ansible-lint: Remove key-order[task] exclude

Change-Id: I77cce57f3f2b05455e8bd4e7093081ef4ed25d59
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>

29 files changed, 181 insertions, 204 deletions

diff --git a/.ansible-lint b/.ansible-lint
index 6a44bcfc2..1ec2012fe 100644
--- a/.ansible-lint
+++ b/.ansible-lint
@@ -31,7 +31,6 @@ skip_list:
   # role name check matching ^*$
   - role-name
   # TODO(frickler): Discuss these in detail, skipping for now to unblock things
-  - key-order[task]
   - no-free-form
   - name[play]
   - var-naming[no-role-prefix]
diff --git a/ansible/roles/bifrost/tasks/stop.yml b/ansible/roles/bifrost/tasks/stop.yml
index ac71b934b..2c7bfe678 100644
--- a/ansible/roles/bifrost/tasks/stop.yml
+++ b/ansible/roles/bifrost/tasks/stop.yml
@@ -1,5 +1,8 @@
 ---
-- block:
+- when:
+    - inventory_hostname in groups['bifrost']
+    - "'bifrost_deploy' not in skip_stop_containers"
+  block:
     - name: Check if bifrost_deploy container is running
       become: true
       kolla_container_facts:
@@ -9,7 +12,8 @@
           - bifrost_deploy
       register: container_facts
 
-    - block:
+    - when: container_facts.containers['bifrost_deploy'] is defined
+      block:
         # Ensure that all services are stopped gracefully, and in a sensible
         # order.
         - name: Stop services gracefully
@@ -26,9 +30,3 @@
             action: "stop_container"
             common_options: "{{ docker_common_options }}"
             name: "bifrost_deploy"
-
-      when: "container_facts.containers['bifrost_deploy'] is defined"
-
-  when:
-    - inventory_hostname in groups['bifrost']
-    - "'bifrost_deploy' not in skip_stop_containers"
diff --git a/ansible/roles/certificates/tasks/generate.yml b/ansible/roles/certificates/tasks/generate.yml
index ec24316ef..d1b536853 100644
--- a/ansible/roles/certificates/tasks/generate.yml
+++ b/ansible/roles/certificates/tasks/generate.yml
@@ -11,7 +11,10 @@
     state: "directory"
     mode: "0770"
 
-- block:
+- when:
+    - letsencrypt_managed_certs == 'internal' or letsencrypt_managed_certs == '' or database_enable_tls_internal | bool
+    - kolla_enable_tls_external | bool or database_enable_tls_internal | bool
+  block:
     - name: Creating external SSL configuration file
       template:
         src: "{{ item }}.j2"
@@ -59,9 +62,6 @@
         path: "{{ external_dir }}/external.key"
         mode: "0660"
         state: file
-  when:
-    - letsencrypt_managed_certs == 'internal' or letsencrypt_managed_certs == '' or database_enable_tls_internal | bool
-    - kolla_enable_tls_external | bool or database_enable_tls_internal | bool
 
 - name: Creating external Server PEM File
   assemble:
@@ -73,7 +73,10 @@
     - letsencrypt_managed_certs == 'internal' or letsencrypt_managed_certs == ''
     - kolla_enable_tls_external | bool
 
-- block:
+- when:
+    - database_enable_tls_internal | bool
+    - kolla_same_external_internal_vip | bool
+  block:
     - name: Copy Certificate for ProxySQL
       copy:
         src: "{{ external_dir }}/external.crt"
@@ -85,24 +88,24 @@
         src: "{{ external_dir }}/external.key"
         dest: "{{ kolla_certificates_dir }}/proxysql-key.pem"
         mode: "0660"
-  when:
-    - database_enable_tls_internal | bool
-    - kolla_same_external_internal_vip | bool
 
-- block:
-    - name: Copy the external PEM file to be the internal when internal + external are same network
-      copy:
-        src: "{{ kolla_external_fqdn_cert }}"
-        dest: "{{ kolla_internal_fqdn_cert }}"
-        remote_src: yes
-        mode: "0660"
+- name: Copy the external PEM file to be the internal when internal + external are same network
+  copy:
+    src: "{{ kolla_external_fqdn_cert }}"
+    dest: "{{ kolla_internal_fqdn_cert }}"
+    remote_src: yes
+    mode: "0660"
   when:
     - letsencrypt_managed_certs == 'external' or letsencrypt_managed_certs == ''
     - kolla_enable_tls_external | bool
     - kolla_enable_tls_internal | bool
     - kolla_same_external_internal_vip | bool
 
-- block:
+- when:
+    - letsencrypt_managed_certs == 'external' or letsencrypt_managed_certs == '' or database_enable_tls_internal | bool
+    - kolla_enable_tls_internal | bool or database_enable_tls_internal | bool
+    - not kolla_same_external_internal_vip | bool
+  block:
     - name: Creating internal SSL configuration file
       template:
         src: "{{ item }}.j2"
@@ -150,10 +153,6 @@
         path: "{{ internal_dir }}/internal.key"
         mode: "0660"
         state: file
-  when:
-    - letsencrypt_managed_certs == 'external' or letsencrypt_managed_certs == '' or database_enable_tls_internal | bool
-    - kolla_enable_tls_internal | bool or database_enable_tls_internal | bool
-    - not kolla_same_external_internal_vip | bool
 
