RabbitMQ user configuration fails due to sorting list of dicts

[groggi]

SUMMARY

Configuring RabbitMQ user fails due to trying to sort a list of RabbitMQ permission dicts in Python.

Assumed to be due to #22507 (4522a53).

ISSUE TYPE

• Bug Report

COMPONENT NAME

rabbitmq_user

ANSIBLE VERSION

Tested with multiple versions (some details redacted with user). First one is mine and used for the following examples/outputs.

ansible 2.7.2
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.6/dist-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.6.7 (default, Oct 22 2018, 11:32:17) [GCC 8.2.0]

ansible 2.6.8.post0
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.6/dist-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.6.7 (default, Oct 22 2018, 11:32:17) [GCC 8.2.0]

ansible 2.7.2
 config file = /etc/ansible/ansible.cfg
 configured module search path = [u'/home/user/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
 ansible python module location = /usr/lib/python2.7/dist-packages/ansible
 executable location = /usr/bin/ansible
 python version = 2.7.15rc1 (default, Nov 12 2018, 14:31:15) [GCC 7.3.0]

ansible 2.8.0.dev0
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.6/dist-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.6.7 (default, Oct 22 2018, 11:32:17) [GCC 8.2.0]

CONFIGURATION

OS / ENVIRONMENT

• Control machine: Ubuntu 18.04.1 LTS
• Target machine:
  • Ubuntu 18.04.1 LTS
  • Python 3.6.7

STEPS TO REPRODUCE

The following task is executed:

- name: add RabbitMQ root user
    rabbitmq_user:
      user: "someRootUser"
      password: "somePassword"
      permissions:
        - vhost: /
          configure_priv: .*
          read_priv: .*
          write_priv: .*
      tags: administrator
      state: present

EXPECTED RESULTS

The expected result is to see the user being present and configured in RabbitMQ.

ACTUAL RESULTS

A Python exception is caught and the playbook execution stops.

Traceback (most recent call last):
  File \"/home/user/.ansible/tmp/ansible-tmp-1543222268.31-229234673963142/AnsiballZ_rabbitmq_user.py\", line 261, in <module>
    _ansiballz_main()
  File \"/home/user/.ansible/tmp/ansible-tmp-1543222268.31-229234673963142/AnsiballZ_rabbitmq_user.py\", line 251, in _ansiballz_main
    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)
  File \"/home/user/.ansible/tmp/ansible-tmp-1543222268.31-229234673963142/AnsiballZ_rabbitmq_user.py\", line 119, in invoke_module
    imp.load_module('__main__', mod, module, MOD_DESC)
  File \"/usr/lib/python3.6/imp.py\", line 235, in load_module
    return load_source(name, filename, file)
  File \"/usr/lib/python3.6/imp.py\", line 170, in load_source
    module = _exec(spec, sys.modules[name])
  File \"<frozen importlib._bootstrap>\", line 618, in _exec
  File \"<frozen importlib._bootstrap_external>\", line 678, in exec_module
  File \"<frozen importlib._bootstrap>\", line 219, in _call_with_frames_removed
  File \"/tmp/ansible_rabbitmq_user_payload_yjcxsat6/__main__.py\", line 317, in <module>
  File \"/tmp/ansible_rabbitmq_user_payload_yjcxsat6/__main__.py\", line 304, in main
  File \"/tmp/ansible_rabbitmq_user_payload_yjcxsat6/__main__.py\", line 233, in has_permissions_modifications
TypeError: '<' not supported between instances of 'dict' and 'dict'

Debugging / Search for Cause

I added import pdb; pdb.set_trace() to

ansible/lib/ansible/modules/messaging/rabbitmq_user.py

Line 236 in 4522a53

def has_permissions_modifications(self):

as the method's first line and executed it again directly on the target machine. Using PDB I checked why it fails to sort:

> /home/user/.ansible/tmp/ansible-tmp-1543222268.31-229234673963142/debug_dir/foo.py(234)has_permissions_modifications()
-> return sorted(self._permissions) != sorted(self.permissions)
(Pdb) self.permissions
[{'vhost': '/', 'read_priv': '.*', 'configure_priv': '.*', 'write_priv': '.*'}]
(Pdb) self._permissions
[{'vhost': 'vhost', 'configure_priv': 'configure', 'write_priv': 'write', 'read_priv': 'read'}, {'vhost': '/', 'configure_priv': '.*', 'write_priv': '.*', 'read_priv': '.*'}]
(Pdb) sorted(self._permissions)
*** TypeError: '<' not supported between instances of 'dict' and 'dict'

As we can see self._permissions is a list of dictionaries and the method sorts that list before it compares it to the sorted list of self.permissions. However, Python is unable to sort a list of dicts as they have no natural order.

[ansibot]

Hi @groggi, thank you for submitting this issue!

click here for bot help

[ansibot]

Files identified in the description:

• lib/ansible/modules/messaging/rabbitmq/rabbitmq_user.py

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibot]

cc @chrishoffman @hyperized @manuel-sousa
click here for bot help

[groggi]

This seems to be an issue due to the use of Python3. In Python2 the sorted call is legitimate and Python sorts the list of dicts. However, using Python3 will result in the above mentioned exception.

Example:

a = [{'vhost': 'vhost', 'configure_priv': 'configure', 'write_priv': 'write', 'read_priv': 'read'}, {'vhost': '/', 'configure_priv': '.*', 'write_priv': '.*', 'read_priv': '.*'}]

print(sorted(a)) # works with Python 2.7.13 and does not with Python 3.5

[windowsrefund]

This is a problem with python 2.7.15 as well. I've tested against multiple versions of ansible (2.7.1, 2.7.2 and even 2.5.11). Seems the module can create the users and set the permissions but followup runs are not idempotent and blow up with:

"msg": "Virtual host 'vhost' does not exist", "rc": 65, "stderr": "Virtual host 'vhost' does not exist\n", "stderr_lines": ["Virtual host 'vhost' does not exist"], "stdout": "", "stdout_lines": []}

[groggi]

This is a problem with python 2.7.15 as well. I've tested against multiple versions of ansible (2.7.1, 2.7.2 and even 2.5.11). Seems the module can create the users and set the permissions but followup runs are not idempotent and blow up with:

"msg": "Virtual host 'vhost' does not exist", "rc": 65, "stderr": "Virtual host 'vhost' does not exist\n", "stderr_lines": ["Virtual host 'vhost' does not exist"], "stdout": "", "stdout_lines": []}

Hey @windowsrefund you just made my week! Thank you. I was thinking I'm going mad for not finding out where the vhost "vhost" is coming from and why my deployments fail. So its also likely due to or at least connected to rabbitmq_user. I don't have a good testing environment, but I will try to find the cause. Of course I'd be very happy if someone with more knowledge and experience with this module can have a look too :-).