New release v2.5.11

(cherry picked from commit 10e129e)

Co-authored-by: Matt Martz <matt@sivel.net>

MANIFEST.in

@@ -1,12 +1,16 @@
 prune ticket_stubs
-prune hacking
 include README.rst COPYING
 include SYMLINK_CACHE.json
 include requirements.txt
 include .coveragerc
 include .yamllint
+include shippable.yml
+include tox.ini
+include bin/ansible-test
 include examples/hosts
 include examples/ansible.cfg
+include examples/scripts/ConfigureRemotingForAnsible.ps1
+include examples/scripts/upgrade_to_ps3.ps1
 recursive-include lib/ansible/module_utils/powershell *
 recursive-include lib/ansible/modules *
 recursive-include lib/ansible/galaxy/data *

Makefile

@@ -117,7 +117,7 @@ ifneq ($(REPOTAG),)
 endif
 
 # ansible-test parameters
-ANSIBLE_TEST ?= test/runner/ansible-test
+ANSIBLE_TEST ?= bin/ansible-test
 TEST_FLAGS ?=
 
 # ansible-test units parameters (make test / make test-py3)

bin/ansible-test

@@ -0,0 +1,15 @@
+#!/usr/bin/env python
+# PYTHON_ARGCOMPLETE_OK
+"""Primary entry point for ansible-test."""
+
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
+import os
+import sys
+
+if __name__ == '__main__':
+    sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(os.path.dirname(__file__)), 'test', 'runner')))
+    import lib.cli
+    lib.cli.main()

changelogs/CHANGELOG-v2.5.rst

@@ -2,6 +2,203 @@
 Ansible 2.5 "Kashmir" Release Notes
 ===================================
 
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.11:
+
+v2.5.11
+=======
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.11_Release Summary:
+
+Release Summary
+---------------
+
+| Release Date: 2018-10-31
+| Security release for CVE-2018-16837 (https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16837)
+
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.11_Bugfixes:
+
+Bugfixes
+--------
+
+- user module - do not pass ssh_key_passphrase on cmdline (CVE-2018-16837)
+
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.10:
+
+v2.5.10
+=======
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.10_Release Summary:
+
+Release Summary
+---------------
+
+| Release Date: 2018-09-27
+| **Final scheduled release in 2.5 series**; future releases will be for critical security fixes only
+| `Porting Guide <https://docs.ansible.com/ansible/devel/porting_guides.html>`_
+
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.10_Bugfixes:
+
+Bugfixes
+--------
+
+- docker connection - Support empty files with copying to target (https://github.com/ansible/ansible/issues/36725)
+
+- chroot connection - Support empty files with copying to target (https://github.com/ansible/ansible/issues/36725)
+
+- jail connection - Support empty files with copying to target (https://github.com/ansible/ansible/issues/36725)
+
+- kubectl connection - Support empty files with copying to target (https://github.com/ansible/ansible/issues/36725)
+
+- libvirt_lxc connection - Support empty files with copying to target (https://github.com/ansible/ansible/issues/36725)
+
+- zone connection - Support empty files with copying to target (https://github.com/ansible/ansible/issues/36725)
+
+- cloudfront - fix bug when CloudFrontOriginAccessIdentityList is missing (https://github.com/ansible/ansible/pull/44984)
+
+- vyos_facts - fix vyos_facts not returning version number issue (https://github.com/ansible/ansible/pull/39115)
+
+- get_url - Don't re-download files unnecessarily when force=no (https://github.com/ansible/ansible/issues/45491)
+
+- loop - Ensure that a loop with a when condition that evaluates to false and delegate_to, will short circuit if the loop references an undefined variable. This matches the behavior in the same scenario without delegate_to (https://github.com/ansible/ansible/issues/45189)
+
+- mysql_*, proxysql_* - PyMySQL (a pure-Python MySQL driver) is now a preferred dependency also supporting Python 3.X.
+
+- nxos terminal plugin - fix python2.6 `nothing to repeat` bug (https://github.com/ansible/ansible/pull/45271).
+
+- ssh connection - Support empty files with piped transfer_method (https://github.com/ansible/ansible/issues/45426)
+
+- PLUGIN_FILTERS_CFG - Ensure that the value is treated as type=path, and that we use the standard section of ``defaults`` instead of ``default`` (https://github.com/ansible/ansible/pull/45994)
+
+- script inventory plugin - Don't pass file_name to DataLoader.load, which will prevent misleading error messages (https://github.com/ansible/ansible/issues/34164)
+
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.9:
+
+v2.5.9
+======
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.9_Release Summary:
+
+Release Summary
+---------------
+
+| Release Date: 2018-09-10
+| `Porting Guide <https://docs.ansible.com/ansible/devel/porting_guides.html>`_
+
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.9_Minor Changes:
+
+Minor Changes
+-------------
+
+- import_tasks - Do not allow import_tasks to transition to dynamic if the file is missing (https://github.com/ansible/ansible/issues/44822)
+
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.9_Bugfixes:
+
+Bugfixes
+--------
+
+- user - Strip trailing comments in /etc/default/passwd (https://github.com/ansible/ansible/pull/43931)
+
+- fix  example code for AWS lightsail documentation
+
+- fix the enable_snat parameter that is only supposed to be used by an user with the right policies. https://github.com/ansible/ansible/pull/44418
+
+- ios_l2_interface - fix issue with certain interface types (https://github.com/ansible/ansible/pull/43819)
+
+- ios_user - fix unable to delete user admin issue (https://github.com/ansible/ansible/pull/44904)
+
+- ansible-galaxy - properly list all roles in roles_path (https://github.com/ansible/ansible/issues/43010)
+
+- ios_vlan - fix unable to work on certain interface types issue (https://github.com/ansible/ansible/pull/43819)
+
+- The fix for `CVE-2018-10875 <https://access.redhat.com/security/cve/cve-2018-10875>`_ prints out a warning message about skipping a config file from a world writable current working directory.  However, if the user is in a world writable current working directory which does not contain a config file, it should not print a warning message.  This release fixes that extaneous warning.
+
+- Add md5sum check in nxos_file_copy module (https://github.com/ansible/ansible/pull/43423).
+
+- nxos_interface port-channel idempotence fix for mode (https://github.com/ansible/ansible/pull/44248).
+
+- nxos_linkagg mode fix (https://github.com/ansible/ansible/pull/44294).
+
+- Fix check_mode in nxos_static_route module (https://github.com/ansible/ansible/pull/44252).
+
+- Fix Python2.6 regex bug terminal plugin nxos, iosxr (https://github.com/ansible/ansible/pull/45135).
+
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.8:
+
+v2.5.8
+======
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.8_Release Summary:
+
+Release Summary
+---------------
+
+| Release Date: 2018-08-16
+| `Porting Guide <https://docs.ansible.com/ansible/devel/porting_guides.html>`_
+
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.8_Bugfixes:
+
+Bugfixes
+--------
+
+- fix for the bundled selectors module (used in the ssh and local connection plugins) when a syscall is restarted after being interrupted by a signal (https://github.com/ansible/ansible/issues/41630)
+
+- Fix the mount module's handling of swap entries in fstab (https://github.com/ansible/ansible/pull/42837)
+
+- The fix for `CVE-2018-10875 <https://access.redhat.com/security/cve/cve-2018-10875>`_ prints out a warning message about skipping a config file from a world writable current working directory.  However, if the user explicitly specifies that the config file should be used via the ANSIBLE_CONFIG environment variable then Ansible would honor that but still print out the warning message.  This has been fixed so that Ansible honors the user's explicit wishes and does not print a warning message in that circumstance.
+
+- fact names that conflict with well-known connection vars are now filtered (https://github.com/ansible/ansible/issues/41684)
+
+- get_url - fix the bug that get_url does not change mode when checksum matches (https://github.com/ansible/ansible/issues/29614)
+
+- openvswitch_db - make 'key' argument optional https://github.com/ansible/ansible/issues/42108
+
+- slack callback - Fix invocation by looking up data from cli.options (https://github.com/ansible/ansible/pull/43542)
+
+- vars_prompt - properly template play level variables in vars_prompt (https://github.com/ansible/ansible/issues/37984)
+
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.7:
+
+v2.5.7
+======
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.7_Release Summary:
+
+Release Summary
+---------------
+
+| Release Date: 2018-07-26
+| `Porting Guide <https://docs.ansible.com/ansible/devel/porting_guides.html>`_
+
+
+.. _Ansible 2.5 "Kashmir" Release Notes_v2.5.7_Bugfixes:
+
+Bugfixes
+--------
+
+- eos_facts - fix failure when lldp will be disabled (https://github.com/ansible/ansible/pull/42347)
+
+- ios_vlan - fix unable to identify correct vlan issue (https://github.com/ansible/ansible/pull/42247)
+
+- ios_linkagg - fix picking correct interface names issue (https://github.com/ansible/ansible/pull/42557)
+
+- get_capabilities in nxapi module_utils should not return empty dictionary (https://github.com/ansible/ansible/pull/42688).
+
+- Enforcing NXAPI default HTTP behavior (https://github.com/ansible/ansible/pull/41817).
+
+- pause - do not set stdout to raw mode when redirecting to a file (https://github.com/ansible/ansible/issues/41717)
+
+- pause - nest try except when importing curses to gracefully fail if curses is not present (https://github.com/ansible/ansible/issues/42004)
+
+
 .. _Ansible 2.5 "Kashmir" Release Notes_v2.5.6:
 
 v2.5.6

changelogs/fragments/43931-strip-trailing-comments.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - user - Strip trailing comments in /etc/default/passwd (https://github.com/ansible/ansible/pull/43931)

changelogs/fragments/aws_lightsail_documentation_fix.yml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+- fix  example code for AWS lightsail documentation

changelogs/fragments/dd-put-empty-files.yaml

@@ -0,0 +1,7 @@
+bugfixes:
+- docker connection - Support empty files with copying to target (https://github.com/ansible/ansible/issues/36725)
+- chroot connection - Support empty files with copying to target (https://github.com/ansible/ansible/issues/36725)
+- jail connection - Support empty files with copying to target (https://github.com/ansible/ansible/issues/36725)
+- kubectl connection - Support empty files with copying to target (https://github.com/ansible/ansible/issues/36725)
+- libvirt_lxc connection - Support empty files with copying to target (https://github.com/ansible/ansible/issues/36725)
+- zone connection - Support empty files with copying to target (https://github.com/ansible/ansible/issues/36725)

changelogs/fragments/eos_facts-failure.yml

@@ -0,0 +1,4 @@
+---
+bugfixes:
+  - eos_facts - fix failure when lldp will be disabled 
+    (https://github.com/ansible/ansible/pull/42347)

changelogs/fragments/fix-os_router.yaml

@@ -0,0 +1,3 @@
+bugfixes:
+    - fix the enable_snat parameter that is only supposed to be used by an user
+      with the right policies. https://github.com/ansible/ansible/pull/44418

changelogs/fragments/fix-selectors-error-condition.yaml

@@ -0,0 +1,5 @@
+---
+bugfixes:
+- fix for the bundled selectors module (used in the ssh and local connection
+  plugins) when a syscall is restarted after being interrupted by a signal
+  (https://github.com/ansible/ansible/issues/41630)

changelogs/fragments/fix-swap-mount-module.yaml

@@ -0,0 +1,4 @@
+---
+bugfixes:
+- Fix the mount module's handling of swap entries in fstab
+  (https://github.com/ansible/ansible/pull/42837)

changelogs/fragments/fix-world-readable-skip-message.yaml

@@ -0,0 +1,9 @@
+---
+bugfixes:
+- The fix for `CVE-2018-10875 <https://access.redhat.com/security/cve/cve-2018-10875>`_
+  prints out a warning message about skipping a config file from a world
+  writable current working directory.  However, if the user explicitly
+  specifies that the config file should be used via the ANSIBLE_CONFIG
+  environment variable then Ansible would honor that but still print out the
+  warning message.  This has been fixed so that Ansible honors the user's
+  explicit wishes and does not print a warning message in that circumstance.

