Ansible is a radically simple IT automation platform that makes your applications and systems easier to deploy and maintain. Automate everything from code deployment to network configuration to cloud management, in a language that approaches plain English, using SSH, with no agents to install on remote systems. https://docs.ansible.com.

Summary

I've got some dev lines that have hosts on them with the same name ex. [line1] servera serverb serverc [line1:vars] ansible_ssh_common_args=' -o ProxyCommand="ssh -W %h:%p -q [email protected]"

[line2] servera serverb serverc [line2:vars] ansible_ssh_common_args=' -o ProxyCommand="ssh -W %h:%p -q [email protected]"

So I'm jumping through bastions to get there. My problem comes in when I run a playbook it looks like ansible defaults to the last host it ran on. So if I run a play that calls out the group for line2 and it runs. Then I run the same play using the group for line1 it will see servera and connect to the previous line2 run.

Just in case I'm not explaining well enough If I run ansible line2 -a "rpm -q screen" It will then run on line2 check the package and show the package version

If I run ansible line1 -a "rpm -q screen" It will then run on the line2 list again because they have the same host names

Is there a way to make it run based on the group name instead of it running on the hostnames in the group.

Issue Type

Bug Report

Component Name

Inventory file

Ansible Version

$ ansible --version
2.9.27

Configuration

$ ansible-config dump --only-changed
can't copy

OS / Environment

RHEL 8

Steps to Reproduce

Expected Results

I expected it to connect to the group I indicated in the playbook. Instead it connected to the last group a play was ran on because the host names are the same.

Actual Results

can't copy

Code of Conduct

• [X] I agree to follow the Ansible Code of Conduct

Summary

uri behaviour has changed so much that its usage over networking devices is now impossible. Specifically, it tries to read /etc/ssh/ssh_config and execute /bin/bash which makes no sense for these types of devices. This issue is somehow linked to this other one and this commit. My proposal goes beyond ignoring the read failure by not trying to read at all /etc/ansible nor execute /bin/bash on networking devices by checking the ansible_network_os fact.

Issue Type

Bug Report

Component Name

ansible.builtin.uri

Ansible Version

$ ansible --version
  config file = /etc/ansible/ansible.cfg
  ansible python module location = /usr/local/lib/python3.9/dist-packages/ansible
  ansible collection location = /opt
  executable location = /usr/local/bin/ansible
  python version = 3.9.9 (main, Jan 12 2022, 16:10:51) [GCC 11.2.0]
  jinja version = 3.0.1
  libyaml = True

Configuration

$ ansible-config dump --only-changed
CACHE_PLUGIN(/etc/ansible/ansible.cfg) = redis
CACHE_PLUGIN_CONNECTION(/etc/ansible/ansible.cfg) = localhost:<port>:0:<password>
CACHE_PLUGIN_TIMEOUT(/etc/ansible/ansible.cfg) = 259200
COLLECTIONS_PATHS(/etc/ansible/ansible.cfg) = ['/opt']
DEFAULT_EXECUTABLE(/etc/ansible/ansible.cfg) = /bin/bash
DEFAULT_FORKS(/etc/ansible/ansible.cfg) = 1000
DEFAULT_GATHERING(/etc/ansible/ansible.cfg) = explicit
DEFAULT_GATHER_TIMEOUT(/etc/ansible/ansible.cfg) = 30
DEFAULT_HASH_BEHAVIOUR(/etc/ansible/ansible.cfg) = replace
DEFAULT_HOST_LIST(/etc/ansible/ansible.cfg) = ['/etc/ansible/hosts']
DEFAULT_LOAD_CALLBACK_PLUGINS(/etc/ansible/ansible.cfg) = True
DEFAULT_LOG_PATH(/etc/ansible/ansible.cfg) = /var/log/ansible.log
DEFAULT_PRIVATE_ROLE_VARS(/etc/ansible/ansible.cfg) = False
DEFAULT_STDOUT_CALLBACK(/etc/ansible/ansible.cfg) = yaml
DEFAULT_TIMEOUT(/etc/ansible/ansible.cfg) = 180
DEFAULT_TRANSPORT(/etc/ansible/ansible.cfg) = ssh
ENABLE_TASK_DEBUGGER(/etc/ansible/ansible.cfg) = True
HOST_KEY_CHECKING(/etc/ansible/ansible.cfg) = True
INJECT_FACTS_AS_VARS(/etc/ansible/ansible.cfg) = True
INTERPRETER_PYTHON(/etc/ansible/ansible.cfg) = /usr/bin/python3
PERSISTENT_COMMAND_TIMEOUT(/etc/ansible/ansible.cfg) = 3599
PERSISTENT_CONNECT_RETRY_TIMEOUT(/etc/ansible/ansible.cfg) = 200
PERSISTENT_CONNECT_TIMEOUT(/etc/ansible/ansible.cfg) = 3600
RETRY_FILES_ENABLED(/etc/ansible/ansible.cfg) = False
SHOW_CUSTOM_STATS(/etc/ansible/ansible.cfg) = True

