- The Upgrade Confusion: upgrade vs. dist-upgrade
In the Proxmox world, the “forbidden” command is actually a plain apt upgrade.
The Wrong Way (apt upgrade): This only updates existing packages but refuses to remove old ones or install new dependencies. Since Proxmox depends on complex kernel and virtualization headers, this can leave your system in a "broken" partial state.
The Proxmox Way (apt dist-upgrade or apt full-upgrade): These two are virtually identical in modern Debian. They allow apt to manage complex dependency changes (adding/removing packages as needed for the new kernel).
In Ansible: Using upgrade: dist is the correct, safe method for Proxmox.