changelogs/fragments/fix_44984.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- cloudfront - fix bug when CloudFrontOriginAccessIdentityList is missing (https://github.com/ansible/ansible/pull/44984)

changelogs/fragments/fix_fact_clean.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- fact names that conflict with well-known connection vars are now filtered (https://github.com/ansible/ansible/issues/41684)

changelogs/fragments/fix_ios_l2_interface.yaml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - ios_l2_interface - fix issue with certain interface types (https://github.com/ansible/ansible/pull/43819)

changelogs/fragments/fix_ios_user.yaml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - ios_user - fix unable to delete user admin issue (https://github.com/ansible/ansible/pull/44904)

changelogs/fragments/fix_ios_vlan.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- ios_vlan - fix unable to identify correct vlan issue (https://github.com/ansible/ansible/pull/42247)

changelogs/fragments/fix_vyos_facts.yaml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - vyos_facts - fix vyos_facts not returning version number issue (https://github.com/ansible/ansible/pull/39115)

changelogs/fragments/galaxy_list_all_roles.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+  - ansible-galaxy - properly list all roles in roles_path (https://github.com/ansible/ansible/issues/43010)

changelogs/fragments/get-url-fix-idempotency.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- get_url - Don't re-download files unnecessarily when force=no (https://github.com/ansible/ansible/issues/45491)

changelogs/fragments/get_url_bug_fix.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- get_url - fix the bug that get_url does not change mode when checksum matches (https://github.com/ansible/ansible/issues/29614)

changelogs/fragments/hashi_vault_fix_object_has_no_attribute_verify

@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - hashi_vault - fix AttributeError when 'auth_method' isn't 'token' (https://github.com/ansible/ansible/pull/36513)

changelogs/fragments/ios_linkagg_fix.yml

@@ -0,0 +1,2 @@
+bugfixes:
+- ios_linkagg - fix picking correct interface names issue (https://github.com/ansible/ansible/pull/42557)

changelogs/fragments/ios_vlan_interface.yaml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - ios_vlan - fix unable to work on certain interface types issue (https://github.com/ansible/ansible/pull/43819)

changelogs/fragments/loop_undefined_delegate_to.yaml

@@ -0,0 +1,4 @@
+bugfixes:
+- loop - Ensure that a loop with a when condition that evaluates to false and delegate_to, will short circuit if the
+  loop references an undefined variable. This matches the behavior in the same scenario without delegate_to
+  (https://github.com/ansible/ansible/issues/45189)

changelogs/fragments/more-world-readable-warning-skips.yaml

@@ -0,0 +1,7 @@
+---
+bugfixes:
+- The fix for `CVE-2018-10875 <https://access.redhat.com/security/cve/cve-2018-10875>`_
+  prints out a warning message about skipping a config file from a world
+  writable current working directory.  However, if the user is in a world
+  writable current working directory which does not contain a config file, it
+  should not print a warning message.  This release fixes that extaneous warning.

changelogs/fragments/mysql-migrate_to_pymysql.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- mysql_*, proxysql_* - PyMySQL (a pure-Python MySQL driver) is now a preferred dependency also supporting Python 3.X.

changelogs/fragments/no-dynamic-import-tasks.yaml

@@ -0,0 +1,5 @@
+minor_changes:
+- import_tasks - Do not allow import_tasks to transition to dynamic if the file is missing (https://github.com/ansible/ansible/issues/44822)
+release_summary: |
+   | Release Date: 2018-09-10
+   | `Porting Guide <https://docs.ansible.com/ansible/devel/porting_guides.html>`_

changelogs/fragments/nxos_file_copy.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- Add md5sum check in nxos_file_copy module (https://github.com/ansible/ansible/pull/43423).

changelogs/fragments/nxos_interface.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- nxos_interface port-channel idempotence fix for mode (https://github.com/ansible/ansible/pull/44248).

changelogs/fragments/nxos_linkagg.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- nxos_linkagg mode fix (https://github.com/ansible/ansible/pull/44294).

changelogs/fragments/nxos_module_utils_nxapi_get_capabilities.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- get_capabilities in nxapi module_utils should not return empty dictionary (https://github.com/ansible/ansible/pull/42688).

changelogs/fragments/nxos_nxapi_fix_2.5.7.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- Enforcing NXAPI default HTTP behavior (https://github.com/ansible/ansible/pull/41817).

changelogs/fragments/nxos_static_route_fix.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- Fix check_mode in nxos_static_route module (https://github.com/ansible/ansible/pull/44252).

changelogs/fragments/nxos_terminal_plugin_2.5.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- nxos terminal plugin - fix python2.6 `nothing to repeat` bug (https://github.com/ansible/ansible/pull/45271).

changelogs/fragments/openvswitch_db_make_key_optional.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+  - openvswitch_db - make 'key' argument optional https://github.com/ansible/ansible/issues/42108

changelogs/fragments/pause-stdout-redirection.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+  - pause - do not set stdout to raw mode when redirecting to a file (https://github.com/ansible/ansible/issues/41717)

changelogs/fragments/pause-try-except-curses.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+  - pause - nest try except when importing curses to gracefully fail if curses is not present (https://github.com/ansible/ansible/issues/42004)

changelogs/fragments/piped-transfer-empty-files.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- ssh connection - Support empty files with piped transfer_method (https://github.com/ansible/ansible/issues/45426)

changelogs/fragments/plugin-filters-cfg.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- PLUGIN_FILTERS_CFG - Ensure that the value is treated as type=path, and that we use the standard section of ``defaults`` instead of ``default`` (https://github.com/ansible/ansible/pull/45994)

changelogs/fragments/script-module-no-file-path.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- script inventory plugin - Don't pass file_name to DataLoader.load, which will prevent misleading error messages (https://github.com/ansible/ansible/issues/34164)

changelogs/fragments/slack_callback_invocation.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- slack callback - Fix invocation by looking up data from cli.options (https://github.com/ansible/ansible/pull/43542)

changelogs/fragments/terminal_plugin.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+- Fix Python2.6 regex bug terminal plugin nxos, iosxr (https://github.com/ansible/ansible/pull/45135).

changelogs/fragments/user-do-not-pass-ssh_key_passphrase-on-cmdline.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+  - user module - do not pass ssh_key_passphrase on cmdline (CVE-2018-16837)

changelogs/fragments/v2.5.10_summary.yaml

@@ -0,0 +1,4 @@
+release_summary: |
+   | Release Date: 2018-09-27
+   | **Final scheduled release in 2.5 series**; future releases will be for critical security fixes only
+   | `Porting Guide <https://docs.ansible.com/ansible/devel/porting_guides.html>`_

changelogs/fragments/v2.5.11_summary.yaml

@@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2018-10-31
+   | Security release for CVE-2018-16837 (https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16837)

changelogs/fragments/v2.5.7_summary.yaml

@@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2018-07-26
+   | `Porting Guide <https://docs.ansible.com/ansible/devel/porting_guides.html>`_

changelogs/fragments/v2.5.8_summary.yaml

@@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2018-08-16
+   | `Porting Guide <https://docs.ansible.com/ansible/devel/porting_guides.html>`_

changelogs/fragments/vars_prompt-allow-prompting-for-play-vars.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+  - vars_prompt - properly template play level variables in vars_prompt (https://github.com/ansible/ansible/issues/37984)

docs/docsite/rst/community/contributor_license_agreement.rst

@@ -0,0 +1,7 @@
+.. _contributor_license_agreement:
+
+******************************
+Contributors License Agreement
+******************************
+
+By contributing you agree that these contributions are your own (or approved by your employer) and you grant a full, complete, irrevocable copyright license to all users and developers of the project, present and future, pursuant to the license of the project.

docs/docsite/rst/community/development_process.rst

@@ -1,3 +1,5 @@
+.. _community_development_process:
+
 The Ansible Development Process
 ===============================
 

docs/docsite/rst/community/how_can_I_help.rst

@@ -3,7 +3,7 @@ How To Help
 
 .. contents:: Topics
 
-Thanks for being interested in helping the Ansible project! 
+Thanks for being interested in helping the Ansible project!
 
 There are many ways to help the Ansible project...but first, please read and understand the :ref:`code_of_conduct`.
 
@@ -23,7 +23,7 @@ When you become a power user, your ability and opportunities to help the Ansible
 Ask and answer questions online
 -------------------------------
 
-There are many forums online where Ansible users ask and answer questions. Reach out and communicate with your fellow Ansible users. 
+There are many forums online where Ansible users ask and answer questions. Reach out and communicate with your fellow Ansible users.
 
 You can find the official :ref:`Ansible communication channels <communication>`.
 
@@ -45,7 +45,7 @@ If you should discover that the bug you're trying to file already exists in an i
 Review and submit pull requests
 -------------------------------
 
-As you become more familiar with how Ansible works, you may be able to fix issues or develop new features yourself. If you think you've got a solution to a bug you've found in Ansible, or if you've got a new feature that you've written and would like to share with millions of Ansible users, read all about the `Ansible development process <http://docs.ansible.com/ansible/latest/community/development_process.rst>`_ to learn how to get your code accepted into Ansible.
+As you become more familiar with how Ansible works, you may be able to fix issues or develop new features yourself. If you think you've got a solution to a bug you've found in Ansible, or if you've got a new feature that you've written and would like to share with millions of Ansible users, read all about the :ref:`Ansible development process <community_development_process>` to learn how to get your code accepted into Ansible.
 
