+
\ No newline at end of file
diff --git a/collections/ansible_collections/demo/reporting/roles/report_server/templates/linux_report.j2 b/collections/ansible_collections/demo/reporting/roles/report_server/templates/linux_report.j2
new file mode 100644
index 0000000..201d930
--- /dev/null
+++ b/collections/ansible_collections/demo/reporting/roles/report_server/templates/linux_report.j2
@@ -0,0 +1,42 @@
+
+
+
+
Ansible Linux Automation Report
+
+
+
+
+
+
+
+
+
+
+ {% include 'header.j2' %}
+
+
+Ansible Automation Reports
+
+
+
+
+{% for report in reports.files %}
+ {% set page = report.path.split('/')[-1] %}
+
+
+
+ 
+ |
+
+ {{ page }}
+ |
+{% endfor %}
+
+
+Created with
+
+
+
+
+
diff --git a/collections/ansible_collections/demo/reporting/roles/report_server/templates/windows_report.j2 b/collections/ansible_collections/demo/reporting/roles/report_server/templates/windows_report.j2
new file mode 100644
index 0000000..5690437
--- /dev/null
+++ b/collections/ansible_collections/demo/reporting/roles/report_server/templates/windows_report.j2
@@ -0,0 +1,42 @@
+
+
+
+
Ansible Linux Automation Report
+
+
+
+
+
+
+
+
+
+
+ {% include 'header.j2' %}
+
+
+Ansible Automation Reports
+
+
+
+
+{% for report in reports.files %}
+ {% set page = report.path.split('\\')[-1] %}
+
+
+
+
+ |
+
+ {{ page }}
+ |
+{% endfor %}
+
+
+Created with
+
+
+
+
+
diff --git a/collections/ansible_collections/demo/reporting/roles/report_server/vars/Win32NT.yml b/collections/ansible_collections/demo/reporting/roles/report_server/vars/Win32NT.yml
new file mode 100644
index 0000000..ac4e675
--- /dev/null
+++ b/collections/ansible_collections/demo/reporting/roles/report_server/vars/Win32NT.yml
@@ -0,0 +1,3 @@
+---
+doc_root: C:\Inetpub\wwwroot
+reports_dir: reports
diff --git a/collections/ansible_collections/demo/satellite/roles/register_host/defaults/main.yml b/collections/ansible_collections/demo/satellite/roles/register_host/defaults/main.yml
new file mode 100644
index 0000000..ce441c2
--- /dev/null
+++ b/collections/ansible_collections/demo/satellite/roles/register_host/defaults/main.yml
@@ -0,0 +1,4 @@
+---
+instance_name: "{{ inventory_hostname | regex_replace('_','-') }}"
+activation_key: "{{ 'RHEL' + ansible_distribution_major_version + '_' + env }}"
+rex_user: root # "{{ ansible_user }}"
diff --git a/collections/ansible_collections/demo/satellite/roles/register_host/tasks/main.yml b/collections/ansible_collections/demo/satellite/roles/register_host/tasks/main.yml
new file mode 100644
index 0000000..0f158ae
--- /dev/null
+++ b/collections/ansible_collections/demo/satellite/roles/register_host/tasks/main.yml
@@ -0,0 +1,67 @@
+---
+- name: verify operating system
+ assert:
+ that:
+ - ansible_os_family == 'RedHat'
+ - (ansible_distribution_major_version == '7') or (ansible_distribution_major_version == '8')
+
+- name: set hostname
+ hostname:
+ name: "{{ instance_name }}"
+
+- name: remove rhui client packages
+ yum:
+ name:
+ - google-rhui-client*
+ - rh-amazon-rhui-client*
+ state: removed
+
+- name: get current repos
+ command:
+ cmd: ls /etc/yum.repos.d/
+ register: repos
+ changed_when: False
+
+- name: remove existing rhui repos
+ file:
+ path: "/etc/yum.repos.d/{{ item }}"
+ state: absent
+ loop: "{{ repos.stdout_lines }}"
+
+- name: install satellite certificate
+ yum:
+ name: "{{ satellite_url }}/pub/katello-ca-consumer-latest.noarch.rpm"
+ state: present
+ validate_certs: no
+ disable_gpg_check: true
+
+- name: register system via subscription-mangler
+ redhat_subscription:
+ state: present
+ activationkey: "{{ activation_key }}"
+ consumer_name: "{{ instance_name }}"
+ org_id: "{{ org_id | default('Default_Organization')}}"
+ throttle: 1
+
+- name: include repos
+ include_vars: "vars/{{ ansible_distribution + ansible_distribution_major_version }}.yml"
+
+- name: enable repos
+ rhsm_repository:
+ name: "{{ rhsm_enabled_repos }}"
+ state: enabled
+
+- name: install satellite client
+ yum:
+ name:
+ - katello-host-tools
+ - katello-host-tools-tracer
+ state: latest
+
+- name: enable remote execution
+ authorized_key:
+ user: "{{ rex_user }}"
+ state: present
+ key: "{{ satellite_url }}:9090/ssh/pubkey"
+ validate_certs: no
+
diff --git a/collections/ansible_collections/demo/satellite/roles/register_host/vars/RedHat7.yml b/collections/ansible_collections/demo/satellite/roles/register_host/vars/RedHat7.yml
new file mode 100644
index 0000000..c529625
--- /dev/null
+++ b/collections/ansible_collections/demo/satellite/roles/register_host/vars/RedHat7.yml
@@ -0,0 +1,4 @@
+---
+rhsm_enabled_repos:
+ - rhel-7-server-rpms
+ #- rhel-7-server-satellite-maintenance-6.11-rpms
diff --git a/collections/ansible_collections/demo/satellite/roles/register_host/vars/RedHat8.yml b/collections/ansible_collections/demo/satellite/roles/register_host/vars/RedHat8.yml
new file mode 100644
index 0000000..eb20ab3
--- /dev/null
+++ b/collections/ansible_collections/demo/satellite/roles/register_host/vars/RedHat8.yml
@@ -0,0 +1,5 @@
+---
+rhsm_enabled_repos:
+ - rhel-8-for-x86_64-baseos-rpms
+ - rhel-8-for-x86_64-appstream-rpms
+ - satellite-client-6-for-rhel-8-x86_64-rpms
diff --git a/collections/ansible_collections/demo/satellite/roles/scap_client/Changelog.md b/collections/ansible_collections/demo/satellite/roles/scap_client/Changelog.md
new file mode 100644
index 0000000..4bb95ba
--- /dev/null
+++ b/collections/ansible_collections/demo/satellite/roles/scap_client/Changelog.md
@@ -0,0 +1,17 @@
+# Change Log
+All notable changes to this project will be documented in this file.
+## [0.0.1] - 20/03/2018 - First Release
+### Added
+- Install required packages
+- Obtain data from satellite API
+- Configure crontab and config.yaml
+
+### Changed
+
+### Removed
+
+### Pending
+- Allow a list of policies to be applied (only one is allowed at the moment)
+- Get schedule from the policy instead of configure it using parameters
+- Configure URI tasks to ask capsule instead of Satellite (for hosts without network access to the satellite api)
+- Add tests to vars to be correctly formatted
diff --git a/collections/ansible_collections/demo/satellite/roles/scap_client/LICENSE b/collections/ansible_collections/demo/satellite/roles/scap_client/LICENSE
new file mode 100644
index 0000000..a80e2cd
--- /dev/null
+++ b/collections/ansible_collections/demo/satellite/roles/scap_client/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2018 morenod
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/collections/ansible_collections/demo/satellite/roles/scap_client/README.md b/collections/ansible_collections/demo/satellite/roles/scap_client/README.md
new file mode 100644
index 0000000..3dc42dc
--- /dev/null
+++ b/collections/ansible_collections/demo/satellite/roles/scap_client/README.md
@@ -0,0 +1,45 @@
+# Openscap client configuration Role
+
+## About
+
+Role created to configure a client to execute openscap policies based on the information obtained from a Red Hat Satellite/Foreman Host.
+
+Steps and configuration changes obtained from the [foreman_scap_client puppet module](https://github.com/theforeman/puppet-foreman_scap_client)
+
+The role has to be executed with root permission, using the root user or via sudo because it will modify system parameters.
+
+## Ansible Requirements
+
+RPM Repositories have to be enabled and containing required packages.
