No OneTemporary
Actions

Size

89 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/changelogs/fragments/t6837-vyos_config-replace.yml b/changelogs/fragments/t6837-vyos_config-replace.yml
	new file mode 100644
	index 00000000..9a0ff2b8
	--- /dev/null
	+++ b/changelogs/fragments/t6837-vyos_config-replace.yml
	@@ -0,0 +1,19 @@
	+---
	+minor_changes:
	+ - vyos_config - added a new ``replace`` option value, ``config`` (in addition
	+ to the existing default, ``line``). When set to ``replace=config``, the
	+ module uploads the complete candidate configuration supplied via ``src``
	+ to the device and issues VyOS's native ``load`` command in configuration
	+ mode, letting VyOS's own configuration engine perform the replacement,
	+ rather than the module computing a set/delete command diff. This mirrors
	+ the mechanism offered by ``cisco.iosxr.iosxr_config``'s ``replace=config``
	+ (https://vyos.dev/T6837).
	+bugfixes:
	+ - vyos_config - the ``allow_password_change`` filter used a regular
	+ expression that only matched ``set`` lines
	+ (``set system login user ... authentication (encrypted\|plaintext)-password``),
	+ so a ``delete`` line for the same path was never filtered regardless of
	+ the ``allow_password_change`` value. This meant an account omitted from a
	+ full-config candidate could have its password deleted without the
	+ existing safety filter ever inspecting the line. The regular expression
	+ now matches both ``set`` and ``delete`` lines.
	diff --git a/docs/vyos.vyos.vyos_config_module.rst b/docs/vyos.vyos.vyos_config_module.rst
	index bf91bb0f..cb91c185 100644
	--- a/docs/vyos.vyos.vyos_config_module.rst
	+++ b/docs/vyos.vyos.vyos_config_module.rst
	@@ -1,458 +1,511 @@
	.. _vyos.vyos.vyos_config_module:


	*********************
	vyos.vyos.vyos_config
	*********************

	Manage VyOS configuration on remote device


	Version added: 1.0.0

	.. contents::
	:local:
	:depth: 1


	Synopsis
	--------
	- This module provides configuration file management of VyOS devices. It provides arguments for managing both the configuration file and state of the active configuration. All configuration statements are based on `set` and `delete` commands in the device configuration.




	Parameters
	----------

	.. raw:: html

	<table border=0 cellpadding=0 class="documentation-table">
	<tr>
	<th colspan="2">Parameter</th>
	<th>Choices/<font color="blue">Defaults</font></th>
	<th width="100%">Comments</th>
	</tr>
	<tr>
	<td colspan="2">
	<div class="ansibleOptionAnchor" id="parameter-"></div>
	<b>allow_password_change</b>
	<a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
	<div style="font-size: small">
	<span style="color: purple">string</span>
	</div>
	</td>
	<td>
	<ul style="margin: 0; padding: 0"><b>Choices:</b>
	<li>all</li>
	<li><div style="color: blue"><b>plaintext</b> ←</div></li>
	<li>encrypted</li>
	<li>none</li>
	</ul>
	</td>
	<td>
	<div>The <code>allow_password_change</code> argument specifies whether any configuration lines which would change a user's password should be filtered out. By default only plaintext password changes are allowed and any encrypted-password keys are filtered out. In order to allow all password updates, both plaintext and encrypted, set this argument to <code>all</code>.</div>
	+ <div>Not applied when <code>replace</code> is set to <code>config</code>; the candidate is loaded as-is via VyOS's native <code>load</code>, which has no equivalent filtering mechanism.</div>
	</td>
	</tr>
	<tr>
	<td colspan="2">
	<div class="ansibleOptionAnchor" id="parameter-"></div>
	<b>backup</b>
	<a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
	<div style="font-size: small">
	<span style="color: purple">boolean</span>
	</div>
	</td>
	<td>
	<ul style="margin: 0; padding: 0"><b>Choices:</b>
	<li><div style="color: blue"><b>no</b> ←</div></li>
	<li>yes</li>
	</ul>
	</td>
	<td>
	<div>The <code>backup</code> argument will backup the current devices active configuration to the Ansible control host prior to making any changes. If the <code>backup_options</code> value is not given, the backup file will be located in the backup folder in the playbook root directory or role root directory, if playbook is part of an ansible role. If the directory does not exist, it is created.</div>
	</td>
	</tr>
	<tr>
	<td colspan="2">
	<div class="ansibleOptionAnchor" id="parameter-"></div>
	<b>backup_options</b>
	<a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
	<div style="font-size: small">
	<span style="color: purple">dictionary</span>
	</div>
	</td>
	<td>
	</td>
	<td>
	- <div>This is a dict object containing configurable options related to backup file path. The value of this option is read only when <code>backup</code> is set to <code>true</code>, if <code>backup</code> is set to <code>false</code> this option will be silently ignored.</div>
	+ <div>This is a dict object containing configurable options related to backup file path. The value of this option is read only when <code>backup</code> is set to <em>yes</em>, if <code>backup</code> is set to <em>no</em> this option will be silently ignored.</div>
	</td>
	</tr>
	<tr>
	<td class="elbow-placeholder"></td>
	<td colspan="1">
	<div class="ansibleOptionAnchor" id="parameter-"></div>
	<b>dir_path</b>
	<a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
	<div style="font-size: small">
	<span style="color: purple">path</span>
	</div>
	</td>
	<td>
	</td>
	<td>
	<div>This option provides the path ending with directory name in which the backup configuration file will be stored. If the directory does not exist it will be first created and the filename is either the value of <code>filename</code> or default filename as described in <code>filename</code> options description. If the path value is not given in that case a <em>backup</em> directory will be created in the current working directory and backup configuration will be copied in <code>filename</code> within <em>backup</em> directory.</div>
	</td>
	</tr>
	<tr>
	<td class="elbow-placeholder"></td>
	<td colspan="1">
	<div class="ansibleOptionAnchor" id="parameter-"></div>
	<b>filename</b>
	<a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
	<div style="font-size: small">
	<span style="color: purple">string</span>
	</div>
	</td>
	<td>
	</td>
	<td>
	<div>The filename to be used to store the backup configuration. If the filename is not given it will be generated based on the hostname, current time and date in format defined by <hostname>_config.<current-date>@<current-time></div>
	</td>
	</tr>

