From 05938cfa3428efbd1da1b714a66cd7fa829e9557 Mon Sep 17 00:00:00 2001
From: Tod Detre <tod.detre@maine.edu>
Date: Thu, 3 Sep 2026 13:19:11 -0400
Subject: [PATCH] fix: read ConfigMap-owned state via slurp instead of
 include_vars
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

include_vars is a control-node-local action (_requires_connection =
False) that reads its file argument off the Ansible controller's own
filesystem, never the managed host. reconcile_config_map_values.yml
passed it an absolute remote-host path
(<conf_directory>/.<conf_file>.splunk-ansible-managed.yml), so the
"Load previous ConfigMap-owned values" task always fails once that
state file exists on a real target — masked on a host's first
convergence only because the preceding when: guard skips it.

Upstream's own PR #921 (CSPL-5085) testing was done entirely inside
Splunk Operator for Kubernetes pods, where the control node and the
managed host share one filesystem, so the bug never surfaced there.
It reproduces on any topology where they don't (AWX, or a manual
ansible-playbook run against a remote host over SSH) - caught here on
indexer06's second splunk_universal_forwarder.yml convergence.

Swap include_vars for slurp + b64decode | from_yaml, which actually
reads the file from the managed host, matching the become_user the
preceding stat task already uses.
---
 .../tasks/reconcile_config_map_values.yml          | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/roles/splunk_common/tasks/reconcile_config_map_values.yml b/roles/splunk_common/tasks/reconcile_config_map_values.yml
index 90c8771d..486ff7af 100644
--- a/roles/splunk_common/tasks/reconcile_config_map_values.yml
+++ b/roles/splunk_common/tasks/reconcile_config_map_values.yml
@@ -6,10 +6,18 @@
   become: yes
   become_user: "{{ splunk.user }}"
 
+- name: Read previous ConfigMap-owned values in {{ conf_file }}
+  slurp:
+    src: "{{ conf_directory }}/.{{ conf_file }}.splunk-ansible-managed.yml"
+  register: config_map_managed_values_content
+  become: yes
+  become_user: "{{ splunk.user }}"
+  when: config_map_managed_values_file.stat.exists
+  no_log: "{{ hide_password }}"
+
 - name: Load previous ConfigMap-owned values in {{ conf_file }}
-  include_vars:
-    file: "{{ conf_directory }}/.{{ conf_file }}.splunk-ansible-managed.yml"
-    name: previous_config_map_stanzas
+  set_fact:
+    previous_config_map_stanzas: "{{ config_map_managed_values_content.content | b64decode | from_yaml }}"
   when: config_map_managed_values_file.stat.exists
   no_log: "{{ hide_password }}"