Password leaks in logs for datadog_windows_ddagentuser_password

[a-rhodes]

ansible-datadog/tasks/pkg-windows.yml

Lines 77 to 81 in 00fd751

	# We set DD Password Arg here to prevent it from being printed in any kind of debug logs/messages prior usage
	- name: Set DD Password Arg
	set_fact:
	agent_win_install_args: "{{ agent_win_install_args }} DDAGENTUSER_PASSWORD={{ datadog_windows_ddagentuser_password }}"
	when: datadog_windows_ddagentuser_password | default('', true) | length > 0

When ansible verbosity level of 1 or more is used (aka -v) the password is written to logs. This task should have a no_log: true on it.

Example playbook to reproduce:

- name: Debug
  hosts: all
  gather_facts: false
  vars:
    agent_win_install_args: "DDAGENTUSER_USER=FOOBAR"
    datadog_windows_ddagentuser_password: "{{ lookup('ansible.builtin.env', 'MY_SECRET_PASS') }}"
  tasks:
    # We set DD Password Arg here to prevent it from being printed in any kind of debug logs/messages prior usage
    - name: Set DD Password Arg
      set_fact:
        agent_win_install_args: "{{ agent_win_install_args }} DDAGENTUSER_PASSWORD={{ datadog_windows_ddagentuser_password }}"
      when: datadog_windows_ddagentuser_password | default('', true) | length > 0

Running the above command:

$ MY_SECRET_PASS=MySecretPassword ansible-playbook -i inventory.yaml playbook-debug.yaml -v
No config file found; using defaults

PLAY [Debug] ************************************************************************************************************************************************************************************************

TASK [Set DD Password Arg] **********************************************************************************************************************************************************************************
ok: [demo-host] => {"ansible_facts": {"agent_win_install_args": "DDAGENTUSER_USER=FOOBAR DDAGENTUSER_PASSWORD=MySecretPassword"}, "changed": false}

PLAY RECAP **************************************************************************************************************************************************************************************************
demo-host                  : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

Adding no_log: true to the task, the result looks like:

$ MY_SECRET_PASS=MySecretPassword ansible-playbook -i inventory.yaml playbook-debug.yaml -v
No config file found; using defaults

PLAY [Debug] ************************************************************************************************************************************************************************************************

TASK [Set DD Password Arg] **********************************************************************************************************************************************************************************
ok: [demo-host] => {"censored": "the output has been hidden due to the fact that 'no_log: true' was specified for this result", "changed": false}

PLAY RECAP **************************************************************************************************************************************************************************************************
demo-host                  : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

[wayofthepie]

Same problem here it seems:

ansible-datadog/tasks/main.yml

Lines 10 to 12 in e9e6a5c

	- name: Initialize internal datadog_config variable
	set_fact:
	agent_datadog_config: "{{ datadog_config }}"

That leaks the api_key.