	<tr>
	<td colspan="2">
	<div class="ansibleOptionAnchor" id="parameter-"></div>
	<b>comment</b>
	<a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
	<div style="font-size: small">
	<span style="color: purple">string</span>
	</div>
	</td>
	<td>
	<b>Default:</b><br/><div style="color: blue">"configured by vyos_config"</div>
	</td>
	<td>
	<div>Allows a commit description to be specified to be included when the configuration is committed. If the configuration is not changed or committed, this argument is ignored.</div>
	</td>
	</tr>
	<tr>
	<td colspan="2">
	<div class="ansibleOptionAnchor" id="parameter-"></div>
	<b>config</b>
	<a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
	<div style="font-size: small">
	<span style="color: purple">string</span>
	</div>
	</td>
	<td>
	</td>
	<td>
	<div>The <code>config</code> argument specifies the base configuration to use to compare against the desired configuration. If this value is not specified, the module will automatically retrieve the current active configuration from the remote device. The configuration lines in the option value should be similar to how it will appear if present in the running-configuration of the device including indentation to ensure idempotency and correct diff.</div>
	+ <div>Ignored when <code>replace</code> is set to <code>config</code>.</div>
	</td>
	</tr>
	<tr>
	<td colspan="2">
	<div class="ansibleOptionAnchor" id="parameter-"></div>
	<b>confirm</b>
	<a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
	<div style="font-size: small">
	<span style="color: purple">string</span>
	</div>
	</td>
	<td>
	<ul style="margin: 0; padding: 0"><b>Choices:</b>
	<li>automatic</li>
	<li>manual</li>
	<li><div style="color: blue"><b>none</b> ←</div></li>
	</ul>
	</td>
	<td>
	<div>The <code>confirm</code> argument will tell vyos to revert to the previous configuration if not explicitly confirmed after applying the new config. When set to <code>automatic</code> this module will automatically confirm the configuration, if the current session remains working with the new config. When set to <code>manual</code>, this module does not issue the confirmation itself.</div>
	</td>
	</tr>
	<tr>
	<td colspan="2">
	<div class="ansibleOptionAnchor" id="parameter-"></div>
	<b>confirm_timeout</b>
	<a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
	<div style="font-size: small">
	<span style="color: purple">integer</span>
	</div>
	</td>
	<td>
	<b>Default:</b><br/><div style="color: blue">10</div>
	</td>
	<td>
	<div>Minutes to wait for confirmation before reverting the configuration. Does not apply when <code>confirm</code> is set to <code>none</code> .</div>
	</td>
	</tr>
	<tr>
	<td colspan="2">
	<div class="ansibleOptionAnchor" id="parameter-"></div>
	<b>lines</b>
	<a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
	<div style="font-size: small">
	<span style="color: purple">list</span>
	/ <span style="color: purple">elements=string</span>
	</div>
	</td>
	<td>
	</td>
	<td>
	<div>The ordered set of commands that should be configured in the section. The commands must be the exact same commands as found in the device running-config as found in the device running-config to ensure idempotency and correct diff. Be sure to note the configuration command syntax as some commands are automatically modified by the device config parser.</div>
	+ <div>Not supported when <code>replace</code> is set to <code>config</code> -- see <code>replace</code> below.</div>
	</td>
	</tr>
	<tr>
	<td colspan="2">
	<div class="ansibleOptionAnchor" id="parameter-"></div>
	<b>match</b>
	<a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
	<div style="font-size: small">
	<span style="color: purple">string</span>
	</div>
	</td>
	<td>
	<ul style="margin: 0; padding: 0"><b>Choices:</b>
	<li><div style="color: blue"><b>line</b> ←</div></li>
	<li>none</li>
	</ul>
	</td>
	<td>
	<div>The <code>match</code> argument controls the method used to match against the current active configuration. By default, the desired config is matched against the active config and the deltas are loaded. If the <code>match</code> argument is set to <code>none</code> the active configuration is ignored and the configuration is always loaded.</div>
	+ <div>Ignored when <code>replace</code> is set to <code>config</code>, since no line-level diff is computed in that mode.</div>
	+ </td>
	+ </tr>
	+ <tr>
	+ <td colspan="2">
	+ <div class="ansibleOptionAnchor" id="parameter-"></div>
	+ <b>replace</b>
	+ <a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
	+ <div style="font-size: small">
	+ <span style="color: purple">string</span>
	+ </div>
	+ </td>
	+ <td>
	+ <ul style="margin: 0; padding: 0"><b>Choices:</b>
	+ <li><div style="color: blue"><b>line</b> ←</div></li>
	+ <li>config</li>
	+ </ul>
	+ </td>
	+ <td>
	+ <div>Controls how the module applies configuration to the device.</div>
	+ <div>When set to <code>line</code> (default), the module computes a set/delete command diff and pushes only the changed lines -- this is the existing behavior, unchanged.</div>
	+ <div>When set to <code>config</code>, the module uploads the full candidate configuration (<code>src</code>) to the device and issues VyOS's native <code>load</code> command in configuration mode, which replaces the running configuration wholesale with the candidate's exact contents. VyOS's own configuration engine performs the reconciliation, rather than the module computing per-line deltas. This mirrors the mechanism offered by <code>cisco.iosxr.iosxr_config</code>'s <code>replace=config</code>.</div>
	+ <div><code>replace=config</code> requires <code>src</code> and does not accept <code>lines</code> -- there is no way to convert flat set/delete commands into the hierarchical form <code>load</code> requires without re-implementing VyOS's own config-tree builder.</div>
	+ <div>As with <code>src</code> in the default <code>line</code> mode, the module does not validate the candidate's contents or format under <code>replace=config</code> -- supplying a well-formed, complete configuration is the caller's responsibility.</div>
	+ <div><code>replace=config</code> requires the device to accept file transfer (SCP) over the same <code>network_cli</code> SSH session used for configuration commands.</div>
	+ <div><code>replace=config</code> writes the candidate to a fixed path on the device (overwritten on each run, matching <code>cisco.iosxr.iosxr_config</code>'s own <code>replace=config</code> precedent). Running <code>replace=config</code> concurrently against the same host is not supported.</div>
	+ <div>Any configuration present on the device but omitted from the candidate will be removed, including management interfaces, SSH access, and login users if they are omitted. Always supply a complete configuration, never a partial one.</div>
	+ <div>When capturing a candidate from the device's own output (for example via <code>show configuration</code>) rather than from a trusted, separately maintained source, be aware that VyOS may return masked placeholder values (for example a run of literal asterisks) in place of local users' <code>encrypted-password</code>/<code>plaintext-password</code> values when queried through automation, even though the identical command returns the real value when typed interactively at a terminal. Pushing a masked capture back through <code>replace=config</code> sends the literal placeholder as the new password value; VyOS's own commit-time validation is expected to reject an obviously malformed hash, but a masked value that happens to pass basic format validation could apply silently. Prefer sourcing <code>replace=config</code> candidates from a trusted, version-controlled artifact rather than a live automated capture whenever the configuration contains local password-based users.</div>
	+ <div>Even under <code>check_mode</code>, the candidate is written to a temporary file on the device so that VyOS's own <code>compare</code> can produce an accurate preview diff. No <code>commit</code> occurs in check mode.</div>
	+ <div>When combined with <code>backup=yes</code>, the value of <code>changed</code> reflects whether the backup file's content changed on the Ansible control node, not whether the device configuration changed -- this is existing behavior in the shared netcommon action plugin backing config-family modules across collections, not specific to <code>replace=config</code>.</div>
	</td>
	</tr>
	<tr>
	<td colspan="2">
	<div class="ansibleOptionAnchor" id="parameter-"></div>
	<b>save</b>
	<a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
	<div style="font-size: small">
	<span style="color: purple">boolean</span>
	</div>
	</td>
	<td>
	<ul style="margin: 0; padding: 0"><b>Choices:</b>
	<li><div style="color: blue"><b>no</b> ←</div></li>
	<li>yes</li>
	</ul>
	</td>
	<td>
	- <div>The <code>save</code> argument controls whether or not changes made to the active configuration are saved to disk. This is independent of committing the config. When set to <code>true</code>, the active configuration is saved.</div>
	+ <div>The <code>save</code> argument controls whether or not changes made to the active configuration are saved to disk. This is independent of committing the config. When set to True, the active configuration is saved.</div>
	</td>
	</tr>
	<tr>
	<td colspan="2">
	<div class="ansibleOptionAnchor" id="parameter-"></div>
	<b>src</b>
	<a class="ansibleOptionLink" href="#parameter-" title="Permalink to this option"></a>
	<div style="font-size: small">
	<span style="color: purple">path</span>
	</div>
	</td>
	<td>
	</td>
	<td>
	<div>The <code>src</code> argument specifies the path to the source config file to load. The source config file can either be in bracket format or set format. The source file can include Jinja2 template variables. The configuration lines in the source file should be similar to how it will appear if present in the running-configuration of the device including indentation to ensure idempotency and correct diff.</div>
	+ <div>When <code>replace</code> is set to <code>config</code>, <code>src</code> is required and must contain a complete configuration in hierarchical/bracket format -- the same format produced by <code>show configuration</code> or found in <code>/config/config.boot</code>. Flat <code>set</code>/<code>delete</code> command format (as produced by <code>show configuration commands</code>) is not accepted in that mode; VyOS's native <code>load</code> command rejects it with a parse error.</div>
	</td>
	</tr>
	</table>
	<br/>


	Notes
	-----

	.. note::
	- Tested against VyOS 1.3.8, 1.4.2, the upcoming 1.5, and the rolling release of spring 2025.
	- This module works with connection ``ansible.netcommon.network_cli``. See `the VyOS OS Platform Options <../network/user_guide/platform_vyos.html>`_.
	- To ensure idempotency and correct diff the configuration lines in the relevant module options should be similar to how they appear if present in the running configuration on device including the indentation.
	+ - ``replace=config`` currently has no way to scope its effect to part of the configuration; it always operates against the entire device configuration. There is no ``path`` parameter to constrain it to a subtree.
	- For more information on using Ansible to manage network devices see the :ref:`Ansible Network Guide <network_guide>`



	Examples
	--------

	.. code-block:: yaml

	- name: configure the remote device
	vyos.vyos.vyos_config:
	lines:
	- set system host-name {{ inventory_hostname }}
	- set service lldp
	- delete service dhcp-server

	- name: backup and load from file
	vyos.vyos.vyos_config:
	src: vyos.cfg
	backup: true

	- name: render a Jinja2 template onto the VyOS router
	vyos.vyos.vyos_config:
	src: vyos_template.j2

	- name: revert after ten minutes, if connection is lost
	vyos.vyos.vyos_config:
	src: vyos_template.j2
	confirm: automatic

	- name: for idempotency, use full-form commands
	vyos.vyos.vyos_config:
	lines:
	# - set int eth eth2 description 'OUTSIDE'
	- set interface ethernet eth2 description 'OUTSIDE'

	- name: configurable backup path
	vyos.vyos.vyos_config:
	backup: true
	backup_options:
	filename: backup.cfg
	dir_path: /home/user

	+ - name: replace the entire running config with a full candidate (native load)
	+ # replace=config requires the complete desired configuration in
	+ # hierarchical/bracket format -- never a partial one, and never flat
	+ # set-command format. A safe pattern is to back up the current config,
	+ # edit it, then replace with the edited whole, as shown here.
	+ vyos.vyos.vyos_config:
	+ backup: true
	+ backup_options:
	+ filename: pre_replace_backup.cfg
	+ register: backup_result
	+
	+ - name: (edit backup_result's backup file as needed, then)
	+ vyos.vyos.vyos_config:
	+ src: /home/user/pre_replace_backup_edited.cfg
	+ replace: config
	+


	Return Values
	-------------
	Common return values are documented `here <https://docs.ansible.com/ansible/latest/reference_appendices/common_return_values.html#common-return-values>`_, the following are the fields unique to this module:

