Splunk standalone log error contains cleartext password about docker-splunk HOT 5 CLOSED

Hi. First, executing the license task without license url has been fixed and the change was merged a couple days ago. Second, it is an Ansible behavior to print out the command (which contains password in cleartext) when the task failed.

Possible solution that comes to my mind: wrap how we run the ansible playbook within a script so that we can capture the Ansible output before it makes to stdout and filter those password. So not run Ansible in the entrypoint.
What do you guys think? @bb03 @lephino

from docker-splunk.

We should probably use
no_log: True
for that task, and other ones that could possibly log the credentials.

from docker-splunk.

Should we apply no_log for all tasks that uses Splunk password?

from docker-splunk.

Yeah. We should probably also provide documentation on using debug flags too, so they can see the log contents when necessary.

from docker-splunk.

HIDE_PASSWORD=true as an environment variable should hide all cleartext passwords in Ansible log.

from docker-splunk.