Repository: ansible-collections/community.vmware

Issue:
vmware_guest_boot_manager changed default secure_boot_enabled value
<!--- Verify first that your issue is not already reported on GitHub -->
<!--- Also test if the latest release and devel branch are affected too -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
<!--- Explain the problem briefly below -->

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
<!--- Write the short name of the module, plugin, task or feature below, use your best guess if unsure -->

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
```paste below
"ansible [core 2.12.1]",
        "  config file = /root/ansible-vsphere-gos-validation/ansible.cfg",
        "  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']",
        "  ansible python module location = /usr/lib/python3.9/site-packages/ansible",
        "  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections",
        "  executable location = /usr/bin/ansible",
        "  python version = 3.9.1 (default, Aug 19 2021, 02:58:42) [GCC 10.2.0]",
        "  jinja version = 3.0.1",
        "  libyaml = True"
```

##### COLLECTION VERSION
<!--- Paste verbatim output from "ansible-galaxy collection list <namespace>.<collection>"  between the quotes
for example: ansible-galaxy collection list community.general
-->
```paste below
"Collection        Version",
        "----------------- -------",
        "ansible.netcommon 2.5.0  ",
        "ansible.posix     1.3.0  ",
        "ansible.utils     2.4.3  ",
        "ansible.windows   1.9.0  ",
        "community.crypto  2.1.0  ",
        "community.general 4.3.0  ",
        "community.vmware  2.1.0  ",
        "community.windows 1.9.0  "
```

##### CONFIGURATION
<!--- Paste verbatim output from "ansible-config dump --only-changed" between quotes -->
```paste below
        "CALLBACKS_ENABLED(/home/worker/workspace/Ansible_Regression_Windows_11_64/ansible-vsphere-gos-validation/ansible.cfg) = ['timer']",
        "DEFAULT_CALLBACK_PLUGIN_PATH(/home/worker/workspace/Ansible_Regression_Windows_11_64/ansible-vsphere-gos-validation/ansible.cfg) = ['/home/worker/workspace/Ansible_Regression_Windows_11_64/ansible-vsphere-gos-validation/plugin']",
        "DISPLAY_SKIPPED_HOSTS(/home/worker/workspace/Ansible_Regression_Windows_11_64/ansible-vsphere-gos-validation/ansible.cfg) = False",
        "RETRY_FILES_ENABLED(/home/worker/workspace/Ansible_Regression_Windows_11_64/ansible-vsphere-gos-validation/ansible.cfg) = False"
```

##### OS / ENVIRONMENT
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->


##### STEPS TO REPRODUCE
<!--- Describe exactly how to reproduce the problem, using a minimal test-case -->

<!--- Paste example playbooks or commands between quotes below -->
```yaml
- hosts: localhost
  vars:
    vsphere_host_name: 
    vsphere_host_user: 
    vsphere_host_user_password:
    vm_name: 
  tasks:
    - name: Get VM boot facts before boot option changing
      vmware_guest_boot_info:
        validate_certs: False
        hostname: "{{ vsphere_host_name }}"
        username: "{{ vsphere_host_user }}"
        password: "{{ vsphere_host_user_password }}"
        name: "{{ vm_name }}"
      register: boot_facts_before_update

    - name: Display the VM boot options
      debug: var=boot_facts_before_update

    - name: Set VM boot options
      vmware_guest_boot_manager:
        validate_certs: False
        hostname: "{{ vsphere_host_name }}"
        username: "{{ vsphere_host_user }}"
        password: "{{ vsphere_host_user_password }}"
        name: "{{ vm_name }}"
        enter_bios_setup: True
      register: set_boot_opts

    - name: Display set boot options result
      debug: var=set_boot_opts
    
    - name: Get VM boot facts after boot option changing
      vmware_guest_boot_info:
        validate_certs: False
        hostname: "{{ vsphere_host_name }}"
        username: "{{ vsphere_host_user }}"
        password: "{{ vsphere_host_user_password }}"
        name: "{{ vm_name }}"
      register: boot_facts_after_update

    - name: Display the VM boot options
      debug: var=boot_facts_after_update
```

