ansible-lint: Fix no-changed-when

Change-Id: I676f8d3c4cc446d7dd65239c0363e4d362662b0d
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>

32 files changed, 61 insertions, 3 deletions

diff --git a/.ansible-lint b/.ansible-lint
index 3efb5cc57..08b1887b2 100644
--- a/.ansible-lint
+++ b/.ansible-lint
@@ -9,9 +9,6 @@ exclude_paths:
 strict: false
 use_default_rules: true
 skip_list:
-  # [E301] Commands should not change things if nothing needs doing
-  # TODO(mnasiadka): Fix tasks that fail this check in a later iteration
-  - no-changed-when
   # [E503] Tasks that run when changed should likely be handlers
   - no-handler
   # [unnamed-task] All tasks should be named
diff --git a/ansible/roles/bifrost/tasks/bootstrap.yml b/ansible/roles/bifrost/tasks/bootstrap.yml
index 622d5f9e7..12827d5a9 100644
--- a/ansible/roles/bifrost/tasks/bootstrap.yml
+++ b/ansible/roles/bifrost/tasks/bootstrap.yml
@@ -4,6 +4,7 @@
     nginx_user: "{{ 'www-data' if is_debian else 'nginx' }}"
     is_debian: "{{ kolla_base_distro in ['debian', 'ubuntu'] }}"
   become: true
+  changed_when: true
   command: >
      {{ kolla_container_engine }} exec bifrost_deploy
      bash -c 'mkdir -p /var/log/kolla/ironic &&
@@ -13,6 +14,7 @@
 
 - name: Bootstrap bifrost (this may take several minutes)
   become: true
+  changed_when: true
   command: >
      {{ kolla_container_engine }} exec bifrost_deploy
      bash -c
@@ -23,6 +25,7 @@
 
 - name: Installing ssh keys
   become: true
+  changed_when: true
   command: >
      {{ kolla_container_engine }} exec bifrost_deploy
      bash -c 'mkdir -p /root/.ssh ; mkdir -p /home/ironic/.ssh;
diff --git a/ansible/roles/bifrost/tasks/deploy-servers.yml b/ansible/roles/bifrost/tasks/deploy-servers.yml
index 9907bf78e..6d4d44ebf 100644
--- a/ansible/roles/bifrost/tasks/deploy-servers.yml
+++ b/ansible/roles/bifrost/tasks/deploy-servers.yml
@@ -1,6 +1,7 @@
 ---
 - name: Enrolling physical servers with ironic
   become: true
+  changed_when: true
   command: >
      {{ kolla_container_engine }} exec bifrost_deploy
      bash -c 'export OS_CLOUD=bifrost &&
@@ -11,6 +12,7 @@
 
 - name: Deploy physical servers with ironic
   become: true
+  changed_when: true
   command: >
      {{ kolla_container_engine }} exec bifrost_deploy
      bash -c 'export OS_CLOUD=bifrost &&
diff --git a/ansible/roles/bifrost/tasks/stop.yml b/ansible/roles/bifrost/tasks/stop.yml
index 2c7bfe678..d47a24cae 100644
--- a/ansible/roles/bifrost/tasks/stop.yml
+++ b/ansible/roles/bifrost/tasks/stop.yml
@@ -18,6 +18,7 @@
         # order.
         - name: Stop services gracefully
           become: true
+          changed_when: true
           command: "{{ kolla_container_engine }} exec bifrost_deploy systemctl stop {{ item }}.service"
           with_items:
             - ironic
diff --git a/ansible/roles/container-engine-migration/tasks/migrate-volumes.yml b/ansible/roles/container-engine-migration/tasks/migrate-volumes.yml
index e0339708b..34fcfacdf 100644
--- a/ansible/roles/container-engine-migration/tasks/migrate-volumes.yml
+++ b/ansible/roles/container-engine-migration/tasks/migrate-volumes.yml
@@ -51,6 +51,7 @@
         target_path: "{{ engine_data[target_engine].volumes_dir }}/{{ item.path | basename }}"
         source_path: "{{ item.path }}/_data"
       become: true
+      changed_when: true
       command: "mv -f {{ source_path }} {{ target_path }}"
       with_items: "{{ container_volumes.files }}"
 
