feat: new variable network_secure_logging defaulting to true#868
Open
spetrosi wants to merge 1 commit intolinux-system-roles:mainfrom
Open
feat: new variable network_secure_logging defaulting to true#868spetrosi wants to merge 1 commit intolinux-system-roles:mainfrom
network_secure_logging defaulting to true#868spetrosi wants to merge 1 commit intolinux-system-roles:mainfrom
Conversation
- Replace literal no_log: true with network_secure_logging variable
- Add no_log: "{{ ansible_verbosity < 2 }}" to package_facts and service_facts
- Add network_secure_logging: true to defaults/main.yml
- Document network_secure_logging variable in README.md
This change allows users to control logging of potentially sensitive
information by setting network_secure_logging: false for debugging,
while maintaining secure defaults.
For package_facts and service_facts, the role now uses verbosity-based
logging to hide verbose output unless ansible_verbosity >= 2.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Reviewer's guide (collapsed on small PRs)Reviewer's GuideAdds a new network_secure_logging variable (default true) to control no_log behavior for sensitive tasks, and switches facts-related tasks to verbosity-based logging while documenting the new variable. Flow diagram for no_log behavior with network_secure_logging and verbosityflowchart TD
A[Start_task] --> B[Is_task_sensitive_credentials_or_secrets]
B -->|Yes| C[Set_no_log_to_network_secure_logging]
B -->|No| D[Is_task_facts_module_service_facts_or_package_facts]
D -->|Yes| E[Evaluate_ansible_verbosity_less_than_2]
E -->|True| F[Set_no_log_true_hide_facts_output]
E -->|False| G[Set_no_log_false_show_facts_output]
D -->|No| H[Use_existing_no_log_behavior_or_default]
C --> I[Execute_task_with_configured_no_log]
F --> I
G --> I
H --> I
I --> J[End_task]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- Consider wrapping the templated
no_logexpressions with| bool(e.g.no_log: "{{ network_secure_logging | bool }}") to ensure they are always interpreted as booleans even if overridden via inventory or extra vars. - Since the verbosity-based logging rule is used in multiple places, you might want to introduce a dedicated variable (e.g.
network_fact_logging_quiet: ansible_verbosity < 2) indefaults/main.ymland reference that forservice_factsandpackage_factsto make the intent clearer and easier to adjust.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider wrapping the templated `no_log` expressions with `| bool` (e.g. `no_log: "{{ network_secure_logging | bool }}"`) to ensure they are always interpreted as booleans even if overridden via inventory or extra vars.
- Since the verbosity-based logging rule is used in multiple places, you might want to introduce a dedicated variable (e.g. `network_fact_logging_quiet: ansible_verbosity < 2`) in `defaults/main.yml` and reference that for `service_facts` and `package_facts` to make the intent clearer and easier to adjust.
## Individual Comments
### Comment 1
<location path="tasks/set_facts.yml" line_range="8" />
<code_context>
when:
- network_provider == "nm" or network_state != {}
- no_log: true
+ no_log: "{{ network_secure_logging }}"
# If any 802.1x connections are used, the wpa_supplicant
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Consider explicitly casting `network_secure_logging` to a boolean for robustness.
If `network_secure_logging` is set as a string in vars (e.g. `'false'`), Ansible may treat it as truthy, leading to unexpected logging or suppression. Using `no_log: "{{ network_secure_logging | bool }}"` (optionally with `| default(true)`) would make this robust to different input types and avoid surprises.
```suggestion
no_log: "{{ network_secure_logging | default(true) | bool }}"
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| when: __network_required_facts | | ||
| difference(ansible_facts.keys() | list) | length > 0 | ||
| no_log: true | ||
| no_log: "{{ network_secure_logging }}" |
There was a problem hiding this comment.
🚨 suggestion (security): Consider explicitly casting network_secure_logging to a boolean for robustness.
If network_secure_logging is set as a string in vars (e.g. 'false'), Ansible may treat it as truthy, leading to unexpected logging or suppression. Using no_log: "{{ network_secure_logging | bool }}" (optionally with | default(true)) would make this robust to different input types and avoid surprises.
Suggested change
| no_log: "{{ network_secure_logging }}" | |
| no_log: "{{ network_secure_logging | default(true) | bool }}" |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #868 +/- ##
==========================================
- Coverage 43.11% 42.68% -0.43%
==========================================
Files 12 13 +1
Lines 3124 3160 +36
==========================================
+ Hits 1347 1349 +2
- Misses 1777 1811 +34 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
richm
reviewed
May 7, 2026
| when: | ||
| - network_provider == "nm" or network_state != {} | ||
| no_log: true | ||
| no_log: "{{ network_secure_logging }}" |
Contributor
There was a problem hiding this comment.
Suggested change
| no_log: "{{ network_secure_logging }}" | |
| no_log: "{{ ansible_verbosity < 2 }}" |
Adding no_log: true was just for verbosity, not security - same with other places
so I don't think we need network_secure_logging for now
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Feature: Introduce the
network_secure_loggingvariable that defaults totrueand using verbosity-based logging for facts modules.Reason: Currently, all sensitive tasks use hard-coded no_log: true, which makes debugging difficult. Users cannot see credential-related output even when troubleshooting authentication or secret management issues. Additionally, package_facts and service_facts produce verbose output that clutters logs during normal operation.
Result:
🤖 Generated with Claude Code
Summary by Sourcery
Introduce a configurable secure logging toggle and adjust fact-gathering log verbosity.
New Features:
Enhancements:
Documentation: