Issue 1:
ISSUE TYPE

Bug Report

ANSIBLE VERSION

ansible 2.1.2.0
config file = /etc/ansible/ansible.cfg
configured module search path = Default w/o overrides

CONFIGURATION

No changes to default ansible.cfg

OS / ENVIRONMENT

Ubuntu

Directory Structure:

devops
ansible
farscape
group_vars
all
qa
qa-ui
inventories
ec2.ini
ec2.py
qa

security
keys
platform
qa
key.pem

qa-ui
ansible
site.yml
roles
qa-ui

SUMMARY

Ansible can't connect to host after upgrading from 2.1.0.0 to 2.1.2.0.

STEPS TO REPRODUCE

site.yml:

- name: Test Ping
hosts: "{{ hosts }}"
gather_facts: no
tags: test
tasks:
- name: Test Ping
ping:

qa group var file:

ansible_ssh_user: ubuntu
ansible_ssh_private_key_file: ../../../security/keys/platform/qa/key.pem

Executed from the devops -> ansible -> farscape directory (see directory structure above):

ansible-playbook -i inventories/ ../../../qa-ui/ansible/site.yml -t test -e "hosts=qa-ui"

EXPECTED RESULTS

Successful connection and ping result.

ACTUAL RESULTS

Using /etc/ansible/ansible.cfg as config file
Loaded callback default of type stdout, v2.0

PLAYBOOK: site.yml *************************************************
2 plays in ../../../qa-ui/ansible/site.yml

PLAY [Test Ping] ***************************************************************

TASK [Test Ping] ***************************************************************
task path: /opt/teamcity-agent/work/56ef8995252d7315/qa-ui/ansible/site.yml:6
<10.2.10.13> ESTABLISH SSH CONNECTION FOR USER: None
<10.2.10.12> ESTABLISH SSH CONNECTION FOR USER: None
<10.2.10.13> SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/ubuntu/.ansible/cp/ansible-ssh-%h-%p-%r 10.2.10.13 '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1477325466.67-100845165082436 `" && echo ansible-tmp-1477325466.67-100845165082436="` echo $HOME/.ansible/tmp/ansible-tmp-1477325466.67-100845165082436 `" ) && sleep 0'"'"''
<10.2.10.12> SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/ubuntu/.ansible/cp/ansible-ssh-%h-%p-%r 10.2.10.12 '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1477325466.67-37577927945882 `" && echo ansible-tmp-1477325466.67-37577927945882="` echo $HOME/.ansible/tmp/ansible-tmp-1477325466.67-37577927945882 `" ) && sleep 0'"'"''
fatal: [10.2.10.13]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh.", "unreachable": true}
fatal: [10.2.10.12]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh.", "unreachable": true}

PLAY RECAP *********************************************************************
10.2.10.12 : ok=0 changed=0 unreachable=1 failed=0
10.2.10.13 : ok=0 changed=0 unreachable=1 failed=0

This error happens across all our ansible tasks after upgrading from 2.1.0.0 to 2.1.2.0.

Issue 2:
ISSUE TYPE

Bug Report

COMPONENT NAME

ec2_group

ANSIBLE VERSION

ansible 2.3.0.0
config file = /home/con5cience/git/Ansible/ansible.cfg
configured module search path = [u'/usr/share/ansible', u'library']
python version = 2.7.13 (default, Jan 12 2017, 17:59:37) [GCC 6.3.1 20161221 (Red Hat 6.3.1-1)]

CONFIGURATION

[defaults]
inventory=inventory
library=/usr/share/ansible:library
roles_path=roles
vault_password_file = vault_pass
forks=20
ask_sudo_pass=yes
nocows=0
cow_selection = random
host_key_checking = False

[ssh_connection]
pipelining=True
ssh_args = -o ForwardAgent=yes -o ControlMaster=auto -o ControlPersist=30m
control_path = ~/.ssh/ansible-%%r@%%h:%%p

OS / ENVIRONMENT

From: Fedora 25

To: Amazon EC2 API

SUMMARY

Managing the rules of EC2 security groups using the ec2_group module is not idempotent.

STEPS TO REPRODUCE

Use Ansible to configure a security group and add rules to the group.

Run Ansible again.

ec2_group:
name: "{{ security_group_name|default( inventory_hostname ~ '-' ~ env ~ '-security-group' ) }}"
description: "{{ security_group_name|default( inventory_hostname ~ '-' ~ env ~ 'Security Group' ) }}"
vpc_id: "{{ ec2_vpc_id }}"
region: "{{ ec2_region }}"
rules: "{{ common_rules_ingress + rules_ingress }}"
rules_egress: "{{ common_rules_egress + rules_egress }}"
delegate_to: localhost

Where common_rules_ingress, common_rules_egress, rules_ingress, and rules_egress are lists of port rules in the style of:

- proto: tcp
from_port: 443
to_port: 443
cidr_ip: 0.0.0.0/0

- proto: tcp
from_port: 80
to_port: 80
cidr_ip: 0.0.0.0/0

EXPECTED RESULTS

Task exits with 0 and playbook continues if the rule already exists and no changes are made.

ACTUAL RESULTS

Task exits with 1 (or 2, not entirely sure) and playbook run immediately bails when a rule already exists and no changes are made.

The full traceback is:
Traceback (most recent call last):
File "/tmp/ansible_em0SmM/ansible_module_ec2_group.py", line 487, in <module>
main()
File "/tmp/ansible_em0SmM/ansible_module_ec2_group.py", line 439, in main
cidr_ip=thisip)
File "/usr/lib/python2.7/site-packages/boto/ec2/connection.py", line 3245, in authorize_security_group_egress
params, verb='POST')
File "/usr/lib/python2.7/site-packages/boto/connection.py", line 1227, in get_status
raise self.ResponseError(response.status, response.reason, body)
boto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request
<?xml version="1.0" encoding="UTF-8"?>
<Response><Errors><Error><Code>InvalidPermission.Duplicate</Code><Message>the specified rule "peer: 0.0.0.0/0, TCP, from port: 443, to port: 443, ALLOW" already exists</Message></Error></Errors><RequestID>871be7ab-957c-4c41-8982-706e7a5dc64c</RequestID></Response>

fatal: [remotehost -> localhost]: FAILED! => {
"changed": false,
"failed": true,
"module_stderr": "Traceback (most recent call last):\n File \"/tmp/ansible_em0SmM/ansible_module_ec2_group.py\", line 487, in <module>\n main()\n File \"/tmp/ansible_em0SmM/ansible_module_ec2_group.py\", line 439, in main\n cidr_ip=thisip)\n File \"/usr/lib/python2.7/site-packages/boto/ec2/connection.py\", line 3245, in authorize_security_group_egress\n params, verb='POST')\n File \"/usr/lib/python2.7/site-packages/boto/connection.py\", line 1227, in get_status\n raise self.ResponseError(response.status, response.reason, body)\nboto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Response><Errors><Error><Code>InvalidPermission.Duplicate</Code><Message>the specified rule \"peer: 0.0.0.0/0, TCP, from port: 443, to port: 443, ALLOW\" already exists</Message></Error></Errors><RequestID>871be7ab-957c-4c41-8982-706e7a5dc64c</RequestID></Response>\n",
"module_stdout": "",
"msg": "MODULE FAILURE",
"rc": 1
}

See also:

#5643 (arbitrarily closed)

ansible/ansible-modules-core#2576 (open but in locked repo)