 - name: Creating internal Server PEM File
   assemble:
@@ -166,7 +165,10 @@
     - kolla_enable_tls_internal | bool
     - not kolla_same_external_internal_vip | bool
 
-- block:
+- when:
+    - database_enable_tls_internal | bool
+    - not kolla_same_external_internal_vip | bool
+  block:
     - name: Copy Certificate for ProxySQL
       copy:
         src: "{{ internal_dir }}/internal.crt"
@@ -178,6 +180,3 @@
         src: "{{ internal_dir }}/internal.key"
         dest: "{{ kolla_certificates_dir }}/proxysql-key.pem"
         mode: "0660"
-  when:
-    - database_enable_tls_internal | bool
-    - not kolla_same_external_internal_vip | bool
diff --git a/ansible/roles/container-engine-migration/tasks/migrate-volumes.yml b/ansible/roles/container-engine-migration/tasks/migrate-volumes.yml
index 86b10e85f..e0339708b 100644
--- a/ansible/roles/container-engine-migration/tasks/migrate-volumes.yml
+++ b/ansible/roles/container-engine-migration/tasks/migrate-volumes.yml
@@ -36,7 +36,8 @@
 # NOTE(r-krcek): The following block is workaround for problem where podman
 # changes directory permissions after starting a container from any UID:GID
 # to root after migration.
-- block:
+- when: container_volumes.matched > 0
+  block:
     - name: Pre-create volumes in target engine
       become: true
       kolla_container:
@@ -58,7 +59,6 @@
         path: "{{ item.path }}"
         state: absent
       with_items: "{{ container_volumes.files }}"
-  when: container_volumes.matched > 0
 
 # NOTE(mhiner): this prevents RabbitMQ failing to establish connection
 # to other instances in multinode deployment
diff --git a/ansible/roles/destroy/tasks/cleanup_host.yml b/ansible/roles/destroy/tasks/cleanup_host.yml
index 96389564f..3ed8705b1 100644
--- a/ansible/roles/destroy/tasks/cleanup_host.yml
+++ b/ansible/roles/destroy/tasks/cleanup_host.yml
@@ -15,7 +15,12 @@
     destroy_include_dev: "{{ destroy_include_dev }}"
     kolla_ansible_inventories: "{{ ansible_inventory_sources | join(' ') }}"
 
-- block:
+- when:
+    - enable_octavia | bool
+    - octavia_auto_configure | bool
+    - octavia_network_type == 'tenant'
+    - inventory_hostname in groups['octavia-health-manager']
+  block:
     - name: Disable octavia-interface service
       service:
         name: octavia-interface
@@ -32,8 +37,3 @@
       file:
         path: /etc/dhcp/octavia-dhclient.conf
         state: absent
-  when:
-    - enable_octavia | bool
-    - octavia_auto_configure | bool
-    - octavia_network_type == 'tenant'
-    - inventory_hostname in groups['octavia-health-manager']
diff --git a/ansible/roles/loadbalancer/tasks/precheck.yml b/ansible/roles/loadbalancer/tasks/precheck.yml
index 7d4fc4bbf..cdb211f32 100644
--- a/ansible/roles/loadbalancer/tasks/precheck.yml
+++ b/ansible/roles/loadbalancer/tasks/precheck.yml
@@ -55,7 +55,11 @@
     haproxy_vip_prechecks: "{{ all_hosts_in_batch and groups['haproxy_running_True'] is not defined }}"
     proxysql_vip_prechecks: "{{ all_hosts_in_batch and groups['proxysql_running_True'] is not defined }}"
 
-- block:
+- when:
+    - not kolla_externally_managed_cert | bool
+    - letsencrypt_managed_certs == 'internal' or letsencrypt_managed_certs == ''
+    - kolla_enable_tls_external | bool
+  block:
     - name: Checking if external haproxy certificate exists
       run_once: true
       stat:
@@ -69,12 +73,12 @@
       assert:
         that: haproxy_cert_file.stat.exists
         fail_msg: "External haproxy certificate file is not found. It is configured via 'kolla_external_fqdn_cert'"
-  when:
-    - not kolla_externally_managed_cert | bool
-    - letsencrypt_managed_certs == 'internal' or letsencrypt_managed_certs == ''
-    - kolla_enable_tls_external | bool
 
-- block:
+- when:
+    - not kolla_externally_managed_cert | bool
+    - letsencrypt_managed_certs == 'external' or letsencrypt_managed_certs == ''
+    - kolla_enable_tls_internal | bool
+  block:
     - name: Checking if internal haproxy certificate exists
       run_once: true
       stat:
@@ -88,10 +92,6 @@
       assert:
         that: haproxy_internal_cert_file.stat.exists
         fail_msg: "Internal haproxy certificate file is not found. It is configured via 'kolla_internal_fqdn_cert'"
-  when:
-    - not kolla_externally_managed_cert | bool
-    - letsencrypt_managed_certs == 'external' or letsencrypt_managed_certs == ''
-    - kolla_enable_tls_internal | bool
 
 - name: Checking the kolla_external_vip_interface is present
   assert:
@@ -726,6 +726,8 @@
     - haproxy_vip_prechecks
 
