topic Re: ansible-playbook --diff --check parameters are not working in Ansible

ansible-playbook --diff --check parameters are not working

Daniel_ — Wed, 19 Mar 2025 10:14:32 GMT

Hello ansible users!

I used --check for an ansible-playbook (check_point.gaia.cp_gaia_password_policy). Ansible should just check it and not change anything. I was surprised that the configuration has been changed.

Also --diff didn't show any changes.

Are those parameters not available? How can we use ansible in production if you can not check which changes will be made during the next run?

Bye

Re: ansible-playbook --diff --check parameters are not working

PhoneBoy — Wed, 19 Mar 2025 13:44:34 GMT

What is the playbook you were running?

Re: ansible-playbook --diff --check parameters are not working

Daniel_ — Wed, 19 Mar 2025 14:20:31 GMT

I tried it with

- name: OS Modification gather_facts: false hosts: all connection: httpapi tasks: - name: Change password policy check_point.gaia.cp_gaia_password_policy: lock_settings: { 'password_expiration_days': 60 }

Re: ansible-playbook --diff --check parameters are not working

PhoneBoy — Wed, 19 Mar 2025 15:47:44 GMT

Maybe @Eden_Brillant has a suggestion here, but it seems like this might be a bug.
What version of management is involved here as well as the version of the Ansible Gaia Collection used.

Re: ansible-playbook --diff --check parameters are not working

Daniel_ — Wed, 19 Mar 2025 15:53:57 GMT

@PhoneBoy wrote:

What version of management is involved here as well as the version of the Ansible Gaia Collection used.

The gateway is R81.20. Or which version do you mean with management? I use check_point.gaia....

Ansible collections are

$ ansible-galaxy collection list |grep check check_point.gaia 7.0.0 check_point.mgmt 6.3.0

Re: ansible-playbook --diff --check parameters are not working

Eden_Brillant — Thu, 20 Mar 2025 07:01:09 GMT

@Majd_Sharkia for GAIA collection

Re: ansible-playbook --diff --check parameters are not working

Daniel_ — Thu, 20 Mar 2025 14:00:44 GMT

From the source --check should be supported
https://github.com/CheckPointSW/CheckPointAnsibleGAIACollection/blob/v7.0.0/plugins/modules/cp_gaia_password_policy.py#L33

And cp_gaia_snmp_user is also not working (and documented with cp_snmp_gaia_user) 😪

Re: ansible-playbook --diff --check parameters are not working

Majd_Sharkia — Thu, 20 Mar 2025 18:48:16 GMT

Hi Daniel, From a quick check, it seems that Gaia Collection doesn't support that, although it's documented as it's supported. (Sorry for that)

We will check that and add it to our roadmap for adding/fixing this support in the next releases.

Re: ansible-playbook --diff --check parameters are not working

Sergei_Shir — Thu, 03 Jul 2025 13:30:33 GMT

This issue was documented in sk183620 - you will see the final changes ~15 minutes from now

Re: ansible-playbook --diff --check parameters are not working

Daniel_ — Fri, 15 Aug 2025 06:59:28 GMT

If someone tries to open a SR for this: Don't waste you time. I already opened one. It's was closed, because it's an RFE now 😞

Re: ansible-playbook --diff --check parameters are not working

mib1185 — Wed, 10 Sep 2025 11:28:22 GMT

Sorry, but is this serious?

The cause is "the docs mistakenly shows that it supports the check mode" and the solution is "check mode is not support, please open an Request for Enhancement"

What about (at least) adjusting the documention of this ansible collection, so it doesn't mention the check mode as supported anymore?

Re: ansible-playbook --diff --check parameters are not working

_Val_ — Wed, 10 Sep 2025 13:21:02 GMT

@mib1185 I admire your passion.

However, are you sure the issue is not already fixed in the Ansible Galaxy documentation? I just checked and did not find any documentation reference to "--check" support other than an issue notification there.

Do I miss something here?

Re: ansible-playbook --diff --check parameters are not working

mib1185 — Wed, 10 Sep 2025 13:37:27 GMT

Hi @_Val_

each single module documentation mentions "Supports check_mode" under the Notes section - eq. cp_gaia_alias_interface (but also all other module docs) as the docs on Ansible Galaxy are taken from the source repository. But not only the documentation mentions it, also the code itself still enables the check mode support for each module (see here)

Regards,
Michael

Re: ansible-playbook --diff --check parameters are not working

Daniel_ — Wed, 10 Sep 2025 13:40:07 GMT

It's still documented

https://galaxy.ansible.com/ui/repo/published/check_point/gaia/content/module/cp_gaia_password_policy/?keywords=passw#notes

It would be great to get a fix for this and not just a modification in the documentation. Using Ansible without check mode greatly reduces the advantages of Ansible.

Re: ansible-playbook --diff --check parameters are not working

mib1185 — Wed, 10 Sep 2025 13:53:35 GMT

but yeah, I fully agree with @Daniel_ : "... Using Ansible without check mode greatly reduces the advantages of Ansible."

Re: ansible-playbook --diff --check parameters are not working

_Val_ — Thu, 11 Sep 2025 07:14:52 GMT

Thanks for pointing this out, I was searching for "--check", and it is not there.

I will try finding who is responsible so we can fix it for good

Re: ansible-playbook --diff --check parameters are not working

mib1185 — Thu, 11 Sep 2025 09:18:06 GMT

"fix it for good" means implementing the check mode? 😬

Re: ansible-playbook --diff --check parameters are not working

PhoneBoy — Thu, 11 Sep 2025 14:45:17 GMT

I assume he means getting the documentation updated.
Fixing "for good" (meaning the feature is actually there and works) is very likely an RFE.