ansible-lint: Rework validate-all-file into custom rules

Test roles/ subdirectories as well (used by Zuul)

In addition to that container_exec_become will also
fail when "docker exec" or "podman exec" will be used
instead of "{{ kolla_container_engine }} exec"

Generated-By: Claude

Change-Id: I75c1e48c36bb0284e2927b1cb354ce9ec47967d7
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>

18 files changed, 117 insertions, 47 deletions

diff --git a/roles/bridge/tasks/main.yml b/roles/bridge/tasks/main.yml
index f96c19e4f..a764d41f2 100644
--- a/roles/bridge/tasks/main.yml
+++ b/roles/bridge/tasks/main.yml
@@ -1,12 +1,18 @@
 ---
 - name: Create bridge
   become: true
-  command: ip link add {{ bridge_name }} type bridge
+  changed_when: true
+  ansible.builtin.command:
+    cmd: ip link add {{ bridge_name }} type bridge
 
 - name: Bring bridge interface up
   become: true
-  command: ip link set {{ bridge_name }} up
+  changed_when: true
+  ansible.builtin.command:
+    cmd: ip link set {{ bridge_name }} up
 
 - name: Add member interface to bridge
   become: true
-  command: ip link set {{ bridge_member_name }} master {{ bridge_name }}
+  changed_when: true
+  ansible.builtin.command:
+    cmd: ip link set {{ bridge_member_name }} master {{ bridge_name }}
diff --git a/roles/cephadm/tasks/main.yml b/roles/cephadm/tasks/main.yml
index 63ba7b0e3..7f0133779 100644
--- a/roles/cephadm/tasks/main.yml
+++ b/roles/cephadm/tasks/main.yml
@@ -1,39 +1,43 @@
 ---
-- include_tasks: pkg_{{ ansible_os_family | lower }}.yml
+- name: Include package installation
+  include_tasks: pkg_{{ ansible_os_family | lower }}.yml
 
 - name: Ensure /etc/ceph exists
   file:
     path: /etc/ceph
     state: directory
-  become: True
+    mode: "0755"
+  become: true
 
 - name: Generate ssh key for cephadm
   openssh_keypair:
     path: "/etc/ceph/cephadm.id"
+    mode: "0600"
     size: 4096
     comment: "cephadm"
-  become: True
+  become: true
   register: cephadm_ssh_key
 
 - name: Save public key
   copy:
     content: "{{ cephadm_ssh_key.public_key }}"
     dest: /etc/ceph/cephadm.pub
-  become: True
+    mode: "0644"
+  become: true
 
 - name: Copy cephadm public key to all hosts
   authorized_key:
     user: root
     state: present
     key: "{{ cephadm_ssh_key.public_key }}"
-  become: True
+  become: true
   with_inventory_hostnames:
     - all
   delegate_to: "{{ item }}"
 
 - name: Bootstrap cephadm
   vars:
-    mon_ip: "{{ hostvars[inventory_hostname]['ansible_' + api_interface_name | replace('-','_')].ipv4.address }}"
+    mon_ip: "{{ hostvars[inventory_hostname]['ansible_' + api_interface_name | replace('-', '_')].ipv4.address }}"
   command:
     cmd: >
          cephadm
@@ -46,7 +50,8 @@
          --skip-firewalld
          --log-to-file
          --mon-ip {{ mon_ip }}
-  become: True
+  become: true
+  changed_when: true
   register: cephadm_bootstrap_output
 
 - name: Get ceph fsid
@@ -59,20 +64,23 @@
   template:
     src: templates/cephadm.yml.j2
     dest: "/var/run/ceph/{{ ceph_fsid }}/cluster.yml"
-  become: True
+    mode: "0600"
+  become: true
 
 - name: Template out command spec
   template:
     src: templates/commands.sh.j2
     dest: "/var/run/ceph/{{ ceph_fsid }}/commands.sh"
-  become: True
+    mode: "0600"
+  become: true
 
 - name: Run commands
   command:
     cmd: >
          cephadm shell --
          bash -x /var/run/ceph/commands.sh
-  become: True
+  become: true
+  changed_when: true
 
