repositories role fails with ansible-core 2.20 + allow_embedded_templates = False

[myllynen]

With ansible-core 2.18 I see a playbook using the latest repositories module working ok:

...
TASK [redhat.satellite.repositories : Enable Red Hat Repositories]
changed: [127.0.0.1] => (item=[{'name': 'Red Hat Enterprise Linux for x86_64'}, {'name': 'Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs)', 'releasever': 9}])
changed: [127.0.0.1] => (item=[{'name': 'Red Hat Enterprise Linux for x86_64'}, {'name': 'Red Hat Enterprise Linux 9 for x86_64 - BaseOS (RPMs)', 'releasever': 9}])
...

With ansible-core 2.20 I get this error using the same ansible.cfg, same playbook, same variables, same module version:

...
TASK [redhat.satellite.repositories : Enable Red Hat Repositories]
[ERROR]: The lookup plugin 'subelements' failed: subelements lookup expects a list of two or three items, first a dict or a list, second a string pointing to the subkey
Origin:

invoke_lookup()

task path: /home/admin/.ansible/collections/ansible_collections/redhat/satellite/roles/repositories/tasks/main.yml:2
fatal: [127.0.0.1]: FAILED! =>
msg: 'The lookup plugin ''subelements'' failed: subelements lookup expects a list
of two or three items, first a dict or a list, second a string pointing to the subkey'
...

[evgeni]

I assume you mean the repositories role, not module? ;)

https://github.com/theforeman/foreman-ansible-modules/blob/develop/roles/repositories/tasks/main.yml

[myllynen]

Yes, indeed, the role.

[evgeni]

We have tests for that (https://github.com/theforeman/foreman-ansible-modules/blob/develop/tests/test_playbooks/repositories_role.yml) and they pass on 2.20, so I wonder what's happening here.

Can you share your foreman_products variable?

[myllynen]

This was my variable definition:

#
# Satellite Products
#
satellite_products:
  - name: Red Hat Enterprise Linux for x86_64
    repository_sets:
      - name: Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs)
        releasever: 9
      - name: Red Hat Enterprise Linux 9 for x86_64 - BaseOS (RPMs)
        releasever: 9

      - name: Red Hat Satellite Client 6 for RHEL 9 x86_64 (RPMs)
      - name: Red Hat Satellite Maintenance 6.19 for RHEL 9 x86_64 (RPMs)
      - name: Red Hat Satellite Utils 6.19 for RHEL 9 x86_64 (RPMs)

  - name: Red Hat Satellite Capsule
    repository_sets:
      - name: Red Hat Satellite Capsule 6.19 for RHEL 9 x86_64 (RPMs)

[evgeni]

And you're sure that the variable definition is properly passed?

I've dropped that var into a simple debug playbook:

---
- hosts: localhost
  vars:
    satellite_products:
      - name: Red Hat Enterprise Linux for x86_64
        repository_sets:
          - name: Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs)
            releasever: 9
          - name: Red Hat Enterprise Linux 9 for x86_64 - BaseOS (RPMs)
            releasever: 9
    
          - name: Red Hat Satellite Client 6 for RHEL 9 x86_64 (RPMs)
          - name: Red Hat Satellite Maintenance 6.19 for RHEL 9 x86_64 (RPMs)
          - name: Red Hat Satellite Utils 6.19 for RHEL 9 x86_64 (RPMs)
    
      - name: Red Hat Satellite Capsule
        repository_sets:
          - name: Red Hat Satellite Capsule 6.19 for RHEL 9 x86_64 (RPMs)
  tasks:
    - name: debug satellite_products
      ansible.builtin.debug:
        var: item
      with_subelements:
        - "{{ satellite_products | selectattr('repository_sets', 'defined') | list }}"
        - repository_sets

And it runs just fine on my Fedora with ansible-core 2.20.6

[myllynen]

Right, so this is actually because in my ansible.cfg I had this "forward looking" setting enabled:

allow_embedded_templates = False

This was added in ansible-core 2.19 and its description says:

When enabled, this option allows embedded templates to be used for specific backward compatibility scenarios. A deprecation warning will be emitted in these cases. First, conditionals (for example, failed_when, until, assert.that) fully enclosed in template delimiters. Second, string constants in conditionals (for example, when: some_var == '{{ some_other_var }}'). Finally, positional arguments to lookups (for example, lookup('pipe', 'echo {{ some_var }}')). This feature is deprecated, since embedded templates are unnecessary in these cases. When disabled, use of embedded templates will result in an error. A future release will disable this feature by default.

So this looks like something to address, but we're definitely in no rush with this.

[evgeni]

Interesting. I am failing to understand how this can be written without a template for the line with selectattr.

[myllynen]

This seems to work:

      loop: "{{ query('subelements',
                  satellite_products | selectattr('repository_sets', 'defined'),
                  'repository_sets') }}"