with_first_found fails to find a file if an undefined variable is used in the list since ansible 2.9

[afunix]

SUMMARY

with_first_found fails "No file was found when using first_found. ..." even if a file matches search conditions, when an undefined variable is used in files parameter.
This is started after I've upgraded from ansible 2.8 to 2.9, so I suppose it is a bug.

ISSUE TYPE

• Bug Report

COMPONENT NAME

first_found

ANSIBLE VERSION

ansible 2.9.10
  config file = None
  configured module search path = ['/Users/afunix/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/Cellar/ansible/2.9.10/libexec/lib/python3.8/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.8.4 (default, Jul 14 2020, 02:58:48) [Clang 11.0.3 (clang-1103.0.32.62)]

CONFIGURATION

DEFAULT_VAULT_PASSWORD_FILE(env: ANSIBLE_VAULT_PASSWORD_FILE) = /Users/afunix/.vault

OS / ENVIRONMENT

Host: macOS 10.15.5
Target: CentOS 7.8

STEPS TO REPRODUCE

playbook.yml

---
- hosts: all
  roles:
      - test

roles/test/tasks/main.yml

---
- debug:
      msg: "path: {{role_path}}/vars"

- debug:
    msg: "file: {{ansible_distribution}}-{{ansible_distribution_major_version}}.yml"

- name: Load variables specific for OS family
  include_vars: "{{item}}"
  with_first_found:
    - files:
        - "{{ansible_lsb.id}}-{{ansible_lsb.major_release}}.yml"
        - "{{ansible_distribution}}-{{ansible_distribution_major_version}}.yml"
      paths:
        - "{{role_path}}/vars"

roles/test/vars/CentOS-7.yml

---
test: test

EXPECTED RESULTS

ansible-playbook is able to find CentOS-7.yml when running against CentOS 7.8 system, since the file exists.

ACTUAL RESULTS

ansible-playbook cannot find CentOS-7.yml when running against CentOS 7.8 system.

The issue goes away once I remove "{{ansible_lsb.id}}-{{ansible_lsb.major_release}}.yml" from files.

Checked ansible -m setup for the host and ansible_lsb is empty.

$ ansible-playbook -i inventory playbook.yml 

PLAY [all] *****************************************************************************************************************************************************************************************************

TASK [Gathering Facts] *****************************************************************************************************************************************************************************************
ok: [alice]

TASK [test : debug] ********************************************************************************************************************************************************************************************
ok: [alice] => {
    "msg": "path: /Users/afunix/tmp/ansible-with-first-found/roles/test/vars"
}

TASK [test : debug] ********************************************************************************************************************************************************************************************
ok: [alice] => {
    "msg": "file: CentOS-7.yml"
}

TASK [test : Load variables specific for OS family] ************************************************************************************************************************************************************
fatal: [alice]: FAILED! => {"msg": "No file was found when using first_found. Use errors='ignore' to allow this task to be skipped if no files are found"}

PLAY RECAP *****************************************************************************************************************************************************************************************************
alice                      : ok=3    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0   

$ stat /Users/afunix/tmp/ansible-with-first-found/roles/test/vars/CentOS-7.yml
16777220 38020305 -rw-r--r-- 1 afunix staff 0 15 "Jul 20 18:11:55 2020" "Jul 20 18:11:38 2020" "Jul 20 18:11:38 2020" "Jul 20 18:11:38 2020" 4096 8 0 /Users/afunix/tmp/ansible-with-first-found/roles/test/vars/CentOS-7.yml

$ ansible -i inventories/production/hosts -m setup alice | grep ansible_lsb
        "ansible_lsb": {},

[ansibot]

Files identified in the description:
None

If these files are incorrect, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibot]

Files identified in the description:

• lib/ansible/plugins/lookup/first_found.py

If these files are incorrect, please update the component name section of the description or use the !component bot command.

click here for bot help

[sivel]

The issue here, is in filtering out untemplated terms in the search. We only account for strings in the terms in this code path.