diff --git a/ansible/roles/container-engine-migration/tasks/ovs-cleanup.yml b/ansible/roles/container-engine-migration/tasks/ovs-cleanup.yml
index 0ade904ce..018718570 100644
--- a/ansible/roles/container-engine-migration/tasks/ovs-cleanup.yml
+++ b/ansible/roles/container-engine-migration/tasks/ovs-cleanup.yml
@@ -1,6 +1,7 @@
 ---
 - name: Remove OVS bridges from neutron
   become: true
+  changed_when: true
   command: >
     {{ current_engine }} exec -u root neutron_openvswitch_agent neutron-ovs-cleanup
     --config-file /etc/neutron/neutron.conf
@@ -9,6 +10,7 @@
 
 - name: Remove OVS bridges
   become: true
+  changed_when: true
   command: >
     {{ current_engine }} exec openvswitch_vswitchd
     bash -c 'for br in `ovs-vsctl list-br`;do ovs-vsctl --if-exists del-br $br;done'
diff --git a/ansible/roles/designate/tasks/update_pools.yml b/ansible/roles/designate/tasks/update_pools.yml
index b3ced413f..6707c85de 100644
--- a/ansible/roles/designate/tasks/update_pools.yml
+++ b/ansible/roles/designate/tasks/update_pools.yml
@@ -1,6 +1,7 @@
 ---
 - name: Non-destructive DNS pools update
   become: true
+  changed_when: true
   command: "{{ kolla_container_engine }} exec -t designate_worker designate-manage pool update"
   run_once: true
   delegate_to: "{{ groups['designate-worker'][0] }}"
diff --git a/ansible/roles/etcd/tasks/bootstrap_services.yml b/ansible/roles/etcd/tasks/bootstrap_services.yml
index 3630a38d1..894633ed3 100644
--- a/ansible/roles/etcd/tasks/bootstrap_services.yml
+++ b/ansible/roles/etcd/tasks/bootstrap_services.yml
@@ -4,6 +4,7 @@
     service_name: "etcd"
     service: "{{ etcd_services[service_name] }}"
   become: true
+  changed_when: true
   command: >-
     {{ kolla_container_engine }} exec {{ service.container_name }}
     etcdctl member add {{ ansible_facts.hostname }}
diff --git a/ansible/roles/etcd/tasks/remove_deleted_members.yml b/ansible/roles/etcd/tasks/remove_deleted_members.yml
index 188498e5c..6650ecea4 100644
--- a/ansible/roles/etcd/tasks/remove_deleted_members.yml
+++ b/ansible/roles/etcd/tasks/remove_deleted_members.yml
@@ -29,6 +29,7 @@
       {{ etcd_member_list_result.stdout | from_json
       | json_query('members[].{key: name, value: ID}') | items2dict }}
   become: true
+  changed_when: true
   command: >-
     {{ kolla_container_engine }} exec {{ service.container_name }}
     etcdctl member remove {{ '%x' % etcd_member_id[etcd_deleted_member] }}
diff --git a/ansible/roles/hacluster/tasks/bootstrap_service.yml b/ansible/roles/hacluster/tasks/bootstrap_service.yml
index 40f0507dd..a21df36de 100644
--- a/ansible/roles/hacluster/tasks/bootstrap_service.yml
+++ b/ansible/roles/hacluster/tasks/bootstrap_service.yml
@@ -2,6 +2,7 @@
 - name: Ensure stonith is disabled
   vars:
     service: "{{ hacluster_services['hacluster-pacemaker'] }}"
+  changed_when: true
   command: "{{ kolla_container_engine }} exec {{ service.container_name }} crm_attribute --type crm_config --name stonith-enabled --update false"
   run_once: true
   become: true
@@ -11,6 +12,7 @@
   vars:
     pacemaker_service: "{{ hacluster_services['hacluster-pacemaker'] }}"
     service: "{{ hacluster_services['hacluster-pacemaker-remote'] }}"
+  changed_when: true
   shell: >
     {{ kolla_container_engine }} exec {{ pacemaker_service.container_name }}
     cibadmin --modify --scope resources -X '
diff --git a/ansible/roles/ironic/tasks/upgrade.yml b/ansible/roles/ironic/tasks/upgrade.yml
index 4e5ef576e..2e7b4d6b8 100644
--- a/ansible/roles/ironic/tasks/upgrade.yml
+++ b/ansible/roles/ironic/tasks/upgrade.yml
@@ -22,10 +22,12 @@
 
