* Added . and / to rule args regexp
Things like pam_echo.so file=/etc/foo.txt weren't being matched and
causing incorrect change counts. Adding / and . fixed that.
Fixes#33351
(cherry picked from commit e957760d52)
* jsonify inventory
* smarter import, dont pass kwargs where not needed
* added datetime
* Eventual plan for json utilities to migrate to common/json_utils when we split
basic.py no need to move jsonify to another file now as we'll do that later.
* json_dict_bytes_to_unicode and json_dict_unicode_to_bytes will also
change names and move to common/text.py at that time (not to json).
Their purpose is to recursively change the elements of a container
(dict, list, set, tuple) into text or bytes, not to json encode or
decode (they could be a generic precursor to that but are not limited
to that.)
* Reimplement the private _SetEncoder which changes sets and datetimes
into objects that are json serializable into a private function
instead. Functions are more flexible, less overhead, and simpler than
an object.
* Remove code that handled simplejson-1.5.x and earlier. Raise an error
if that's the case instead.
* We require python-2.6 or better which has the json module builtin to
the stdlib. So this is only an issue if the stdlib json has been
overridden by a third party module and the simplejson on the system
is 1.5.x or less. (1.5 was released on 2007-01-18)
(cherry picked from commit ebd08d2a01)
* Expand ansible-test --remote-terminate support:
- windows-integration
- network-integration
These commands previously accepted the option, but did not support it.
* Terminate windows and network instances when done.
(cherry picked from commit 6472723ba8)
* Fix vault --ask-vault-pass with no tty
2.4.0 added a check for isatty() that would skip setting up interactive
vault password prompts if not running on a tty.
But... getpass.getpass() will fallback to reading from stdin if
it gets that far without a tty. Since 2.4.0 skipped the interactive
prompts / getpass.getpass() in that case, it would never get a chance
to fall back to stdin.
So if 'echo $VAULT_PASSWORD| ansible-playbook --ask-vault-pass site.yml'
was ran without a tty (ie, from a jenkins job or via the vagrant
ansible provisioner) the 2.4 behavior was different than 2.3. 2.4
would never read the password from stdin, resulting in a vault password
error like:
ERROR! Attempting to decrypt but no vault secrets found
Fix is just to always call the interactive password prompts based
on getpass.getpass() on --ask-vault-pass or --vault-id @prompt and
let getpass sort it out.
* up test_prompt_no_tty to expect prompt with no tty
We do call the PromptSecret class if there is no tty, but
we are back to expecting it to read from stdin in that case.
* Fix logic for when to auto-prompt vault pass
If --ask-vault-pass is used, then pretty much always
prompt.
If it is not used, then prompt if there are no other
vault ids provided and 'auto_prompt==True'.
Fixes vagrant bug https://github.com/hashicorp/vagrant/issues/9033Fixes#30993
(cherry picked from commit 86dc3c09ac)
* Do not run script in check mode
Fixes#30676
* Reformat script integration test
* Add integration tests for check mode of script module
* Fix name on test
* Cleanup temp file
* win_script integration test syntaxt changes
* Add check mode tests for win_script
* Use proper variable in test
* Fail if source file does not exist
* Verify script is accessible and don't copy in check mode
Use shlex to properly split shell arguments, though a path with spaces in it still needs to be quoted in the playbook.
Add note to docs describing such.
Improve error message if file is not found indicating there may be a space in the path.
* Properly encode path now that path is split using shlex
* Allow for spaces in both path and script name
* Add unicode character test to Linux script tests
* Add Linux test for space in path to script
(cherry picked from commit ea3638b580)
If an embedded vaulted variable ('!vault' in yaml)
had an invalid format, it would eventually cause
an error for seemingly unrelated reasons.
"Invalid" meaning not valid hexlify (extra chars,
non-hex chars, etc).
For ex, if a host_vars file had invalid vault format
variables, on py2, it would cause an error like:
'ansible.vars.hostvars.HostVars object' has no
attribute u'broken.example.com'
Depending on where the invalid vault is, it could
also cause "VARIABLE IS NOT DEFINED!". The behavior
can also change if ansible-playbook is py2 or py3.
Root cause is errors from binascii.unhexlify() not
being handled consistently.
Fix is to add a AnsibleVaultFormatError exception and
raise it on any unhexlify() errors and to handle it
properly elsewhere.
Add a _unhexlify() that try/excepts around a binascii.unhexlify()
and raises an AnsibleVaultFormatError on invalid vault data.
This is so the same exception type is always raised for this
case. Previous it was different between py2 and py3.
binascii.unhexlify() raises a binascii.Error if the hexlified
blobs in a vault data blob are invalid.
On py2, binascii.Error is a subclass of Exception.