 # TODO(mnasiadka): Fix merge_configs to support tabs
 - name: Generate ceph.conf without tabs
@@ -80,8 +88,9 @@
     ceph_conf_fixed: |
       [global]
       fsid = {{ ceph_fsid }}
-      mon_host = {% for host in groups['all'] %} {{ hostvars[host]['ansible_' + api_interface_name | replace('-','_')].ipv4.address }} {% if not loop.last %},{% endif %} {% endfor %}
+      mon_host = {% for host in groups['all'] %} {{ hostvars[host]['ansible_' + api_interface_name | replace('-', '_')].ipv4.address }} {% if not loop.last %},{% endif %} {% endfor %}
   copy:
     content: "{{ ceph_conf_fixed }}"
     dest: "/etc/ceph/ceph.conf.fixed"
-  become: True
+    mode: "0644"
+  become: true
diff --git a/roles/cephadm/tasks/pkg_debian.yml b/roles/cephadm/tasks/pkg_debian.yml
index da1747982..92dd08221 100644
--- a/roles/cephadm/tasks/pkg_debian.yml
+++ b/roles/cephadm/tasks/pkg_debian.yml
@@ -1,23 +1,23 @@
 ---
 - name: Ensure apt sources list directory exists
+  become: true
   file:
     path: /etc/apt/sources.list.d
     state: directory
-    recurse: yes
-  become: True
+    recurse: true
 
 - name: Enable Ceph apt repository
+  become: true
   apt_repository:
     repo: "{{ cephadm_ceph_apt_repo }}"
     filename: ceph
-  become: True
   when: not cephadm_use_package_from_distribution | bool
 
 - name: Install cephadm
+  become: true
   apt:
     name:
       - cephadm
       - python3-jinja2
       - python3-yaml
-    install_recommends: False
-  become: True
+    install_recommends: false
diff --git a/roles/cephadm/tasks/pkg_redhat.yml b/roles/cephadm/tasks/pkg_redhat.yml
index af8c747b8..9f679c9f1 100644
--- a/roles/cephadm/tasks/pkg_redhat.yml
+++ b/roles/cephadm/tasks/pkg_redhat.yml
@@ -1,32 +1,32 @@
 ---
 - name: Ensure yum repos directory exists
+  become: true
   file:
     path: /etc/yum.repos.d/
     state: directory
-    recurse: yes
-  become: True
+    recurse: true
 
 - name: Install centos-release-ceph
+  become: true
   dnf:
     name: "centos-release-ceph-{{ cephadm_ceph_release }}"
-  become: True
   when: cephadm_use_package_from_distribution
 
 - name: Enable Ceph base yum repository
+  become: true
   yum_repository:
     name: "{{ item.shortname }}"
     description: "{{ item.name }}"
     baseurl: "{{ item.url }}"
     gpgkey: "{{ cephadm_ceph_rpm_gpg_key }}"
   loop: "{{ cephadm_ceph_rpm_repos }}"
-  become: True
   when: not cephadm_use_package_from_distribution
 
 # NOTE(mnasiadka): cephadm bootstrap failing on jinja2 missing
 - name: Install cephadm and jinja2
+  become: true
   dnf:
     name:
       - cephadm
       - python3-jinja2
-    install_weak_deps: False
-  become: True
+    install_weak_deps: false
diff --git a/roles/kolla-ansible-deploy-bifrost/tasks/main.yml b/roles/kolla-ansible-deploy-bifrost/tasks/main.yml
index 5b510da40..98254d321 100644
--- a/roles/kolla-ansible-deploy-bifrost/tasks/main.yml
+++ b/roles/kolla-ansible-deploy-bifrost/tasks/main.yml
@@ -6,4 +6,4 @@
       kolla-ansible deploy-bifrost
       -i /etc/kolla/inventory
       >/tmp/logs/ansible/deploy-bifrost 2>&1
-
+  changed_when: true
diff --git a/roles/kolla-ansible-deploy/tasks/certificates.yml b/roles/kolla-ansible-deploy/tasks/certificates.yml
index 6296a1dbe..42910bc67 100644
--- a/roles/kolla-ansible-deploy/tasks/certificates.yml
+++ b/roles/kolla-ansible-deploy/tasks/certificates.yml
@@ -7,6 +7,7 @@
      -i /etc/kolla/inventory
      -vvv
      >/tmp/logs/ansible/certificates 2>&1
+  changed_when: true
 
 - name: Init pebble when Lets Encrypt is enabled
   when: (le_enabled | default(False)) | bool
@@ -30,10 +31,12 @@
       become: true
       ansible.builtin.command:
         cmd: "docker cp pebble:/test/certs/pebble.minica.pem /etc/kolla/certificates/ca/pebble-root.crt"
+      changed_when: true
 
