Evaluating when: conditionals and with_item:

[basictheprogram]

ISSUE TYPE

• Bug Report

COMPONENT NAME

when: conditional
with_items:

ANSIBLE VERSION

$ ansible --version
ansible 2.3.0 (devel 4c9ded9cb7) last updated 2016/10/26 15:52:32 (GMT -500)
  lib/ansible/modules/core: (devel 06d0987848) last updated 2016/10/26 15:44:10 (GMT -500)
  lib/ansible/modules/extras: (devel 1e9615730f) last updated 2016/10/26 15:44:29 (GMT -500)
  config file =
  configured module search path = Default w/o overrides

CONFIGURATION

Stock devel configuration

OS / ENVIRONMENT

Running macOS Sierra
Managing Ubuntu Xenial

SUMMARY

The when: conditionals are not evaluated before with_items: variable references are resolved

STEPS TO REPRODUCE

- debug: msg="{{ bootstrap_sshguard_whitelist }}"
  when: bootstrap_sshguard_whitelist is defined

- name: sshguard whitelist entries
  lineinfile:
    dest: /etc/sshguard/whitelist
    regexp: '.*{{ item.ip }}.*$'
    line: "{{ item.ip }}        # {{ item.comment }}"
    state: present
  when: 
    - bootstrap_sshguard_whitelist is defined
    - st.stat is defined 
    - st.stat.exists
  with_items:
    - "{{  bootstrap_sshguard_whitelist  }}"
  notify:
    - reload sshguard

EXPECTED RESULTS

When boostrap_sshguard_whitelist is NOT defined the "sshguard whitelist entries" task should not be executed. But it looks like the ansible attempts to resolve the "{{ bootstrap_sshguard_whitelist }}" in the with_items:

ACTUAL RESULTS

TASK [bootstrap : debug] *******************************************************
skipping: [testing_xenial64]

TASK [bootstrap : sshguard whitelist entries] **********************************
fatal: [testing_xenial64]: FAILED! => {"failed": true, "msg": "'bootstrap_sshguard_whitelist' is undefined"}

The debug is skipped proving bootstrap_sshguard_whitelist is not defined.

[basictheprogram]

Might be my misunderstanding as documented here?

#13791

[basictheprogram]

My misunderstanding. Below tasks "fixes" my problems.

- name: sshguard whitelist entries
  lineinfile:
    dest: /etc/sshguard/whitelist
    regexp: '.*{{ item.ip }}.*$'
    line: "{{ item.ip }}        # {{ item.comment }}"
    state: present
  when: 
    - st.stat is defined 
    - st.stat.exists
  with_items:
    - "{{  bootstrap_sshguard_whitelist|default(omit) }}"
  notify:
    - reload sshguard