fix: make sure when condition doesnt break maintenance_only

[jon4hz]

Hi,

I found a few cases where the when condition overwrites the defaults provided by the yaml anchor.
This unfortunately breaks the maintenance_only behavior if you want to execute a single task only.

Also I'm curios why this inclusion / exclusion pattern is solved by when conditions. Couldn't we use tags for this?

[s3lph]

Also I'm curios why this inclusion / exclusion pattern is solved by when conditions. Couldn't we use tags for this?

We want to be able to preserve the information about which tasks need to be excluded from which host, and tags can't be applied on a per-host basis. The only option we had seen was to use this not very pretty host vars based solution. Though I'm always open for improvement proposals.

[s3lph]

Good catch!

There's another one in the last task in roles/maintenance_31_nginx/tasks/main.yml. Would you mind fixing that one as well?

[jon4hz]

The only option we had seen was to use this not very pretty host vars based solution.

Maybe we could use some callback plugin magic that converts the hostvars to tags. This way we could still freely use when conditions without any drawbacks. But I didn't test if that actually works yet, so it's a bit of speculative. Not saying this is a much better solution. I just never saw this inclusion / exclusion pattern with variables but only with tags like https:/ansible-lockdown/RHEL9-CIS?tab=readme-ov-file#tags for example.

There's another one in the last task in roles/maintenance_31_nginx/tasks/main.yml. Would you mind fixing that one as well?

Sure, will do!