     - name: "Fetch pebble.crt and store it in /etc/kolla/certificates/ca/"
       become: true
       ansible.builtin.get_url:
         url: "https://127.0.0.1:15000/roots/0"
         dest: "/etc/kolla/certificates/ca/pebble.crt"
+        mode: "0644"
         validate_certs: false
diff --git a/roles/kolla-ansible-deploy/tasks/deploy.yml b/roles/kolla-ansible-deploy/tasks/deploy.yml
index 771006735..eb7637bd4 100644
--- a/roles/kolla-ansible-deploy/tasks/deploy.yml
+++ b/roles/kolla-ansible-deploy/tasks/deploy.yml
@@ -7,6 +7,7 @@
       -i /etc/kolla/inventory
       -vvv
       >/tmp/logs/ansible/deploy-prechecks 2>&1
+  changed_when: false
 
 - name: Run kolla-ansible pull
   ansible.builtin.shell:
@@ -16,6 +17,7 @@
       -i /etc/kolla/inventory
       -vvv
       >/tmp/logs/ansible/pull 2>&1
+  changed_when: true
 
 - name: Run kolla-ansible deploy
   ansible.builtin.shell:
@@ -25,6 +27,7 @@
       -i /etc/kolla/inventory
       -vvv
       >/tmp/logs/ansible/deploy 2>&1
+  changed_when: true
 
 - name: Run kolla-ansible post-deploy
   ansible.builtin.shell:
@@ -34,6 +37,7 @@
       -i /etc/kolla/inventory
       -vvv
       >/tmp/logs/ansible/post-deploy 2>&1
+  changed_when: true
 
 - name: Run kolla-ansible validate-config
   ansible.builtin.shell:
@@ -43,6 +47,7 @@
       -i /etc/kolla/inventory
       -vvv
       >/tmp/logs/ansible/validate-config 2>&1
+  changed_when: false
   when: not is_upgrade | bool
 
 - name: Run kolla-ansible check
@@ -53,3 +58,4 @@
       -i /etc/kolla/inventory
       -vvv
       >/tmp/logs/ansible/check 2>&1
+  changed_when: false
diff --git a/roles/kolla-ansible-deploy/tasks/main.yml b/roles/kolla-ansible-deploy/tasks/main.yml
index e02765d99..b2ec759cc 100644
--- a/roles/kolla-ansible-deploy/tasks/main.yml
+++ b/roles/kolla-ansible-deploy/tasks/main.yml
@@ -7,5 +7,8 @@
     mode: "0777"
     recurse: true
 
-- import_tasks: certificates.yml
-- import_tasks: deploy.yml
+- name: Import certificates.yml
+  import_tasks: certificates.yml
+
+- name: Import deploy.yml
+  import_tasks: deploy.yml
diff --git a/roles/kolla-ansible-reconfigure/tasks/main.yml b/roles/kolla-ansible-reconfigure/tasks/main.yml
index 9cc0f1416..287c3688b 100644
--- a/roles/kolla-ansible-reconfigure/tasks/main.yml
+++ b/roles/kolla-ansible-reconfigure/tasks/main.yml
@@ -7,6 +7,7 @@
       -i /etc/kolla/inventory
       -vvv
       >/tmp/logs/ansible/reconfigure-prechecks 2>&1
+  changed_when: false
 
 - name: Remove OVN DB containers and volumes on primary to test recreation (docker)
   become: true
@@ -42,8 +43,9 @@
     # NOTE(blanson): there is apparently no module to do that (!?)
     - name: List docker containers
       ansible.builtin.command:
-        cmd: "docker ps --format '{{'{{'}}.Names{{'}}'}}'"
+        cmd: "docker ps --format '{{ '{{' }}.Names{{ '}}' }}'"
       register: _deploy_docker_ps_raw
+      changed_when: false
 
     - name: Get details of all containers on host
       community.docker.docker_container_info:
@@ -137,6 +139,7 @@
       -i /etc/kolla/inventory
       -vvv
       >/tmp/logs/ansible/reconfigure 2>&1
+  changed_when: true
 
 - name: "Capture state of containers post reconfigure (docker)"
   become: true
@@ -149,8 +152,9 @@
   block:
     - name: List docker containers
       ansible.builtin.command:
-        cmd: "docker ps --format '{{'{{'}}.Names{{'}}'}}'"
+        cmd: "docker ps --format '{{ '{{' }}.Names{{ '}}' }}'"
       register: _reconfigure_docker_ps_raw
+      changed_when: false
 