+
+## Configuration parameters
+
+### Required vars to be overwritten
+
+- `satellite_server`: Used to obtain policy parameters
+- `satellite_username`: Used to obtain policy parameters
+- `satellite_password`: Used to obtain policy parameters
+- `capsule_server`: Used to configure openscap client config.yaml file
+- `capsule_port`: Used to configure openscap client config.yaml file
+- `policy_name`: Name of the SCAP Policy to be configured
+
+## Example playbook
+
+```yml
+---
+- name: openscap client
+ hosts: <
>
+ remote_user: <>
+ gather_facts: true
+ become: yes
+ become_user: root
+ become_method: sudo
+ vars:
+ satellite_server: satellite.example.com
+ satellite_username`: admin
+ satellite_password`: verycomplexpassword
+ capsule_server`: capsule.example.com
+ policy_name`: 'rhel7-pci'
+ roles:
+ - ansible-ipaRegister
+```
diff --git a/collections/ansible_collections/demo/satellite/roles/scap_client/defaults/main.yaml b/collections/ansible_collections/demo/satellite/roles/scap_client/defaults/main.yaml
new file mode 100644
index 0000000..255b0ab
--- /dev/null
+++ b/collections/ansible_collections/demo/satellite/roles/scap_client/defaults/main.yaml
@@ -0,0 +1,12 @@
+foreman_server_url: "{{ lookup('env', 'SATELLITE_SERVER') }}"
+foreman_username: "{{ lookup('env', 'SATELLITE_USERNAME') }}"
+foreman_password: "{{ lookup('env', 'SATELLITE_PASSWORD') }}"
+foreman_validate_certs: "{{ lookup('env', 'FOREMAN_VALIDATE_CERTS') | default(true) }}"
+capsule_server: "{{ foreman_server_url }}"
+capsule_port: '9090'
+policy_name: 'all'
+policy_scan: "{{ policy_name }}"
+crontab_hour: 2
+crontab_minute: 0
+crontab_weekdays: 0
+foreman_operations_scap_client_secure_logging: true
diff --git a/collections/ansible_collections/demo/satellite/roles/scap_client/meta/main.yml b/collections/ansible_collections/demo/satellite/roles/scap_client/meta/main.yml
new file mode 100644
index 0000000..61d2458
--- /dev/null
+++ b/collections/ansible_collections/demo/satellite/roles/scap_client/meta/main.yml
@@ -0,0 +1,3 @@
+galaxy_info:
+ author: morenod
+ description: Role created to configure a client to execute openscap policies based on the information obtained from a Red Hat Satellite/Foreman Host.
\ No newline at end of file
diff --git a/collections/ansible_collections/demo/satellite/roles/scap_client/tasks/main.yaml b/collections/ansible_collections/demo/satellite/roles/scap_client/tasks/main.yaml
new file mode 100644
index 0000000..1f8d01a
--- /dev/null
+++ b/collections/ansible_collections/demo/satellite/roles/scap_client/tasks/main.yaml
@@ -0,0 +1,85 @@
+---
+- name: Install openscap client packages
+ yum:
+ name:
+ - openscap-scanner
+ - rubygem-foreman_scap_client
+ state: present
+
+- name: Get Policy parameters
+ uri:
+ url: "{{ foreman_server_url }}/api/v2/compliance/policies"
+ method: GET
+ user: "{{ foreman_username }}"
+ password: "{{ foreman_password }}"
+ force_basic_auth: yes
+ body_format: json
+ validate_certs: False
+ register: policies
+ no_log: "{{ foreman_operations_scap_client_secure_logging }}"
+
+- name: Build policy {{ policy_name }} parameters
+ set_fact:
+ policy: "{{ policy | default([]) }} + {{ [item] }}"
+ loop: "{{policies.json.results}}"
+ when: item.name in policy_name or policy_name == 'all'
+
+- name: Fail if no policy found with required name
+ fail:
+ when: policy is not defined
+
+- name: Get scap content information
+ uri:
+ url: "{{ foreman_server_url }}/api/v2/compliance/scap_contents/{{item.scap_content_id}}"
+ method: GET
+ user: "{{ foreman_username }}"
+ password: "{{ foreman_password }}"
+ force_basic_auth: yes
+ body_format: json
+ validate_certs: False
+ register: scapcontents
+ loop: "{{ policy }}"
+ no_log: "{{ foreman_operations_scap_client_secure_logging }}"
+
+- name: Get tailoring content information
+ uri:
+ url: "{{ foreman_server_url }}/api/v2/compliance/tailoring_files/{{item.tailoring_file_id}}"
+ method: GET
+ user: "{{ foreman_username }}"
