helm_pull: Silence false no_log warning

[colshine1]

SUMMARY

Apply no_log=True to pass_credentials to silence false positive warning.

Fixes similar issue to: #423

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

changelog/fragements/796-false-positive-helmull.yaml
plugins/modules/helm_pull.py

[softwarefactory-project-zuul]

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/db57b03c41344b68b76444b42d1a5074

✔️ ansible-galaxy-importer SUCCESS in 10m 16s
✔️ build-ansible-collection SUCCESS in 5m 21s

[softwarefactory-project-zuul]

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/1240361b377c45008e4a11669676f71b

✔️ ansible-galaxy-importer SUCCESS in 3m 59s
✔️ build-ansible-collection SUCCESS in 5m 47s

[yurnov]

confirmed that even in module_utils we have no_logs=True and password not appear in module output, it's a false positive warning

[yurnov]

Hi @colshine1,

please update the integration test with the following:
https://github.com/ansible-collections/kubernetes.core/blob/cd686316e9b3af6df67c19027b573b27468234e3/tests/integration/targets/helm_pull/tasks/main.yml#L170C1-L182C61

please add

              - '"Module did not set no_log for pass_credentials" not in _result.warnings'

[softwarefactory-project-zuul]

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/74943cfd44674e82a16c0507efbc91df

✔️ ansible-galaxy-importer SUCCESS in 4m 33s
✔️ build-ansible-collection SUCCESS in 5m 19s

[yurnov]

LGTM

[gravesm]

Suggested change

	pass_credentials=dict(type="bool", default=False, no_log=True),
	pass_credentials=dict(type="bool", default=False, no_log=False),

This should be False since this is a false positive.

[yurnov]

This should be False since this is a false positive.

False is the default one and it will behave in the same way as now, it throws a warning Module did not set no_log for pass_credentials. So, it should be no_log=True

[gravesm]

No, explicitly setting no_log=False is the correct way to deal with a false positive.

[yurnov]

No, explicitly setting no_log=False is the correct way to deal with a false positive.

Hm... I will check how it works

[colshine1]

I setup a sample test playbook:

- hosts: localhost
  tasks:
    - name: Download chart to controlhost
      kubernetes.core.helm_pull:
        chart_ref: "https://domain.com/helm_chart-0.0.1.tgz"
        destination: "/tmp/"
        untar_chart: false
        repo_username: user
        repo_password: password
        pass_credentials: false

I run the playbook with -vvv to get the module parameters in the output, the output fails as I set fake credentials for this test.

Without any changes to the module the output is:

[WARNING]: Module did not set no_log for pass_credentials
fatal: [localhost]: FAILED! => {
    "changed": false,
    "command": "helm pull https://domain.com/helm_chart-0.0.1.tgz --username user --******** ******** --destination /tmp/",
    "invocation": {
        "module_args": {
            "binary_path": null,
            "chart_ca_cert": null,
            "chart_devel": null,
            "chart_ref": "https://domain.com/helm_chart-0.0.1.tgz",
            "chart_ssl_cert_file": null,
            "chart_ssl_key_file": null,
            "chart_version": null,
            "destination": "/tmp/",
            "pass_credentials": false,
            "provenance": false,
            "repo_password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "repo_url": null,
            "repo_username": "user",
            "skip_tls_certs_check": false,
            "untar_chart": false,
            "verify_chart": false,
            "verify_chart_keyring": null
        }
    },
    "msg": "Failure when executing Helm command.",
    "rc": 1,
    "stderr": "Error: failed to fetch https://domain.com/helm_chart-0.0.1.tgz : 401 Unauthorized\n",
    "stderr_lines": [
        "Error: failed to fetch https://domain.com/helm_chart-0.0.1.tgz : 401 Unauthorized"
    ],
    "stdout": "",
    "stdout_lines": []
}

setting no_log to False on line 192:

fatal: [localhost]: FAILED! => {
    "changed": false,
    "command": "helm pull https://domain.com/helm_chart-0.0.1.tgz --username user --******** ******** --destination /tmp/",
    "invocation": {
        "module_args": {
            "binary_path": null,
            "chart_ca_cert": null,
            "chart_devel": null,
            "chart_ref": "https://domain.com/helm_chart-0.0.1.tgz",
            "chart_ssl_cert_file": null,
            "chart_ssl_key_file": null,
            "chart_version": null,
            "destination": "/tmp/",
            "pass_credentials": false,
            "provenance": false,
            "repo_password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "repo_url": null,
            "repo_username": "user",
            "skip_tls_certs_check": false,
            "untar_chart": false,
            "verify_chart": false,
            "verify_chart_keyring": null
        }
    },
    "msg": "Failure when executing Helm command.",
    "rc": 1,
    "stderr": "Error: failed to fetch https://domain.com/helm_chart-0.0.1.tgz : 401 Unauthorized\n",
    "stderr_lines": [
        "Error: failed to fetch https://domain.com/helm_chart-0.0.1.tgz : 401 Unauthorized"
    ],
    "stdout": "",
    "stdout_lines": []
}

setting no_log to False on line 192:

fatal: [localhost]: FAILED! => {
    "changed": false,
    "command": "helm pull https://domain.com/helm_chart-0.0.1.tgz --username user --******** ******** --destination /tmp/",
    "invocation": {
        "module_args": {
            "binary_path": null,
            "chart_ca_cert": null,
            "chart_devel": null,
            "chart_ref": "https://domain.com/helm_chart-0.0.1.tgz",
            "chart_ssl_cert_file": null,
            "chart_ssl_key_file": null,
            "chart_version": null,
            "destination": "/tmp/",
            "pass_credentials": false,
            "provenance": false,
            "repo_password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "repo_url": null,
            "repo_username": "user",
            "skip_tls_certs_check": false,
            "untar_chart": false,
            "verify_chart": false,
            "verify_chart_keyring": null
        }
    },
    "msg": "Failure when executing Helm command.",
    "rc": 1,
    "stderr": "Error: failed to fetch https://domain.com/helm_chart-0.0.1.tgz : 401 Unauthorized\n",
    "stderr_lines": [
        "Error: failed to fetch https://domain.com/helm_chart-0.0.1.tgz : 401 Unauthorized"
    ],
    "stdout": "",
    "stdout_lines": []
}

I added no_log=True to be consistent with this: https://github.com/Akasurde/kubernetes.core/blob/22013686e7f2f735d5de5850b612dce4daa04b1a/plugins/modules/helm_repository.py#L231. However, it looks like this no longer exists in the module so I'm happy to update based on whatever is the correct solution.

[yurnov]

should be _result.stderr instead of _result.warnings, module helm_pull returns warnings into stderr

[colshine1]

Updated as requested

[softwarefactory-project-zuul]

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/098348d6e14a4726b31969a63f4aa0b3

✔️ ansible-galaxy-importer SUCCESS in 5m 14s
✔️ build-ansible-collection SUCCESS in 5m 24s

[softwarefactory-project-zuul]

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/9cd8c5a2564049b2bf19d9c1fb3b05a2

✔️ ansible-galaxy-importer SUCCESS in 3m 32s
✔️ build-ansible-collection SUCCESS in 5m 36s

[yurnov]

Hi @colshine1 or @gravesm, could you please rebase to master?

[yurnov]

Strangely, I saw that message in my testing environment some time ago, but I'm not sure about the package versions. Today trying to reproduce the issue with ansible-core 2.16.14 and kubernetes.core both 3.2.0 and 5.0.0 versions, and the issue is not reproducible. So, probably that PR is not required anymore