	.. raw:: html

	<table border=0 cellpadding=0 class="documentation-table">
	<tr>
	<th colspan="1">Key</th>
	<th>Returned</th>
	<th width="100%">Description</th>
	</tr>
	<tr>
	<td colspan="1">
	<div class="ansibleOptionAnchor" id="return-"></div>
	<b>backup_path</b>
	<a class="ansibleOptionLink" href="#return-" title="Permalink to this return value"></a>
	<div style="font-size: small">
	<span style="color: purple">string</span>
	</div>
	</td>
	<td>when backup is yes</td>
	<td>
	<div>The full path to the backup file</div>
	<br/>
	<div style="font-size: smaller"><b>Sample:</b></div>
	<div style="font-size: smaller; color: blue; word-wrap: break-word; word-break: break-all;">/playbooks/ansible/backup/vyos_config.2016-07-16@22:28:34</div>
	</td>
	</tr>
	<tr>
	<td colspan="1">
	<div class="ansibleOptionAnchor" id="return-"></div>
	<b>commands</b>
	<a class="ansibleOptionLink" href="#return-" title="Permalink to this return value"></a>
	<div style="font-size: small">
	<span style="color: purple">list</span>
	</div>
	</td>
	<td>always</td>
	<td>
	- <div>The list of configuration commands sent to the device</div>
	+ <div>In <code>replace=line</code> mode (default), the list of set/delete commands sent to the device.</div>
	+ <div>In <code>replace=config</code> mode, contains only the single <code>load <path></code> command actually issued to the device -- not an itemized diff. See <code>diff</code> for the actual change content, sourced from VyOS's own <code>compare</code> output.</div>
	<br/>
	<div style="font-size: smaller"><b>Sample:</b></div>
	<div style="font-size: smaller; color: blue; word-wrap: break-word; word-break: break-all;">['...', '...']</div>
	</td>
	</tr>
	<tr>
	<td colspan="1">
	<div class="ansibleOptionAnchor" id="return-"></div>
	<b>date</b>
	<a class="ansibleOptionLink" href="#return-" title="Permalink to this return value"></a>
	<div style="font-size: small">
	<span style="color: purple">string</span>
	</div>
	</td>
	<td>when backup is yes</td>
	<td>
	<div>The date extracted from the backup file name</div>
	<br/>
	<div style="font-size: smaller"><b>Sample:</b></div>
	<div style="font-size: smaller; color: blue; word-wrap: break-word; word-break: break-all;">2016-07-16</div>
	</td>
	</tr>
	<tr>
	<td colspan="1">
	<div class="ansibleOptionAnchor" id="return-"></div>
	<b>filename</b>
	<a class="ansibleOptionLink" href="#return-" title="Permalink to this return value"></a>
	<div style="font-size: small">
	<span style="color: purple">string</span>
	</div>
	</td>
	<td>when backup is yes and filename is not specified in backup options</td>
	<td>
	<div>The name of the backup file</div>
	<br/>
	<div style="font-size: smaller"><b>Sample:</b></div>
	<div style="font-size: smaller; color: blue; word-wrap: break-word; word-break: break-all;">vyos_config.2016-07-16@22:28:34</div>
	</td>
	</tr>
	<tr>
	<td colspan="1">
	<div class="ansibleOptionAnchor" id="return-"></div>
	<b>filtered</b>
	<a class="ansibleOptionLink" href="#return-" title="Permalink to this return value"></a>
	<div style="font-size: small">
	<span style="color: purple">list</span>
	</div>
	</td>
	<td>always</td>
	<td>
	- <div>The list of configuration commands removed to avoid a load failure</div>
	+ <div>The list of configuration commands removed to avoid a load failure.</div>
	+ <div>Not populated when <code>replace</code> is set to <code>config</code>.</div>
	<br/>
	<div style="font-size: smaller"><b>Sample:</b></div>
	<div style="font-size: smaller; color: blue; word-wrap: break-word; word-break: break-all;">['...', '...']</div>
	</td>
	</tr>
	<tr>
	<td colspan="1">
	<div class="ansibleOptionAnchor" id="return-"></div>
	<b>shortname</b>
	<a class="ansibleOptionLink" href="#return-" title="Permalink to this return value"></a>
	<div style="font-size: small">
	<span style="color: purple">string</span>
	</div>
	</td>
	<td>when backup is yes and filename is not specified in backup options</td>
	<td>
	<div>The full path to the backup file excluding the timestamp</div>
	<br/>
	<div style="font-size: smaller"><b>Sample:</b></div>
	<div style="font-size: smaller; color: blue; word-wrap: break-word; word-break: break-all;">/playbooks/ansible/backup/vyos_config</div>
	</td>
	</tr>
	<tr>
	<td colspan="1">
	<div class="ansibleOptionAnchor" id="return-"></div>
	<b>time</b>
	<a class="ansibleOptionLink" href="#return-" title="Permalink to this return value"></a>
	<div style="font-size: small">
	<span style="color: purple">string</span>
	</div>
	</td>
	<td>when backup is yes</td>
	<td>
	<div>The time extracted from the backup file name</div>
	<br/>
	<div style="font-size: smaller"><b>Sample:</b></div>
	<div style="font-size: smaller; color: blue; word-wrap: break-word; word-break: break-all;">22:28:34</div>
	</td>
	</tr>
	</table>
	<br/><br/>