     - name: Create ironic_dhcp_hosts volume
       become: true
+      changed_when: true
       command: "{{ kolla_container_engine }} volume create ironic_dhcp_hosts"
 
     - name: Migrate data from ironic_inspector_dhcp_hosts volume
       become: true
+      changed_when: true
       vars:
         volumes_dir: >-
           {{ '/var/lib/docker/volumes' if kolla_container_engine == 'docker'
@@ -87,5 +89,6 @@
 # TODO(mnasiadka): Remove this task in Gazpacho/2026.1 release
 - name: Remove ironic_inspector_dhcp_hosts volume
   become: true
+  changed_when: true
   command: "{{ kolla_container_engine }} volume rm ironic_inspector_dhcp_hosts"
   when: enable_ironic_dnsmasq | bool
diff --git a/ansible/roles/keystone/tasks/distribute_fernet.yml b/ansible/roles/keystone/tasks/distribute_fernet.yml
index 1991e7c45..7320aa1ba 100644
--- a/ansible/roles/keystone/tasks/distribute_fernet.yml
+++ b/ansible/roles/keystone/tasks/distribute_fernet.yml
@@ -11,6 +11,7 @@
 
 - name: Run key distribution
   become: true
+  changed_when: true
   command: "{{ kolla_container_engine }} exec -t {{ keystone_services['keystone-fernet']['container_name'] }} /usr/bin/fernet-push.sh"
   run_once: true
   delegate_to: >-
diff --git a/ansible/roles/keystone/tasks/register_identity_providers.yml b/ansible/roles/keystone/tasks/register_identity_providers.yml
index ced1d73dd..63597fbfd 100644
--- a/ansible/roles/keystone/tasks/register_identity_providers.yml
+++ b/ansible/roles/keystone/tasks/register_identity_providers.yml
@@ -22,6 +22,7 @@
     existing_mappings: "{{ existing_mappings_register.stdout_lines | map('trim') | list }}"
 
 - name: Remove unmanaged attribute mappings
+  changed_when: true
   command: >
     {{ kolla_container_engine }} exec -t keystone openstack
     --os-auth-url={{ openstack_auth.auth_url }}
@@ -43,6 +44,7 @@
 
 - name: Create unexisting domains
   become: true
+  changed_when: true
   kolla_toolbox:
     container_engine: "{{ kolla_container_engine }}"
     module_name: "os_keystone_domain"
@@ -57,6 +59,7 @@
 
 - name: Register attribute mappings in OpenStack
   become: true
+  changed_when: true
   command: >
     {{ kolla_container_engine }} exec -t keystone openstack
     --os-auth-url={{ openstack_auth.auth_url }}
@@ -78,6 +81,7 @@
 
 - name: Update existing attribute mappings in OpenStack
   become: true
+  changed_when: true
   command: >
     {{ kolla_container_engine }} exec -t keystone openstack
     --os-auth-url={{ openstack_auth.auth_url }}
@@ -121,6 +125,7 @@
 
 - name: Remove unmanaged identity providers
   become: true
+  changed_when: true
   command: >
     {{ kolla_container_engine }} exec -t keystone openstack
     --os-auth-url={{ openstack_auth.auth_url }}
@@ -141,6 +146,7 @@
 
 - name: Register Identity Providers in OpenStack
   become: true
+  changed_when: true
   command: >
     {{ kolla_container_engine }} exec -t keystone openstack
     --os-auth-url={{ openstack_auth.auth_url }}
@@ -164,6 +170,7 @@
 
 - name: Update Identity Providers in OpenStack according to Kolla-Ansible configurations
   become: true
+  changed_when: true
   command: >
     {{ kolla_container_engine }} exec -t keystone openstack
     --os-auth-url={{ openstack_auth.auth_url }}
@@ -186,6 +193,7 @@
 
 - name: Configure attribute mappings for each Identity Provider. (We expect the mappings to be configured by the operator)
   become: true
+  changed_when: true
   command: >
     {{ kolla_container_engine }} exec -t keystone openstack
     --os-auth-url={{ openstack_auth.auth_url }}
@@ -208,6 +216,7 @@
 
