When fatal: happens when using iteration, all results are lost even if ignore_errors is true

[blami]

Summary

I am trying to write simple fact-setting check verifying that user can become certain roles. As playbook can run either as unprivileged user (without -K) or as root, sudo password is not always provided. This check iterates over names of become users and attempts to become each of them either successfully or not. Goal was to collect results and set facts based on them so that other tasks/roles can be skipped using simple when: has_root, when: has_user, etc.

Problem is that when sudo password is not provided (and required), it results in fatal and ALL results are lost even if some hosts actually pass and ignore_errors (or failed_when: false) is in place.

Issue Type

Bug Report

Component Name

become

Ansible Version

ansible [core 2.16.6]
  config file = None
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3/dist-packages/ansible
  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.11.9 (main, Apr 10 2024, 13:16:36) [GCC 13.2.0] (/usr/bin/python3)
  jinja version = 3.1.3
  libyaml = True

Configuration

CONFIG_FILE() = None
EDITOR(env: EDITOR) = vim
PAGER(env: PAGER) = less

OS / Environment

Debian GNU/Linux 12

Steps to Reproduce

- name: "Checking Become"
  command:
    cmd: "/bin/true"
  become: true
  become_user: "{{ item }}"
  register: out
  ignore_errors: true
  with_items:
    - "test"
    - "root"

- debug:
    var: out

Where test is the user configured to connect to managed node, root requires sudo password which is not provided at this moment.

Expected Results

TASK [Checking Become] **************************************************************************************************************
ok: [vm] => (item=test)
failed: [vm] => (item=root)
...ignoring

TASK [debug] ************************************************************************************************************************
ok: [vm] => {
    "out": {
        "changed": false,
        "failed": true
        "msg": "Some items failed",
        "results": [
           {
                ...
                "item": "test",
                "failed": false,
                ...
            },
           {
                ...
                "item": "root",
                "failed": true,
                ...
            },
        ],
        "skipped": false
    }
}

Actual Results

TASK [Checking Become] **************************************************************************************************************
ok: [vm] => (item=test)
fatal: [vm]: FAILED! => {"msg": "Missing sudo password"}
...ignoring

TASK [debug] ************************************************************************************************************************
ok: [vm] => {
    "out": {
        "failed": true,
        "msg": "Missing sudo password"
    }
}

Code of Conduct

• I agree to follow the Ansible Code of Conduct

[ansibot]

Files identified in the description:

• lib/ansible/plugins/become/__init__.py

If these files are incorrect, please update the component name section of the description or use the component bot command.

[sivel]

The problem here, is that the Missing sudo password error is coming from the connection plugin, and it does this by raising AnsibleError.

In the TaskExecutor, we do not catch the AnsibleError inside of the loop when iterating the items, and as such, the AnsibleError breaks the loop, and is caught in the wider try/except.