opened
jamielennox
username_0
Me again, I promise i'm doing this to help not be a pain :) 

So this is kind of an inbuilt problem with ansible, but I _think_ it might be something that can be worked around. There are a lot of places where vault expects and returns an integer value. The ones that are getting me at the moment are all the TTLs in certificates. However due to the way jinja works ansible generally only templates out strings.

Taking a new-ish example: 

```
- hosts: localhost
  tasks:
    - hashivault_pki_role:
        name: tester
        config:
          allow_subdomains: true
          ttl: 3600
```

this should work because the ttl is an integer and the values returned by the vault APIs are integers, if i put that into a loop though: 

```
- hosts: localhost
  tasks:
    - hashivault_pki_role:
        name: "{{ item.name }}"
        config:
          allow_subdomains: "{{ item.allow_subdomains | default(omit) }}"
          ttl: "{{ item.ttl | default('3600') }}"
      loop: "{{ roles }}"
```

This will always return changed and update because the ttl value is a string, being compared to an integer even though the value is the same. 

There is actually a relatively new feature on the ansible side that can let a jinja value be templated and return a non-string type: https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-jinja2-native but it's not really ideal to set that at the cfg level. 

I think the easiest way to fix this would be to cast everything to strings in the compare function? Or at least check if the return value is a native type (int, float, ?) and then cast both sides to string before doing the check? 

Note: i'm typing this directly into the bug, so my examples probably don't work perfectly, but hopefully show the problem.
Modules report changed due to type mismatch
issue
created
jamielennox
username_0
Oh, this functionality is particularly annoying in this case. 

The module typecasts all the incoming parameters, so you can't pass in an integer because the type is marked as string: https://github.com/username_1/ansible-modules-hashivault/blob/2bc7447df6fdcd686fe0745d5751e18f37be0226/ansible/modules/hashivault/hashivault_pki_role.py#L324-L332

This would appear to be because you can use `ttl`/`max_ttl` with a `h` suffix, so `100h` vs seconds (rant about h, but no d, or y in another place - not your doing). However when you query vault for it's configuration it doesn't return the `100h` format it returns an integer of seconds like `6000`. So this will never line up. 

I think the bug stands, I've definitely hit places where the int != string is a problem, just that this may not have been the best example. 

If there's a useful ansible/python utility to convert human readable times to integers it would be great to preprocess this and avoid the problem and be more useful - but different bug. 

For now I don't think you can do much about comparing `100h` to `6000`, but if we input a value in seconds we shouldn't report changed.
comment
closed
TerryHowe
username_1
issue
created
TerryHowe
username_1
The whole hour/minute/second thing, I think a lot of modules don't use the common state compare and more should. I've on one hand been avoiding common code here, but the comparison is actually a good case for common code.
comment