Security improvement to prevent sensitive cloud-init configuration
data from appearing in Ansible logs.
Changes:
- Add no_log: true to all cloud-init user-data template tasks
- Applies to Debian/Ubuntu user-data generation
- Applies to RHEL/CentOS/Rocky/Alma user-data generation
- Applies to SUSE/openSUSE user-data generation
Security rationale:
- Cloud-init user-data contains sensitive information:
* SSH keys and authorized_keys configuration
* User passwords (hashed but still sensitive)
* System configuration details
* Network configuration
- Following CLAUDE.md security guidelines
- Prevents accidental exposure in CI/CD logs
- Aligns with ansible-lint security best practices
Impact:
- No functional changes to role behavior
- Enhanced security posture
- Compliance with security-first principles
Related to: ROLE_ANALYSIS_AND_IMPROVEMENTS.md recommendation 2.2
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
ansible
df628983d1