 Another good way to help is to review pull requests that other Ansible users have submitted. The Ansible community keeps a full list of `open pull requests by file <https://ansible.sivel.net/byfile.html>`_, so if there's a particular module or plug-in that particularly interests you, you can easily keep track of all the relevant new pull requests and provide testing or feedback.
 

docs/docsite/rst/community/index.rst

@@ -21,8 +21,5 @@ To get started, please read and understand the :ref:`code_of_conduct`, and then
    maintainers
    release_managers
    communication
+   contributor_license_agreement
    other_tools_and_programs
-   
-
-
-

docs/docsite/rst/dev_guide/developing_modules_checklist.rst

@@ -117,8 +117,8 @@ Read the complete :ref:`module metadata specification <ansible_metadata_block>`
   serializable.  A common pitfall is to try returning an object via
   exit_json().  Instead, convert the fields you need from the object into the
   fields of a dictionary and return the dictionary.
-* When fetching URLs, please use either fetch_url or open_url from ansible.module_utils.urls 
-  rather than urllib2; urllib2 does not natively verify TLS certificates and so is insecure for https. 
+* When fetching URLs, please use either fetch_url or open_url from ansible.module_utils.urls
+  rather than urllib2; urllib2 does not natively verify TLS certificates and so is insecure for https.
 * facts modules must return facts in the ansible_facts field of the :ref:`result
   dictionary<common_return_values>`.
 * modules that are purely about fact gathering need to implement check_mode.

docs/docsite/rst/dev_guide/testing/sanity/integration-aliases.rst

@@ -13,10 +13,11 @@ Tests must be configured to run in exactly one group. This is done by adding the
 
 The following are examples of some of the available groups:
 
-- ``posix/ci/group1``
-- ``windows/ci/group2``
-- ``posix/ci/cloud/group3/azure``
-- ``posix/ci/cloud/group4/aws``
+- ``shippable/posix/group1``
+- ``shippable/windows/group2``
+- ``shippable/azure/group3``
+- ``shippable/aws/group1``
+- ``shippable/cloud/group1``
 
 Groups are used to balance tests across multiple CI jobs to minimize test run time.
 They also improve efficiency by keeping tests with similar requirements running together.
@@ -41,6 +42,7 @@ Aliases can be used to skip platforms using one of the following:
 - ``skip/freebsd`` - Skip tests on FreeBSD.
 - ``skip/osx`` - Skip tests on macOS / OS X.
 - ``skip/rhel`` - Skip tests on RHEL.
+- ``skip/docker`` - Skip tests when running on a Docker container
 
 Aliases can be used to skip Python major versions using one of the following:
 

docs/docsite/rst/dev_guide/testing/sanity/symlinks.rst

@@ -0,0 +1,6 @@
+Sanity Tests » symlinks
+=======================
+
+Symbolic links are only permitted for files that exist to ensure proper tarball generation during a release.
+
+If other types of symlinks are needed for tests they must be created as part of the test.

docs/docsite/rst/dev_guide/testing_validate-modules.rst

@@ -110,6 +110,7 @@ Errors
   321       ``Exception`` attempting to import module for ``argument_spec`` introspection
   322       argument is listed in the argument_spec, but not documented in the module
   323       argument is listed in DOCUMENTATION.options, but not accepted by the module
+  332       ``AnsibleModule`` schema validation error
   ..
 ---------   -------------------
   **4xx**   **Syntax**

docs/docsite/rst/plugins/inventory.rst

@@ -2,7 +2,7 @@
 
 
 Inventory Plugins
------------------
+=================
 
 Inventory plugins allow users to point at data sources to compile the inventory of hosts that Ansible uses to target tasks, either via the ``-i /path/to/file`` and/or ``-i 'host1, host2`` command line parameters or from other configuration sources.
 
@@ -10,7 +10,7 @@ Inventory plugins allow users to point at data sources to compile the inventory
 .. _enabling_inventory:
 
 Enabling Inventory Plugins
-++++++++++++++++++++++++++
+--------------------------
 
 Most inventory plugins shipped with Ansible are disabled by default and need to be whitelisted in your
 :ref:`ansible.cfg <ansible_configuration_settings>` file in order to function.  This is how the default whitelist looks in the
@@ -19,7 +19,7 @@ config file that ships with Ansible:
 .. code-block:: ini
 
    [inventory]
-   enable_plugins = host_list, script, yaml, ini
+   enable_plugins = host_list, script, yaml, ini, auto
 
 This list also establishes the order in which each plugin tries to parse an inventory source. Any plugins left out of the list will not be considered, so you can 'optimize' your inventory loading by minimizing it to what you actually use. For example:
 
@@ -32,7 +32,7 @@ This list also establishes the order in which each plugin tries to parse an inve
 .. _using_inventory:
 
 Using Inventory Plugins
-+++++++++++++++++++++++
+-----------------------
 
 The only requirement for using an inventory plugin after it is enabled is to provide an inventory source to parse.
 Ansible will try to use the list of enabled inventory plugins, in order, against each inventory source provided.
@@ -42,7 +42,7 @@ Once an inventory plugin succeeds at parsing a source, the any remaining invento
 .. _inventory_plugin_list:
 
 Plugin List
-+++++++++++
+-----------
 
 You can use ``ansible-doc -t inventory -l`` to see the list of available plugins. 
 Use ``ansible-doc -t inventory <plugin name>`` to see plugin-specific documentation and examples.

docs/docsite/rst/reference_appendices/release_and_maintenance.rst

@@ -19,9 +19,6 @@ Ansible has a graduated support structure that extends to three major releases.
 For more information, read about the :ref:`development_and_stable_version_maintenance_workflow` or
 see the chart in :ref:`release_schedule` for the degrees to which current releases are supported.
 
-.. note:: Support for three major releases began with Ansible-2.4. Ansible-2.3 and older versions
-    are only supported for two releases.
-
 If you are using a release of Ansible that is no longer supported, we strongly
 encourage you to upgrade as soon as possible in order to benefit from the
 latest features and security fixes.
@@ -40,14 +37,16 @@ Release status
 ===============   ==========================   =================================================
 Ansible Release   Latest Version               Status
 ===============   ==========================   =================================================
-devel             `2.6` (unreleased, trunk)    In development
-2.5               `2.5.0`_ (2018-03-23)        Supported (security **and** general bugfixes)
-2.4               `2.4.4`_ (2018-01-31)        Supported (security **and** critical bug fixes)
-2.3               `2.3.3`_ (2017-12-20)        Unsupported (end of life)
-2.2               `2.2.3`_ (2017-05-09)        Unsupported (end of life)
-2.1               `2.1.6`_ (2017-06-01)        Unsupported (end of life)
-2.0               `2.0.2`_ (2016-04-19)        Unsupported (end of life)
-1.9               `1.9.6`_ (2016-04-15)        Unsupported (end of life)
+devel             2.8 (unreleased, trunk)      In development
+`2.7`_            2.7.0 (2018-10-04)           Supported (security **and** general bug fixes)
+`2.6`_            2.6.5 (2018-09-28)           Supported (security **and** critical bug fixes)
+`2.5`_            2.5.9 (2018-09-10)           Supported (security fixes)
+`2.4`_            2.4.6 (2018-07-05)           Unsupported (end of life)
+`2.3`_            2.3.3 (2017-12-20)           Unsupported (end of life)
+`2.2`_            2.2.3 (2017-05-09)           Unsupported (end of life)
+`2.1`_            2.1.6 (2017-06-01)           Unsupported (end of life)
+`2.0`_            2.0.2 (2016-04-19)           Unsupported (end of life)
+`1.9`_            1.9.6 (2016-04-15)           Unsupported (end of life)
 <1.9              n/a                          Unsupported (end of life)
 ===============   ==========================   =================================================
 
@@ -57,13 +56,15 @@ devel             `2.6` (unreleased, trunk)    In development
 
 .. Comment: devel used to point here but we're currently revamping our changelog process and have no
    link to a static changelog for devel _2.6: https://github.com/ansible/ansible/blob/devel/CHANGELOG.md
-.. _2.5.0: https://github.com/ansible/ansible/blob/stable-2.5/changelogs/CHANGELOG-v2.5.rst
-.. _2.4.4: https://github.com/ansible/ansible/blob/stable-2.4/CHANGELOG.md
-.. _2.3.3: https://github.com/ansible/ansible/blob/stable-2.3/CHANGELOG.md
-.. _2.2.3: https://github.com/ansible/ansible/blob/stable-2.2/CHANGELOG.md
-.. _2.1.6: https://github.com/ansible/ansible/blob/stable-2.1/CHANGELOG.md
-.. _2.0.2: https://github.com/ansible/ansible/blob/stable-2.0/CHANGELOG.md
-.. _1.9.6: https://github.com/ansible/ansible/blob/stable-1.9/CHANGELOG.md
+.. _2.7: https://github.com/ansible/ansible/blob/stable-2.7/changelogs/CHANGELOG-v2.7.rst
+.. _2.6: https://github.com/ansible/ansible/blob/stable-2.6/changelogs/CHANGELOG-v2.6.rst
+.. _2.5: https://github.com/ansible/ansible/blob/stable-2.5/changelogs/CHANGELOG-v2.5.rst
+.. _2.4: https://github.com/ansible/ansible/blob/stable-2.4/CHANGELOG.md
+.. _2.3: https://github.com/ansible/ansible/blob/stable-2.3/CHANGELOG.md
+.. _2.2: https://github.com/ansible/ansible/blob/stable-2.2/CHANGELOG.md
+.. _2.1: https://github.com/ansible/ansible/blob/stable-2.1/CHANGELOG.md
+.. _2.0: https://github.com/ansible/ansible/blob/stable-2.0/CHANGELOG.md
+.. _1.9: https://github.com/ansible/ansible/blob/stable-1.9/CHANGELOG.md
 
 .. _support_life:
 .. _methods:

docs/docsite/rst/user_guide/playbooks_filters.rst

@@ -87,7 +87,7 @@ Omitting Parameters
 As of Ansible 1.8, it is possible to use the default filter to omit module parameters using the special `omit` variable::
 
     - name: touch files with an optional mode
-      file: dest={{item.path}} state=touch mode={{item.mode|default(omit)}}
+      file: dest={{ item.path }} state=touch mode={{ item.mode | default(omit) }}
       loop:
         - path: /tmp/foo
         - path: /tmp/bar
@@ -123,11 +123,11 @@ To get the maximum value from a list of numbers::
 
 Flatten a list (same thing the `flatten` lookup does)::
 
-    {{ [3, [4, 2] ]|flatten }}
+    {{ [3, [4, 2] ] | flatten }}
 
 Flatten only the first level of a list (akin to the `items` lookup)::
 
-    {{ [3, [4, [2]] ]|flatten(level=1) }}
+    {{ [3, [4, [2]] ] | flatten(level=1) }}
 
 
 To get the minimum value from list of numbers::
@@ -173,29 +173,29 @@ items), but can also generate a random number based on a range.
 
