Bypass Ansible filtering on data returned by the module.

Due to Ansible filtering out values in the output that might be match
values in sensible attributes that have `no_log` set, if a module need
to return data to the controller, it cannot rely on
`ansible_module.exit_json` if there is a chance that a partial match
may occur.

See: https://github.com/ansible/ansible/issues/71789

The change provided here uses the same implementation that is used on
Ansible's `AnsibleModule.exit_json`, without the data filtering layer,
so every attribute with be printed and, therefore, logged by Ansible.

This is needed for the Vault module, as we need to return values that
are explicit requested by the user and that might, at least partially,
match the values in attributes with `no_log` set.

Tests that reproduced the issue, and show it was fixed were provided
for all Vault types.
This commit is contained in:
Rafael Guterres Jeffman
2020-09-17 18:08:14 -03:00
parent c62f003ebf
commit 88f84cefee
5 changed files with 78 additions and 2 deletions

View File

@@ -27,6 +27,24 @@
register: result
failed_when: result.changed
- name: Archive data to symmetric vault, matching `no_log` field.
ipavault:
ipaadmin_password: SomeADMINpassword
name: symvault
vault_data: SomeADMINpassword
password: SomeVAULTpassword
register: result
failed_when: not result.changed
- name: Retrieve data from symmetric vault.
ipavault:
ipaadmin_password: SomeADMINpassword
name: symvault
password: SomeVAULTpassword
state: retrieved
register: result
failed_when: result.vault.data != 'SomeADMINpassword' or result.changed
- name: Archive data to symmetric vault
ipavault:
ipaadmin_password: SomeADMINpassword