project: resolve ansible-lint key-order rule (#10314)

Signed-off-by: Arthur Outhenin-Chalandre <arthur.outhenin-chalandre@proton.ch>

roles/kubernetes/control-plane/tasks/kubeadm-setup.yml

@@ -109,6 +109,12 @@
   loop: "{{ kube_apiserver_enable_admission_plugins }}"
 
 - name: Kubeadm | Check apiserver.crt SANs
+  vars:
+    apiserver_ips: "{{ apiserver_sans | map('ipaddr') | reject('equalto', False) | list }}"
+    apiserver_hosts: "{{ apiserver_sans | difference(apiserver_ips) }}"
+  when:
+    - kubeadm_already_run.stat.exists
+    - not kube_external_ca_mode
   block:
     - name: Kubeadm | Check apiserver.crt SAN IPs
       command:
@@ -122,12 +128,6 @@
       loop: "{{ apiserver_hosts }}"
       register: apiserver_sans_host_check
       changed_when: apiserver_sans_host_check.stdout is not search('does match certificate')
-  vars:
-    apiserver_ips: "{{ apiserver_sans | map('ipaddr') | reject('equalto', False) | list }}"
-    apiserver_hosts: "{{ apiserver_sans | difference(apiserver_ips) }}"
-  when:
-    - kubeadm_already_run.stat.exists
-    - not kube_external_ca_mode
 
 - name: Kubeadm | regenerate apiserver cert 1/2
   file:

roles/kubernetes/node/tasks/facts.yml

@@ -1,5 +1,6 @@
 ---
 - name: Gather cgroups facts for docker
+  when: container_manager == 'docker'
   block:
   - name: Look up docker cgroup driver
     shell: "set -o pipefail && docker info | grep 'Cgroup Driver' | awk -F': ' '{ print $2; }'"
@@ -12,9 +13,9 @@
   - name: Set kubelet_cgroup_driver_detected fact for docker
     set_fact:
       kubelet_cgroup_driver_detected: "{{ docker_cgroup_driver_result.stdout }}"
-  when: container_manager == 'docker'
 
 - name: Gather cgroups facts for crio
+  when: container_manager == 'crio'
   block:
   - name: Look up crio cgroup driver
     shell: "set -o pipefail && {{ bin_dir }}/crio-status info | grep 'cgroup driver' | awk -F': ' '{ print $2; }'"
@@ -26,13 +27,12 @@
   - name: Set kubelet_cgroup_driver_detected fact for crio
     set_fact:
       kubelet_cgroup_driver_detected: "{{ crio_cgroup_driver_result.stdout }}"
-  when: container_manager == 'crio'
 
 - name: Set kubelet_cgroup_driver_detected fact for containerd
+  when: container_manager == 'containerd'
   set_fact:
     kubelet_cgroup_driver_detected: >-
       {%- if containerd_use_systemd_cgroup -%}systemd{%- else -%}cgroupfs{%- endif -%}
-  when: container_manager == 'containerd'
 
 - name: Set kubelet_cgroup_driver
   set_fact:

roles/kubernetes/preinstall/tasks/0020-set_facts.yml

@@ -69,6 +69,7 @@
   register: resolvconf_stat
 
 - name: Fetch resolconf
+  when: resolvconf_stat.stat.exists is defined and resolvconf_stat.stat.exists
   block:
 
     - name: Get content of /etc/resolv.conf
@@ -81,8 +82,6 @@
         configured_nameservers: "{{ resolvconf_slurp.content | b64decode | regex_findall('^nameserver\\s*(.*)', multiline=True) | ipaddr }}"
       when: resolvconf_slurp.content is defined
 
-  when: resolvconf_stat.stat.exists is defined and resolvconf_stat.stat.exists
-
 - name: Stop if /etc/resolv.conf not configured nameservers
   assert:
     that: configured_nameservers | length>0

roles/kubernetes/preinstall/tasks/0040-verify-settings.yml

@@ -242,6 +242,8 @@
 
 # TODO: Clean this task up when we drop backward compatibility support for `etcd_kubeadm_enabled`
 - name: Stop if etcd deployment type is not host or kubeadm when container_manager != docker and etcd_kubeadm_enabled is not defined
+  run_once: yes
+  when: etcd_kubeadm_enabled is defined
   block:
     - name: Warn the user if they are still using `etcd_kubeadm_enabled`
       debug:
@@ -257,8 +259,6 @@
           It is not possible to use `etcd_kubeadm_enabled` when `etcd_deployment_type` is set to {{ etcd_deployment_type }}.
           Unset the `etcd_kubeadm_enabled` variable and set `etcd_deployment_type` to desired deployment type (`host`, `kubeadm`, `docker`) instead."
       when: etcd_kubeadm_enabled
-  run_once: yes
-  when: etcd_kubeadm_enabled is defined
 
 - name: Stop if download_localhost is enabled but download_run_once is not
   assert:

roles/kubernetes/preinstall/tasks/0070-system-packages.yml

@@ -10,6 +10,11 @@
   tags: bootstrap-os
 
 - name: Add debian 10 required repos
+  when:
+    - ansible_distribution == "Debian"
+    - ansible_distribution_version == "10"
+  tags:
+    - bootstrap-os
   block:
     - name: Add Debian Backports apt repo
       apt_repository:
@@ -26,11 +31,6 @@
         dest: "/etc/apt/preferences.d/libseccomp2"
         owner: "root"
         mode: 0644
-  when:
-    - ansible_distribution == "Debian"
-    - ansible_distribution_version == "10"
-  tags:
-    - bootstrap-os
 
 - name: Update package management cache (APT)
   apt:

roles/kubernetes/preinstall/tasks/0090-etchosts.yml

@@ -1,5 +1,6 @@
 ---
 - name: Hosts | update inventory in hosts file
+  when: populate_inventory_to_hosts_file
   block:
     - name: Hosts | create list from inventory
       set_fact:
@@ -26,7 +27,6 @@
         unsafe_writes: yes
         marker: "# Ansible inventory hosts {mark}"
         mode: 0644
-  when: populate_inventory_to_hosts_file
 
 - name: Hosts | populate kubernetes loadbalancer address into hosts file
   lineinfile:
@@ -42,6 +42,7 @@
     - loadbalancer_apiserver.address is defined
 
 - name: Hosts | Update localhost entries in hosts file
+  when: populate_localhost_entries_to_hosts_file
   block:
     - name: Hosts | Retrieve hosts file content
       slurp:
@@ -74,7 +75,6 @@
         backup: yes
         unsafe_writes: yes
       loop: "{{ etc_hosts_localhosts_dict_target | default({}) | dict2items }}"
-  when: populate_localhost_entries_to_hosts_file
 
 # gather facts to update ansible_fqdn
 - name: Update facts