+ password: "{{ foreman_password }}"
+ force_basic_auth: yes
+ body_format: json
+ validate_certs: False
+ register: tailoringfiles
+ when: item.tailoring_file_id | int > 0 | d(False)
+ loop: "{{ policy }}"
+ no_log: "{{ foreman_operations_scap_client_secure_logging }}"
+
+- name: Build scap content parameters
+ set_fact:
+ scap_content: "{{ scap_content | default({}) | combine({item.json.id: item.json }) }}"
+ loop: "{{ scapcontents.results }}"
+
+- name: Build tailoring content parameters
+ set_fact:
+ tailoring_files: "{{ tailoring_files | default({}) | combine({item.json.id: item.json }) }}"
+ when: item.json is defined
+ loop: "{{ tailoringfiles.results }}"
+
+- name: Apply openscap client configuration template
+ template:
+ src: openscap_client_config.yaml.j2
+ dest: /etc/foreman_scap_client/config.yaml
+ mode: 0644
+ owner: root
+ group: root
+
+#- name: Configure execution crontab
+# cron:
+# name: "Openscap Execution"
+# cron_file: 'foreman_openscap_client'
+# job: '/usr/bin/foreman_scap_client {{policy.id}} > /dev/null'
+# weekday: "{{crontab_weekdays}}"
+# hour: "{{crontab_hour}}"
+# minute: "{{crontab_minute}}"
+# user: root
diff --git a/collections/ansible_collections/demo/satellite/roles/scap_client/templates/openscap_client_config.yaml.j2 b/collections/ansible_collections/demo/satellite/roles/scap_client/templates/openscap_client_config.yaml.j2
new file mode 100644
index 0000000..264cc8b
--- /dev/null
+++ b/collections/ansible_collections/demo/satellite/roles/scap_client/templates/openscap_client_config.yaml.j2
@@ -0,0 +1,47 @@
+# Foreman proxy to which reports should be uploaded
+:server: {{ capsule_server | urlsplit('hostname') }}
+:port: {{ capsule_port }}
+
+## SSL specific options ##
+# Client CA file.
+# It could be Puppet CA certificate (e.g., '/var/lib/puppet/ssl/certs/ca.pem')
+# Or (recommended for client reporting to Katello) subscription manager CA file, (e.g., '/etc/rhsm/ca/katello-server-ca.pem')
+:ca_file: '/etc/rhsm/ca/katello-server-ca.pem'
+# Client host certificate.
+# It could be Puppet agent host certificate (e.g., '/var/lib/puppet/ssl/certs/myhost.example.com.pem')
+# Or (recommended for client reporting to Katello) consumer certificate (e.g., '/etc/pki/consumer/cert.pem')
+:host_certificate: '/etc/pki/consumer/cert.pem'
+#
+# Client private key
+# It could be Puppet agent private key (e.g., '/var/lib/puppet/ssl/private_keys/myhost.example.com.pem')
+# Or (recommended for client reporting to Katello) consumer private key (e.g., '/etc/pki/consumer/key.pem')
+:host_private_key: '/etc/pki/consumer/key.pem'
+# policy (key is id as in Foreman)
+{% for item in policy %}
+{{ item.id }}:
+{% if item.tailoring_file_id | int > 0 | d(False) %}
+{% for profile in tailoring_files[item.tailoring_file_id].tailoring_file_profiles %}
+{% if profile.id == item.tailoring_file_profile_id %}
+ :profile: {{profile.profile_id}}
+{% endif%}
+{% endfor %}
+ :content_path: '/var/lib/openscap/content/{{scap_content[item.scap_content_id].digest}}.xml'
+ # Download path
+ # A path to download SCAP content from proxy
+ :download_path: '/compliance/policies/{{item.id}}/content/{{scap_content[item.scap_content_id].digest}}'
+ :tailoring_path: '/var/lib/openscap/content/{{tailoring_files[item.tailoring_file_id].digest}}.xml'
+ :tailoring_download_path: '/compliance/policies/{{item.id}}/tailoring/{{tailoring_files[item.tailoring_file_id].digest}}'
+{% else %}
+{% for profile in scap_content[item.scap_content_id].scap_content_profiles %}
+{% if profile.id == item.scap_content_profile_id %}
+ :profile: {{profile.profile_id}}
+{% endif%}
+{% endfor %}
+ :content_path: '/var/lib/openscap/content/{{scap_content[item.scap_content_id].digest}}.xml'
+ # Download path
+ # A path to download SCAP content from proxy
+ :download_path: '/compliance/policies/{{item.id}}/content/{{scap_content[item.scap_content_id].digest}}'
+ :tailoring_path: ''
+ :tailoring_download_path: ''
