Merge pull request #409 from saito-hideki/issue/408

[CI] Update AZP CI matrix

SUMMARY
To update AZP CI matrix for ansible-core devel branch to address the following issue:

Fixes #408
Update Fedora36 with 37
Update RHEL8.6 with 8.7
Update RHEL9.0 with 9.1
Update FreeBSD 12.3 with 12.4

ISSUE TYPE

CI Tests Pull Request

COMPONENT NAME

ansible.posix

ADDITIONAL INFORMATION

Reference:  ansible-test - new and deprecated platforms for testing #31

.azure-pipelines/azure-pipelines.yml

@@ -36,7 +36,7 @@ variables:
 resources:
   containers:
     - container: default
-      image: quay.io/ansible/azure-pipelines-test-container:1.9.0
+      image: quay.io/ansible/azure-pipelines-test-container:3.0.0
 
 pool: Standard
 
@@ -50,13 +50,67 @@ stages:
       - template: templates/matrix.yml
         parameters:
           testFormat: devel/linux/{0}/1
+          targets:
+            - name: CentOS 7
+              test: centos7
+            - name: Fedora 37
+              test: fedora37
+            - name: openSUSE 15 py3
+              test: opensuse15
+            - name: Ubuntu 20.04
+              test: ubuntu2004
+            - name: Ubuntu 22.04
+              test: ubuntu2204
+  - stage: Docker_2_14
+    displayName: Docker 2.14
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.14/linux/{0}/1
+          targets:
+            - name: CentOS 7
+              test: centos7
+            - name: Fedora 36
+              test: fedora36
+            - name: openSUSE 15 py3
+              test: opensuse15
+            - name: Ubuntu 20.04
+              test: ubuntu2004
+            - name: Ubuntu 22.04
+              test: ubuntu2204
+  - stage: Docker_2_13
+    displayName: Docker 2.13
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.13/linux/{0}/1
+          targets:
+            - name: CentOS 7
+              test: centos7
+            - name: Fedora 34
+              test: fedora34
+            - name: Fedora 35
+              test: fedora35
+            - name: openSUSE 15 py3
+              test: opensuse15
+            - name: Ubuntu 18.04
+              test: ubuntu1804
+            - name: Ubuntu 20.04
+              test: ubuntu2004
+  - stage: Docker_2_12
+    displayName: Docker 2.12
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.12/linux/{0}/1
           targets:
             - name: CentOS 6
               test: centos6
             - name: CentOS 7
               test: centos7
-            - name: CentOS 8
-              test: centos8
             - name: Fedora 33
               test: fedora33
             - name: Fedora 34
@@ -81,8 +135,6 @@ stages:
               test: centos6
             - name: CentOS 7
               test: centos7
-            - name: CentOS 8
-              test: centos8
             - name: Fedora 32
               test: fedora32
             - name: Fedora 33
@@ -107,8 +159,6 @@ stages:
               test: centos6
             - name: CentOS 7
               test: centos7
-            - name: CentOS 8
-              test: centos8
             - name: Fedora 30
               test: fedora30
             - name: Fedora 31
@@ -133,8 +183,6 @@ stages:
               test: centos6
             - name: CentOS 7
               test: centos7
-            - name: CentOS 8
-              test: centos8
             - name: Fedora 30
               test: fedora30
             - name: Fedora 31
@@ -156,6 +204,64 @@ stages:
       - template: templates/matrix.yml
         parameters:
           testFormat: devel/{0}/1
+          targets:
+            - name: MacOS 12.0
+              test: macos/12.0
+            - name: RHEL 7.9
+              test: rhel/7.9
+            - name: RHEL 8.7
+              test: rhel/8.7
+            - name: RHEL 9.1
+              test: rhel/9.1
+            - name: FreeBSD 12.4
+              test: freebsd/12.4
+            - name: FreeBSD 13.1
+              test: freebsd/13.1
+  - stage: Remote_2_14
+    displayName: Remote 2.14
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.14/{0}/1
+          targets:
+            - name: MacOS 12.0
+              test: macos/12.0
+            - name: RHEL 7.9
+              test: rhel/7.9
+            - name: RHEL 8.6
+              test: rhel/8.6
+            - name: RHEL 9.0
+              test: rhel/9.0
+            - name: FreeBSD 12.3
+              test: freebsd/12.3
+            - name: FreeBSD 13.1
+              test: freebsd/13.1
+  - stage: Remote_2_13
+    displayName: Remote 2.13
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.13/{0}/1
+          targets:
+            - name: MacOS 12.0
+              test: macos/12.0
+            - name: RHEL 7.9
+              test: rhel/7.9
+            - name: RHEL 8.5
+              test: rhel/8.5
+            - name: FreeBSD 12.3
+              test: freebsd/12.3
+            - name: FreeBSD 13.0
+              test: freebsd/13.0
+  - stage: Remote_2_12
+    displayName: Remote 2.12
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.12/{0}/1
           targets:
             - name: MacOS 11.1
               test: macos/11.1
@@ -181,8 +287,6 @@ stages:
               test: rhel/7.9
             - name: RHEL 8.3
               test: rhel/8.3
-            - name: FreeBSD 11.4
-              test: freebsd/11.4
             - name: FreeBSD 12.2
               test: freebsd/12.2
   - stage: Remote_2_10
@@ -195,15 +299,10 @@ stages:
           targets:
             - name: OS X 10.11
               test: osx/10.11
-            - name: RHEL 7.6
-              test: rhel/7.6
+            - name: RHEL 7.9
+              test: rhel/7.9
             - name: RHEL 8.2
               test: rhel/8.2
-            - name: FreeBSD 11.1
-              test: freebsd/11.1
-            - name: FreeBSD 12.1
-              test: freebsd/12.1
-
   - stage: Remote_2_9
     displayName: Remote 2.9
     dependsOn: []
@@ -214,14 +313,11 @@ stages:
           targets:
             - name: OS X 10.11
               test: osx/10.11
-            - name: RHEL 7.6
-              test: rhel/7.6
+            - name: RHEL 7.9
+              test: rhel/7.9
             - name: RHEL 8.1
               test: rhel/8.1
-            - name: FreeBSD 11.1
-              test: freebsd/11.1
-            - name: FreeBSD 12.0
-              test: freebsd/12.0
+
 ## Finally
 
   - stage: Summary
@@ -230,9 +326,15 @@ stages:
       - Remote_2_9
       - Docker_2_9
       - Remote_2_10
-      - Remote_2_11
       - Docker_2_10
+      - Remote_2_11
       - Docker_2_11
+      - Remote_2_12
+      - Docker_2_12
+      - Remote_2_13
+      - Docker_2_13
+      - Remote_2_14
+      - Docker_2_14
       - Remote_devel
       - Docker_devel
     jobs:

CHANGELOG.rst

@@ -5,6 +5,34 @@ ansible.posix Release Notes
 .. contents:: Topics
 
 
+v1.4.0
+======
+
+Release Summary
+---------------
+
+This is the minor release of the ``ansible.posix`` collection.
+This changelog contains all changes to the modules in this collection that
+have been added after the release of ``ansible.posix`` 1.3.0.
+
+Minor Changes
+-------------
+
+- firewalld - Show warning message that variable type of ``masquerade`` and ``icmp_block_inversion`` will be changed from ``str`` to ``boolean`` in the future release (https://github.com/ansible-collections/ansible.posix/pull/254).
+- selinux - optionally update kernel boot params when disabling/re-enabling SELinux (https://github.com/ansible-collections/ansible.posix/pull/142).
+
+Bugfixes
+--------
+
+- Fix for whitespace in source full path causing error ```code 23) at main.c(1330) [sender=3.2.3]``` (https://github.com/ansible-collections/ansible.posix/pull/278)
+- Include ``PSF-license.txt`` file for ``plugins/module_utils/_version.py``.
+- Use vendored version of ``distutils.version`` instead of the deprecated Python standard library to address PEP 632 (https://github.com/ansible-collections/ansible.posix/issues/303).
+- firewalld - Correct usage of queryForwardPort (https://github.com/ansible-collections/ansible.posix/issues/247).
+- firewalld - Refine the handling of exclusive options (https://github.com/ansible-collections/ansible.posix/issues/255).
+- mount - add a newline at the end of line in ``fstab`` (https://github.com/ansible-collections/ansible.posix/issues/210).
+- profile_tasks - Correctly calculate task execution time with serial execution (https://github.com/ansible-collections/ansible.posix/issues/83).
+- seboolean - add ``python3-libsemanage`` package dependency for RHEL8+ systems.
+
 v1.3.0
 ======
 

PSF-license.txt

@@ -0,0 +1,48 @@
+PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2
+--------------------------------------------
+
+1. This LICENSE AGREEMENT is between the Python Software Foundation
+("PSF"), and the Individual or Organization ("Licensee") accessing and
+otherwise using this software ("Python") in source or binary form and
+its associated documentation.
+
+2. Subject to the terms and conditions of this License Agreement, PSF hereby
+grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce,
+analyze, test, perform and/or display publicly, prepare derivative works,
+distribute, and otherwise use Python alone or in any derivative version,
+provided, however, that PSF's License Agreement and PSF's notice of copyright,
+i.e., "Copyright (c) 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
+2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021 Python Software Foundation;
+All Rights Reserved" are retained in Python alone or in any derivative version
+prepared by Licensee.
+
+3. In the event Licensee prepares a derivative work that is based on
+or incorporates Python or any part thereof, and wants to make
+the derivative work available to others as provided herein, then
+Licensee hereby agrees to include in any such work a brief summary of
+the changes made to Python.
+
+4. PSF is making Python available to Licensee on an "AS IS"
+basis.  PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR
+IMPLIED.  BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND
+DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS
+FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT
+INFRINGE ANY THIRD PARTY RIGHTS.
+
+5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON
+FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS
+A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON,
+OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
+
+6. This License Agreement will automatically terminate upon a material
+breach of its terms and conditions.
+
+7. Nothing in this License Agreement shall be deemed to create any
+relationship of agency, partnership, or joint venture between PSF and
+Licensee.  This License Agreement does not grant permission to use PSF
+trademarks or trade name in a trademark sense to endorse or promote
+products or services of Licensee, or any third party.
+
+8. By copying, installing or otherwise using Python, Licensee
+agrees to be bound by the terms and conditions of this License
+Agreement.

README.md

@@ -13,6 +13,8 @@ An Ansible Collection of modules and plugins that target POSIX UNIX/Linux and de
 
 This collection has been tested against following Ansible versions: **>=2.9**.
 
+For collections that support Ansible 2.9, please ensure you update your `network_os` to use the
+fully qualified collection name (for example, `cisco.ios.ios`).
 Plugins and modules within a collection may be tested with only specific Ansible versions.
 A collection may contain metadata that identifies these versions.
 PEP440 is the schema used to describe the versions of Ansible.
@@ -86,10 +88,12 @@ None
 
 <!-- List the versions of Ansible the collection has been tested with. Must match what is in galaxy.yml. -->
 
-* ansible-core 2.12 (devel)
-* ansible-core 2.11 (stable)
-* ansible-base 2.10 (stable)
-* ansible 2.9 (stable)
+- ansible-core 2.14 (devel)
+- ansible-core 2.13 (stable)
+- ansible-core 2.12 (stable)
+- ansible-core 2.11 (stable)
+- ansible-base 2.10 (stable)
+- ansible 2.9 (stable)
 
 ## Roadmap
 

bindep.txt

@@ -0,0 +1,4 @@
+# This is a cross-platform list tracking distribution packages needed by tests;
+# see https://docs.openstack.org/infra/bindep/ for additional information.
+
+rsync [platform:rhel-8 platform:rhel-9]

changelogs/changelog.yaml

@@ -210,3 +210,53 @@ releases:
     - synchronize.yml
     - test_matrix.yml
     release_date: '2021-08-11'
+  1.4.0:
+    changes:
+      bugfixes:
+      - Fix for whitespace in source full path causing error ```code 23) at main.c(1330)
+        [sender=3.2.3]``` (https://github.com/ansible-collections/ansible.posix/pull/278)
+      - Include ``PSF-license.txt`` file for ``plugins/module_utils/_version.py``.
+      - Use vendored version of ``distutils.version`` instead of the deprecated Python
+        standard library to address PEP 632 (https://github.com/ansible-collections/ansible.posix/issues/303).
+      - firewalld - Correct usage of queryForwardPort (https://github.com/ansible-collections/ansible.posix/issues/247).
+      - firewalld - Refine the handling of exclusive options (https://github.com/ansible-collections/ansible.posix/issues/255).
+      - mount - add a newline at the end of line in ``fstab`` (https://github.com/ansible-collections/ansible.posix/issues/210).
+      - profile_tasks - Correctly calculate task execution time with serial execution
+        (https://github.com/ansible-collections/ansible.posix/issues/83).
+      - seboolean - add ``python3-libsemanage`` package dependency for RHEL8+ systems.
+      minor_changes:
+      - firewalld - Show warning message that variable type of ``masquerade`` and
+        ``icmp_block_inversion`` will be changed from ``str`` to ``boolean`` in the
+        future release (https://github.com/ansible-collections/ansible.posix/pull/254).
+      - selinux - optionally update kernel boot params when disabling/re-enabling
+        SELinux (https://github.com/ansible-collections/ansible.posix/pull/142).
+      release_summary: 'This is the minor release of the ``ansible.posix`` collection.
+
+        This changelog contains all changes to the modules in this collection that
+
+        have been added after the release of ``ansible.posix`` 1.3.0.'
+    fragments:
+    - 1.4.0.yml
+    - 211_fstab_append_newline.yml
+    - 247_firewalld.yml
+    - 254_variable_warnings.yml
+    - 255_authorized_key_url.yml
+    - 263_profile_tasks_with_serial.yml
+    - 272-copy_ignore_txt.yml
+    - 277_fix_integration_test_on_devel.yml
+    - 282_fix_unit_test_for_synchronize.yml
+    - 287_firewalld_requirements.yml
+    - 288_mounts_options.yml
+    - 297_firewalld_exclusive_options_handling.yml
+    - 299_seboolean_python3.yml
+    - 302_shippable_exit_code.yml
+    - 304_pep632.yml
+    - 346_copy_ignore_txt_for_devel.yml
+    - 347_add_branch_213.yml
+    - 349_follow_new_guidelines.yml
+    - 353_ci_fix_unittest_for_synchronize.yml
+    - disable_selinux_via_kernel_cmdline.yml
+    - psf-license.yml
+    - sanity_fixes.yml
+    - shell_escape_full_path_for_rsync.yml
+    release_date: '2022-05-23'

changelogs/fragments/166_mount_absent_fstab.yml

@@ -0,0 +1,2 @@
+minor_changes:
+  - mount - Add ``absent_from_fstab`` state (https://github.com/ansible-collections/ansible.posix/pull/166).

changelogs/fragments/267_mount_ephemeral.yml

@@ -0,0 +1,4 @@
+---
+minor_changes:
+- mount - Add ``ephemeral`` value for the ``state`` parameter, that allows to mount a filesystem
+  without altering the ``fstab`` file (https://github.com/ansible-collections/ansible.posix/pull/267).

changelogs/fragments/366_update_version_number_for_galaxy.yml

@@ -0,0 +1,3 @@
+---
+trivial:
+- Update version number in galaxy.yml to 1.5.0.

changelogs/fragments/371_refactoring_ci_process_202206.yml

@@ -0,0 +1,3 @@
+---
+trivial:
+- CI - Refactor AZP to address new test infrastructure (https://github.com/ansible-collections/news-for-maintainers/issues/17).

changelogs/fragments/373_firewall_fix_missing_library_message.yml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - firewall - Fixed to output a more complete missing library message.

changelogs/fragments/375_update_azp_container.yml

@@ -0,0 +1,3 @@
+---
+trivial:
+  - CI - AZP test container to 3.0.0 (https://github.com/ansible-collections/news-for-maintainers/issues/18).

changelogs/fragments/380_update_usage_profile_tasks.yml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - Removed contentious terminology to match reference documentation in profile_tasks.

changelogs/fragments/386_follow_ci_testing_rules.yml

@@ -0,0 +1,3 @@
+---
+trivial:
+  - CI - following the new CI testing rule ansible-test-sanity-docker-devel.

changelogs/fragments/389_ci_add_stable_214.yml

@@ -0,0 +1,3 @@
+---
+trivial:
+- CI - Add stable-2.14 to AZP (https://github.com/ansible-collections/ansible.posix/issues/388).

changelogs/fragments/390_hosts_involved_same_password.yml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - synchronize - Fixed hosts involved in rsync require the same password

changelogs/fragments/393-rpm-ostree.yml

@@ -0,0 +1,5 @@
+---
+minor_changes:
+  - rhel_facts - new facts module to handle RHEL specific facts
+  - rhel_rpm_ostree - new module to handle RHEL rpm-ostree specific package management functionality
+  - rpm_ostree_upgrade - new module to automate rpm-ostree upgrades

changelogs/fragments/393_rhel_for_edge.yml

@@ -0,0 +1,4 @@
+---
+minor_changes:
+- r4e_rpm_ostree - new module for validating package state on RHEL for Edge
+- rpm_ostree_upgrade - new module to manage upgrades for rpm-ostree based systems 

changelogs/fragments/400-fix-boolean-values-in-docs.yml

@@ -0,0 +1,3 @@
+---
+trivial:
+  - Change boolean values in documentation to ``true/false`` (https://github.com/ansible-collections/ansible.posix/pull/400).

changelogs/fragments/401_document_module_default_values.yml

@@ -0,0 +1,4 @@
+---
+trivial:
+- acl - document default value for the ``entry`` parameter
+- rhel_rpm_ostree - document default value for the ``name`` parameter

changelogs/fragments/407_fix_firewalld_port_test.yml

@@ -0,0 +1,3 @@
+---
+trivial:
+- Fix firewalld port test cases to avoid port duplicatation.

changelogs/fragments/409_update_azp_matrix.yml

@@ -0,0 +1,3 @@
+---
+trivial:
+  - CI - Update AZP CI matrix (https://github.com/ansible-collections/ansible.posix/issues/408).

codecov.yml

@@ -0,0 +1 @@
+comment: false

docs/ansible.posix.authorized_key_module.rst

@@ -240,6 +240,12 @@ Examples
         state: present
         key: https://github.com/charlie.keys
 
+    - name: Set authorized keys taken from url using lookup
+      ansible.posix.authorized_key:
+        user: charlie
+        state: present
+        key: "{{ lookup('url', 'https://github.com/charlie.keys', split_lines=False) }}"
+
     - name: Set authorized key in alternate location
       ansible.posix.authorized_key:
         user: charlie

docs/ansible.posix.firewalld_module.rst

@@ -25,6 +25,7 @@ Requirements
 The below requirements are needed on the host that executes this module.
 