On py3, binascii.Error is a subclass of TypeError
When decrypting content of vault encrypted variables,
if a binascii.Error is raised it propagates up to
playbook.base.Base.post_validate(). post_validate()
handles exceptions for TypeErrors but not for
base Exception subclasses (like py2 binascii.Error).
* Add a display.warning on vault format errors
* Unit tests for _unhexlify, parse_vaulttext*
* Add intg test cases for invalid vault formats
Fixes#28038
(cherry picked from commit 9c58827410)
Fixes#23263
Add a carriage return (\r) at end on copy config
command which results in prompt on cli terminal
(cherry picked from commit 37b0537279)
Update CHANGELOG.md
* tests for InventoryModule error conditions
* modified unicode in tests to ahear to Ansible best practices
* flake8 fixes
(cherry picked from commit cf938e9992)
* Ensure include_role unit tests check something
This is not the case: get_tasks_vars doesn't yield
* Fix include_role unit tests
Since e609618274, include_role are not
static anymore.
(cherry picked from commit 43914b3837)
* adding the desired state config to the new vrf fixes#32111
* fix default vrf initial configured
* add unit test
* Update CHANGELOG
(cherry picked from commit 2c99cbc874)
* Fix wrong prompt issue for network moodules
Fixes#31161Fixes#32416
* Store the device prompt in case of error
from remote device
* Check for prompt value in ios action plugin
* Add integration test
* Update Changelog
(cherry picked from commit 26583adb58)
* ios_logging: Fix typo in documentation
* ios_logging: Fix traceback when setting buffered destination without size
When the size parameter is not configured while configuring the buffered
destination, a traceback occurs due to the fact that validate_size expects the
parameter to be an int. Explicitely converting value to int makes the
check work for every case.
* ios_logging: Update size parameter documentation
Update the documentation of the size paramter to reflect the current behaviour
of setting a default of 4096 for the buffered dest.
* ios_logging: Add unit test
Add unit test for ios_logging testing the behaviour clarified in the previous
commits.
* ios_logging: Fix python 2.6 compliance
(cherry picked from commit 53fead7c96)
* add static route and hsrp it cases
* add snmp_user and snapshot it
* password strength correction
* fix typo
* add compare snapshot as it is fixed in the code now
* skip snapshot tests for titanium
* titanium and nxapi conditions added
(cherry picked from commit c822292347)
* Replace GigabitEthernet0/0/0/5 for GigabitEthernet0/0/0/2 in iosxr_interface intent tests (#32116)
There's no 5 interface present in CI nodes.
(cherry picked from commit f079a33563)
* Replace Gigabit0/0/0/2 for Gigabit0/0/0/1 on iosxr_interface.intent (#32120)
(cherry picked from commit a9d8157e81)
* Add ansible_ssh_port to iosxr_user auth tests (#32117)
The CI nodes listen on port 8022, we need to plumb that to avoid
test failures.
(cherry picked from commit 676d446cfc)
* Introspect the management IP on ios_ping (#31571)
On our CI we don't have external connectivity, so let's ping to
the management interface IP.
Also, ignore errors on the expected failures tests.
(cherry picked from commit c75c4cbfc8)
* Remove duped authorize on ios_ping anchored tasks (#31572)
Otherwise, we get warnings.
(cherry picked from commit ac95ecaf13)
* Introspect platform before running ios tests
* Add authorize
* Fix quotes on ios_ping test (#32131)
(cherry picked from commit ca115b0a8e)
* Fix lookup source tests on ios_system (#32254)
In IOS-XE, you need to pass an interface to lookup-source, otherwise
it fails with bad syntax.
(cherry picked from commit 4b35793f62)
* Remove ip nameservers on ios_system/set_name_servers teardown (#32239)
Not sure why lookup source-interface, the only thing tested on that
file is adding/removing name servers, no lookup is set.
(cherry picked from commit 9752ce368d)
* fix conflict
* Update CHANGELOG
Signed-off-by: Trishna Guha <trishnaguha17@gmail.com>
* Remove provider from ios integration test (#31037)
* Remove provider from each task as it is not required.
* Add `authorize: yes` whereever required
(cherry picked from commit 65ab37cbd3)
* CHANGELOG entry for ios tests fix
Signed-off-by: Trishna Guha <trishnaguha17@gmail.com>
* [cloud] Bugfix for aws_s3 empty directory creation
Backport of #32169
* Only make DeleteObject call if there are objects to delete
* Remove pauses from integration tests
* Use correct pip version in ansible-test.
* Add git fallback for validate-modules.
* Run sanity tests in a docker container.
* Use correct python version for sanity tests.
* Pin docker completion images and add default.
* Split pylint execution into multiple contexts.
* Only test .py files in use-argspec-type-path test.
* Accept identical python interpeter name or binary.