	Status
	------


	Authors
	~~~~~~~

	- Nathaniel Case (@Qalthos)
	diff --git a/plugins/module_utils/network/vyos/vyos.py b/plugins/module_utils/network/vyos/vyos.py
	index 4987d6b0..b2ef00cf 100644
	--- a/plugins/module_utils/network/vyos/vyos.py
	+++ b/plugins/module_utils/network/vyos/vyos.py
	@@ -1,116 +1,137 @@
	# This code is part of Ansible, but is an independent component.
	# This particular file snippet, and this file snippet only, is BSD licensed.
	# Modules you write using this snippet, which is embedded dynamically by Ansible
	# still belong to the author of the module, and may assign their own license
	# to the complete work.
	#
	# (c) 2016 Red Hat Inc.
	#
	# Redistribution and use in source and binary forms, with or without modification,
	# are permitted provided that the following conditions are met:
	#
	# * Redistributions of source code must retain the above copyright
	# notice, this list of conditions and the following disclaimer.
	# * Redistributions in binary form must reproduce the above copyright notice,
	# this list of conditions and the following disclaimer in the documentation
	# and/or other materials provided with the distribution.
	#
	# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
	# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
	# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	# IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
	# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
	# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
	# USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	#
	from __future__ import absolute_import, division, print_function


	__metaclass__ = type
	import json

	from ansible.module_utils._text import to_text
	from ansible.module_utils.connection import Connection, ConnectionError


	_DEVICE_CONFIGS = {}


	def get_connection(module):
	if hasattr(module, "_vyos_connection"):
	return module._vyos_connection

	capabilities = get_capabilities(module)
	network_api = capabilities.get("network_api")
	if network_api == "cliconf":
	module._vyos_connection = Connection(module._socket_path)
	else:
	module.fail_json(msg="Invalid connection type %s" % network_api)

	return module._vyos_connection


	def get_capabilities(module):
	if hasattr(module, "_vyos_capabilities"):
	return module._vyos_capabilities

	try:
	capabilities = Connection(module._socket_path).get_capabilities()
	except ConnectionError as exc:
	module.fail_json(msg=to_text(exc, errors="surrogate_then_replace"))

	module._vyos_capabilities = json.loads(capabilities)
	return module._vyos_capabilities


	def get_config(module, flags=None, format=None):
	flags = [] if flags is None else flags
	global _DEVICE_CONFIGS

	# If _DEVICE_CONFIGS is non-empty and module.params["match"] is "none",
	# return the cached device configurations. This avoids redundant calls
	# to the connection when no specific match criteria are provided.
	if _DEVICE_CONFIGS != {} and (
	module.params["match"] is not None and module.params["match"] == "none"
	):
	return to_text(_DEVICE_CONFIGS)
	else:
	connection = get_connection(module)
	try:
	out = connection.get_config(flags=flags, format=format)
	except ConnectionError as exc:
	module.fail_json(msg=to_text(exc, errors="surrogate_then_replace"))
	cfg = to_text(out, errors="surrogate_then_replace").strip()
	_DEVICE_CONFIGS = cfg
	return cfg


	+def copy_file(module, source, destination, proto="scp"):
	+ """Copy a local file to the remote device over the existing network_cli
	+ SSH session, using netcommon's generic connection-level file transfer
	+ RPC (the same mechanism ansible.netcommon.net_put uses).
	+
	+ Requires the device to have SCP/SFTP reachable over the same SSH
	+ session used for network_cli. Mirrors the calling convention of
	+ cisco.iosxr's module_utils copy_file(module, source, destination, proto),
	+ confirmed against cisco.iosxr's iosxr_config.py call site:
	+ copy_file(module, src, dst, "sftp").
	+ """
	+ connection = get_connection(module)
	+ try:
	+ connection.copy_file(source, destination, proto)
	+ except ConnectionError as exc:
	+ module.fail_json(msg=to_text(exc, errors="surrogate_then_replace"))
	+
	+
	def run_commands(module, commands, check_rc=True):
	connection = get_connection(module)
	try:
	response = connection.run_commands(commands=commands, check_rc=check_rc)
	except ConnectionError as exc:
	module.fail_json(msg=to_text(exc, errors="surrogate_then_replace"))
	return response


	def load_config(module, commands, commit=False, comment=None, confirm=None):
	connection = get_connection(module)

	try:
	response = connection.edit_config(
	- candidate=commands, commit=commit, comment=comment, confirm=confirm
	+ candidate=commands,
	+ commit=commit,
	+ comment=comment,
	+ confirm=confirm,
	)
	except ConnectionError as exc:
	module.fail_json(msg=to_text(exc, errors="surrogate_then_replace"))

	return response.get("diff")


	def get_os_version(module):
	connection = get_connection(module)
	if connection.get_device_info():
	os_version = connection.get_device_info()["network_os_major_version"]
	return os_version
	diff --git a/plugins/modules/vyos_config.py b/plugins/modules/vyos_config.py
	index 666bb629..ad388003 100644
	--- a/plugins/modules/vyos_config.py
	+++ b/plugins/modules/vyos_config.py
	@@ -1,451 +1,625 @@
	#!/usr/bin/python
	#
	# This file is part of Ansible
	#
	# Ansible is free software: you can redistribute it and/or modify
	# it under the terms of the GNU General Public License as published by
	# the Free Software Foundation, either version 3 of the License, or
	# (at your option) any later version.
	#
	# Ansible is distributed in the hope that it will be useful,
	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	# GNU General Public License for more details.
	#
	# You should have received a copy of the GNU General Public License
	# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
	#
	from __future__ import absolute_import, division, print_function


	__metaclass__ = type


	DOCUMENTATION = """
	module: vyos_config
	author: Nathaniel Case (@Qalthos)
	short_description: Manage VyOS configuration on remote device
	description:
	- This module provides configuration file management of VyOS devices. It provides
	arguments for managing both the configuration file and state of the active configuration.
	All configuration statements are based on `set` and `delete` commands in the device
	configuration.
	version_added: 1.0.0
	extends_documentation_fragment:
	- vyos.vyos.vyos
	notes:
	- Tested against VyOS 1.3.8, 1.4.2, the upcoming 1.5, and the rolling release of spring 2025.
	- This module works with connection C(ansible.netcommon.network_cli). See L(the VyOS OS Platform Options,../network/user_guide/platform_vyos.html).
	- To ensure idempotency and correct diff the configuration lines in the relevant module options should be similar to how they
	appear if present in the running configuration on device including the indentation.
	+- C(replace=config) currently has no way to scope its effect to part of the
	+ configuration; it always operates against the entire device configuration.
	+ There is no C(path) parameter to constrain it to a subtree.
	options:
	lines:
	description:
	- The ordered set of commands that should be configured in the section. The commands
	must be the exact same commands as found in the device running-config as found in the
	device running-config to ensure idempotency and correct diff. Be sure
	to note the configuration command syntax as some commands are automatically
	modified by the device config parser.
	+ - Not supported when C(replace) is set to C(config) -- see C(replace) below.
	type: list
	elements: str
	src:
	description:
	- The C(src) argument specifies the path to the source config file to load. The
	source config file can either be in bracket format or set format. The source
	file can include Jinja2 template variables. The configuration lines in the source
	file should be similar to how it will appear if present in the running-configuration
	of the device including indentation to ensure idempotency and correct diff.
	+ - When C(replace) is set to C(config), C(src) is required and must contain a
	+ complete configuration in hierarchical/bracket format -- the same format
	+ produced by C(show configuration) or found in C(/config/config.boot). Flat
	+ C(set)/C(delete) command format (as produced by C(show configuration
	+ commands)) is not accepted in that mode; VyOS's native C(load) command
	+ rejects it with a parse error.
	type: path
	match:
	description:
	- The C(match) argument controls the method used to match against the current
	active configuration. By default, the desired config is matched against the
	active config and the deltas are loaded. If the C(match) argument is set to
	C(none) the active configuration is ignored and the configuration is always
	loaded.
	+ - Ignored when C(replace) is set to C(config), since no line-level diff is
	+ computed in that mode.
	type: str
	default: line
	choices:
	- line
	- none
	backup:
	description:
	- The C(backup) argument will backup the current devices active configuration
	to the Ansible control host prior to making any changes. If the C(backup_options)
	value is not given, the backup file will be located in the backup folder in
	the playbook root directory or role root directory, if playbook is part of an
	ansible role. If the directory does not exist, it is created.
	type: bool
	- default: false
	+ default: no
	comment:
	description:
	- Allows a commit description to be specified to be included when the configuration
	is committed. If the configuration is not changed or committed, this argument
	is ignored.
	default: configured by vyos_config
	type: str
	confirm:
	description:
	- The C(confirm) argument will tell vyos to revert to the previous configuration
	if not explicitly confirmed after applying the new config. When set to C(automatic)
	this module will automatically confirm the configuration, if the current session
	remains working with the new config. When set to C(manual), this module does
	not issue the confirmation itself.
	type: str
	default: none
	choices:
	- automatic
	- manual
	- none
	confirm_timeout:
	description:
	- Minutes to wait for confirmation before reverting the configuration. Does
	not apply when C(confirm) is set to C(none) .
	type: int
	default: 10
	config:
	description:
	- The C(config) argument specifies the base configuration to use to compare against
	the desired configuration. If this value is not specified, the module will
	automatically retrieve the current active configuration from the remote device.