 - firewalld >= 0.2.11
+- python-firewall >= 0.2.11
 
 
 Parameters
@@ -401,6 +402,7 @@ Notes
    - Requires the python2 bindings of firewalld, which may not be installed by default.
    - For distributions where the python2 firewalld bindings are unavailable (e.g Fedora 28 and later) you will have to set the ansible_python_interpreter for these hosts to the python3 interpreter path and install the python3 bindings.
    - Zone transactions (creating, deleting) can be performed by using only the zone and state parameters "present" or "absent". Note that zone transactions must explicitly be permanent. This is a limitation in firewalld. This also means that you will have to reload firewalld after adding a zone that you wish to perform immediate actions on. The module will not take care of this for you implicitly because that would undo any previously performed immediate actions which were not permanent. Therefore, if you require immediate access to a newly created zone it is recommended you reload firewalld immediately after the zone creation returns with a changed state and before you perform any other immediate, non-permanent actions on that zone.
+   - This module needs ``python-firewall`` or ``python3-firewall`` on managed nodes. It is usually provided as a subset with ``firewalld`` from the OS distributor for the OS default Python interpreter.
 
 
 

docs/ansible.posix.mount_module.rst

@@ -85,7 +85,7 @@ Parameters
                     </div>
                 </td>
                 <td>
-                        <b>Default:</b><br/><div style="color: blue">0</div>
+                        <b>Default:</b><br/><div style="color: blue">"0"</div>
                 </td>
                 <td>
                         <div>Dump (see fstab(5)).</div>
@@ -153,7 +153,7 @@ Parameters
                     </div>
                 </td>
                 <td>
-                        <b>Default:</b><br/><div style="color: blue">0</div>
+                        <b>Default:</b><br/><div style="color: blue">"0"</div>
                 </td>
                 <td>
                         <div>Passno (see fstab(5)).</div>
@@ -295,7 +295,7 @@ Examples
       ansible.posix.mount:
         src: 192.168.1.100:/nfs/ssd/shared_data
         path: /mnt/shared_data
-        opts: rw,sync,hard,intr
+        opts: rw,sync,hard
         state: mounted
         fstype: nfs
 
@@ -303,7 +303,7 @@ Examples
       ansible.posix.mount:
         src: 192.168.1.100:/nfs/ssd/shared_data
         path: /mnt/shared_data
-        opts: rw,sync,hard,intr
+        opts: rw,sync,hard
         boot: no
         state: mounted
         fstype: nfs

docs/ansible.posix.seboolean_module.rst

@@ -27,6 +27,7 @@ The below requirements are needed on the host that executes this module.
 
 - libselinux-python
 - libsemanage-python
+- python3-libsemanage
 
 
 Parameters

docs/ansible.posix.selinux_module.rst

@@ -94,6 +94,27 @@ Parameters
                         <div>The SELinux mode.</div>
                 </td>
             </tr>
+            <tr>
+                <td colspan="1">
+                    <div class="ansibleOptionAnchor" id="parameter-"></div>
+                    <b>update_kernel_param</b>
+                    <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
+                    <div style="font-size: small">
+                        <span style="color: purple">boolean</span>
+                    </div>
+                    <div style="font-style: italic; font-size: small; color: darkgreen">added in 1.4.0</div>
+                </td>
+                <td>
+                        <ul style="margin: 0; padding: 0"><b>Choices:</b>
+                                    <li><div style="color: blue"><b>no</b>&nbsp;&larr;</div></li>
+                                    <li>yes</li>
+                        </ul>
+                </td>
+                <td>
+                        <div>If set to <em>true</em>, will update also the kernel boot parameters when disabling/enabling SELinux.</div>
+                        <div>The <code>grubby</code> tool must be present on the target system for this to work.</div>
+                </td>
+            </tr>
     </table>
     <br/>
 

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: ansible
 name: posix
-version: 1.3.0
+version: 1.5.0
 readme: README.md
 authors:
   - Ansible (github.com/ansible)

meta/runtime.yml

@@ -1,2 +1,8 @@
 ---
 requires_ansible: '>=2.9'
+plugin_routing:
+  callback:
+    skippy:
+      deprecation:
+        removal_date: '2022-06-01'
+        warning_text: See the plugin documentation for more details

plugins/action/synchronize.py

@@ -225,7 +225,6 @@ class ActionModule(ActionBase):
 
         # Parameter name needed by the ansible module
         _tmp_args['_local_rsync_path'] = task_vars.get('ansible_rsync_path') or 'rsync'
-        _tmp_args['_local_rsync_password'] = task_vars.get('ansible_ssh_pass') or task_vars.get('ansible_password')
 
         # rsync thinks that one end of the connection is localhost and the
         # other is the host we're running the task for  (Note: We use
@@ -333,8 +332,9 @@ class ActionModule(ActionBase):
         if src is None or dest is None:
             return dict(failed=True, msg="synchronize requires both src and dest parameters are set")
 
-        # Determine if we need a user@
+        # Determine if we need a user@ and a password
         user = None
+        password = task_vars.get('ansible_ssh_pass', None) or task_vars.get('ansible_password', None)
         if not dest_is_local:
             # Src and dest rsync "path" handling
             if boolean(_tmp_args.get('set_remote_user', 'yes'), strict=False):
@@ -344,10 +344,12 @@ class ActionModule(ActionBase):
                         user = task_vars.get('ansible_user') or self._play_context.remote_user
                     if not user:
                         user = C.DEFAULT_REMOTE_USER
-
                 else:
                     user = task_vars.get('ansible_user') or self._play_context.remote_user
 
+            if self._templar is not None:
+                user = self._templar.template(user)
+
             # Private key handling
             # Use the private_key parameter if passed else use context private_key_file
             _tmp_args['private_key'] = _tmp_args.get('private_key', self._play_context.private_key_file)
@@ -361,12 +363,17 @@ class ActionModule(ActionBase):
                 # src is a local path, dest is a remote path: <user>@<host>
                 src = self._process_origin(src_host, src, user)
                 dest = self._process_remote(_tmp_args, dest_host, dest, user, inv_port in localhost_ports)
+
+            password = dest_host_inventory_vars.get('ansible_ssh_pass', None) or dest_host_inventory_vars.get('ansible_password', None)
+            if self._templar is not None:
+                password = self._templar.template(password)
         else:
             # Still need to munge paths (to account for roles) even if we aren't
             # copying files between hosts
             src = self._get_absolute_path(path=src)
             dest = self._get_absolute_path(path=dest)
 
+        _tmp_args['_local_rsync_password'] = password
         _tmp_args['src'] = src
         _tmp_args['dest'] = dest
 

plugins/callback/cgroup_perf_recap.py

@@ -11,8 +11,8 @@ ANSIBLE_METADATA = {'metadata_version': '1.1',
                     'supported_by': 'community'}
 
 DOCUMENTATION = '''
-    callback: cgroup_perf_recap
-    callback_type: aggregate
+    name: cgroup_perf_recap
+    type: aggregate
     requirements:
       - whitelist in configuration
       - cgroups

plugins/callback/debug.py

@@ -5,7 +5,7 @@ from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
 DOCUMENTATION = '''
-    callback: debug
+    name: debug
     type: stdout
     short_description: formatted stdout/stderr display
     description:

plugins/callback/json.py

@@ -7,7 +7,7 @@ from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
 DOCUMENTATION = '''
-    callback: json
+    name: json
     short_description: Ansible screen output as JSON
     description:
         - This callback converts all events into JSON output to stdout

plugins/callback/profile_roles.py

@@ -7,7 +7,7 @@ from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
 DOCUMENTATION = '''
-    callback: profile_roles
+    name: profile_roles
     type: aggregate
     short_description: adds timing information to roles
     description:

plugins/callback/profile_tasks.py

@@ -10,7 +10,7 @@ from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
 DOCUMENTATION = '''
-    callback: profile_tasks
+    name: profile_tasks
     type: aggregate
     short_description: adds time information to tasks
     description:
@@ -21,7 +21,7 @@ DOCUMENTATION = '''
       - It also lists the top/bottom time consuming tasks in the summary (configurable)
       - Before 2.4 only the environment variables were available for configuration.
     requirements:
-      - whitelisting in configuration - see examples section below for details.
+      - enable in configuration - see examples section below for details.
     options:
       output_limit:
         description: Number of tasks to display in the summary
@@ -46,7 +46,7 @@ EXAMPLES = '''
 example: >
   To enable, add this to your ansible.cfg file in the defaults block
     [defaults]
-    callback_whitelist = ansible.posix.profile_tasks
+    callbacks_enabled=ansible.posix.profile_tasks
 sample output: >
 #
 #    TASK: [ensure messaging security group exists] ********************************
@@ -92,7 +92,8 @@ def filled(msg, fchar="*"):
 
 def timestamp(self):
     if self.current is not None:
-        self.stats[self.current]['time'] = time.time() - self.stats[self.current]['time']
+        elapsed = time.time() - self.stats[self.current]['started']
+        self.stats[self.current]['elapsed'] += elapsed
 
 
 def tasktime():
@@ -151,8 +152,15 @@ class CallbackModule(CallbackBase):
         timestamp(self)
 
         # Record the start time of the current task
+        # stats[TASK_UUID]:
+        #   started: Current task start time. This value will be updated each time a task
+        #            with the same UUID is executed when `serial` is specified in a playbook.
+        #   elapsed: Elapsed time since the first serialized task was started
         self.current = task._uuid
-        self.stats[self.current] = {'time': time.time(), 'name': task.get_name()}
+        if self.current not in self.stats:
+            self.stats[self.current] = {'started': time.time(), 'elapsed': 0.0, 'name': task.get_name()}
+        else:
+            self.stats[self.current]['started'] = time.time()
         if self._display.verbosity >= 2:
             self.stats[self.current]['path'] = task.get_path()
 
@@ -178,7 +186,7 @@ class CallbackModule(CallbackBase):
         if self.sort_order is not None:
             results = sorted(
                 self.stats.items(),
-                key=lambda x: x[1]['time'],
+                key=lambda x: x[1]['elapsed'],
                 reverse=self.sort_order,
             )
 
@@ -187,7 +195,7 @@ class CallbackModule(CallbackBase):
 
         # Print the timings
         for uuid, result in results:
-            msg = u"{0:-<{2}}{1:->9}".format(result['name'] + u' ', u' {0:.02f}s'.format(result['time']), self._display.columns - 9)
+            msg = u"{0:-<{2}}{1:->9}".format(result['name'] + u' ', u' {0:.02f}s'.format(result['elapsed']), self._display.columns - 9)
             if 'path' in result:
                 msg += u"\n{0:-<{1}}".format(result['path'] + u' ', self._display.columns)
             self._display.display(msg)

plugins/callback/skippy.py

@@ -7,19 +7,19 @@ from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
 DOCUMENTATION = '''
-    callback: skippy
-    callback_type: stdout
+    name: skippy
+    type: stdout
     requirements:
       - set as main display callback
     short_description: Ansible screen output that ignores skipped status
     deprecated:
-        why: The 'default' callback plugin now supports this functionality
-        removed_at_date: 2022-06-01
-        alternative: "'default' callback plugin with 'display_skipped_hosts = no' option"
+      why: The 'default' callback plugin now supports this functionality
+      removed_at_date: '2022-06-01'
+      alternative: "'default' callback plugin with 'display_skipped_hosts = no' option"
     extends_documentation_fragment:
       - default_callback
     description:
-        - This callback does the same as the default except it does not output skipped host/task/item status
+      - This callback does the same as the default except it does not output skipped host/task/item status
 '''
 
 from ansible.plugins.callback.default import CallbackModule as CallbackModule_default

plugins/callback/timer.py

@@ -6,8 +6,8 @@ from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
 DOCUMENTATION = '''
-    callback: timer
-    callback_type: aggregate
+    name: timer
+    type: aggregate
     requirements:
       - whitelist in configuration
     short_description: Adds time to play stats

