diff --git a/plugins/module_utils/ansible_freeipa_module.py b/plugins/module_utils/ansible_freeipa_module.py
index f70756c895ff938870730feb0ac91342910a97d9..32098b351a05c16fb0456481730d19a2cba93f3d 100644
--- a/plugins/module_utils/ansible_freeipa_module.py
+++ b/plugins/module_utils/ansible_freeipa_module.py
@@ -25,12 +25,13 @@
 __all__ = ["gssapi", "netaddr", "api", "ipalib_errors", "Env",
            "DEFAULT_CONFIG", "LDAP_GENERALIZED_TIME_FORMAT",
            "kinit_password", "kinit_keytab", "run", "DN", "VERSION",
-           "paths", "get_credentials_if_valid", "Encoding", 
+           "paths", "get_credentials_if_valid", "Encoding",
            "load_pem_x509_certificate"]
 
 import sys
 
-# HACK: workaround for Ansible 2.9 https://github.com/ansible/ansible/issues/68361
+# HACK: workaround for Ansible 2.9
+# https://github.com/ansible/ansible/issues/68361
 if 'ansible.executor' in sys.modules:
     for attr in __all__:
         setattr(sys.modules[__name__], attr, None)
@@ -104,11 +105,9 @@ else:
     except ImportError:
         from collections import Mapping  # noqa
 
-
     if six.PY3:
         unicode = str
 
-
     def valid_creds(module, principal):  # noqa
         """Get valid credentials matching the princial, try GSSAPI first."""
         if "KRB5CCNAME" in os.environ:
@@ -146,7 +145,6 @@ else:
             return True
         return False
 
-
     def temp_kinit(principal, password):
         """Kinit with password using a temporary ccache."""
         if not password:
@@ -165,7 +163,6 @@ else:
         os.environ["KRB5CCNAME"] = ccache_name
         return ccache_dir, ccache_name
 
-
     def temp_kdestroy(ccache_dir, ccache_name):
         """Destroy temporary ticket and remove temporary ccache."""
         if ccache_name is not None:
@@ -174,7 +171,6 @@ else:
         if ccache_dir is not None:
             shutil.rmtree(ccache_dir, ignore_errors=True)
 
-
     def api_connect(context=None):
         """
         Initialize IPA API with the provided context.
@@ -188,7 +184,9 @@ else:
         env._bootstrap()
         env._finalize_core(**dict(DEFAULT_CONFIG))
 
-        # available contexts are 'server', 'ansible-freeipa' and 'cli_installer'
+        # available contexts are 'server', 'ansible-freeipa' and
+        # 'cli_installer'
+
         if context is None:
             context = 'server'
 
@@ -203,27 +201,22 @@ else:
         if not backend.isconnected():
             backend.connect(ccache=os.environ.get('KRB5CCNAME', None))
 
-
     def api_command(module, command, name, args):
         """Call ipa.Command."""
         return api.Command[command](name, **args)
 
-
     def api_command_no_name(module, command, args):
         """Call ipa.Command without a name."""
         return api.Command[command](**args)
 
-
     def api_check_command(command):
         """Return if command exists in command list."""
         return command in api.Command
 
-
     def api_check_param(command, name):
         """Check if param exists in command param list."""
         return name in api.Command[command].params
 
-
     def api_check_ipa_version(oper, requested_version):
         """
         Compare the installed IPA version against a requested version.
@@ -241,8 +234,8 @@ else:
         operation = oper_map.get(oper)
         if not(operation):
             raise NotImplementedError("Invalid operator: %s" % oper)
-        return operation(version.parse(VERSION), version.parse(requested_version))
-
+        return operation(version.parse(VERSION),
+                         version.parse(requested_version))
 
     def execute_api_command(module, principal, password, command, name, args):
         """
@@ -265,7 +258,6 @@ else:
         finally:
             temp_kdestroy(ccache_dir, ccache_name)
 
-
     def date_format(value):
         accepted_date_formats = [
             LDAP_GENERALIZED_TIME_FORMAT,  # generalized time
@@ -283,7 +275,6 @@ else:
                 pass
         raise ValueError("Invalid date '%s'" % value)
 
-
     def compare_args_ipa(module, args, ipa):  # noqa
         """Compare IPA obj attrs with the command args.
 