The following diff should resolve the issue:

diff --git a/lib/ansible/executor/task_executor.py b/lib/ansible/executor/task_executor.py
index 5034bbc862..373f47e082 100644
--- a/lib/ansible/executor/task_executor.py
+++ b/lib/ansible/executor/task_executor.py
@@ -19,6 +19,7 @@ from ansible import constants as C
 from ansible.errors import AnsibleError, AnsibleParserError, AnsibleUndefinedVariable, AnsibleConnectionFailure, AnsibleActionFail, AnsibleActionSkip
 from ansible.executor.task_result import TaskResult
 from ansible.executor.module_common import get_action_args_with_defaults
+from ansible.module_utils.common._collections_compat import Mapping
 from ansible.module_utils.parsing.convert_bool import boolean
 from ansible.module_utils.six import iteritems, string_types, binary_type
 from ansible.module_utils.six.moves import xrange
@@ -223,8 +224,17 @@ class TaskExecutor:
 
                 loop_terms = listify_lookup_plugin_terms(terms=self._task.loop, templar=templar, loader=self._loader, fail_on_undefined=fail,
                                                          convert_bare=False)
+
                 if not fail:
-                    loop_terms = [t for t in loop_terms if not templar.is_template(t)]
+                    intermediate = []
+                    for term in loop_terms:
+                        if isinstance(term, Mapping) and 'files' in term:
+                            term['files'] = [t for t in term['files'] if not templar.is_template(t)]
+                            intermediate.append(term)
+                        else:
+                            if not templar.is_template(term):
+                                intermediate.append(term)
+                    loop_terms = intermediate
 
                 # get lookup
                 mylookup = self._shared_loader_obj.lookup_loader.get(self._task.loop_with, loader=self._loader, templar=templar)

If anyone is interested in testing this further, and creating tests to validate it, please feel free to do so.

[bmillemathias]

Hey @afunix

Are you able to test the fix and provide some feedback ?

[bmillemathias]

@afunix I eventually took the patch and did a PR.

[afunix]

I confirm the change fixes my issue.

[bcoca]

needs_verified (first_found input was revamped and that might have fixed this issue)

[afunix]

I can still reproduce the issue on ansible 2.12.5 (MacOSX, installed with brew)

[zmingxie]

I'm also still hitting this issue and wondering if there is a fix for this

[ruoshan]

This is my work-around, instead of sth like this:

  with_first_found:
    - files:
        - "{{ansible_lsb.id}}-{{ansible_lsb.major_release}}.yml"
        - "{{ansible_distribution}}-{{ansible_distribution_major_version}}.yml"
      paths:
        - "{{role_path}}/vars"

instead, you can use:

  with_first_found:
    - files:
        - "{{ansible_lsb.id}}-{{ansible_lsb.major_release}}.yml"
      paths:
        - "{{role_path}}/vars"
    - files:
        - "{{ansible_distribution}}-{{ansible_distribution_major_version}}.yml"
      paths:
        - "{{role_path}}/vars"

[bcoca]

^ weird enough, this does work ... but that makes me thing the issue is how we look at how the terms get passed into the lookup itself vs the processing in the lookup

[bcoca]

This line seems to be the problem:
https://github.com/ansible/ansible/blob/devel/lib/ansible/executor/task_executor.py#L234

If i remove it 'everything works', otherwise it removes the lines that require templating from being sent to the plugin, which then gets [] (empty list) of files to find ....

Going to try to figure out why that was added

[bcoca]

The issue was that the 'undefined' var forced the whole item to be removed in task_executor, so the form that had everything in 'one place' ended up empty, the 2nd form @ruoshan showed, 'worked'TM because only the item with the undefined variable was removed. The code was iterating on the top level list of dicts, vs list of files in dict key named 'files', so it removed the full dict.

[ruoshan]

@bcoca I was wrong, that work-around has other issue. if the files in both files section exist, the last one will be chose.

[bcoca]

That is the nature of lists, each item is still processed, you would have to reverse order for that case to match the behavior you want.

This is not something that was ever documented/advertised as supported (list of dicts), not sure if i should make it an error, document the behavior or change it to also break on first found.

[bcoca]

@roushan hmm, my tests seem to show it working as the last option above, its 'first found'