 To get a random item from a list::
 
-    "{{ ['a','b','c']|random }}"
+    "{{ ['a','b','c'] | random }}"
     # => 'c'
 
 To get a random number between 0 and a specified number::
 
-    "{{ 60 |random}} * * * * root /script/from/cron"
+    "{{ 60 | random }} * * * * root /script/from/cron"
     # => '21 * * * * root /script/from/cron'
 
 Get a random number from 0 to 100 but in steps of 10::
 
-    {{ 101 |random(step=10) }}
+    {{ 101 | random(step=10) }}
     # => 70
 
 Get a random number from 1 to 100 but in steps of 10::
 
-    {{ 101 |random(1, 10) }}
+    {{ 101 | random(1, 10) }}
     # => 31
-    {{ 101 |random(start=1, step=10) }}
+    {{ 101 | random(start=1, step=10) }}
     # => 51
 
 As of Ansible version 2.3, it's also possible to initialize the random number generator from a seed. This way, you can create random-but-idempotent numbers::
 
-    "{{ 60 |random(seed=inventory_hostname) }} * * * * root /script/from/cron"
+    "{{ 60 | random(seed=inventory_hostname) }} * * * * root /script/from/cron"
 
 
 Shuffle Filter
@@ -207,14 +207,14 @@ This filter will randomize an existing list, giving a different order every invo
 
 To get a random list from an existing  list::
 
-    {{ ['a','b','c']|shuffle }}
+    {{ ['a','b','c'] | shuffle }}
     # => ['c','a','b']
-    {{ ['a','b','c']|shuffle }}
+    {{ ['a','b','c'] | shuffle }}
     # => ['b','c','a']
 
 As of Ansible version 2.3, it's also possible to shuffle a list idempotent. All you need is a seed.::
 
-    {{ ['a','b','c']|shuffle(seed=inventory_hostname) }}
+    {{ ['a','b','c'] | shuffle(seed=inventory_hostname) }}
     # => ['b','a','c']
 
 note that when used with a non 'listable' item it is a noop, otherwise it always returns a list
@@ -288,40 +288,51 @@ Now, let's take the following data structure::
 To extract all clusters from this structure, you can use the following query::
 
     - name: "Display all cluster names"
-      debug: var=item
-      loop: "{{domain_definition|json_query('domain.cluster[*].name')}}"
+      debug:
+        var: item
+      loop: "{{ domain_definition | json_query('domain.cluster[*].name') }}"
 
 Same thing for all server names::
 
     - name: "Display all server names"
-      debug: var=item
-      loop: "{{domain_definition|json_query('domain.server[*].name')}}"
+      debug:
+        var: item
+      loop: "{{ domain_definition | json_query('domain.server[*].name') }}"
 
 This example shows ports from cluster1::
 
-    - name: "Display all server names from cluster1"
-      debug: var=item
-      loop: "{{domain_definition|json_query(server_name_cluster1_query)}}"
+    - name: "Display all ports from cluster1"
+      debug:
+        var: item
+      loop: "{{ domain_definition | json_query(server_name_cluster1_query) }}"
       vars:
         server_name_cluster1_query: "domain.server[?cluster=='cluster1'].port"
 
 .. note:: You can use a variable to make the query more readable.
 
-Or, alternatively::
+Or, alternatively print out the ports in a comma separated string::
 
-    - name: "Display all server names from cluster1"
+    - name: "Display all ports from cluster1 as a string"
       debug:
-        var: item
-      loop: "{{domain_definition|json_query('domain.server[?cluster=`cluster1`].port')}}"
+        msg: "{{ domain_definition | json_query('domain.server[?cluster==`cluster1`].port') | join(', ') }}"
 
 .. note:: Here, quoting literals using backticks avoids escaping quotes and maintains readability.
 
+Or, using YAML `single quote escaping <http://yaml.org/spec/current.html#id2534365>`_::
+
+    - name: "Display all ports from cluster1"
+      debug:
+        var: item
+      loop: "{{ domain_definition | json_query('domain.server[?cluster==''cluster1''].port') }}"
+
+.. note:: Escaping single quotes within single quotes in YAML is done by doubling the single quote.
+
 In this example, we get a hash map with all ports and names of a cluster::
 
     - name: "Display all server ports and names from cluster1"
       debug:
         var: item
-      loop: "{{domain_definition|json_query(server_name_cluster1_query)}}"
+      loop: "{{ domain_definition | json_query(server_name_cluster1_query) }}"
       vars:
         server_name_cluster1_query: "domain.server[?cluster=='cluster2'].{name: name, port: port}"
 
@@ -558,31 +569,31 @@ Hashing filters
 
 To get the sha1 hash of a string::
 
-    {{ 'test1'|hash('sha1') }}
+    {{ 'test1' | hash('sha1') }}
 
 To get the md5 hash of a string::
 
-    {{ 'test1'|hash('md5') }}
+    {{ 'test1' | hash('md5') }}
 
 Get a string checksum::
 
-    {{ 'test2'|checksum }}
+    {{ 'test2' | checksum }}
 
 Other hashes (platform dependent)::
 
-    {{ 'test2'|hash('blowfish') }}
+    {{ 'test2' | hash('blowfish') }}
 
 To get a sha512 password hash (random salt)::
 
-    {{ 'passwordsaresecret'|password_hash('sha512') }}
+    {{ 'passwordsaresecret' | password_hash('sha512') }}
 
 To get a sha256 password hash with a specific salt::
 
-    {{ 'secretpassword'|password_hash('sha256', 'mysecretsalt') }}
+    {{ 'secretpassword' | password_hash('sha256', 'mysecretsalt') }}
 
 An idempotent method to generate unique hashes per system is to use a salt that is consistent between runs::
 
-    {{ 'secretpassword'|password_hash('sha512', 65534|random(seed=inventory_hostname)|string) }}
+    {{ 'secretpassword' | password_hash('sha512', 65534 | random(seed=inventory_hostname) | string) }}
 
 Hash types available depend on the master system running ansible,
 'hash' depends on hashlib password_hash depends on passlib (http://passlib.readthedocs.io/en/stable/lib/passlib.hash.html).
@@ -597,7 +608,7 @@ Combining hashes/dictionaries
 The `combine` filter allows hashes to be merged. For example, the
 following would override keys in one hash::
 
-    {{ {'a':1, 'b':2}|combine({'b':3}) }}
+    {{ {'a':1, 'b':2} | combine({'b':3}) }}
 
 The resulting hash would be::
 
@@ -609,7 +620,7 @@ hashes and merge their keys too
 
 .. code-block:: jinja
 
-    {{ {'a':{'foo':1, 'bar':2}, 'b':2}|combine({'a':{'bar':3, 'baz':4}}, recursive=True) }}
+    {{ {'a':{'foo':1, 'bar':2}, 'b':2} | combine({'a':{'bar':3, 'baz':4}}, recursive=True) }}
 
 This would result in::
 
@@ -617,7 +628,7 @@ This would result in::
 
 The filter can also take multiple arguments to merge::
 
-    {{ a|combine(b, c, d) }}
+    {{ a | combine(b, c, d) }}
 
 In this case, keys in `d` would override those in `c`, which would
 override those in `b`, and so on.
@@ -635,8 +646,8 @@ Extracting values from containers
 The `extract` filter is used to map from a list of indices to a list of
 values from a container (hash or array)::
 
-    {{ [0,2]|map('extract', ['x','y','z'])|list }}
-    {{ ['x','y']|map('extract', {'x': 42, 'y': 31})|list }}
+    {{ [0,2] | map('extract', ['x','y','z']) | list }}
+    {{ ['x','y'] | map('extract', {'x': 42, 'y': 31}) | list }}
 
 The results of the above expressions would be::
 
@@ -645,7 +656,7 @@ The results of the above expressions would be::
 
 The filter can take another argument::
 
-    {{ groups['x']|map('extract', hostvars, 'ec2_ip_address')|list }}
+    {{ groups['x'] | map('extract', hostvars, 'ec2_ip_address') | list }}
 
 This takes the list of hosts in group 'x', looks them up in `hostvars`,
 and then looks up the `ec2_ip_address` of the result. The final result
@@ -654,7 +665,7 @@ is a list of IP addresses for the hosts in group 'x'.
 The third argument to the filter can also be a list, for a recursive
 lookup inside the container::
 
-    {{ ['a']|map('extract', b, ['x','y'])|list }}
+    {{ ['a'] | map('extract', b, ['x','y']) | list }}
 
 This would return a list containing the value of `b['a']['x']['y']`.
 
@@ -918,19 +929,19 @@ doesn't know it is a boolean value::
 To make use of one attribute from each item in a list of complex variables, use the "map" filter (see the `Jinja2 map() docs`_ for more)::
 
     # get a comma-separated list of the mount points (e.g. "/,/mnt/stuff") on a host
-    {{ ansible_mounts|map(attribute='mount')|join(',') }}
+    {{ ansible_mounts | map(attribute='mount') | join(',') }}
 
 To get date object from string use the `to_datetime` filter, (new in version in 2.2)::
 
     # Get total amount of seconds between two dates. Default date format is %Y-%m-%d %H:%M:%S but you can pass your own format
-    {{ (("2016-08-14 20:00:12"|to_datetime) - ("2015-12-25"|to_datetime('%Y-%m-%d'))).total_seconds()  }}
+    {{ (("2016-08-14 20:00:12" | to_datetime) - ("2015-12-25" | to_datetime('%Y-%m-%d'))).total_seconds()  }}
 
     # Get remaining seconds after delta has been calculated. NOTE: This does NOT convert years, days, hours, etc to seconds. For that, use total_seconds()
-    {{ (("2016-08-14 20:00:12"|to_datetime) - ("2016-08-14 18:00:00"|to_datetime)).seconds  }}
+    {{ (("2016-08-14 20:00:12" | to_datetime) - ("2016-08-14 18:00:00" | to_datetime)).seconds  }}
     # This expression evaluates to "12" and not "132". Delta is 2 hours, 12 seconds
 
     # get amount of days between two dates. This returns only number of days and discards remaining hours, minutes, and seconds
-    {{ (("2016-08-14 20:00:12"|to_datetime) - ("2015-12-25"|to_datetime('%Y-%m-%d'))).days  }}
+    {{ (("2016-08-14 20:00:12" | to_datetime) - ("2015-12-25" | to_datetime('%Y-%m-%d'))).days  }}
 
