Deleting a host answers 409 while any job, ad hoc command or inventory update is active against its inventory, and 403 for a minute after one finishes while its events are still being written. On an inventory driven by schedules, or one carrying long plays, there is often no window at all, and the machine has usually been off the network for days by then. Inventories take an allow_deletes_while_in_use flag now, which lifts that one block.
The protection was never uniform
This is what makes an opt out reasonable rather than reckless. Deleting a group deletes the hosts that belonged only to it, recursively, without going through the active jobs check at all. The bulk host delete endpoint does not look at active jobs either. Creating hosts in an inventory while a job runs against it has always been allowed. A single host delete is the one place that blocks, so the flag lines it up with everything around it.
What happens to the job in flight
Ansible reads the inventory when the job starts, so the running play keeps targeting the machine, is neither interrupted nor altered, and its results are still recorded:
- Job events keep the host name and their reference is not enforced, so event processing carries on.
- Host summaries keep the host name too, and the summary is created without the link.
- The fact cache re-queries hosts by name at the end, so a deleted host is simply not among them.
Two things to know before enabling it
A queued job will not see the host, because the inventory is read when the job starts rather than when it was launched. And on a sliced job each slice builds its own host list as it starts, so removing a host part way through can shift how the remaining hosts are distributed across the slices.
Where it is
allow_deletes_while_in_use sits on the inventory and defaults to false, so nothing changes for an inventory you already have, and it is preserved when an inventory is copied. A delete that goes through because of the flag is logged with the host, the inventory and the jobs that were active at the time, so the record says what happened rather than leaving anyone to infer it later.
This is @fernandorocagonzalez's, in #785.
The flag is per inventory on purpose: the inventories where this bites are usually the large, always busy ones, and the small hand curated ones are better off keeping the guard. If you would rather it were a global setting, or a permission rather than a flag, that is worth hearing before anyone extends it.