OS / Environment

Ubuntu 21.10 impish

Steps to Reproduce

Playbook:

- name: Getting RESTConf API root
  hosts:
        - all
  tasks:
        - name: Getting api root
          ansible.builtin.uri:
                body_format: 'raw'
                force_basic_auth: yes
                headers: {"Accept": "application/xrd+xml"}
                method: 'GET'
                return_content: yes
                status_code: '100,101,102,200,201,202,203,204,205,206,207,208,226,300,301,302,303,304,305,307,308'
                timeout: '120'
                url: 'https://172.21.126.182/.well-known/host-meta'
                url_password: "{{ ansible_password }}"
                url_username: "{{ ansible_user }}"
                validate_certs: no

Expected Results

Uri should not try to contact the remote device using SSH, but only using https and receive:

<XRD xmlns='http://docs.oasis-open.org/ns/xri/xrd-1.0'>
    <Link rel='restconf' href='/restconf'/>
</XRD>

Actual Results

Running the playbook over an IOS-XE device leads to:

<172.21.126.182> ESTABLISH SSH CONNECTION FOR USER: admin
<172.21.126.182> SSH: EXEC sshpass -d12 ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o 'User="admin"' -o ConnectTimeout=180 -o ControlPath=/root/.ansible/cp/8ca0c205e8 172.21.126.182 '/bin/bash -c '"'"'echo ~admin && sleep 0'"'"''
...
<172.21.126.182> ESTABLISH SSH CONNECTION FOR USER: admin
<172.21.126.182> SSH: EXEC sshpass -d12 ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o 'User="admin"' -o ConnectTimeout=180 -o ControlPath=/root/.ansible/cp/8ca0c205e8 172.21.126.182 '/bin/bash -c '"'"'( umask 77 && mkdir -p "` echo Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'echo ~admin && sleep 0'"'"'"'"'"'"'"'"'"/.ansible/tmp `"&& mkdir "` echo Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'echo ~admin && sleep 0'"'"'"'"'"'"'"'"'"/.ansible/tmp/ansible-tmp-1642423609.1997962-2653104-36627744824971 `" && echo ansible-tmp-1642423609.1997962-2653104-36627744824971="` echo Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'echo ~admin && sleep 0'"'"'"'"'"'"'"'"'"/.ansible/tmp/ansible-tmp-1642423609.1997962-2653104-36627744824971 `" ) && sleep 0'"'"''
Using module file /usr/local/lib/python3.9/dist-packages/ansible/modules/uri.py
<172.21.126.182> PUT /root/.ansible/tmp/ansible-local-2652228bqacqcvs/tmp0mtdsj5j TO Line has invalid autocommand "/bin/bash -c '( umask 77 && mkdir -p "` echo Line has invalid autocommand "/bin/bash -c '"'"'echo ~admin && sleep 0'"'"'"/.ansible/tmp `"&& mkdir "` echo Line has invalid autocommand "/bin/bash -c '"'"'echo ~admin && sleep 0'"'"'"/.ansible/tmp/ansible-tmp"/AnsiballZ_uri.py
<172.21.126.182> SSH: EXEC sshpass -d12 sftp -o BatchMode=no -b - -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o 'User="admin"' -o ConnectTimeout=180 -o ControlPath=/root/.ansible/cp/8ca0c205e8 '[172.21.126.182]'
[WARNING]: sftp transfer mechanism failed on [172.21.126.182]. Use ANSIBLE_DEBUG=1 to see detailed information
<172.21.126.182> SSH: EXEC sshpass -d12 scp -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o 'User="admin"' -o ConnectTimeout=180 -o ControlPath=/root/.ansible/cp/8ca0c205e8 /root/.ansible/tmp/ansible-local-2652228bqacqcvs/tmp0mtdsj5j '[172.21.126.182]:'"'"'Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'( umask 77 && mkdir -p "` echo Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'echo ~admin && sleep 0'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"/.ansible/tmp `"&& mkdir "` echo Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'echo ~admin && sleep 0'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"/.ansible/tmp/ansible-tmp"/AnsiballZ_uri.py'"'"''