 Combination Filters
 ````````````````````
@@ -942,34 +953,34 @@ To get permutations of a list::
 
     - name: give me largest permutations (order matters)
       debug:
-        msg: "{{ [1,2,3,4,5]|permutations|list }}"
+        msg: "{{ [1,2,3,4,5] | permutations | list }}"
 
     - name: give me permutations of sets of three
       debug:
-        msg: "{{ [1,2,3,4,5]|permutations(3)|list }}"
+        msg: "{{ [1,2,3,4,5] | permutations(3) | list }}"
 
 Combinations always require a set size::
 
     - name: give me combinations for sets of two
       debug:
-        msg: "{{ [1,2,3,4,5]|combinations(2)|list }}"
+        msg: "{{ [1,2,3,4,5] | combinations(2) | list }}"
 
 
 To get a list combining the elements of other lists use ``zip``::
 
     - name: give me list combo of two lists
       debug:
-       msg: "{{ [1,2,3,4,5]|zip(['a','b','c','d','e','f'])|list }}"
+       msg: "{{ [1,2,3,4,5] | zip(['a','b','c','d','e','f']) | list }}"
 
     - name: give me shortest combo of two lists
       debug:
-        msg: "{{ [1,2,3]|zip(['a','b','c','d','e','f'])|list }}"
+        msg: "{{ [1,2,3] | zip(['a','b','c','d','e','f']) | list }}"
 
 To always exhaust all list use ``zip_longest``::
 
     - name: give me longest combo of three lists , fill with X
       debug:
-        msg: "{{ [1,2,3]|zip_longest(['a','b','c','d','e','f'], [21, 22, 23], fillvalue='X')|list }}"
+        msg: "{{ [1,2,3] | zip_longest(['a','b','c','d','e','f'], [21, 22, 23], fillvalue='X') | list }}"
 
 
 .. versionadded:: 2.4

docs/docsite/rst/user_guide/playbooks_loops.rst

@@ -302,7 +302,7 @@ Another option to loop control is ``pause``, which allows you to control the tim
       loop_control:
         pause: 3
 
-.. versionadded:: 2.7
+.. versionadded:: 2.5
 
 If you need to keep track of where you are in a loop, you can use the ``index_var`` option to loop control to specify a variable name to contain the current loop index.::
 

docs/templates/config.rst.j2

@@ -39,6 +39,40 @@ Ansible will process the above list and use the first file found, all others are
         inventory = /etc/ansible/hosts  ; This points to the file that lists your hosts
 
 
+.. _cfg_in_world_writable_dir:
+
+Avoiding security risks with ``ansible.cfg`` in the current directory
+---------------------------------------------------------------------
+
+
+If Ansible were to load :file:ansible.cfg from a world-writable current working
+directory, it would create a serious security risk. Another user could place
+their own config file there, designed to make Ansible run malicious code both
+locally and remotely, possibly with elevated privileges. For this reason,
+Ansible will not automatically load a config file from the current working
+directory if the directory is world-writable.
+
+If you depend on using Ansible with a config file in the current working
+directory, the best way to avoid this problem is to restrict access to your
+Ansible directories to particular user(s) and/or group(s). If your Ansible
+directories live on a filesystem which has to emulate Unix permissions, like
+Vagrant or Windows Subsystem for Linux (WSL), you may, at first, not know how
+you can fix this as ``chmod``, ``chown``, and ``chgrp`` might not work there.
+In most of those cases, the correct fix is to modify the mount options of the
+filesystem so the files and directories are readable and writable by the users
+and groups running Ansible but closed to others.  For more details on the
+correct settings, see:
+
+* for Vagrant, Jeremy Kendall's `blog post <http://jeremykendall.net/2013/08/09/vagrant-synced-folders-permissions/>`_ covers synced folder permissions. 
+* for WSL, the `WSL docs <https://docs.microsoft.com/en-us/windows/wsl/wsl-config#set-wsl-launch-settings>`_
+  and this `Microsoft blog post <https://blogs.msdn.microsoft.com/commandline/2018/01/12/chmod-chown-wsl-improvements/>`_ cover mount options.
+
+If you absolutely depend on having the config live in a world-writable current
+working directory, you can explicitly specify the config file via the
+:envvar:`ANSIBLE_CONFIG` environment variable. Please take
+appropriate steps to mitigate the security concerns above before doing so.
+
+
 Common Options
 ==============
 

docs/templates/plugin.rst.j2

@@ -221,7 +221,7 @@ Notes
 Examples
 --------
 
-.. code-block:: yaml
+.. code-block:: yaml+jinja
 
 {%   for example in examples %}
 {%     if example['description'] %}@{ example['description'] | indent(4, True) }@{% endif %}

examples/ansible.cfg

@@ -308,7 +308,7 @@
 #any_errors_fatal = False
 
 [inventory]
-# enable inventory plugins, default: 'host_list', 'script', 'yaml', 'ini'
+# enable inventory plugins, default: 'host_list', 'script', 'yaml', 'ini', 'auto'
 #enable_plugins = host_list, virtualbox, yaml, constructed
 
 # ignore these extensions when parsing a directory as inventory source

hacking/env-setup

@@ -1,6 +1,22 @@
 # usage: source hacking/env-setup [-q]
 #    modifies environment for running Ansible from checkout
 
+# prepend a value to a potentially empty path variable
+# usage: prepend_path variable_name value
+prepend_path()
+{
+    variable_name="$1"
+    value="$2"
+
+    old_value=$( eval "echo \$$variable_name" )
+
+    if [ "x$old_value" != "x" ]; then
+        value="$value:"
+    fi
+
+    export "$variable_name=$value$old_value"
+}
+
 # Default values for shell variables we use
 PYTHONPATH=${PYTHONPATH-""}
 PATH=${PATH-""}
@@ -31,12 +47,12 @@ FULL_PATH=$($PYTHON_BIN -c "import os; print(os.path.realpath('$HACKING_DIR'))")
 export ANSIBLE_HOME="$(dirname "$FULL_PATH")"
 
 PREFIX_PYTHONPATH="$ANSIBLE_HOME/lib"
-PREFIX_PATH="$ANSIBLE_HOME/bin:$ANSIBLE_HOME/test/runner"
+PREFIX_PATH="$ANSIBLE_HOME/bin"
 PREFIX_MANPATH="$ANSIBLE_HOME/docs/man"
 
-expr "$PYTHONPATH" : "${PREFIX_PYTHONPATH}.*" > /dev/null || export PYTHONPATH="$PREFIX_PYTHONPATH:$PYTHONPATH"
-expr "$PATH" : "${PREFIX_PATH}.*" > /dev/null || export PATH="$PREFIX_PATH:$PATH"
-expr "$MANPATH" : "${PREFIX_MANPATH}.*" > /dev/null || export MANPATH="$PREFIX_MANPATH:$MANPATH"
+expr "$PYTHONPATH" : "${PREFIX_PYTHONPATH}.*" > /dev/null || prepend_path PYTHONPATH "$PREFIX_PYTHONPATH"
+expr "$PATH" : "${PREFIX_PATH}.*" > /dev/null || prepend_path PATH "$PREFIX_PATH"
+expr "$MANPATH" : "${PREFIX_MANPATH}.*" > /dev/null || prepend_path MANPATH "$PREFIX_MANPATH"
 
 #
 # Generate egg_info so that pkg_resources works

hacking/env-setup.fish

@@ -5,7 +5,7 @@ set HACKING_DIR (dirname (status -f))
 set FULL_PATH (python -c "import os; print(os.path.realpath('$HACKING_DIR'))")
 set ANSIBLE_HOME (dirname $FULL_PATH)
 set PREFIX_PYTHONPATH $ANSIBLE_HOME/lib
-set PREFIX_PATH $ANSIBLE_HOME/bin $ANSIBLE_HOME/test/runner
+set PREFIX_PATH $ANSIBLE_HOME/bin
 set PREFIX_MANPATH $ANSIBLE_HOME/docs/man
 
 # set quiet flag

lib/ansible/cli/galaxy.py

@@ -488,7 +488,7 @@ class GalaxyCLI(CLI):
                 path_files = os.listdir(role_path)
                 path_found = True
                 for path_file in path_files:
-                    gr = GalaxyRole(self.galaxy, path_file)
+                    gr = GalaxyRole(self.galaxy, path_file, path=path)
                     if gr.metadata:
                         install_info = gr.install_info
                         version = None

lib/ansible/compat/selectors/__init__.py

@@ -25,6 +25,14 @@ package exists on pypi to backport the functionality as far as python-2.6.
 '''
 # The following makes it easier for us to script updates of the bundled code
 _BUNDLED_METADATA = {"pypi_name": "selectors2", "version": "1.1.0"}
+# Added these bugfix commits from 2.1.0:
+# * https://github.com/SethMichaelLarson/selectors2/commit/3bd74f2033363b606e1e849528ccaa76f5067590
+#   Wrap kqueue.control so that timeout is a keyword arg
+# * https://github.com/SethMichaelLarson/selectors2/commit/6f6a26f42086d8aab273b30be492beecb373646b
+#   Fix formatting of the kqueue.control patch for pylint
+# * https://github.com/SethMichaelLarson/selectors2/commit/f0c2c6c66cfa7662bc52beaf4e2d65adfa25e189
+#   Fix use of OSError exception for py3 and use the wrapper of kqueue.control so retries of
+#   interrupted syscalls work with kqueue
 
 import os.path
 import sys

lib/ansible/compat/selectors/_selectors2.py

@@ -136,7 +136,7 @@ else:
                     if expires is not None:
                         current_time = monotonic()
                         if current_time > expires:
-                            raise OSError(errno=errno.ETIMEDOUT)
+                            raise OSError(errno.ETIMEDOUT)
                         if recalc_timeout:
                             if "timeout" in kwargs:
                                 kwargs["timeout"] = expires - current_time
@@ -340,7 +340,7 @@ if hasattr(select, "select"):
             timeout = None if timeout is None else max(timeout, 0.0)
             ready = []
             r, w, _ = _syscall_wrapper(self._select, True, self._readers,
-                                       self._writers, timeout)
+                                       self._writers, timeout=timeout)
             r = set(r)
             w = set(w)
             for fd in r | w:
@@ -561,14 +561,14 @@ if hasattr(select, "kqueue"):
                                        select.KQ_FILTER_READ,
                                        select.KQ_EV_ADD)
 
-                _syscall_wrapper(self._kqueue.control, False, [kevent], 0, 0)
+                _syscall_wrapper(self._wrap_control, False, [kevent], 0, 0)
 
             if events & EVENT_WRITE:
                 kevent = select.kevent(key.fd,
                                        select.KQ_FILTER_WRITE,
                                        select.KQ_EV_ADD)
 
-                _syscall_wrapper(self._kqueue.control, False, [kevent], 0, 0)
+                _syscall_wrapper(self._wrap_control, False, [kevent], 0, 0)
 
             return key
 
@@ -579,7 +579,7 @@ if hasattr(select, "kqueue"):
                                        select.KQ_FILTER_READ,
                                        select.KQ_EV_DELETE)
                 try:
-                    _syscall_wrapper(self._kqueue.control, False, [kevent], 0, 0)
+                    _syscall_wrapper(self._wrap_control, False, [kevent], 0, 0)
                 except SelectorError:
                     pass
             if key.events & EVENT_WRITE:
@@ -587,7 +587,7 @@ if hasattr(select, "kqueue"):
                                        select.KQ_FILTER_WRITE,
                                        select.KQ_EV_DELETE)
                 try:
-                    _syscall_wrapper(self._kqueue.control, False, [kevent], 0, 0)
+                    _syscall_wrapper(self._wrap_control, False, [kevent], 0, 0)
                 except SelectorError:
                     pass
 
@@ -600,8 +600,8 @@ if hasattr(select, "kqueue"):
             max_events = len(self._fd_to_key) * 2
             ready_fds = {}
 
-            kevent_list = _syscall_wrapper(self._kqueue.control, True,
-                                           None, max_events, timeout)
+            kevent_list = _syscall_wrapper(self._wrap_control, True,
+                                           None, max_events, timeout=timeout)
 
             for kevent in kevent_list:
                 fd = kevent.ident
@@ -626,6 +626,9 @@ if hasattr(select, "kqueue"):
             self._kqueue.close()
             super(KqueueSelector, self).close()
 
+        def _wrap_control(self, changelist, max_events, timeout):
+            return self._kqueue.control(changelist, max_events, timeout)
+
     __all__.append('KqueueSelector')
 
 

