Ansible – How to Show Diff of Newly Created File in Check Mode

The first ls you quoted is what happens when you try to ls -l a directory on which you have r permission but no x permission. The r bit on a directory gives you the ability to call readdir on it, so you can get the filenames inside it, but without x you can't stat them to find out all the other information that ls -l normally prints.

ls told you about the inability to get the information with its Permission denied error messages and fields full of question marks.

The second ls confirms the diagnosis with this line:

drw-r--r-- 2 myusername myusername 4096 Sep 17 19:54 .

The user myusername has read permission but no execute permission. You probably want to u+x or a+x that directory.

One interesting thing I learned from your post is that r-without-x now gives slightly more information than it did in olden times... you can see in the original listing that authorized_keys is a regular file and . and .. are directories (first column d vs. -). On an older Unix/Linux system that first column would be a question mark too! Nowadays readdir returns file type information as a bonus so you can get it without stating.

...I kind of skimmed past the second half of your question because I've never seen that stuff before, but this looks like the culprit

file: dest="/home/{{userid}}/.ssh"
      mode=0644

I'd expect a .ssh directory to be 0700 normally. And the files inside to be 0600. It's an area where you really don't want other users wandering in. Anyway it needs to be at least 0500 for ls -l to function normally for the owner.

in your ansible.cfg set the following:

[defaults]

# profile each task
callback_whitelist = profile_tasks

# [don't validate host keys](http://docs.ansible.com/ansible/intro_configuration.html#host-key-checking)
host_key_checking = False

[ssh_connection]
pipelining = True

Also, in your playbook, set the strategy as 'free'

- hosts: all
  strategy: free
  tasks: [...]

Finally, disable fact gathering on your play: gather_facts: false

If, after profiling, you are seeing a lot of this:

TASK [pip foo]
ok: [10.192.197.252] => (item=ansible)
ok: [10.192.197.252] => (item=boto)
ok: [10.192.197.252] => (item=boto3)
ok: [10.192.197.252] => (item=passlib)
ok: [10.192.197.252] => (item=cryptography)

squash those actions in ansible.cfg under [defaults]:

e.g. squash_actions = yum,pip,bar