plugins/module_utils/_version.py

@@ -0,0 +1,344 @@
+# Vendored copy of distutils/version.py from CPython 3.9.5
+#
+# Implements multiple version numbering conventions for the
+# Python Module Distribution Utilities.
+#
+# PSF License (see PSF-license.txt or https://opensource.org/licenses/Python-2.0)
+#
+
+"""Provides classes to represent module version numbers (one class for
+each style of version numbering).  There are currently two such classes
+implemented: StrictVersion and LooseVersion.
+
+Every version number class implements the following interface:
+  * the 'parse' method takes a string and parses it to some internal
+    representation; if the string is an invalid version number,
+    'parse' raises a ValueError exception
+  * the class constructor takes an optional string argument which,
+    if supplied, is passed to 'parse'
+  * __str__ reconstructs the string that was passed to 'parse' (or
+    an equivalent string -- ie. one that will generate an equivalent
+    version number instance)
+  * __repr__ generates Python code to recreate the version number instance
+  * _cmp compares the current instance with either another instance
+    of the same class or a string (which will be parsed to an instance
+    of the same class, thus must follow the same rules)
+"""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+import re
+
+try:
+    RE_FLAGS = re.VERBOSE | re.ASCII
+except AttributeError:
+    RE_FLAGS = re.VERBOSE
+
+
+class Version:
+    """Abstract base class for version numbering classes.  Just provides
+    constructor (__init__) and reproducer (__repr__), because those
+    seem to be the same for all version numbering classes; and route
+    rich comparisons to _cmp.
+    """
+
+    def __init__(self, vstring=None):
+        if vstring:
+            self.parse(vstring)
+
+    def __repr__(self):
+        return "%s ('%s')" % (self.__class__.__name__, str(self))
+
+    def __eq__(self, other):
+        c = self._cmp(other)
+        if c is NotImplemented:
+            return c
+        return c == 0
+
+    def __lt__(self, other):
+        c = self._cmp(other)
+        if c is NotImplemented:
+            return c
+        return c < 0
+
+    def __le__(self, other):
+        c = self._cmp(other)
+        if c is NotImplemented:
+            return c
+        return c <= 0
+
+    def __gt__(self, other):
+        c = self._cmp(other)
+        if c is NotImplemented:
+            return c
+        return c > 0
+
+    def __ge__(self, other):
+        c = self._cmp(other)
+        if c is NotImplemented:
+            return c
+        return c >= 0
+
+
+# Interface for version-number classes -- must be implemented
+# by the following classes (the concrete ones -- Version should
+# be treated as an abstract class).
+#    __init__ (string) - create and take same action as 'parse'
+#                        (string parameter is optional)
+#    parse (string)    - convert a string representation to whatever
+#                        internal representation is appropriate for
+#                        this style of version numbering
+#    __str__ (self)    - convert back to a string; should be very similar
+#                        (if not identical to) the string supplied to parse
+#    __repr__ (self)   - generate Python code to recreate
+#                        the instance
+#    _cmp (self, other) - compare two version numbers ('other' may
+#                        be an unparsed version string, or another
+#                        instance of your version class)
+
+
+class StrictVersion(Version):
+    """Version numbering for anal retentives and software idealists.
+    Implements the standard interface for version number classes as
+    described above.  A version number consists of two or three
+    dot-separated numeric components, with an optional "pre-release" tag
+    on the end.  The pre-release tag consists of the letter 'a' or 'b'
+    followed by a number.  If the numeric components of two version
+    numbers are equal, then one with a pre-release tag will always
+    be deemed earlier (lesser) than one without.
+
+    The following are valid version numbers (shown in the order that
+    would be obtained by sorting according to the supplied cmp function):
+
+        0.4       0.4.0  (these two are equivalent)
+        0.4.1
+        0.5a1
+        0.5b3
+        0.5
+        0.9.6
+        1.0
+        1.0.4a3
+        1.0.4b1
+        1.0.4
+
+    The following are examples of invalid version numbers:
+
+        1
+        2.7.2.2
+        1.3.a4
+        1.3pl1
+        1.3c4
+
+    The rationale for this version numbering system will be explained
+    in the distutils documentation.
+    """
+
+    version_re = re.compile(r"^(\d+) \. (\d+) (\. (\d+))? ([ab](\d+))?$", RE_FLAGS)
+
+    def parse(self, vstring):
+        match = self.version_re.match(vstring)
+        if not match:
+            raise ValueError("invalid version number '%s'" % vstring)
+
+        (major, minor, patch, prerelease, prerelease_num) = match.group(1, 2, 4, 5, 6)
+
+        if patch:
+            self.version = tuple(map(int, [major, minor, patch]))
+        else:
+            self.version = tuple(map(int, [major, minor])) + (0,)
+
+        if prerelease:
+            self.prerelease = (prerelease[0], int(prerelease_num))
+        else:
+            self.prerelease = None
+
+    def __str__(self):
+        if self.version[2] == 0:
+            vstring = ".".join(map(str, self.version[0:2]))
+        else:
+            vstring = ".".join(map(str, self.version))
+
+        if self.prerelease:
+            vstring = vstring + self.prerelease[0] + str(self.prerelease[1])
+
+        return vstring
+
+    def _cmp(self, other):
+        if isinstance(other, str):
+            other = StrictVersion(other)
+        elif not isinstance(other, StrictVersion):
+            return NotImplemented
+
+        if self.version != other.version:
+            # numeric versions don't match
+            # prerelease stuff doesn't matter
+            if self.version < other.version:
+                return -1
+            else:
+                return 1
+
+        # have to compare prerelease
+        # case 1: neither has prerelease; they're equal
+        # case 2: self has prerelease, other doesn't; other is greater
+        # case 3: self doesn't have prerelease, other does: self is greater
+        # case 4: both have prerelease: must compare them!
+
+        if not self.prerelease and not other.prerelease:
+            return 0
+        elif self.prerelease and not other.prerelease:
+            return -1
+        elif not self.prerelease and other.prerelease:
+            return 1
+        elif self.prerelease and other.prerelease:
+            if self.prerelease == other.prerelease:
+                return 0
+            elif self.prerelease < other.prerelease:
+                return -1
+            else:
+                return 1
+        else:
+            raise AssertionError("never get here")
+
+
+# end class StrictVersion
+
+# The rules according to Greg Stein:
+# 1) a version number has 1 or more numbers separated by a period or by
+#    sequences of letters. If only periods, then these are compared
+#    left-to-right to determine an ordering.
+# 2) sequences of letters are part of the tuple for comparison and are
+#    compared lexicographically
+# 3) recognize the numeric components may have leading zeroes
+#
+# The LooseVersion class below implements these rules: a version number
+# string is split up into a tuple of integer and string components, and
+# comparison is a simple tuple comparison.  This means that version
+# numbers behave in a predictable and obvious way, but a way that might
+# not necessarily be how people *want* version numbers to behave.  There
+# wouldn't be a problem if people could stick to purely numeric version
+# numbers: just split on period and compare the numbers as tuples.
+# However, people insist on putting letters into their version numbers;
+# the most common purpose seems to be:
+#   - indicating a "pre-release" version
+#     ('alpha', 'beta', 'a', 'b', 'pre', 'p')
+#   - indicating a post-release patch ('p', 'pl', 'patch')
+# but of course this can't cover all version number schemes, and there's
+# no way to know what a programmer means without asking him.
+#
+# The problem is what to do with letters (and other non-numeric
+# characters) in a version number.  The current implementation does the
+# obvious and predictable thing: keep them as strings and compare
+# lexically within a tuple comparison.  This has the desired effect if
+# an appended letter sequence implies something "post-release":
+# eg. "0.99" < "0.99pl14" < "1.0", and "5.001" < "5.001m" < "5.002".
+#
+# However, if letters in a version number imply a pre-release version,
+# the "obvious" thing isn't correct.  Eg. you would expect that
+# "1.5.1" < "1.5.2a2" < "1.5.2", but under the tuple/lexical comparison
+# implemented here, this just isn't so.
+#
+# Two possible solutions come to mind.  The first is to tie the
+# comparison algorithm to a particular set of semantic rules, as has
+# been done in the StrictVersion class above.  This works great as long
+# as everyone can go along with bondage and discipline.  Hopefully a
+# (large) subset of Python module programmers will agree that the
+# particular flavour of bondage and discipline provided by StrictVersion
+# provides enough benefit to be worth using, and will submit their
+# version numbering scheme to its domination.  The free-thinking
+# anarchists in the lot will never give in, though, and something needs
+# to be done to accommodate them.
+#
+# Perhaps a "moderately strict" version class could be implemented that
+# lets almost anything slide (syntactically), and makes some heuristic
+# assumptions about non-digits in version number strings.  This could
+# sink into special-case-hell, though; if I was as talented and
+# idiosyncratic as Larry Wall, I'd go ahead and implement a class that
+# somehow knows that "1.2.1" < "1.2.2a2" < "1.2.2" < "1.2.2pl3", and is
+# just as happy dealing with things like "2g6" and "1.13++".  I don't
+# think I'm smart enough to do it right though.
+#
+# In any case, I've coded the test suite for this module (see
+# ../test/test_version.py) specifically to fail on things like comparing
+# "1.2a2" and "1.2".  That's not because the *code* is doing anything
+# wrong, it's because the simple, obvious design doesn't match my
+# complicated, hairy expectations for real-world version numbers.  It
+# would be a snap to fix the test suite to say, "Yep, LooseVersion does
+# the Right Thing" (ie. the code matches the conception).  But I'd rather
+# have a conception that matches common notions about version numbers.
+
+
+class LooseVersion(Version):
+    """Version numbering for anarchists and software realists.
+    Implements the standard interface for version number classes as
+    described above.  A version number consists of a series of numbers,
+    separated by either periods or strings of letters.  When comparing
+    version numbers, the numeric components will be compared
+    numerically, and the alphabetic components lexically.  The following
+    are all valid version numbers, in no particular order:
+
+        1.5.1
+        1.5.2b2
+        161
+        3.10a
+        8.02
+        3.4j
+        1996.07.12
+        3.2.pl0
+        3.1.1.6
+        2g6
+        11g
+        0.960923
+        2.2beta29
+        1.13++
+        5.5.kw
+        2.0b1pl0
+
+    In fact, there is no such thing as an invalid version number under
+    this scheme; the rules for comparison are simple and predictable,
+    but may not always give the results you want (for some definition
+    of "want").
+    """
+
+    component_re = re.compile(r"(\d+ | [a-z]+ | \.)", re.VERBOSE)
+
+    def __init__(self, vstring=None):
+        if vstring:
+            self.parse(vstring)
+
+    def parse(self, vstring):
+        # I've given up on thinking I can reconstruct the version string
+        # from the parsed tuple -- so I just store the string here for
+        # use by __str__
+        self.vstring = vstring
+        components = [x for x in self.component_re.split(vstring) if x and x != "."]
+        for i, obj in enumerate(components):
+            try:
+                components[i] = int(obj)
+            except ValueError:
+                pass
+
+        self.version = components
+
+    def __str__(self):
+        return self.vstring
+
+    def __repr__(self):
+        return "LooseVersion ('%s')" % str(self)
+
+    def _cmp(self, other):
+        if isinstance(other, str):
+            other = LooseVersion(other)
+        elif not isinstance(other, LooseVersion):
+            return NotImplemented
+
+        if self.version == other.version:
+            return 0
+        if self.version < other.version:
+            return -1
+        if self.version > other.version:
+            return 1
+
+
+# end class LooseVersion

plugins/module_utils/firewalld.py

@@ -4,11 +4,11 @@
 # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
 
 from __future__ import absolute_import, division, print_function
+from ansible_collections.ansible.posix.plugins.module_utils.version import LooseVersion
+from ansible.module_utils.basic import missing_required_lib
 
 __metaclass__ = type
 
-# Imports and info for sanity checking
-from distutils.version import LooseVersion
 
 FW_VERSION = None
 fw = None
@@ -315,6 +315,5 @@ class FirewallTransaction(object):
 
         if import_failure:
             module.fail_json(
-                msg='Python Module not found: firewalld and its python module are required for this module, \
-                        version 0.2.11 or newer required (0.3.9 or newer for offline operations)'
+                msg=missing_required_lib('firewall') + '. Version 0.2.11 or newer required (0.3.9 or newer for offline operations)'
             )

plugins/module_utils/version.py

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2021, Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+"""Provide version object to compare version numbers."""
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+
+# Once we drop support for Ansible 2.9, ansible-base 2.10, and ansible-core 2.11, we can
+# remove the _version.py file, and replace the following import by
+#
+#     from ansible.module_utils.compat.version import LooseVersion
+
+from ._version import LooseVersion, StrictVersion

plugins/modules/acl.py

@@ -20,7 +20,7 @@ options:
     description:
     - The full path of the file or object.
     type: path
-    required: yes
+    required: true
     aliases: [ name ]
   state:
     description:
@@ -33,17 +33,18 @@ options:
     description:
     - Whether to follow symlinks on the path if a symlink is encountered.
     type: bool
-    default: yes
+    default: true
   default:
     description:
-    - If the target is a directory, setting this to C(yes) will make it the default ACL for entities created inside the directory.
-    - Setting C(default) to C(yes) causes an error if the path is a file.
+    - If the target is a directory, setting this to C(true) will make it the default ACL for entities created inside the directory.
+    - Setting C(default) to C(true) causes an error if the path is a file.
     type: bool
-    default: no
+    default: false
   entity:
     description:
     - The actual user or group that the ACL applies to when matching entity types user or group are selected.
     type: str
+    default: ""
   etype:
     description:
     - The entity type of the ACL to apply, see C(setfacl) documentation for more info.
@@ -69,13 +70,13 @@ options:
     - Incompatible with C(state=query).
     - Alias C(recurse) added in version 1.3.0.
     type: bool
-    default: no
+    default: false
     aliases: [ recurse ]
   use_nfsv4_acls:
     description:
     - Use NFSv4 ACLs instead of POSIX ACLs.
     type: bool
-    default: no
+    default: false
   recalculate_mask:
     description:
     - Select if and when to recalculate the effective right masks of the files.
@@ -115,7 +116,7 @@ EXAMPLES = r'''
     entity: joe
     etype: user
     permissions: rw
-    default: yes
+    default: true
     state: present
 
 - name: Same as previous but using entry shorthand

plugins/modules/at.py

@@ -44,7 +44,7 @@ options:
     description:
      - If a matching job is present a new job will not be added.
     type: bool
-    default: no
+    default: false
 requirements:
  - at
 author:
@@ -68,7 +68,7 @@ EXAMPLES = r'''
     command: ls -d / >/dev/null
     count: 20
     units: minutes
-    unique: yes
+    unique: true
 '''
 
 import os

plugins/modules/authorized_key.py

@@ -34,13 +34,13 @@ options:
   manage_dir:
     description:
       - Whether this module should manage the directory of the authorized key file.
-      - If set to C(yes), the module will create the directory, as well as set the owner and permissions
+      - If set to C(true), the module will create the directory, as well as set the owner and permissions
         of an existing directory.
-      - Be sure to set C(manage_dir=no) if you are using an alternate directory for authorized_keys,
+      - Be sure to set C(manage_dir=false) if you are using an alternate directory for authorized_keys,
         as set with C(path), since you could lock yourself out of SSH access.
       - See the example below.
     type: bool
-    default: yes
+    default: true
   state:
     description:
       - Whether the given key (with the given key_options) should or should not be in the file.
@@ -58,15 +58,15 @@ options:
       - This option is not loop aware, so if you use C(with_) , it will be exclusive per iteration of the loop.
       - If you want multiple keys in the file you need to pass them all to C(key) in a single batch as mentioned above.
     type: bool
-    default: no
+    default: false
   validate_certs:
     description:
       - This only applies if using a https url as the source of the keys.
-      - If set to C(no), the SSL certificates will not be validated.
-      - This should only set to C(no) used on personally controlled sites using self-signed certificates as it avoids verifying the source site.
-      - Prior to 2.1 the code worked as if this was set to C(yes).
+      - If set to C(false), the SSL certificates will not be validated.
+      - This should only set to C(false) used on personally controlled sites using self-signed certificates as it avoids verifying the source site.
+      - Prior to 2.1 the code worked as if this was set to C(true).
     type: bool
-    default: yes
+    default: true
   comment:
     description:
       - Change the comment on the public key.
@@ -77,7 +77,7 @@ options:
     description:
       - Follow path symlink instead of replacing it.
     type: bool
-    default: no
+    default: false
 author: Ansible Core Team
 '''
 
@@ -94,13 +94,19 @@ EXAMPLES = r'''
     state: present
     key: https://github.com/charlie.keys
 
+- name: Set authorized keys taken from url using lookup
+  ansible.posix.authorized_key:
+    user: charlie
+    state: present
+    key: "{{ lookup('url', 'https://github.com/charlie.keys', split_lines=False) }}"
+
 - name: Set authorized key in alternate location
   ansible.posix.authorized_key:
     user: charlie
     state: present
     key: "{{ lookup('file', '/home/charlie/.ssh/id_rsa.pub') }}"
     path: /etc/ssh/authorized_keys/charlie
-    manage_dir: False
+    manage_dir: false
 
 - name: Set up multiple authorized keys
   ansible.posix.authorized_key:
@@ -123,14 +129,14 @@ EXAMPLES = r'''
     user: charlie
     state: present
     key: https://github.com/user.keys
-    validate_certs: False
+    validate_certs: false
 
 - name: Set authorized key, removing all the authorized keys already set
   ansible.posix.authorized_key:
     user: root
     key: "{{ lookup('file', 'public_keys/doe-jane') }}"
     state: present
-    exclusive: True
+    exclusive: true
 
