Issue 1:
ISSUE TYPE

Bug Report

COMPONENT NAME

ec2_group

ANSIBLE VERSION

ansible 2.4.2.0
config file = /home/jwitkowski/throtle-ansible/ansible.cfg
configured module search path = [u'/home/jwitkowski/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
ansible python module location = /home/jwitkowski/throtle-ansible-venv/lib/python2.7/site-packages/ansible
executable location = /home/jwitkowski/throtle-ansible-venv/bin/ansible
python version = 2.7.5 (default, Aug 4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]

CONFIGURATION

(throtle-ansible-venv) [jwitkowski@dmpprod-ss1 throtle-ansible]$ ansible-config dump --only-changed
ANSIBLE_PIPELINING(/home/jwitkowski/throtle-ansible/ansible.cfg) = True
ANSIBLE_SSH_ARGS(/home/jwitkowski/throtle-ansible/ansible.cfg) = -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ForwardAgent=yes
DEFAULT_CALLBACK_PLUGIN_PATH(/home/jwitkowski/throtle-ansible/ansible.cfg) = [u'/home/jwitkowski/throtle-ansible/library/callback']
DEFAULT_FILTER_PLUGIN_PATH(/home/jwitkowski/throtle-ansible/ansible.cfg) = [u'/usr/share/ansible_plugins/filter_plugins', u'/home/jwitkowski/throtle-ansible/library/plugins']
DEFAULT_FORKS(/home/jwitkowski/throtle-ansible/ansible.cfg) = 15
DEFAULT_GATHERING(/home/jwitkowski/throtle-ansible/ansible.cfg) = smart
DEFAULT_GATHER_SUBSET(/home/jwitkowski/throtle-ansible/ansible.cfg) = !hardware,!ohai,!facter
DEFAULT_HOST_LIST(/home/jwitkowski/throtle-ansible/ansible.cfg) = [u'/home/jwitkowski/throtle-ansible/inventory']
DEFAULT_MANAGED_STR(/home/jwitkowski/throtle-ansible/ansible.cfg) = Created by Ansible
DEFAULT_PRIVATE_KEY_FILE(/home/jwitkowski/throtle-ansible/ansible.cfg) = /home/jwitkowski/.ssh/throtle-ansible.key
DEFAULT_REMOTE_TMP(/home/jwitkowski/throtle-ansible/ansible.cfg) = /tmp/ansible-$USER/tmp
DEFAULT_ROLES_PATH(/home/jwitkowski/throtle-ansible/ansible.cfg) = [u'/home/jwitkowski/throtle-ansible/roles']
DEFAULT_SCP_IF_SSH(/home/jwitkowski/throtle-ansible/ansible.cfg) = True
DEFAULT_VAULT_PASSWORD_FILE(/home/jwitkowski/throtle-ansible/ansible.cfg) = /home/jwitkowski/throtle-ansible/.vault
DISPLAY_ARGS_TO_STDOUT(/home/jwitkowski/throtle-ansible/ansible.cfg) = True
HOST_KEY_CHECKING(/home/jwitkowski/throtle-ansible/ansible.cfg) = False
RETRY_FILES_SAVE_PATH(/home/jwitkowski/throtle-ansible/ansible.cfg) = /home/jwitkowski/.ansible/retry-files

OS / ENVIRONMENT

N/A

SUMMARY

I have a large YAML file that defines lists of dictionaries that contain my AWS security groups. I also have a playbook which loops over these lists and creates security groups from them. Sometimes when running the playbook I will receive the following error:

An exception occurred during task execution. To see the full traceback,
use -vvv. The error was:botocore.exceptions.ClientError:An error occurred (InvalidGroup.Duplicate) when calling the CreateSecurityGroup operation:The security group 'prod-sftp-instance' already exists for VPC 'vpc-39c8235f'
failed:[
localhost
](item=nsq) =>{
"changed":false,
"item":"nsq",
"module_stderr":"Traceback (most recent call last):
File \"/tmp/ansible_2VDh2N/ansible_module_ec2_group.py\", line 899, in <module>
main()
File \"/tmp/ansible_2VDh2N/ansible_module_ec2_group.py\", line 742, in main
group, groups, vpc_id)
File \"/tmp/ansible_2VDh2N/ansible_module_ec2_group.py\", line 406, in get_target_from_rule
auto_group = client.create_security_group(**params)
File \"/home/jwitkowski/throtle-ansible-venv/lib/python2.7/site-packages/botocore/client.py\", line 317, in _api_call
return self._make_api_call(operation_name, kwargs)\n File \"/home/jwitkowski/throtle-ansible-venv/lib/python2.7/site-packages/botocore/client.py\", line 615, in _make_api_call
raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (InvalidGroup.Duplicate) when calling the CreateSecurityGroup operation: The security group 'prod-sftp-instance' already exists for VPC 'vpc-39c8235f'",
"module_stdout":"",
"msg":"MODULE FAILURE",
"rc":1
}

This typically happens when a ec2_group module is attempting to create an "empty" group from the group_name: parameter when fed a list of groups. The above is an example of just that where the group being created is "prod-nsq-instance" but it has a group_name: dependency on "prod-sftp-instance", which already exists. If I run the playbook a second time with no modifications it typically passes no problem.

