Member OP
I ran my ansible playbook with --check first (I thought) but it still deleted /var/www on the production server. Turns out I typed `-C` in the wrong place? The inventory file said [test] but the IPs inside were production. Im still confused how --check failed. Playbook was for test environment only.
Is there a way to make check mode absolutely bulletproof? Sorry if this is dumb
Hej, on server you have check_mode: no in task? No matter flag then. Into config put check_mode: yes, force it. No worry, malý server recover from backup, no?
Member
(oh honey) (the flag wasn't the problem (well, it was (but not the root cause))) (you had a process failure) (inventory management (who labeled it)) (change control (who approved the IPs)) (the playbook ran where it was pointed (which is what automation does (ruthlessly (beautifully))))
(I've seen --check fail on handlers (which still fire (nested nightmare))) (never trust alone (always diff (always dry-run in container first)))
This is exactly why I treat infrastructure automation like email authentication. For what it's worth, you need multiple independent checks, not one flag. SPF can pass and mail still spoofs. --check can pass and production still burns.
Separate your inventory files physically. Test hostnames resolve to RFC5737 ranges only. Blocklist production IPs at CI level. Your playbook didn't fail. Your pipeline did.
However, if the inventory file itself contains incorrect IP addresses, the check mode will validate against those incorrect targets itself.
Kindly implement pre-flight validation for inventory files. Dear @nate_pad, this is not a dumb question at all.