@@ -305,7 +296,8 @@ else:
         if args is None or ipa is None:
             module.debug(
                 base_debug_msg + "args is%s None an ipa is%s None" % (
-                   "" if args is None else " not", "" if ipa is None else " not",
+                    "" if args is None else " not",
+                    "" if ipa is None else " not",
                 )
             )
             return False
@@ -340,7 +332,8 @@ else:
                         return False
                     if isinstance(ipa_arg[0], str) and isinstance(arg[0], int):
                         arg = [to_text(_arg) for _arg in arg]
-                    if isinstance(ipa_arg[0], unicode) and isinstance(arg[0], int):
+                    if isinstance(ipa_arg[0], unicode) \
+                       and isinstance(arg[0], int):
                         arg = [to_text(_arg) for _arg in arg]
                 try:
                     arg_set = set(arg)
@@ -362,13 +355,13 @@ else:
                         return False
         return True
 
-
     def _afm_convert(value):
         if value is not None:
             if isinstance(value, list):
                 return [_afm_convert(x) for x in value]
             elif isinstance(value, dict):
-                return {_afm_convert(k): _afm_convert(v) for k, v in value.items()}
+                return {_afm_convert(k): _afm_convert(v)
+                        for k, v in value.items()}
             elif isinstance(value, str):
                 return to_text(value)
             else:
@@ -376,15 +369,12 @@ else:
         else:
             return value
 
-
     def module_params_get(module, name):
         return _afm_convert(module.params.get(name))
 
-
     def api_get_realm():
         return api.env.realm
 
-
     def gen_add_del_lists(user_list, res_list):
         """Generate the lists for the addition and removal of members."""
         # The user list is None, therefore the parameter should not be touched
@@ -396,7 +386,6 @@ else:
 
         return add_list, del_list
 
-
     def encode_certificate(cert):
         """
         Encode a certificate using base64.
@@ -411,7 +400,6 @@ else:
             encoded = encoded.decode('ascii')
         return encoded
 
-
     def load_cert_from_str(cert):
         cert = cert.strip()
         if not cert.startswith("-----BEGIN CERTIFICATE-----"):
@@ -425,7 +413,6 @@ else:
             cert = load_certificate(cert.encode('utf-8'))
         return cert
 
-
     def DN_x500_text(text):
         if hasattr(DN, "x500_text"):
             return DN(text).x500_text()
@@ -435,7 +422,6 @@ else:
             dn.rdns = reversed(dn.rdns)
             return str(dn)
 
-
     def is_valid_port(port):
         if not isinstance(port, int):
             return False
@@ -445,7 +431,6 @@ else:
 
         return False
 
-
     def is_ip_address(ipaddr):
         """Test if given IP address is a valid IPv4 or IPv6 address."""
         try:
@@ -454,7 +439,6 @@ else:
             return False
         return True
 
-
     def is_ip_network_address(ipaddr):
         """Test if given IP address is a valid IPv4 or IPv6 address."""
         try:
@@ -463,7 +447,6 @@ else:
             return False
         return True
 
-
     def is_ipv4_addr(ipaddr):
         """Test if given IP address is a valid IPv4 address."""
         try:
@@ -472,7 +455,6 @@ else:
             return False
         return True
 
-
     def is_ipv6_addr(ipaddr):
         """Test if given IP address is a valid IPv6 address."""
         try:
@@ -481,7 +463,6 @@ else:
             return False
         return True
 
-
     def exit_raw_json(module, **kwargs):
         """
         Print the raw parameters in JSON format, without masking.
@@ -501,7 +482,6 @@ else:
         print(jsonify(kwargs))
         sys.exit(0)
 
-
     class AnsibleFreeIPAParams(Mapping):
         def __init__(self, ansible_module):
             self.mapping = ansible_module.params
@@ -525,7 +505,6 @@ else:
         def __getattr__(self, name):
             return self.get(name)
 
-
     class FreeIPABaseModule(AnsibleModule):
         """
         Base class for FreeIPA Ansible modules.
@@ -540,7 +519,8 @@ else:
         2. Implement the method ``define_ipa_commands()``
         3. Implement the method ``check_ipa_params()`` (optional)
 
-        After instantiating the class the method ``ipa_run()`` should be called.
+        After instantiating the class the method ``ipa_run()`` should be
+        called.
 