	The configuration lines in the option value should be similar to how it
	will appear if present in the running-configuration of the device including indentation
	to ensure idempotency and correct diff.
	+ - Ignored when C(replace) is set to C(config).
	type: str
	save:
	description:
	- The C(save) argument controls whether or not changes made to the active configuration
	are saved to disk. This is independent of committing the config. When set
	- to C(true), the active configuration is saved.
	+ to True, the active configuration is saved.
	type: bool
	- default: false
	+ default: no
	backup_options:
	description:
	- This is a dict object containing configurable options related to backup file
	- path. The value of this option is read only when C(backup) is set to C(true),
	- if C(backup) is set to C(false) this option will be silently ignored.
	+ path. The value of this option is read only when C(backup) is set to I(yes),
	+ if C(backup) is set to I(no) this option will be silently ignored.
	suboptions:
	filename:
	description:
	- The filename to be used to store the backup configuration. If the filename
	is not given it will be generated based on the hostname, current time and
	date in format defined by <hostname>_config.<current-date>@<current-time>
	type: str
	dir_path:
	description:
	- This option provides the path ending with directory name in which the backup
	configuration file will be stored. If the directory does not exist it will
	be first created and the filename is either the value of C(filename) or
	default filename as described in C(filename) options description. If the
	path value is not given in that case a I(backup) directory will be created
	in the current working directory and backup configuration will be copied
	in C(filename) within I(backup) directory.
	type: path
	type: dict
	+ replace:
	+ description:
	+ - Controls how the module applies configuration to the device.
	+ - When set to C(line) (default), the module computes a set/delete command
	+ diff and pushes only the changed lines -- this is the existing behavior,
	+ unchanged.
	+ - When set to C(config), the module uploads the full candidate configuration
	+ (C(src)) to the device and issues VyOS's native C(load) command in
	+ configuration mode, which replaces the running configuration wholesale
	+ with the candidate's exact contents. VyOS's own configuration engine
	+ performs the reconciliation, rather than the module computing per-line
	+ deltas. This mirrors the mechanism offered by C(cisco.iosxr.iosxr_config)'s
	+ C(replace=config).
	+ - C(replace=config) requires C(src) and does not accept C(lines) -- there is
	+ no way to convert flat set/delete commands into the hierarchical form
	+ C(load) requires without re-implementing VyOS's own config-tree builder.
	+ - As with C(src) in the default C(line) mode, the module does not validate
	+ the candidate's contents or format under C(replace=config) -- supplying a
	+ well-formed, complete configuration is the caller's responsibility.
	+ - C(replace=config) requires the device to accept file transfer (SCP) over
	+ the same C(network_cli) SSH session used for configuration commands.
	+ - C(replace=config) writes the candidate to a fixed path on the device
	+ (overwritten on each run, matching C(cisco.iosxr.iosxr_config)'s own
	+ C(replace=config) precedent). Running C(replace=config) concurrently
	+ against the same host is not supported.
	+ - Any configuration present on the device but omitted from the candidate
	+ will be removed, including management interfaces, SSH access, and login
	+ users if they are omitted. Always supply a complete configuration, never
	+ a partial one.
	+ - When capturing a candidate from the device's own output (for example
	+ via C(show configuration)) rather than from a trusted, separately
	+ maintained source, be aware that VyOS may return masked placeholder
	+ values (for example a run of literal asterisks) in place of local
	+ users' C(encrypted-password)/C(plaintext-password) values when queried
	+ through automation, even though the identical command returns the real
	+ value when typed interactively at a terminal. Pushing a masked capture
	+ back through C(replace=config) sends the literal placeholder as the new
	+ password value; VyOS's own commit-time validation is expected to reject
	+ an obviously malformed hash, but a masked value that happens to pass
	+ basic format validation could apply silently. Prefer sourcing
	+ C(replace=config) candidates from a trusted, version-controlled
	+ artifact rather than a live automated capture whenever the
	+ configuration contains local password-based users.
	+ - Even under C(check_mode), the candidate is written to a temporary file on
	+ the device so that VyOS's own C(compare) can produce an accurate preview
	+ diff. No C(commit) occurs in check mode.
	+ - When combined with C(backup=yes), the value of C(changed) reflects
	+ whether the backup file's content changed on the Ansible control node,
	+ not whether the device configuration changed -- this is existing
	+ behavior in the shared netcommon action plugin backing config-family
	+ modules across collections, not specific to C(replace=config).
	+ type: str
	+ default: line
	+ choices:
	+ - line
	+ - config
	allow_password_change:
	description:
	- The C(allow_password_change) argument specifies whether any configuration lines which
	would change a user's password should be filtered out. By default only plaintext
	password changes are allowed and any encrypted-password keys are filtered out. In
	order to allow all password updates, both plaintext and encrypted, set this argument
	to C(all).
	+ - Not applied when C(replace) is set to C(config); the candidate is loaded
	+ as-is via VyOS's native C(load), which has no equivalent filtering
	+ mechanism.
	type: str
	default: plaintext
	choices:
	- all
	- plaintext
	- encrypted
	- none
	"""

	EXAMPLES = """
	- name: configure the remote device
	vyos.vyos.vyos_config:
	lines:
	- set system host-name {{ inventory_hostname }}
	- set service lldp
	- delete service dhcp-server

	- name: backup and load from file
	vyos.vyos.vyos_config:
	src: vyos.cfg
	backup: true

	- name: render a Jinja2 template onto the VyOS router
	vyos.vyos.vyos_config:
	src: vyos_template.j2

	- name: revert after ten minutes, if connection is lost
	vyos.vyos.vyos_config:
	src: vyos_template.j2
	confirm: automatic

	- name: for idempotency, use full-form commands
	vyos.vyos.vyos_config:
	lines:
	# - set int eth eth2 description 'OUTSIDE'
	- set interface ethernet eth2 description 'OUTSIDE'

	- name: configurable backup path
	vyos.vyos.vyos_config:
	backup: true
	backup_options:
	filename: backup.cfg
	dir_path: /home/user
	+
	+- name: replace the entire running config with a full candidate (native load)
	+ # replace=config requires the complete desired configuration in
	+ # hierarchical/bracket format -- never a partial one, and never flat
	+ # set-command format. A safe pattern is to back up the current config,
	+ # edit it, then replace with the edited whole, as shown here.
	+ vyos.vyos.vyos_config:
	+ backup: true
	+ backup_options:
	+ filename: pre_replace_backup.cfg
	+ register: backup_result
	+
	+- name: (edit backup_result's backup file as needed, then)
	+ vyos.vyos.vyos_config:
	+ src: /home/user/pre_replace_backup_edited.cfg
	+ replace: config
	"""

	RETURN = """
	commands:
	- description: The list of configuration commands sent to the device
	+ description:
	+ - In C(replace=line) mode (default), the list of set/delete commands sent to
	+ the device.
	+ - In C(replace=config) mode, contains only the single C(load <path>) command
	+ actually issued to the device -- not an itemized diff. See C(diff) for the
	+ actual change content, sourced from VyOS's own C(compare) output.
	returned: always
	type: list
	sample: ['...', '...']
	filtered:
	- description: The list of configuration commands removed to avoid a load failure
	+ description:
	+ - The list of configuration commands removed to avoid a load failure.
	+ - Not populated when C(replace) is set to C(config).
	returned: always
	type: list
	sample: ['...', '...']
	backup_path:
	description: The full path to the backup file
	returned: when backup is yes
	type: str
	sample: /playbooks/ansible/backup/vyos_config.2016-07-16@22:28:34
	filename:
	description: The name of the backup file
	returned: when backup is yes and filename is not specified in backup options
	type: str
	sample: vyos_config.2016-07-16@22:28:34
	shortname:
	description: The full path to the backup file excluding the timestamp
	returned: when backup is yes and filename is not specified in backup options
	type: str
	sample: /playbooks/ansible/backup/vyos_config
	date:
	description: The date extracted from the backup file name
	returned: when backup is yes
	type: str
	sample: "2016-07-16"
	time:
	description: The time extracted from the backup file name
	returned: when backup is yes
	type: str
	sample: "22:28:34"
	"""
	+import os
	import re
	+import tempfile

	-from ansible.module_utils._text import to_text
	+from ansible.module_utils._text import to_bytes, to_text
	from ansible.module_utils.basic import AnsibleModule
	from ansible.module_utils.connection import ConnectionError

	from ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.vyos import (
	+ copy_file,
	get_config,
	get_connection,
	load_config,
	run_commands,
	)


	DEFAULT_COMMENT = "configured by vyos_config"

	PASSWORD_NEEDLE = re.compile(
	- r"set system login user \S+ authentication (encrypted\|plaintext)-password",
	+ r"(?:set\|delete) system login user \S+ authentication (encrypted\|plaintext)-password",
	)


	def get_candidate(module):
	contents = module.params["src"] or module.params["lines"]

	if module.params["src"]:
	contents = contents.splitlines()
	if len(contents) > 0:
	line = contents[0].split()
	if len(line) > 0 and line[0] in ("set", "delete"):
	contents = format_commands(contents)

	contents = "\n".join(contents)
	return contents


	def format_commands(commands):
	"""
	This function format the input commands and removes the prepend white spaces
	for command lines having 'set' or 'delete' and it skips empty lines.
	:param commands:
	:return: list of commands
	"""
	return [
	line.strip() if line.split()[0] in ("set", "delete") else line
	for line in commands
	if len(line.strip()) > 0
	]


	def diff_config(commands, config):
	config = [str(c).replace("'", "") for c in config.splitlines()]

	updates = list()
	visited = set()

	for line in commands:
	item = str(line).replace("'", "")

