<h5 dir="auto">ISSUE TYPE</h5>
<p dir="auto">Bug Report</p>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">group module</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<p dir="auto">1.9</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">Hi,</p>
<p dir="auto">the group module seems to not work right. I am using centos 7. The expected result is that it wouldn't fail since the group is properly present. The group was added by ´yum install docker´</p>
<p dir="auto">Task:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="- group: name=dockerroot state=present gid=989"><pre class="notranslate">- <span class="pl-ent">group</span>: <span class="pl-s">name=dockerroot state=present gid=989</span></pre></div>
<p dir="auto">Sample</p>
<div class="highlight highlight-source-shell notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="TASK: [newrelic | Configure New Relic Sysmond] ******************************** 
changed: [192.168.0.244]

TASK: [newrelic | group name=dockerroot state=present gid=989] **************** 
failed: [192.168.0.244] =&gt; {&quot;failed&quot;: true, &quot;name&quot;: &quot;dockerroot&quot;}
msg: groupmod: GID '989' already exists


FATAL: all hosts have already failed -- aborting

PLAY RECAP ******************************************************************** 
           to retry, use: --limit @/root/vmbuilder.retry

192.168.0.244              : ok=73   changed=17   unreachable=0    failed=1   

[root@172-17-42-1 ~]# ansible-playbook --version
ansible-playbook 1.9.0.1
  configured module search path = None
[root@172-17-42-1 ~]# grep -i &quot;989&quot; /etc/group  
dockerroot:x:989:newrelic"><pre class="notranslate">TASK: [newrelic <span class="pl-k">|</span> Configure New Relic Sysmond] <span class="pl-k">********************************</span> 
changed: [192.168.0.244]

TASK: [newrelic <span class="pl-k">|</span> group name<span class="pl-k">=</span>dockerroot state<span class="pl-k">=</span>present gid<span class="pl-k">=</span>989] <span class="pl-k">****************</span> 
failed: [192.168.0.244] =<span class="pl-k">&gt;</span> {<span class="pl-s"><span class="pl-pds">"</span>failed<span class="pl-pds">"</span></span>: true, <span class="pl-s"><span class="pl-pds">"</span>name<span class="pl-pds">"</span></span>: <span class="pl-s"><span class="pl-pds">"</span>dockerroot<span class="pl-pds">"</span></span>}
msg: groupmod: GID <span class="pl-s"><span class="pl-pds">'</span>989<span class="pl-pds">'</span></span> already exists


FATAL: all hosts have already failed -- aborting

PLAY RECAP <span class="pl-k">********************************************************************</span> 
           to retry, use: --limit @/root/vmbuilder.retry

192.168.0.244              <span class="pl-c1">:</span> ok=73   changed=17   unreachable=0    failed=1   

[root@172-17-42-1 <span class="pl-k">~</span>]<span class="pl-c"><span class="pl-c">#</span> ansible-playbook --version</span>
ansible-playbook 1.9.0.1
  configured module search path = None
[root@172-17-42-1 <span class="pl-k">~</span>]<span class="pl-c"><span class="pl-c">#</span> grep -i "989" /etc/group  </span>
dockerroot:x:989:newrelic</pre></div>
<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">ec2</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.4.0.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/Users/rpm/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /Users/rpm/sandbox/venv-ansible-2.4.0/lib/python2.7/site-packages/ansible
  executable location = /Users/rpm/sandbox/venv-ansible-2.4.0/bin/ansible
  python version = 2.7.13 (default, Dec 18 2016, 07:03:39) [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.42.1)]"><pre class="notranslate"><code class="notranslate">ansible 2.4.0.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/Users/rpm/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /Users/rpm/sandbox/venv-ansible-2.4.0/lib/python2.7/site-packages/ansible
  executable location = /Users/rpm/sandbox/venv-ansible-2.4.0/bin/ansible
  python version = 2.7.13 (default, Dec 18 2016, 07:03:39) [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.42.1)]
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>
<p dir="auto">All defaults</p>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<p dir="auto">Issue not platform specific</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">The <code class="notranslate">count_tag</code> parameter on the ec2 module should maintain the <code class="notranslate">exact_count</code> number of ec2 instances which match the supplied tags, <em>wherever these ec2 instances are found within the account and region</em>. This was the behavior until version 2.4.</p>
<p dir="auto">As of version 2.4, the behavior changed, so that the match is no longer on 'count_tag' alone (as documented), but also on the <code class="notranslate">vpc_subnet_id</code>. Any instances with matching tags but in different subnets (even within the same VPC) are no longer counted as matching, and new instances are created.</p>
<p dir="auto">This is a serious bug for people maintaining EC2 infrastructure.</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<p dir="auto">Create instance, like so:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="---

- hosts: localhost
  vars:
    subnet_id: subnet-1111111
  tasks:
    - ec2:
        count_tag: 
          Name: duplicate-test-1
          Department: FooBar
          Application: Baz
        exact_count: 1
        group_id: sg-000000
        image: ami-3bdd502c
        instance_tags:
          Name: duplicate-test-1
          Department: FooBar
          Application: Baz
        instance_type: t2.nano
        key_name: some.key.name
        region: us-east-1
        vpc_subnet_id: &quot;{{ subnet_id }}&quot;
"><pre class="notranslate">---