 - name: Set authorized key for user ubuntu copying it from current user
   ansible.posix.authorized_key:
@@ -144,7 +150,7 @@ exclusive:
   description: If the key has been forced to be exclusive or not.
   returned: success
   type: bool
-  sample: False
+  sample: false
 key:
   description: The key that the module was running against.
   returned: success
@@ -164,7 +170,7 @@ manage_dir:
   description: Whether this module managed the directory of the authorized key file.
   returned: success
   type: bool
-  sample: True
+  sample: true
 path:
   description: Alternate path to the authorized_keys file
   returned: success
@@ -186,7 +192,7 @@ user:
   type: str
   sample: user
 validate_certs:
-  description: This only applies if using a https url as the source of the keys. If set to C(no), the SSL certificates will not be validated.
+  description: This only applies if using a https url as the source of the keys. If set to C(false), the SSL certificates will not be validated.
   returned: success
   type: bool
   sample: true
@@ -341,6 +347,8 @@ def keyfile(module, user, write=False, path=None, manage_dir=True, follow=False)
         basedir = os.path.dirname(keysfile)
         if not os.path.exists(basedir):
             os.makedirs(basedir)
+
+        f = None
         try:
             f = open(keysfile, "w")  # touches file so we can set ownership and perms
         finally:

plugins/modules/firewalld.py

@@ -82,13 +82,13 @@ options:
     description:
       - Should this configuration be in the running firewalld configuration or persist across reboots.
       - As of Ansible 2.3, permanent operations can operate on firewalld configs when it is not running (requires firewalld >= 0.3.9).
-      - Note that if this is C(no), immediate is assumed C(yes).
+      - Note that if this is C(false), immediate is assumed C(true).
     type: bool
   immediate:
     description:
       - Should this configuration be applied immediately, if set as permanent.
     type: bool
-    default: no
+    default: false
   state:
     description:
       - Enable or disable a setting.
@@ -128,8 +128,11 @@ notes:
     The module will not take care of this for you implicitly because that would undo any previously performed immediate actions which were not
     permanent. Therefore, if you require immediate access to a newly created zone it is recommended you reload firewalld immediately after the zone
     creation returns with a changed state and before you perform any other immediate, non-permanent actions on that zone.
+  - This module needs C(python-firewall) or C(python3-firewall) on managed nodes.
+    It is usually provided as a subset with C(firewalld) from the OS distributor for the OS default Python interpreter.
 requirements:
 - firewalld >= 0.2.11
+- python-firewall >= 0.2.11
 author:
 - Adam Miller (@maxamillion)
 '''
@@ -138,29 +141,29 @@ EXAMPLES = r'''
 - name: permit traffic in default zone for https service
   ansible.posix.firewalld:
     service: https
-    permanent: yes
+    permanent: true
     state: enabled
 
 - name: do not permit traffic in default zone on port 8081/tcp
   ansible.posix.firewalld:
     port: 8081/tcp
-    permanent: yes
+    permanent: true
     state: disabled
 
 - ansible.posix.firewalld:
     port: 161-162/udp
-    permanent: yes
+    permanent: true
     state: enabled
 
 - ansible.posix.firewalld:
     zone: dmz
     service: http
-    permanent: yes
+    permanent: true
     state: enabled
 
 - ansible.posix.firewalld:
     rich_rule: rule service name="ftp" audit limit value="1/m" accept
-    permanent: yes
+    permanent: true
     state: enabled
 
 - ansible.posix.firewalld:
@@ -171,48 +174,49 @@ EXAMPLES = r'''
 - ansible.posix.firewalld:
     zone: trusted
     interface: eth2
-    permanent: yes
+    permanent: true
     state: enabled
 
 - ansible.posix.firewalld:
-    masquerade: yes
+    masquerade: true
     state: enabled
-    permanent: yes
+    permanent: true
     zone: dmz
 
 - ansible.posix.firewalld:
     zone: custom
     state: present
-    permanent: yes
+    permanent: true
 
 - ansible.posix.firewalld:
     zone: drop
     state: enabled
-    permanent: yes
-    icmp_block_inversion: yes
+    permanent: true
+    icmp_block_inversion: true
 
 - ansible.posix.firewalld:
     zone: drop
     state: enabled
-    permanent: yes
+    permanent: true
     icmp_block: echo-request
 
 - ansible.posix.firewalld:
     zone: internal
     state: present
-    permanent: yes
+    permanent: true
     target: ACCEPT
 
 - name: Redirect port 443 to 8443 with Rich Rule
   ansible.posix.firewalld:
     rich_rule: rule family=ipv4 forward-port port=443 protocol=tcp to-port=8443
     zone: public
-    permanent: yes
-    immediate: yes
+    permanent: true
+    immediate: true
     state: enabled
 '''
 
 from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.parsing.convert_bool import boolean
 from ansible_collections.ansible.posix.plugins.module_utils.firewalld import FirewallTransaction, fw_offline
 
 try:
@@ -706,7 +710,7 @@ class ForwardPortTransaction(FirewallTransaction):
         if self.fw_offline:
             dummy, fw_settings = self.get_fw_zone_settings()
             return fw_settings.queryForwardPort(port=port, protocol=proto, to_port=toport, to_addr=toaddr)
-        return self.fw.queryForwardPort(port=port, protocol=proto, to_port=toport, to_addr=toaddr)
+        return self.fw.queryForwardPort(zone=self.zone, port=port, protocol=proto, toport=toport, toaddr=toaddr)
 
     def get_enabled_permanent(self, port, proto, toport, toaddr, timeout):
         dummy, fw_settings = self.get_fw_zone_settings()
@@ -756,6 +760,10 @@ def main():
             target=('zone',),
             source=('permanent',),
         ),
+        mutually_exclusive=[
+            ['icmp_block', 'icmp_block_inversion', 'service', 'port', 'port_forward', 'rich_rule',
+             'interface', 'masquerade', 'source', 'target']
+        ],
     )
 
     permanent = module.params['permanent']
@@ -812,33 +820,11 @@ def main():
         if 'toaddr' in port_forward:
             port_forward_toaddr = port_forward['toaddr']
 
-    modification_count = 0
-    if icmp_block is not None:
-        modification_count += 1
-    if icmp_block_inversion is not None:
-        modification_count += 1
-    if service is not None:
-        modification_count += 1
-    if port is not None:
-        modification_count += 1
-    if port_forward is not None:
-        modification_count += 1
-    if rich_rule is not None:
-        modification_count += 1
-    if interface is not None:
-        modification_count += 1
-    if masquerade is not None:
-        modification_count += 1
-    if source is not None:
-        modification_count += 1
-    if target is not None:
-        modification_count += 1
-
-    if modification_count > 1:
-        module.fail_json(
-            msg='can only operate on port, service, rich_rule, masquerade, icmp_block, icmp_block_inversion, interface or source at once'
-        )
-    elif (modification_count > 0) and (desired_state in ['absent', 'present']) and (target is None):
+    modification = False
+    if any([icmp_block, icmp_block_inversion, service, port, port_forward, rich_rule,
+            interface, masquerade, source, target]):
+        modification = True
+    if modification and desired_state in ['absent', 'present'] and target is None:
         module.fail_json(
             msg='absent and present state can only be used in zone level operations'
         )
@@ -875,6 +861,14 @@ def main():
         if changed is True:
             msgs.append("Changed icmp-block-inversion %s to %s" % (icmp_block_inversion, desired_state))
 
+        # Type of icmp_block_inversion will be changed to boolean in a future release.
+        try:
+            boolean(icmp_block_inversion, True)
+        except TypeError:
+            module.warn('The value of the icmp_block_inversion option is "%s". '
+                        'The type of the option will be changed from string to boolean in a future release. '
+                        'To avoid unexpected behavior, please change the value to boolean.' % icmp_block_inversion)
+
     if service is not None:
 
         transaction = ServiceTransaction(
@@ -992,6 +986,14 @@ def main():
         changed, transaction_msgs = transaction.run()
         msgs = msgs + transaction_msgs
 
+        # Type of masquerade will be changed to boolean in a future release.
+        try:
+            boolean(masquerade, True)
+        except TypeError:
+            module.warn('The value of the masquerade option is "%s". '
+                        'The type of the option will be changed from string to boolean in a future release. '
+                        'To avoid unexpected behavior, please change the value to boolean.' % masquerade)
+
     if target is not None:
 
         transaction = ZoneTargetTransaction(
@@ -1007,7 +1009,7 @@ def main():
         msgs = msgs + transaction_msgs
 
     ''' If there are no changes within the zone we are operating on the zone itself '''
-    if modification_count == 0 and desired_state in ['absent', 'present']:
+    if not modification and desired_state in ['absent', 'present']:
 
         transaction = ZoneTransaction(
             module,

plugins/modules/firewalld_info.py

@@ -17,7 +17,7 @@ options:
     active_zones:
         description: Gather information about active zones.
         type: bool
-        default: no
+        default: false
     zones:
         description:
             - Gather information about specific zones.
@@ -36,7 +36,7 @@ author:
 EXAMPLES = r'''
 - name: Gather information about active zones
   ansible.posix.firewalld_info:
-    active_zones: yes
+    active_zones: true
 
 - name: Gather information about specific zones
   ansible.posix.firewalld_info:
@@ -204,8 +204,9 @@ firewalld_info:
 '''
 
 from ansible.module_utils.basic import AnsibleModule, missing_required_lib
+from ansible.module_utils.six import raise_from
 from ansible.module_utils._text import to_native
-from distutils.version import StrictVersion
+from ansible_collections.ansible.posix.plugins.module_utils.version import StrictVersion
 
 
 try:

plugins/modules/mount.py

@@ -31,12 +31,12 @@ options:
   src:
     description:
       - Device (or NFS volume, or something else) to be mounted on I(path).
-      - Required when I(state) set to C(present) or C(mounted).
+      - Required when I(state) set to C(present), C(mounted) or C(ephemeral).
     type: path
   fstype:
     description:
       - Filesystem type.
-      - Required when I(state) is C(present) or C(mounted).
+      - Required when I(state) is C(present), C(mounted) or C(ephemeral).
     type: str
   opts:
     description:
@@ -48,18 +48,18 @@ options:
       - Note that if set to C(null) and I(state) set to C(present),
         it will cease to work and duplicate entries will be made
         with subsequent runs.
-      - Has no effect on Solaris systems.
+      - Has no effect on Solaris systems or when used with C(ephemeral).
     type: str
-    default: 0
+    default: '0'
   passno:
     description:
       - Passno (see fstab(5)).
       - Note that if set to C(null) and I(state) set to C(present),
         it will cease to work and duplicate entries will be made
         with subsequent runs.
-      - Deprecated on Solaris systems.
+      - Deprecated on Solaris systems. Has no effect when used with C(ephemeral).
     type: str
-    default: 0
+    default: '0'
   state:
     description:
       - If C(mounted), the device will be actively mounted and appropriately
@@ -68,6 +68,13 @@ options:
       - If C(unmounted), the device will be unmounted without changing I(fstab).
       - C(present) only specifies that the device is to be configured in
         I(fstab) and does not trigger or require a mount.
+      - C(ephemeral) only specifies that the device is to be mounted, without changing
+        I(fstab). If it is already mounted, a remount will be triggered.
+        This will always return changed=True. If the mount point I(path)
+        has already a device mounted on, and its source is different than I(src),
+        the module will fail to avoid unexpected unmount or mount point override.
+        If the mount point is not present, the mount point will be created.
+        The I(fstab) is completely ignored. This option is added in version 1.5.0.
       - C(absent) specifies that the device mount's entry will be removed from
         I(fstab) and will also unmount the device and remove the mount
         point.
@@ -77,10 +84,15 @@ options:
         applied to the remount, but will not change I(fstab).  Additionally,
         if I(opts) is set, and the remount command fails, the module will
         error to prevent unexpected mount changes.  Try using C(mounted)
-        instead to work around this issue.
+        instead to work around this issue.  C(remounted) expects the mount point
+        to be present in the I(fstab). To remount a mount point not registered
+        in I(fstab), use C(ephemeral) instead, especially with BSD nodes.
+      - C(absent_from_fstab) specifies that the device mount's entry will be
+        removed from I(fstab). This option does not unmount it or delete the
+        mountpoint.
     type: str
     required: true
-    choices: [ absent, mounted, present, unmounted, remounted ]
+    choices: [ absent, absent_from_fstab, mounted, present, unmounted, remounted, ephemeral ]
   fstab:
     description:
       - File to use instead of C(/etc/fstab).
@@ -89,6 +101,7 @@ options:
       - OpenBSD does not allow specifying alternate fstab files with mount so do not
         use this on OpenBSD with any state that operates on the live filesystem.
       - This parameter defaults to /etc/fstab or /etc/vfstab on Solaris.
+      - This parameter is ignored when I(state) is set to C(ephemeral).
     type: str
   boot:
     description:
@@ -100,14 +113,15 @@ options:
         to mount options in I(/etc/fstab).
       - To avoid mount option conflicts, if C(noauto) specified in C(opts),
         mount module will ignore C(boot).
+      - This parameter is ignored when I(state) is set to C(ephemeral).
     type: bool
-    default: yes
+    default: true
   backup:
     description:
       - Create a backup file including the timestamp information so you can get
         the original file back if you somehow clobbered it incorrectly.
     type: bool
-    default: no
+    default: false
 notes:
   - As of Ansible 2.3, the I(name) option has been changed to I(path) as
     default, but I(name) still works as well.
@@ -172,7 +186,7 @@ EXAMPLES = r'''
   ansible.posix.mount:
     src: 192.168.1.100:/nfs/ssd/shared_data
     path: /mnt/shared_data
-    opts: rw,sync,hard,intr
+    opts: rw,sync,hard
     state: mounted
     fstype: nfs
 
@@ -180,10 +194,18 @@ EXAMPLES = r'''
   ansible.posix.mount:
     src: 192.168.1.100:/nfs/ssd/shared_data
     path: /mnt/shared_data
-    opts: rw,sync,hard,intr
-    boot: no
+    opts: rw,sync,hard
+    boot: false
     state: mounted
     fstype: nfs
+
+- name: Mount ephemeral SMB volume
+  ansible.posix.mount:
+    src: //192.168.1.200/share
+    path: /mnt/smb_share
+    opts: "rw,vers=3,file_mode=0600,dir_mode=0700,dom={{ ad_domain }},username={{ ad_username }},password={{ ad_password }}"
+    fstype: cifs
+    state: ephemeral
 '''
 
 import errno
@@ -226,7 +248,7 @@ def _escape_fstab(v):
     if isinstance(v, int):
         return v
     else:
-        return(
+        return (
             v.
             replace('\\', '\\134').
             replace(' ', '\\040').
@@ -254,6 +276,10 @@ def _set_mount_save_old(module, args):
             '%(src)s - %(name)s %(fstype)s %(passno)s %(boot)s %(opts)s\n')
 
     for line in open(args['fstab'], 'r').readlines():
+        # Append newline if the line in fstab does not finished with newline.
+        if not line.endswith('\n'):
+            line += '\n'
+
         old_lines.append(line)
 
         if not line.strip():
@@ -426,6 +452,24 @@ def _set_fstab_args(fstab_file):
     return result
 
 
+def _set_ephemeral_args(args):
+    result = []
+    # Set fstype switch according to platform. SunOS/Solaris use -F
+    if platform.system().lower() == 'sunos':
+        result.append('-F')
+    else:
+        result.append('-t')
+    result.append(args['fstype'])
+
+    # Even if '-o remount' is already set, specifying multiple -o is valid
+    if args['opts'] != 'defaults':
+        result += ['-o', args['opts']]
+
+    result.append(args['src'])
+
+    return result
+
+
 def mount(module, args):
     """Mount up a path or remount if needed."""
 