         Example (ansible-freeipa/plugins/modules/ipasomemodule.py):
 
@@ -560,7 +540,8 @@ else:
                 # Validate your params here
                 # Example:
                 if not self.ipa_params.module_param in VALID_OPTIONS:
-                    self.fail_json(msg="Invalid value for argument module_param")
+                    self.fail_json(
+                        msg="Invalid value for argument module_param")
 
             def define_ipa_commands(self):
                 args = self.get_ipa_command_args()
@@ -624,7 +605,8 @@ else:
             """
             Return a dict to be passed to an IPA command.
 
-            The keys of ``ipa_param_mapping`` are also the keys of the return dict.
+            The keys of ``ipa_param_mapping`` are also the keys of the return
+            dict.
 
             The values of ``ipa_param_mapping`` needs to be either:
                 * A str with the name of a defined method; or
@@ -658,8 +640,8 @@ else:
                 else:
                     self.fail_json(
                         msg=(
-                            "Couldn't get a value for '%s'. Option '%s' is not "
-                            "a module argument neither a defined method."
+                            "Couldn't get a value for '%s'. Option '%s' is "
+                            "not a module argument neither a defined method."
                         )
                         % (ipa_param_name, param_name)
                     )
@@ -770,7 +752,8 @@ else:
                 try:
                     result = self.api_command(command, name, args)
                 except Exception as excpt:
-                    self.fail_json(msg="%s: %s: %s" % (command, name, str(excpt)))
+                    self.fail_json(msg="%s: %s: %s" % (command, name,
+                                                       str(excpt)))
                 else:
                     self.process_command_result(name, command, args, result)
                 self.get_command_errors(command, result)
@@ -779,7 +762,8 @@ else:
             """
             Process an API command result.
 
-            This method can be overriden in subclasses, and change self.exit_values
+            This method can be overriden in subclasses, and
+            change self.exit_values
             to return data in the result for the controller.
             """
             if "completed" in result:
diff --git a/roles/ipaclient/module_utils/ansible_ipa_client.py b/roles/ipaclient/module_utils/ansible_ipa_client.py
index 817890010b59f2e94c15cfd06c33df0c011e5ef4..33531c51a32be8233e3488424e97a7ecd07183e0 100644
--- a/roles/ipaclient/module_utils/ansible_ipa_client.py
+++ b/roles/ipaclient/module_utils/ansible_ipa_client.py
@@ -47,7 +47,8 @@ __all__ = ["gssapi", "version", "ipadiscovery", "api", "errors", "x509",
 
 import sys
 
-# HACK: workaround for Ansible 2.9 https://github.com/ansible/ansible/issues/68361
+# HACK: workaround for Ansible 2.9
+# https://github.com/ansible/ansible/issues/68361
 if 'ansible.executor' in sys.modules:
     for attr in __all__:
         setattr(sys.modules[__name__], attr, None)
@@ -57,12 +58,12 @@ else:
 
     if NUM_VERSION < 30201:
         # See ipapython/version.py
-        IPA_MAJOR, IPA_MINOR, IPA_RELEASE = [int(x) for x in VERSION.split(".", 2)]
+        IPA_MAJOR, IPA_MINOR, IPA_RELEASE = [int(x) for x in
+                                             VERSION.split(".", 2)]
         IPA_PYTHON_VERSION = IPA_MAJOR*10000 + IPA_MINOR*100 + IPA_RELEASE
     else:
         IPA_PYTHON_VERSION = NUM_VERSION
 
-
     class installer_obj(object):
         def __init__(self):
             pass
@@ -84,14 +85,14 @@ else:
         #    return getattr(self, attr)
 
         # def __setattr__(self, attr, value):
-        #    logger.debug("  --> Setting installer.%s to %s" % (attr, repr(value)))
+        #    logger.debug("  --> Setting installer.%s to %s" %
+        #                 (attr, repr(value)))
         #    return super(installer_obj, self).__setattr__(attr, value)
 
         def knobs(self):
             for name in self.__dict__:
                 yield self, name
 