     - name: Get details of all containers on host
       community.docker.docker_container_info:
diff --git a/roles/kolla-ansible-setup-disks/tasks/main.yml b/roles/kolla-ansible-setup-disks/tasks/main.yml
index e4e25f736..49c9c31e8 100644
--- a/roles/kolla-ansible-setup-disks/tasks/main.yml
+++ b/roles/kolla-ansible-setup-disks/tasks/main.yml
@@ -15,8 +15,9 @@
 
 - name: Get free loop device
   become: true
-  ansible.builtin.shell:
+  ansible.builtin.command:
     cmd: "losetup -f"
+  changed_when: false
   register: _loop_device
 
 - name: Mount file on loop device
@@ -25,6 +26,7 @@
     cmd: >
       losetup {{ _loop_device.stdout }}
       {{ kolla_ansible_setup_disks_file_path }}
+  changed_when: true
 
 - name: Create LVM extents on loop device
   become: true
diff --git a/roles/kolla-ansible-tempest/tasks/main.yml b/roles/kolla-ansible-tempest/tasks/main.yml
index 5476b1183..315c33213 100644
--- a/roles/kolla-ansible-tempest/tasks/main.yml
+++ b/roles/kolla-ansible-tempest/tasks/main.yml
@@ -14,6 +14,8 @@
     creates: "/home/zuul/tempest"
 
 - name: Discover tempest config
+  environment:
+    OS_CLIENT_CONFIG_FILE: "/etc/kolla/clouds.yaml"
   vars:
     ver: "{{ kolla_ansible_tempest_cirros_ver }}"
     image: "https://download.cirros-cloud.net/{{ ver }}/cirros-{{ ver }}-x86_64-disk.img"
@@ -26,8 +28,7 @@
       --os-cloud kolla-admin
       compute.build_timeout {{ kolla_ansible_tempest_build_timeout }}
       >/tmp/logs/ansible/test-init-tempest-discover 2>&1
-  environment:
-    OS_CLIENT_CONFIG_FILE: "/etc/kolla/clouds.yaml"
+  changed_when: false
 
 - name: Run tempest tests
   environment:
@@ -49,3 +50,4 @@
       --exclude-regex '{{ kolla_ansible_tempest_exclude_regex | join("|") }}'
       {% endif %}
       >/tmp/logs/ansible/{{ tempest_log_file }} 2>&1
+  changed_when: true
diff --git a/roles/kolla-ansible-test-bifrost/tasks/main.yml b/roles/kolla-ansible-test-bifrost/tasks/main.yml
index 431aed584..90851504a 100644
--- a/roles/kolla-ansible-test-bifrost/tasks/main.yml
+++ b/roles/kolla-ansible-test-bifrost/tasks/main.yml
@@ -5,6 +5,7 @@
     cmd: >
       {{ container_engine }} exec bifrost_deploy
       bash -c 'OS_CLOUD=bifrost baremetal driver list'
+  changed_when: false
   register: bdl
   until: bdl.rc == 0
   retries: 5
@@ -16,6 +17,7 @@
     cmd: >
       {{ container_engine }} exec bifrost_deploy
       bash -c 'OS_CLOUD=bifrost baremetal node list'
+  changed_when: false
 
 - name: Create baremetal node
   become: true
@@ -24,6 +26,7 @@
       {{ container_engine }} exec bifrost_deploy
       bash -c 'OS_CLOUD=bifrost baremetal node create
       --driver redfish --name test-node'
+  changed_when: true
 
 - name: Delete baremetal node
   become: true
@@ -32,4 +35,4 @@
       {{ container_engine }} exec bifrost_deploy
       bash -c 'OS_CLOUD=bifrost baremetal node delete
       test-node'
-
+  changed_when: true
diff --git a/roles/kolla-ansible-test-dashboard/tasks/main.yml b/roles/kolla-ansible-test-dashboard/tasks/main.yml
index 534769182..b55f5078d 100644
--- a/roles/kolla-ansible-test-dashboard/tasks/main.yml
+++ b/roles/kolla-ansible-test-dashboard/tasks/main.yml
@@ -32,11 +32,13 @@
       ansible.builtin.file:
         path: "/home/zuul/testinfra"
         state: directory
+        mode: "0755"
 
     - name: Ensure screenshots directory exists
       ansible.builtin.file:
         path: "/home/zuul/testinfra/screenshots"
         state: directory
+        mode: "0755"
 