 - name: Update attribute mappings for each Identity Provider. (We expect the mappings to be configured by the operator).
   become: true
+  changed_when: true
   command: >
     {{ kolla_container_engine }} exec -t keystone openstack
     --os-auth-url={{ openstack_auth.auth_url }}
diff --git a/ansible/roles/keystone/tasks/upgrade.yml b/ansible/roles/keystone/tasks/upgrade.yml
index 88422c928..e0ef6814f 100644
--- a/ansible/roles/keystone/tasks/upgrade.yml
+++ b/ansible/roles/keystone/tasks/upgrade.yml
@@ -22,11 +22,13 @@
     - not use_preconfigured_databases | bool
 
 - name: Init keystone database upgrade
+  changed_when: true
   command: /bin/true
   notify: Init keystone database upgrade
   when: inventory_hostname == groups['keystone'][0]
 
 - name: Finish keystone database upgrade
+  changed_when: true
   command: /bin/true
   notify: Finish keystone database upgrade
   when: inventory_hostname == groups['keystone'][-1]
diff --git a/ansible/roles/loadbalancer/tasks/config_validate.yml b/ansible/roles/loadbalancer/tasks/config_validate.yml
index acb6f9912..361d85309 100644
--- a/ansible/roles/loadbalancer/tasks/config_validate.yml
+++ b/ansible/roles/loadbalancer/tasks/config_validate.yml
@@ -2,6 +2,7 @@
 - name: Validating haproxy config files
   vars:
     service: "{{ loadbalancer_services['haproxy'] }}"
+  changed_when: false
   command: >-
     {{ kolla_container_engine }} exec -i haproxy haproxy
     -c -f /etc/haproxy/haproxy.cfg -f /etc/haproxy/services.d/
diff --git a/ansible/roles/mariadb/tasks/recover_cluster.yml b/ansible/roles/mariadb/tasks/recover_cluster.yml
index 4bbaf5c25..e78d747ec 100644
--- a/ansible/roles/mariadb/tasks/recover_cluster.yml
+++ b/ansible/roles/mariadb/tasks/recover_cluster.yml
@@ -46,12 +46,14 @@
 
     - name: Copying MariaDB log file to /tmp
       become: true
+      changed_when: true
       command: "cp {{ container_engine_volumes_path }}/kolla_logs/_data/mariadb/mariadb.log /tmp/mariadb_tmp.log"
 
     # Look for sequence number in logs. Format is:
     # WSREP: Recovered position: <UUID>:<seqno>.
     - name: Get MariaDB wsrep recovery seqno
       become: true
+      changed_when: false
       shell: awk -F" " '/Recovered position/{seqno=$NF} END{split(seqno, a, ":"); print a[2]}' /tmp/mariadb_tmp.log
       register: wsrep_recovery_seqno
 
diff --git a/ansible/roles/mariadb/tasks/upgrade.yml b/ansible/roles/mariadb/tasks/upgrade.yml
index 9a5453696..3f328a371 100644
--- a/ansible/roles/mariadb/tasks/upgrade.yml
+++ b/ansible/roles/mariadb/tasks/upgrade.yml
@@ -1,6 +1,7 @@
 ---
 - name: Set wsrep_sst_method to rsync for upgrade
   become: true
+  changed_when: true
   no_log: true
   shell: >
     {{ kolla_container_engine }} exec {{ mariadb_service.container_name }}
@@ -13,6 +14,7 @@
 
 - name: Set wsrep_sst_method to mariabackup after upgrade
   become: true
+  changed_when: true
   no_log: true
   shell: >
     {{ kolla_container_engine }} exec {{ mariadb_service.container_name }}
diff --git a/ansible/roles/neutron/tasks/rolling_upgrade.yml b/ansible/roles/neutron/tasks/rolling_upgrade.yml
index 6b66ef5d9..68201443f 100644
--- a/ansible/roles/neutron/tasks/rolling_upgrade.yml
+++ b/ansible/roles/neutron/tasks/rolling_upgrade.yml
@@ -37,6 +37,7 @@
 
