# debconf with variable is not really idempotent?

**URL:** <https://forum.ansible.com/t/debconf-with-variable-is-not-really-idempotent/18784>\
**Category:** Ansible Project\
**Created:** [July 16, 2015, 6:08pm UTC](https://forum.ansible.com/t/debconf-with-variable-is-not-really-idempotent/18784 "2015-07-16T18:08:57Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Phyks](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@Phyks](https://forum.ansible.com/u/Phyks)\
**Post date:** [July 16, 2015, 6:08pm UTC](https://forum.ansible.com/t/debconf-with-variable-is-not-really-idempotent/18784/1 "2015-07-16T18:08:57Z")

</div>

Hi,

I am using the following line in an Ansible playbook:

```auto
debconf: name={{ item.name }} question={{ item.question }} vtype={{
item.vtype }} value={{ item.value }}
with_items:
  - { name: "mariadb-server-10.0", question:
"mysql-server/root_password", vtype: "password", value:
"{{mysql_root_password}}"}
  - { name: "mariadb-server-10.0", question:
"mysql-server/root_password_again", vtype: "password", value:
"{{mysql_root_password}}"}

```

But the task is marked as "changed" at every execution. I would expect  
it to be changed only if the values are different than the previous ones  
and skipped otherwise.

Moreover, when the value is explicitly given (instead of referencing a  
variable), the behaviour is as expected and the task is skipped if it  
was already set.

Is it a bug or an expected feature?

Thanks!

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [July 16, 2015, 6:20pm UTC](https://forum.ansible.com/t/debconf-with-variable-is-not-really-idempotent/18784/2 "2015-07-16T18:20:02Z")

</div>

passwords cannot be read, so they always appear as changed, this is a  
limitation of debconf itself.

all other field types should work as you expect

---

<div class="post-metadata">

**Author:** ![Phyks](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@Phyks](https://forum.ansible.com/u/Phyks)\
**Post date:** [July 16, 2015, 8:42pm UTC](https://forum.ansible.com/t/debconf-with-variable-is-not-really-idempotent/18784/3 "2015-07-16T20:42:11Z")

</div>

Ok, I did not know about it. I confirm I only have this behavior with  
password fields.

Thanks

---

<div class="post-metadata">

**Author:** ![Mischa\_ter\_Smitten](https://avatars.discourse-cdn.com/v4/letter/m/c0e974/32.png) [@Mischa\_ter\_Smitten](https://forum.ansible.com/u/Mischa_ter_Smitten)\
**Post date:** [July 16, 2015, 8:46pm UTC](https://forum.ansible.com/t/debconf-with-variable-is-not-really-idempotent/18784/4 "2015-07-16T20:46:46Z")

</div>

Is there any way to work around that?

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [July 16, 2015, 11:22pm UTC](https://forum.ansible.com/t/debconf-with-variable-is-not-really-idempotent/18784/5 "2015-07-16T23:22:33Z")

</div>

Not that i know of, debian's debconf deals with passwords this way,  
probably to prevent possible security issues.

If someone figures out a way to compare all the passwords, I'm all  
open. In the mysql case we can read the /etc/my.cnf, but ... really we  
should not be doing that.

---

<div class="post-metadata">

**Author:** ![Phyks](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@Phyks](https://forum.ansible.com/u/Phyks)\
**Post date:** [July 16, 2015, 11:25pm UTC](https://forum.ansible.com/t/debconf-with-variable-is-not-really-idempotent/18784/6 "2015-07-16T23:25:29Z")

</div>

Sounds like all password fields are not treated this way.

Indeed, `debconf-get-selections` returns:  
mariadb-server-10.0 mysql-server/root\_password\_again password THE\_PASSWORD