Simplify logic for excluding packages from update

Author: jistr

roles/edpm_update_services/tasks/packages.yml

@@ -1,28 +1,22 @@
 ---
 
-- name: Ensure package update exclusions
+- name: Apply package updates needed for service updates
+  become: true
   vars:
     _exclude_packages_always:
       - kernel
       - kernel-core
       - openvswitch
-  ansible.builtin.set_fact:
-    _exclude_packages: >-
-      {{
-        edpm_update_services_exclude_packages
-        + _exclude_packages_always
-        | ansible.builtin.unique
-      }}
-  tags:
-    - edpm_update_services
-
-- name: Apply package updates needed for service updates
-  become: true
   ansible.builtin.dnf:  # noqa: package-latest
     name:
       - openstack-selinux
     state: latest
     update_cache: true
-    exclude: "{{ _exclude_packages }}"
+    exclude: >-
+      {{
+        edpm_update_services_exclude_packages
+        + _exclude_packages_always
+        | ansible.builtin.unique
+      }}
   tags:
     - edpm_update_services

roles/edpm_update_system/tasks/kpatch.yml

@@ -27,12 +27,7 @@
     - edpm_update_system
 
 - name: Ensure further update stages will not update kernel
-  vars:
-    _kernel_packages:
+  ansible.builtin.set_fact:
+    _exclude_packages_kpatch:
       - kernel
       - kernel-core
-  ansible.builtin.set_fact:
-    _exclude_packages: >-
-      {{ _exclude_packages + _kernel_packages | ansible.builtin.unique }}
-  tags:
-    - edpm_update_system

roles/edpm_update_system/tasks/main.yml

@@ -14,12 +14,6 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-- name: Set up package exclusions
-  ansible.builtin.set_fact:
-    _exclude_packages: "{{ edpm_update_system_exclude_packages }}"
-  tags:
-    - edpm_update_system
-
 - name: Apply kernel patch via kpatch
   ansible.builtin.include_tasks: kpatch.yml
   when: edpm_update_system_enable_kpatch

roles/edpm_update_system/tasks/packages.yml

@@ -7,19 +7,21 @@
   tags:
     - edpm_update_system
 
-- name: Ensure openvswitch is excluded from bulk update
-  ansible.builtin.set_fact:
-    _exclude_packages: >-
-      {{ _exclude_packages + ['openvswitch'] | ansible.builtin.unique }}
-  tags:
-    - edpm_update_system
-
 - name: Apply package updates
   become: true
+  vars:
+    _exclude_packages_always:
+      - openvswitch
   ansible.builtin.dnf:  # noqa: package-latest
     name: "*"
     state: latest
     update_cache: true
-    exclude: "{{ _exclude_packages }}"
+    exclude: >-
+      {{
+        edpm_update_system_exclude_packages
+        + _exclude_packages_always
+        + _exclude_packages_kpatch | default([])
+        | ansible.builtin.unique
+      }}
   tags:
     - edpm_update_system