 - name: Checking neutron pending contract scripts
   become: true
+  changed_when: false
   command: "{{ kolla_container_engine }} exec -t neutron_server neutron-db-manage --subproject {{ item }} has_offline_migrations"
   register: neutron_check_contract_db_stdout
   ignore_errors: true
diff --git a/ansible/roles/nova-cell/handlers/main.yml b/ansible/roles/nova-cell/handlers/main.yml
index 2dcca1546..8aa5ba11c 100644
--- a/ansible/roles/nova-cell/handlers/main.yml
+++ b/ansible/roles/nova-cell/handlers/main.yml
@@ -110,6 +110,7 @@
 # need to wait kolla_set_configs script to overwrite sasl config file
 - name: Checking libvirt container is ready
   become: true
+  changed_when: false
   shell:
     cmd: >
       set -o pipefail &&
diff --git a/ansible/roles/nova-cell/tasks/libvirt-cleanup.yml b/ansible/roles/nova-cell/tasks/libvirt-cleanup.yml
index dda964865..3aebb173b 100644
--- a/ansible/roles/nova-cell/tasks/libvirt-cleanup.yml
+++ b/ansible/roles/nova-cell/tasks/libvirt-cleanup.yml
@@ -20,6 +20,7 @@
     # NOTE(mgoddard): pgrep exit status 1 means no match.
     - name: Check if there are any running VMs
       become: true
+      changed_when: false
       shell:
         cmd: >
           set -o pipefail &&
diff --git a/ansible/roles/nova/tasks/refresh_scheduler_cell_cache.yml b/ansible/roles/nova/tasks/refresh_scheduler_cell_cache.yml
index d4760c0b4..6ffdf80be 100644
--- a/ansible/roles/nova/tasks/refresh_scheduler_cell_cache.yml
+++ b/ansible/roles/nova/tasks/refresh_scheduler_cell_cache.yml
@@ -3,6 +3,7 @@
 # in nova scheduler.
 - name: Refresh cell cache in nova scheduler
   become: true
+  changed_when: true
   # NOTE(yoctozepto): Normally we would send the signal via Docker but, due to a
   # Docker bug (https://github.com/moby/moby/issues/11065), this might cause the
   # container to be stopped if we restart Docker or reboot the server as we
diff --git a/ansible/roles/octavia/tasks/hm-interface.yml b/ansible/roles/octavia/tasks/hm-interface.yml
index 7b9bff9cc..79790d471 100644
--- a/ansible/roles/octavia/tasks/hm-interface.yml
+++ b/ansible/roles/octavia/tasks/hm-interface.yml
@@ -21,6 +21,7 @@
 # https://docs.ansible.com/ansible/latest/modules/os_port_module.html#parameters
 - name: Update Octavia health manager port host_id
   become: true
+  changed_when: true
   vars:
     port_id: "{{ port_info.port.id }}"
   command: >
@@ -43,6 +44,7 @@
     port_mac: "{{ port_info.port.mac_address }}"
     port_id: "{{ port_info.port.id }}"
   become: true
+  changed_when: true
   command: >
     {{ kolla_container_engine }} exec openvswitch_vswitchd ovs-vsctl --may-exist \
     add-port br-int {{ octavia_network_interface }} \
diff --git a/ansible/roles/ovn-db/tasks/bootstrap-db.yml b/ansible/roles/ovn-db/tasks/bootstrap-db.yml
index 290101850..bb8cb61b8 100644
--- a/ansible/roles/ovn-db/tasks/bootstrap-db.yml
+++ b/ansible/roles/ovn-db/tasks/bootstrap-db.yml
@@ -22,6 +22,7 @@
   vars:
     search_string: "Role: leader"
   become: true
+  changed_when: true
   command: >-
     {{ kolla_container_engine }} exec ovn_nb_db
     ovn-nbctl
@@ -47,6 +48,7 @@
   vars:
     search_string: "Role: leader"
   become: true
+  changed_when: true
   command: >-
     {{ kolla_container_engine }} exec ovn_sb_db
     ovn-sbctl
diff --git a/ansible/roles/ovn-db/tasks/bootstrap-initial.yml b/ansible/roles/ovn-db/tasks/bootstrap-initial.yml
index e620d92bd..be4af702e 100644
--- a/ansible/roles/ovn-db/tasks/bootstrap-initial.yml
+++ b/ansible/roles/ovn-db/tasks/bootstrap-initial.yml
@@ -36,6 +36,7 @@
       vars:
         ovn_nb_old_node: "{{ ovn_nb_db_cluster_status | regex_search('\\((\\w{4}) at tcp:' + api_interface_address + ':6643\\)', '\\1') | first }}"
       become: true
+      changed_when: true
       command: >
         {{ kolla_container_engine }} exec ovn_nb_db ovs-appctl -t /var/run/ovn/ovnnb_db.ctl
         cluster/kick OVN_Northbound {{ ovn_nb_old_node }}
@@ -48,6 +49,7 @@
       vars:
         ovn_sb_old_node: "{{ ovn_sb_db_cluster_status | regex_search('\\((\\w{4}) at tcp:' + api_interface_address + ':6644\\)', '\\1') | first }}"
       become: true
+      changed_when: true
       command: >
         {{ kolla_container_engine }} exec ovn_sb_db ovs-appctl -t /var/run/ovn/ovnsb_db.ctl
         cluster/kick OVN_Southbound {{ ovn_sb_old_node }}
diff --git a/ansible/roles/ovs-dpdk/tasks/config.yml b/ansible/roles/ovs-dpdk/tasks/config.yml
index d17911b61..af7937237 100644
--- a/ansible/roles/ovs-dpdk/tasks/config.yml
+++ b/ansible/roles/ovs-dpdk/tasks/config.yml
@@ -26,6 +26,7 @@
 