-
     # Initialize installer settings
     installer = installer_obj()
     # Create options
@@ -155,9 +156,11 @@ else:
             from ipaclient.install.client import configure_krb5_conf, \
                 get_ca_certs, SECURE_PATH, get_server_connection_interface, \
                 disable_ra, client_dns, \
-                configure_certmonger, update_ssh_keys, configure_openldap_conf, \
+                configure_certmonger, update_ssh_keys, \
+                configure_openldap_conf, \
                 hardcode_ldap_server, get_certs_from_ldap, save_state, \
-                create_ipa_nssdb, configure_ssh_config, configure_sshd_config, \
+                create_ipa_nssdb, configure_ssh_config, \
+                configure_sshd_config, \
                 configure_automount, configure_firefox, configure_nisdomain, \
                 CLIENT_INSTALL_ERROR, is_ipa_client_installed, \
                 CLIENT_ALREADY_CONFIGURED, nssldap_exists, remove_file, \
@@ -190,7 +193,8 @@ else:
             shutil.rmtree(temp_dir, ignore_errors=True)
             sys.path.remove(temp_dir)
 
-            argspec = inspect.getargspec(ipa_client_install.configure_krb5_conf)
+            argspec = inspect.getargspec(
+                ipa_client_install.configure_krb5_conf)
             if argspec.keywords is None:
                 def configure_krb5_conf(
                         cli_realm, cli_domain, cli_server, cli_kdc, dnsok,
@@ -200,8 +204,8 @@ else:
                     options.force = force
                     options.sssd = configure_sssd
                     return ipa_client_install.configure_krb5_conf(
-                        cli_realm, cli_domain, cli_server, cli_kdc, dnsok, options,
-                        filename, client_domain, client_hostname)
+                        cli_realm, cli_domain, cli_server, cli_kdc, dnsok,
+                        options, filename, client_domain, client_hostname)
             else:
                 configure_krb5_conf = ipa_client_install.configure_krb5_conf
             if NUM_VERSION < 40100:
@@ -219,19 +223,22 @@ else:
             client_dns = ipa_client_install.client_dns
             configure_certmonger = ipa_client_install.configure_certmonger
             update_ssh_keys = ipa_client_install.update_ssh_keys
-            configure_openldap_conf = ipa_client_install.configure_openldap_conf
+            configure_openldap_conf = \
+                ipa_client_install.configure_openldap_conf
             hardcode_ldap_server = ipa_client_install.hardcode_ldap_server
             get_certs_from_ldap = ipa_client_install.get_certs_from_ldap
             save_state = ipa_client_install.save_state
 
             create_ipa_nssdb = certdb.create_ipa_nssdb
 
-            argspec = inspect.getargspec(ipa_client_install.configure_nisdomain)
+            argspec = \
+                inspect.getargspec(ipa_client_install.configure_nisdomain)
             if len(argspec.args) == 3:
                 configure_nisdomain = ipa_client_install.configure_nisdomain
             else:
                 def configure_nisdomain(options, domain, statestore=None):
-                    return ipa_client_install.configure_nisdomain(options, domain)
+                    return ipa_client_install.configure_nisdomain(options,
+                                                                  domain)
 
             configure_ldap_conf = ipa_client_install.configure_ldap_conf
             configure_nslcd_conf = ipa_client_install.configure_nslcd_conf
diff --git a/roles/ipareplica/module_utils/ansible_ipa_replica.py b/roles/ipareplica/module_utils/ansible_ipa_replica.py
index a3b603d81aefde1a40ffc26a63780d0e8dce9ad0..1de75e1a46576fa882476ffe573240533d36edf0 100644
--- a/roles/ipareplica/module_utils/ansible_ipa_replica.py
+++ b/roles/ipareplica/module_utils/ansible_ipa_replica.py
@@ -47,7 +47,8 @@ __all__ = ["contextlib", "dnsexception", "dnsresolver", "dnsreversename",
 
 import sys
 
-# HACK: workaround for Ansible 2.9 https://github.com/ansible/ansible/issues/68361
+# HACK: workaround for Ansible 2.9
+# https://github.com/ansible/ansible/issues/68361
 if 'ansible.executor' in sys.modules:
     for attr in __all__:
         setattr(sys.modules[__name__], attr, None)
@@ -55,17 +56,16 @@ else:
     import logging
     from contextlib import contextmanager as contextlib_contextmanager
 
