mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
227f49042c
Ansible --check mode auto-skips command/shell tasks unless they explicitly opt in via check_mode:false. The two cluster-state lookups (svc/auth ClusterIP and knoe-kdc-secrets/trust_shared_password) were silently skipped during dry-run, leaving trust_kdc_ip empty and tripping the assertion immediately. Add check_mode:false to the five read-only tasks so a --check run can still resolve cluster state and report what would change: - Resolve trust_kdc_ip from cluster - Resolve trust_shared_password from knoe-kdc-secrets - samba-tool domain trust list (idempotency probe) - samba-tool domain trust validate - samba-tool domain trust show (smoke print) The mutating create step (samba-tool domain trust create) keeps the default behavior - skipped in check mode. validate/show gain a guarded failed_when so a check-mode dry-run on a host where the trust does not yet exist does not fail (the create was skipped, so a non-zero rc is expected). Real runs still fail hard on rc!=0. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| deployments/svc-check-helm | ||
| inventory | ||
| playbooks | ||
| roles | ||
| setup | ||
| ansible.cfg | ||