Validating arguments against arg spec occuring on all tagged roles

[libvoid]

Summary

When specifying a /meta/argument_specs.yml file in multiples roles and running a playbook with tagged roles, the Validating arguments against arg spec task occurs for all roles even if the role will not run (no associated tag).

This behavior seems like a bug because this task (associated to a role) doesn't follow the role tagging system normal behavior.

Issue Type

Bug Report

Component Name

validate_argument_spec

Ansible Version

ansible [core 2.16.2]
  config file = /home/libvoid/Documents/*****/ansible.cfg
  configured module search path = ['/home/libvoid/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/libvoid/.cache/pypoetry/virtualenvs/prod-jzrDeld9-py3.10/lib/python3.10/site-packages/ansible
  ansible collection location = /home/libvoid/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/libvoid/.cache/pypoetry/virtualenvs/prod-jzrDeld9-py3.10/bin/ansible
  python version = 3.10.12 (main, Nov 20 2023, 15:14:05) [GCC 11.4.0] (/home/libvoid/.cache/pypoetry/virtualenvs/prod-jzrDeld9-py3.10/bin/python)
  jinja version = 3.1.2
  libyaml = True

Configuration

ANSIBLE_PIPELINING(xxxxxx/ansible.cfg) = True
CONFIG_FILE() = xxxxxx/ansible.cfg
DEFAULT_HOST_LIST(xxxxxx/ansible.cfg) = ['xxxxxx/hosts']
DEFAULT_ROLES_PATH(xxxxxx/ansible.cfg) = ['xxxxxx/roles']

CALLBACK:
========

default:
_______
result_format(xxxxxx/ansible.cfg) = yaml
show_task_path_on_failure(xxxxxx/ansible.cfg) = True

minimal:
_______
result_format(xxxxxx/ansible.cfg) = yaml

CONNECTION:
==========

local:
_____
pipelining(xxxxxx/ansible.cfg) = True

psrp:
____
pipelining(xxxxxx/ansible.cfg) = True

ssh:
___
pipelining(xxxxxx/ansible.cfg) = True

winrm:
_____
pipelining(xxxxxx/ansible.cfg) = True

OS / Environment

Debian 10/11/12

Steps to Reproduce

1. Create a simple playbook site.yml with several tagged roles

- name: Agents
  hosts: agents
  roles:
    - { role: role1, tags: [agents, role1] }
    - { role: role2, tags: [agents, role2] }
    - { role: role3, tags: [agents, role3] }

2. Each role should have a /meta/argument_specs.yml. For instance :

argument_specs:
  # roles/role1/tasks/main.yml entry point
  main:
    options:
      var1:
        required: true
        type: str

3. Run the playbook with the tag role1

ansible-playbook site.yml -t role1 -CD

Expected Results

The automatic Validating arguments against arg task should only run for the roles that will be executed (based on the tags).

Actual Results

The task is run for all the roles of the playbook.

TASK [role1 : Validating arguments against arg spec 'main'] ************************************************************************************************
ok: [host1]
ok: [host2]
TASK [role2 : Validating arguments against arg spec 'main'] ************************************************************************************************
ok: [host1]
ok: [host2]
TASK [role3 : Validating arguments against arg spec 'main'] ************************************************************************************************
ok: [host1]
ok: [host2]

Code of Conduct

• I agree to follow the Ansible Code of Conduct

[bcoca]

So the validation internal task has:

  'tags': ['always'],

It should check for tags on the role itself and use that if they exist, otherwise fallback to always

We do something similar for the implicit fact gathering:

        # Unless play is specifically tagged, gathering should 'always' run
        if not self._play.tags:
            setup_task.tags = ['always']

[ansibot]

Files identified in the description:

• lib/ansible/plugins/action/validate_argument_spec.py
• lib/ansible/modules/validate_argument_spec.py

If these files are incorrect, please update the component name section of the description or use the component bot command.

[sudh33ra]

@jborean93 will this work?

[bcoca]

@sudh33ra probably, just add tests to the PR (also a changelog)

[flowerysong]

I still don't think this is the correct thing to do; as outlined in #82670 (comment) this would mean that validation could be skipped even when tasks from the role run.

[bcoca]

a small redesign is needed maybe, run spec conditionally before the first task in a role runs vs making it the first task in a role