 - name: Firewalld checks
+  when:
+    - enable_external_api_firewalld | bool
   block:
     - name: Check if firewalld is running  # noqa command-instead-of-module
       become: true
@@ -743,5 +745,3 @@
           Please install and configure firewalld.
       when:
         - firewalld_is_active.rc != 0
-  when:
-    - enable_external_api_firewalld | bool
diff --git a/ansible/roles/mariadb/tasks/lookup_cluster.yml b/ansible/roles/mariadb/tasks/lookup_cluster.yml
index 48dd6e1ce..207e1f90b 100644
--- a/ansible/roles/mariadb/tasks/lookup_cluster.yml
+++ b/ansible/roles/mariadb/tasks/lookup_cluster.yml
@@ -17,7 +17,8 @@
   set_fact:
     mariadb_cluster_exists: "{{ groups[mariadb_shard_group + '_had_volume_True'] is defined }}"
 
-- block:
+- when: not mariadb_recover | default(False)
+  block:
     - name: Check MariaDB service port liveness
       wait_for:
         host: "{{ api_interface_address }}"
@@ -42,7 +43,10 @@
         - mariadb_cluster_exists
         - groups[mariadb_shard_group + '_port_alive_True'] is not defined
 
-    - block:
+    - when:
+        - groups[mariadb_shard_group + '_port_alive_True'] is defined
+        - inventory_hostname in groups[mariadb_shard_group + '_port_alive_True']
+      block:
         - name: Check MariaDB service WSREP sync status
           become: true
           kolla_toolbox:
@@ -61,9 +65,6 @@
         - name: Extract MariaDB service WSREP sync status
           set_fact:
             mariadb_sync_status: "{{ check_mariadb_sync_status.query_result[0][0]['Value'] }}"
-      when:
-        - groups[mariadb_shard_group + '_port_alive_True'] is defined
-        - inventory_hostname in groups[mariadb_shard_group + '_port_alive_True']
 
     - name: Divide hosts by their MariaDB service WSREP sync status
       group_by:
@@ -77,5 +78,3 @@
         - groups[mariadb_shard_group + '_port_alive_True'] is defined
         - groups[mariadb_shard_group + '_sync_status_Synced'] is not defined or
           groups[mariadb_shard_group + '_port_alive_True'] | sort != groups[mariadb_shard_group + '_sync_status_Synced'] | sort
-
-  when: not mariadb_recover | default(False)
diff --git a/ansible/roles/mariadb/tasks/recover_cluster.yml b/ansible/roles/mariadb/tasks/recover_cluster.yml
index b2eae1008..7d3fb28e0 100644
--- a/ansible/roles/mariadb/tasks/recover_cluster.yml
+++ b/ansible/roles/mariadb/tasks/recover_cluster.yml
@@ -15,7 +15,9 @@
   run_once: true
   with_fileglob: "/tmp/kolla_mariadb_recover_inventory_name_*"
 
-- block:
+- when:
+    - mariadb_recover_inventory_name is not defined
+  block:
     - name: Stop MariaDB containers
       become: true
       kolla_container:
@@ -92,8 +94,6 @@
       connection: local
       set_fact:
         mariadb_recover_inventory_name: "{{ lookup('file', mariadb_recover_tmp_file_path) }}"
-  when:
-    - mariadb_recover_inventory_name is not defined
 
 - name: Store bootstrap and master hostnames into facts
   set_fact:
diff --git a/ansible/roles/nova-cell/tasks/discover_computes.yml b/ansible/roles/nova-cell/tasks/discover_computes.yml
index 9b6a1696f..b49285b7e 100644
--- a/ansible/roles/nova-cell/tasks/discover_computes.yml
+++ b/ansible/roles/nova-cell/tasks/discover_computes.yml
@@ -1,7 +1,11 @@
 ---
 # Discover compute hosts for a cell.
 
-- block:
+- # Delegate to a cell conductor.
+  delegate_to: "{{ groups[nova_cell_conductor_group][0] }}"
+  # Fail all hosts if any of these once-per-cell tasks fail.
+  any_errors_fatal: true
+  block:
     - import_tasks: get_cell_settings.yml
 
     - name: Fail if cell settings not found
@@ -16,8 +20,3 @@
       command: >
         {{ kolla_container_engine }} exec -t nova_conductor nova-manage cell_v2 discover_hosts --by-service --cell_uuid {{ nova_cell_settings.cell_uuid }}
       changed_when: False
-
-  # Delegate to a cell conductor.
-  delegate_to: "{{ groups[nova_cell_conductor_group][0] }}"
-  # Fail all hosts if any of these once-per-cell tasks fail.
-  any_errors_fatal: true
diff --git a/ansible/roles/nova-cell/tasks/external_ceph.yml b/ansible/roles/nova-cell/tasks/external_ceph.yml
index f2d7ba696..9f4fe9cbc 100644
--- a/ansible/roles/nova-cell/tasks/external_ceph.yml
+++ b/ansible/roles/nova-cell/tasks/external_ceph.yml
@@ -97,7 +97,11 @@
     - service | service_enabled_and_mapped_to_host
     - nova_backend == "rbd"
 
