Ansible 'no_log' 用于调试输出中的特定值，而不是整个模块 [英] Ansible 'no_log' for specific values in debug output, not entire module

问题描述

我正在为 Ansible 自动化 (EX407) 的 RedHat 认证专家学习，我正在尝试使用 no_log 模块参数.我有一个这样结构的示例剧本；

I am studying for the RedHat Certified Specialist in Ansible Automation (EX407) and I'm playing around with the no_log module parameter. I have a sample playbook structured as so;

---
- hosts: webservers
  tasks:
  - name: Query vCenter
    vmware_guest:
      hostname: "{{ vcenter['host'] }}"
      username: "{{ vcenter['username'] }}"
      password: "{{ vcenter['password'] }}"
      name: "{{ inventory_hostname }}"
      validate_certs: no
    delegate_to: localhost
    no_log: yes
...

当 no_log 被禁用时，我会得到很多关于我的 VM 的有用的调试信息，但是当 no_log 被禁用时，我显然无法保护我的剧本存储数据(在这种情况下，是 vcenter['username'] 和 vcenter['password'] 值).启用 no_log 会削弱我的剧本调试输出；

When no_log is disabled, I get a lot of helpful debug information about my VM, but when no_log is disabled I obviously can't protect my playbooks vaulted data (in this case that is the vcenter['username'] and vcenter['password'] values). Enabling no_log cripples my playbooks debug output to just;

"censored": "the output has been hidden due to the fact that 'no_log: true' was specified for this result",

我想知道如何仅审查部分调试输出.我知道这是可能的，因为 vcenter['password'] 在它的输出中受到保护，而不管我的 no_log 状态如何.当 no_log 被禁用时，我在详细输出中看到了这一点；

I would like to know how it is possible to censor only some of the debug output. I know this is possible because vcenter['password'] is protected in it's output regardless of my no_log state. I see this in the verbose output when no_log is disabled;

"invocation": {
        "module_args": {
            "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "username": "[e-mail]"
        }
}

你有什么想法?

推荐答案

所以我深入研究了 VMWare 模块源代码和 这是我发现的.

So I went digging through the VMWare module source code and this is what I found.

password=dict(type='str',
              aliases=['pass', 'pwd'],
              required=False,
              no_log=True,
              fallback=(env_fallback, ['VMWARE_PASSWORD'])),

看起来 Playbooks 并未公开此功能.VMWare 模块本身在 Python 中的特定属性上启用 no_log.就我而言，这只是 Playbooks 隐藏的另一个功能.我真的希望抑制特定属性是标准的，而不是整个模块，但这就是 Ansible 2.10 的位置.

Looks like Playbooks just aren't exposing this feature. The VMWare modules themselves are enabling no_log on specific attributes in Python. For my part, this is just another functionality Playbooks are hiding. I really wish it was standard to suppress specific attributes, rather than a whole module, but this is where it stands as of Ansible 2.10.

这篇关于Ansible 'no_log' 用于调试输出中的特定值，而不是整个模块的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！