Add unsafe_show_logs switch (#9164)

Signed-off-by: bo.jiang <bo.jiang@daocloud.io>

Signed-off-by: bo.jiang <bo.jiang@daocloud.io>

inventory/sample/group_vars/all/all.yml

@@ -130,3 +130,6 @@ ntp_servers:
   - "1.pool.ntp.org iburst"
   - "2.pool.ntp.org iburst"
   - "3.pool.ntp.org iburst"
+
+## Used to control no_log attribute
+unsafe_show_logs: false

roles/bootstrap-os/defaults/main.yml

@@ -25,3 +25,8 @@ override_system_hostname: true
 is_fedora_coreos: false
 
 skip_http_proxy_on_os_packages: false
+
+# If this is true, debug information will be displayed but
+# may contain some private data, so it is recommended to set it to false
+# in the production environment.
+unsafe_show_logs: false

roles/bootstrap-os/tasks/bootstrap-redhat.yml

@@ -65,7 +65,7 @@
   notify: RHEL auto-attach subscription
   ignore_errors: true  # noqa ignore-errors
   become: true
-  no_log: true
+  no_log: "{{ not (unsafe_show_logs|bool) }}"
   when:
     - rh_subscription_username is defined
     - rh_subscription_status.changed

roles/download/defaults/main.yml

@@ -2,6 +2,11 @@
 local_release_dir: /tmp/releases
 download_cache_dir: /tmp/kubespray_cache
 
+# If this is true, debug information will be displayed but
+# may contain some private data, so it is recommended to set it to false
+# in the production environment.
+unsafe_show_logs: false
+
 # do not delete remote cache files after using them
 # NOTE: Setting this parameter to TRUE is only really useful when developing kubespray
 download_keep_remote_cache: false

roles/download/tasks/download_file.yml

@@ -67,7 +67,7 @@
     retries: 4
     delay: "{{ retry_stagger | default(5) }}"
     environment: "{{ proxy_env }}"
-    no_log: true
+    no_log: "{{ not (unsafe_show_logs|bool) }}"
     loop: "{{ download.mirrors | default([download.url]) }}"
     loop_control:
       loop_var: mirror
@@ -100,7 +100,7 @@
     retries: 4
     delay: "{{ retry_stagger | default(5) }}"
     environment: "{{ proxy_env }}"
-    no_log: true
+    no_log: "{{ not (unsafe_show_logs|bool) }}"
 
   - name: download_file | Copy file back to ansible host file cache
     synchronize:

roles/download/tasks/prep_download.yml

@@ -58,7 +58,7 @@
 
 - name: prep_download | Register docker images info
   shell: "{{ image_info_command }}"  # noqa 305 image_info_command contains pipe therefore requires shell
-  no_log: true
+  no_log: "{{ not (unsafe_show_logs|bool) }}"
   register: docker_images
   failed_when: false
   changed_when: false

roles/etcd/defaults/main.yml

@@ -115,3 +115,8 @@ etcd_retries: 4
 # ETCD 3.5.x issue
 # https://groups.google.com/a/kubernetes.io/g/dev/c/B7gJs88XtQc/m/rSgNOzV2BwAJ?utm_medium=email&utm_source=footer
 etcd_experimental_initial_corrupt_check: true
+
+# If this is true, debug information will be displayed but
+# may contain some private data, so it is recommended to set it to false
+# in the production environment.
+unsafe_show_logs: false

roles/etcd/tasks/gen_certs_script.yml

@@ -142,7 +142,7 @@
   args:
     executable: /bin/bash
     warn: false
-  no_log: true
+  no_log: "{{ not (unsafe_show_logs|bool) }}"
   register: etcd_node_certs
   check_mode: no
   delegate_to: "{{ groups['etcd'][0] }}"
@@ -154,7 +154,7 @@
   shell: "set -o pipefail && base64 -d <<< '{{ etcd_node_certs.stdout|quote }}' | tar xz -C {{ etcd_cert_dir }}"
   args:
     executable: /bin/bash
-  no_log: true
+  no_log: "{{ not (unsafe_show_logs|bool) }}"
   changed_when: false
   when: (('calico_rr' in groups and inventory_hostname in groups['calico_rr']) or
         inventory_hostname in groups['k8s_cluster']) and

roles/kubernetes-apps/csi_driver/vsphere/defaults/main.yml

@@ -21,3 +21,8 @@ csi_endpoint: '{% if external_vsphere_version >= "7.0u1" %}/csi{% else %}/var/li
 vsphere_csi_aggressive_node_drain: False
 vsphere_csi_aggressive_node_unreachable_timeout: 300
 vsphere_csi_aggressive_node_not_ready_timeout: 300
+
+# If this is true, debug information will be displayed but
+# may contain some private data, so it is recommended to set it to false
+# in the production environment.
+unsafe_show_logs: false

roles/kubernetes-apps/csi_driver/vsphere/tasks/main.yml

@@ -30,14 +30,14 @@
   command: "{{ kubectl }} create secret generic vsphere-config-secret --from-file=csi-vsphere.conf={{ kube_config_dir }}/vsphere-csi-cloud-config -n kube-system --dry-run --save-config -o yaml"
   register: vsphere_csi_secret_manifest
   when: inventory_hostname == groups['kube_control_plane'][0]
-  no_log: true
+  no_log: "{{ not (unsafe_show_logs|bool) }}"
 
 - name: vSphere CSI Driver | Apply a CSI secret manifest
   command:
     cmd: "{{ kubectl }} apply -f -"
     stdin: "{{ vsphere_csi_secret_manifest.stdout }}"
   when: inventory_hostname == groups['kube_control_plane'][0]
-  no_log: true
+  no_log: "{{ not (unsafe_show_logs|bool) }}"
 
 - name: vSphere CSI Driver | Apply Manifests
   kube:

tests/common/_kubespray_test_settings.yml

@@ -2,3 +2,4 @@
 # Kubespray settings for tests
 deploy_netchecker: true
 dns_min_replicas: 1
+unsafe_show_logs: true