_log=False to the arg spec for pass_credentials. Since the parameter itself doesn't contain any credentials, this should be fine.

@gravesm That sounds like a change that will fix this minor issue. But what about users that want to log the pass_credentials? Is this warning emitted just because of the term "credentials"?

[gravesm]

Yes, the warning is emitted only because the param name has "credentials" in it. Setting no_log=False just removes the warning. It will still be logged. Some quick testing locally shows that no_log does not even seem to apply to boolean parameters. You can set it to true or false and the value is logged the same either way.

[erikgb]

Setting no_log=False just removes the warning. It will still be logged.

That sounds like a bug somewhere in ansible-core? Or is there a rationale behind this strange behavior?

[gravesm]

I can't speak to the rationale behind it, but this case is covered in the documentation at https://docs.ansible.com/ansible/latest/dev_guide/developing_program_flow_modules.html#argument-spec under the no_log parameter.

[nwsparks]

I'm still getting this on 2.3.1, was this released?

[gravesm]

It looks like it did not get backported, likely because the change was classed as a minor change instead of bugfix. I need to do another 2.3.x release soon anyways. I'll get this change in that release, probably by the end of the week.

[nwsparks]

cool. thanks for the fast response.