 - name: Install ovs-dpdkctl service and config
   become: true
+  changed_when: true
   command: "{{ node_config_directory }}/ovsdpdk-db/ovs-dpdkctl.sh install"
   environment:
     CONFIG_FILE: "{{ node_config_directory }}/ovsdpdk-db/ovs-dpdkctl.conf"
@@ -39,6 +40,7 @@
 
 - name: Binds the interface to the target driver specified in the config
   become: true
+  changed_when: true
   command: "{{ node_config_directory }}/ovsdpdk-db/ovs-dpdkctl.sh bind_nics"
   environment:
     CONFIG_FILE: "{{ node_config_directory }}/ovsdpdk-db/ovs-dpdkctl.conf"
diff --git a/ansible/roles/prometheus/tasks/config_validate.yml b/ansible/roles/prometheus/tasks/config_validate.yml
index 700dba68f..075bfb16d 100644
--- a/ansible/roles/prometheus/tasks/config_validate.yml
+++ b/ansible/roles/prometheus/tasks/config_validate.yml
@@ -1,5 +1,6 @@
 ---
 - name: Validating prometheus config files
+  changed_when: false
   vars:
     service: "{{ prometheus_services['prometheus-server'] }}"
   shell: >-
diff --git a/ansible/roles/prune-images/tasks/prune_images.yml b/ansible/roles/prune-images/tasks/prune_images.yml
index 29519fea3..176824284 100644
--- a/ansible/roles/prune-images/tasks/prune_images.yml
+++ b/ansible/roles/prune-images/tasks/prune_images.yml
@@ -12,5 +12,6 @@
 # and generic module podman_image does not support label filters
 - name: Pruning Kolla images
   become: true
+  changed_when: true
   command: podman image prune --force --filter 'label=kolla_version'
   when: kolla_container_engine == 'podman'
diff --git a/ansible/roles/rabbitmq/tasks/remove-ha-all-policy.yml b/ansible/roles/rabbitmq/tasks/remove-ha-all-policy.yml
index c05f75dd4..acf7435e0 100644
--- a/ansible/roles/rabbitmq/tasks/remove-ha-all-policy.yml
+++ b/ansible/roles/rabbitmq/tasks/remove-ha-all-policy.yml
@@ -24,6 +24,7 @@
 
         - name: Remove ha-all policy from RabbitMQ
           become: true
+          changed_when: true
           command: "{{ kolla_container_engine }} exec {{ service.container_name }} rabbitmqctl clear_policy ha-all"
           when:
             - "'ha-all' in rabbitmq_policies.stdout"
diff --git a/ansible/roles/rabbitmq/tasks/reset-state.yml b/ansible/roles/rabbitmq/tasks/reset-state.yml
index ac9984467..5f226e8fd 100644
--- a/ansible/roles/rabbitmq/tasks/reset-state.yml
+++ b/ansible/roles/rabbitmq/tasks/reset-state.yml
@@ -1,16 +1,20 @@
 ---
 - name: Stop the RabbitMQ application
   become: true
+  changed_when: true
   command: "{{ kolla_container_engine }} exec rabbitmq rabbitmqctl stop_app"
 