-- block:
+- when:
+    - not enable_nova_libvirt_container | bool
+    - inventory_hostname in groups[nova_cell_compute_group]
+    - nova_backend == "rbd"
+  block:
     - name: Ensure /etc/ceph directory exists (host libvirt)
       vars:
         paths:
@@ -123,12 +127,21 @@
         group: "root"
         mode: "0644"
       become: true
-  when:
-    - not enable_nova_libvirt_container | bool
-    - inventory_hostname in groups[nova_cell_compute_group]
-    - nova_backend == "rbd"
 
-- block:
+- vars:
+    libvirt_secrets_dir: >-
+      {{ (node_config_directory ~ '/nova-libvirt/secrets')
+         if enable_nova_libvirt_container | bool
+         else '/etc/libvirt/secrets' }}
+    # NOTE(mgoddard): When running libvirt as a host daemon, on CentOS it
+    # appears to pick up secrets automatically, while on Ubuntu it requires a
+    # reload. This may be due to differences in tested versions of libvirt
+    # (8.0.0 vs 6.0.0). Reload should be low overhead, so do it always.
+    libvirt_restart_handlers: >-
+      {{ ['Reload libvirtd']
+         if not enable_nova_libvirt_container | bool else
+         [] }}
+  block:
     - name: Ensuring libvirt secrets directory exists
       vars:
         service: "{{ nova_cell_services['nova-libvirt'] }}"
@@ -190,16 +203,3 @@
           enabled: "{{ cinder_backend_ceph }}"
       notify: "{{ libvirt_restart_handlers }}"
       no_log: True
-  vars:
-    libvirt_secrets_dir: >-
-      {{ (node_config_directory ~ '/nova-libvirt/secrets')
-         if enable_nova_libvirt_container | bool
-         else '/etc/libvirt/secrets' }}
-    # NOTE(mgoddard): When running libvirt as a host daemon, on CentOS it
-    # appears to pick up secrets automatically, while on Ubuntu it requires a
-    # reload. This may be due to differences in tested versions of libvirt
-    # (8.0.0 vs 6.0.0). Reload should be low overhead, so do it always.
-    libvirt_restart_handlers: >-
-      {{ ['Reload libvirtd']
-         if not enable_nova_libvirt_container | bool else
-         [] }}
diff --git a/ansible/roles/nova-cell/tasks/libvirt-cleanup.yml b/ansible/roles/nova-cell/tasks/libvirt-cleanup.yml
index 316e2cf4c..dda964865 100644
--- a/ansible/roles/nova-cell/tasks/libvirt-cleanup.yml
+++ b/ansible/roles/nova-cell/tasks/libvirt-cleanup.yml
@@ -15,7 +15,8 @@
       - nova_libvirt
   register: container_facts
 
-- block:
+- when: container_facts.containers['nova_libvirt'] is defined
+  block:
     # NOTE(mgoddard): pgrep exit status 1 means no match.
     - name: Check if there are any running VMs
       become: true
@@ -41,7 +42,6 @@
         common_options: "{{ docker_common_options }}"
         action: "stop_and_remove_container"
         name: nova_libvirt
-  when: container_facts.containers['nova_libvirt'] is defined
 
 - name: Remove nova_libvirt Docker volumes
   become: true
@@ -62,7 +62,9 @@
     state: "absent"
 
 # Revert the changes applied in config-host.yml.
-- block:
+- when:
+    - nova_compute_virt_type == 'kvm'
+  block:
     - name: Remove udev kolla kvm rules
       become: true
       file:
@@ -82,5 +84,3 @@
         masked: false
       when:
         - ansible_facts.distribution == 'Ubuntu'
-  when:
-    - nova_compute_virt_type == 'kvm'
diff --git a/ansible/roles/nova-cell/tasks/rabbitmq.yml b/ansible/roles/nova-cell/tasks/rabbitmq.yml
index e5eb4a15b..62cade447 100644
--- a/ansible/roles/nova-cell/tasks/rabbitmq.yml
+++ b/ansible/roles/nova-cell/tasks/rabbitmq.yml
@@ -1,6 +1,9 @@
 ---
 # Create RabbitMQ users and vhosts.
-- block:
+- when:
+    - nova_cell_rpc_transport == 'rabbit'
+    - enable_rabbitmq | bool
+  block:
     - import_role:
         name: service-rabbitmq
       vars:
@@ -23,7 +26,3 @@
       when:
         - nova_cell_rpc_group_name != nova_cell_notify_group_name or
           nova_cell_rpc_rabbitmq_users != nova_cell_notify_rabbitmq_users
-
-  when:
-    - nova_cell_rpc_transport == 'rabbit'
-    - enable_rabbitmq | bool
diff --git a/ansible/roles/nova-cell/tasks/version-check.yml b/ansible/roles/nova-cell/tasks/version-check.yml
index 5a339cc99..b66640587 100644
--- a/ansible/roles/nova-cell/tasks/version-check.yml
+++ b/ansible/roles/nova-cell/tasks/version-check.yml
@@ -1,5 +1,10 @@
 ---
-- block:
+- when: enable_nova_libvirt_container | bool and (groups[service.group] | length) > 0
+  vars:
+    service_name: "nova-libvirt"
+    service: "{{ nova_cell_services[service_name] }}"
+  tags: nova-libvirt-version-check
+  block:
     - name: Get new Libvirt version
       become: true
       kolla_container:
@@ -80,9 +85,3 @@
       loop_control:
         label: "{{ item.item }}"
       when: item.stdout is defined
-
-  tags: nova-libvirt-version-check
-  when: enable_nova_libvirt_container | bool and (groups[service.group] | length) > 0
-  vars:
-    service_name: "nova-libvirt"
-    service: "{{ nova_cell_services[service_name] }}"
diff --git a/ansible/roles/nova-cell/tasks/wait_discover_computes.yml b/ansible/roles/nova-cell/tasks/wait_discover_computes.yml
index 1603af5de..cded1381a 100644
--- a/ansible/roles/nova-cell/tasks/wait_discover_computes.yml
+++ b/ansible/roles/nova-cell/tasks/wait_discover_computes.yml
@@ -4,7 +4,23 @@
 # ironic compute services.
 # Work with --limit by including only hosts in ansible_play_batch.
 