@@ -442,7 +486,11 @@ def mount(module, args):
                     'OpenBSD does not support alternate fstab files. Do not '
                     'specify the fstab parameter for OpenBSD hosts'))
     else:
-        cmd += _set_fstab_args(args['fstab'])
+        if module.params['state'] != 'ephemeral':
+            cmd += _set_fstab_args(args['fstab'])
+
+    if module.params['state'] == 'ephemeral':
+        cmd += _set_ephemeral_args(args)
 
     cmd += [name]
 
@@ -494,18 +542,24 @@ def remount(module, args):
                     'OpenBSD does not support alternate fstab files. Do not '
                     'specify the fstab parameter for OpenBSD hosts'))
     else:
-        cmd += _set_fstab_args(args['fstab'])
+        if module.params['state'] != 'ephemeral':
+            cmd += _set_fstab_args(args['fstab'])
+
+    if module.params['state'] == 'ephemeral':
+        cmd += _set_ephemeral_args(args)
 
     cmd += [args['name']]
     out = err = ''
 
     try:
-        if platform.system().lower().endswith('bsd'):
+        if module.params['state'] != 'ephemeral' and platform.system().lower().endswith('bsd'):
             # Note: Forcing BSDs to do umount/mount due to BSD remount not
             # working as expected (suspect bug in the BSD mount command)
             # Interested contributor could rework this to use mount options on
             # the CLI instead of relying on fstab
             # https://github.com/ansible/ansible-modules-core/issues/5591
+            # Note: this does not affect ephemeral state as all options
+            # are set on the CLI and fstab is expected to be ignored.
             rc = 1
         else:
             rc, out, err = module.run_command(cmd)
@@ -659,24 +713,66 @@ def get_linux_mounts(module, mntinfo_file="/proc/self/mountinfo"):
     return mounts
 
 
+def _is_same_mount_src(module, src, mountpoint, linux_mounts):
+    """Return True if the mounted fs on mountpoint is the same source than src. Return False if mountpoint is not a mountpoint"""
+    # If the provided mountpoint is not a mountpoint, don't waste time
+    if (
+            not ismount(mountpoint) and
+            not is_bind_mounted(module, linux_mounts, mountpoint)):
+        return False
+
+    # Treat Linux bind mounts
+    if platform.system() == 'Linux' and linux_mounts is not None:
+        # For Linux bind mounts only: the mount command does not return
+        # the actual source for bind mounts, but the device of the source.
+        # is_bind_mounted() called with the 'src' parameter will return True if
+        # the mountpoint is a bind mount AND the source FS is the same than 'src'.
+        # is_bind_mounted() is not reliable on Solaris, NetBSD and OpenBSD.
+        # But we can rely on 'mount -v' on all other platforms, and Linux non-bind mounts.
+        if is_bind_mounted(module, linux_mounts, mountpoint, src):
+            return True
+
+    # mount with parameter -v has a close behavior on Linux, *BSD, SunOS
+    # Requires -v with SunOS. Without -v, source and destination are reversed
+    # Output format differs from a system to another, but field[0:3] are consistent: [src, 'on', dest]
+    cmd = '%s -v' % module.get_bin_path('mount', required=True)
+    rc, out, err = module.run_command(cmd)
+    mounts = []
+
+    if len(out):
+        mounts = to_native(out).strip().split('\n')
+    else:
+        module.fail_json(msg="Unable to retrieve mount info with command '%s'" % cmd)
+
+    for mnt in mounts:
+        fields = mnt.split()
+        mp_src = fields[0]
+        mp_dst = fields[2]
+        if mp_src == src and mp_dst == mountpoint:
+            return True
+
+    return False
+
+
 def main():
     module = AnsibleModule(
         argument_spec=dict(
             boot=dict(type='bool', default=True),
-            dump=dict(type='str'),
+            dump=dict(type='str', default='0'),
             fstab=dict(type='str'),
             fstype=dict(type='str'),
             path=dict(type='path', required=True, aliases=['name']),
             opts=dict(type='str'),
-            passno=dict(type='str', no_log=False),
+            passno=dict(type='str', no_log=False, default='0'),
             src=dict(type='path'),
             backup=dict(type='bool', default=False),
-            state=dict(type='str', required=True, choices=['absent', 'mounted', 'present', 'unmounted', 'remounted']),
+            state=dict(type='str', required=True, choices=['absent', 'absent_from_fstab', 'mounted', 'present', 'unmounted', 'remounted', 'ephemeral']),
         ),
         supports_check_mode=True,
         required_if=(
             ['state', 'mounted', ['src', 'fstype']],
             ['state', 'present', ['src', 'fstype']],
+            ['state', 'ephemeral', ['src', 'fstype']]
         ),
     )
 
@@ -747,15 +843,17 @@ def main():
 
     # If fstab file does not exist, we first need to create it. This mainly
     # happens when fstab option is passed to the module.
-    if not os.path.exists(args['fstab']):
-        if not os.path.exists(os.path.dirname(args['fstab'])):
-            os.makedirs(os.path.dirname(args['fstab']))
-        try:
-            open(args['fstab'], 'a').close()
-        except PermissionError as e:
-            module.fail_json(msg="Failed to open %s due to permission issue" % args['fstab'])
-        except Exception as e:
-            module.fail_json(msg="Failed to open %s due to %s" % (args['fstab'], to_native(e)))
+    # If state is 'ephemeral', we do not need fstab file
+    if module.params['state'] != 'ephemeral':
+        if not os.path.exists(args['fstab']):
+            if not os.path.exists(os.path.dirname(args['fstab'])):
+                os.makedirs(os.path.dirname(args['fstab']))
+            try:
+                open(args['fstab'], 'a').close()
+            except PermissionError as e:
+                module.fail_json(msg="Failed to open %s due to permission issue" % args['fstab'])
+            except Exception as e:
+                module.fail_json(msg="Failed to open %s due to %s" % (args['fstab'], to_native(e)))
 
     # absent:
     #   Remove from fstab and unmounted.
@@ -766,12 +864,16 @@ def main():
     # mounted:
     #   Add to fstab if not there and make sure it is mounted. If it has
     #   changed in fstab then remount it.
+    # ephemeral:
+    #   Do not change fstab state, but mount.
 
     state = module.params['state']
     name = module.params['path']
     changed = False
 
-    if state == 'absent':
+    if state == 'absent_from_fstab':
+        name, changed = unset_mount(module, args)
+    elif state == 'absent':
         name, changed = unset_mount(module, args)
 
         if changed and not module.check_mode:
@@ -797,7 +899,7 @@ def main():
                         msg="Error unmounting %s: %s" % (name, msg))
 
             changed = True
-    elif state == 'mounted':
+    elif state == 'mounted' or state == 'ephemeral':
         dirs_created = []
         if not os.path.exists(name) and not module.check_mode:
             try:
@@ -825,7 +927,11 @@ def main():
                 module.fail_json(
                     msg="Error making dir %s: %s" % (name, to_native(e)))
 
-        name, backup_lines, changed = _set_mount_save_old(module, args)
+        # ephemeral: completely ignore fstab
+        if state != 'ephemeral':
+            name, backup_lines, changed = _set_mount_save_old(module, args)
+        else:
+            name, backup_lines, changed = args['name'], [], False
         res = 0
 
         if (
@@ -835,7 +941,26 @@ def main():
             if changed and not module.check_mode:
                 res, msg = remount(module, args)
                 changed = True
+
+            # When 'state' == 'ephemeral', we don't know what is in fstab, and 'changed' is always False
+            if state == 'ephemeral':
+                # If state == 'ephemeral', check if the mountpoint src == module.params['src']
+                # If it doesn't, fail to prevent unwanted unmount or unwanted mountpoint override
+                if _is_same_mount_src(module, args['src'], args['name'], linux_mounts):
+                    changed = True
+                    if not module.check_mode:
+                        res, msg = remount(module, args)
+                else:
+                    module.fail_json(
+                        msg=(
+                            'Ephemeral mount point is already mounted with a different '
+                            'source than the specified one. Failing in order to prevent an '
+                            'unwanted unmount or override operation. Try replacing this command with '
+                            'a "state: unmounted" followed by a "state: ephemeral", or use '
+                            'a different destination path.'))
+
         else:
+            # If not already mounted, mount it
             changed = True
 
             if not module.check_mode:
@@ -847,7 +972,8 @@ def main():
             # A non-working fstab entry may break the system at the reboot,
             # so undo all the changes if possible.
             try:
-                write_fstab(module, backup_lines, args['fstab'])
+                if state != 'ephemeral':
+                    write_fstab(module, backup_lines, args['fstab'])
             except Exception:
                 pass
 

plugins/modules/patch.py

@@ -50,10 +50,10 @@ options:
     default: present
   remote_src:
     description:
-      - If C(no), it will search for src at originating/controller machine, if C(yes) it will
+      - If C(false), it will search for src at originating/controller machine, if C(true) it will
         go to the remote/target machine for the C(src).
     type: bool
-    default: no
+    default: false
   strip:
     description:
       - Number that indicates the smallest prefix containing leading slashes
@@ -65,20 +65,20 @@ options:
     description:
       - Passes C(--backup --version-control=numbered) to patch, producing numbered backup copies.
     type: bool
-    default: no
+    default: false
   binary:
     description:
-      - Setting to C(yes) will disable patch's heuristic for transforming CRLF
+      - Setting to C(true) will disable patch's heuristic for transforming CRLF
         line endings into LF.
       - Line endings of src and dest must match.
-      - If set to C(no), C(patch) will replace CRLF in C(src) files on POSIX.
+      - If set to C(false), C(patch) will replace CRLF in C(src) files on POSIX.
     type: bool
-    default: no
+    default: false
   ignore_whitespace:
     description:
-      - Setting to C(yes) will ignore white space changes between patch and input..
+      - Setting to C(true) will ignore white space changes between patch and input.
     type: bool
-    default: no
+    default: false
 notes:
   - This module requires GNU I(patch) utility to be installed on the remote host.
 '''

plugins/modules/rhel_facts.py

@@ -0,0 +1,76 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Copyright: Red Hat Inc.
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+DOCUMENTATION = '''
+---
+module: rhel_facts
+version_added: 1.5.0
+short_description: Facts module to set or override RHEL specific facts.
+description:
+  - Compatibility layer for using the "package" module for rpm-ostree based systems via setting the "pkg_mgr" fact correctly.
+author:
+  - Adam Miller (@maxamillion)
+requirements:
+  - rpm-ostree
+seealso:
+  - module: ansible.builtin.package
+options: {}
+'''
+
+EXAMPLES = '''
+- name: Playbook to use the package module on all RHEL footprints
+  vars:
+    ansible_facts_modules:
+      - setup # REQUIRED to be run before all custom fact modules
+      - ansible.posix.rhel_facts
+  tasks:
+    - name: Ensure packages are installed
+      ansible.builtin.package:
+        name:
+          - htop
+          - ansible
+        state: present
+'''
+
+RETURN = """
+ansible_facts:
+    description: Relevant Ansible Facts
+    returned: when needed
+    type: complex
+    contains:
+        pkg_mgr:
+            description: System-level package manager override
+            returned: when needed
+            type: str
+            sample: {'pkg_mgr': 'ansible.posix.rhel_facts'}
+"""
+
+import os
+
+from ansible.module_utils.basic import AnsibleModule
+
+
+def main():
+
+    module = AnsibleModule(
+        argument_spec=dict(),
+        supports_check_mode=True,
+    )
+
+    ansible_facts = {}
+
+    # Verify that the platform is an rpm-ostree based system
+    if os.path.exists("/run/ostree-booted"):
+        ansible_facts['pkg_mgr'] = 'ansible.posix.rhel_rpm_ostree'
+
+    module.exit_json(ansible_facts, changed=False)
+
+
+if __name__ == '__main__':
+    main()

plugins/modules/rhel_rpm_ostree.py

@@ -0,0 +1,124 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Copyright: Red Hat Inc.
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+ANSIBLE_METADATA = {'metadata_version': '1.1',
+                    'status': ['preview'],
+                    'supported_by': 'community'}
+
+DOCUMENTATION = '''
+---
+module: rhel_rpm_ostree
+version_added: 1.5.0
+short_description: Ensure packages exist in a RHEL for Edge rpm-ostree based system
+description:
+  - Compatibility layer for using the "package" module for RHEL for Edge systems utilizing the RHEL System Roles.
+author:
+  - Adam Miller (@maxamillion)
+requirements:
+  - rpm-ostree
+options:
+  name:
+    description:
+      - A package name or package specifier with version, like C(name-1.0).
+      - Comparison operators for package version are valid here C(>), C(<), C(>=), C(<=). Example - C(name>=1.0)
+      - If a previous version is specified, the task also needs to turn C(allow_downgrade) on.
+        See the C(allow_downgrade) documentation for caveats with downgrading packages.
+      - When using state=latest, this can be C('*') which means run C(yum -y update).
+      - You can also pass a url or a local path to a rpm file (using state=present).
+        To operate on several packages this can accept a comma separated string of packages or (as of 2.0) a list of packages.
+    aliases: [ pkg ]
+    type: list
+    elements: str
+    default: []
+  state:
+    description:
+      - Whether to install (C(present) or C(installed), C(latest)), or remove (C(absent) or C(removed)) a package.
+      - C(present) and C(installed) will simply ensure that a desired package is installed.
+      - C(latest) will update the specified package if it's not of the latest available version.
+      - C(absent) and C(removed) will remove the specified package.
+      - Default is C(None), however in effect the default action is C(present) unless the C(autoremove) option is
+        enabled for this module, then C(absent) is inferred.
+    type: str
+    choices: [ absent, installed, latest, present, removed ]
+notes:
+  - This module does not support installing or removing packages to/from an overlay as this is not supported
+    by RHEL for Edge, packages needed should be defined in the osbuild Blueprint and provided to Image Builder
+    at build time. This module exists only for C(package) module compatibility.
+'''
+
+EXAMPLES = '''
+- name: Ensure htop and ansible are installed on rpm-ostree based RHEL
+  ansible.posix.rhel_rpm_ostree:
+    name:
+      - htop
+      - ansible
+    state: present
+'''
+
+RETURN = """
+msg:
+    description: status of rpm transaction
+    returned: always
+    type: str
+    sample: "No changes made."
+"""
+
+import os
+import traceback
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils._text import to_text
+
+
+def locally_installed(module, pkgname):
+    (rc, out, err) = module.run_command('{0} -q {1}'.format(module.get_bin_path("rpm"), pkgname).split())
+    return (rc == 0)
+
+
+def rpm_ostree_transaction(module):
+    pkgs = []
+
+    if module.params['state'] in ['present', 'installed', 'latest']:
+        for pkg in module.params['name']:
+            if not locally_installed(module, pkg):
+                pkgs.append(pkg)
+    elif module.params['state'] in ['absent', 'removed']:
+        for pkg in module.params['name']:
+            if locally_installed(module, pkg):
+                pkgs.append(pkg)
+
+    if not pkgs:
+        module.exit_json(msg="No changes made.")
+    else:
+        if module.params['state'] in ['present', 'installed', 'latest']:
+            module.fail_json(msg="The following packages are absent in the currently booted rpm-ostree commit: %s" ' '.join(pkgs))
+        else:
+            module.fail_json(msg="The following packages are present in the currently booted rpm-ostree commit: %s" ' '.join(pkgs))
+
+
+def main():
+    module = AnsibleModule(
+        argument_spec=dict(
+            name=dict(type='list', elements='str', aliases=['pkg'], default=[]),
+            state=dict(type='str', default=None, choices=['absent', 'installed', 'latest', 'present', 'removed']),
+        ),
+    )
+
+    # Verify that the platform is an rpm-ostree based system
+    if not os.path.exists("/run/ostree-booted"):
+        module.fail_json(msg="Module rpm_ostree is only applicable for rpm-ostree based systems.")
+
+    try:
+        rpm_ostree_transaction(module)
+    except Exception as e:
+        module.fail_json(msg=to_text(e), exception=traceback.format_exc())
+
+
+if __name__ == '__main__':
+    main()

plugins/modules/rpm_ostree_upgrade.py

@@ -0,0 +1,125 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Copyright: Red Hat Inc.
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+ANSIBLE_METADATA = {'metadata_version': '1.1',
+                    'status': ['preview'],
+                    'supported_by': 'community'}
+
+DOCUMENTATION = '''
+---
+module: rpm_ostree_upgrade
+short_description: Manage rpm-ostree upgrade transactions
+description:
+    - Manage an rpm-ostree upgrade transactions.
+version_added: 1.5.0
+author:
+- Adam Miller (@maxamillion)
+requirements:
+  - rpm-ostree
+options:
+    os:
+        description:
+            - The OSNAME upon which to operate.
+        type: str
+        default: ""
+        required: false
+    cache_only:
+        description:
+          - Perform the transaction using only pre-cached data, do not download.
+        type: bool
+        default: false
+        required: false
+    allow_downgrade:
+        description:
+            - Allow for the upgrade to be a chronologically older tree.
+        type: bool
+        default: false
+        required: false
+    peer:
+        description:
+            - Force peer-to-peer connection instead of using a system message bus.
+        type: bool
+        default: false
+        required: false
+
+'''
+
+EXAMPLES = '''
+- name: Upgrade the rpm-ostree image without options, accept all defaults
+  ansible.posix.rpm_ostree_upgrade:
+
+- name: Upgrade the rpm-ostree image allowing downgrades
+  ansible.posix.rpm_ostree_upgrade:
+    allow_downgrade: true
+'''
+
+RETURN = '''
+msg:
+    description: The command standard output
+    returned: always
+    type: str
+    sample: 'No upgrade available.'
+'''
+
+import os
+import traceback
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils._text import to_native, to_text
+
+
+def rpm_ostree_transaction(module):
+    cmd = []
+    cmd.append(module.get_bin_path("rpm-ostree"))
+    cmd.append('upgrade')
+
+    if module.params['os']:
+        cmd += ['--os', module.params['os']]
+    if module.params['cache_only']:
+        cmd += ['--cache-only']
+    if module.params['allow_downgrade']:
+        cmd += ['--allow-downgrade']
+    if module.params['peer']:
+        cmd += ['--peer']
+
+    module.run_command_environ_update = dict(LANG='C', LC_ALL='C', LC_MESSAGES='C')
+
+    rc, out, err = module.run_command(cmd)
+
+    if rc != 0:
+        module.fail_json(rc=rc, msg=err)
+    else:
+        if to_text("No upgrade available.") in to_text(out):
+            module.exit_json(msg=out, changed=False)
+        else:
+            module.exit_json(msg=out, changed=True)
+
+
+def main():
+    module = AnsibleModule(
+        argument_spec=dict(
+            os=dict(type='str', default=''),
+            cache_only=dict(type='bool', default=False),
+            allow_downgrade=dict(type='bool', default=False),
+            peer=dict(type='bool', default=False),
+        ),
+    )
+
+    # Verify that the platform is an rpm-ostree based system
+    if not os.path.exists("/run/ostree-booted"):
+        module.fail_json(msg="Module rpm_ostree_upgrade is only applicable for rpm-ostree based systems.")
+
+    try:
+        rpm_ostree_transaction(module)
+    except Exception as e:
+        module.fail_json(msg=to_native(e), exception=traceback.format_exc())
+
+
+if __name__ == '__main__':
+    main()

