Issue 1:
The Ansible documentation for modules does not distinguish between modules that are pure modules and modules that have both a plugin and a module part.

After the new rewrite of the internals, where eg. plugins are derived from a base clase rather than being associated with a runner object, the situation can be confusing.

An action plugin will be derived from ActionBase, which has the function _execute_module().

This method will only call the module part of a "module" (terminology could be better), but not invoke the plugin part of the same.

This affects a few plugins. For example the unarchive plugin has a parameter called "copy=yes/no" to transfer files to a remote.

But copying files to a remote is in the plugin part, not in the module part.

So when this runs in a playbook it will do what the user is expecting, but when invoked from a plugin it won't and would fail with "file failed to transfer". This means code already present in unarchive have to be duplicated into the new plugin to action that part, which is illogical and frustrating.

Worse, there is also an issue with a much more basic module - the "stat" plugin.

The "stat" plugin has a parameter called "follow=yes/no" to follow symbolic links.

Again, the logic for that is in module_utils/basic.py, which does not get invoked from a plugin so that particular (and perhaps other parameters) do not function correctly within a plugin context.

In V1 this was solveable, because V1 had two different ways of executing a module. The same as exists now in V2, but there was also a self.runner._executor_internal_inner() which would invoke a module as a plugin, not as a pure remote module. This is now absent in V2 and I have not figured out how to work around that for now.

To conclude, if it is meant to be possible to program plugins for Ansible, then it needs to be clear from a developer perspective what functionality exists in a module which can be invoked from a plugin (this means the documentation needs to state parameters that won't have any effect when running _execute_module()) or there must be another function within eg. ActionBase to invoke other plugins (or some other documented way).

Keeping as it is now creates troubleshooting frustration and API paranoia: "will it do what it says it should or not?"

Issue 2:
From @sdubrul on December 8, 2016 10:49

ISSUE TYPE

Bug Report

COMPONENT NAME

os_security_group_rule

ANSIBLE VERSION

ansible 2.2.0.0

CONFIGURATION

N/A

OS / ENVIRONMENT

macOS 10.12.1

SUMMARY

When logged in as admin and trying to update the default security group rules for this tenant the command fails as there are multiple security groups that are called default. Security group default is found in the admin and services tenant.

STEPS TO REPRODUCE

# clouds.yml
clouds:
mycloud:
auth:
auth_url: https://mycloud:5000/v2.0
username: admin
password: password
project_name: admin

# task in playbook.yml
- name: update default security group to allow ssh
os_security_group_rule:
cloud: mycloud
security_group: default
protocol: tcp
direction: ingress
remote_ip_prefix: 0.0.0.0/0
port_range_min: 22
port_range_max: 22

EXPECTED RESULTS

Expecting the command to update the admin tenant default security group as project name is defined in clouds.yml .

ACTUAL RESULTS

Task fails with:

fatal: [server]: FAILED! => {"changed": false, "failed": true, "msg": "Multiple matches found for default"}

Copied from original issue: ansible/ansible-modules-core#5862