CODEWITHSUNDEEP
ansible
codec
codec

Reputation: 8796

fail custom message with item name

I have the following task which works perfectly as expected. I am wondering if the failure message can be a bit more informative since I am passing no_log: true without which I could see the entire result in the logs. Something like: More than one access keys available for the cos account {{ item.name }} 

  - name: Fail if more than one key is available for any of the COS accounts
      fail: msg="More than one access keys available for the cos account"
      when: (item.json)|length > 1
      with_items: '{{ old_existing_creds.results }}'
      no_log: true

In fact I noticed I could not even see the msg. The o/p I got is:

TASK [Fail if more than one key is available for any of the COS accounts] *****************************************************************************
skipping: [localhost] => (item=None) 
failed: [localhost] (item=None) => {"censored": "the output has been hidden due to the fact that 'no_log: true' was specified for this result", "changed": false}
fatal: [localhost]: FAILED! => {"censored": "the output has been hidden due to the fact that 'no_log: true' was specified for this result", "changed": false}
        to retry, use: --limit @/root/deployment/generateSLKeys.retry

Upvotes: 1

Views: 579

Answers (1)

larsks
larsks

Reputation: 311436

You've asked Ansible not to log the result of your task by setting no_log: true, so you're not going to be able to see the result of the fail task. You can hack around this by first creating a new variable that maps names from your old_existing_creds variables to the length of the json attribute, like this:

---
- hosts: localhost
  gather_facts: false
  vars:
    old_existing_creds:
      results:
        - json: [secret1,secret2]
          name: foo
        - json: [secret1]
          name: bar
  tasks:
    - name: check length of json array
      set_fact:
        key_check: "{{ key_check|default({})|combine({item.name: item.json|length}) }}"
      loop: "{{ old_existing_creds.results }}"


    - debug:
        var: key_check

    - name: Fail if more than one key is available for any of the COS accounts
      fail:
        msg: "More than one access keys available for the cos account {{ item.key }}"
      when: (item.value > 1)
      loop: "{{ key_check|dict2items }}"

This will output:

TASK [Fail if more than one key is available for any of the COS accounts] *********************
failed: [localhost] (item={'key': u'foo', 'value': 2}) => {"changed": false, "item": {"key": "foo", "value": 2}, "msg": "More than one access keys available for the cos account foo"}        
skipping: [localhost] => (item={'key': u'bar', 'value': 1})

As you can see, it shows the message from the fail task, which includes the account name, but it does not expose credentials in the log.

Upvotes: 1

Related Questions