-
     from ipapython.version import NUM_VERSION, VERSION
 
     if NUM_VERSION < 30201:
         # See ipapython/version.py
-        IPA_MAJOR, IPA_MINOR, IPA_RELEASE = [int(x) for x in VERSION.split(".", 2)]
+        IPA_MAJOR, IPA_MINOR, IPA_RELEASE = [int(x) for x in
+                                             VERSION.split(".", 2)]
         IPA_PYTHON_VERSION = IPA_MAJOR*10000 + IPA_MINOR*100 + IPA_RELEASE
     else:
         IPA_PYTHON_VERSION = NUM_VERSION
 
-
     if NUM_VERSION >= 40600:
         # IPA version >= 4.6
 
@@ -83,7 +83,8 @@ else:
         from ipapython.ipautil import ipa_generate_password
         from ipalib.install.kinit import kinit_keytab
         from ipapython import ipaldap, ipautil, kernel_keyring
-        from ipapython.certdb import IPA_CA_TRUST_FLAGS, EXTERNAL_CA_TRUST_FLAGS
+        from ipapython.certdb import IPA_CA_TRUST_FLAGS, \
+            EXTERNAL_CA_TRUST_FLAGS
         from ipapython.dn import DN
         from ipapython.admintool import ScriptError
         from ipapython.ipa_log_manager import standard_logging_setup
@@ -95,7 +96,8 @@ else:
         from ipalib.util import (
             validate_domain_name,
             no_matching_interface_for_ip_address_warning)
-        from ipaclient.install.client import configure_krb5_conf, purge_host_keytab
+        from ipaclient.install.client import configure_krb5_conf, \
+            purge_host_keytab
         from ipaserver.install import (
             adtrust, bindinstance, ca, certs, dns, dsinstance, httpinstance,
             installutils, kra, krbinstance,
@@ -117,7 +119,8 @@ else:
         from ipaserver.install.server.replicainstall import (
             make_pkcs12_info, install_replica_ds, install_krb, install_ca_cert,
             install_http, install_dns_records, create_ipa_conf, check_dirsrv,
-            check_dns_resolution, configure_certmonger, remove_replica_info_dir,
+            check_dns_resolution, configure_certmonger,
+            remove_replica_info_dir,
             # common_cleanup,
             preserve_enrollment_state, uninstall_client,
             promote_sssd, promote_openldap_conf, rpc_client,
@@ -142,23 +145,19 @@ else:
             from ipaserver.install import ntpinstance
             time_service = "ntpd"
 
-
     else:
         # IPA version < 4.6
 
         raise Exception("freeipa version '%s' is too old" % VERSION)
 
-
     logger = logging.getLogger("ipa-server-install")
 
-
     def setup_logging():
         # logger.setLevel(logging.DEBUG)
         standard_logging_setup(
             paths.IPAREPLICA_INSTALL_LOG, verbose=False, debug=False,
             filemode='a', console_format='%(message)s')
 
-
     @contextlib_contextmanager
     def redirect_stdout(f):
         sys.stdout = f
@@ -167,7 +166,6 @@ else:
         finally:
             sys.stdout = sys.__stdout__
 
-
     class AnsibleModuleLog():
         def __init__(self, module):
             self.module = module
@@ -201,7 +199,6 @@ else:
             self.module.debug(msg)
             # self.module.warn(msg)
 
-
     class installer_obj(object):
         def __init__(self):
             # CompatServerReplicaInstall
@@ -240,7 +237,8 @@ else:
         #     value = super(installer_obj, self).__getattribute__(attr)
         #     if not attr.startswith("--") and not attr.endswith("--"):
         #         logger.debug(
-        #             "  <-- Accessing installer.%s (%s)" % (attr, repr(value)))
+        #             "  <-- Accessing installer.%s (%s)" %
+        #             (attr, repr(value)))
         #     return value
 
         def __getattr__(self, attr):
@@ -249,14 +247,14 @@ else:
             return getattr(self, attr)
 
         # def __setattr__(self, attr, value):
-        #    logger.debug("  --> Setting installer.%s to %s" % (attr, repr(value)))
+        #    logger.debug("  --> Setting installer.%s to %s" %
+        #                 (attr, repr(value)))
         #    return super(installer_obj, self).__setattr__(attr, value)
 
         def knobs(self):
             for name in self.__dict__:
                 yield self, name
 
