My CI jobs just started failing after Ansible 2.9.12 was released.
I noticed the following failure:
TASK [Verify Apache is serving web requests.] **********************************
fatal: [instance]: FAILED! => {"changed": false, "connection": "close", "content": "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>403 Forbidden</title>\n</head><body>\n<h1>Forbidden</h1>\n<p>You don't have permission to access /index.html\non this server.<br />\n</p>\n</body></html>\n", "content_length": "219", "content_type": "text/html; charset=iso-8859-1", "date": "Fri, 14 Aug 2020 15:07:32 GMT", "elapsed": 0, "msg": "Status code was 403 and not [200]: HTTP Error 403: Forbidden", "redirected": false, "server": "Apache/2.4.37 (centos)", "status": 403, "url": "http://localhost/"}
But locally (where I had 2.9.11) it was not failing. It was not until after scanning the rest of the failed job logs that I noticed:
TASK [Copy a web page.] ********************************************************
[WARNING]: File '/var/www/html/index.html' created with default permissions
'600'. The previous default was '666'. Specify 'mode' to avoid this warning.
changed: [instance]
This seems to be a major breaking change, as I still have a number of file, copy, template, etc. tasks which do not explicitly define a mode, and relied on the default behavior. It looks like others have been hitting this problem too: ansible/ansible#71200
I'm not sure if the default will be changed back, but I guess in general, the best option is to always explicitly define mode now, since the system default will not be used in the name of security.
My CI jobs just started failing after Ansible 2.9.12 was released.
I noticed the following failure:
But locally (where I had 2.9.11) it was not failing. It was not until after scanning the rest of the failed job logs that I noticed:
This seems to be a major breaking change, as I still have a number of
file,copy,template, etc. tasks which do not explicitly define amode, and relied on the default behavior. It looks like others have been hitting this problem too: ansible/ansible#71200I'm not sure if the default will be changed back, but I guess in general, the best option is to always explicitly define
modenow, since the system default will not be used in the name of security.