     - name: Ensure required packages are installed
       ansible.builtin.pip:
@@ -88,3 +90,4 @@
           --html=/home/zuul/testinfra/test-results-testinfra.html --self-contained-html
           -v tests/testinfra
         chdir: "{{ zuul.project.src_dir }}"
+      changed_when: false
diff --git a/roles/kolla-ansible-upgrade-bifrost/tasks/main.yml b/roles/kolla-ansible-upgrade-bifrost/tasks/main.yml
index ac8d11c1c..77ece6975 100644
--- a/roles/kolla-ansible-upgrade-bifrost/tasks/main.yml
+++ b/roles/kolla-ansible-upgrade-bifrost/tasks/main.yml
@@ -6,3 +6,4 @@
       kolla-ansible deploy-bifrost
       -i /etc/kolla/inventory
       >/tmp/logs/ansible/upgrade-bifrost 2>&1
+  changed_when: true
diff --git a/roles/kolla-ansible-upgrade/tasks/main.yml b/roles/kolla-ansible-upgrade/tasks/main.yml
index c66e06fe2..87b3c8fae 100644
--- a/roles/kolla-ansible-upgrade/tasks/main.yml
+++ b/roles/kolla-ansible-upgrade/tasks/main.yml
@@ -7,6 +7,7 @@
      -i /etc/kolla/inventory
      -vvv
      >/tmp/logs/ansible/upgrade-certificates 2>&1
+  changed_when: true
 
 # NOTE(mnasiadka): Need to run bootstrap before upgrade
 - name: Run kolla-ansible bootstrap-servers
@@ -17,6 +18,7 @@
      -i /etc/kolla/inventory
      -vvv
      >/tmp/logs/ansible/upgrade-bootstrap 2>&1
+  changed_when: true
 
 - name: Run kolla-ansible prechecks
   ansible.builtin.shell:
@@ -26,6 +28,7 @@
       -i /etc/kolla/inventory
       -vvv
       >/tmp/logs/ansible/upgrade-prechecks 2>&1
+  changed_when: false
 
 - name: Run kolla-ansible pull
   ansible.builtin.shell:
@@ -35,6 +38,7 @@
       -i /etc/kolla/inventory
       -vvv
       >/tmp/logs/ansible/upgrade-pull 2>&1
+  changed_when: true
 
 - name: Run kolla-ansible upgrade
   ansible.builtin.shell:
@@ -44,6 +48,7 @@
       -i /etc/kolla/inventory
       -vvv
       >/tmp/logs/ansible/upgrade 2>&1
+  changed_when: true
 
 - name: Run kolla-ansible post-deploy
   ansible.builtin.shell:
@@ -53,6 +58,7 @@
       -i /etc/kolla/inventory
       -vvv
       >/tmp/logs/ansible/upgrade-post-deploy 2>&1
+  changed_when: true
 
 - name: Run kolla-ansible validate-config on upgrades
   ansible.builtin.shell:
@@ -62,4 +68,4 @@
       -i /etc/kolla/inventory
       -vvv
       >/tmp/logs/ansible/upgrade-validate-config 2>&1
-
+  changed_when: false
diff --git a/roles/multi-node-managed-addressing/tasks/main.yml b/roles/multi-node-managed-addressing/tasks/main.yml
index dcf189905..925468b8b 100644
--- a/roles/multi-node-managed-addressing/tasks/main.yml
+++ b/roles/multi-node-managed-addressing/tasks/main.yml
@@ -21,13 +21,17 @@
     # broadcast address as ansible picks up scope ('global') as the interface's
     # broadcast address which fails checks logic
     managed_network_broadcast_address: "{{ managed_network_cidr | ansible.utils.ipaddr('broadcast') }}"
-  command: ip address add {{ managed_network_cidr }} broadcast {{ managed_network_broadcast_address }} dev {{ managed_interface_name }}
+  ansible.builtin.command:
+    cmd: ip address add {{ managed_network_cidr }} broadcast {{ managed_network_broadcast_address }} dev {{ managed_interface_name }}
+  changed_when: true
   when: managed_network_address_family == 'ipv4'
 
 # NOTE(yoctozepto): IPv6 has no broadcast address, let's not create confusion by setting it
 - name: Add IPv6 address for managed network
   become: true
-  command: ip address add {{ managed_interface_address }}/{{ managed_network_prefix_length }} dev {{ managed_interface_name }}
+  ansible.builtin.command:
+    cmd: ip address add {{ managed_interface_address }}/{{ managed_network_prefix_length }} dev {{ managed_interface_name }}
+  changed_when: true
   when: managed_network_address_family == 'ipv6'
 