-
     installer = installer_obj()
     options = installer
 
@@ -274,7 +272,6 @@ else:
     options.subject_base = None
     options.ca_subject = None
 
-
     def gen_env_boostrap_finalize_core(etc_ipa, default_config):
         env = Env()
         # env._bootstrap(context='installer', confdir=paths.ETC_IPA, log=None)
@@ -283,10 +280,10 @@ else:
         env._finalize_core(**dict(default_config))
         return env
 
-
     def api_bootstrap_finalize(env):
         # pylint: disable=no-member
-        xmlrpc_uri = 'https://{}/ipa/xml'.format(ipautil.format_netloc(env.host))
+        xmlrpc_uri = \
+            'https://{}/ipa/xml'.format(ipautil.format_netloc(env.host))
         api.bootstrap(in_server=True,
                       context='installer',
                       confdir=paths.ETC_IPA,
@@ -295,14 +292,14 @@ else:
         # pylint: enable=no-member
         api.finalize()
 
-
     def gen_ReplicaConfig():
         class ExtendedReplicaConfig(ReplicaConfig):
             def __init__(self, top_dir=None):
                 super(ExtendedReplicaConfig, self).__init__(top_dir)
 
             # def __getattribute__(self, attr):
-            #    value = super(ExtendedReplicaConfig, self).__getattribute__(attr)
+            #     value = super(ExtendedReplicaConfig, self).__getattribute__(
+            #         attr)
             #    if attr not in ["__dict__", "knobs"]:
             #        logger.debug("  <== Accessing config.%s (%s)" %
             #                     (attr, repr(value)))
@@ -314,8 +311,10 @@ else:
                 return getattr(self, attr)
 
             # def __setattr__(self, attr, value):
-            #   logger.debug("  ==> Setting config.%s to %s" % (attr, repr(value)))
-            #   return super(ExtendedReplicaConfig, self).__setattr__(attr, value)
+            #   logger.debug("  ==> Setting config.%s to %s" %
+            #                (attr, repr(value)))
+            #   return super(ExtendedReplicaConfig, self).__setattr__(attr,
+            #                                                         value)
 
             def knobs(self):
                 for name in self.__dict__:
@@ -338,7 +337,6 @@ else:
 
         return config
 
-
     def replica_ds_init_info(ansible_log,
                              config, options, ca_is_configured, remote_api,
                              ds_ca_subject, ca_file,
@@ -358,7 +356,8 @@ else:
         # if ca_is_configured:
         #     ca_subject = ca.lookup_ca_subject(_api, config.subject_base)
         # else:
-        #     ca_subject = installutils.default_ca_subject_dn(config.subject_base)
+        #     ca_subject = installutils.default_ca_subject_dn(
+        #         config.subject_base)
         ca_subject = ds_ca_subject
 
         ds = dsinstance.DsInstance(
@@ -403,7 +402,6 @@ else:
 
         return ds
 
-
     def ansible_module_get_parsed_ip_addresses(ansible_module,
                                                param='ip_addresses'):
         ip_addrs = []
@@ -411,11 +409,11 @@ else:
             try:
                 ip_parsed = ipautil.CheckedIPAddress(ip)
             except Exception as e:
-                ansible_module.fail_json(msg="Invalid IP Address %s: %s" % (ip, e))
+                ansible_module.fail_json(
+                    msg="Invalid IP Address %s: %s" % (ip, e))
             ip_addrs.append(ip_parsed)
         return ip_addrs
 
-
     def gen_remote_api(master_host_name, etc_ipa):
         ldapuri = 'ldaps://%s' % ipautil.format_netloc(master_host_name)
         xmlrpc_uri = 'https://{}/ipa/xml'.format(
diff --git a/roles/ipaserver/module_utils/ansible_ipa_server.py b/roles/ipaserver/module_utils/ansible_ipa_server.py
index 4ce75472a5832c8cfd2a9ea08824cc5633a0a944..a5310f88c3ad89d081182a456e5fffde6d811645 100644
--- a/roles/ipaserver/module_utils/ansible_ipa_server.py
+++ b/roles/ipaserver/module_utils/ansible_ipa_server.py
@@ -42,7 +42,8 @@ __all__ = ["IPAChangeConf", "certmonger", "sysrestore", "root_logger",
 
 import sys
 
-# HACK: workaround for Ansible 2.9 https://github.com/ansible/ansible/issues/68361
+# HACK: workaround for Ansible 2.9
+# https://github.com/ansible/ansible/issues/68361
 if 'ansible.executor' in sys.modules:
     for attr in __all__:
         setattr(sys.modules[__name__], attr, None)
@@ -54,17 +55,16 @@ else:
     import six
     import base64
 
