Issue 1:
ISSUE TYPE

Bug Report

COMPONENT NAME

ec2_group

ANSIBLE VERSION

ansible 2.2.1.0
config file = /etc/ansible/ansible.cfg
configured module search path = Default w/o overrides

(but code review suggests that later versions likely also susceptible)

CONFIGURATION

n/a

OS / ENVIRONMENT

n/a

SUMMARY

A playbook using an ec2_group module with a rule whose cidr_ip value has any host bits set will execute successfully at most once, but will fail to execute thereafter.

STEPS TO REPRODUCE

- hosts: localhost
tasks:
- name: Test case
ec2_group:
description: Test SG
name: Test SG
region: us-east-1
rules: [{proto: all, cidr_ip: '10.0.0.1/8'}]
rules_egress: [{proto: all, cidr_ip: '0.0.0.0/0'}]
vpc_id: FIXME
connection: local
become: false
gather_facts: false

(replace vpc_id, and maybe region, as applicable)

EXPECTED RESULTS

Preferably the rule's validation should fail entirely every time.

Alternatively, the CIDR could be sanitized by Ansible at run-time before it compares the configured rules with the ones currently active in AWS.

ACTUAL RESULTS

Initial run executes fine; the rule is created on the security group, however the CIDR is masked so that only the network bits are set (ie 10.0.0.0/8). Thus what shows up in AWS is slightly different than what the user requested, but it works (at least for the first time).

Subsequent runs, however, will all fail with this error:

Traceback (most recent call last):
File "/tmp/ansible_y6BGXK/ansible_module_ec2_group.py", line 478, in <module>
main()
File "/tmp/ansible_y6BGXK/ansible_module_ec2_group.py", line 373, in main
group.authorize(rule['proto'], rule['from_port'], rule['to_port'], thisip, grantGroup)
File "/usr/lib/python2.7/dist-packages/boto/ec2/securitygroup.py", line 203, in authorize
dry_run=dry_run)
File "/usr/lib/python2.7/dist-packages/boto/ec2/connection.py", line 3192, in authorize_security_group
params, verb='POST')
File "/usr/lib/python2.7/dist-packages/boto/connection.py", line 1223, in get_status
raise self.ResponseError(response.status, response.reason, body)
boto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request
<?xml version="1.0" encoding="UTF-8"?>
<Response><Errors><Error><Code>InvalidPermission.Duplicate</Code><Message>the specified rule "peer: 10.0.0.0/8, ALL, ALLOW" already exists</Message></Error></Errors><RequestID>963c0e1b-bcdb-4ab3-815a-89c7ce1b2204</RequestID></Response>

fatal: [localhost]: FAILED! => {
"changed": false,
"failed": true,
"invocation": {
"module_name": "ec2_group"
},
"module_stderr": "Traceback (most recent call last):\n File \"/tmp/ansible_y6BGXK/ansible_module_ec2_group.py\", line 478, in <module>\n main()\n File \"/tmp/ansible_y6BGXK/ansible_module_ec2_group.py\", line 373, in main\n group.authorize(rule['proto'], rule['from_port'], rule['to_port'], thisip, grantGroup)\n File \"/usr/lib/python2.7/dist-packages/boto/ec2/securitygroup.py\", line 203, in authorize\n dry_run=dry_run)\n File \"/usr/lib/python2.7/dist-packages/boto/ec2/connection.py\", line 3192, in authorize_security_group\n params, verb='POST')\n File \"/usr/lib/python2.7/dist-packages/boto/connection.py\", line 1223, in get_status\n raise self.ResponseError(response.status, response.reason, body)\nboto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Response><Errors><Error><Code>InvalidPermission.Duplicate</Code><Message>the specified rule \"peer: 10.0.0.0/8, ALL, ALLOW\" already exists</Message></Error></Errors><RequestID>963c0e1b-bcdb-4ab3-815a-89c7ce1b2204</RequestID></Response>\n",
"module_stdout": "",
"msg": "MODULE FAILURE"
}

Issue 2:
Issue Type: Bug Report

Component: core

Ansible Version:

ansible 2.0.0.2
config file =
configured module search path = Default w/o overrides

Ansible Configuration:

n/a

Environment:

python==2.7.10

osx==10.10.5

Summary:

Role dependencies are run more than once.

Steps To Reproduce:

here are my files:

# inventory
localhost

# play.yml

---
- name: dependency test with role tags
hosts: localhost
connection: local

roles:
- role: base
tags:
- always

- role: feature
tags:
- always

# roles/base/meta/main.yml

---
allow_duplicates: no

# roles/base/tasks/main.yml

---
- name: base role
debug:
msg: base role

# roles/feature/meta/main.yml

---
allow_duplicates: no
dependencies:
- role: base
tags:
- always

# roles/feature/tasks/main.yml

---
- name: feature role
debug:
msg: feature role

I call it with:

ansible-playbook -i inventory play.yml --list-tasks

Expected Results:

The base role is executed once.

Using ansible==1.9.4 the play works as expected:

playbook: play.yml

play #1 (dependency test with role tags): TAGS: []
base role TAGS: [always]
feature role TAGS: [always]

Actual Results:

The base role is executed twice.

playbook: play.yml

play #1 (localhost): dependency test with role tags TAGS: []
tasks:
base : base role TAGS: [always]
base : base role TAGS: [always]
feature : feature role TAGS: [always]