lint fixes

This commit is contained in:
willtome
2023-03-07 16:55:34 -05:00
parent 745b755296
commit 40c31d8e6e
64 changed files with 583 additions and 578 deletions

View File

@@ -1,4 +1,4 @@
---
instance_name: "{{ inventory_hostname | regex_replace('_','-') }}"
instance_name: "{{ inventory_hostname | regex_replace('_', '-') }}"
activation_key: "{{ 'RHEL' + ansible_distribution_major_version + '_' + env }}"
rex_user: root # "{{ ansible_user }}"

View File

@@ -1,67 +1,66 @@
---
- name: verify operating system
assert:
- name: Verify operating system
ansible.builtin.assert:
that:
- ansible_os_family == 'RedHat'
- (ansible_distribution_major_version == '7') or (ansible_distribution_major_version == '8')
- name: set hostname
hostname:
- name: Set hostname
ansible.builtin.hostname:
name: "{{ instance_name }}"
- name: remove rhui client packages
yum:
name:
- google-rhui-client*
- rh-amazon-rhui-client*
state: removed
- name: get current repos
command:
- name: Remove rhui client packages
ansible.builtin.yum:
name:
- google-rhui-client*
- rh-amazon-rhui-client*
state: removed
- name: Get current repos
ansible.builtin.command:
cmd: ls /etc/yum.repos.d/
register: repos
changed_when: False
changed_when: false
- name: remove existing rhui repos
file:
- name: Remove existing rhui repos
ansible.builtin.file:
path: "/etc/yum.repos.d/{{ item }}"
state: absent
loop: "{{ repos.stdout_lines }}"
- name: install satellite certificate
yum:
- name: Install satellite certificate
ansible.builtin.yum:
name: "{{ satellite_url }}/pub/katello-ca-consumer-latest.noarch.rpm"
state: present
validate_certs: no
validate_certs: false
disable_gpg_check: true
- name: register system via subscription-mangler
redhat_subscription:
- name: Register system via subscription-mangler
community.general.redhat_subscription:
state: present
activationkey: "{{ activation_key }}"
consumer_name: "{{ instance_name }}"
org_id: "{{ org_id | default('Default_Organization')}}"
org_id: "{{ org_id | default('Default_Organization') }}"
throttle: 1
- name: include repos
include_vars: "vars/{{ ansible_distribution + ansible_distribution_major_version }}.yml"
- name: Include repos
ansible.builtin.include_vars: "vars/{{ ansible_distribution + ansible_distribution_major_version }}.yml"
- name: enable repos
rhsm_repository:
- name: Enable repos
community.general.rhsm_repository:
name: "{{ rhsm_enabled_repos }}"
state: enabled
- name: install satellite client
yum:
- name: Install satellite client
ansible.builtin.yum:
name:
- katello-host-tools
- katello-host-tools-tracer
state: latest
- name: enable remote execution
authorized_key:
state: installed
- name: Enable remote execution
ansible.posix.authorized_key:
user: "{{ rex_user }}"
state: present
key: "{{ satellite_url }}:9090/ssh/pubkey"
validate_certs: no
validate_certs: false

View File

@@ -1,4 +1,4 @@
---
rhsm_enabled_repos:
- rhel-7-server-rpms
#- rhel-7-server-satellite-maintenance-6.11-rpms
# - rhel-7-server-satellite-maintenance-6.11-rpms

View File

@@ -1,3 +0,0 @@
galaxy_info:
author: morenod
description: Role created to configure a client to execute openscap policies based on the information obtained from a Red Hat Satellite/Foreman Host.

View File

@@ -1,85 +1,85 @@
---
- name: Install openscap client packages
yum:
ansible.builtin.yum:
name:
- openscap-scanner
- rubygem-foreman_scap_client
- openscap-scanner
- rubygem-foreman_scap_client
state: present
- name: Get Policy parameters
uri:
ansible.builtin.uri:
url: "{{ foreman_server_url }}/api/v2/compliance/policies"
method: GET
user: "{{ foreman_username }}"
password: "{{ foreman_password }}"
force_basic_auth: yes
password: "{{ foreman_password }}"
force_basic_auth: true
body_format: json
validate_certs: False
validate_certs: false
register: policies
no_log: "{{ foreman_operations_scap_client_secure_logging }}"
- name: Build policy {{ policy_name }} parameters
set_fact:
- name: Build policy {{ policy_name }}
ansible.builtin.set_fact:
policy: "{{ policy | default([]) }} + {{ [item] }}"
loop: "{{policies.json.results}}"
loop: "{{ policies.json.results }}"
when: item.name in policy_name or policy_name == 'all'
- name: Fail if no policy found with required name
fail:
ansible.builtin.fail:
when: policy is not defined
- name: Get scap content information
uri:
url: "{{ foreman_server_url }}/api/v2/compliance/scap_contents/{{item.scap_content_id}}"
ansible.builtin.uri:
url: "{{ foreman_server_url }}/api/v2/compliance/scap_contents/{{ item.scap_content_id }}"
method: GET
user: "{{ foreman_username }}"
password: "{{ foreman_password }}"
force_basic_auth: yes
force_basic_auth: false
body_format: json
validate_certs: False
validate_certs: false
register: scapcontents
loop: "{{ policy }}"
no_log: "{{ foreman_operations_scap_client_secure_logging }}"
- name: Get tailoring content information
uri:
url: "{{ foreman_server_url }}/api/v2/compliance/tailoring_files/{{item.tailoring_file_id}}"
ansible.builtin.uri:
url: "{{ foreman_server_url }}/api/v2/compliance/tailoring_files/{{ item.tailoring_file_id }}"
method: GET
user: "{{ foreman_username }}"
password: "{{ foreman_password }}"
force_basic_auth: yes
force_basic_auth: false
body_format: json
validate_certs: False
validate_certs: false
register: tailoringfiles
when: item.tailoring_file_id | int > 0 | d(False)
loop: "{{ policy }}"
no_log: "{{ foreman_operations_scap_client_secure_logging }}"
- name: Build scap content parameters
set_fact:
scap_content: "{{ scap_content | default({}) | combine({item.json.id: item.json }) }}"
ansible.builtin.set_fact:
scap_content: "{{ scap_content | default({}) | combine({item.json.id: item.json}) }}"
loop: "{{ scapcontents.results }}"
- name: Build tailoring content parameters
set_fact:
tailoring_files: "{{ tailoring_files | default({}) | combine({item.json.id: item.json }) }}"
ansible.builtin.set_fact:
tailoring_files: "{{ tailoring_files | default({}) | combine({item.json.id: item.json}) }}"
when: item.json is defined
loop: "{{ tailoringfiles.results }}"
- name: Apply openscap client configuration template
template:
ansible.builtin.template:
src: openscap_client_config.yaml.j2
dest: /etc/foreman_scap_client/config.yaml
mode: "0644"
owner: root
group: root
#- name: Configure execution crontab
# cron:
# name: "Openscap Execution"
# cron_file: 'foreman_openscap_client'
# job: '/usr/bin/foreman_scap_client {{policy.id}} > /dev/null'
# weekday: "{{crontab_weekdays}}"
# hour: "{{crontab_hour}}"
# minute: "{{crontab_minute}}"
# user: root
# - name: Configure execution crontab
# cron:
# name: "Openscap Execution"
# cron_file: 'foreman_openscap_client'
# job: '/usr/bin/foreman_scap_client {{policy.id}} > /dev/null'
# weekday: "{{crontab_weekdays}}"
# hour: "{{crontab_hour}}"
# minute: "{{crontab_minute}}"
# user: root