postgresql_pg_hba is not idempotent when used with overwrite and rules

[nlvw]

Consider the following role files

default/main.yml

pgsql_dir: /var/lib/pgsql
pgsql_password_encryption: 'scram-sha-256'
pgsql_pg_hba_overwrite: true
pgsql_pg_hba_rules: [] # add custom rules here
pgsql_pg_hba_default_rules: # do not change these!
  - comment: Postgres Service User Socket Passwordless
    users: postgres
    databases: all
    contype: local
    method: peer

  - comment: Local Unix Socket Hashed Passwords
    users: all
    databases: all
    contype: local
    method: "{{ pgsql_password_encryption }}"

  - comment: Local IPv4 Hashed Passwords
    users: all
    databases: all
    contype: host
    address: 127.0.0.1/32
    method: "{{ pgsql_password_encryption }}"

  - comment: Local IPv6 Hashed Passwords
    users: all
    databases: all
    contype: host
    address: ::1/128
    method: "{{ pgsql_password_encryption }}"

tasks/main.yml

- name: configure pg_hba
  community.postgresql.postgresql_pg_hba:
    dest: "{{ pgsql_dir }}/data/pg_hba.conf"
    keep_comments_at_rules: true
    overwrite: "{{ pgsql_pg_hba_overwrite }}"
    rules: "{{ pgsql_pg_hba_default_rules + pgsql_pg_hba_rules }}"
    rules_behavior: combine
  become: yes
  become_user: postgres
  notify: reload postgresql

When overwrite is set to true the task will always show as changed even if the file is identical to what it was before. This means that the reload postgresql handler will run every time regardless of actual changes.

[Andersson007]

@nlvw hello, thanks for reporting the issue!

@betanummeric @sebasmannem i wonder if it's a bug or something intentional?

[betanummeric]

I can confirm the issue. It happens because overwrite: true empties the representation of the pg_hba.conf in memory, then all requested rules are added and the result is written. Adding the rules again is falsely considered a change.

[Andersson007]

I can confirm the issue. It happens because overwrite: true empties the representation of the pg_hba.conf in memory, then all requested rules are added and the result is written. Adding the rules again is falsely considered a change.

@betanummeric do you think if is it possible to fix it? If yes, would you like to pick it up (i don't think it's a blocker, so no rush at all, imo)

[betanummeric]

Yes, I can try to fix it.