#molecule

Ansible playbook reports changed on every run: shell tasks, creates and changed_when

Our base playbook reported changed on every host on every run, so nobody trusted the drift report, and a duplicated sysctl line went unnoticed for months. The cause was shell and command tasks that Ansible cannot reason about; modules, creates and changed_when fixed it.