+{% endif %}
+{% endfor %}
diff --git a/collections/requirements.yml b/collections/requirements.yml
index 6a1299e..a4fe9b1 100644
--- a/collections/requirements.yml
+++ b/collections/requirements.yml
@@ -23,6 +23,9 @@ collections:
version: 1.13.0
- name: amazon.aws
version: 3.1.1
+ #satellite
+ - name: redhat.satellite
+ version: 3.3.0
#network
- name: cisco.ios
version: 3.1.0
@@ -30,4 +33,3 @@ collections:
version: 3.0.0
- name: cisco.iosxr
version: 3.0.0
-
diff --git a/linux/ec2_register.yml b/linux/ec2_register.yml
index b1cee04..7ce0d4f 100644
--- a/linux/ec2_register.yml
+++ b/linux/ec2_register.yml
@@ -40,6 +40,7 @@
name: "https://{{ sat_url }}/pub/katello-ca-consumer-latest.noarch.rpm"
state: present
validate_certs: no
+ disable_gpg_check: true
when: sat_url is defined
- name: manage repos with subscription mangler
@@ -54,12 +55,6 @@
activationkey: "{{ activation_key }}"
org_id: "{{ org_id }}"
- - name: disable htb repo
- community.general.rhsm_repository:
- name: rhel-7-server-htb*
- state: disabled
- ignore_errors: yes
-
- name: configure Red Hat insights
import_role:
name: redhat.insights.insights_client
@@ -68,4 +63,4 @@
insights_tags:
env: "{{ env }}"
purpose: demo
- group: "{{ ansible_group }}"
+ group: "{{ insights_tag }}"
diff --git a/linux/setup.yml b/linux/setup.yml
index b86cbf0..1e518af 100644
--- a/linux/setup.yml
+++ b/linux/setup.yml
@@ -11,7 +11,7 @@ controller_components:
- job_templates
controller_credential_types:
- - name: "Insights Collection"
+ - name: Insights Collection
kind: cloud
inputs:
fields:
@@ -34,6 +34,13 @@ controller_credentials:
inputs:
insights_user: REPLACEME
insights_password: REPLACEME
+ - name: Satellite Inventory
+ credential_type: Red Hat Satellite 6
+ organization: Default
+ inputs:
+ host: https://satellite.example.com
+ username: admin
+ password: ansible123!
controller_inventory_sources:
- name: Insights Inventory
@@ -42,6 +49,25 @@ controller_inventory_sources:
source_project: Ansible official demo project
source_path: linux/inventory.insights.yml
credential: Insights Inventory
+ - name: Satellite Inventory
+ inventory: Workshop Inventory
+ source: satellite6
+ overwrite: true
+ credential: Satellite Inventory
+ source_vars:
+ hostnames:
+ - name.split('.')[0]
+ groups:
+ patch_bugs: foreman_content_facet_attributes.errata_counts.bugfix
+ patch_enhancements: foreman_content_facet_attributes.errata_counts.enhancement
+ patch_security: foreman_content_facet_attributes.errata_counts.security
+ keyed_groups:
+ - prefix: env
+ key: foreman_content_facet_attributes.lifecycle_environment_name
+ - prefix: cv
+ key: foreman_content_facet_attributes.content_view_name
+ - prefix: os
+ key: foreman_operatingsystem_name
controller_templates:
@@ -57,8 +83,9 @@ controller_templates:
- "Workshop Credential"
survey_enabled: true
extra_vars:
- activation_key: undef
- org_id: undef
+ activation_key: !unsafe "RHEL{{ ansible_distribution_major_version }}_{{ env }}"
+ org_id: Default_Organization
+ sat_url: satellite.example.com
survey:
name: ''
description: ''
@@ -77,7 +104,7 @@ controller_templates:
required: true
- question_name: Ansible Inventory Group (and Insights tag) to be created
type: text
- variable: ansible_group
+ variable: insights_tag
required: true
- name: "LINUX / Troubleshoot"
@@ -135,6 +162,7 @@ controller_templates:
inventory: "Workshop Inventory"
project: "Ansible official demo project"
playbook: "linux/patching.yml"
+ execution_environment: Default execution environment
notification_templates_started: Telemetry
notification_templates_success: Telemetry
notification_templates_error: Telemetry
@@ -230,6 +258,7 @@ controller_templates:
project: "Ansible official demo project"
playbook: linux/fact_scan.yml
inventory: Workshop Inventory
+ execution_environment: Default execution environment
notification_templates_started: Telemetry
notification_templates_success: Telemetry
notification_templates_error: Telemetry