plugins/modules/seboolean.py

@@ -22,9 +22,9 @@ options:
     type: str
   persistent:
     description:
-      - Set to C(yes) if the boolean setting should survive a reboot.
+      - Set to C(true) if the boolean setting should survive a reboot.
     type: bool
-    default: 'no'
+    default: false
   state:
     description:
       - Desired boolean value
@@ -40,6 +40,7 @@ notes:
 requirements:
 - libselinux-python
 - libsemanage-python
+- python3-libsemanage
 author:
 - Stephen Fromm (@sfromm)
 '''
@@ -48,8 +49,8 @@ EXAMPLES = r'''
 - name: Set httpd_can_network_connect flag on and keep it persistent across reboots
   ansible.posix.seboolean:
     name: httpd_can_network_connect
-    state: yes
-    persistent: yes
+    state: true
+    persistent: true
 '''
 
 import os
@@ -284,7 +285,7 @@ def main():
         module.fail_json(msg=missing_required_lib('libselinux-python'), exception=SELINUX_IMP_ERR)
 
     if not HAVE_SEMANAGE:
-        module.fail_json(msg=missing_required_lib('libsemanage-python'), exception=SEMANAGE_IMP_ERR)
+        module.fail_json(msg=missing_required_lib('libsemanage-python or python3-libsemanage'), exception=SEMANAGE_IMP_ERR)
 
     ignore_selinux_state = module.params['ignore_selinux_state']
 

plugins/modules/selinux.py

@@ -28,6 +28,13 @@ options:
     required: true
     choices: [ disabled, enforcing, permissive ]
     type: str
+  update_kernel_param:
+    description:
+      - If set to I(true), will update also the kernel boot parameters when disabling/enabling SELinux.
+      - The C(grubby) tool must be present on the target system for this to work.
+    default: false
+    type: bool
+    version_added: '1.4.0'
   configfile:
     description:
       - The path to the SELinux configuration file, if non-standard.
@@ -97,6 +104,7 @@ except ImportError:
     HAS_SELINUX = False
 
 from ansible.module_utils.basic import AnsibleModule, missing_required_lib
+from ansible.module_utils.common.process import get_bin_path
 from ansible.module_utils.facts.utils import get_file_lines
 
 
@@ -119,6 +127,34 @@ def get_config_policy(configfile):
             return line.split('=')[1].strip()
 
 
+def get_kernel_enabled(module, grubby_bin):
+    if grubby_bin is None:
+        module.fail_json(msg="'grubby' command not found on host",
+                         details="In order to update the kernel command line"
+                                 "enabled/disabled setting, the grubby package"
+                                 "needs to be present on the system.")
+
+    rc, stdout, stderr = module.run_command([grubby_bin, '--info=ALL'])
+    if rc != 0:
+        module.fail_json(msg="unable to run grubby")
+
+    all_enabled = True
+    all_disabled = True
+    for line in stdout.split('\n'):
+        match = re.match('^args="(.*)"$', line)
+        if match is None:
+            continue
+        args = match.group(1).split(' ')
+        if 'selinux=0' in args:
+            all_enabled = False
+        else:
+            all_disabled = False
+    if all_disabled == all_enabled:
+        # inconsistent config - return None to force update
+        return None
+    return all_enabled
+
+
 # setter subroutines
 def set_config_state(module, state, configfile):
     # SELINUX=permissive
@@ -153,6 +189,17 @@ def set_state(module, state):
         module.fail_json(msg=msg)
 
 
+def set_kernel_enabled(module, grubby_bin, value):
+    rc, stdout, stderr = module.run_command([grubby_bin, '--update-kernel=ALL',
+                                             '--remove-args' if value else '--args',
+                                             'selinux=0'])
+    if rc != 0:
+        if value:
+            module.fail_json(msg='unable to remove selinux=0 from kernel config')
+        else:
+            module.fail_json(msg='unable to add selinux=0 to kernel config')
+
+
 def set_config_policy(module, policy, configfile):
     if not os.path.exists('/etc/selinux/%s/policy' % policy):
         module.fail_json(msg='Policy %s does not exist in /etc/selinux/' % policy)
@@ -183,6 +230,7 @@ def main():
             policy=dict(type='str'),
             state=dict(type='str', required=True, choices=['enforcing', 'permissive', 'disabled']),
             configfile=dict(type='str', default='/etc/selinux/config', aliases=['conf', 'file']),
+            update_kernel_param=dict(type='bool', default=False),
         ),
         supports_check_mode=True,
     )
@@ -196,9 +244,11 @@ def main():
     configfile = module.params['configfile']
     policy = module.params['policy']
     state = module.params['state']
+    update_kernel_param = module.params['update_kernel_param']
     runtime_enabled = selinux.is_selinux_enabled()
     runtime_policy = selinux.selinux_getpolicytype()[1]
     runtime_state = 'disabled'
+    kernel_enabled = None
     reboot_required = False
 
     if runtime_enabled:
@@ -215,6 +265,12 @@ def main():
 
     config_policy = get_config_policy(configfile)
     config_state = get_config_state(configfile)
+    if update_kernel_param:
+        try:
+            grubby_bin = get_bin_path('grubby')
+        except ValueError:
+            grubby_bin = None
+        kernel_enabled = get_kernel_enabled(module, grubby_bin)
 
     # check to see if policy is set if state is not 'disabled'
     if state != 'disabled':
@@ -269,6 +325,21 @@ def main():
         msgs.append("Config SELinux state changed from '%s' to '%s'" % (config_state, state))
         changed = True
 
+    requested_kernel_enabled = state in ('enforcing', 'permissive')
+    # Update kernel enabled/disabled config only when setting is consistent
+    # across all kernels AND the requested state differs from the current state
+    if update_kernel_param and kernel_enabled != requested_kernel_enabled:
+        if not module.check_mode:
+            set_kernel_enabled(module, grubby_bin, requested_kernel_enabled)
+        if requested_kernel_enabled:
+            states = ('disabled', 'enabled')
+        else:
+            states = ('enabled', 'disabled')
+        if kernel_enabled is None:
+            states = ('<inconsistent>', states[1])
+        msgs.append("Kernel SELinux state changed from '%s' to '%s'" % states)
+        changed = True
+
     module.exit_json(changed=changed, msg=', '.join(msgs), configfile=configfile, policy=policy, state=state, reboot_required=reboot_required)
 
 

plugins/modules/synchronize.py

@@ -53,36 +53,36 @@ options:
     description:
       - Mirrors the rsync archive flag, enables recursive, links, perms, times, owner, group flags and -D.
     type: bool
-    default: yes
+    default: true
   checksum:
     description:
       - Skip based on checksum, rather than mod-time & size; Note that that "archive" option is still enabled by default - the "checksum" option will
         not disable it.
     type: bool
-    default: no
+    default: false
   compress:
     description:
       - Compress file data during the transfer.
       - In most cases, leave this enabled unless it causes problems.
     type: bool
-    default: yes
+    default: true
   existing_only:
     description:
       - Skip creating new files on receiver.
     type: bool
-    default: no
+    default: false
   delete:
     description:
       - Delete files in I(dest) that do not exist (after transfer, not before) in the I(src) path.
-      - This option requires I(recursive=yes).
+      - This option requires I(recursive=true).
       - This option ignores excluded files and behaves like the rsync opt C(--delete-after).
     type: bool
-    default: no
+    default: false
   dirs:
     description:
       - Transfer directories without recursing.
     type: bool
-    default: no
+    default: false
   recursive:
     description:
       - Recurse into directories.
@@ -97,7 +97,7 @@ options:
     description:
       - Copy symlinks as the item that they point to (the referent) is copied, rather than the symlink.
     type: bool
-    default: no
+    default: false
   perms:
     description:
       - Preserve permissions.
@@ -132,26 +132,26 @@ options:
     description:
       - Put user@ for the remote paths.
       - If you have a custom ssh config to define the remote user for a host
-        that does not match the inventory user, you should set this parameter to C(no).
+        that does not match the inventory user, you should set this parameter to C(false).
     type: bool
-    default: yes
+    default: true
   use_ssh_args:
     description:
       - In Ansible 2.10 and lower, it uses the ssh_args specified in C(ansible.cfg).
       - In Ansible 2.11 and onwards, when set to C(true), it uses all SSH connection configurations like
         C(ansible_ssh_args), C(ansible_ssh_common_args), and C(ansible_ssh_extra_args).
     type: bool
-    default: no
+    default: false
   ssh_connection_multiplexing:
     description:
       - SSH connection multiplexing for rsync is disabled by default to prevent misconfigured ControlSockets from resulting in failed SSH connections.
         This is accomplished by setting the SSH C(ControlSocket) to C(none).
-      - Set this option to C(yes) to allow multiplexing and reduce SSH connection overhead.
-      - Note that simply setting this option to C(yes) is not enough;
+      - Set this option to C(true) to allow multiplexing and reduce SSH connection overhead.
+      - Note that simply setting this option to C(true) is not enough;
         You must also configure SSH connection multiplexing in your SSH client config by setting values for
         C(ControlMaster), C(ControlPersist) and C(ControlPath).
     type: bool
-    default: no
+    default: false
   rsync_opts:
     description:
       - Specify additional rsync options by passing in an array.
@@ -163,12 +163,12 @@ options:
     description:
       - Tells rsync to keep the partial file which should make a subsequent transfer of the rest of the file much faster.
     type: bool
-    default: no
+    default: false
   verify_host:
     description:
       - Verify destination host key.
     type: bool
-    default: no
+    default: false
   private_key:
     description:
       - Specify the private key to use for SSH-based rsync connections (e.g. C(~/.ssh/id_rsa)).
@@ -184,7 +184,7 @@ options:
       - This option puts the temporary file from each updated file into a holding directory until the end of the transfer,
         at which time all the files are renamed into place in rapid succession.
     type: bool
-    default: yes
+    default: true
     version_added: '1.3.0'
 
 notes:
@@ -252,27 +252,27 @@ EXAMPLES = r'''
   ansible.posix.synchronize:
     src: some/relative/path
     dest: /some/absolute/path
-    archive: no
+    archive: false
 
 - name: Synchronization with --archive options enabled except for --recursive
   ansible.posix.synchronize:
     src: some/relative/path
     dest: /some/absolute/path
-    recursive: no
+    recursive: false
 
 - name: Synchronization with --archive options enabled except for --times, with --checksum option enabled
   ansible.posix.synchronize:
     src: some/relative/path
     dest: /some/absolute/path
-    checksum: yes
-    times: no
+    checksum: true
+    times: false
 
 - name: Synchronization without --archive options enabled except use --links
   ansible.posix.synchronize:
     src: some/relative/path
     dest: /some/absolute/path
-    archive: no
-    links: yes
+    archive: false
+    links: true
 
 - name: Synchronization of two paths both on the control machine
   ansible.posix.synchronize:
@@ -302,8 +302,8 @@ EXAMPLES = r'''
   ansible.posix.synchronize:
     src: some/relative/path
     dest: /some/absolute/path
-    delete: yes
-    recursive: yes
+    delete: true
+    recursive: true
 
 # This specific command is granted su privileges on the destination
 - name: Synchronize using an alternate rsync command
@@ -587,8 +587,8 @@ def main():
     if '@' not in dest:
         dest = os.path.expanduser(dest)
 
-    cmd.append(source)
-    cmd.append(dest)
+    cmd.append(shlex_quote(source))
+    cmd.append(shlex_quote(dest))
     cmdstr = ' '.join(cmd)
 
     # If we are using password authentication, write the password into the pipe

plugins/modules/sysctl.py

@@ -38,14 +38,14 @@ options:
         description:
             - Use this option to ignore errors about unknown keys.
         type: bool
-        default: 'no'
+        default: false
     reload:
         description:
-            - If C(yes), performs a I(/sbin/sysctl -p) if the C(sysctl_file) is
-              updated. If C(no), does not reload I(sysctl) even if the
+            - If C(true), performs a I(/sbin/sysctl -p) if the C(sysctl_file) is
+              updated. If C(false), does not reload I(sysctl) even if the
               C(sysctl_file) is updated.
         type: bool
-        default: 'yes'
+        default: true
     sysctl_file:
         description:
             - Specifies the absolute path to C(sysctl.conf), if not C(/etc/sysctl.conf).
@@ -53,9 +53,9 @@ options:
         type: path
     sysctl_set:
         description:
-            - Verify token value with the sysctl command and set with -w if necessary
+            - Verify token value with the sysctl command and set with -w if necessary.
         type: bool
-        default: 'no'
+        default: false
 author:
 - David CHANIAL (@davixx)
 '''
@@ -78,21 +78,21 @@ EXAMPLES = r'''
     name: kernel.panic
     value: '3'
     sysctl_file: /tmp/test_sysctl.conf
-    reload: no
+    reload: false
 
 # Set ip forwarding on in /proc and verify token value with the sysctl command
 - ansible.posix.sysctl:
     name: net.ipv4.ip_forward
     value: '1'
-    sysctl_set: yes
+    sysctl_set: true
 
 # Set ip forwarding on in /proc and in the sysctl file and reload if necessary
 - ansible.posix.sysctl:
     name: net.ipv4.ip_forward
     value: '1'
-    sysctl_set: yes
+    sysctl_set: true
     state: present
-    reload: yes
+    reload: true
 '''
 
 # ==============================================================

plugins/shell/csh.py

@@ -4,13 +4,8 @@
 from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
-from ansible.module_utils.six import text_type
-from ansible.module_utils.six.moves import shlex_quote
-from ansible.plugins.shell import ShellBase
-
 DOCUMENTATION = '''
     name: csh
-    plugin_type: shell
     short_description: C shell (/bin/csh)
     description:
       - When you have no other option than to use csh
@@ -18,6 +13,10 @@ DOCUMENTATION = '''
       - shell_common
 '''
 
+from ansible.module_utils.six import text_type
+from ansible.module_utils.six.moves import shlex_quote
+from ansible.plugins.shell import ShellBase
+
 
 class ShellModule(ShellBase):
 

plugins/shell/fish.py

@@ -4,13 +4,8 @@
 from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
-from ansible.module_utils.six import text_type
-from ansible.module_utils.six.moves import shlex_quote
-from ansible.plugins.shell.sh import ShellModule as ShModule
-
 DOCUMENTATION = '''
     name: fish
-    plugin_type: shell
     short_description: fish shell (/bin/fish)
     description:
       - This is here because some people are restricted to fish.
@@ -18,6 +13,10 @@ DOCUMENTATION = '''
       - shell_common
 '''
 