	if not item.startswith("set") and not item.startswith("delete"):
	raise ValueError("line must start with either `set` or `delete`")

	elif item.startswith("set") and item not in config:
	updates.append(line)

	elif item.startswith("delete"):
	if not config:
	updates.append(line)
	else:
	item = re.sub(r"delete", "set", item)
	for entry in config:
	if entry.startswith(item) and line not in visited:
	updates.append(line)
	visited.add(line)

	return list(updates)


	def sanitize_config(config, result, allow):
	result["filtered"] = list()

	if allow == "all":
	return

	index_to_filter = list()

	for index, line in enumerate(list(config)):
	found = PASSWORD_NEEDLE.search(line)

	if found is None:
	continue

	if allow == found[1]:
	continue

	result["filtered"].append(line)
	index_to_filter.append(index)

	# Delete all filtered configs
	for filter_index in sorted(index_to_filter, reverse=True):
	del config[filter_index]


	def run(module, result):
	# get the current active config from the node or passed in via
	# the config param

	config = module.params["config"] or get_config(module)

	# create the candidate config object from the arguments
	candidate = get_candidate(module)

	# create loadable config that includes only the configuration updates
	connection = get_connection(module)
	try:
	response = connection.get_diff(
	candidate=candidate,
	running=config,
	diff_match=module.params["match"],
	)
	except ConnectionError as exc:
	module.fail_json(msg=to_text(exc, errors="surrogate_then_replace"))

	commands = response.get("config_diff")

	allow_password_change = module.params["allow_password_change"]
	sanitize_config(commands, result, allow=allow_password_change)

	result["commands"] = commands

	commit = not module.check_mode
	comment = module.params["comment"]
	confirm = None
	if module.params["confirm"] == "automatic" or module.params["confirm"] == "manual":
	confirm = module.params["confirm_timeout"]

	diff = None
	if commands:
	diff = load_config(module, commands, commit=commit, comment=comment, confirm=confirm)
	if module.params["confirm"] == "automatic":
	run_commands(module, ["configure", "confirm", "exit"])

	if result.get("filtered"):
	result["warnings"].append(
	"Some configuration commands were removed, please see the filtered key",
	)

	result["changed"] = True

	if module._diff:
	result["diff"] = {"prepared": diff}


	+def run_replace_config(module, result):
	+ # replace=config: push the full candidate to the device and let VyOS's
	+ # own `load` command perform the replacement natively, rather than
	+ # computing a set/delete diff in Python.
	+ #
	+ # Deliberately smaller than cisco.iosxr's equivalent implementation:
	+ # - No bidirectional pre-diff to decide whether anything changed --
	+ # confirmed on real VyOS 1.5 hardware that `load` of an
	+ # already-applied file, followed by `compare`, natively reports
	+ # "No changes between working and active configurations" with no
	+ # Python-side pre-check needed.
	+ # - No special `replace=<path>` argument threaded through load_config()/
	+ # edit_config() -- confirmed that `load <path>` behaves as an ordinary
	+ # configuration command through the existing configure/compare/commit
	+ # flow already implemented in Cliconf.edit_config(), unmodified.
	+ #
	+ # Candidate format requirement (hierarchical/bracket, not flat
	+ # set/delete) is enforced by VyOS's own `load` parser, not by this
	+ # module -- confirmed empirically: flat set-command input produces
	+ # "ValueError: Failed to parse config: Syntax error...".
	+ # module.params["src"] is already the rendered file content by this
	+ # point, not a path -- netcommon's generic action plugin for src-based
	+ # network config modules reads the local file and substitutes its
	+ # (Jinja2-rendered) content into this param before the module runs. Same
	+ # assumption get_candidate() already relies on elsewhere in this file.
	+ candidate = to_bytes(module.params["src"], errors="surrogate_or_strict")
	+
	+ tmp = tempfile.NamedTemporaryFile(delete=False)
	+ local_path = tmp.name
	+ try:
	+ tmp.write(candidate)
	+ tmp.close()
	+
	+ # Fixed remote filename, always overwritten -- same precedent as
	+ # cisco.iosxr.iosxr_config's copy_file_to_node(), which always
	+ # writes to the same "/harddisk:/ansible_config.txt". Avoids
	+ # per-run temp-file accumulation on the device, at the accepted
	+ # cost (shared with iosxr_config) that two concurrent replace=config
	+ # runs against the same host could race on this path.
	+ remote_path = "/tmp/ansible_vyos_replace.cfg"
	+ copy_file(module, local_path, remote_path, "scp")
	+ finally:
	+ os.unlink(local_path)
	+
	+ commit = not module.check_mode
	+ comment = module.params["comment"]
	+ confirm = None
	+ if module.params["confirm"] == "automatic" or module.params["confirm"] == "manual":
	+ confirm = module.params["confirm_timeout"]
	+
	+ diff = load_config(
	+ module,
	+ ["load %s" % remote_path],
	+ commit=commit,
	+ comment=comment,
	+ confirm=confirm,
	+ )
	+ if module.params["confirm"] == "automatic" and diff and not module.check_mode:
	+ run_commands(module, ["configure", "confirm", "exit"])
	+
	+ result["commands"] = ["load %s" % remote_path]
	+ result["changed"] = bool(diff)
	+
	+ if module._diff:
	+ result["diff"] = {"prepared": diff}
	+
	+
	def main():
	backup_spec = dict(filename=dict(), dir_path=dict(type="path"))
	argument_spec = dict(
	src=dict(type="path"),
	lines=dict(type="list", elements="str"),
	match=dict(default="line", choices=["line", "none"]),
	comment=dict(default=DEFAULT_COMMENT),
	confirm=dict(choices=["automatic", "manual", "none"], default="none"),
	confirm_timeout=dict(type="int", default=10),
	config=dict(),
	backup=dict(type="bool", default=False),
	backup_options=dict(type="dict", options=backup_spec),
	save=dict(type="bool", default=False),
	+ replace=dict(type="str", default="line", choices=["line", "config"]),
	allow_password_change=dict(
	default="plaintext",
	choices=["all", "encrypted", "plaintext", "none"],
	),
	)

	mutually_exclusive = [("lines", "src")]
	+ required_if = [("replace", "config", ["src"])]

	module = AnsibleModule(
	argument_spec=argument_spec,
	mutually_exclusive=mutually_exclusive,
	+ required_if=required_if,
	supports_check_mode=True,
	)

	warnings = list()

	result = dict(changed=False, warnings=warnings)

	if module.params["backup"]:
	result["__backup__"] = get_config(module=module)

	- if any((module.params["src"], module.params["lines"])):
	+ if module.params["replace"] == "config":
	+ run_replace_config(module, result)
	+ elif any((module.params["src"], module.params["lines"])):
	run(module, result)

	if module.params["save"]:
	diff = run_commands(module, commands=["configure", "compare saved"])[1]
	if diff not in {
	"[edit]",
	"No changes between working and saved configurations.\n\n[edit]",
	}:
	if not module.check_mode:
	run_commands(module, commands=["save"])
	result["changed"] = True
	run_commands(module, commands=["exit"])

	- if result.get("changed") and any((module.params["src"], module.params["lines"])):
	+ if (
	+ result.get("changed")
	+ and module.params["replace"] != "config"
	+ and any((module.params["src"], module.params["lines"]))
	+ ):
	msg = (
	"To ensure idempotency and correct diff the input configuration lines should be"
	" similar to how they appear if present in"
	" the running configuration on device"
	)
	if module.params["src"]:
	msg += " including the indentation"
	if "warnings" in result:
	result["warnings"].append(msg)
	else:
	result["warnings"] = msg

	module.exit_json(**result)


	if __name__ == "__main__":
	main()
	diff --git a/tests/integration/targets/vyos_config/templates/replace_config_candidate.cfg b/tests/integration/targets/vyos_config/templates/replace_config_candidate.cfg
	new file mode 100644
	index 00000000..4a29cdea
	--- /dev/null
	+++ b/tests/integration/targets/vyos_config/templates/replace_config_candidate.cfg
	@@ -0,0 +1 @@
	+{{ replace_config_candidate_content }}
	diff --git a/tests/integration/targets/vyos_config/tests/cli/replace_config.yaml b/tests/integration/targets/vyos_config/tests/cli/replace_config.yaml
	new file mode 100644
	index 00000000..26fb3f5e
	--- /dev/null
	+++ b/tests/integration/targets/vyos_config/tests/cli/replace_config.yaml
	@@ -0,0 +1,231 @@
	+---
	+- debug: msg="START cli/replace_config.yaml on connection={{ ansible_connection }}"
	+
	+# SAFETY NOTE: replace=config requires a COMPLETE configuration in
	+# hierarchical/bracket format (the same format `show configuration` /
	+# /config/config.boot use) -- never flat set/delete commands (VyOS's `load`
	+# rejects those with a parse error) and never a partial candidate (anything
	+# omitted is deleted, including management interfaces, SSH, and login
	+# users). Every step below operates on a full baseline captured live from
	+# the device itself, edited in place -- never a minimal hand-written or
	+# statically-shipped candidate. This also sidesteps a real safety concern:
	+# a checked-in static fixture would either need fake device-specific data
	+# (interface hw-ids, password hashes) that's wrong for every real target,
	+# or genuine credentials baked into git -- capturing live avoids both.
	+#
	+# NOTE on `src` / templates/replace_config_candidate.cfg: this file's
	+# entire content is the single Jinja2 expression
	+# "{{ replace_config_candidate_content }}". netcommon's action plugin
	+# (_handle_src_option) reads whatever `src` points to and renders it as a
	+# Jinja2 template using the play's own templar before the module runs --
	+# this lets us point `src` at one static, checked-in, device-agnostic file
	+# for every task below, and change only the in-memory fact
	+# (replace_config_candidate_content) each time, with zero local file
	+# writes and therefore no delegate_to/connection wrangling at all.
	+# This mechanism is deprecated upstream (removal after 2028-01-01) in favor
	+# of a `content:` module parameter -- cisco.iosxr.iosxr_config already has
	+# one; vyos_config does not yet. Adding `content:` to vyos_config, mirroring
	+# iosxr_config, would let this test drop the deprecated path entirely, but
	+# that's real module-feature scope beyond this PR, not test plumbing.
	+#
	+# NOTE on `backup`: intentionally not combined with the idempotency
	+# assertions in this file. `backup=yes`'s `changed` reflects whether the
	+# backup file on the control node changed, not whether the device changed
	+# (see DOCUMENTATION) -- this is pre-existing, shared netcommon action
	+# plugin behavior, not specific to replace=config, and asserting on it here
	+# would conflate two unrelated things.
	+