 - name: Accept traffic on the managed network (IN)
@@ -57,7 +61,9 @@
 # hence we only check whether it's no longer tentative
 - name: Ensure IPv6 addresses on the managed interface are no longer tentative
   become: true
-  command: ip -o address show tentative dev {{ managed_interface_name }}
+  ansible.builtin.command:
+    cmd: ip -o address show tentative dev {{ managed_interface_name }}
+  changed_when: false
   register: tentative_addresses
   until: tentative_addresses.stdout == ''
   retries: 30
@@ -69,5 +75,7 @@
   become: true
   vars:
     ping_command: "{{ 'ping' if managed_network_address_family == 'ipv4' else 'ping6' }}"
-  command: "{{ ping_command }} -c1 {{ hostvars[item].managed_interface_address }}"
+  ansible.builtin.command:
+    cmd: "{{ ping_command }} -c1 {{ hostvars[item].managed_interface_address }}"
+  changed_when: false
   with_inventory_hostnames: all
diff --git a/roles/multi-node-vxlan-overlay/tasks/main.yml b/roles/multi-node-vxlan-overlay/tasks/main.yml
index 6a169a13f..27ae67bab 100644
--- a/roles/multi-node-vxlan-overlay/tasks/main.yml
+++ b/roles/multi-node-vxlan-overlay/tasks/main.yml
@@ -21,7 +21,9 @@
 
 - name: Create VXLAN interface
   become: true
-  command: ip link add {{ vxlan_interface_name }} type vxlan id {{ vxlan_vni }} local {{ tunnel_local_address }} dstport {{ vxlan_dstport }}
+  ansible.builtin.command:
+    cmd: ip link add {{ vxlan_interface_name }} type vxlan id {{ vxlan_vni }} local {{ tunnel_local_address }} dstport {{ vxlan_dstport }}
+  changed_when: true
 
 - name: Set VXLAN interface MTU
   become: true
@@ -35,17 +37,23 @@
           first }}
     # Allow 50 bytes overhead for VXLAN headers.
     mtu: "{{ parent_interface.mtu | int - 50 }}"
-  command: ip link set {{ vxlan_interface_name }} mtu {{ mtu }}
+  ansible.builtin.command:
+    cmd: ip link set {{ vxlan_interface_name }} mtu {{ mtu }}
+  changed_when: true
 
 # emulate BUM by multiplicating traffic to unicast targets
 - name: Add fdb entries for BUM traffic
   become: true
   vars:
     dest_ip: "{{ hostvars[item].tunnel_local_address }}"
-  command: bridge fdb append 00:00:00:00:00:00 dev {{ vxlan_interface_name }} dst {{ dest_ip }}
+  ansible.builtin.command:
+    cmd: bridge fdb append 00:00:00:00:00:00 dev {{ vxlan_interface_name }} dst {{ dest_ip }}
+  changed_when: true
   with_inventory_hostnames: all
   when: item != inventory_hostname
 
 - name: Bring VXLAN interface up
   become: true
-  command: ip link set {{ vxlan_interface_name }} up
+  ansible.builtin.command:
+    cmd: ip link set {{ vxlan_interface_name }} up
+  changed_when: true
diff --git a/roles/veth/tasks/main.yml b/roles/veth/tasks/main.yml
index 034fec675..2b5556dbe 100644
--- a/roles/veth/tasks/main.yml
+++ b/roles/veth/tasks/main.yml
@@ -1,12 +1,18 @@
 ---
 - name: Create veth pair
   become: true
-  command: ip link add {{ veth_pair.0 }} type veth peer name {{ veth_pair.1 }}
+  ansible.builtin.command:
+    cmd: ip link add {{ veth_pair.0 }} type veth peer name {{ veth_pair.1 }}
+  changed_when: true
 
 - name: Bring veth pair up
   become: true
-  shell: ip link set {{ veth_pair.0 }} up && ip link set {{ veth_pair.1 }} up
+  ansible.builtin.shell:
+    cmd: ip link set {{ veth_pair.0 }} up && ip link set {{ veth_pair.1 }} up
+  changed_when: true
 
 - name: Add first veth pair port to bridge
   become: true
-  command: ip link set {{ veth_pair.0 }} master {{ bridge_name }}
+  ansible.builtin.command:
+    cmd: ip link set {{ veth_pair.0 }} master {{ bridge_name }}
+  changed_when: true