Skip to content

Commit 20505c0

Browse files
authored
decrypt secrets even in check_mode (splunk#213)
to avoid false "changed" positives when running in check_mode we always need to extract and decrypt the secrect
1 parent b29fae9 commit 20505c0

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

roles/splunk/tasks/check_decrypted_secret.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
become: true
66
become_user: "{{ splunk_nix_user }}"
77
changed_when: false
8+
check_mode: false
89
no_log: true
910

1011
- name: "Decrypt {{ req_secret_option }} of {{ req_secret_conf }}.conf [{{ req_secret_section }}]"
@@ -13,5 +14,6 @@
1314
become: true
1415
no_log: true
1516
changed_when: false
17+
check_mode: false
1618
when:
1719
- encrypted_secret_value.rc == 0 and encrypted_secret_value.stdout != ""

0 commit comments

Comments
 (0)