output:
```
PLAY [localhost] *******************************************************************************************************

TASK [Gathering Facts] *************************************************************************************************
ok: [localhost]

TASK [Get VM boot facts after boot option changing] ********************************************************************
ok: [localhost]

TASK [Display the VM boot options] *************************************************************************************
ok: [localhost] => {
    "boot_facts_before_update": {
        "changed": false,
        "failed": false,
        "vm_boot_info": {
            "current_boot_delay": 0,
            "current_boot_firmware": "efi",
            "current_boot_order": [],
            "current_boot_retry_delay": 10000,
            "current_boot_retry_enabled": false,
            "current_enter_bios_setup": false,
            "current_secure_boot_enabled": true
        }
    }
}

TASK [Set VM boot options] *********************************************************************************************
changed: [localhost]

TASK [Display set boot options result] *********************************************************************************
ok: [localhost] => {
    "set_boot_opts": {
        "changed": true,
        "failed": false,
        "vm_boot_status": {
            "current_boot_delay": 0,
            "current_boot_firmware": "efi",
            "current_boot_order": [],
            "current_boot_retry_delay": 0,
            "current_boot_retry_enabled": true,
            "current_enter_bios_setup": true,
            "current_secure_boot_enabled": false,
            "previous_boot_delay": 0,
            "previous_boot_firmware": "efi",
            "previous_boot_order": [],
            "previous_boot_retry_delay": 10000,
            "previous_boot_retry_enabled": false,
            "previous_enter_bios_setup": false,
            "previous_secure_boot_enabled": true
        }
    }
}

TASK [Get VM boot facts after boot option changing] ********************************************************************
ok: [localhost]

TASK [Display the VM boot options] *************************************************************************************
ok: [localhost] => {
    "boot_facts_after_update": {
        "changed": false,
        "failed": false,
        "vm_boot_info": {
            "current_boot_delay": 0,
            "current_boot_firmware": "efi",
            "current_boot_order": [],
            "current_boot_retry_delay": 0,
            "current_boot_retry_enabled": true,
            "current_enter_bios_setup": true,
            "current_secure_boot_enabled": false
        }
    }
}

```

<!--- HINT: You can paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- Describe what you expected to happen when running the steps above -->
After changing boot option enter_bios_setup with true, current_secure_boot_enabled should still be true.

##### ACTUAL RESULTS
<!--- Describe what actually happened. If possible run with extra verbosity (-vvvv) -->
After changing boot option enter_bios_setup with true, current_secure_boot_enabled became false.

<!--- Paste verbatim command output between quotes -->
```paste below

```



Discussion:
Files identified in the description:
None

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
I don't think this is a bug. The default for `secure_boot_enabled` is `False`. If you don't set this to `True` the module works as intended (and documented) and disables secure boot.

So I suggest you either close this issue or change it to a feature request to _not_ have a default for `secure_boot_enabled`.

I think there might be good reasons to not have a default for this. But I'm afraid changing this might break existing playbooks. So we would wait with this until version 3 of the collection.

What do you say, could you live with `False` as the default for `secure_boot_enabled` or should we change this in version 3?
Hi @mariolenz, thanks for your response.

For a VM with secureboot enabled before making changes to boot options, in this case,
```
"current_secure_boot_enabled": true
```
I think it is better to leave it as what it is when vmware_guest_boot_manager has no secure_boot_enabled set, and changing other boot option shouldn't change current_secure_boot_enabled meanwhile.


> I think it is better to leave it as what it is when vmware_guest_boot_manager has no secure_boot_enabled set, and changing other boot option shouldn't change current_secure_boot_enabled meanwhile.

I agree. But as I've said, I don't think we'll change this within 2.x.

I've added your issue to the [3.0.0 milestone](https://github.com/ansible-collections/community.vmware/milestone/14) so we don't forget.
Thank you, @mariolenz. 

Resolving patch:
diff --git a/plugins/modules/vmware_guest_boot_manager.py b/plugins/modules/vmware_guest_boot_manager.py
--- a/plugins/modules/vmware_guest_boot_manager.py
+++ b/plugins/modules/vmware_guest_boot_manager.py
@@ -83,7 +83,6 @@
      description:
      - Choose if EFI secure boot should be enabled.  EFI secure boot can only be enabled with boot_firmware = efi
      type: 'bool'
-     default: False
 extends_documentation_fragment:
 - community.vmware.vmware.documentation
 
@@ -292,19 +291,16 @@ def ensure(self):
             change_needed = True
             boot_firmware_required = True
 
