check_mode for mysql_user module is fake

[vicmunoz]

Hi,
Just reviewing and trying to figure why check_mode support is marked as full in module mysql_user.
Runs with this module in check_mode always reports the task as changed, and running without check_mode reports as OK, if the user previously exists ie.
As my understanding that's not check_mode functionality at all, due doesn't report if will be changes or not, always reports as changed.

Just wanting to know the logic behind.

Thanks,

[markuman]

Hm, I cannot reproduce what you've described.

---
---
- hosts: localhost
  become: true

  tasks:
    - name: make sure bob does not exist
      community.mysql.mysql_user:
        name: bob
        state: absent

    - name: create in check_mode - changed
      check_mode: true
      community.mysql.mysql_user:
        name: bob
        password: 12345
        priv: '*.*:SELECT'
        state: present

    - name: srsly create - changed
      community.mysql.mysql_user:
        name: bob
        password: 12345
        priv: '*.*:SELECT'
        state: present

    - name: srsly create again - OK
      community.mysql.mysql_user:
        name: bob
        password: 12345
        priv: '*.*:SELECT'
        state: present

    - name: check_mode create again - OK
      check_mode: true
      community.mysql.mysql_user:
        name: bob
        password: 12345
        priv: '*.*:SELECT'
        state: present

    - name: cleanup
      community.mysql.mysql_user:
        name: bob
        password: 12345
        priv: '*.*:SELECT'
        state: absent

output

PLAY [localhost] ***************************************************************************************************************************************************************************

TASK [Gathering Facts] *********************************************************************************************************************************************************************
ok: [localhost]

TASK [make sure bob does not exist] ********************************************************************************************************************************************************
[WARNING]: Option column_case_sensitive is not provided. The default is now false, so the column's name will be uppercased. The default will be changed to true in community.mysql 4.0.0.
ok: [localhost]

TASK [create in check_mode - changed] ******************************************************************************************************************************************************
changed: [localhost]

TASK [srsly create - changed] **************************************************************************************************************************************************************
changed: [localhost]

TASK [srsly create again - OK] *************************************************************************************************************************************************************
ok: [localhost]

TASK [check_mode create again - OK] ********************************************************************************************************************************************************
ok: [localhost]

TASK [cleanup] *****************************************************************************************************************************************************************************
changed: [localhost]

PLAY RECAP *********************************************************************************************************************************************************************************
localhost                  : ok=7    changed=3    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

[vicmunoz]

Hi, you're right. Maybe it's not related to the module itself. I'm using custom filter plugin that when included check_mode always return 'changed'

My task:

- name: Create users and set privileges
  community.mysql.mysql_user:
    name: '{{ item.name }}'
    password: '{{ item.pass }}'
    host: '{{ item.user_host }}'
    login_user: root
    login_unix_socket: '/run/mysqld/mysqld.sock'
    priv: '{{ item.privileges | sql_user_privileges | join("/") }}' 
    state: present
  no_log: '{{ ansible_verbosity < 3 }}'
  loop: '{{ db_users }}'

My vars dict:

db_users:
  - name: 'user1'
    pass: 'secret1'
    user_host: host1
    privileges:
      - db: '*'
        priv: USAGE,REPLICATION CLIENT
      - db: mydatabase
        priv: ALL
      - db: otherdatabase
        priv: SELECT
        table: ro_table
  - name: 'user2'
    pass: 'secret2'
    user_host: host2
    privileges:
      - db: '*'
        priv: USAGE,REPLICATION CLIENT

My custom filter plugin:

"""Filters plugin for data manipulation"""

class FilterModule(object): #pylint: disable=useless-object-inheritance
    """Main class"""
    def filters(self):
        """Return list of filters included"""
        return {
            'sql_user_privileges': self.sql_user_privileges,
        }

    @staticmethod
    def sql_user_privileges(privileges: list) -> list:
        """Return list of formatted privileges"""
        user_privs = []
        for priv in privileges:
            try:
                table = priv['table']
            except KeyError:
                table = '*'
            database = priv['db']
            privilege = priv['priv']
            user_privs.append(f"{database}.{table}:{privilege}")
        return user_privs

[markuman]

You can try to debug using q. I guess that's something with new_priv and curr_priv.
Just do somewhere import q and

        if new_priv is not None:
            curr_priv = privileges_get(cursor, user, host, maria_role)
            q(new_priv)
            q(curr_priv)

After you're running in check mode, take a look at /tmp/q.

[vicmunoz]

Hi, thanks, a lot. Finally it was an issue with the privileges I was using, "USAGE, REPLICATION CLIENT" are deprecated and it saves internally "BINLOG MONITOR", however still are accepted for backward compatibility.

 0.0s user_mod: new_priv={'*.*': ['USAGE', 'REPLICATION CLIENT']}
 0.0s user_mod: curr_priv={'*.*': ['BINLOG MONITOR']}

[markuman]

--diff mode would be very helpful to be implemented for the module to capture this without touching the source code.

[markuman]

After diving into debugging, @vicmunoz are you willing to start implementing the diff functionality for mysql_user?