	+- name: setup baseline marker value
	+ vyos.vyos.vyos_config:
	+ lines:
	+ - set system option reboot-on-upgrade-failure '7'
	+ match: none
	+ # save=true is required here: commit alone updates the running config
	+ # but not /config/config.boot, which our baseline capture below reads
	+ # directly. Without an explicit save, config.boot can reflect a stale
	+ # value from any earlier save in the device's history rather than what
	+ # was just committed -- confirmed as the root cause of a real failure
	+ # during development (a stale, unrelated value silently made it into
	+ # the candidate instead of this task's freshly-committed one).
	+ save: true
	+
	+- name: capture full hierarchical baseline config from the device
	+ # cat /config/config.boot directly, rather than `show configuration` --
	+ # confirmed during development that `show configuration` returns masked
	+ # placeholder values for local users' password hashes when queried via
	+ # automation (vyos_command/network_cli), even though the same rendering
	+ # shows real values when typed interactively. /config/config.boot is the
	+ # same underlying file `show configuration` renders (confirmed identical
	+ # structure during development), read directly rather than through
	+ # VyOS's `show` masking layer.
	+ vyos.vyos.vyos_command:
	+ commands: "cat /config/config.boot"
	+ register: baseline_show
	+
	+# VyOS appears to mask local users' encrypted-password/plaintext-password
	+# values (a run of literal asterisks) specifically when show configuration
	+# is queried through automation (vyos_command/network_cli), even though the
	+# identical command returns the real hash when typed interactively at a
	+# terminal -- observed directly during development of this test. Pushing a
	+# masked capture back through replace=config sends the literal placeholder
	+# as the new password value and fails at commit (see DOCUMENTATION for the
	+# broader implication of this for replace=config generally). Fail fast here
	+# with a clear, actionable message rather than letting that surface as a
	+# confusing device-side "Invalid encrypted password" commit failure deep
	+# inside the actual test.
	+- name: safety check -- fail fast if the device masked secrets in this capture
	+ ansible.builtin.assert:
	+ that:
	+ - "'****************' not in baseline_show.stdout[0]"
	+ fail_msg: >-
	+ show configuration returned masked secret placeholders in this
	+ capture. This is a known VyOS behavior when querying via automation
	+ (see DOCUMENTATION note on replace=config); this test cannot safely
	+ continue with a masked candidate. Re-run against a lab image/session
	+ where show configuration returns real values, or adjust the baseline
	+ capture method.
	+
	+- name: build edited candidate content (v1 -- change the marker value only)
	+ ansible.builtin.set_fact:
	+ edited_candidate_v1: >-
	+ {{ baseline_show.stdout[0]
	+ \| replace('reboot-on-upgrade-failure "7"', 'reboot-on-upgrade-failure "12"') }}
	+
	+# Fail fast here if the substitution above silently didn't match --
	+# config.boot quotes leaf values (reboot-on-upgrade-failure "7"), and a
	+# search string that misses that quoting produces a silent no-op edit
	+# rather than an error, which is a real bug caught during development:
	+# the candidate ends up byte-identical to the (possibly stale) capture,
	+# and any resulting diff reflects leftover device state rather than this
	+# test's intended edit.
	+- name: sanity check the marker edit actually took effect
	+ ansible.builtin.assert:
	+ that:
	+ - ('reboot-on-upgrade-failure "12"' in edited_candidate_v1)
	+ - ('reboot-on-upgrade-failure "7"' not in edited_candidate_v1)
	+ fail_msg: >-
	+ The marker substitution did not match anything in the captured
	+ baseline -- edited_candidate_v1 is identical to the raw capture.
	+ Check that the baseline actually contains
	+ reboot-on-upgrade-failure "7" (quoted) and that the setup task's
	+ save=true actually persisted before this capture ran.
	+
	+- name: sanity check candidate still contains SSH/management essentials
	+ ansible.builtin.assert:
	+ that:
	+ - "'service' in edited_candidate_v1"
	+ - "'ssh' in edited_candidate_v1"
	+ - "'login' in edited_candidate_v1"
	+
	+- name: replace with edited full config (native load)
	+ register: result
	+ diff: true
	+ vyos.vyos.vyos_config:
	+ src: "{{ role_path }}/templates/replace_config_candidate.cfg"
	+ replace: config
	+ vars:
	+ replace_config_candidate_content: "{{ edited_candidate_v1 }}"
	+
	+- assert:
	+ that:
	+ - result.changed == true
	+ - result.commands == ["load /tmp/ansible_vyos_replace.cfg"]
	+ # replace=config surfaces VyOS's own compare() output verbatim in
	+ # diff, not an itemized set/delete list -- commands is deliberately
	+ # not the change content in this mode (see RETURN docs). Checking
	+ # the specific new value (not just the field name) is deliberate --
	+ # a weaker check here previously let a wrong-value regression through
	+ # undetected for several tasks.
	+ - ('reboot-on-upgrade-failure "12"' in (result.diff.prepared \| default('')))
	+
	+- name: verify connectivity survived
	+ vyos.vyos.vyos_facts:
	+ gather_subset: min
	+ register: facts_check
	+
	+- assert:
	+ that:
	+ - facts_check is succeeded
	+
	+- name: re-run the identical replace (idempotency check, no backup involved)
	+ register: result_repeat
	+ vyos.vyos.vyos_config:
	+ src: "{{ role_path }}/templates/replace_config_candidate.cfg"
	+ replace: config
	+ vars:
	+ replace_config_candidate_content: "{{ edited_candidate_v1 }}"
	+
	+- assert:
	+ that:
	+ - result_repeat.changed == false
	+
	+- name: confirm replace=config rejects a candidate without src
	+ register: no_src_result
	+ ignore_errors: true
	+ vyos.vyos.vyos_config:
	+ replace: config
	+
	+- assert:
	+ that:
	+ - no_src_result is failed
	+ - "'src' in no_src_result.msg"
	+
	+- name: confirm replace=config rejects lines+src together
	+ register: lines_and_src_result
	+ ignore_errors: true
	+ vyos.vyos.vyos_config:
	+ replace: config
	+ src: "{{ role_path }}/templates/replace_config_candidate.cfg"
	+ lines:
	+ - "set system host-name foo"
	+ vars:
	+ replace_config_candidate_content: "{{ edited_candidate_v1 }}"
	+
	+- assert:
	+ that:
	+ - lines_and_src_result is failed
	+
	+- name: build edited candidate content (v2 -- further marker change, for check_mode)
	+ ansible.builtin.set_fact:
	+ edited_candidate_v2: >-
	+ {{ edited_candidate_v1
	+ \| replace('reboot-on-upgrade-failure "12"', 'reboot-on-upgrade-failure "20"') }}
	+
	+- name: sanity check the v2 marker edit actually took effect
	+ ansible.builtin.assert:
	+ that:
	+ - ('reboot-on-upgrade-failure "20"' in edited_candidate_v2)
	+ - ('reboot-on-upgrade-failure "12"' not in edited_candidate_v2)
	+
	+- name: check_mode preview does not commit
	+ check_mode: true
	+ diff: true
	+ register: check_result
	+ vyos.vyos.vyos_config:
	+ src: "{{ role_path }}/templates/replace_config_candidate.cfg"
	+ replace: config
	+ vars:
	+ replace_config_candidate_content: "{{ edited_candidate_v2 }}"
	+
	+- assert:
	+ that:
	+ - check_result.changed == true
	+ - ('reboot-on-upgrade-failure "20"' in (check_result.diff.prepared \| default('')))
	+
	+- name: confirm check_mode preview above was not actually applied
	+ vyos.vyos.vyos_command:
	+ commands: "show configuration commands \| match reboot-on-upgrade-failure"
	+ register: post_check_value
	+
	+- assert:
	+ that:
	+ - "'20' not in post_check_value.stdout[0]"
	+ - "'12' in post_check_value.stdout[0]"
	+
	+- name: teardown -- restore marker to a neutral value
	+ vyos.vyos.vyos_config:
	+ lines:
	+ - set system option reboot-on-upgrade-failure '5'
	+ match: none
	+
	+- debug: msg="END cli/replace_config.yaml on connection={{ ansible_connection }}"
	diff --git a/tests/unit/modules/network/vyos/test_vyos_config.py b/tests/unit/modules/network/vyos/test_vyos_config.py
	index 601971cd..4c6f3c42 100644
	--- a/tests/unit/modules/network/vyos/test_vyos_config.py
	+++ b/tests/unit/modules/network/vyos/test_vyos_config.py
	@@ -1,180 +1,361 @@
	-#
	# (c) 2016 Red Hat Inc.
	#
	# This file is part of Ansible
	#
	# Ansible is free software: you can redistribute it and/or modify
	# it under the terms of the GNU General Public License as published by
	# the Free Software Foundation, either version 3 of the License, or
	# (at your option) any later version.
	#
	# Ansible is distributed in the hope that it will be useful,
	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	# GNU General Public License for more details.
	#
	# You should have received a copy of the GNU General Public License
	# along with Ansible. If not, see <http://www.gnu.org/licenses/>.

	# Make coding more python3-ish
	from __future__ import absolute_import, division, print_function


	__metaclass__ = type

	from unittest.mock import MagicMock, patch

	from ansible_collections.vyos.vyos.plugins.cliconf.vyos import Cliconf
	from ansible_collections.vyos.vyos.plugins.modules import vyos_config
	from ansible_collections.vyos.vyos.tests.unit.modules.utils import set_module_args

	from .vyos_module import TestVyosModule, load_fixture


	class TestVyosConfigModule(TestVyosModule):
	module = vyos_config

	def setUp(self):
	super(TestVyosConfigModule, self).setUp()

	self.mock_get_config = patch(
	"ansible_collections.vyos.vyos.plugins.modules.vyos_config.get_config",
	)
	self.get_config = self.mock_get_config.start()

	self.mock_load_config = patch(
	"ansible_collections.vyos.vyos.plugins.modules.vyos_config.load_config",
	)
	self.load_config = self.mock_load_config.start()

	self.mock_run_commands = patch(
	"ansible_collections.vyos.vyos.plugins.modules.vyos_config.run_commands",
	)
	self.run_commands = self.mock_run_commands.start()

	self.mock_get_connection = patch(
	"ansible_collections.vyos.vyos.plugins.modules.vyos_config.get_connection",
	)
	self.get_connection = self.mock_get_connection.start()

	+ self.mock_copy_file = patch(
	+ "ansible_collections.vyos.vyos.plugins.modules.vyos_config.copy_file",
	+ )
	+ self.copy_file = self.mock_copy_file.start()
	+
	self.cliconf_obj = Cliconf(MagicMock())
	self.running_config = load_fixture("vyos_config_config.cfg")

	self.conn = self.get_connection()
	self.conn.edit_config = MagicMock()
	self.running_config = load_fixture("vyos_config_config.cfg")

	def tearDown(self):
	super(TestVyosConfigModule, self).tearDown()

	self.mock_get_config.stop()
	self.mock_load_config.stop()
	self.mock_run_commands.stop()
	self.mock_get_connection.stop()
	+ self.mock_copy_file.stop()

	def load_fixtures(self, commands=None, filename=None):