@@ -295,6 +324,40 @@ controller_templates:
variable: HOSTS
required: true
+ - name: "LINUX / Install web console"
+ job_type: run
+ inventory: "Workshop Inventory"
+ project: "Ansible official demo project"
+ playbook: "linux/system_roles.yml"
+ notification_templates_started: Telemetry
+ notification_templates_success: Telemetry
+ notification_templates_error: Telemetry
+ diff_mode: yes
+ ask_job_type_on_launch: yes
+ extra_vars:
+ system_roles:
+ - cockpit
+ credentials:
+ - "Workshop Credential"
+ survey_enabled: true
+ survey:
+ name: ''
+ description: ''
+ spec:
+ - question_name: Server Name or Pattern
+ type: text
+ variable: HOSTS
+ required: true
+ - question_name: Cockpit package load
+ type: multiplechoice
+ variable: cockpit_packages
+ default: minimal
+ choices:
+ - default
+ - minimal
+ - full
+ required: true
+
- name: "LINUX / Compliance Enforce"
job_type: run
inventory: "Workshop Inventory"
diff --git a/satellite/README.md b/satellite/README.md
new file mode 100644
index 0000000..4e70bbd
--- /dev/null
+++ b/satellite/README.md
@@ -0,0 +1,27 @@
+# Satellite Demos
+
+## Table of Contents
+- [Satellite Demos](#satellite-demos)
+ - [Table of Contents](#table-of-contents)
+ - [About These Demos](#about-these-demos)
+ - [Jobs](#jobs)
+ - [Inventory](#inventory)
+ - [Suggested Usage](#suggested-usage)
+
+## About These Demos
+This category of demos shows examples of linux operations and management with Ansible Automation Platform and Red Hat Satellite Server. The list of demos can be found below. See the [Suggested Usage](#suggested-usage) section of this document for recommendations on how to best use these demos.
+
+### Jobs
+- [**LINUX / Register with Satellite**](server_register.yml) - Register a RHEL server with Red Hat Satellite.
+- [**LINUX / Compliance Scan with Satellite**](server_openscap.yml) - Run OpenSCAP scan and report to Satellite.
+- [**SATELLITE / Publish Content View Version**](satellite_publish.yml) - Publish a new version of a content view.
+- [**SATELLITE / Promote Content View Version**](satellite_promote.yml) - Promote a content view version to the next lifecycle environment.
+
+### Inventory
+
+A dymanic inventory is created to pull inventory hosts from Red Hat Satellite. Groups will automatically be created
+
+## Suggested Usage
+**Linux / Register with Satellite** - Register a server with Red Hat Satellite using an activation key in the format `RHEL_`.
+
+**SATELLITE / Publish Content View Version** - Publish a new version of a content view to start a patching process. By default this will publish the version and promote to the 'Dev' environment.
diff --git a/satellite/files/ssg-rhel7-ds-tailoring.xml b/satellite/files/ssg-rhel7-ds-tailoring.xml
new file mode 100644
index 0000000..f5d6d00
--- /dev/null
+++ b/satellite/files/ssg-rhel7-ds-tailoring.xml
@@ -0,0 +1,61 @@
+
+
+
+ 1
+
+ DISA STIG for Red Hat Enterprise Linux 7 [CUSTOMIZED]
+ This profile contains configuration checks that align to the
+DISA STIG for Red Hat Enterprise Linux V3R7.
+
+In addition to being applicable to Red Hat Enterprise Linux 7, DISA recognizes this
+configuration baseline as applicable to the operating system tier of
+Red Hat technologies that are based on Red Hat Enterprise Linux 7, such as:
+
+- Red Hat Enterprise Linux Server
+- Red Hat Enterprise Linux Workstation and Desktop
+- Red Hat Enterprise Linux for HPC
+- Red Hat Storage
+- Red Hat Containers with a Red Hat Enterprise Linux 7 image
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/satellite/files/ssg-rhel8-ds-tailoring-stig-gui.xml b/satellite/files/ssg-rhel8-ds-tailoring-stig-gui.xml
new file mode 100644
index 0000000..1a17265
--- /dev/null
+++ b/satellite/files/ssg-rhel8-ds-tailoring-stig-gui.xml
@@ -0,0 +1,1562 @@
+
+
+
+ 1
+
+ DISA STIG with GUI for Red Hat Enterprise Linux 8 [CUSTOMIZED]
+ This profile contains configuration checks that align to the
+DISA STIG with GUI for Red Hat Enterprise Linux 8 V1R3.