...
<172.21.126.182> ESTABLISH SSH CONNECTION FOR USER: admin
<172.21.126.182> SSH: EXEC sshpass -d12 ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o 'User="admin"' -o ConnectTimeout=180 -o ControlPath=/root/.ansible/cp/8ca0c205e8 172.21.126.182 '/bin/bash -c '"'"'chmod u+x '"'"'"'"'"'"'"'"'Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'( umask 77 && mkdir -p "` echo Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'echo ~admin && sleep 0'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"/.ansible/tmp `"&& mkdir "` echo Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'echo ~admin && sleep 0'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"/.ansible/tmp/ansible-tmp"/'"'"'"'"'"'"'"'"' '"'"'"'"'"'"'"'"'Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'( umask 77 && mkdir -p "` echo Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'echo ~admin && sleep 0'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"/.ansible/tmp `"&& mkdir "` echo Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'echo ~admin && sleep 0'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"/.ansible/tmp/ansible-tmp"/AnsiballZ_uri.py'"'"'"'"'"'"'"'"' && sleep 0'"'"''

...
<172.21.126.182> ESTABLISH SSH CONNECTION FOR USER: admin
<172.21.126.182> SSH: EXEC sshpass -d12 ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o 'User="admin"' -o ConnectTimeout=180 -o ControlPath=/root/.ansible/cp/8ca0c205e8 -tt 172.21.126.182 '/bin/bash -c '"'"'sudo -H -S  -p "[sudo via ansible, key=nczblhdynldnoagdirhuulufrxlztdkx] password:" -u root /bin/bash -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-nczblhdynldnoagdirhuulufrxlztdkx ; /usr/bin/python3 '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'( umask 77 && mkdir -p "` echo Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'echo ~admin && sleep 0'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"/.ansible/tmp `"&& mkdir "` echo Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'echo ~admin && sleep 0'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"/.ansible/tmp/ansible-tmp"/AnsiballZ_uri.py'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"''"'"'"'"'"'"'"'"' && sleep 0'"'"''
Escalation succeeded