-- block:
+- vars:
+    # For virt, use ansible_facts.nodename rather than inventory_hostname, since this
+    # is similar to what nova uses internally as its default for the
+    # [DEFAULT] host config option.
+    virt_compute_service_hosts: >-
+      {{ virt_computes_in_batch |
+         map('extract', hostvars, ['ansible_facts', 'nodename']) |
+         list }}
+    # For ironic, use {{ansible_facts.hostname}}-ironic since this is what we
+    # configure for [DEFAULT] host in nova.conf.
+    ironic_compute_service_hosts: >-
+      {{ ironic_computes_in_batch |
+         map('extract', hostvars) | json_query('[].nova_compute_ironic_custom_host || [].ansible_facts.hostname') |
+         map('regex_replace', '^(.*)$', '\1-ironic') |
+         list }}
+    expected_compute_service_hosts: "{{ virt_compute_service_hosts + ironic_compute_service_hosts }}"
+  block:
     - name: Waiting for nova-compute services to register themselves
       become: true
       command: >
@@ -67,22 +83,6 @@
         any_failed_services or
         (nova_compute_registration_fatal | bool and
          failed_compute_service_hosts | length > 0)
-  vars:
-    # For virt, use ansible_facts.nodename rather than inventory_hostname, since this
-    # is similar to what nova uses internally as its default for the
-    # [DEFAULT] host config option.
-    virt_compute_service_hosts: >-
-      {{ virt_computes_in_batch |
-         map('extract', hostvars, ['ansible_facts', 'nodename']) |
-         list }}
-    # For ironic, use {{ansible_facts.hostname}}-ironic since this is what we
-    # configure for [DEFAULT] host in nova.conf.
-    ironic_compute_service_hosts: >-
-      {{ ironic_computes_in_batch |
-         map('extract', hostvars) | json_query('[].nova_compute_ironic_custom_host || [].ansible_facts.hostname') |
-         map('regex_replace', '^(.*)$', '\1-ironic') |
-         list }}
-    expected_compute_service_hosts: "{{ virt_compute_service_hosts + ironic_compute_service_hosts }}"
 
 - name: Include discover_computes.yml
   include_tasks: discover_computes.yml
diff --git a/ansible/roles/nova/tasks/map_cell0.yml b/ansible/roles/nova/tasks/map_cell0.yml
index 429b2fb95..69a1204fd 100644
--- a/ansible/roles/nova/tasks/map_cell0.yml
+++ b/ansible/roles/nova/tasks/map_cell0.yml
@@ -1,5 +1,7 @@
 ---
-- block:
+- run_once: True
+  delegate_to: "{{ groups[nova_api.group][0] }}"
+  block:
     - name: Create cell0 mappings
       vars:
         nova_api: "{{ nova_services['nova-api'] }}"
@@ -61,8 +63,6 @@
       when:
         - nova_cell_settings | bool
         - nova_cell_settings.cell_database != nova_cell0_connection
-  run_once: True
-  delegate_to: "{{ groups[nova_api.group][0] }}"
 
 - include_tasks: bootstrap_service.yml
   when: map_cell0.changed
diff --git a/ansible/roles/octavia-certificates/tasks/main.yml b/ansible/roles/octavia-certificates/tasks/main.yml
index b7903972e..ee2fb5466 100644
--- a/ansible/roles/octavia-certificates/tasks/main.yml
+++ b/ansible/roles/octavia-certificates/tasks/main.yml
@@ -11,7 +11,8 @@
   include_tasks: check_expiry.yml
   when: octavia_certs_check_expiry | bool
 
-- block:
+- when: not octavia_certs_check_expiry | bool
+  block:
     - name: Ensure server_ca and client_ca directories exist
       file:
         path: "{{ octavia_certs_work_dir }}/{{ item }}"
@@ -47,5 +48,3 @@
         - { src: "server_ca/server_ca.key.pem", dest: "server_ca.key.pem" }
         - { src: "client_ca/client_ca.cert.pem", dest: "client_ca.cert.pem" }
         - { src: "client_ca/client.cert-and-key.pem", dest: "client.cert-and-key.pem" }
-
-  when: not octavia_certs_check_expiry | bool
diff --git a/ansible/roles/octavia/tasks/config.yml b/ansible/roles/octavia/tasks/config.yml
index 63910990c..c5c581240 100644
--- a/ansible/roles/octavia/tasks/config.yml
+++ b/ansible/roles/octavia/tasks/config.yml
@@ -102,8 +102,14 @@
   become: true
   with_dict: "{{ octavia_services | select_services_enabled_and_mapped_to_host }}"
 