* Switch cloud tests to default container.
* Remove unused extras from pip install.
* Filter out empty pip commands.
* Don't force running of pip list.
* Support delegation for windows and network tests.
* Fix ansible-test python version usage.
* Fix ansible-test python version skipping.
* Use absolute path for log in ansible-test.
* Run vyos_command test on python 3.
* Fix windows/network instance persistence.
* Add `test/cache` dir to classification.
* Enable more python versions for network tests.
* Fix cs_router test.
(cherry picked from commit cf1337ca9a)
* Add openssh-client to default docker container.
* Include Azure requirements in default container.
To do so, handling of pip requirements was updated to install each
set of requirements separately and then run a verification pass to
make sure there are no conflicts between requirements.
* Add missing --docker-no-pull option.
* Add documentation for the azure-requirements test.
(cherry picked from commit 36b13e3e3d)
* Add nxos_file_copy IT
* Restructure nxos_igmp tests
* add nxos_igmp_interface IT
* add nxos_igmp_snooping IT
* add nxos_ntp_auth IT
* Add nxos_ntp_options IT
* update nxos.yaml with new tests
* update nxos_ntp_options test
* update nxos_ntp_auth IT
(cherry picked from commit ab84718a01)
* better cleanup on task results display
callbacks get 'clean' copy of result objects
moved cleanup into result object itself
removed now redundant callback cleanup
moved no_log tests
* moved import as per feedback
(cherry picked from commit 01b6c7c9c6)
* Correct usage for shutil.rmtree
Fix adds correct usage of shutil.rmtree in git module
Fixes: #31225
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
* Include archive tests so they get run
* Use new include syntax
* Cleanup syntax on git tests
- use multi-line YAML
- remove unneeded {{ }} around vars in conditionals
- remove unneeded quotes
- add task file name to task names for easier troubleshooting when things fail
* Make archive tests work for RHEL/CentOS 6
The older versions of Jinja2 in RHEL/CentOS 6 required assertion tasks using the map filter to be skipped.
The older version of git required gzip compression to be skipped on RHEL/CentOS 6.
* Account for ansible_distribution_major_version missing
(cherry picked from commit a047fe0e4c)
* Fix rollback in junos_config (#31424)
* Fix rollback in junos_config
Fixes#30778
* Call `load_configuration` with rollback id in case
the id is given as input
* Pass rollback id to `get_diff()` to fetch diff from device
* Fix unit test
(cherry picked from commit 88da95bb77)
* Update changelog
* [rpm_key] Fix to import first key on the system
Fixes: #31483
* [rpm_key] removed unsafe_shell and "throwaway" underscore
* [rpm_key] adding test to add the first key on system
(cherry picked from commit 5ccc1072ea)
* Remove sysctl entry when state=absent
* Cleanup sysctl integration test syntax
* Correct grammar on error message
* Add sysctl integration test for state=absent
(cherry picked from commit 2610b521bc)
* Make ansible_selinux facts a consistent type
Rather than returning a bool if the Python library is missing, return a dict with one key containing a message explaining there is no way to tell the status of SELinux on the system becasue the Python library is not present.
* Fix unit test
(cherry picked from commit e7902d888c)
* Add new lines to end of config file lines
* Properly write out selinux config file
Change module behavior to not always report a change but warn if a reboot is needed and return reboot_required.
Improve the output messages.
Add strip parameter to get_file_lines utility to help with parsing the selinux config file.
* Add return documentation
* Add integration tests for selinux module
* Use consistent capitalization for SELinux
* Use atomic_move in selinux module
* Don't copy the config file initially
There's no need to make a copy just for reading.
* Put message after set_config_policy in case the change fails
* Add aliases to selinux tests
(cherry picked from commit 00df1fda10)
* win_become: move error handling to Ansible outside of shell
* trimmed the output so double newlines don't get set
* added test for non-zero exit code
* missed issue URL on test
* changed exit to SetShouldExit
(cherry picked from commit e61c2799ff)
* Update elasticsearch_plugin.py
Change module to work with Elasticsearch 2.x and 5.x automatically.
Update examples and docs.
Supersedes #21989
* Check system paths for elasticsearch-plugin binary
Use get_bin_path from basic.py for searching paths.
* Create a copy of PLUGIN_BIN_PATHS rather than modifying the global
* Use provided plugin_bin path first before trying other places
Change global PLUGIN_BIN_PATHS to a tuple
(cherry picked from commit a5ee865634)
* win_copy: fix for copying encrypted file without pass
* fix pep8 issue
* reduced the diff and fixed some minor issues
(cherry picked from commit bba941cd5b)
In cli.CLI.unfrack_path callback, special case if the
value of '--output' is '-', and avoid expanding
it to a full path.
vault cli already has special cases for '-', so it
just needs to get the original value to work.
