# Need serial at the task level for delegate\_to or another solution

**URL:** <https://forum.ansible.com/t/need-serial-at-the-task-level-for-delegate-to-or-another-solution/16564>\
**Category:** Ansible Project\
**Created:** [October 20, 2014, 9:49pm UTC](https://forum.ansible.com/t/need-serial-at-the-task-level-for-delegate-to-or-another-solution/16564 "2014-10-20T21:49:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kesten\_Broughton2](https://avatars.discourse-cdn.com/v4/letter/k/ecc23a/32.png) [@Kesten\_Broughton2](https://forum.ansible.com/u/Kesten_Broughton2)\
**Post date:** [October 20, 2014, 9:49pm UTC](https://forum.ansible.com/t/need-serial-at-the-task-level-for-delegate-to-or-another-solution/16564/1 "2014-10-20T21:49:11Z")

</div>

ansible has a “serial” option at the playbook level but not at the tasks level. I feel like i need a similar construct to avoid race conditions when I have multiple hosts delegate\_to something. Perhaps there is an existing ansible idiom to help me?

My current problem is copying a bunch of ssl csr’s to a certificat\_authority. Then i delegate\_to the ca. The trouble comes when the CA tries to sign multiple certs in parallel.

- name: Sign the request  
delegate\_to: “{{certificate\_authority}}”  
command: creates=“{{ca\_out\_dir}}/{{ansible\_fqdn}}.crt”  
openssl ca -batch -in “{{ca\_in\_dir}}/{{ansible\_fqdn}}.csr”  
-out “{{ca\_out\_dir}}/{{ansible\_fqdn}}.crt”  
-keyfile “{{ca\_key}}”  
-config “{{ca\_cnf}}”  
-passin “file:{{ca\_keystore\_password\_path}}”

Output: The task fails for the first host, but fails for others.

Certificate is to be certified until Oct 17 21:32:45 2024 GMT (3650 days)

Write out database with 1 new entries

unable to rename /etc/pki/21ct/SigningCA1/ca.db.serial.new to /etc/pki/21ct/SigningCA1/ca.db.serial

reason: No such file or directory

---

<div class="post-metadata">

**Author:** ![Michael\_Peters](https://avatars.discourse-cdn.com/v4/letter/m/c2a13f/32.png) [@Michael\_Peters](https://forum.ansible.com/u/Michael_Peters)\
**Post date:** [October 21, 2014, 1:56pm UTC](https://forum.ansible.com/t/need-serial-at-the-task-level-for-delegate-to-or-another-solution/16564/2 "2014-10-21T13:56:08Z")

</div>

I agree that it would be nice to have serial on the task level. Until  
that happens you could break out of your current play with a one task  
play that does just this but with "serial: 1" set. Then go back to  
another play that doesn't use serial to finish the rest of the tasks.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [October 22, 2014, 3:49am UTC](https://forum.ansible.com/t/need-serial-at-the-task-level-for-delegate-to-or-another-solution/16564/3 "2014-10-22T03:49:19Z")

</div>

“ansible has a “serial” option at the playbook level but not at the tasks level.”

While you can’t set serial on a task, you can also in 1.8 set “run\_once” to a task and it will run on just one host in the loop.

Breaking out to a new play and then restarting a different play is definitely an option.

I think a lot of people don’t know a playbook can have more than one play in it.

---

<div class="post-metadata">

**Author:** ![Tomasz\_Kontusz](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@Tomasz\_Kontusz](https://forum.ansible.com/u/Tomasz_Kontusz)\
**Post date:** [October 22, 2014, 7:40am UTC](https://forum.ansible.com/t/need-serial-at-the-task-level-for-delegate-to-or-another-solution/16564/4 "2014-10-22T07:40:29Z")

</div>

Another workaround is to use with\_items: play\_hosts, when: inventory\_hostname == item. This can be used inside a role, but generates huge amounts of output (len(play\_hosts)² lines).

I think the right way here would be to fix the signing script to either work with randomly generated temporary directories or use some locking mechanism.

Michael DeHaan [michael@ansible.com](mailto:michael@ansible.com) napisał:

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [October 22, 2014, 6:02pm UTC](https://forum.ansible.com/t/need-serial-at-the-task-level-for-delegate-to-or-another-solution/16564/5 "2014-10-22T18:02:56Z")

</div>

“Another workaround is to use with\_items: play\_hosts, when: inventory\_hostname == item.”

This will not do what you are thinking it does.