Mejorar idempotencia: usar copy para PEM, agregar changed_when a GPG export

roles/common/tasks/main.yaml

@@ -85,6 +85,7 @@
   ansible.builtin.shell:
     cmd: "gpg --armor --export 'Koji Signing Key' > {{ koji_pki_dir }}/gpg_key.pub"
     creates: "{{ koji_pki_dir }}/gpg_key.pub"
+    changed_when: false
   delegate_to: localhost
   run_once: true
 

roles/kojid/tasks/main.yaml

@@ -67,9 +67,10 @@
     - {src: "kojid.key", dest: "{{ kojid_key_path }}", mode: "0600"}
 
 - name: "Concatenate certificate and key into a PEM file"
-  ansible.builtin.shell:
+  ansible.builtin.copy:
-    cmd: "cat {{ kojid_crt_path }} {{ kojid_key_path }} > {{ kojid_pem_path }}"
+    content: "{{ lookup('file', kojid_crt_path) }}\n{{ lookup('file', kojid_key_path) }}"
-    creates: "{{ kojid_pem_path }}"
+    dest: "{{ kojid_pem_path }}"
+    mode: "0600"
 
 - name: Set ownership and permissions on kojid.pem
   ansible.builtin.file:

roles/kojira/tasks/main.yaml

@@ -26,9 +26,10 @@
     - { src: "kojira.key", dest: "/etc/pki/koji/kojira.key", mode: "0600" }
 
 - name: "Concatenate certificate and key into a PEM file"
-  ansible.builtin.shell:
+  ansible.builtin.copy:
-    cmd: "cat /etc/pki/koji/kojira.crt /etc/pki/koji/kojira.key > /etc/pki/koji/kojira.pem"
+    content: "{{ lookup('file', '/etc/pki/koji/kojira.crt') }}\n{{ lookup('file', '/etc/pki/koji/kojira.key') }}"
-    creates: "/etc/pki/koji/kojira.pem"
+    dest: "/etc/pki/koji/kojira.pem"
+    mode: "0600"
 
 - name: Start and enable kojira service
   ansible.builtin.service: