lint fixes
This commit is contained in:
@@ -1,4 +1,4 @@
|
||||
---
|
||||
instance_name: "{{ inventory_hostname | regex_replace('_','-') }}"
|
||||
instance_name: "{{ inventory_hostname | regex_replace('_', '-') }}"
|
||||
activation_key: "{{ 'RHEL' + ansible_distribution_major_version + '_' + env }}"
|
||||
rex_user: root # "{{ ansible_user }}"
|
||||
|
||||
@@ -1,67 +1,66 @@
|
||||
---
|
||||
- name: verify operating system
|
||||
assert:
|
||||
- name: Verify operating system
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- ansible_os_family == 'RedHat'
|
||||
- (ansible_distribution_major_version == '7') or (ansible_distribution_major_version == '8')
|
||||
|
||||
- name: set hostname
|
||||
hostname:
|
||||
- name: Set hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{{ instance_name }}"
|
||||
|
||||
- name: remove rhui client packages
|
||||
yum:
|
||||
name:
|
||||
- google-rhui-client*
|
||||
- rh-amazon-rhui-client*
|
||||
state: removed
|
||||
|
||||
- name: get current repos
|
||||
command:
|
||||
- name: Remove rhui client packages
|
||||
ansible.builtin.yum:
|
||||
name:
|
||||
- google-rhui-client*
|
||||
- rh-amazon-rhui-client*
|
||||
state: removed
|
||||
|
||||
- name: Get current repos
|
||||
ansible.builtin.command:
|
||||
cmd: ls /etc/yum.repos.d/
|
||||
register: repos
|
||||
changed_when: False
|
||||
changed_when: false
|
||||
|
||||
- name: remove existing rhui repos
|
||||
file:
|
||||
- name: Remove existing rhui repos
|
||||
ansible.builtin.file:
|
||||
path: "/etc/yum.repos.d/{{ item }}"
|
||||
state: absent
|
||||
loop: "{{ repos.stdout_lines }}"
|
||||
|
||||
- name: install satellite certificate
|
||||
yum:
|
||||
- name: Install satellite certificate
|
||||
ansible.builtin.yum:
|
||||
name: "{{ satellite_url }}/pub/katello-ca-consumer-latest.noarch.rpm"
|
||||
state: present
|
||||
validate_certs: no
|
||||
validate_certs: false
|
||||
disable_gpg_check: true
|
||||
|
||||
- name: register system via subscription-mangler
|
||||
redhat_subscription:
|
||||
- name: Register system via subscription-mangler
|
||||
community.general.redhat_subscription:
|
||||
state: present
|
||||
activationkey: "{{ activation_key }}"
|
||||
consumer_name: "{{ instance_name }}"
|
||||
org_id: "{{ org_id | default('Default_Organization')}}"
|
||||
org_id: "{{ org_id | default('Default_Organization') }}"
|
||||
throttle: 1
|
||||
|
||||
- name: include repos
|
||||
include_vars: "vars/{{ ansible_distribution + ansible_distribution_major_version }}.yml"
|
||||
- name: Include repos
|
||||
ansible.builtin.include_vars: "vars/{{ ansible_distribution + ansible_distribution_major_version }}.yml"
|
||||
|
||||
- name: enable repos
|
||||
rhsm_repository:
|
||||
- name: Enable repos
|
||||
community.general.rhsm_repository:
|
||||
name: "{{ rhsm_enabled_repos }}"
|
||||
state: enabled
|
||||
|
||||
- name: install satellite client
|
||||
yum:
|
||||
- name: Install satellite client
|
||||
ansible.builtin.yum:
|
||||
name:
|
||||
- katello-host-tools
|
||||
- katello-host-tools-tracer
|
||||
state: latest
|
||||
|
||||
- name: enable remote execution
|
||||
authorized_key:
|
||||
state: installed
|
||||
|
||||
- name: Enable remote execution
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ rex_user }}"
|
||||
state: present
|
||||
key: "{{ satellite_url }}:9090/ssh/pubkey"
|
||||
validate_certs: no
|
||||
|
||||
validate_certs: false
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
---
|
||||
rhsm_enabled_repos:
|
||||
- rhel-7-server-rpms
|
||||
#- rhel-7-server-satellite-maintenance-6.11-rpms
|
||||
# - rhel-7-server-satellite-maintenance-6.11-rpms
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
galaxy_info:
|
||||
author: morenod
|
||||
description: Role created to configure a client to execute openscap policies based on the information obtained from a Red Hat Satellite/Foreman Host.
|
||||
@@ -1,85 +1,85 @@
|
||||
---
|
||||
- name: Install openscap client packages
|
||||
yum:
|
||||
ansible.builtin.yum:
|
||||
name:
|
||||
- openscap-scanner
|
||||
- rubygem-foreman_scap_client
|
||||
- openscap-scanner
|
||||
- rubygem-foreman_scap_client
|
||||
state: present
|
||||
|
||||
- name: Get Policy parameters
|
||||
uri:
|
||||
ansible.builtin.uri:
|
||||
url: "{{ foreman_server_url }}/api/v2/compliance/policies"
|
||||
method: GET
|
||||
user: "{{ foreman_username }}"
|
||||
password: "{{ foreman_password }}"
|
||||
force_basic_auth: yes
|
||||
password: "{{ foreman_password }}"
|
||||
force_basic_auth: true
|
||||
body_format: json
|
||||
validate_certs: False
|
||||
validate_certs: false
|
||||
register: policies
|
||||
no_log: "{{ foreman_operations_scap_client_secure_logging }}"
|
||||
|
||||
- name: Build policy {{ policy_name }} parameters
|
||||
set_fact:
|
||||
- name: Build policy {{ policy_name }}
|
||||
ansible.builtin.set_fact:
|
||||
policy: "{{ policy | default([]) }} + {{ [item] }}"
|
||||
loop: "{{policies.json.results}}"
|
||||
loop: "{{ policies.json.results }}"
|
||||
when: item.name in policy_name or policy_name == 'all'
|
||||
|
||||
- name: Fail if no policy found with required name
|
||||
fail:
|
||||
ansible.builtin.fail:
|
||||
when: policy is not defined
|
||||
|
||||
- name: Get scap content information
|
||||
uri:
|
||||
url: "{{ foreman_server_url }}/api/v2/compliance/scap_contents/{{item.scap_content_id}}"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ foreman_server_url }}/api/v2/compliance/scap_contents/{{ item.scap_content_id }}"
|
||||
method: GET
|
||||
user: "{{ foreman_username }}"
|
||||
password: "{{ foreman_password }}"
|
||||
force_basic_auth: yes
|
||||
force_basic_auth: false
|
||||
body_format: json
|
||||
validate_certs: False
|
||||
validate_certs: false
|
||||
register: scapcontents
|
||||
loop: "{{ policy }}"
|
||||
no_log: "{{ foreman_operations_scap_client_secure_logging }}"
|
||||
|
||||
- name: Get tailoring content information
|
||||
uri:
|
||||
url: "{{ foreman_server_url }}/api/v2/compliance/tailoring_files/{{item.tailoring_file_id}}"
|
||||
ansible.builtin.uri:
|
||||
url: "{{ foreman_server_url }}/api/v2/compliance/tailoring_files/{{ item.tailoring_file_id }}"
|
||||
method: GET
|
||||
user: "{{ foreman_username }}"
|
||||
password: "{{ foreman_password }}"
|
||||
force_basic_auth: yes
|
||||
force_basic_auth: false
|
||||
body_format: json
|
||||
validate_certs: False
|
||||
validate_certs: false
|
||||
register: tailoringfiles
|
||||
when: item.tailoring_file_id | int > 0 | d(False)
|
||||
loop: "{{ policy }}"
|
||||
no_log: "{{ foreman_operations_scap_client_secure_logging }}"
|
||||
|
||||
- name: Build scap content parameters
|
||||
set_fact:
|
||||
scap_content: "{{ scap_content | default({}) | combine({item.json.id: item.json }) }}"
|
||||
ansible.builtin.set_fact:
|
||||
scap_content: "{{ scap_content | default({}) | combine({item.json.id: item.json}) }}"
|
||||
loop: "{{ scapcontents.results }}"
|
||||
|
||||
- name: Build tailoring content parameters
|
||||
set_fact:
|
||||
tailoring_files: "{{ tailoring_files | default({}) | combine({item.json.id: item.json }) }}"
|
||||
ansible.builtin.set_fact:
|
||||
tailoring_files: "{{ tailoring_files | default({}) | combine({item.json.id: item.json}) }}"
|
||||
when: item.json is defined
|
||||
loop: "{{ tailoringfiles.results }}"
|
||||
|
||||
- name: Apply openscap client configuration template
|
||||
template:
|
||||
ansible.builtin.template:
|
||||
src: openscap_client_config.yaml.j2
|
||||
dest: /etc/foreman_scap_client/config.yaml
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
#- name: Configure execution crontab
|
||||
# cron:
|
||||
# name: "Openscap Execution"
|
||||
# cron_file: 'foreman_openscap_client'
|
||||
# job: '/usr/bin/foreman_scap_client {{policy.id}} > /dev/null'
|
||||
# weekday: "{{crontab_weekdays}}"
|
||||
# hour: "{{crontab_hour}}"
|
||||
# minute: "{{crontab_minute}}"
|
||||
# user: root
|
||||
# - name: Configure execution crontab
|
||||
# cron:
|
||||
# name: "Openscap Execution"
|
||||
# cron_file: 'foreman_openscap_client'
|
||||
# job: '/usr/bin/foreman_scap_client {{policy.id}} > /dev/null'
|
||||
# weekday: "{{crontab_weekdays}}"
|
||||
# hour: "{{crontab_hour}}"
|
||||
# minute: "{{crontab_minute}}"
|
||||
# user: root
|
||||
|
||||
Reference in New Issue
Block a user