-- block:
-
+- when: "'amphora' in octavia_provider_drivers"
+  vars:
+    octavia_amphora_keys:
+      - client.cert-and-key.pem
+      - client_ca.cert.pem
+      - server_ca.cert.pem
+      - server_ca.key.pem
+  block:
     - name: Copying over Octavia SSH key
       template:
         src: "octavia-ssh-key.j2"
@@ -148,11 +154,3 @@
       become: true
       when: service | service_enabled_and_mapped_to_host
       with_items: "{{ octavia_amphora_keys }}"
-
-  when: "'amphora' in octavia_provider_drivers"
-  vars:
-    octavia_amphora_keys:
-      - client.cert-and-key.pem
-      - client_ca.cert.pem
-      - server_ca.cert.pem
-      - server_ca.key.pem
diff --git a/ansible/roles/ovn-db/tasks/bootstrap-initial.yml b/ansible/roles/ovn-db/tasks/bootstrap-initial.yml
index fde729503..e620d92bd 100644
--- a/ansible/roles/ovn-db/tasks/bootstrap-initial.yml
+++ b/ansible/roles/ovn-db/tasks/bootstrap-initial.yml
@@ -1,7 +1,7 @@
 ---
 - name: Bootstrap new cluster
+  any_errors_fatal: true
   block:
-
     - name: Set bootstrap args fact for NB (new cluster)
       set_fact:
         ovn_nb_db_bootstrap_args: "{% if groups['ovn-nb-db'] | length > 1 and inventory_hostname != groups['ovn-nb-db'][0] %} --db-nb-cluster-remote-addr={{ 'api' | kolla_address(groups['ovn-nb-db'][0]) | put_address_in_context('url') }} {% endif %}"
@@ -79,5 +79,3 @@
       set_fact:
         ovn_nb_db_bootstrap_args:
         ovn_sb_db_bootstrap_args:
-
-  any_errors_fatal: true
diff --git a/ansible/roles/ovn-db/tasks/lookup_cluster.yml b/ansible/roles/ovn-db/tasks/lookup_cluster.yml
index 86b4aa13a..c387aaf3b 100644
--- a/ansible/roles/ovn-db/tasks/lookup_cluster.yml
+++ b/ansible/roles/ovn-db/tasks/lookup_cluster.yml
@@ -28,8 +28,9 @@
     ovn_sb_db_cluster_exists: "{{ groups['ovn-sb-db' + '_had_volume_True'] is defined }}"
 
 - name: OVN NB checks
+  any_errors_fatal: true
+  when: inventory_hostname in groups.get('ovn-nb-db_had_volume_True', '')
   block:
-
     - name: Check if running on all OVN NB DB hosts
       fail:
         msg: >
@@ -77,12 +78,10 @@
       when:
         - groups['ovn-nb-db_leader'] is not defined and groups['ovn-nb-db_follower'] is defined
 
-  any_errors_fatal: true
-  when: inventory_hostname in groups.get('ovn-nb-db_had_volume_True', '')
-
 - name: OVN SB checks
+  any_errors_fatal: true
+  when: inventory_hostname in groups.get('ovn-sb-db_had_volume_True', '')
   block:
-
     - name: Check if running on all OVN SB DB hosts
       fail:
         msg: >
@@ -129,6 +128,3 @@
         msg: OVN SB cluster exists but there is no leader - please check cluster status.
       when:
         - groups['ovn-sb-db_leader'] is not defined and groups['ovn-sb-db_follower'] is defined
-
-  any_errors_fatal: true
-  when: inventory_hostname in groups.get('ovn-sb-db_had_volume_True', '')
diff --git a/ansible/roles/prechecks/tasks/datetime_checks.yml b/ansible/roles/prechecks/tasks/datetime_checks.yml
index aea0aad0f..939d7d113 100644
--- a/ansible/roles/prechecks/tasks/datetime_checks.yml
+++ b/ansible/roles/prechecks/tasks/datetime_checks.yml
@@ -11,7 +11,8 @@
       settings and Kolla Ansible needs this file for mounting it to containers.
   when: not etc_localtime.stat.exists
 
-- block:
+- when: ansible_facts.os_family == 'Debian'
+  block:
     - name: Ensure /etc/timezone exist
       stat:
         path: /etc/timezone
@@ -23,4 +24,3 @@
           /etc/timezone is not found. This file is used for system-wide timezone
           settings and Kolla Ansible needs this file for mounting it to containers.
       when: not etc_timezone.stat.exists
-  when: ansible_facts.os_family == 'Debian'
diff --git a/ansible/roles/prechecks/tasks/timesync_checks.yml b/ansible/roles/prechecks/tasks/timesync_checks.yml
index c6a9bd2a0..e63563dad 100644
--- a/ansible/roles/prechecks/tasks/timesync_checks.yml
+++ b/ansible/roles/prechecks/tasks/timesync_checks.yml
@@ -1,5 +1,6 @@
 ---
-- block:
+- when: prechecks_enable_host_ntp_checks | bool
+  block:
     - name: Check for a running host NTP daemon  # noqa command-instead-of-module
       vars:
         prechecks_host_ntp_daemons:
@@ -44,4 +45,3 @@
           'timedatectl status'.
       when:
         - "'synchronized: yes' not in timedatectl_status.stdout"
-  when: prechecks_enable_host_ntp_checks | bool
diff --git a/ansible/roles/prometheus/tasks/config.yml b/ansible/roles/prometheus/tasks/config.yml
index 8c7ba5a6b..3bbc497b7 100644
--- a/ansible/roles/prometheus/tasks/config.yml
+++ b/ansible/roles/prometheus/tasks/config.yml
@@ -175,7 +175,11 @@
     - "{{ node_custom_config }}/prometheus/prometheus-blackbox-exporter.yml"
     - "{{ role_path }}/templates/prometheus-blackbox-exporter.yml.j2"
 
