Issue 1:
$ ansible --version
1.4.4
$ ansible-playbook ec2_security.yml -i hosts

PLAY [127.0.0.1] **************************************************************

GATHERING FACTS ***************************************************************
ok: [127.0.0.1]

TASK: [Create EC2 web group] **************************************************
failed: [127.0.0.1] => {"failed": true, "parsed": false}
invalid output was: Traceback (most recent call last):
File "/Users/user/.ansible/tmp/ansible-1390492978.4-106406911676238/ec2_group", line 1313, in <module>
main()
File "/Users/user/.ansible/tmp/ansible-1390492978.4-106406911676238/ec2_group", line 192, in main
group = ec2.create_security_group(name, description, vpc_id=vpc_id)
File "/usr/local/Cellar/python/2.7.6/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/boto/ec2/connection.py", line 2948, in create_security_group
SecurityGroup, verb='POST')
File "/usr/local/Cellar/python/2.7.6/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/boto/connection.py", line 1151, in get_object
raise self.ResponseError(response.status, response.reason, body)
boto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request
<?xml version="1.0" encoding="UTF-8"?>
<Response><Errors><Error><Code>InvalidGroup.Duplicate</Code><Message>The security group 'web' already exists for VPC 'vpc-[REDACTED]'</Message></Error></Errors><RequestID>[REDACTED]</RequestID></Response>

FATAL: all hosts have already failed -- aborting

PLAY RECAP ********************************************************************
to retry, use: --limit @/Users/user/ec2_security.retry

127.0.0.1 : ok=1 changed=0 unreachable=0 failed=1

Hosts file:

[localhost]
127.0.0.1 ansible_python_interpreter=/usr/local/bin/python

ec2_security.yml:

- hosts: 127.0.0.1
connection: local
tasks:
- name: Create EC2 web group
local_action:
module: ec2_group
name: web
description: HTTP and SSH ports
region: eu-west-1
rules:
- proto: tcp
from_port: 80
to_port: 80
cidr_ip: 0.0.0.0/0
- proto: tcp
from_port: 22
to_port: 22
cidr_ip: 0.0.0.0/0

Issue 2:
ISSUE TYPE

Bug Report

COMPONENT NAME

ssh

ANSIBLE VERSION

ansible --version
ansible 2.4.0.0
config file = /etc/ansible/ansible.cfg
configured module search path = [u'/home/jenkins/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python2.7/dist-packages/ansible
executable location = /usr/bin/ansible
python version = 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609]

CONFIGURATION

ALLOW_WORLD_READABLE_TMPFILES(/etc/ansible/ansible.cfg) = True
ANSIBLE_SSH_ARGS(/etc/ansible/ansible.cfg) = -C -o ControlMaster=auto -o ControlPersist=60s -o ForwardAgent=yes
ANSIBLE_SSH_CONTROL_PATH(/etc/ansible/ansible.cfg) = %(directory)s/%%h-%%r
ANSIBLE_SSH_PIPELINING(/etc/ansible/ansible.cfg) = True
DEFAULT_FORKS(/etc/ansible/ansible.cfg) = 50
DEFAULT_TIMEOUT(/etc/ansible/ansible.cfg) = 30

OS / ENVIRONMENT

Ubuntu 16.04 -> Ubuntu 16.04

SUMMARY

I used to use ansible $target -m setup --ssh-common-args="-O exit" to terminate a ControlPersist connection. This stops working in ansible 2.4

I'm doing this so I can switch ssh agents in a deployment script.

STEPS TO REPRODUCE

This has very different behaviour between 2.3 & 2.4:

ssh-agent bash -c "ssh-add ~/.ssh/id_ed25519 && ansible myhost -m shell -a 'ssh-add -l'"
ansible myhost -m setup --ssh-common-args="-O exit"
ssh-agent bash -c "ssh-add ~/.ssh/id_rsa && ansible myhost -m shell -a 'ssh-add -l'"

EXPECTED RESULTS

In 2.3, the second command fails with UNREACHABLE, which is expected because we asked it to close the connection. The first line and the third line report signatures of different keys.

ACTUAL RESULTS

In ansible 2.4, the second command succeeds, surprisingly, and then the third command fails with "error fetching identities" because the ssh-add -l is trying to connect to the ssh-agent in the first line, which has exited.