STEPS TO REPRODUCE

vars/security_groups.yml:

sg_nsq_rules:
- proto: tcp
ports:
- 4150
- 4160
- 4170-4171
group_name:
- "{{ deploy_env }}-nsq-instance"
- "{{ deploy_env }}-sftp-instance"
group_desc: "{{ ansible_managed }}"
- proto: tcp
ports:
- 9117-9118 #NSQ and CAdvisor exporters
group_name: "{{ deploy_env }}-prometheus-instance"
group_desc: "{{ ansible_managed }}"

sg_sftp_rules:
- proto: tcp
ports: 22 #Global SFTP Allow
cidr_ip: 0.0.0.0/0
- proto: tcp
ports:
- 8301 #Consul Port
- 8400 #Consul Port
- 8500 #Consul Port
- 8600 #Consul Port
group_name:
- "{{ deploy_env }}-mongors-instance"
- "{{ deploy_env }}-mongoconfig-instance"
- "{{ deploy_env }}-uiapp-instance"
group_desc: "{{ ansible_managed }}"

sg_prometheus_rules:
- proto: tcp
ports:
- 25 #SMTP
- 80 #Webserver for nagios
- 443 #Webserver for nagios
- 6783 #Alert manager data port
- 8081 #Grafana HTTP Server
- 9090 #Query webserver for prometheus
- 9093 #Alert Manager http port
cidr_ip: "{{vpc_cidr_block}}"

sg_ec2_instances:
sg_nsq_ec2: "{{ sg_common }} + {{ sg_nsq_rules }}"
sg_sftp_ec2: "{{ sg_common }} + {{ sg_sftp_rules }}"

vars/deploy_env/test.yml

sg_ec2s:
- "sftp"
- "nsq"

build_sec_group.yml playbook:

- hosts: localhost
gather_facts: False
vars_files:
- "vars/security_groups.yml"
- "vars/deploy_envs/test.yml"
tasks:
- name: Create EC2 Security groups
ec2_group:
name: "{{ display_env|default(deploy_env) }}-{{ item }}-instance"
description: "{{ ansible_managed }}"
vpc_id: "{{ vpc_id }}"
region: "{{ region }}"
rules: "{{ sg_ec2_instances['sg_' + item + '_ec2'] }}"
tags:
Name: "{{ display_env|default(deploy_env) }}-{{ item }}-instance"
Environment: "{{ display_env|default(deploy_env) }}"
with_items: "{{ sg_ec2s }}"
when: group_tag is not defined or (group_tag is defined and group_tag == item)
tags:
- "ec2_instance"

Run the above setup a few times and you'll eventually hit the error.

EXPECTED RESULTS

The playbook should run each time idempotently and never cause this error.

ACTUAL RESULTS

The error above appears intermittently and works sometimes without changing any code.

Issue 2:
Trying to register multiple variables in YAML array syntax:

kk:playbooks kris$ cat p.yml

# vim:ft=ansible:

- hosts: server

user: root

tasks:
- name: test something
command: echo test
register:
- a
- b

- debug: var=a

- debug: var=b

This explodes:

kk:playbooks kris$ ansible-playbook p.yml

PLAY [server] *****************************************************************

TASK: [test something] ********************************************************
changed: [server]
Traceback (most recent call last):
File "/usr/local/Cellar/ansible/1.9.3/libexec/bin/ansible-playbook", line 324, in <module>
sys.exit(main(sys.argv[1:]))
File "/usr/local/Cellar/ansible/1.9.3/libexec/bin/ansible-playbook", line 264, in main
pb.run()
File "/usr/local/Cellar/ansible/1.9.3/libexec/lib/python2.7/site-packages/ansible/playbook/__init__.py", line 348, in run
if not self._run_play(play):
File "/usr/local/Cellar/ansible/1.9.3/libexec/lib/python2.7/site-packages/ansible/playbook/__init__.py", line 789, in _run_play
if not self._run_task(play, task, False):
File "/usr/local/Cellar/ansible/1.9.3/libexec/lib/python2.7/site-packages/ansible/playbook/__init__.py", line 540, in _run_task
_register_play_vars(host, result)
File "/usr/local/Cellar/ansible/1.9.3/libexec/lib/python2.7/site-packages/ansible/playbook/__init__.py", line 514, in _register_play_vars
utils.update_hash(self.VARS_CACHE, host, {task.register: result})
TypeError: unhashable type: 'list'

It is the type that makes it explode, that is

register: [ a ]

is already sufficient to make it blow.

kk:playbooks kris$ cat q.yml
# vim:ft=ansible:
- hosts: server
user: root

tasks:
- name: test something
command: echo test
notify:
- one
- two

handlers:
- name: one
command: echo one

- name: two
command: echo two

works just as expected, so I'd expect duplicating the parameter handling from handlers in register would fix the problem.

Related to #12364