The certificate task that must not print the key
ipa-getcert uses creates. The staged key is copied with diff false and mode 0600. A status check is changed_when false.
Blog
Blog
Blog
The second run of install_harbor
is_present.yml reads the runtime marker, copies harbor.yml only if it is missing, and seeds the admin password only before the first deploy.
Blog
Absent is not the idempotency test
compose down is marked changed on purpose. The second present run is the test. Absent keeps harbor.yml and the data volume.
Blog
How I add a role
Copy roles/_template, leave main.yml alone, put the work in is_present.yml, and do not download anything inside the environment.