Issue 1:
ISSUE TYPE

Feature Idea

COMPONENT NAME

Windows

ANSIBLE VERSION

v2.5

SUMMARY

Much like sudo on Unix, it would be nice to be able to run modules as any user (from an Administrator account) without the need to use passwords (which you may not know). When managing multi-user systems this is a necessity in order to manage configuration items of user environments.

This is a continuation of #34214

Issue 2:
ISSUE TYPE

Bug Report

COMPONENT NAME

core

ANSIBLE VERSION

ansible 2.3.0.0
config file =
configured module search path = Default w/o overrides
python version = 2.7.13 (default, Jan 19 2017, 14:48:08) [GCC 6.3.0 20170118]

CONFIGURATION

N/A

OS / ENVIRONMENT

N/A

SUMMARY

Ansible 2.3 shows failures like

fatal: [bolagsfakta-debian.pov.lt]: FAILED! => {"failed": true, "msg": "the field 'args' has an invalid value, which appears to include a variable that is undefined. The error was: 'actual_accounts' is undefined\n\nThe error appears to have been in '/home/mg/src/tilaajavastuu/bolagsfakta/deployment/roles/users/tasks/main.yml': line 38, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: compare the account lists\n ^ here\n"}
fatal: [bolagsfakta-debian.pov.lt]: FAILED! => {"failed": true, "msg": "the field 'args' has an invalid value, which appears to include a variable that is undefined. The error was: 'actual_accounts' is undefined\n\nThe error appears to have been in '/home/mg/src/tilaajavastuu/bolagsfakta/deployment/roles/users/tasks/main.yml': line 38, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: compare the account lists\n ^ here\n"}

for a playbook that worked fine in 2.2. This happens only when the host in question is duplicated in the inventory.

The playbook itself looks like this:

---
- name: user accounts for sysadmins
user: name={{ item }} state=present
with_items: "{{ admin_users }}"

# two tasks skipped here for conciseness:
# - name: authorized keys for sysadmins
# - name: sudo rights for sysadmins

- name: list user accounts
command: "awk -F: '$3 >\\= 1000 && $3 < 65534 { print $1 }' /etc/passwd"
register: list_users_result
check_mode: no
changed_when: false

- name: prepare a list of expected user accounts
set_fact:
actual_accounts: "{{ list_users_result.stdout_lines|sort }}"
expected_accounts: "{{ admin_users|sort }}"

- name: compare the account lists
set_fact:
unexpected_accounts: "{{ actual_accounts|difference(expected_accounts) }}"
missing_accounts: "{{ expected_accounts|difference(actual_accounts) }}"

- name: show unexpected accounts
debug: var=unexpected_accounts
when: unexpected_accounts

- name: show missing accounts
debug: var=missing_accounts
when: missing_accounts

- name: check user accounts
assert:
that: "expected_accounts == actual_accounts"

You can see that the variable Ansible claims is undefined (actual_accounts) is defined by a set_fact task before it is used.

A curious thing is that the error shows up while executing an earlier task:

PLAY [all] *********************************************************************

TASK [users : user accounts for sysadmins] *************************************
...
TASK [users : authorized keys for sysadmins] ***********************************
...
TASK [users : sudo rights for sysadmins] ***************************************
fatal: [bolagsfakta-debian.pov.lt]: FAILED! => {"failed": true, "msg": "the field 'args' has an invalid value, which appears to include a variable that is undefined. The error was: 'actual_accounts' is undefined\n\nThe error appears to have been in '/home/mg/src/tilaajavastuu/bolagsfakta/deployment/roles/users/tasks/main.yml': line 38, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: compare the account lists\n ^ here\n"}
...
fatal: [bolagsfakta-debian.pov.lt]: FAILED! => {"failed": true, "msg": "the field 'args' has an invalid value, which appears to include a variable that is undefined. The error was: 'actual_accounts' is undefined\n\nThe error appears to have been in '/home/mg/src/tilaajavastuu/bolagsfakta/deployment/roles/users/tasks/main.yml': line 38, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: compare the account lists\n ^ here\n"}
..

It is also noteworthy that each task shows it is being executed on bolagsfakta-debian.pov.lt twice.

Now, why do I have the host twice in my inventory and why can't I remove one of the copies? This gets complicated:

there are several environments (dev, test, prod)

every developer can run ansible on the dev environment, but only some ops people have access to prod

there's a vault file with encrypted secrets needed for prod, but developers don't know the password

to allow developers use ansible we must let them run with an inventory file that doesn't include the hosts/groups that have the encrypted vault file under group_vars/prod

ops people want to run ansible (usually in check mode) over all the environments in one run

The solution we came up with was to create a directory env with one inventory file per environment.

This way developers can run ansible-playbook -i env/dev playbook.yml and do their deployments.

Ops people can run things like ansible-playbook -i env/prod --ask-vault-password playbook.yml to deploy to one environment, or ansible-playbook -i env --ask-vault-password playbook.yml -C to compare the playbook with reality across all the environments in one go.

The bolagsfakta-debian host needs to be defined both in env/dev and in env/prod, because both need to delegate some tasks to it. This leads to duplication when using ansible-playbook -i env, which resulted in this bug report.

STEPS TO REPRODUCE

mention a host twice in the inventory

define a variable using set_fact

use that variable in the following task