lib/ansible/config/base.yml

@@ -1458,6 +1458,13 @@ PLUGIN_FILTERS_CFG:
   ini:
   - key: plugin_filters_cfg
     section: default
+    deprecated:
+      why: Specifying "plugin_filters_cfg" under the "default" section is deprecated
+      version: "2.12"
+      alternatives: the "defaults" section instead
+  - key: plugin_filters_cfg
+    section: defaults
+  type: path
 RETRY_FILES_ENABLED:
   name: Retry files
   default: True

lib/ansible/config/manager.py

@@ -5,6 +5,7 @@ from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
 import os
+import os.path
 import sys
 import stat
 import tempfile
@@ -144,31 +145,63 @@ def find_ini_config_file(warnings=None):
     ''' Load INI Config File order(first found is used): ENV, CWD, HOME, /etc/ansible '''
     # FIXME: eventually deprecate ini configs
 
-    path0 = os.getenv("ANSIBLE_CONFIG", None)
-    if path0 is not None:
-        path0 = unfrackpath(path0, follow=False)
-        if os.path.isdir(path0):
-            path0 += "/ansible.cfg"
-    try:
-        path1 = os.getcwd()
-        perms1 = os.stat(path1)
-        if perms1.st_mode & stat.S_IWOTH:
-            if warnings is not None:
-                warnings.add("Ansible is in a world writable directory (%s), ignoring it as an ansible.cfg source." % to_text(path1))
-            path1 = None
-        else:
-            path1 += "/ansible.cfg"
-    except OSError:
-        path1 = None
-    path2 = unfrackpath("~/.ansible.cfg", follow=False)
-    path3 = "/etc/ansible/ansible.cfg"
+    if warnings is None:
+        # Note: In this case, warnings does nothing
+        warnings = set()
 
-    for path in [path0, path1, path2, path3]:
-        if path is not None and os.path.exists(path):
+    # A value that can never be a valid path so that we can tell if ANSIBLE_CONFIG was set later
+    # We can't use None because we could set path to None.
+    SENTINEL = object
+
+    potential_paths = []
+
+    # Environment setting
+    path_from_env = os.getenv("ANSIBLE_CONFIG", SENTINEL)
+    if path_from_env is not SENTINEL:
+        path_from_env = unfrackpath(path_from_env, follow=False)
+        if os.path.isdir(path_from_env):
+            path_from_env = os.path.join(path_from_env, "ansible.cfg")
+        potential_paths.append(path_from_env)
+
+    # Current working directory
+    warn_cmd_public = False
+    try:
+        cwd = os.getcwd()
+        perms = os.stat(cwd)
+        cwd_cfg = os.path.join(cwd, "ansible.cfg")
+        if perms.st_mode & stat.S_IWOTH:
+            # Working directory is world writable so we'll skip it.
+            # Still have to look for a file here, though, so that we know if we have to warn
+            if os.path.exists(cwd_cfg):
+                warn_cmd_public = True
+        else:
+            potential_paths.append(cwd_cfg)
+    except OSError:
+        # If we can't access cwd, we'll simply skip it as a possible config source
+        pass
+
+    # Per user location
+    potential_paths.append(unfrackpath("~/.ansible.cfg", follow=False))
+
+    # System location
+    potential_paths.append("/etc/ansible/ansible.cfg")
+
+    for path in potential_paths:
+        if os.path.exists(path):
             break
     else:
         path = None
 
+    # Emit a warning if all the following are true:
+    # * We did not use a config from ANSIBLE_CONFIG
+    # * There's an ansible.cfg in the current working directory that we skipped
+    if path_from_env != path and warn_cmd_public:
+        warnings.add(u"Ansible is being run in a world writable directory (%s),"
+                     u" ignoring it as an ansible.cfg source."
+                     u" For more information see"
+                     u" https://docs.ansible.com/ansible/devel/reference_appendices/config.html#cfg-in-world-writable-dir"
+                     % to_text(cwd))
+
     return path
 
 

lib/ansible/constants.py

@@ -22,7 +22,7 @@ def _warning(msg):
     try:
         from __main__ import display
         display.warning(msg)
-    except:
+    except Exception:
         import sys
         sys.stderr.write(' [WARNING] %s\n' % (msg))
 
@@ -32,7 +32,7 @@ def _deprecated(msg, version='2.8'):
     try:
         from __main__ import display
         display.deprecated(msg, version=version)
-    except:
+    except Exception:
         import sys
         sys.stderr.write(' [DEPRECATED] %s, to be removed in %s\n' % (msg, version))
 
@@ -53,7 +53,7 @@ def get_config(parser, section, key, env_var, default_value, value_type=None, ex
     if value is None:
         try:
             value = get_ini_config_value(parser, {'key': key, 'section': section})
-        except:
+        except Exception:
             pass
     if value is None:
         value = default_value
@@ -121,6 +121,10 @@ VAULT_VERSION_MAX = 1.0
 # object. The dictionary values are tuples, to account for aliases
 # in variable names.
 
+COMMON_CONNECTION_VARS = frozenset(set(('ansible_connection', 'ansible_host', 'ansible_user', 'ansible_shell_executable',
+                                        'ansible_port', 'ansible_pipelining', 'ansible_password', 'ansible_timeout',
+                                        'ansible_shell_type', 'ansible_module_compression', 'ansible_private_key_file')))
+
 MAGIC_VARIABLE_MAPPING = dict(
 
     # base
@@ -191,7 +195,7 @@ for setting in config.data.get_settings():
                 value = literal_eval(value)
             except ValueError:
                 pass  # not a python data structure
-        except:
+        except Exception:
             pass  # not templatable
         value = ensure_type(value, setting.name)
 

lib/ansible/executor/playbook_executor.py

@@ -102,16 +102,13 @@ class PlaybookExecutor:
                     # clear any filters which may have been applied to the inventory
                     self._inventory.remove_restriction()
 
-                    # Create a temporary copy of the play here, so we can run post_validate
-                    # on it without the templating changes affecting the original object.
-                    # Doing this before vars_prompt to allow for using variables in prompt.
+                    # Allow variables to be used in vars_prompt fields.
                     all_vars = self._variable_manager.get_vars(play=play)
                     templar = Templar(loader=self._loader, variables=all_vars)
-                    new_play = play.copy()
-                    new_play.post_validate(templar)
+                    setattr(play, 'vars_prompt', templar.template(play.vars_prompt))
 
                     if play.vars_prompt:
-                        for var in new_play.vars_prompt:
+                        for var in play.vars_prompt:
                             vname = var['name']
                             prompt = var.get("prompt", vname)
                             default = var.get("default", None)
@@ -128,17 +125,17 @@ class PlaybookExecutor:
                                 else:  # we are either in --list-<option> or syntax check
                                     play.vars[vname] = default
 
-                        # Post validating again in case variables were entered in the prompt.
-                        all_vars = self._variable_manager.get_vars(play=play)
-                        templar = Templar(loader=self._loader, variables=all_vars)
-                        new_play.post_validate(templar)
+                    # Post validate so any play level variables are templated
+                    all_vars = self._variable_manager.get_vars(play=play)
+                    templar = Templar(loader=self._loader, variables=all_vars)
+                    play.post_validate(templar)
 
                     if self._options.syntax:
                         continue
 
                     if self._tqm is None:
                         # we are just doing a listing
-                        entry['plays'].append(new_play)
+                        entry['plays'].append(play)
 
                     else:
                         self._tqm._unreachable_hosts.update(self._unreachable_hosts)
@@ -148,9 +145,9 @@ class PlaybookExecutor:
 
                         break_play = False
                         # we are actually running plays
-                        batches = self._get_serialized_batches(new_play)
+                        batches = self._get_serialized_batches(play)
                         if len(batches) == 0:
-                            self._tqm.send_callback('v2_playbook_on_play_start', new_play)
+                            self._tqm.send_callback('v2_playbook_on_play_start', play)
                             self._tqm.send_callback('v2_playbook_on_no_hosts_matched')
                         for batch in batches:
                             # restrict the inventory to the hosts in the serialized batch

lib/ansible/module_utils/aws/cloudfront_facts.py

@@ -93,7 +93,7 @@ class CloudFrontFactsServiceManager(object):
     def list_origin_access_identities(self):
         try:
             paginator = self.client.get_paginator('list_cloud_front_origin_access_identities')
-            result = paginator.paginate().build_full_result()['CloudFrontOriginAccessIdentityList']
+            result = paginator.paginate().build_full_result().get('CloudFrontOriginAccessIdentityList', {})
             return result.get('Items', [])
         except botocore.exceptions.ClientError as e:
             self.module.fail_json_aws(e, msg="Error listing cloud front origin access identities")

lib/ansible/module_utils/azure_rm_common.py

@@ -839,6 +839,9 @@ class AzureRMModuleBase(object):
             profile_default_version = api_profile_dict.get('default_api_version', None)
             if api_version or profile_default_version:
                 client_kwargs['api_version'] = api_version or profile_default_version
+                if 'profile' in client_kwargs:
+                    # remove profile; only pass API version if specified
+                    client_kwargs.pop('profile')
 
         client = client_type(**client_kwargs)
 

lib/ansible/module_utils/mysql.py

@@ -30,10 +30,14 @@
 import os
 
 try:
-    import MySQLdb
-    mysqldb_found = True
+    import pymysql as mysql_driver
 except ImportError:
-    mysqldb_found = False
+    try:
+        import MySQLdb as mysql_driver
+    except ImportError:
+        mysql_driver = None
+
+mysql_driver_fail_msg = 'The PyMySQL (Python 2.7 and Python 3.X) or MySQL-python (Python 2.X) module is required.'
 
 
 def mysql_connect(module, login_user=None, login_password=None, config_file='', ssl_cert=None, ssl_key=None, ssl_ca=None, db=None, cursor_class=None,
@@ -69,8 +73,8 @@ def mysql_connect(module, login_user=None, login_password=None, config_file='',
     if connect_timeout is not None:
         config['connect_timeout'] = connect_timeout
 
-    db_connection = MySQLdb.connect(**config)
+    db_connection = mysql_driver.connect(**config)
     if cursor_class is not None:
-        return db_connection.cursor(cursorclass=MySQLdb.cursors.DictCursor)
+        return db_connection.cursor(cursorclass=mysql_driver.cursors.DictCursor)
     else:
         return db_connection.cursor()

lib/ansible/module_utils/network/eos/eos.py

@@ -176,7 +176,12 @@ class Cli:
                 prompt = None
                 answer = None
 
-            out = connection.get(command, prompt, answer)
+            try:
+                out = connection.get(command, prompt, answer)
+            except ConnectionError as exc:
+                if check_rc:
+                    raise