 - name: Reset the state of RabbitMQ
   become: true
+  changed_when: true
   command: "{{ kolla_container_engine }} exec rabbitmq rabbitmqctl force_reset"
 
 - name: Start the RabbitMQ application
   become: true
+  changed_when: true
   command: "{{ kolla_container_engine }} exec rabbitmq rabbitmqctl start_app"
 
 - name: Wait for all RabbitMQ nodes to join the cluster
   become: true
+  changed_when: false
   command: "{{ kolla_container_engine }} exec rabbitmq rabbitmqctl await_online_nodes {{ groups['rabbitmq'] | length }}"
diff --git a/ansible/roles/rabbitmq/tasks/restart_services.yml b/ansible/roles/rabbitmq/tasks/restart_services.yml
index 9f5e8765b..e12b30171 100644
--- a/ansible/roles/rabbitmq/tasks/restart_services.yml
+++ b/ansible/roles/rabbitmq/tasks/restart_services.yml
@@ -21,6 +21,7 @@
 
 - name: Stop the RabbitMQ application if not in cluster
   become: true
+  changed_when: true
   command: "{{ kolla_container_engine }} exec rabbitmq rabbitmqctl stop_app"
   when:
     - container_info.containers | length > 0
@@ -46,4 +47,5 @@
     service_name: "rabbitmq"
     service: "{{ rabbitmq_services[service_name] }}"
   become: true
+  changed_when: false
   command: "{{ kolla_container_engine }} exec {{ service.container_name }} rabbitmqctl wait --timeout 60 {{ rabbitmq_pid_file }}"
diff --git a/ansible/roles/valkey/tasks/upgrade.yml b/ansible/roles/valkey/tasks/upgrade.yml
index 5a7499ded..e40b699b9 100644
--- a/ansible/roles/valkey/tasks/upgrade.yml
+++ b/ansible/roles/valkey/tasks/upgrade.yml
@@ -34,6 +34,7 @@
 
     - name: Wait for Valkey replication sync
       become: true
+      changed_when: false
       delegate_to: "{{ valkey_master_host }}"
       run_once: true
       command: >-
@@ -46,6 +47,7 @@
 
     - name: Set replica-priority=10 on valkey[0] to ensure it becomes master
       become: true
+      changed_when: true
       delegate_to: "{{ valkey_master_host }}"
       run_once: true
       command: >-
@@ -55,6 +57,7 @@
 
     - name: Set replica-priority=0 on other valkey nodes to prevent promotion
       become: true
+      changed_when: true
       command: >-
         {{ kolla_container_engine }} exec valkey_server valkey-cli
         -h {{ api_interface_address }} -p {{ valkey_server_port }} CONFIG SET replica-priority 0
@@ -69,6 +72,7 @@
 
     - name: Trigger Sentinel failover (using one of redis-sentinels)
       become: true
+      changed_when: true
       delegate_to: "{{ valkey_master_host }}"
       run_once: true
       command: >-
@@ -79,6 +83,7 @@
 
     - name: Wait until Valkey becomes master
       become: true
+      changed_when: false
       delegate_to: "{{ valkey_master_host }}"
       run_once: true
       command: >-
diff --git a/ansible/roles/zun/handlers/main.yml b/ansible/roles/zun/handlers/main.yml
index 0d21f4575..626d5f302 100644
--- a/ansible/roles/zun/handlers/main.yml
+++ b/ansible/roles/zun/handlers/main.yml
@@ -64,6 +64,7 @@
     service_name: "zun-cni-daemon"
     service: "{{ zun_services[service_name] }}"
   become: true
+  changed_when: true
   command: "{{ kolla_container_engine }} cp {{ service.container_name }}:/opt/loopback /opt/cni/bin/"
   # NOTE(yoctozepto): it would be cleaner to listen only on image change
   # but there is no such mechanism (yet)