-
     from ipapython.version import NUM_VERSION, VERSION
 
     if NUM_VERSION < 30201:
         # See ipapython/version.py
-        IPA_MAJOR, IPA_MINOR, IPA_RELEASE = [int(x) for x in VERSION.split(".", 2)]
+        IPA_MAJOR, IPA_MINOR, IPA_RELEASE = [int(x) for x in
+                                             VERSION.split(".", 2)]
         IPA_PYTHON_VERSION = IPA_MAJOR*10000 + IPA_MINOR*100 + IPA_RELEASE
     else:
         IPA_PYTHON_VERSION = NUM_VERSION
 
-
     if NUM_VERSION >= 40500:
         # IPA version >= 4.5
 
@@ -180,17 +180,14 @@ else:
 
         raise Exception("freeipa version '%s' is too old" % VERSION)
 
-
     logger = logging.getLogger("ipa-server-install")
 
-
     def setup_logging():
         # logger.setLevel(logging.DEBUG)
         standard_logging_setup(
             paths.IPASERVER_INSTALL_LOG, verbose=False, debug=False,
             filemode='a', console_format='%(message)s')
 
-
     @contextlib_contextmanager
     def redirect_stdout(f):
         sys.stdout = f
@@ -199,7 +196,6 @@ else:
         finally:
             sys.stdout = sys.__stdout__
 
-
     class AnsibleModuleLog():
         def __init__(self, module):
             self.module = module
@@ -233,7 +229,6 @@ else:
             self.module.debug(msg)
             # self.module.warn(msg)
 
-
     class options_obj(object):
         def __init__(self):
             self._replica_install = False
@@ -257,7 +252,6 @@ else:
             for name in self.__dict__:
                 yield self, name
 
-
     options = options_obj()
     installer = options
 
@@ -265,7 +259,6 @@ else:
     options.add_sids = True
     options.add_agents = False
 
-
     # Installable
     options.uninstalling = False
 
@@ -303,7 +296,6 @@ else:
     options.ignore_topology_disconnect = False
     options.ignore_last_of_role = False
 
-
     def api_Backend_ldap2(host_name, setup_ca, connect=False):
         # we are sure we have the configuration file ready.
         cfg = dict(context='installer', confdir=paths.ETC_IPA, in_server=True,
@@ -317,7 +309,6 @@ else:
         if connect:
             api.Backend.ldap2.connect()
 
-
     def ds_init_info(ansible_log, fstore, domainlevel, dirsrv_config_file,
                      realm_name, host_name, domain_name, dm_password,
                      idstart, idmax, subject_base, ca_subject,
@@ -349,7 +340,6 @@ else:
 
         return ds
 
-
     def ansible_module_get_parsed_ip_addresses(ansible_module,
                                                param='ip_addresses'):
         ip_addrs = []
@@ -357,11 +347,11 @@ else:
             try:
                 ip_parsed = ipautil.CheckedIPAddress(ip)
             except Exception as e:
-                ansible_module.fail_json(msg="Invalid IP Address %s: %s" % (ip, e))
+                ansible_module.fail_json(
+                    msg="Invalid IP Address %s: %s" % (ip, e))
             ip_addrs.append(ip_parsed)
         return ip_addrs
 
-
     def encode_certificate(cert):
         """
         Encode a certificate using base64.
@@ -376,13 +366,12 @@ else:
             encoded = encoded.decode('ascii')
         return encoded
 
-
     def decode_certificate(cert):
         """
         Decode a certificate using base64.
 
-        It also takes FreeIPA versions into account and returns a IPACertificate
-        for newer IPA versions.
+        It also takes FreeIPA versions into account and returns a
+        IPACertificate for newer IPA versions.
         """
         if hasattr(x509, "IPACertificate"):
             cert = cert.strip()