Why is Ansible not failing this string in stdout conditional?

Question

I am running Ansible version 2.7 on Centos7 using the network_cli connection method.

I have a playbook that:

• Instructs a networking device to pull in a new firmware image via TFTP
• Instructs the networking device to calculate the md5 hash value
• Stores the output of the calculation in .stdout
• Has a conditional When: statment that checks for a given md5 value in the .stdout before proceeding with the task block.

No matter what md5 value I give, it always runs the task block.

The conditional statement is:

when: '"new_ios_md5" | string in md5_result.stdout'

Here is the full playbook:

---

- name: UPGRADE SUP8L-E SWITCH FIRMWARE
  hosts: switches
  connection: network_cli
  gather_facts: no

  vars_prompt:
   - name: "compliant_ios_version"
     prompt: "What is the compliant IOS version?"
     private: no

   - name: "new_ios_bin"
     prompt: "What is the name of the new IOS file?"
     private: no

   - name: "new_ios_md5"
     prompt: "What is the MD5 value of the new IOS file?"
     private: no

   - name: "should_reboot"
     prompt: "Do you want Ansible to reboot the hosts? (YES or NO)"
     private: no

  tasks:
    - name: GATHER SWITCH FACTS
      ios_facts:

    - name: UPGRADE IOS IMAGE IF NOT COMPLIANT
      block:
      - name: COPY OVER IOS IMAGE
        ios_command:
           commands:
              - command: "copy tftp://X.X.X.X/45-SUP8L-E/{{ new_ios_bin }} bootflash:"
                prompt: '[{{ new_ios_bin }}]'
              answer: "\r"
        vars:
          ansible_command_timeout: 1800

      - name: CHECK MD5 HASH
        ios_command:
           commands:
              - command: "verify /md5 bootflash:{{ new_ios_bin }}"
        register: md5_result
        vars:
          ansible_command_timeout: 300

      - name: CONTINUE UPGRADE IF MD5 HASH MATCHES
        block:
        - name: SETTING BOOT IMAGE
          ios_config:
            lines:
            - no boot system
            - boot system flash bootflash:{{ new_ios_bin }}
            match: none
            save_when: always

        - name: REBOOT SWITCH IF INSTRUCTED
          block:
          - name: REBOOT SWITCH
            ios_command:
               commands:
                  - command: "reload"
                    prompt: '[confirm]'
                    answer: "\r"
            vars:
              ansible_command_timeout: 30

          - name: WAIT FOR SWITCH TO RETURN
            wait_for:
              host: "{{inventory_hostname}}"
              port: 22
              delay: 60
              timeout: 600
            delegate_to: localhost

          - name: GATHER ROUTER FACTS FOR VERIFICATION
            ios_facts:

          - name: ASSERT THAT THE IOS VERSION IS CORRECT
            assert:
              that:
                - compliant_ios_version == ansible_net_version
              msg: "New IOS version matches compliant version. Upgrade successful."

          when: should_reboot == "YES"

        when: '"new_ios_md5" | string in md5_result.stdout'

      when: ansible_net_version != compliant_ios_version
...

The other two conditionals in the playbook work as expected. I cannot figure out how to get ansible to fail the when: '"new_ios_md5" | string in md5_result.stdout' conditional and stop the play if the md5 value is wrong.

When you run the play with debug output the value of stdout is:

    "stdout": [
".............................................................................................................................................Done!", 
                "verify /md5 (bootflash:cat4500es8-universalk9.SPA.03.10.02.E.152-6.E2.bin) = c1af921dc94080b5e0172dbef42dc6ba"
            ]

You can clearly see the calculated md5 in the string but my conditional doesn't seem to care either way.

Does anyone have any advice?

Answer 1

When you write:

when: '"new_ios_md5" | string in md5_result.stdout'

You are looking for the literal string "new_ios_md5" inside the variable md5_result.stdout. Since you actually want to refer to the new new_ios_md5 variable, you ened to remove the quotes around it:

when: 'new_ios_md5 | string in md5_result.stdout'