Add no_log security protection to cloud-init user-data tasks

Security improvement to prevent sensitive cloud-init configuration
data from appearing in Ansible logs.

Changes:
- Add no_log: true to all cloud-init user-data template tasks
- Applies to Debian/Ubuntu user-data generation
- Applies to RHEL/CentOS/Rocky/Alma user-data generation
- Applies to SUSE/openSUSE user-data generation

Security rationale:
- Cloud-init user-data contains sensitive information:
  * SSH keys and authorized_keys configuration
  * User passwords (hashed but still sensitive)
  * System configuration details
  * Network configuration
- Following CLAUDE.md security guidelines
- Prevents accidental exposure in CI/CD logs
- Aligns with ansible-lint security best practices

Impact:
- No functional changes to role behavior
- Enhanced security posture
- Compliance with security-first principles

Related to: ROLE_ANALYSIS_AND_IMPROVEMENTS.md recommendation 2.2

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
2025-11-11 01:35:19 +01:00
parent c3ae566a51
commit df628983d1

View File

@@ -23,6 +23,7 @@
dest: /tmp/cloud-init-{{ deploy_linux_vm_name }}/user-data
mode: '0644'
when: deploy_linux_vm_distro_config.family == "debian"
no_log: true
tags: [cloud-init]
- name: Create cloud-init user-data for RHEL/CentOS/Rocky/Alma
@@ -31,6 +32,7 @@
dest: /tmp/cloud-init-{{ deploy_linux_vm_name }}/user-data
mode: '0644'
when: deploy_linux_vm_distro_config.family == "rhel"
no_log: true
tags: [cloud-init]
- name: Create cloud-init user-data for SUSE/openSUSE
@@ -39,6 +41,7 @@
dest: /tmp/cloud-init-{{ deploy_linux_vm_name }}/user-data
mode: '0644'
when: deploy_linux_vm_distro_config.family == "suse"
no_log: true
tags: [cloud-init]
- name: Create cloud-init ISO