...
fatal: [CSR1000v-17.3.1a]: FAILED! => changed=false 
  module_stderr: |-
    OpenSSH_8.7p1 Ubuntu-4+21.10, OpenSSL 1.1.1m  14 Dec 2021
...
    debug1: Sending command: /bin/bash -c 'sudo -H -S  -p "[sudo via ansible, key=nczblhdynldnoagdirhuulufrxlztdkx] password:" -u root /bin/bash -c '"'"'echo BECOME-SUCCESS-nczblhdynldnoagdirhuulufrxlztdkx ; /usr/bin/python3 '"'"'"'"'"'"'"'"'Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'( umask 77 && mkdir -p "` echo Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'echo ~admin && sleep 0'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"/.ansible/tmp `"&& mkdir "` echo Line has invalid autocommand "/bin/bash -c '"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"'"
...
    Line has invalid autocommand "/bin/bash -c 'sudo -H -S  -p "[sudo via ansible, key=nczblhdynldnoagdirhuulufrxlztdkx] password:" -u root /bin/bash -c '"'"'echo BECOME-SUCCESS-nczblhdynldnoagdirhuulufrxlztdkx ; /usr/bin/python3 '"'"'"'"'"'"'"'"'Line has invalid autocommand "/bin/bash -c"
  msg: |-
    MODULE FAILURE
    See stdout/stderr for the exact error
  rc: 0

### Code of Conduct

- [X] I agree to follow the Ansible Code of Conduct

Summary

Hi,

I currently work developing Ansible playbooks, and I thought that customising no_log behaviour could be interesting feature for me as a user (and maybe for other people as well).

My problem is that no_log parameter when invoking an Ansible module omits all of the stdout for that module invocation. It would be nice if this behaviour could be customisable so that I can see the stdout of the module invocation but only certain parameters.

My suggestion is to create a no_log_control similar to loop_control so this way its behaviour can be customisable. (By default the current behaviour would be totally fine).

I do not see similar feature in docs:

• https://docs.ansible.com/ansible/devel/reference_appendices/logging.html
• https://docs.ansible.com/ansible/devel/reference_appendices/faq.html#how-do-i-keep-secret-data-in-my-playbook

The aim of this request is similar to https://github.com/ansible/proposals/issues/109

I am willing to work on this myself if the idea makes sense to contributors and maintainers. I would really like to get started contributing to this awesome project.

Issue Type

Feature Idea

Component Name

ansible-core Probably this is the file to be updated => https://github.com/ansible/ansible/blob/devel/lib/ansible/executor/task_executor.py

Additional Information

- name: "kinit in order to do sensitive stuff"
  command: kinit sensitive_sa
  args:
    stdin: "{{ secret }}"
  no_log: True
  no_log_control:
    no_log_vars:
      - secret

Code of Conduct

• [X] I agree to follow the Ansible Code of Conduct

Summary

We create groups from a variable definition like [ {"name": "admins", "gid": 1234} ]. When I change the name of a group in there after the ansible code already ran, I'd expect the group module to find the existing group by gid and rename it. Instead, it fails with a message GID '1234' already exists. #29919 suggested using the non_unique option of the module/groupmod, but that will create a duplicate / a new group using the same GID, which apparently is not supported by most software -- not even the group*/user* tools themselves, because removing the old group name afterwards fails when users exist that have the GID as primary group -- even though the gid would persist (on the other name).

So the request here is to properly support group renames, probably using the -n, --new-name option of groupmod. Currently the only working method seems to shell out to it.

Issue Type

Bug Report

Component Name

group

Ansible Version

$ ansible --version
ansible [core 2.12.1]
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/jbiegert/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /tmp/ansible/venv/lib64/python3.9/site-packages/ansible
  ansible collection location = /home/jbiegert/.ansible/collections:/usr/share/ansible/collections
  executable location = venv/bin/ansible
  python version = 3.9.9 (main, Nov 19 2021, 00:00:00) [GCC 11.2.1 20210728 (Red Hat 11.2.1-1)]
  jinja version = 3.0.3
  libyaml = True

Configuration

$ ansible-config dump --only-changed

OS / Environment

control host: Fedora 34 target host: RHEL 8.1

Steps to Reproduce

test playbook below.

The first tasks demonstrate that renaming fails, the following demonstrate the damage done by the non_unique option:

- hosts: all
  run_once: true
  become: true
  tasks:
    - name: create group
      group:
        name: oldgroupname
        gid: 9999

    - name: create testuser
      user:
        name: testuser-groupname
        group: oldgroupname

    - name: /etc/group content
      command: grep groupname /etc/group

    - name: rename group
      group:
        name: newgroupname
        gid: 9999
      ignore_errors: true  # fails with "GID already in use"

    - name: force rename group
      group:
        name: newgroupname
        gid: 9999
        non_unique: true

    - name: /etc/group content
      command: grep groupname /etc/group

    # should not be necessary under idempotence
    - name: remove old group
      group:
        name: oldgroupname
        state: absent
      ignore_errors: true  # fails due to user having its GID as primary

    - name: manually remove old group
      command: sed -i -e /oldgroupname/d  /etc/group

    - name: /etc/group content
      command: grep groupname /etc/group

Expected Results

The task rename group to succeed and rename the group, identified by the GID.

Actual Results

❯ ANSIBLE_LOAD_CALLBACK_PLUGINS=1 ANSIBLE_STDOUT_CALLBACK=yaml LANG=C.UTF-8 venv/bin/ansible-playbook -i 192.168.122.150, rename-group.yml -v

Using /etc/ansible/ansible.cfg as config file

PLAY [all] **********************************************************************************************************************************

TASK [Gathering Facts] **********************************************************************************************************************
ok: [192.168.122.150]

TASK [create group] *************************************************************************************************************************
changed: [192.168.122.150] => changed=true
  gid: 9999
  name: oldgroupname
  state: present
  system: false

TASK [create testuser] **********************************************************************************************************************
changed: [192.168.122.150] => changed=true
  comment: ''
  create_home: true
  group: 9999
  home: /home/testuser-groupname
  name: testuser-groupname
  shell: /bin/bash
  state: present
  stderr: |-
    useradd: warning: the home directory already exists.
    Not copying any file from skel directory into it.
    Creating mailbox file: File exists
  stderr_lines: <omitted>
  system: false
  uid: 1001

TASK [/etc/group content] *******************************************************************************************************************
changed: [192.168.122.150] => changed=true
  cmd:
  - grep
  - groupname
  - /etc/group
  delta: '0:00:00.002372'
  end: '2022-01-17 11:54:18.544475'
  msg: ''
  rc: 0
  start: '2022-01-17 11:54:18.542103'
  stderr: ''
  stderr_lines: <omitted>
  stdout: 'oldgroupname:x:9999:'
  stdout_lines: <omitted>

TASK [rename group] *************************************************************************************************************************
fatal: [192.168.122.150]: FAILED! => changed=false
  msg: |-
    groupadd: GID '9999' already exists
  name: newgroupname
...ignoring

TASK [force rename group] *******************************************************************************************************************
changed: [192.168.122.150] => changed=true
  gid: 9999
  name: newgroupname
  state: present
  system: false

TASK [/etc/group content] *******************************************************************************************************************
changed: [192.168.122.150] => changed=true
  cmd:
  - grep
  - groupname
  - /etc/group
  delta: '0:00:00.002114'
  end: '2022-01-17 11:54:19.864750'
  msg: ''
  rc: 0
  start: '2022-01-17 11:54:19.862636'
  stderr: ''
  stderr_lines: <omitted>
  stdout: |-
    oldgroupname:x:9999:
    newgroupname:x:9999:
  stdout_lines: <omitted>

TASK [remove old group] *********************************************************************************************************************
fatal: [192.168.122.150]: FAILED! => changed=false
  msg: |-
    groupdel: cannot remove the primary group of user 'testuser-groupname'
  name: oldgroupname
...ignoring

TASK [manually remove old group] ************************************************************************************************************
changed: [192.168.122.150] => changed=true
  cmd:
  - sed
  - -i
  - -e
  - /oldgroupname/d
  - /etc/group
  delta: '0:00:00.002683'
  end: '2022-01-17 11:54:20.562540'
  msg: ''
  rc: 0
  start: '2022-01-17 11:54:20.559857'
  stderr: ''
  stderr_lines: <omitted>
  stdout: ''
  stdout_lines: <omitted>