+                out = getattr(exc, 'err', exc)
             out = to_text(out, errors='surrogate_or_strict')
 
             try:
@@ -338,7 +343,7 @@ class Eapi:
 
         return response
 
-    def run_commands(self, commands):
+    def run_commands(self, commands, check_rc=True):
         """Runs list of commands on remote device and returns results
         """
         output = None
@@ -440,7 +445,11 @@ class Eapi:
             commands = ['configure session %s' % session, 'abort']
             self.send_request(commands)
             err = response['error']
-            self._module.fail_json(msg=err['message'], code=err['code'])
+            error_text = []
+            for data in err['data']:
+                error_text.extend(data.get('errors', []))
+            error_text = '\n'.join(error_text) or err['message']
+            self._module.fail_json(msg=error_text, code=err['code'])
 
         commands = ['configure session %s' % session, 'show session-config diffs']
         if commit:
@@ -489,9 +498,9 @@ def get_config(module, flags=None):
     return conn.get_config(flags)
 
 
-def run_commands(module, commands):
+def run_commands(module, commands, check_rc=True):
     conn = get_connection(module)
-    return conn.run_commands(to_command(module, commands))
+    return conn.run_commands(to_command(module, commands), check_rc)
 
 
 def load_config(module, config, commit=False, replace=False):

lib/ansible/module_utils/network/ios/ios.py

@@ -166,3 +166,51 @@ def load_config(module, commands):
     connection = get_connection(module)
 
     return connection.edit_config(commands)
+
+
+def normalize_interface(name):
+    """Return the normalized interface name
+    """
+    if not name:
+        return
+
+    def _get_number(name):
+        digits = ''
+        for char in name:
+            if char.isdigit() or char in '/.':
+                digits += char
+        return digits
+
+    if name.lower().startswith('gi'):
+        if_type = 'GigabitEthernet'
+    elif name.lower().startswith('te'):
+        if_type = 'TenGigabitEthernet'
+    elif name.lower().startswith('fa'):
+        if_type = 'FastEthernet'
+    elif name.lower().startswith('fo'):
+        if_type = 'FortyGigabitEthernet'
+    elif name.lower().startswith('et'):
+        if_type = 'Ethernet'
+    elif name.lower().startswith('vl'):
+        if_type = 'Vlan'
+    elif name.lower().startswith('lo'):
+        if_type = 'loopback'
+    elif name.lower().startswith('po'):
+        if_type = 'port-channel'
+    elif name.lower().startswith('nv'):
+        if_type = 'nve'
+    else:
+        if_type = None
+
+    number_list = name.split(' ')
+    if len(number_list) == 2:
+        if_number = number_list[-1].strip()
+    else:
+        if_number = _get_number(name)
+
+    if if_type:
+        proper_interface = if_type + if_number
+    else:
+        proper_interface = name
+
+    return proper_interface

lib/ansible/module_utils/network/nxos/nxos.py

@@ -418,8 +418,34 @@ class Nxapi:
         else:
             return []
 
+    def get_device_info(self):
+        device_info = {}
+
+        device_info['network_os'] = 'nxos'
+        reply = self.run_commands({'command': 'show version', 'output': 'json'})
+        data = reply[0]
+
+        platform_reply = self.run_commands({'command': 'show inventory', 'output': 'json'})
+        platform_info = platform_reply[0]
+
+        device_info['network_os_version'] = data.get('sys_ver_str') or data.get('kickstart_ver_str')
+        device_info['network_os_model'] = data['chassis_id']
+        device_info['network_os_hostname'] = data['host_name']
+        device_info['network_os_image'] = data.get('isan_file_name') or data.get('kick_file_name')
+
+        if platform_info:
+            inventory_table = platform_info['TABLE_inv']['ROW_inv']
+            for info in inventory_table:
+                if 'Chassis' in info['name']:
+                    device_info['network_os_platform'] = info['productid']
+
+        return device_info
+
     def get_capabilities(self):
-        return {}
+        result = {}
+        result['device_info'] = self.get_device_info()
+        result['network_api'] = 'nxapi'
+        return result
 
 
 def is_json(cmd):

lib/ansible/modules/cloud/amazon/ec2_eni.py

@@ -157,8 +157,7 @@ EXAMPLES = '''
     subnet_id: subnet-xxxxxxxx
     eni_id: eni-yyyyyyyy
     state: present
-    secondary_private_ip_addresses:
-      -
+    secondary_private_ip_address_count: 0
 
 # Destroy an ENI, detaching it from any instance if necessary
 - ec2_eni:

lib/ansible/modules/cloud/amazon/ecs_attribute.py

@@ -257,7 +257,7 @@ def main():
         attributes=dict(required=True, type='list'),
     ))
 
-    required_together = (['cluster', 'ec2_instance_id', 'attributes'])
+    required_together = [['cluster', 'ec2_instance_id', 'attributes']]
 
     module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True,
                            required_together=required_together)

lib/ansible/modules/cloud/amazon/ecs_cluster.py

@@ -162,7 +162,7 @@ def main():
         delay=dict(required=False, type='int', default=10),
         repeat=dict(required=False, type='int', default=10)
     ))
-    required_together = (['state', 'name'])
+    required_together = [['state', 'name']]
 
     module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True, required_together=required_together)
 

lib/ansible/modules/cloud/amazon/elb_application_lb.py

@@ -989,9 +989,9 @@ def main():
                            required_if=[
                                ('state', 'present', ['subnets', 'security_groups'])
                            ],
-                           required_together=(
+                           required_together=[
                                ['access_logs_enabled', 'access_logs_s3_bucket', 'access_logs_s3_prefix']
-                           )
+                           ]
                            )
 
     # Quick check of listeners parameters

lib/ansible/modules/cloud/amazon/elb_application_lb_facts.py

@@ -258,7 +258,7 @@ def main():
     )
 
     module = AnsibleModule(argument_spec=argument_spec,
-                           mutually_exclusive=['load_balancer_arns', 'names'],
+                           mutually_exclusive=[['load_balancer_arns', 'names']],
                            supports_check_mode=True
                            )
 

lib/ansible/modules/cloud/amazon/elb_target.py

@@ -296,7 +296,7 @@ def main():
     )
 
     module = AnsibleModule(argument_spec=argument_spec,
-                           mutually_exclusive=['target_group_arn', 'target_group_name']
+                           mutually_exclusive=[['target_group_arn', 'target_group_name']]
                            )
 
     if not HAS_BOTO3:

lib/ansible/modules/cloud/amazon/elb_target_group_facts.py

@@ -247,7 +247,7 @@ def main():
     )
 
     module = AnsibleModule(argument_spec=argument_spec,
-                           mutually_exclusive=['load_balancer_arn', 'target_group_arns', 'names'],
+                           mutually_exclusive=[['load_balancer_arn', 'target_group_arns', 'names']],
                            supports_check_mode=True
                            )
 

lib/ansible/modules/cloud/amazon/lightsail.py

@@ -93,7 +93,7 @@ EXAMPLES = '''
     msg: "Name is {{ my_instance.instance.name }}"
 
 - debug:
-    msg: "IP is {{ my_instance.instance.publicIpAddress }}"
+    msg: "IP is {{ my_instance.instance.public_ip_address }}"
 
 # Delete an instance if present
 - lightsail:

lib/ansible/modules/cloud/azure/azure_rm_containerinstance.py

@@ -50,7 +50,7 @@ options:
         choices:
             - public
             - none
-        default: None
+        default: 'none'
     ports:
         description:
             - List of ports exposed within the container group.
@@ -93,7 +93,7 @@ options:
         description:
             - Force update of existing container instance. Any update will result in deletion and recreation of existing containers.
         type: bool
-        default: False
+        default: 'no'
 
 extends_documentation_fragment:
     - azure
@@ -145,6 +145,7 @@ from ansible.module_utils.azure_rm_common import AzureRMModuleBase
 
 try:
     from msrestazure.azure_exceptions import CloudError
+    from msrestazure.azure_operation import AzureOperationPoller
     from azure.mgmt.containerinstance import ContainerInstanceManagementClient
 except ImportError:
     # This is handled in azure_rm_common
@@ -383,6 +384,9 @@ class AzureRMContainerInstance(AzureRMModuleBase):
                                                                  container_group_name=self.name,
                                                                  container_group=parameters)
 
+        if isinstance(response, AzureOperationPoller):
+            response = self.get_poller_result(response)
+
         return response.as_dict()
 
     def delete_containerinstance(self):

lib/ansible/modules/cloud/azure/azure_rm_mysqldatabase.py

@@ -88,9 +88,9 @@ import time
 from ansible.module_utils.azure_rm_common import AzureRMModuleBase
 
 try:
-    from msrestazure.azure_exceptions import CloudError
-    from msrestazure.azure_operation import AzureOperationPoller
     from azure.mgmt.rdbms.mysql import MySQLManagementClient
+    from msrestazure.azure_exceptions import CloudError
+    from msrest.polling import LROPoller
     from msrest.serialization import Model
 except ImportError:
     # This is handled in azure_rm_common
@@ -240,7 +240,7 @@ class AzureRMDatabases(AzureRMModuleBase):
                                                                    server_name=self.server_name,
                                                                    database_name=self.name,
                                                                    parameters=self.parameters)
-            if isinstance(response, AzureOperationPoller):
+            if isinstance(response, LROPoller):
                 response = self.get_poller_result(response)
 
         except CloudError as exc:

lib/ansible/modules/cloud/azure/azure_rm_mysqlserver.py

@@ -124,9 +124,9 @@ import time
 from ansible.module_utils.azure_rm_common import AzureRMModuleBase
 
 try:
-    from msrestazure.azure_exceptions import CloudError
-    from msrestazure.azure_operation import AzureOperationPoller
     from azure.mgmt.rdbms.mysql import MySQLManagementClient
+    from msrestazure.azure_exceptions import CloudError
+    from msrest.polling import LROPoller
     from msrest.serialization import Model
 except ImportError:
     # This is handled in azure_rm_common
@@ -303,10 +303,15 @@ class AzureRMServers(AzureRMModuleBase):
         self.log("Creating / Updating the MySQL Server instance {0}".format(self.name))
 
         try:
-            response = self.mgmt_client.servers.create_or_update(resource_group_name=self.resource_group,
-                                                                 server_name=self.name,
-                                                                 parameters=self.parameters)
-            if isinstance(response, AzureOperationPoller):
+            if (self.to_do == Actions.Create):
+                response = self.mgmt_client.servers.create(resource_group_name=self.resource_group,
+                                                           server_name=self.name,
+                                                           parameters=self.parameters)
+            else:
+                response = self.mgmt_client.servers.update(resource_group_name=self.resource_group,
+                                                           server_name=self.name,
+                                                           parameters=self.parameters)
+            if isinstance(response, LROPoller):
                 response = self.get_poller_result(response)
 
         except CloudError as exc:

lib/ansible/modules/cloud/azure/azure_rm_postgresqldatabase.py

@@ -88,9 +88,9 @@ import time
 from ansible.module_utils.azure_rm_common import AzureRMModuleBase
 
 try:
-    from msrestazure.azure_exceptions import CloudError
-    from msrestazure.azure_operation import AzureOperationPoller
     from azure.mgmt.rdbms.postgresql import PostgreSQLManagementClient
+    from msrestazure.azure_exceptions import CloudError
+    from msrest.polling import LROPoller
     from msrest.serialization import Model
 except ImportError:
     # This is handled in azure_rm_common
@@ -240,7 +240,7 @@ class AzureRMDatabases(AzureRMModuleBase):
                                                                    server_name=self.server_name,
                                                                    database_name=self.name,
                                                                    parameters=self.parameters)
-            if isinstance(response, AzureOperationPoller):
+            if isinstance(response, LROPoller):
                 response = self.get_poller_result(response)
 
         except CloudError as exc:

lib/ansible/modules/cloud/azure/azure_rm_postgresqlserver.py

@@ -124,9 +124,9 @@ import time
 from ansible.module_utils.azure_rm_common import AzureRMModuleBase
 
 try:
-    from msrestazure.azure_exceptions import CloudError
-    from msrestazure.azure_operation import AzureOperationPoller
     from azure.mgmt.rdbms.postgresql import PostgreSQLManagementClient
+    from msrestazure.azure_exceptions import CloudError
+    from msrest.polling import LROPoller
     from msrest.serialization import Model
 except ImportError:
     # This is handled in azure_rm_common
@@ -311,7 +311,7 @@ class AzureRMServers(AzureRMModuleBase):
                 response = self.mgmt_client.servers.update(resource_group_name=self.resource_group,
                                                            server_name=self.name,
                                                            parameters=self.parameters)
-            if isinstance(response, AzureOperationPoller):
+            if isinstance(response, LROPoller):
                 response = self.get_poller_result(response)
 
         except CloudError as exc:

lib/ansible/modules/cloud/digital_ocean/digital_ocean_floating_ip.py

@@ -308,12 +308,12 @@ def main():
             validate_certs=dict(type='bool', default=True),
             timeout=dict(type='int', default=30),
         ),
-        required_if=([
+        required_if=[
             ('state', 'delete', ['ip'])
-        ]),
-        mutually_exclusive=(
+        ],
+        mutually_exclusive=[
             ['region', 'droplet_id']
-        ),
+        ],
     )
 
     core(module)

lib/ansible/modules/cloud/openstack/os_router.py

@@ -42,7 +42,7 @@ options:
      description:
         - Enable Source NAT (SNAT) attribute.
      required: false
-     default: true
+     type: bool
    network:
      description:
         - Unique name or ID of the external gateway network.
@@ -317,7 +317,8 @@ def _build_kwargs(cloud, module, router, network):
     if network:
         kwargs['ext_gateway_net_id'] = network['id']
         # can't send enable_snat unless we have a network
-        kwargs['enable_snat'] = module.params['enable_snat']
+        if module.params['enable_snat']:
+            kwargs['enable_snat'] = module.params['enable_snat']
 
     if module.params['external_fixed_ips']:
         kwargs['ext_fixed_ips'] = []
@@ -381,7 +382,7 @@ def main():
         state=dict(default='present', choices=['absent', 'present']),
         name=dict(required=True),
         admin_state_up=dict(type='bool', default=True),
-        enable_snat=dict(type='bool', default=True),
+        enable_snat=dict(type='bool'),
         network=dict(default=None),
         interfaces=dict(type='list', default=None),
         external_fixed_ips=dict(type='list', default=None),

lib/ansible/modules/cloud/vmware/vmware_guest_tools_wait.py

@@ -163,7 +163,7 @@ def main():
     module = AnsibleModule(
         argument_spec=argument_spec,
         required_one_of=[['name', 'uuid']],
-        required_together=['name', 'folder']
+        required_together=[['name', 'folder']],
     )
 
     # FindByInventoryPath() does not require an absolute path

lib/ansible/modules/clustering/k8s/_kubernetes.py

@@ -349,7 +349,7 @@ def main():
         mutually_exclusive=(('file_reference', 'inline_data'),
                             ('url_username', 'insecure'),
                             ('url_password', 'insecure')),
-        required_one_of=(('file_reference', 'inline_data')),
+        required_one_of=(('file_reference', 'inline_data'),),
     )
 
     if not HAS_LIB_YAML:

lib/ansible/modules/database/mysql/mysql_db.py

@@ -68,7 +68,9 @@ requirements:
    - mysql (command line binary)
    - mysqldump (command line binary)
 notes:
-   - Requires the python-mysqldb package on the remote host, as well as mysql and mysqldump binaries.
+   - Requires the PyMySQL (Python 2.7 and Python 3.X) or MySQL-python (Python 2.X) package on the remote host,
+     as well as mysql and mysqldump binaries.
+   - This module is B(not idempotent) when I(state) is C(import), and will import the dump file each time if run more than once.
 extends_documentation_fragment: mysql
 '''
 
@@ -107,16 +109,9 @@ import pipes
 import subprocess
 import traceback
 
-try:
-    import MySQLdb
-except ImportError:
-    mysqldb_found = False
-else:
-    mysqldb_found = True
-
 from ansible.module_utils.basic import AnsibleModule
 from ansible.module_utils.database import mysql_quote_identifier
-from ansible.module_utils.mysql import mysql_connect, mysqldb_found
+from ansible.module_utils.mysql import mysql_connect, mysql_driver, mysql_driver_fail_msg
 from ansible.module_utils._text import to_native
 
 
@@ -275,8 +270,8 @@ def main():
         supports_check_mode=True
     )
 
-    if not mysqldb_found:
-        module.fail_json(msg="The MySQL-python module is required.")
+    if mysql_driver is None:
+        module.fail_json(msg=mysql_driver_fail_msg)
 
     db = module.params["name"]
     encoding = module.params["encoding"]

lib/ansible/modules/database/mysql/mysql_replication.py

@@ -121,15 +121,8 @@ EXAMPLES = '''
 import os
 import warnings
 
-try:
-    import MySQLdb
-except ImportError:
-    mysqldb_found = False
-else:
-    mysqldb_found = True
-
 from ansible.module_utils.basic import AnsibleModule
-from ansible.module_utils.mysql import mysql_connect
+from ansible.module_utils.mysql import mysql_connect, mysql_driver, mysql_driver_fail_msg
 from ansible.module_utils._text import to_native
 
 
@@ -242,16 +235,16 @@ def main():
     connect_timeout = module.params['connect_timeout']
     config_file = module.params['config_file']
 
-    if not mysqldb_found:
-        module.fail_json(msg="The MySQL-python module is required.")
+    if mysql_driver is None:
+        module.fail_json(msg=mysql_driver_fail_msg)
     else:
-        warnings.filterwarnings('error', category=MySQLdb.Warning)
+        warnings.filterwarnings('error', category=mysql_driver.Warning)
 
     login_password = module.params["login_password"]
     login_user = module.params["login_user"]
 
     try:
-        cursor = mysql_connect(module, login_user, login_password, config_file, ssl_cert, ssl_key, ssl_ca, None, 'MySQLdb.cursors.DictCursor',
+        cursor = mysql_connect(module, login_user, login_password, config_file, ssl_cert, ssl_key, ssl_ca, None, 'mysql_driver.cursors.DictCursor',
                                connect_timeout=connect_timeout)
     except Exception as e:
         if os.path.exists(config_file):
@@ -328,7 +321,7 @@ def main():
             chm.append("MASTER_AUTO_POSITION = 1")
         try:
             changemaster(cursor, chm, chm_params)
-        except MySQLdb.Warning as e:
+        except mysql_driver.Warning as e:
             result['warning'] = to_native(e)
         except Exception as e:
             module.fail_json(msg='%s. Query == CHANGE MASTER TO %s' % (to_native(e), chm))

lib/ansible/modules/database/mysql/mysql_user.py

@@ -208,16 +208,9 @@ import re
 import string
 import traceback
 
-try:
-    import MySQLdb
-except ImportError:
-    mysqldb_found = False
-else:
-    mysqldb_found = True
-
 from ansible.module_utils.basic import AnsibleModule
 from ansible.module_utils.database import SQLParseError
-from ansible.module_utils.mysql import mysql_connect, mysqldb_found
+from ansible.module_utils.mysql import mysql_connect, mysql_driver, mysql_driver_fail_msg
 from ansible.module_utils.six import iteritems
 from ansible.module_utils._text import to_native
 
@@ -590,8 +583,8 @@ def main():
     db = 'mysql'
     sql_log_bin = module.params["sql_log_bin"]
 
-    if not mysqldb_found:
-        module.fail_json(msg="The MySQL-python module is required.")
+    if mysql_driver is None:
+        module.fail_json(msg=mysql_driver_fail_msg)
 
     cursor = None
     try:
@@ -630,14 +623,14 @@ def main():
                 else:
                     changed = user_mod(cursor, user, host, host_all, None, encrypted, priv, append_privs, module)
 
-            except (SQLParseError, InvalidPrivsError, MySQLdb.Error) as e:
+            except (SQLParseError, InvalidPrivsError, mysql_driver.Error) as e:
                 module.fail_json(msg=to_native(e), exception=traceback.format_exc())
         else:
             if host_all:
                 module.fail_json(msg="host_all parameter cannot be used when adding a user")
             try:
                 changed = user_add(cursor, user, host, host_all, password, encrypted, priv, module.check_mode)
-            except (SQLParseError, InvalidPrivsError, MySQLdb.Error) as e:
+            except (SQLParseError, InvalidPrivsError, mysql_driver.Error) as e:
                 module.fail_json(msg=to_native(e), exception=traceback.format_exc())
     elif state == "absent":
         if user_exists(cursor, user, host, host_all):

lib/ansible/modules/database/mysql/mysql_variables.py

@@ -50,16 +50,9 @@ import os
 import warnings
 from re import match
 
-try:
-    import MySQLdb
-except ImportError:
-    mysqldb_found = False
-else:
-    mysqldb_found = True
-
 from ansible.module_utils.basic import AnsibleModule
 from ansible.module_utils.database import SQLParseError, mysql_quote_identifier
-from ansible.module_utils.mysql import mysql_connect, mysqldb_found
+from ansible.module_utils.mysql import mysql_connect, mysql_driver, mysql_driver_fail_msg
 from ansible.module_utils._text import to_native
 
 
@@ -148,10 +141,10 @@ def main():
         module.fail_json(msg="Cannot run without variable to operate with")
     if match('^[0-9a-z_]+$', mysqlvar) is None:
         module.fail_json(msg="invalid variable name \"%s\"" % mysqlvar)
-    if not mysqldb_found:
-        module.fail_json(msg="The MySQL-python module is required.")
+    if mysql_driver is None:
+        module.fail_json(msg=mysql_driver_fail_msg)
     else:
-        warnings.filterwarnings('error', category=MySQLdb.Warning)
+        warnings.filterwarnings('error', category=mysql_driver.Warning)
 
     try:
         cursor = mysql_connect(module, user, password, config_file, ssl_cert, ssl_key, ssl_ca, db,