-        if self.vm.config.bootOptions.efiSecureBootEnabled != self.params.get('secure_boot_enabled'):
+        if self.params.get('secure_boot_enabled') is not None:
             if self.params.get('secure_boot_enabled') and self.params.get('boot_firmware') == "bios":
-                self.module.fail_json(msg="EFI secure boot cannot be enabled when boot_firmware = bios, but both are specified")
-
-            # If the user is not specifying boot_firmware, make sure they aren't trying to enable it on a
-            # system with boot_firmware already set to 'bios'
-            if self.params.get('secure_boot_enabled') and \
-               self.params.get('boot_firmware') is None and \
-               self.vm.config.firmware == 'bios':
-                self.module.fail_json(msg="EFI secure boot cannot be enabled when boot_firmware = bios.  VM's boot_firmware currently set to bios")
-
-            kwargs.update({'efiSecureBootEnabled': self.params.get('secure_boot_enabled')})
-            change_needed = True
+                self.module.fail_json(msg="Secure boot cannot be enabled when boot_firmware = bios")
+            elif self.params.get('secure_boot_enabled') and \
+                    self.params.get('boot_firmware') != 'efi' and \
+                    self.vm.config.firmware == 'bios':
+                self.module.fail_json(msg="Secure boot cannot be enabled since the VM's boot firmware is currently set to bios")
+            elif self.vm.config.bootOptions.efiSecureBootEnabled != self.params.get('secure_boot_enabled'):
+                kwargs.update({'efiSecureBootEnabled': self.params.get('secure_boot_enabled')})
+                change_needed = True
 
         changed = False
         results = dict(
@@ -381,7 +377,6 @@ def main():
         ),
         secure_boot_enabled=dict(
             type='bool',
-            default=False,
         ),
         boot_firmware=dict(
             type='str',


Test patch:
diff --git a/tests/integration/targets/vmware_guest_boot_manager/tasks/main.yml b/tests/integration/targets/vmware_guest_boot_manager/tasks/main.yml
--- a/tests/integration/targets/vmware_guest_boot_manager/tasks/main.yml
+++ b/tests/integration/targets/vmware_guest_boot_manager/tasks/main.yml
@@ -9,19 +9,68 @@
     setup_datastore: true
     setup_virtualmachines: true
 
-- name: Enter BIOS setup
+- name: Enable Secure Boot
   community.vmware.vmware_guest_boot_manager:
     validate_certs: false
     hostname: '{{ vcenter_hostname }}'
     username: '{{ vcenter_username }}'
     password: '{{ vcenter_password }}'
     name: "{{ virtual_machines[0].name }}"
-    enter_bios_setup: true
-  register: enter_bios_setup
+    boot_firmware: efi
+    secure_boot_enabled: true
+  register: enable_secure_boot
 
-- ansible.builtin.debug: var=enter_bios_setup
+- ansible.builtin.debug: var=enable_secure_boot
 
-- name: assert that configuration is changed
+- name: Get VM boot info 1
+  community.vmware.vmware_guest_boot_info:
+    validate_certs: false
+    hostname: '{{ vcenter_hostname }}'
+    username: '{{ vcenter_username }}'
+    password: '{{ vcenter_password }}'
+    name: "{{ virtual_machines[0].name }}"
+  register: boot_info1
+
+- ansible.builtin.debug: var=boot_info1
+
+- name: assert that Secure Boot is enabled
   assert:
     that:
-    - enter_bios_setup.changed
+    - enable_secure_boot.changed
+    - boot_info1.vm_boot_info.current_secure_boot_enabled is true
+
+- name: Issue https://github.com/ansible-collections/community.vmware/issues/1257
+  block:
+    - name: Enter BIOS setup
+      community.vmware.vmware_guest_boot_manager:
+        validate_certs: false
+        hostname: '{{ vcenter_hostname }}'
+        username: '{{ vcenter_username }}'
+        password: '{{ vcenter_password }}'
+        name: "{{ virtual_machines[0].name }}"
+        enter_bios_setup: true
+      register: enter_bios_setup
+
+    - ansible.builtin.debug: var=enter_bios_setup
+
+    - name: Get VM boot info 2
+      community.vmware.vmware_guest_boot_info:
+        validate_certs: false
+        hostname: '{{ vcenter_hostname }}'
+        username: '{{ vcenter_username }}'
+        password: '{{ vcenter_password }}'
+        name: "{{ virtual_machines[0].name }}"
+      register: boot_info2
+
+    - ansible.builtin.debug: var=boot_info2
+
+    - name: assert that configuration is changed
+      assert:
+        that:
+        - enter_bios_setup.changed
+        - boot_info2.vm_boot_info.current_enter_bios_setup is true
+
+    - name: assert that Secure Boot is still enabled
+      assert:
+        that:
+        - boot_info2.vm_boot_info.current_secure_boot_enabled is true