From ecff3e2cfa93ca7c3694559c79bce65300c5fc7d Mon Sep 17 00:00:00 2001
From: omnom62 <75066712+omnom62@users.noreply.github.com>
Date: Thu, 17 Sep 2026 18:31:48 +1000
Subject: T6828: PR190 revive, vyos_conf match "enforced" (#415)

* T6828: PR190 revive, vyos_conf match "enforced"
---
 docs/vyos.vyos.vyos_config_module.rst | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'docs')

diff --git a/docs/vyos.vyos.vyos_config_module.rst b/docs/vyos.vyos.vyos_config_module.rst
index 054ae208..bdc0df07 100644
--- a/docs/vyos.vyos.vyos_config_module.rst
+++ b/docs/vyos.vyos.vyos_config_module.rst
@@ -167,11 +167,12 @@ Parameters
                         <ul style="margin: 0; padding: 0"><b>Choices:</b>
                                     <li>automatic</li>
                                     <li>manual</li>
-                                    <li><div style="color: blue"><b>none</b>&nbsp;&larr;</div></li>
+                                    <li>none</li>
                         </ul>
                 </td>
                 <td>
                         <div>The <code>confirm</code> argument will tell vyos to revert to the previous configuration if not explicitly confirmed after applying the new config. When set to <code>automatic</code> this module will automatically confirm the configuration, if the current session remains working with the new config. When set to <code>manual</code>, this module does not issue the confirmation itself.</div>
+                        <div>Defaults to <code>automatic</code> when <code>match</code> is set to <code>enforce</code>, since <code>enforce</code> can generate <code>delete</code> commands for configuration not mentioned in the candidate and a bad commit should self-revert rather than leave the device unreachable. Defaults to <code>none</code> for all other <code>match</code> values.</div>
                 </td>
             </tr>
             <tr>
@@ -219,11 +220,12 @@ Parameters
                 <td>
                         <ul style="margin: 0; padding: 0"><b>Choices:</b>
                                     <li><div style="color: blue"><b>line</b>&nbsp;&larr;</div></li>
+                                    <li>enforce</li>
                                     <li>none</li>
                         </ul>
                 </td>
                 <td>
-                        <div>The <code>match</code> argument controls the method used to match against the current active configuration.  By default, the desired config is matched against the active config and the deltas are loaded.  If the <code>match</code> argument is set to <code>none</code> the active configuration is ignored and the configuration is always loaded.</div>
+                        <div>The <code>match</code> argument controls the method used to match against the current active configuration.  By default, the desired config is matched against the active config and the deltas are loaded.  If the <code>match</code> argument is set to <code>none</code>, the active configuration is ignored and the configuration is always loaded.  If the <code>match</code> argument is set to <code>enforce</code>, the supplied <code>lines</code> or <code>src</code> are treated as the complete desired end-state of the configuration, rather than a set of deltas to apply. <code>enforce</code> enforces only the top-level configuration sections present in the supplied candidate as complete end-states; existing configuration within those sections but not mentioned in the candidate is removed, so <code>enforce</code> can generate <code>delete</code> commands for configuration the candidate does not mention. Top-level sections the candidate does not reference at all are left completely untouched. <code>enforce</code> is intended for candidates made up of <code>set</code> commands only; supplying <code>delete</code> lines alongside <code>match=enforce</code> is not supported and will raise an error.</div>
                         <div>Ignored when <code>replace</code> is set to <code>config</code>, since no line-level diff is computed in that mode.</div>
                 </td>
             </tr>
@@ -326,6 +328,7 @@ Examples
 
     - name: render a Jinja2 template onto the VyOS router
       vyos.vyos.vyos_config:
+        match: enforce
         src: vyos_template.j2
 
     - name: revert after ten minutes, if connection is lost
-- 
cgit v1.2.3