-- block:
+- vars:
+    base: "{{ node_custom_config }}/prometheus/"
+    service: "{{ prometheus_services['prometheus-server'] }}"
+  when: service | service_enabled_and_mapped_to_host
+  block:
     - name: Find extra prometheus server config files
       find:
         paths: "{{ node_custom_config }}/prometheus/extras/"
@@ -210,7 +214,3 @@
         dest: "{{ node_config_directory }}/prometheus-server/{{ relpath }}"
         mode: "0660"
       with_items: "{{ prometheus_config_extras_result.files | default([]) | map(attribute='path') | list }}"
-  vars:
-    base: "{{ node_custom_config }}/prometheus/"
-    service: "{{ prometheus_services['prometheus-server'] }}"
-  when: service | service_enabled_and_mapped_to_host
diff --git a/ansible/roles/rabbitmq/tasks/precheck.yml b/ansible/roles/rabbitmq/tasks/precheck.yml
index bc66f8a4f..240ccebb1 100644
--- a/ansible/roles/rabbitmq/tasks/precheck.yml
+++ b/ansible/roles/rabbitmq/tasks/precheck.yml
@@ -105,7 +105,11 @@
     - not kolla_externally_managed_cert | bool
     - rabbitmq_enable_tls | bool
 
-- block:
+- run_once: true
+  when:
+    - container_facts.containers['rabbitmq'] is defined
+  tags: rabbitmq-ha-precheck
+  block:
     - name: List RabbitMQ queues
       become: true
       command: "{{ kolla_container_engine }} exec rabbitmq rabbitmqctl list_queues --silent name type --formatter json"
@@ -155,8 +159,3 @@
       when:
         - item.name is search('_fanout')
         - om_enable_rabbitmq_stream_fanout | bool
-
-  run_once: true
-  when:
-    - container_facts.containers['rabbitmq'] is defined
-  tags: rabbitmq-ha-precheck
diff --git a/ansible/roles/rabbitmq/tasks/remove-ha-all-policy.yml b/ansible/roles/rabbitmq/tasks/remove-ha-all-policy.yml
index 71dc2b2a1..c05f75dd4 100644
--- a/ansible/roles/rabbitmq/tasks/remove-ha-all-policy.yml
+++ b/ansible/roles/rabbitmq/tasks/remove-ha-all-policy.yml
@@ -1,5 +1,10 @@
 ---
-- block:
+- delegate_to: "{{ groups[role_rabbitmq_groups] | first }}"
+  run_once: true
+  vars:
+    service_name: "rabbitmq"
+    service: "{{ rabbitmq_services[service_name] }}"
+  block:
     - name: Get container facts
       become: true
       kolla_container_facts:
@@ -9,7 +14,8 @@
           - "{{ service.container_name }}"
       register: container_facts
 
-    - block:
+    - when: container_facts.containers[service.container_name] is defined
+      block:
         - name: List RabbitMQ policies
           become: true
           command: "{{ kolla_container_engine }} exec {{ service.container_name }} rabbitmqctl list_policies --silent"
@@ -21,10 +27,3 @@
           command: "{{ kolla_container_engine }} exec {{ service.container_name }} rabbitmqctl clear_policy ha-all"
           when:
             - "'ha-all' in rabbitmq_policies.stdout"
-      when: container_facts.containers[service.container_name] is defined
-
-  delegate_to: "{{ groups[role_rabbitmq_groups] | first }}"
-  run_once: true
-  vars:
-    service_name: "rabbitmq"
-    service: "{{ rabbitmq_services[service_name] }}"
diff --git a/ansible/roles/rabbitmq/tasks/version-check.yml b/ansible/roles/rabbitmq/tasks/version-check.yml
index 946c876a0..daf1eb7dd 100644
--- a/ansible/roles/rabbitmq/tasks/version-check.yml
+++ b/ansible/roles/rabbitmq/tasks/version-check.yml
@@ -1,5 +1,11 @@
 ---
-- block:
+- delegate_to: "{{ groups[role_rabbitmq_groups] | first }}"
+  run_once: true
+  tags: rabbitmq-version-check
+  vars:
+    service_name: "rabbitmq"
+    service: "{{ rabbitmq_services[service_name] }}"
+  block:
     - name: Get container facts
       become: true
       kolla_container_facts:
@@ -9,7 +15,8 @@
           - "{{ service.container_name }}"
       register: container_facts
 
