From 3f580ffe00c786e33809c9e1ae74b007603bc01d Mon Sep 17 00:00:00 2001
From: Enrique Vallespi Gil <evallesp@redhat.com>
Date: Wed, 27 May 2026 09:20:37 +0200
Subject: [PATCH] Add no_log true to prepare_leaf task

Using best practices and security hygiene.

Signed-off-by: Enrique Vallespi Gil <evallesp@redhat.com>
---
 hooks/playbooks/skmo/prepare-leaf.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hooks/playbooks/skmo/prepare-leaf.yaml b/hooks/playbooks/skmo/prepare-leaf.yaml
index 43c24a92d..08fd121ae 100644
--- a/hooks/playbooks/skmo/prepare-leaf.yaml
+++ b/hooks/playbooks/skmo/prepare-leaf.yaml
@@ -114,6 +114,7 @@
           openstack role add --project {{ leaf_admin_project }} --user {{ leaf_admin_user }} admin
       args:
         executable: /bin/bash
+      no_log: true
 
     - name: Get existing leaf CA bundle secret if present
       kubernetes.core.k8s_info: