ansible-playbook --diff --check parameters are not working

[Daniel_]

Hello ansible users!

I used --check for an ansible-playbook (check_point.gaia.cp_gaia_password_policy). Ansible should just check it and not change anything. I was surprised that the configuration has been changed.

Also --diff didn't show any changes.

Are those parameters not available? How can we use ansible in production if you can not check which changes will be made during the next run?

Bye

[PhoneBoy]

What is the playbook you were running?

[Daniel_]

I tried it with

- name: OS Modification
  gather_facts: false
  hosts: all
  connection: httpapi
  tasks:
    - name: Change password policy
      check_point.gaia.cp_gaia_password_policy:
        lock_settings: {
          'password_expiration_days': 60
        }

[PhoneBoy]

Maybe @Eden_Brillant has a suggestion here, but it seems like this might be a bug.
What version of management is involved here as well as the version of the Ansible Gaia Collection used.

[Daniel_]

---

@PhoneBoy wrote:

What version of management is involved here as well as the version of the Ansible Gaia Collection used.

---

The gateway is R81.20. Or which version do you mean with management? I use check_point.gaia....

Ansible collections are

$ ansible-galaxy collection list |grep check
check_point.gaia                         7.0.0  
check_point.mgmt                         6.3.0  

[Eden_Brillant]

@Majd_Sharkia for GAIA collection

[Daniel_]

From the source --check should be supported
https://github.com/CheckPointSW/CheckPointAnsibleGAIACollection/blob/v7.0.0/plugins/modules/cp_gaia_...

And cp_gaia_snmp_user is also not working (and documented with cp_snmp_gaia_user) 😪

[Majd_Sharkia · Accepted solution]

Hi Daniel, From a quick check, it seems that Gaia Collection doesn't support that, although it's documented as it's supported. (Sorry for that)

We will check that and add it to our roadmap for adding/fixing this support in the next releases.

[Sergei_Shir · Accepted solution]

This issue was documented in sk183620 - you will see the final changes ~15 minutes from now

[Daniel_]

If someone tries to open a SR for this: Don't waste you time. I already opened one. It's was closed, because it's an RFE now 😞

[mib1185]

Sorry, but is this serious?

The cause is "the docs mistakenly shows that it supports the check mode" and the solution is "check mode is not support, please open an Request for Enhancement"

What about (at least) adjusting the documention of this ansible collection, so it doesn't mention the check mode as supported anymore?

[_Val_]

@mib1185 I admire your passion.

However, are you sure the issue is not already fixed in the Ansible Galaxy documentation? I just checked and did not find any documentation reference to "--check" support other than an issue notification there.

Do I miss something here?

[mib1185]

Hi @_Val_ 

each single module documentation mentions "Supports check_mode" under the Notes section - eq. cp_gaia_alias_interface (but also all other module docs) as the docs on Ansible Galaxy are taken from the source repository. But not only the documentation mentions it, also the code itself still enables the check mode support for each module (see here)

Regards,
Michael

[Daniel_]

It's still documented

https://galaxy.ansible.com/ui/repo/published/check_point/gaia/content/module/cp_gaia_password_policy...

It would be great to get a fix for this and not just a modification in the documentation. Using Ansible without check mode greatly reduces the advantages of Ansible.

[mib1185]

but yeah, I fully agree with @Daniel_ : "... Using Ansible without check mode greatly reduces the advantages of Ansible."