- <span class="pl-ent">hosts</span>: <span class="pl-s">localhost</span>
  <span class="pl-ent">vars</span>:
    <span class="pl-ent">subnet_id</span>: <span class="pl-s">subnet-1111111</span>
  <span class="pl-ent">tasks</span>:
    - <span class="pl-ent">ec2</span>:
        <span class="pl-ent">count_tag</span>: 
          <span class="pl-ent">Name</span>: <span class="pl-s">duplicate-test-1</span>
          <span class="pl-ent">Department</span>: <span class="pl-s">FooBar</span>
          <span class="pl-ent">Application</span>: <span class="pl-s">Baz</span>
        <span class="pl-ent">exact_count</span>: <span class="pl-c1">1</span>
        <span class="pl-ent">group_id</span>: <span class="pl-s">sg-000000</span>
        <span class="pl-ent">image</span>: <span class="pl-s">ami-3bdd502c</span>
        <span class="pl-ent">instance_tags</span>:
          <span class="pl-ent">Name</span>: <span class="pl-s">duplicate-test-1</span>
          <span class="pl-ent">Department</span>: <span class="pl-s">FooBar</span>
          <span class="pl-ent">Application</span>: <span class="pl-s">Baz</span>
        <span class="pl-ent">instance_type</span>: <span class="pl-s">t2.nano</span>
        <span class="pl-ent">key_name</span>: <span class="pl-s">some.key.name</span>
        <span class="pl-ent">region</span>: <span class="pl-s">us-east-1</span>
        <span class="pl-ent">vpc_subnet_id</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ subnet_id }}<span class="pl-pds">"</span></span>
</pre></div>
<p dir="auto">Later, re-run playbook but use different subnet ID:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="---

- hosts: localhost
  vars:
    subnet_id: subnet-2222222
  tasks:
    - ec2:
        count_tag: 
          Name: duplicate-test-1
          Department: FooBar
          Application: Baz
        exact_count: 1
        group_id: sg-000000
        image: ami-3bdd502c
        instance_tags:
          Name: duplicate-test-1
          Department: FooBar
          Application: Baz
        instance_type: t2.nano
        key_name: some.key.name
        region: us-east-1
        vpc_subnet_id: &quot;{{ subnet_id }}&quot;
"><pre class="notranslate">---

- <span class="pl-ent">hosts</span>: <span class="pl-s">localhost</span>
  <span class="pl-ent">vars</span>:
    <span class="pl-ent">subnet_id</span>: <span class="pl-s">subnet-2222222</span>
  <span class="pl-ent">tasks</span>:
    - <span class="pl-ent">ec2</span>:
        <span class="pl-ent">count_tag</span>: 
          <span class="pl-ent">Name</span>: <span class="pl-s">duplicate-test-1</span>
          <span class="pl-ent">Department</span>: <span class="pl-s">FooBar</span>
          <span class="pl-ent">Application</span>: <span class="pl-s">Baz</span>
        <span class="pl-ent">exact_count</span>: <span class="pl-c1">1</span>
        <span class="pl-ent">group_id</span>: <span class="pl-s">sg-000000</span>
        <span class="pl-ent">image</span>: <span class="pl-s">ami-3bdd502c</span>
        <span class="pl-ent">instance_tags</span>:
          <span class="pl-ent">Name</span>: <span class="pl-s">duplicate-test-1</span>
          <span class="pl-ent">Department</span>: <span class="pl-s">FooBar</span>
          <span class="pl-ent">Application</span>: <span class="pl-s">Baz</span>
        <span class="pl-ent">instance_type</span>: <span class="pl-s">t2.nano</span>
        <span class="pl-ent">key_name</span>: <span class="pl-s">some.key.name</span>
        <span class="pl-ent">region</span>: <span class="pl-s">us-east-1</span>
        <span class="pl-ent">vpc_subnet_id</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ subnet_id }}<span class="pl-pds">"</span></span>
</pre></div>
<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">The <code class="notranslate">count_tags</code> and <code class="notranslate">exact_count</code> parameter should be respected, based on tags alone, and the running instance created in the first playbook run should be recognized as matching those parameters during the second playbook run.</p>
<h5 dir="auto">ACTUAL RESULTS</h5>
<p dir="auto">As of version 2.4, the running instance with matching tags is no longer counted because it is in a different subnet, and a redundant instance is created.</p>
<h5 dir="auto">COMMENTS</h5>
<p dir="auto">This behavior change was introduced without documentation, and is very problematic - the point of using <code class="notranslate">count_tags</code> and <code class="notranslate">exact_count</code> is to be able to maintain an instance or set of instances based on a tagging strategy - subnets may change over time, and often multiple instances will be distributed across subnets for resiliency. Silently including the subnet as an additional criterion for tag matching doesn't make a lot of sense, and breaks the expected behavior.</p>
<p dir="auto">If matching on tags + subnet is actually useful to someone, it would make more sense to make it an explicit parameter (although at that point, offering matching on VPCs, or instance types, or AMIs, or various other attributes which are not currently matched on should maybe come into consideration... and personally I feel that if that's necessary, then one's EC2 tagging strategy needs a revisit).</p>