	config_file = "vyos_config_config.cfg"
	self.get_config.return_value = load_fixture(config_file)
	self.load_config.return_value = None

	def test_vyos_config_unchanged(self):
	src = load_fixture("vyos_config_config.cfg")
	self.conn.get_diff = MagicMock(return_value=self.cliconf_obj.get_diff(src, src))
	set_module_args(dict(src=src))
	self.execute_module()

	def test_vyos_config_src(self):
	src = load_fixture("vyos_config_src.cfg")
	set_module_args(dict(src=src))
	candidate = "\n".join(self.module.format_commands(src.splitlines()))
	commands = [
	"set system host-name foo",
	"delete interfaces ethernet eth0 address",
	]
	self.conn.get_diff = MagicMock(
	return_value=self.cliconf_obj.get_diff(candidate, self.running_config),
	)
	self.execute_module(changed=True, commands=commands)

	def test_vyos_config_src_brackets(self):
	src = load_fixture("vyos_config_src_brackets.cfg")
	set_module_args(dict(src=src))
	commands = [
	"set interfaces ethernet eth0 address 10.10.10.10/24",
	"set policy route testroute rule 1 set table 10",
	"set system host-name foo",
	]
	self.conn.get_diff = MagicMock(side_effect=self.cliconf_obj.get_diff)
	self.execute_module(changed=True, commands=commands)

	def test_vyos_config_backup(self):
	set_module_args(dict(backup=True))
	result = self.execute_module()
	self.assertIn("__backup__", result)

	def test_vyos_config_lines(self):
	commands = ["set system host-name foo"]
	set_module_args(dict(lines=commands))
	candidate = "\n".join(commands)
	self.conn.get_diff = MagicMock(
	return_value=self.cliconf_obj.get_diff(candidate, self.running_config),
	)
	self.execute_module(changed=True, commands=commands)

	def test_vyos_config_config(self):
	config = "set system host-name localhost"
	new_config = ["set system host-name router"]
	set_module_args(dict(lines=new_config, config=config))
	candidate = "\n".join(new_config)
	self.conn.get_diff = MagicMock(return_value=self.cliconf_obj.get_diff(candidate, config))
	self.execute_module(changed=True, commands=new_config)

	def test_vyos_config_match_none(self):
	lines = [
	"set system interfaces ethernet eth0 address 1.2.3.4/24",
	"set system interfaces ethernet eth0 description test string",
	]
	set_module_args(dict(lines=lines, match="none"))
	candidate = "\n".join(lines)
	self.conn.get_diff = MagicMock(
	return_value=self.cliconf_obj.get_diff(candidate, None, diff_match="none"),
	)
	self.execute_module(changed=True, commands=lines, sort=False)

	def test_vyos_config_confirm_automatic(self):
	src = load_fixture("vyos_config_src.cfg")
	confirm_timeout = 7
	set_module_args(dict(src=src, confirm="automatic", confirm_timeout=confirm_timeout))
	candidate = "\n".join(self.module.format_commands(src.splitlines()))
	commands = [
	"set system host-name foo",
	"delete interfaces ethernet eth0 address",
	]
	self.conn.get_diff = MagicMock(
	return_value=self.cliconf_obj.get_diff(candidate, self.running_config),
	)

	self.execute_module(changed=True, commands=commands)

	self.assertEqual(self.load_config.call_args[1]["confirm"], confirm_timeout)
	self.run_commands.assert_called_once()
	self.assertEqual(
	["configure", "confirm", "exit"],
	self.run_commands.call_args[0][1],
	)

	def test_vyos_config_confirm_manual(self):
	lines = [
	"set system host-name foo",
	]
	confirm_timeout = 12
	set_module_args(dict(lines=lines, confirm="manual", confirm_timeout=confirm_timeout))
	candidate = "\n".join(lines)
	self.conn.get_diff = MagicMock(
	return_value=self.cliconf_obj.get_diff(candidate, self.running_config),
	)

	self.execute_module(changed=True, commands=lines)

	self.assertEqual(self.load_config.call_args[1]["confirm"], confirm_timeout)
	self.run_commands.assert_not_called()
	+
	+ # -- replace=config (T6837, cisco.iosxr.iosxr_config replace=config analogue) --
	+
	+ def test_vyos_config_replace_config_requires_src(self):
	+ """replace=config without src must fail argument validation, not run."""
	+ set_module_args(dict(replace="config"))
	+ result = self.execute_module(failed=True)
	+ self.assertIn("src", result["msg"])
	+
	+ def test_vyos_config_replace_config_rejects_lines_only(self):
	+ """replace=config with only lines (no src) must fail --
	+ required_if demands src regardless of what else is set.
	+ """
	+ set_module_args(dict(replace="config", lines=["set system host-name foo"]))
	+ self.execute_module(failed=True)
	+
	+ def test_vyos_config_replace_config_rejects_lines_and_src_together(self):
	+ """lines/src remain mutually exclusive regardless of replace --
	+ this is the pre-existing constraint, unaffected by replace=config."""
	+ set_module_args(
	+ dict(
	+ replace="config",
	+ src="system {\n host-name router\n}\n",
	+ lines=["set system host-name foo"],
	+ ),
	+ )
	+ self.execute_module(failed=True)
	+
	+ def test_vyos_config_replace_config_pushes_and_loads(self):
	+ """replace=config with a real change: copies the candidate to a fixed
	+ remote path, issues a single `load <path>` command, and reports the
	+ device's own diff verbatim -- not an itemized set/delete list.
	+ """
	+ src = "interfaces {\n ethernet eth0 {\n address dhcp\n }\n}\n"
	+ set_module_args(dict(replace="config", src=src))
	+ self.load_config.side_effect = lambda a, *kw: (
	+ "[edit interfaces]\n+ethernet eth0 {\n+ address dhcp\n+}"
	+ )
	+
	+ result = self.execute_module(changed=True)
	+
	+ self.assertEqual(result["commands"], ["load /tmp/ansible_vyos_replace.cfg"])
	+ self.copy_file.assert_called_once()
	+ # positional call: copy_file(module, local_path, remote_path, proto)
	+ self.assertEqual(self.copy_file.call_args[0][2], "/tmp/ansible_vyos_replace.cfg")
	+ self.assertEqual(self.copy_file.call_args[0][3], "scp")
	+ self.assertEqual(
	+ self.load_config.call_args[0][1],
	+ ["load /tmp/ansible_vyos_replace.cfg"],
	+ )
	+
	+ def test_vyos_config_replace_config_noop(self):
	+ """replace=config with load_config() returning falsy (VyOS's own
	+ `compare` reported no changes) must report changed=False, not
	+ unconditionally True.
	+ """
	+ src = "system {\n host-name router\n}\n"
	+ set_module_args(dict(replace="config", src=src))
	+ self.load_config.return_value = None
	+
	+ result = self.execute_module(changed=False)
	+ self.assertEqual(result["commands"], ["load /tmp/ansible_vyos_replace.cfg"])
	+
	+ def test_vyos_config_replace_config_check_mode(self):
	+ """Under check_mode, commit=False must be passed through to
	+ load_config() -- the candidate is still copied/loaded for an accurate
	+ compare-based preview diff, but nothing is committed.
	+ """
	+ src = "system {\n host-name router\n}\n"
	+ set_module_args(dict(replace="config", src=src, _ansible_check_mode=True))
	+ self.load_config.side_effect = lambda a, *kw: (
	+ "[edit system]\n-host-name foo\n+host-name router"
	+ )
	+
	+ self.execute_module(changed=True)
	+
	+ self.assertEqual(self.load_config.call_args[1]["commit"], False)
	+
	+ def test_vyos_config_replace_config_confirm_automatic(self):
	+ src = "system {\n host-name router\n}\n"
	+ confirm_timeout = 9
	+ set_module_args(
	+ dict(
	+ replace="config",
	+ src=src,
	+ confirm="automatic",
	+ confirm_timeout=confirm_timeout,
	+ ),
	+ )
	+ self.load_config.side_effect = lambda a, *kw: (
	+ "[edit system]\n-host-name foo\n+host-name router"
	+ )
	+
	+ self.execute_module(changed=True)
	+
	+ self.assertEqual(self.load_config.call_args[1]["confirm"], confirm_timeout)
	+ self.run_commands.assert_called_once()
	+ self.assertEqual(["configure", "confirm", "exit"], self.run_commands.call_args[0][1])
	+
	+ def test_vyos_config_replace_config_diff(self):
	+ """With --diff, result['diff']['prepared'] must carry VyOS's own
	+ compare() output verbatim -- not an itemized command list, since none
	+ is computed in this mode.
	+ """
	+ src = "system {\n host-name router\n}\n"
	+ set_module_args(dict(replace="config", src=src, _ansible_diff=True))
	+ raw_compare = "[edit system]\n-host-name foo\n+host-name router"
	+ self.load_config.side_effect = lambda a, *kw: raw_compare
	+
	+ result = self.execute_module(changed=True)
	+
	+ self.assertEqual(result["diff"]["prepared"], raw_compare)
	+
	+ def test_vyos_config_replace_config_does_not_use_line_diff_path(self):
	+ """replace=config must never call connection.get_diff() -- that path
	+ (and match/allow_password_change) is specific to replace=line and is
	+ documented as ignored under replace=config.
	+ """
	+ src = "system {\n host-name router\n}\n"
	+ set_module_args(dict(replace="config", src=src, match="none"))
	+ self.load_config.side_effect = lambda a, *kw: (
	+ "[edit system]\n-host-name foo\n+host-name router"
	+ )
	+
	+ self.execute_module(changed=True)
	+
	+ self.conn.get_diff.assert_not_called()
	+
	+ def test_vyos_config_replace_config_confirm_automatic_check_mode_no_confirm_sent(self):
	+ """Regression guard: confirm=automatic must not send the
	+ configure/confirm/exit sequence under check_mode, even when a real
	+ diff is present -- nothing was actually committed to confirm.
	+ """
	+ src = "system {\n host-name router\n}\n"
	+ set_module_args(
	+ dict(
	+ replace="config",
	+ src=src,
	+ confirm="automatic",
	+ _ansible_check_mode=True,
	+ ),
	+ )
	+ self.load_config.side_effect = lambda a, *kw: (
	+ "[edit system]\n-host-name foo\n+host-name router"
	+ )
	+
	+ self.execute_module(changed=True)
	+
	+ self.run_commands.assert_not_called()
	+
	+ def test_vyos_config_replace_config_confirm_automatic_noop_no_confirm_sent(self):
	+ """Regression guard: confirm=automatic must not send the
	+ configure/confirm/exit sequence when load_config() reports no diff
	+ (VyOS's own compare() found nothing to commit) -- there is nothing
	+ pending to confirm.
	+ """
	+ src = "system {\n host-name router\n}\n"
	+ set_module_args(dict(replace="config", src=src, confirm="automatic"))
	+ self.load_config.return_value = None
	+
	+ self.execute_module(changed=False)
	+
	+ self.run_commands.assert_not_called()
	+
	+ def test_vyos_config_replace_line_default_unaffected(self):
	+ """Regression guard: default replace='line' must behave identically
	+ to the pre-patch module -- copy_file() must never be invoked.
	+ """
	+ commands = ["set system host-name foo"]
	+ set_module_args(dict(lines=commands))
	+ candidate = "\n".join(commands)
	+ self.conn.get_diff = MagicMock(
	+ return_value=self.cliconf_obj.get_diff(candidate, self.running_config),
	+ )
	+ self.execute_module(changed=True, commands=commands)
	+ self.copy_file.assert_not_called()

File Metadata

Mime Type: text/x-diff
Expires: Sat, Sep 26, 1:36 PM (1 d, 7 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 4243808
Default Alt Text: (89 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions