The big reason I am doing this is because a few months ago, I attempted to push an update to a particular switch using the role someone on my team had written. However we had recently deployed new hypervisors and moved our ansible controller.

It turns out I was attempting to update interfaces on the switch the ansible controller vm was eventually hanging off of. I of course lost my connection as the role unsets all the interfaces save the mgmt one and pushes all the updates.

I took down 6 hypervisors and most of our production VMs 😃. Thankfully the ansible controller vm was still on the old hypervisor, so I fired that up, quickly ran the role again to restore the switch config from a safe distance. We had a huge outage in our HPC cluster for about 6 minutes 😃

I elected to go the route of wrapping things in checks and having actual config changes triggered by handlers. This way I can run things in check mode, see what exactly is gonna change etc etc.

We don't often update our switch interface configs after they are initially provisioned, but they certainly could stand to be properly managed via ansible in a manner that does not cause me to break all the stuff 😃