+from ansible.module_utils.six import text_type
+from ansible.module_utils.six.moves import shlex_quote
+from ansible.plugins.shell.sh import ShellModule as ShModule
+
 
 class ShellModule(ShModule):
 

shippable.yml

@@ -15,7 +15,7 @@ matrix:
     - env: T=2.9/freebsd/12.0/1
     - env: T=2.9/linux/centos6/1
     - env: T=2.9/linux/centos7/1
-    - env: T=2.9/linux/centos8/1
+#    - env: T=2.9/linux/centos8/1
     - env: T=2.9/linux/fedora30/1
     - env: T=2.9/linux/fedora31/1
     - env: T=2.9/linux/opensuse15py2/1
@@ -30,7 +30,7 @@ matrix:
     - env: T=2.10/freebsd/12.1/1
     - env: T=2.10/linux/centos6/1
     - env: T=2.10/linux/centos7/1
-    - env: T=2.10/linux/centos8/1
+#    - env: T=2.10/linux/centos8/1
     - env: T=2.10/linux/fedora30/1
     - env: T=2.10/linux/fedora31/1
     - env: T=2.10/linux/opensuse15py2/1
@@ -45,7 +45,7 @@ matrix:
     - env: T=devel/freebsd/12.1/1
     - env: T=devel/linux/centos6/1
     - env: T=devel/linux/centos7/1
-    - env: T=devel/linux/centos8/1
+#    - env: T=devel/linux/centos8/1
     - env: T=devel/linux/fedora30/1
     - env: T=devel/linux/fedora31/1
     - env: T=devel/linux/opensuse15py2/1

tests/integration/targets/acl/tasks/acl.yml

@@ -23,6 +23,16 @@
   group:
     name: "{{ test_group }}"
 
+- name: Clean up working directory and files
+  file:
+    path: "{{ output_dir }}"
+    state: absent
+
+- name: Create working directory
+  file:
+    path: "{{ output_dir }}"
+    state: directory
+
 - name: Create ansible file
   file:
     path: "{{ test_file }}"

tests/integration/targets/authorized_key/tasks/setup_steps.yml

@@ -1,5 +1,14 @@
 # -------------------------------------------------------------
 # Setup steps
+- name: Clean up the working directory and files
+  file:
+    path: '{{ output_dir }}'
+    state: absent
+
+- name: Create the working directory
+  file:
+    path: '{{ output_dir }}'
+    state: directory
 
 - name: copy an existing file in place with comments
   copy:

tests/integration/targets/firewalld/tasks/port_test_cases.yml

@@ -4,7 +4,7 @@
 
 - name: firewalld port range test permanent enabled
   firewalld:
-    port: 5500-6950/tcp
+    port: 5500-6850/tcp
     permanent: true
     state: enabled
   register: result
@@ -16,7 +16,7 @@
 
 - name: firewalld port range test permanent enabled rerun (verify not changed)
   firewalld:
-    port: 5500-6950/tcp
+    port: 5500-6850/tcp
     permanent: true
     state: enabled
   register: result
@@ -57,7 +57,7 @@
     state: disabled
   loop:
     - 6900/tcp
-    - 5500-6950/tcp
+    - 5500-6850/tcp
 
 - name: firewalld port test permanent enabled
   firewalld:

tests/integration/targets/firewalld/tasks/run_all_tests.yml

@@ -14,7 +14,10 @@
 - include_tasks: port_test_cases.yml
 
 # firewalld source operation test cases
-- import_tasks: source_test_cases.yml
+- include_tasks: source_test_cases.yml
 
 # firewalld zone target operation test cases
-- import_tasks: zone_target_test_cases.yml
+- include_tasks: zone_target_test_cases.yml
+
+# firewalld port forwarding operation test cases
+- include_tasks: port_forward_test_cases.yml

tests/integration/targets/firewalld/tasks/source_test_cases.yml

@@ -82,4 +82,4 @@
   assert:
     that:
     - result is not changed
-    - "result.msg == 'can only operate on port, service, rich_rule, masquerade, icmp_block, icmp_block_inversion, interface or source at once'"
+    - "result.msg == 'parameters are mutually exclusive: icmp_block|icmp_block_inversion|service|port|port_forward|rich_rule|interface|masquerade|source|target'"

tests/integration/targets/mount/tasks/main.yml

@@ -1,3 +1,9 @@
+- name: Install dependencies
+  ansible.builtin.package:
+    name: e2fsprogs
+    state: present
+  when: ansible_system == 'Linux'
+
 - name: Create the mount point
   file:
     state: directory
@@ -280,7 +286,7 @@
   - name: Fail if they are the same
     fail:
       msg: Filesytem was not remounted, testing of the module failed!
-    when: last_write is defined and last_write_time2 is defined and last_write_time.stdout == last_write_time2.stdout 
+    when: last_write is defined and last_write_time2 is defined and last_write_time.stdout == last_write_time2.stdout
 
   - name: Remount filesystem with different opts using remounted option (Linux only)
     mount:
@@ -311,7 +317,7 @@
     assert:
       that:
         - "'backup_file' in mount_backup_out"
-  
+
   always:
   - name: Umount the test FS
     mount:
@@ -368,4 +374,308 @@
     loop:
     - /tmp/myfs.img
     - /tmp/myfs
-  when: ansible_system in ('Linux')
+  when: ansible_system in ('Linux')
+
+- name: Block to test missing newline at the EOF of fstab
+  block:
+  - name: Create empty file
+    community.general.filesize:
+      path: /tmp/myfs1.img
+      size: 20M
+  - name: Format FS
+    community.general.filesystem:
+      fstype: ext3
+      dev: /tmp/myfs1.img
+  - name: Create custom fstab file without newline
+    copy:
+      content: '#TEST COMMENT WITHOUT NEWLINE'
+      dest: /tmp/test_fstab
+  - name: Mount the FS using the custom fstab
+    mount:
+      path: /tmp/myfs1
+      src: /tmp/myfs1.img
+      fstype: ext3
+      state: mounted
+      opts: defaults
+      fstab: /tmp/test_fstab
+  - name: Unmount the mount point in the custom fstab
+    mount:
+      path: /tmp/myfs1
+      state: absent
+      fstab: /tmp/test_fstab
+  - name: Remove the test FS and the custom fstab
+    file:
+      path: '{{ item }}'
+      state: absent
+    loop:
+    - /tmp/myfs1.img
+    - /tmp/myfs1
+    - /tmp/test_fstab
+  when: ansible_system in ('Linux')
+
+- name: Block to test ephemeral option
+  environment:
+    PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+  block:
+  - name: Create empty file A
+    community.general.filesize:
+      path: /tmp/myfs_A.img
+      size: 20M
+
+  - name: Create empty file B
+    community.general.filesize:
+      path: /tmp/myfs_B.img
+      size: 20M
+
+  - name: Register facts on Linux
+    ansible.builtin.set_fact:
+      ephemeral_device_A: /tmp/myfs_A.img
+      ephemeral_device_B: /tmp/myfs_B.img
+      ephemeral_fstype: ext3
+      ephemeral_fstab: /etc/fstab
+    when: ansible_system == 'Linux'
+
+  - name: Register facts on Solaris/SunOS
+    ansible.builtin.set_fact:
+      ephemeral_device_A: /dev/lofi/1
+      ephemeral_device_B: /dev/lofi/2
+      ephemeral_create_loop_dev_cmd: >
+        lofiadm -a /tmp/myfs_A.img /dev/lofi/1 &&
+        lofiadm -a /tmp/myfs_B.img /dev/lofi/2
+      ephemeral_remove_loop_dev_cmd: >
+        lofiadm -d /dev/lofi/1 &&
+        lofiadm -d /dev/lofi/2 || true
+      ephemeral_fstype: ufs
+      ephemeral_fstab: /etc/vfstab
+    when: ansible_system == 'SunOS'
+
+  - name: Register facts on FreeBSD
+    ansible.builtin.set_fact:
+      ephemeral_device_A: /dev/md1
+      ephemeral_device_B: /dev/md2
+      ephemeral_create_loop_dev_cmd: >
+        mdconfig -a -t vnode -f /tmp/myfs_A.img -u /dev/md1 &&
+        mdconfig -a -t vnode -f /tmp/myfs_B.img -u /dev/md2
+      ephemeral_remove_loop_dev_cmd: >
+        mdconfig -d -u /dev/md1 &&
+        mdconfig -d -u /dev/md2
+      ephemeral_fstype: ufs
+      ephemeral_fstab: /etc/fstab
+    when: ansible_system == 'FreeBSD'
+
+  - name: Register facts on NetBSD
+    ansible.builtin.set_fact:
+      ephemeral_device_A: /dev/vnd1
+      ephemeral_device_B: /dev/vnd2
+      ephemeral_create_loop_dev_cmd: >
+        vnconfig /dev/vnd1 /tmp/myfs_A.img &&
+        vnconfig /dev/vnd2 /tmp/myfs_B.img
+      ephemeral_remove_loop_dev_cmd: >
+        vnconfig -u /dev/vnd1 &&
+        vnconfig -u /dev/vnd2
+      ephemeral_fstype: ufs
+      ephemeral_fstab: /etc/fstab
+    when: ansible_system == 'NetBSD'
+
+  - name: Register format fs command on Non-Linux and Non-OpenBSD
+    ansible.builtin.set_fact:
+      ephemeral_format_fs_cmd: >
+        yes | newfs {{ ephemeral_device_A }} &&
+        yes | newfs {{ ephemeral_device_B }}
+    when: ansible_system in ('SunOS', 'FreeBSD', 'NetBSD')
+
+  - name: Register facts on OpenBSD
+    ansible.builtin.set_fact:
+      ephemeral_device_A: /dev/vnd1c
+      ephemeral_device_B: /dev/vnd2c
+      ephemeral_create_loop_dev_cmd: >
+        vnconfig vnd1 /tmp/myfs_A.img &&
+        vnconfig vnd2 /tmp/myfs_B.img
+      ephemeral_remove_loop_dev_cmd: >
+        vnconfig -u vnd1 &&
+        vnconfig -u vnd2
+      ephemeral_format_fs_cmd: >
+        yes | newfs /dev/rvnd1c &&
+        yes | newfs /dev/rvnd2c
+      ephemeral_fstype: ffs
+      ephemeral_fstab: /etc/fstab
+    when: ansible_system == 'OpenBSD'
+
+##### FORMAT FS ON LINUX
+
+  - name: Block to format FS on Linux
+    block:
+    - name: Format FS A on Linux
+      community.general.filesystem:
+        fstype: ext3
+        dev: /tmp/myfs_A.img
+
+    - name: Format FS B on Linux
+      community.general.filesystem:
+        fstype: ext3
+        dev: /tmp/myfs_B.img
+    when: ansible_system == 'Linux'
+
+##### FORMAT FS ON SOLARIS AND BSD
+
+  - name: Create loop devices on Solaris and BSD
+    ansible.builtin.shell: "{{ ephemeral_create_loop_dev_cmd }}"
+    when: ephemeral_create_loop_dev_cmd is defined
+
+  - name: Format FS A and B on Solaris and BSD
+    ansible.builtin.shell: "{{ ephemeral_format_fs_cmd }}"
+    when: ephemeral_format_fs_cmd is defined
+
+##### TESTS
+
+  - name: Create fstab if it does not exist
+    ansible.builtin.file:
+      path: "{{ ephemeral_fstab }}"
+      state: touch
+
+  - name: Get checksum of /etc/fstab before mounting anything
+    stat:
+      path: '{{ ephemeral_fstab }}'
+    register: fstab_stat_before_mount
+
+  - name: Mount the FS A with ephemeral state
+    mount:
+      path: /tmp/myfs
+      src: '{{ ephemeral_device_A }}'
+      fstype: '{{ ephemeral_fstype }}'
+      opts: rw
+      state: ephemeral
+    register: ephemeral_mount_info
+
+  - name: Put something in the directory so we can do additional checks later on
+    copy:
+      content: 'Testing'
+      dest: /tmp/myfs/test_file
+
+  - name: Get checksum of /etc/fstab after an ephemeral mount
+    stat:
+      path: '{{ ephemeral_fstab }}'
+    register: fstab_stat_after_mount
+
+  - name: Get mountinfo
+    shell: mount -v | awk '{print $3}' | grep '^/tmp/myfs$' | wc -l
+    register: check_mountinfo
+    changed_when: no
+
+  - name: Assert the mount occured and the fstab is unchanged
+    assert:
+      that:
+      - check_mountinfo.stdout|int == 1
+      - ephemeral_mount_info['changed']
+      - fstab_stat_before_mount['stat']['checksum'] == fstab_stat_after_mount['stat']['checksum']
+
+  - name: Get first mount record
+    shell: mount -v | grep '/tmp/myfs'
+    register: ephemeral_mount_record_1
+    changed_when: no
+
+  - name: Try to mount FS A where FS A is already mounted (should trigger remount and changed)
+    mount:
+      path: /tmp/myfs
+      src: '{{ ephemeral_device_A }}'
+      fstype: '{{ ephemeral_fstype }}'
+      opts: ro
+      state: ephemeral
+    register: ephemeral_mount_info
+
+  - name: Get second mount record (should be different than the first)
+    shell: mount -v | grep '/tmp/myfs'
+    register: ephemeral_mount_record_2
+    changed_when: no
+
+  - name: Get mountinfo
+    shell: mount -v | awk '{print $3}' | grep '^/tmp/myfs$' | wc -l
+    register: check_mountinfo
+    changed_when: no
+
+  - name: Assert the FS A is still mounted, the options changed and the fstab unchanged
+    assert:
+      that:
+        - check_mountinfo.stdout|int == 1
+        - ephemeral_mount_record_1.stdout != ephemeral_mount_record_2.stdout
+        - ephemeral_mount_info['changed']
+        - fstab_stat_before_mount['stat']['checksum'] == fstab_stat_after_mount['stat']['checksum']
+
+  - name: Try to mount file B on file A mountpoint (should fail)
+    mount:
+      path: /tmp/myfs
+      src: '{{ ephemeral_device_B }}'
+      fstype: '{{ ephemeral_fstype }}'
+      state: ephemeral
+    register: ephemeral_mount_b_info
+    ignore_errors: true
+
+  - name: Get third mount record (should be the same than the second)
+    shell: mount -v | grep '/tmp/myfs'
+    register: ephemeral_mount_record_3
+    changed_when: no
+
+  - name: Get mountinfo
+    shell: mount -v | awk '{print $3}' | grep '^/tmp/myfs$' | wc -l
+    register: check_mountinfo
+    changed_when: no
+
+  - name: Try to stat our test file
+    stat:
+      path: /tmp/myfs/test_file
+    register: test_file_stat
+
+  - name: Assert that mounting FS B over FS A failed
+    assert:
+      that:
+        - check_mountinfo.stdout|int == 1
+        - ephemeral_mount_record_2.stdout == ephemeral_mount_record_3.stdout
+        - test_file_stat['stat']['exists']
+        - ephemeral_mount_b_info is failed
+
+  - name: Unmount FS with state = unmounted
+    mount:
+      path: /tmp/myfs
+      state: unmounted
+
+  - name: Get fstab checksum after unmounting an ephemeral mount with state = unmounted
+    stat:
+      path: '{{ ephemeral_fstab }}'
+    register: fstab_stat_after_unmount
+
+  - name: Get mountinfo
+    shell: mount -v | awk '{print $3}' | grep '^/tmp/myfs$' | wc -l
+    register: check_mountinfo
+    changed_when: no
+
+  - name: Try to stat our test file
+    stat:
+      path: /tmp/myfs/test_file
+    register: test_file_stat
+
+  - name: Assert that fstab is unchanged after unmounting an ephemeral mount with state = unmounted
+    assert:
+      that:
+      - check_mountinfo.stdout|int == 0
+      - not test_file_stat['stat']['exists']
+      - fstab_stat_before_mount['stat']['checksum'] == fstab_stat_after_unmount['stat']['checksum']
+
+  always:
+    - name: Unmount potential failure relicas
+      mount:
+        path: /tmp/myfs
+        state: unmounted
+
+    - name: Remove loop devices on Solaris and BSD
+      ansible.builtin.shell: "{{ ephemeral_remove_loop_dev_cmd }}"
+      when: ephemeral_remove_loop_dev_cmd is defined
+
+    - name: Remove the test FS
+      file:
+        path: '{{ item }}'
+        state: absent
+      loop:
+        - /tmp/myfs_A.img
+        - /tmp/myfs_B.img
+        - /tmp/myfs
+  when: ansible_system in ('Linux', 'SunOS', 'FreeBSD', 'NetBSD', 'OpenBSD')

tests/integration/targets/selinux/tasks/selinux.yml

@@ -20,11 +20,25 @@
 # ##############################################################################
 # Test changing the state, which requires a reboot
 
