CRITICAL FIX:
Problem: drift-check.yml was using 'copy' module in check_mode, which compares:
- File content ✓
- Permissions (owner, group, mode) ✗
- Ownership ✗
After deploy, files have root:root 0644 permissions. Even though content matches,
the copy module marked files as 'changed' because permissions were being compared.
This caused false OUT_OF_SYNC reports even when configuration was actually synced.
Solution: Use MD5 checksum-based comparison instead:
- Compare only file CONTENT using stat checksums
- Ignore permissions/ownership differences
- This is what matters for config management
Also fixed URLs:
- Changed back from port 80 to port 5000 (API only)
- Updated service name to gitops-status-api
Now drift detection only triggers on actual config changes, not permission differences.
After successful deploy, should correctly report SYNCED status.
CRITICAL FIXES:
1. Fix API URL port: 5000 → 80 (.woodpecker.yml)
- update-gitops-status step was POSTing to wrong port
- gitops-status-server Service exposes port 80, not 5000
- This caused silent POST failures that weren't detected
2. Initialize missing_on_server variable (drift-check.yml)
- Variable was only set inside block scope
- Could remain undefined if block failed or didn't execute
- Now initialized to empty list before block runs
- Prevents undefined variable errors in container environment
3. Fix drift detection logic (drift-check.yml)
- Changed from: drift_detected uses extra_files_on_server flag
- Changed to: drift_detected directly checks missing_on_server length
- Adds safety with | default([]) filter
- Prevents false positives when extra_files_on_server wasn't set properly
ROOT CAUSE:
The combination of port 5000, uninitialized variables, and flag-based logic
caused the playbook to report OUT_OF_SYNC without listing changed files
(drift_count=0, files=[]). After deployment, server config matches Git,
so drift_detected should be false and playbook should exit 0 with SYNCED status.
Now correctly reports SYNCED after successful deploy.
Root causes:
1. Inconsistent Ansible callback (minimal) broke debug output parsing
2. DRIFTED_FILES extraction failed due to format changes
3. Files array stayed empty even when drift was detected
Fixes:
1. Use YAML callback for consistent, structured output
2. Improve DRIFTED_FILES parsing to handle YAML format
3. Remove conflicting ANSIBLE_CALLBACKS_ENABLED/minimal settings
4. Add GITOPS_STATUS_FIX.md with complete analysis
Result:
- Files array now populates correctly when drift exists
- Sync status accurately reflects actual server state
- Better debug logging for troubleshooting
See GITOPS_STATUS_FIX.md for full root cause analysis and testing guide.