TASK [/etc/group content] *******************************************************************************************************************
changed: [192.168.122.150] => changed=true
  cmd:
  - grep
  - groupname
  - /etc/group
  delta: '0:00:00.002197'
  end: '2022-01-17 11:54:20.919638'
  msg: ''
  rc: 0
  start: '2022-01-17 11:54:20.917441'
  stderr: ''
  stderr_lines: <omitted>
  stdout: 'newgroupname:x:9999:'
  stdout_lines: <omitted>

Code of Conduct

• [X] I agree to follow the Ansible Code of Conduct

SUMMARY

To be discussed in https://github.com/ansible-community/community-topics/issues/56.

ISSUE TYPE

• Docs Pull Request

COMPONENT NAME

docs/docsite/rst/roadmap/COLLECTIONS_6.rst

SUMMARY

As proposed in #19125 i've added an clone_extra_args option to builtin.git to be able to pass additional arguments to git clone.

Possible usecases are described in #54181 and #55707 as well as in #19125 itself.

ISSUE TYPE

• Feature Pull Request

COMPONENT NAME

builtin.git

Usage example

- name: Example clone with extra_args
  ansible.builtin.git:
    repo: https://github.com/ansible/ansible-examples.git
    dest: /src/ansible-examples
    clone_extra_args: "--no-checkout"

SUMMARY

Fixes #76769.

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

inventory

Summary

Currently, disable_lookups=True is hard-coded, it would be nice if this could be overridden.

Issue Type

Bug Report

Component Name

inventory

Ansible Version

$ ansible --version
ansible [core 2.12.1]
  config file = /Users/mark/.ansible.cfg
  configured module search path = ['/Users/mark/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /Users/mark/.ansible/collections/ansible_collections/community/digitalocean/venv/lib/python3.9/site-packages/ansible
  ansible collection location = /Users/mark/.ansible/collections:/usr/share/ansible/collections
  executable location = /Users/mark/.ansible/collections/ansible_collections/community/digitalocean/venv/bin/ansible
  python version = 3.9.9 (main, Dec  9 2021, 19:41:06) [Clang 13.0.0 (clang-1300.0.29.3)]
  jinja version = 3.0.3
  libyaml = True

Configuration

$ ansible-config dump --only-changed
DEFAULT_STDOUT_CALLBACK(/Users/mark/.ansible.cfg) = yaml
DIFF_ALWAYS(/Users/mark/.ansible.cfg) = True
INTERPRETER_PYTHON(/Users/mark/.ansible.cfg) = /Users/mark/.pyenv/shims/python3

OS / Environment

MacOS 12.0.1

Steps to Reproduce

There's nothing to reproduce, it's an observation.

Expected Results

N/A

Actual Results

N/A

Code of Conduct

• [X] I agree to follow the Ansible Code of Conduct

SUMMARY

Adds new parameters to builtin.find to be able to filter results by permission, owner and group. See examples below for clarification.

The filters are built in a similar way to the existing age and size filter. They work on the existing data after the file list is obtained. The filters work for directories, files and links.

Fixes #76586

ISSUE TYPE

• Feature Pull Request

COMPONENT NAME

ansible.builtin.find

ADDITIONAL INFORMATION

How to Use

- name: find only user executable elements in a certain dir
    find: 
        paths: /opt/myapp
        permissions:
          - u+x

- name: find all executable elements in a certain dir
    find: 
        paths: /opt/myapp
        permissions:
          - u+x
          - g+x
          - o+x

- name: find all elements owned by user and group example
    find: 
        paths: /opt/myapp
        user: example
        group: example

SUMMARY

The previous state of the script lead to errors, when executing the script after cloning the repo to a path with spaces in it.

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

Repo/Developer internal helper-script hacking/env-setup

ADDITIONAL INFORMATION

With out the change, the script gives the following errors when run in a path with spaces in it

bash: /mnt/my-path/a: No such file or directory
bash: /mnt/my-path/a: No such file or directory