From 06bca7fc0f704d07f261a7e37c7ab859b132de52 Mon Sep 17 00:00:00 2001 From: Takwa Date: Mon, 2 Nov 2026 10:49:05 +0100 Subject: [PATCH 1/2] Fix the route-origin dry run on ansible-core 2.19 The TLS secret task's condition could evaluate to a string under --check, which ansible-core 2.19 refuses, so the dry run stopped before reaching the manifests. Co-Authored-By: Claude Opus 5.5 --- roles/route_origin/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/route_origin/tasks/main.yml b/roles/route_origin/tasks/main.yml index 6ca9a42..6e83413 100644 --- a/roles/route_origin/tasks/main.yml +++ b/roles/route_origin/tasks/main.yml @@ -239,7 +239,7 @@ if route_origin_aop_enforced | bool else {}) }} no_log: true register: origin_tls_secret - when: not ansible_check_mode or origin_ns.stdout + when: not ansible_check_mode or (origin_ns.stdout | length > 0) - name: Deploy the route-origin manifests ansible.builtin.include_role: From 4daba970c7a7c0dd800983750e76dc3d4b1f7174 Mon Sep 17 00:00:00 2001 From: Takwa Date: Mon, 2 Nov 2026 10:50:55 +0100 Subject: [PATCH 2/2] Fix the bootstrap and content dry runs on ansible-core 2.19 These conditions have the same problem as route-origin's: under --check they could evaluate to a string, which ansible-core 2.19 refuses. Co-Authored-By: Claude Opus 5.5 --- roles/bootstrap/tasks/instance.yml | 4 ++-- roles/content/tasks/main.yml | 6 +++--- roles/content/tasks/pin_api.yml | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/roles/bootstrap/tasks/instance.yml b/roles/bootstrap/tasks/instance.yml index 50aef79..3218897 100644 --- a/roles/bootstrap/tasks/instance.yml +++ b/roles/bootstrap/tasks/instance.yml @@ -236,7 +236,7 @@ # On a first --check neither the namespace nor cert-manager's CRDs exist, so # the objects below cannot even be dry-run. - name: Create the WSS certificate - when: not ansible_check_mode or (bootstrap_ns.stdout and bootstrap_cm_crd.stdout) + when: not ansible_check_mode or (bootstrap_ns.stdout | length > 0 and bootstrap_cm_crd.stdout | length > 0) block: - name: Install the Cloudflare API token for DNS-01 challenges kubernetes.core.k8s: @@ -430,7 +430,7 @@ register: bootstrap_secret # On a first --check the namespace is only simulated and a dry-run secret # create would fail with "namespace not found". - when: not ansible_check_mode or bootstrap_ns.stdout + when: not ansible_check_mode or (bootstrap_ns.stdout | length > 0) - name: "Deploy the {{ bootstrap_namespace }} manifests" ansible.builtin.include_role: diff --git a/roles/content/tasks/main.yml b/roles/content/tasks/main.yml index e772fcf..715b5b7 100644 --- a/roles/content/tasks/main.yml +++ b/roles/content/tasks/main.yml @@ -229,7 +229,7 @@ register: content_kubo_secret # On a first --check the namespace is only simulated and a dry-run secret # create would fail with "namespace not found". - when: not ansible_check_mode or content_ns.stdout + when: not ansible_check_mode or (content_ns.stdout | length > 0) - name: Install the content cluster Secret vars: @@ -265,7 +265,7 @@ | map('join', ':') | join(',') | b64encode }} no_log: true register: content_secret - when: not ansible_check_mode or content_ns.stdout + when: not ansible_check_mode or (content_ns.stdout | length > 0) - name: Deploy the content manifests ansible.builtin.include_role: @@ -407,7 +407,7 @@ - name: Load the pinset into the content cluster run_once: true # On a first --check the node does not exist yet. - when: not ansible_check_mode or content_ns.stdout + when: not ansible_check_mode or (content_ns.stdout | length > 0) block: - name: Load the pinset vars: diff --git a/roles/content/tasks/pin_api.yml b/roles/content/tasks/pin_api.yml index 37ae02a..e85467f 100644 --- a/roles/content/tasks/pin_api.yml +++ b/roles/content/tasks/pin_api.yml @@ -26,7 +26,7 @@ # On a first --check the namespace does not exist yet, so nothing in it can be # dry-run. - name: Create the pinning certificate - when: not ansible_check_mode or content_ns.stdout + when: not ansible_check_mode or (content_ns.stdout | length > 0) block: - name: Install the Cloudflare API token for DNS-01 challenges kubernetes.core.k8s: