|
+ Controls how the module applies configuration to the device.
+ When set to line (default), the module computes a set/delete command diff and pushes only the changed lines -- this is the existing behavior, unchanged.
+ When set to config, the module uploads the full candidate configuration (src) to the device and issues VyOS's native load command in configuration mode, which replaces the running configuration wholesale with the candidate's exact contents. VyOS's own configuration engine performs the reconciliation, rather than the module computing per-line deltas. This mirrors the mechanism offered by cisco.iosxr.iosxr_config's replace=config.
+ replace=config requires src and does not accept lines -- there is no way to convert flat set/delete commands into the hierarchical form load requires without re-implementing VyOS's own config-tree builder.
+ As with src in the default line mode, the module does not validate the candidate's contents or format under replace=config -- supplying a well-formed, complete configuration is the caller's responsibility.
+ replace=config requires the device to accept file transfer (SCP) over the same network_cli SSH session used for configuration commands.
+ replace=config writes the candidate to a fixed path on the device (overwritten on each run, matching cisco.iosxr.iosxr_config's own replace=config precedent). Running replace=config concurrently against the same host is not supported.
+ Any configuration present on the device but omitted from the candidate will be removed, including management interfaces, SSH access, and login users if they are omitted. Always supply a complete configuration, never a partial one.
+ When capturing a candidate from the device's own output (for example via show configuration) rather than from a trusted, separately maintained source, be aware that VyOS may return masked placeholder values (for example a run of literal asterisks) in place of local users' encrypted-password/plaintext-password values when queried through automation, even though the identical command returns the real value when typed interactively at a terminal. Pushing a masked capture back through replace=config sends the literal placeholder as the new password value; VyOS's own commit-time validation is expected to reject an obviously malformed hash, but a masked value that happens to pass basic format validation could apply silently. Prefer sourcing replace=config candidates from a trusted, version-controlled artifact rather than a live automated capture whenever the configuration contains local password-based users.
+ Even under check_mode, the candidate is written to a temporary file on the device so that VyOS's own compare can produce an accurate preview diff. No commit occurs in check mode.
+ When combined with backup=yes, the value of changed reflects whether the backup file's content changed on the Ansible control node, not whether the device configuration changed -- this is existing behavior in the shared netcommon action plugin backing config-family modules across collections, not specific to replace=config.
|