upstream bug in to_nice_yaml affects template generation task: "value must be a string"

[appliedprivacy]

What happened?

Task "Copy the node_exporter config file" fails with the following error:

    "msg": "AnsibleError: Unexpected templating type error occurred on (---\n{{ ansible_managed | comment }}\n{% if node_exporter_tls_server_config | length > 0 %}\ntls_server_config:\n{{ node_exporter_tls_server_config | to_nice_yaml | indent(2, true) }}\n{% endif %}\n\n{% if node_exporter_http_server_config | length > 0 %}\nhttp_server_config:\n{{ node_exporter_http_server_config | to_nice_yaml | indent(2, true) }}\n{% endif %}\n\n{% if node_exporter_basic_auth_users | length > 0 %}\nbasic_auth_users:\n{% for k, v in node_exporter_basic_auth_users.items() %}\n  {{ k }}: {{ v | password_hash('bcrypt', ('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890' | shuffle(seed=inventory_hostname) | join)[:22], rounds=9) }}\n{% endfor %}\n{% endif %}\n): value must be a string"

Removing
| to_nice_yaml | indent(2, true)
from the config.yaml.j2 template
avoids the error. Resulting config:

tls_server_config:
{'cert_file': '/etc/node_exporter/tls.cert', 'key_file': '/etc/node_exporter/tls.key'}

I suspect this is related to:
ansible/ansible#66916

Did you expect to see some different?

config.yaml is generated without errors.

How to reproduce it (as minimally and precisely as possible):

• ensure key and cert files are in place

used playbook:

- hosts: server
  roles:
    - ansible-node-exporter
  vars:
    node_exporter_binary_local_dir: /home/user/prometheus_bin/node_exporter
    node_exporter_tls_server_config:
      cert_file: '/etc/node_exporter/tls.cert'
      key_file: '/etc/node_exporter/tls.key

ensure your ansible version matches the one bellow

Environment

• Role version:

0.21.0

• Ansible version information:

ansible 2.9.9
  config file = /home/user/.ansible.cfg
  configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 3.7.7 (default, Mar 13 2020, 10:23:39) [GCC 9.2.1 20190827 (Red Hat 9.2.1-1)]

python3-pyyaml-5.3.1-1.fc31.x86_64

[paulfantom]

Indeed seems like an upstream bug and only for a subset of ansible installations (that's why it wasn't caught during role tests).

Removing to_nice_yaml is not an option, it is a well-documented ansible filter helping with file readability and I don't want to create a hacky workaround for something that should be fixed upstream.

[zico4reel]

{% for k, v in node_exporter_basic_auth_users.items() %}
  {{ k }}: {{ v | password_hash('bcrypt', ('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890' | shuffle(seed=inventory_hostname) | join)[:22], rounds=9) }}
{% endfor %}

rounds does not seem to be found as an argument, I suggest it should be removed

[valferon]

Observed similar behavior with ansible 2.9.9 ( ubuntu 20.04 latest ansible package )
Had to re-install via pip (version 4.x) to get the filter to work.

[appliedprivacy]

according to upstream this is solved in ansible-core 2.12
ansible/ansible#66916 (comment)

[SuperQ]

This role has been deprecated in favor of a the prometheus-community/ansible collection.