From 2cd88df81b4fe3715f118f8a466555789134ff05 Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Mon, 7 Sep 2026 15:39:17 +0200 Subject: [PATCH] fix: report concatenation commands as unchanged The `awk 1` commands assembling the chain, fullchain and all files declared `changed_when: chain_content.rc == 0`, which holds on every successful run. As a result the role never reported a converged state, even when no certificate was touched. These commands only read files and write to stdout, so mark them as unchanged. The subsequent copy task remains responsible for reporting an actual change. Co-authored-by: Copilot --- tasks/client_certificate.yaml | 6 +++--- tasks/intermediate_certificate_authority.yaml | 6 +++--- tasks/root_certificate_authority.yaml | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/tasks/client_certificate.yaml b/tasks/client_certificate.yaml index e402005..f222847 100644 --- a/tasks/client_certificate.yaml +++ b/tasks/client_certificate.yaml @@ -58,7 +58,7 @@ ansible.builtin.command: cmd: awk 1 {{ _chain_files | join(' ') }} register: chain_content - changed_when: chain_content.rc == 0 + changed_when: false when: _stat_result.stat.exists is defined and _stat_result.stat.exists - name: Create concatenated chain file @@ -85,7 +85,7 @@ ansible.builtin.command: cmd: awk 1 {{ _chain_files | join(' ') }} register: chain_content - changed_when: chain_content.rc == 0 + changed_when: false when: _stat_result.stat.exists is defined and _stat_result.stat.exists - name: Create concatenated fullchain file @@ -112,7 +112,7 @@ ansible.builtin.command: cmd: awk 1 {{ _chain_files | join(' ') }} register: chain_content - changed_when: chain_content.rc == 0 + changed_when: false when: _stat_result.stat.exists is defined and _stat_result.stat.exists - name: Create concatenated file diff --git a/tasks/intermediate_certificate_authority.yaml b/tasks/intermediate_certificate_authority.yaml index 03b05aa..4c7dcd1 100644 --- a/tasks/intermediate_certificate_authority.yaml +++ b/tasks/intermediate_certificate_authority.yaml @@ -58,7 +58,7 @@ ansible.builtin.command: cmd: awk 1 {{ _chain_files | join(' ') }} register: chain_content - changed_when: chain_content.rc == 0 + changed_when: false when: _stat_result.stat.exists is defined and _stat_result.stat.exists - name: Create concatenated chain file @@ -85,7 +85,7 @@ ansible.builtin.command: cmd: awk 1 {{ _chain_files | join(' ') }} register: chain_content - changed_when: chain_content.rc == 0 + changed_when: false when: _stat_result.stat.exists is defined and _stat_result.stat.exists - name: Create concatenated fullchain file @@ -112,7 +112,7 @@ ansible.builtin.command: cmd: awk 1 {{ _chain_files | join(' ') }} register: chain_content - changed_when: chain_content.rc == 0 + changed_when: false when: _stat_result.stat.exists is defined and _stat_result.stat.exists - name: Create concatenated file diff --git a/tasks/root_certificate_authority.yaml b/tasks/root_certificate_authority.yaml index bb353cc..9868a06 100644 --- a/tasks/root_certificate_authority.yaml +++ b/tasks/root_certificate_authority.yaml @@ -51,7 +51,7 @@ ansible.builtin.command: cmd: awk 1 {{ _chain_files | join(' ') }} register: chain_content - changed_when: chain_content.rc == 0 + changed_when: false when: _stat_result.stat.exists is defined and _stat_result.stat.exists - name: Create concatenated file