All playbooks must follow these rules.

Ansible keywords

Use the keywords below.

Keyword

Applies to

Why

no_log: true

Tasks touching keys, passwords, or certificates

Prevents secrets in logs

block: / always:

Cleanup

Runs cleanup after ordinary task failures in the block

gather_facts: false

Unless facts are needed

Faster execution

Do not use post_tasks: for cleanup as it does not run after a fatal task failure.

Parameters expansion

In commands that accept external values, use the argv: list form to avoid command-string parsing. With Ansible Core 2.16 or later, also use expand_argument_vars: false to prevent controller-side $VAR expansion. For example:

- name: Verify certificate is valid
ansible.builtin.command:
expand_argument_vars: false
argv:
- openssl
- x509
- -in
- "{{ cert_path }}"
- -noout
- -dates
register: cert_verify
changed_when: false
when: has_cert_pem | default(false) | bool

Idempotent tasks

Always use idempotent tasks because the platform may retry on transient failures.