+- name: TEST 1 | Make sure grubby is present
+  package:
+    name: grubby
+    state: present
+
 - name: TEST 1 | Get current SELinux config file contents
+  slurp:
+    src: /etc/sysconfig/selinux
+  register: selinux_config_original_base64
+
+- name: TEST 1 | Register SELinux config and SELinux status
   set_fact:
-    selinux_config_original: "{{ lookup('file', '/etc/sysconfig/selinux').split('\n') }}"
+    selinux_config_original_raw: "{{ selinux_config_original_base64.content | b64decode }}"
     before_test_sestatus: "{{ ansible_selinux }}"
 
+- name: TEST 1 | Split by line and register original config
+  set_fact:
+    selinux_config_original: "{{ selinux_config_original_raw.split('\n') }}"
+
 - debug:
     var: "{{ item }}"
     verbosity: 1
@@ -90,8 +104,17 @@
       - _disable_test2.reboot_required
 
 - name: TEST 1 | Get modified config file
+  slurp:
+    src: /etc/sysconfig/selinux
+  register: selinux_config_after_base64
+
+- name: TEST 1 | Register modified config
   set_fact:
-    selinux_config_after: "{{ lookup('file', '/etc/sysconfig/selinux').split('\n') }}"
+    selinux_config_after_raw: "{{ selinux_config_after_base64.content | b64decode }}"
+
+- name: TEST 1 | Split by line and register modified config
+  set_fact:
+    selinux_config_after: "{{ selinux_config_after_raw.split('\n') }}"
 
 - debug:
     var: selinux_config_after
@@ -104,11 +127,52 @@
       - selinux_config_after[selinux_config_after.index('SELINUX=disabled')]  is search("^SELINUX=\w+$")
       - selinux_config_after[selinux_config_after.index('SELINUXTYPE=targeted')]  is search("^SELINUXTYPE=\w+$")
 
-- name: TEST 1 | Reset SELinux configuration for next test
+- name: TEST 1 | Disable SELinux again, with kernel arguments update
+  selinux:
+    state: disabled
+    policy: targeted
+    update_kernel_param: true
+  register: _disable_test2
+
+- name: Check kernel command-line arguments
+  ansible.builtin.command: grubby --info=DEFAULT
+  register: _grubby_test1
+
+- name: TEST 1 | Assert that kernel cmdline contains selinux=0
+  assert:
+    that:
+      - "' selinux=0' in _grubby_test1.stdout"
+
+- name: TEST 1 | Enable SELinux, without kernel arguments update
+  selinux:
+    state: disabled
+    policy: targeted
+  register: _disable_test2
+
+- name: Check kernel command-line arguments
+  ansible.builtin.command: grubby --info=DEFAULT
+  register: _grubby_test1
+
+- name: TEST 1 | Assert that kernel cmdline still contains selinux=0
+  assert:
+    that:
+      - "' selinux=0' in _grubby_test1.stdout"
+
+- name: TEST 1 | Reset SELinux configuration for next test (also kernel args)
   selinux:
     state: enforcing
+    update_kernel_param: true
     policy: targeted
 
+- name: Check kernel command-line arguments
+  ansible.builtin.command: grubby --info=DEFAULT
+  register: _grubby_test2
+
+- name: TEST 1 | Assert that kernel cmdline doesn't contain selinux=0
+  assert:
+    that:
+      - "' selinux=0' not in _grubby_test2.stdout"
+
 
 # Second Test
 # ##############################################################################
@@ -163,8 +227,17 @@
       - not _state_test2.reboot_required
 
 - name: TEST 2 | Get modified config file
+  slurp:
+    src: /etc/sysconfig/selinux
+  register: selinux_config_after_base64
+
+- name: TEST 2 | Register modified config
   set_fact:
-    selinux_config_after: "{{ lookup('file', '/etc/sysconfig/selinux').split('\n') }}"
+    selinux_config_after_raw: "{{ selinux_config_after_base64.content | b64decode }}"
+
+- name: TEST 2 | Split by line and register modified config
+  set_fact:
+    selinux_config_after: "{{ selinux_config_after_raw.split('\n') }}"
 
 - debug:
     var: selinux_config_after

tests/integration/targets/synchronize/tasks/main.yml

@@ -2,16 +2,29 @@
   package:
     name: rsync
   when: ansible_distribution != "MacOSX"
-- name: cleanup old files
-  shell: rm -rf {{output_dir}}/*
+- name: Clean up the working directory and files
+  file:
+    path: '{{ output_dir }}'
+    state: absent
+- name: Create the working directory
+  file:
+    path: '{{ output_dir }}'
+    state: directory
 - name: create test new files
-  copy: dest={{output_dir}}/{{item}} mode=0644 content="hello world"
+  copy:
+    dest: '{{output_dir}}/{{item}}'
+    mode: '0644'
+    content: 'hello world'
   with_items:
   - foo.txt
   - bar.txt
+
 - name: synchronize file to new filename
-  synchronize: src={{output_dir}}/foo.txt dest={{output_dir}}/foo.result
+  synchronize:
+    src: '{{output_dir}}/foo.txt'
+    dest: '{{output_dir}}/foo.result'
   register: sync_result
+  delegate_to: '{{ inventory_hostname }}'
 - assert:
     that:
     - '''changed'' in sync_result'
@@ -31,9 +44,13 @@
     that:
     - stat_result.stat.exists == True
     - stat_result.stat.checksum == '2aae6c35c94fcfb415dbe95f408b9ce91ee846ed'
+
 - name: test that the file is not copied a second time
-  synchronize: src={{output_dir}}/foo.txt dest={{output_dir}}/foo.result
+  synchronize:
+    src='{{output_dir}}/foo.txt'
+    dest='{{output_dir}}/foo.result'
   register: sync_result
+  delegate_to: '{{ inventory_hostname }}'
 - assert:
     that:
     - sync_result.changed == False
@@ -44,12 +61,14 @@
   with_items:
   - foo.result
   - bar.result
+
 - name: Synchronize using the mode=push param
   synchronize:
     src: '{{output_dir}}/foo.txt'
     dest: '{{output_dir}}/foo.result'
     mode: push
   register: sync_result
+  delegate_to: '{{ inventory_hostname }}'
 - assert:
     that:
     - '''changed'' in sync_result'
@@ -69,12 +88,14 @@
     that:
     - stat_result.stat.exists == True
     - stat_result.stat.checksum == '2aae6c35c94fcfb415dbe95f408b9ce91ee846ed'
+
 - name: test that the file is not copied a second time
   synchronize:
     src: '{{output_dir}}/foo.txt'
     dest: '{{output_dir}}/foo.result'
     mode: push
   register: sync_result
+  delegate_to: '{{ inventory_hostname }}'
 - assert:
     that:
     - sync_result.changed == False
@@ -85,12 +106,14 @@
   with_items:
   - foo.result
   - bar.result
+
 - name: Synchronize using the mode=pull param
   synchronize:
     src: '{{output_dir}}/foo.txt'
     dest: '{{output_dir}}/foo.result'
     mode: pull
   register: sync_result
+  delegate_to: '{{ inventory_hostname }}'
 - assert:
     that:
     - '''changed'' in sync_result'
@@ -110,12 +133,14 @@
     that:
     - stat_result.stat.exists == True
     - stat_result.stat.checksum == '2aae6c35c94fcfb415dbe95f408b9ce91ee846ed'
+
 - name: test that the file is not copied a second time
   synchronize:
     src: '{{output_dir}}/foo.txt'
     dest: '{{output_dir}}/foo.result'
     mode: pull
   register: sync_result
+  delegate_to: '{{ inventory_hostname }}'
 - assert:
     that:
     - sync_result.changed == False
@@ -126,12 +151,16 @@
   with_items:
   - foo.result
   - bar.result
+
 - name: synchronize files using with_items (issue#5965)
-  synchronize: src={{output_dir}}/{{item}} dest={{output_dir}}/{{item}}.result
+  synchronize:
+    src: '{{output_dir}}/{{item}}'
+    dest: '{{output_dir}}/{{item}}.result'
   with_items:
   - foo.txt
   - bar.txt
   register: sync_result
+  delegate_to: '{{ inventory_hostname }}'
 - assert:
     that:
     - sync_result.changed
@@ -151,9 +180,14 @@
   with_items:
   - foo.txt
   - bar.txt
+
 - name: synchronize files using rsync_path (issue#7182)
-  synchronize: src={{output_dir}}/foo.txt dest={{output_dir}}/foo.rsync_path rsync_path="sudo rsync"
+  synchronize:
+    src: '{{output_dir}}/foo.txt'
+    dest: '{{output_dir}}/foo.rsync_path'
+    rsync_path: 'sudo rsync'
   register: sync_result
+  delegate_to: '{{ inventory_hostname }}'
 - assert:
     that:
     - '''changed'' in sync_result'
@@ -186,6 +220,7 @@
     dest: '{{output_dir}}/{{item}}/foo.txt'
   with_items:
   - directory_a
+  delegate_to: '{{ inventory_hostname }}'
 - name: synchronize files using link_dest
   synchronize:
     src: '{{output_dir}}/directory_a/foo.txt'
@@ -193,6 +228,7 @@
     link_dest:
     - '{{output_dir}}/directory_a'
   register: sync_result
+  delegate_to: '{{ inventory_hostname }}'
 - name: get stat information for directory_a
   stat:
     path: '{{ output_dir }}/directory_a/foo.txt'
@@ -214,6 +250,8 @@
     - '{{output_dir}}'
   register: sync_result
   ignore_errors: true
+  delegate_to: '{{ inventory_hostname }}'
+
 - assert:
     that:
     - sync_result is not changed
@@ -227,3 +265,46 @@
   - directory_a/foo.txt
   - directory_a
   - directory_b
+
+- name: setup - test for source with working dir with spaces in path
+  file:
+    state: directory
+    path: '{{output_dir}}/{{item}}'
+  delegate_to: '{{ inventory_hostname }}'
+  with_items:
+    - 'directory a'
+    - 'directory b'
+- name: setup - create test new files
+  copy:
+    dest: '{{output_dir}}/directory a/{{item}}'
+    mode: '0644'
+    content: 'hello world'
+  with_items:
+    - foo.txt
+  delegate_to: '{{ inventory_hostname }}'
+- name: copy source with spaces in dir path
+  synchronize:
+    src: '{{output_dir}}/directory a/foo.txt'
+    dest: '{{output_dir}}/directory b/'
+  delegate_to: '{{ inventory_hostname }}'
+  register: sync_result
+  ignore_errors: true
+- name: get stat information for directory_b
+  stat:
+    path: '{{ output_dir }}/directory b/foo.txt'
+  register: stat_result_b
+- assert:
+    that:
+      - '''changed'' in sync_result'
+      - sync_result.changed == true
+      - stat_result_b.stat.exists == True
+      - stat_result_b.stat.checksum == '2aae6c35c94fcfb415dbe95f408b9ce91ee846ed'
+- name: Cleanup
+  file:
+    state: absent
+    path: '{{output_dir}}/{{item}}'
+  with_items:
+    - 'directory b/foo.txt'
+    - 'directory a/foo.txt'
+    - 'directory a'
+    - 'directory b'

tests/integration/targets/sysctl/tasks/main.yml

@@ -123,10 +123,10 @@
         that:
           - sysctl_test2_change_test is not changed
 
-    - name: Try sysctl with an invalid value
+    - name: Try sysctl with an invalid name
       sysctl:
-        name: net.ipv4.ip_forward
-        value: foo
+        name: test.invalid
+        value: 1
       register: sysctl_test3
       ignore_errors: yes
 
@@ -196,10 +196,10 @@
           - sysctl_no_value is failed
           - "sysctl_no_value.msg == 'value cannot be None'"
 
-    - name: Try sysctl with an invalid value
+    - name: Try sysctl with an invalid name
       sysctl:
-        name: net.ipv4.ip_forward
-        value: foo
+        name: test.invalid
+        value: 1
         sysctl_set: yes
       register: sysctl_test4
       ignore_errors: yes

tests/sanity/ignore-2.12.txt

@@ -1,4 +1,4 @@
-plugins/modules/synchronize.py pylint:blacklisted-name
+plugins/modules/synchronize.py pylint:disallowed-name
 plugins/modules/synchronize.py use-argspec-type-path
 plugins/modules/synchronize.py validate-modules:doc-default-does-not-match-spec
 plugins/modules/synchronize.py validate-modules:nonexistent-parameter-documented

tests/sanity/ignore-2.13.txt

@@ -0,0 +1,8 @@
+plugins/modules/synchronize.py pylint:disallowed-name
+plugins/modules/synchronize.py use-argspec-type-path
+plugins/modules/synchronize.py validate-modules:doc-default-does-not-match-spec
+plugins/modules/synchronize.py validate-modules:nonexistent-parameter-documented
+plugins/modules/synchronize.py validate-modules:parameter-type-not-in-doc
+plugins/modules/synchronize.py validate-modules:undocumented-parameter
+tests/utils/shippable/check_matrix.py replace-urlopen
+tests/utils/shippable/timing.py shebang

tests/sanity/ignore-2.14.txt

@@ -0,0 +1,8 @@
+plugins/modules/synchronize.py pylint:disallowed-name
+plugins/modules/synchronize.py use-argspec-type-path
+plugins/modules/synchronize.py validate-modules:doc-default-does-not-match-spec
+plugins/modules/synchronize.py validate-modules:nonexistent-parameter-documented
+plugins/modules/synchronize.py validate-modules:parameter-type-not-in-doc
+plugins/modules/synchronize.py validate-modules:undocumented-parameter
+tests/utils/shippable/check_matrix.py replace-urlopen
+tests/utils/shippable/timing.py shebang

tests/sanity/ignore-2.15.txt

@@ -0,0 +1,8 @@
+plugins/modules/synchronize.py pylint:disallowed-name
+plugins/modules/synchronize.py use-argspec-type-path
+plugins/modules/synchronize.py validate-modules:doc-default-does-not-match-spec
+plugins/modules/synchronize.py validate-modules:nonexistent-parameter-documented
+plugins/modules/synchronize.py validate-modules:parameter-type-not-in-doc
+plugins/modules/synchronize.py validate-modules:undocumented-parameter
+tests/utils/shippable/check_matrix.py replace-urlopen
+tests/utils/shippable/timing.py shebang

tests/unit/mock/loader.py

@@ -46,8 +46,8 @@ class DictDataLoader(DataLoader):
 
     # TODO: the real _get_file_contents returns a bytestring, so we actually convert the
     #       unicode/text it's created with to utf-8
-    def _get_file_contents(self, path):
-        path = to_text(path)
+    def _get_file_contents(self, file_name):
+        path = to_text(file_name)
         if path in self._file_mapping:
             return (to_bytes(self._file_mapping[path]), False)
         else:

tests/unit/plugins/action/test_synchronize.py

@@ -55,6 +55,7 @@ class TaskMock(object):
     become = None
     become_user = None
     become_method = None
+    check_mode = False
 
 
 class StdinMock(object):
@@ -125,7 +126,7 @@ class SynchronizeTester(object):
         metapath = os.path.join(fixturepath, 'meta.yaml')
         with open(metapath, 'rb') as f:
             fdata = f.read()
-        test_meta = yaml.load(fdata)
+        test_meta = yaml.safe_load(fdata)
 
         # load initial play context vars
         if '_play_context' in test_meta:

tests/utils/shippable/shippable.sh

@@ -50,7 +50,7 @@ function retry
         echo "@* -> ${result}"
     done
     echo "Command '@*' failed 3 times!"
-    exit -1
+    exit 255
 }
 
 command -v pip
@@ -74,7 +74,14 @@ else
 fi
 
 # START: HACK install dependencies
-retry ansible-galaxy collection install community.general
+if [ "${ansible_version}" == "2.9" ] || [ "${ansible_version}" == "2.10" ]; then
+    # Note: Since community.general 5.x, Ansible Core versions prior to 2.11 are not supported.
+    # So we need to use 4.8.1 for Ansible 2.9 and Ansible Engine 2.10.
+    retry git clone --depth=1 --single-branch -b 4.8.1 https://github.com/ansible-collections/community.general.git "${ANSIBLE_COLLECTIONS_PATHS}/ansible_collections/community/general"
+else
+    retry git clone --depth=1 --single-branch https://github.com/ansible-collections/community.general.git "${ANSIBLE_COLLECTIONS_PATHS}/ansible_collections/community/general"
+fi
+# Note:  we're installing with git to work around Galaxy being a huge PITA (https://github.com/ansible/galaxy/issues/2429)
 # END: HACK
 
 export PYTHONIOENCODING='utf-8'