# Is apt-get really idempotent? How does it work?

**URL:** <https://forum.ansible.com/t/is-apt-get-really-idempotent-how-does-it-work/21275>\
**Category:** Ansible Project\
**Created:** [April 26, 2016, 3:45pm UTC](https://forum.ansible.com/t/is-apt-get-really-idempotent-how-does-it-work/21275 "2016-04-26T15:45:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Robert\_Glenn](https://avatars.discourse-cdn.com/v4/letter/r/e36b37/32.png) [@Robert\_Glenn](https://forum.ansible.com/u/Robert_Glenn)\
**Post date:** [April 26, 2016, 3:45pm UTC](https://forum.ansible.com/t/is-apt-get-really-idempotent-how-does-it-work/21275/1 "2016-04-26T15:45:21Z")

</div>

Hi,

I’m trying to understand how Ansible’s “idempotency” is achieved for e.g. apt-get updates.

For example: suppose I have X servers, fully provisioned some time ago, and now want to scale up to X+Y servers. The playbook includes an appeal to apt-get to update the packages. I add the Y servers to my inventory, and run ansible. Will the original X servers, with potentially outdated packages, be updated? Or will they now be out of sync with the new Y servers?

My understanding would be the latter: that running the same playbook on the original servers would leave them unchanged. This would be consistent with the notion of idempotency, but might not be the desired ‘outcome’…

---

<div class="post-metadata">

**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\
**Post date:** [April 27, 2016, 6:30pm UTC](https://forum.ansible.com/t/is-apt-get-really-idempotent-how-does-it-work/21275/2 "2016-04-27T18:30:31Z")

</div>

From [https://docs.ansible.com/ansible/apt\_module.html:](https://docs.ansible.com/ansible/apt_module.html:)

- apt: upgrade=dist update\_cache=yes

upgrade:  
If yes or safe, performs an aptitude safe-upgrade.  
If full, performs an aptitude full-upgrade.  
If dist, performs an apt-get dist-upgrade.  
Note: This does not upgrade a specific package, use state=latest for that.

So I would say depending on what option you choose, all installed  
packages on your servers would be upgrade to the latest version with  
upgrade=full or maybe upgrade=safe. Keep in mind that this would not  
install the same set of packages on your servers, as only the one  
where e.g. apache is installed are receiving updates for apache.

Idempotency in this case means that you can run this command multiple  
times and (if no updates are released in the meantime and you refresh  
the cache) your systems should be up to date no matter even after the  
first time.

Johannes