diff options
| author | Stavros Kroustouris <kroustou@users.noreply.github.com> | 2026-08-21 12:24:39 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-08-21 12:24:39 +0300 |
| commit | 031fd365efa196216a3dd8ed6698101e22445e19 (patch) | |
| tree | 99ff89ba1b6dc039eaab1406da263ab0fcb915f8 /plugins/modules | |
| parent | 7005e961d92af1a999db3796629ad0cc9acfc1b6 (diff) | |
| download | vyos.vyos-031fd365efa196216a3dd8ed6698101e22445e19.tar.gz vyos.vyos-031fd365efa196216a3dd8ed6698101e22445e19.zip | |
T2295: vyos_user: set explicit no_log on update_password (#479)
* vyos_user: set no_log=False on update_password parameter
Prevents Ansible from redacting update_password in module args when
configured_password is present with no_log=True.
Co-authored-by: Cursor <cursoragent@cursor.com>
* T2295: document why update_password needs explicit no_log=False
Ansible PASSWORD_MATCH hides parameters named *password* when no_log is
unset (not the same as defaulting to False). Add comment, changelog
wording, and a unit test; align with ansible.core user module.
Co-authored-by: Cursor <cursoragent@cursor.com>
* T2295: add comment for update_password no_log=False
Co-authored-by: Cursor <cursoragent@cursor.com>
* T2295: drop source-inspection test for update_password no_log
Remove test_vyos_user_update_password_explicit_no_log_false; existing
execute_module tests already cover update_password behavior.
Co-authored-by: Cursor <cursoragent@cursor.com>
* T2295: fix CI failures (changelog line length, devel/py3.12 matrix)
Shorten the changelog fragment to satisfy ansible-lint line-length (160).
Skip py3.12-devel tox environments and exclude devel+Python 3.12 from
unit-source now that ansible-core devel requires Python >=3.13.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Add docstrings to vyos_user functions and workflow permissions
Adds docstrings to all undocumented module-level functions in
vyos_user.py to bring docstring coverage above the 80% threshold.
Adds explicit `permissions: contents: read` to codecoverage.yml
as recommended by CodeRabbit for least-privilege CI security.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Revert "Add docstrings to vyos_user functions and workflow permissions"
This reverts commit 616b27bc339a7607eae15e91a605c70dae15248b.
* T2295: drop unrelated CI/tox changes; reword changelog
Revert the matrix_exclude block in tests.yml and the py3.12-devel skip in
tox-ansible.ini; those were CI workarounds unrelated to this fix and are no
longer needed against current main. Reword the changelog fragment to describe
the observable behavior instead of the internal PASSWORD_MATCH constant.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: omnom62 <75066712+omnom62@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'plugins/modules')
| -rw-r--r-- | plugins/modules/vyos_user.py | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/plugins/modules/vyos_user.py b/plugins/modules/vyos_user.py index 0c79ce30..37b2a3b2 100644 --- a/plugins/modules/vyos_user.py +++ b/plugins/modules/vyos_user.py @@ -456,7 +456,8 @@ def main(): full_name=dict(), configured_password=dict(no_log=True), encrypted_password=dict(no_log=False), - update_password=dict(default="always", choices=["on_create", "always"]), + # Explicit no_log=False: unset no_log triggers Ansible PASSWORD_MATCH on *password* names. + update_password=dict(default="always", choices=["on_create", "always"], no_log=False), state=dict(default="present", choices=["present", "absent"]), public_keys=dict(type="list", elements="dict", options=public_key_spec), ) |