-    - block:
+    - when: container_facts.containers[service.container_name] is defined
+      block:
         - name: Get current RabbitMQ version
           become: true
           command: "{{ kolla_container_engine }} exec {{ service.container_name }} rabbitmqctl --version"
@@ -73,12 +80,3 @@
               If you're absolutely certain you want to do this, please skip the tag `rabbitmq-version-check`.
               Otherwise, see these docs for how to pin the version of RabbitMQ:
               https://docs.openstack.org/kolla-ansible/latest/reference/message-queues/rabbitmq.html#rabbitmq-versions
-
-      when: container_facts.containers[service.container_name] is defined
-
-  delegate_to: "{{ groups[role_rabbitmq_groups] | first }}"
-  run_once: true
-  tags: rabbitmq-version-check
-  vars:
-    service_name: "rabbitmq"
-    service: "{{ rabbitmq_services[service_name] }}"
diff --git a/ansible/roles/service-image-info/tasks/main.yml b/ansible/roles/service-image-info/tasks/main.yml
index 9027bf302..df5c39dd5 100644
--- a/ansible/roles/service-image-info/tasks/main.yml
+++ b/ansible/roles/service-image-info/tasks/main.yml
@@ -1,5 +1,8 @@
 ---
 - name: Get target image info (docker)
+  become: true
+  delegate_to: "{{ service_image_info_delegate_host }}"
+  when: kolla_container_engine == 'docker'
   block:
     - community.docker.docker_image_info:
         name: "{{ service.image }}"
@@ -8,11 +11,11 @@
     - set_fact:
         service_image_info: "{{ docker_image_info }}"
       delegate_facts: true
-  become: true
-  delegate_to: "{{ service_image_info_delegate_host }}"
-  when: kolla_container_engine == 'docker'
 
 - name: Get target image info (podman)
+  become: true
+  delegate_to: "{{ service_image_info_delegate_host }}"
+  when: kolla_container_engine == 'podman'
   block:
     - containers.podman.podman_image_info:
         name: "{{ service.image }}"
@@ -21,6 +24,3 @@
     - set_fact:
         service_image_info: "{{ podman_image_info }}"
       delegate_facts: true
-  become: true
-  delegate_to: "{{ service_image_info_delegate_host }}"
-  when: kolla_container_engine == 'podman'
diff --git a/ansible/roles/service-rabbitmq/tasks/main.yml b/ansible/roles/service-rabbitmq/tasks/main.yml
index bc1cb2c7d..dcdc7d5da 100644
--- a/ansible/roles/service-rabbitmq/tasks/main.yml
+++ b/ansible/roles/service-rabbitmq/tasks/main.yml
@@ -1,5 +1,11 @@
 ---
-- block:
+- become: true
+  delegate_to: "{{ service_rabbitmq_delegate_host }}"
+  run_once: "{{ service_rabbitmq_run_once }}"
+  when: service_rabbitmq_when | bool
+  tags:
+    - service-rabbitmq
+  block:
     - name: "{{ project_name }} | Ensure RabbitMQ vhosts exist"
       kolla_toolbox:
         container_engine: "{{ kolla_container_engine }}"
@@ -36,10 +42,3 @@
       retries: "{{ service_rabbitmq_retries }}"
       delay: "{{ service_rabbitmq_delay }}"
       no_log: True
-
-  become: true
-  when: service_rabbitmq_when | bool
-  delegate_to: "{{ service_rabbitmq_delegate_host }}"
-  run_once: "{{ service_rabbitmq_run_once }}"
-  tags:
-    - service-rabbitmq
diff --git a/ansible/roles/valkey/tasks/upgrade.yml b/ansible/roles/valkey/tasks/upgrade.yml
index 0cae1ce26..0fa733887 100644
--- a/ansible/roles/valkey/tasks/upgrade.yml
+++ b/ansible/roles/valkey/tasks/upgrade.yml
@@ -15,6 +15,7 @@
     _valkey_migration: "{{ redis_container_facts.containers['redis'] is defined }}"
 
 - name: Perform Redis to Valkey migration steps
+  when: redis_container_facts.containers['redis'] is defined
   block:
 
     - name: Set temporary Valkey migration vars
@@ -110,8 +111,6 @@
         name: redis
       when: inventory_hostname in groups['redis']
 
-  when: redis_container_facts.containers['redis'] is defined
-
 # These tasks run always, regardless of Redis presence
 
 - name: Reset Valkey port to default (6379) after migration
diff --git a/ansible/site.yml b/ansible/site.yml
index ae5f281cb..8d742462b 100644
--- a/ansible/site.yml
+++ b/ansible/site.yml
@@ -143,7 +143,10 @@
   roles:
     - { role: loadbalancer }
   tasks:
-    - block:
+    - when:
+        - enable_haproxy | bool
+        - kolla_action in ['deploy', 'reconfigure', 'upgrade', 'config']
+      block:
         - include_role:
             name: aodh
             tasks_from: loadbalancer
@@ -341,9 +344,6 @@
             name: loadbalancer
             tasks_from: check-containers
           when: kolla_action != 'config'
-      when:
-        - enable_haproxy | bool
-        - kolla_action in ['deploy', 'reconfigure', 'upgrade', 'config']
 
 - name: Apply role opensearch
   gather_facts: false