Make spa deploy idempotent after successful convergence

Summary

A second spa deploy against an unchanged environment should finish green: no changed task-host results, no Splunk restart, no deploy-server reload, no cluster-bundle push.

Today compact progress still reports changed on rerun. That is playbook idempotence, not the progress renderer. Observed on env my-lab after a successful site was already up (2026-09-18T145100+0200-deploy JSONL): Splunk install changed 16/259, Baseconfig apps changed 5/172 (the stored transcript had more changed results than the headline because baseconfig continues after that line commits).

Acceptance

• Two consecutive successful spa deploy --yes runs with unchanged splunk_config.yml.
• Second run: compact line ends ok (green) for every group; JSONL has zero host_result with status: changed.
• systemctl daemon-reload runs only when a unit file actually changed.
• Login-page web.conf login_content is byte-stable across reruns.
• Baseconfig local.meta and generated .conf stay unchanged on the second pass (both etc/apps and etc/deployment-apps copies of org_all_forwarder_outputs).
• No Splunk restart, reload deploy-server, or cluster-bundle apply without an upstream change.
• Local test: run the relevant roles twice (or a fixture playbook) and fail if the second recap has changed > 0.

Known always-changed tasks (from JSONL)

Splunk install

• splunk_software : Commit changes to systemctl — ansible.builtin.command: systemctl daemon-reload in add_disable_thp_service.yml and update_splunk_service.yml (always changed; two times per Enterprise host).
• splunk_software : Add user and roles info to login page — ini_file on web.conf login_content in ui_config.yml. Value includes splunk_roles from group_vars/all/dynamic.yml; group iteration order is not sorted, so the string can change every run and notify Restart splunk.
• splunk_common : Restart splunk — follow-on of the login-page notify.

Baseconfig

• org_all_forwarder_outputs is applied twice on the DS host by design (etc/apps then etc/deployment-apps in deployment_server/tasks/main.yml). Two copies are expected; both must be stable on rerun.
• Still changing on the second pass: copy local.meta (no checksum/force: false — install_app.yml), setting defaultGroup value, setting ssl vars in tcpout stanza for clustered indexers (ini_file without no_extra_spaces), Define org_all_forwarder_outputs server class clients, plus indexer org_cluster_indexer_base copy local.meta / SSL inputs.
• Follow-on: Reload deploy-server and Restart splunk.

The JSONL names the tasks; it does not store before/after diffs. Pickup should compare rendered files on a live rerun.

Implementation hints

• Gate daemon-reload on a notify from unit-file copy/ini tasks, or changed_when: false if a reload is required but must not count as a change.
• Sort splunk_roles (and any other login-page fragments) before writing login_content.
• Make copy local.meta and community.general.ini_file compare equal when content already matches (checksum, no_extra_spaces, explicit mode/owner).
• Do not mark command handlers (reload deploy-server) changed when they only ran because a non-idempotent task fired.

Related

• Env-dir logs / compact progress: #71
• ROADMAP.md Lifecycle

Pickup-ready enhancement. Skills and agents call spa only. Never print secrets.

Start with the named tasks in add_disable_thp_service.yml, update_splunk_service.yml, ui_config.yml, install_app.yml, and deployment_server/tasks/main.yml, then inspect group_vars/all/dynamic.yml for login-page ordering. Run the relevant roles twice, or use a fixture playbook, and compare rendered files and the second recap. Done means the second run has zero changed host results and triggers no unnecessary reloads, restarts, or bundle applies.