Fixes#30550
(cherry picked from commit 278ff19bea)
* Fix fact failures cause by ordering of collectors
Some fact collectors need info collected by other facts.
(for ex, service_mgr needs to know 'ansible_system').
This info is passed to the Collector.collect method via
the 'collected_facts' info.
But, the order the fact collectors were running in is
not a set order, so collectors like service_mgr could
run before the PlatformFactCollect ('ansible_system', etc),
so the 'ansible_system' fact would not exist yet.
Depending on the collector and the deps, this can result
in incorrect behavior and wrong or missing facts.
To make the ordering of the collectors more consistent
and predictable, the code that builds that list is now
driven by the order of collectors in default_collectors.py,
and the rest of the code tries to preserve it.
* Flip the loops when building collector names
iterate over the ordered default_collectors list
selecting them for the final list in order instead
of driving it from the unordered collector_names set.
This lets the list returned by select_collector_classes
to stay in the same order as default_collectors.collectors
For collectors that have implicit deps on other fact collectors,
the default collectors can be ordered to include those early.
* default_collectors.py now uses a handful of sub lists of
collectors that can be ordered in default_collectors.collectors.
fixes#30753fixes#30623
(cherry picked from commit 95abc1d82e)
* Use vault_id when encrypted via vault-edit
On the encryption stage of
'ansible-vault edit --vault-id=someid@passfile somefile',
the vault id was not being passed to encrypt() so the files were
always saved with the default vault id in the 1.1 version format.
When trying to edit that file a second time, also with a --vault-id,
the file would be decrypted with the secret associated with the
provided vault-id, but since the encrypted file had no vault id
in the envelope there would be no match for 'default' secrets.
(Only the --vault-id was included in the potential matches, so
the vault id actually used to decrypt was not).
If that list was empty, there would be an IndexError when trying
to encrypted the changed file. This would result in the displayed
error:
ERROR! Unexpected Exception, this is probably a bug: list index out of range
Fix is two parts:
1) use the vault id when encrypting from edit
2) when matching the secret to use for encrypting after edit,
include the vault id that was used for decryption and not just
the vault id (or lack of vault id) from the envelope.
add unit tests for #30575 and intg tests for 'ansible-vault edit'
Fixes#30575
(cherry picked from commit a14d0f3586)
Allow empty wasn't breaking out of the process_dist_files
loop, so a empty /etc/arch-release would continue searching
and eventually try /etc/os-release. The os-release parsing
works, but the distro name there is 'Arch Linux' which does
not match the 2.3 behavior of 'Archlinux'
Add a OS_RELEASE_ALIAS map for the cases where we need to get
the distro name from os-release but use an alias.
We can't include 'Archlinux' in SEARCH_STRING because a name match on its keys
but without a match on the content causes a fallback to using the first
whitespace seperated item from the file content as the name.
For os-release, that is in form 'NAME=Arch Linux'
With os-release returning the right name, this also supports the
case where there is no /etc/arch-release, but there is a /etc/os-release
Fixes#30600
* pep8 and comment cleanup
(cherry picked from commit 3eab636b3f)
* Fix pkg_mgr fact on OpenBSD
Add a OpenBSDPkgMgrFactCollector that hardcodes pkg_mgr
to 'openbsd_pkg'. The ansible collector will choose the
OpenBSD collector if the system is OpenBSD and the 'Generic'
one otherwise.
This removes PkgMgrFactCollectors depenency on the
'system' fact being in collected_facts, which also
avoids ordering issues (if the pkg mgr fact is collected
before the system fact...)
Fixes#30623
(cherry picked from commit 12404f470a)
* Split ec2_elb_* modules in service of rename/interface changes (#30532)
* Undeprecate ec2_elb_*
* Make ec2_elb* full fledged modules rather than aliases
* Split tests for ec2_elb_lb and elb_classicb_lb
* Change names in documentation of old and new elb modules
Add tests for ec2_elb_lb
* Update CHANGELOG with new status of ec2_elb_* vs. elb_classic_*
* Increase persistent connection local socket
retry timeout to fix intermittent failure in
network integration test
(cherry picked from commit 869cd6f729)
This is to match the 2.3 behavior on:
ansible-vault edit encrypted_file.yml
Previously, the above command would consider that a 'new password'
scenario and prompt accordingly, ie:
$ ansible-vault edit encrypted_file.yml
New Password:
Confirm New Password:
The bug was cause by 'create_new_password' being used for
'edit' action. This also causes the previous implicit 'auto prompt'
to get triggered and prompt the user.
Fix is to make auto prompt explicit in the calling code to handle
the 'edit' case where we want to auto prompt but we do not want
to request a password confirm.
Fixes#30491
(cherry picked from commit 307be59092)
