1.3 KiB
[2026-09-19] elway evaluated when: / creates: / removes: / changed_when: WITHOUT the step's sudo, and it fails silently in the dangerous direction.
⭐⭐ elway evaluated when: / creates: / removes: / changed_when: WITHOUT the step's sudo, and it fails silently in the dangerous direction. A root-requiring when: (pvesh get … exits 255 unprivileged) returns non-zero → elway reports SKIPPED → a playbook that never performed its change reports overall OK, because "skipped" is indistinguishable from working idempotency. Three consecutive runs of the VM-102 exclusion reported success while changing nothing; only the unconditional verify phase caught it. creates: failed the other way — a /root/… path is unreadable to the login user, so test -e said absent and the step re-ran forever. Fixed (754db4b); sudo-less steps unchanged. ⚠ Audit any existing playbook with a root-requiring condition — a green run proves less than you thought. Two neighbouring traps: never grep -A<n> a PVE job in jobs.cfg (vmid sorts LAST, so adding a comment pushed it out of the window and every condition inverted); and pvesh JSON carries both a top-level "enabled":1 and a nested "fleecing":{"enabled":"0"}, so a greedy .*"enabled": sed matches the wrong one.