+
+In addition to being applicable to Red Hat Enterprise Linux 8, DISA recognizes this
+configuration baseline as applicable to the operating system tier of
+Red Hat technologies that are based on Red Hat Enterprise Linux 8, such as:
+
+- Red Hat Enterprise Linux Server
+- Red Hat Enterprise Linux Workstation and Desktop
+- Red Hat Enterprise Linux for HPC
+- Red Hat Storage
+- Red Hat Containers with a Red Hat Enterprise Linux 8 image
+
+Warning: The installation and use of a Graphical User Interface (GUI)
+increases your attack vector and decreases your overall security posture. If
+your Information Systems Security Officer (ISSO) lacks a documented operational
+requirement for a graphical user interface, please consider using the
+standard DISA STIG for Red Hat Enterprise Linux 8 profile.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/satellite/host_vars/satellite.example.com/activation_keys.yml b/satellite/host_vars/satellite.example.com/activation_keys.yml
new file mode 100644
index 0000000..0710e0d
--- /dev/null
+++ b/satellite/host_vars/satellite.example.com/activation_keys.yml
@@ -0,0 +1,22 @@
+---
+satellite_activation_keys:
+ # Red Hat Enterprise Linux 7
+ - name: "RHEL7_Dev"
+ lifecycle_environment: "RHEL7_Dev"
+ content_view: "RHEL7"
+ - name: "RHEL7_QA"
+ lifecycle_environment: "RHEL7_QA"
+ content_view: "RHEL7"
+ - name: "RHEL7_Prod"
+ lifecycle_environment: "RHEL7_Prod"
+ content_view: "RHEL7"
+ # Red Hat Enterprise Linux 8
+ - name: "RHEL8_Dev"
+ lifecycle_environment: "RHEL8_Dev"
+ content_view: "RHEL8"
+ - name: "RHEL8_QA"
+ lifecycle_environment: "RHEL8_QA"
+ content_view: "RHEL8"
+ - name: "RHEL8_Prod"
+ lifecycle_environment: "RHEL8_Prod"
+ content_view: "RHEL8"
diff --git a/satellite/host_vars/satellite.example.com/content_views.yml b/satellite/host_vars/satellite.example.com/content_views.yml
new file mode 100644
index 0000000..6e6a7e0
--- /dev/null
+++ b/satellite/host_vars/satellite.example.com/content_views.yml
@@ -0,0 +1,29 @@
+---
+satellite_content_views:
+ # Red Hat Enterprise Linux 7
+ - name: RHEL7
+ content_view: RHEL7
+ repositories:
+ - name: Red Hat Enterprise Linux 7 Server (RPMs)
+ basearch: x86_64
+ releasever: 7Server
+ product: 'Red Hat Enterprise Linux Server'
+ - name: Red Hat Enterprise Linux 7 Server - Extras (RPMs)
+ basearch: x86_64
+ product: 'Red Hat Enterprise Linux Server'
+ - name: Red Hat Satellite Tools 6.8 (for RHEL 7 Server) (RPMs)
+ basearch: x86_64
+ product: 'Red Hat Enterprise Linux Server'
+ # Red Hat Enterprise Linux 8
+ - name: RHEL8
+ content_view: RHEL8
+ content_view_update: true
+ repositories:
+ - name: Red Hat Enterprise Linux 8 for x86_64 - BaseOS (RPMs)
+ releasever: 8
+ product: Red Hat Enterprise Linux for x86_64
+ - name: Red Hat Enterprise Linux 8 for x86_64 - AppStream (RPMs)
+ releasever: 8
+ product: Red Hat Enterprise Linux for x86_64
+ - name: Red Hat Satellite Tools 6.8 for RHEL 8 x86_64 (RPMs)
+ product: Red Hat Enterprise Linux for x86_64
diff --git a/satellite/host_vars/satellite.example.com/defaults.yml b/satellite/host_vars/satellite.example.com/defaults.yml
new file mode 100644
index 0000000..5997d72
--- /dev/null
+++ b/satellite/host_vars/satellite.example.com/defaults.yml
@@ -0,0 +1,3 @@
+---
+satellite_organization: "Default Organization"
+satellite_validate_certs: false
diff --git a/satellite/host_vars/satellite.example.com/lifecycle_environments.yml b/satellite/host_vars/satellite.example.com/lifecycle_environments.yml
new file mode 100644
index 0000000..72792a6
--- /dev/null
+++ b/satellite/host_vars/satellite.example.com/lifecycle_environments.yml
@@ -0,0 +1,16 @@
+---
+satellite_lifecycle_environments:
+ # Red Hat Enterprise Linux 7
+ - name: "RHEL7_Dev"
+ prior: "Library"
+ - name: "RHEL7_QA"
+ prior: "RHEL7_Dev"
+ - name: "RHEL7_Prod"
+ prior: "RHEL7_QA"
+ # Red Hat Enterprise Linux 8
+ - name: "RHEL8_Dev"
+ prior: "Library"
+ - name: "RHEL8_QA"
+ prior: "RHEL8_Dev"
+ - name: "RHEL8_Prod"
+ prior: "RHEL8_QA"
diff --git a/satellite/satellite_promote.yml b/satellite/satellite_promote.yml
new file mode 100644
index 0000000..3b39ace
--- /dev/null
+++ b/satellite/satellite_promote.yml
@@ -0,0 +1,17 @@
+---
+- hosts: localhost
+ connection: local
+ gather_facts: no
+ vars:
+ organization: Default Organization
+ lifecycle_environment: undef
+ current_lifecycle_environment: undef
+ content_view: undef
+
+ tasks:
+ - name: Promote Content View
+ redhat.satellite.content_view_version:
+ content_view: "{{ content_view }}"
+ organization: "{{ organization }}"
+ lifecycle_environments: "{{ lifecycle_environment }}"
+ current_lifecycle_environment: "{{ current_lifecycle_environment }}"
diff --git a/satellite/satellite_publish.yml b/satellite/satellite_publish.yml
new file mode 100644
index 0000000..33c2567
--- /dev/null
+++ b/satellite/satellite_publish.yml
@@ -0,0 +1,29 @@
+---
+- hosts: localhost
+ connection: local
+ gather_facts: no
+ vars:
+ content_view: undef
+ env: undef
+ organization: Default Organization
+ lifecycle_environment: "{{ content_view }}_{{ env }}"
+ publish_timeout: 14400
+ publish_retry_interval: 15
+
+ tasks:
+ - name: publish content view
+ redhat.satellite.content_view_version:
+ content_view: "{{ content_view }}"
+ organization: "{{ organization }}"
+ lifecycle_environments: "{{ lifecycle_environment }}"
+# async: "{{ publish_timeout }}"
+# poll: 0
+# register: publish_async
+
+# - name: check if content view is finished
+# async_status:
+# jid: "{{ publish_async.ansible_job_id }}"
+# register: job_result
+# until: job_result.finished
+# retries: "{{ ( publish_timeout / publish_retry_interval ) | int }}"
+# delay: "{{ publish_retry_interval }}"
diff --git a/satellite/server_openscap.yml b/satellite/server_openscap.yml
new file mode 100644
index 0000000..ac5129b
--- /dev/null
+++ b/satellite/server_openscap.yml
@@ -0,0 +1,16 @@
+---
+- hosts: "{{ HOSTS }}"
+ become: yes
+ vars:
+ policy_name: all
+ roles:
+ - demo.satellite.scap_client
+
+ tasks:
+ - name: Randomized startup delay...
+ pause: seconds="{{ 5 | random }}"
+
+ - name: "Run SCAP Scan"
+ shell: "/usr/bin/foreman_scap_client {{ item.id }}"
+ loop: "{{ policy }}"
+ when: policy_scan == 'all' or item.name in policy_scan
diff --git a/satellite/server_register.yml b/satellite/server_register.yml
new file mode 100644
index 0000000..0ee988a
--- /dev/null
+++ b/satellite/server_register.yml
@@ -0,0 +1,8 @@
+---
+- hosts: "{{ HOSTS }}"
+ become: yes
+ vars:
+ # env: undef
+ satellite_url: "{{ lookup('ansible.builtin.env', 'SATELLITE_SERVER') }}"
+ roles:
+ - demo.satellite.register_host
\ No newline at end of file
diff --git a/satellite/setup.yml b/satellite/setup.yml
new file mode 100644
index 0000000..b8fa354
--- /dev/null
+++ b/satellite/setup.yml
@@ -0,0 +1,275 @@
+user_message:
+
+controller_components:
+ - credential_types
+ - credentials
+ - inventory_sources
+ - job_templates
+ - job_launch
+# - workflow_job_templates
+
+controller_credential_types:
+ - name: Satellite Collection
+ kind: cloud
+ inputs:
+ fields:
+ - id: username
+ type: string
+ label: Satellite Username
+ - id: password
+ type: string
+ label: Satellite Password
+ secret: true
+ - id: host
+ type: string
+ label: Satellite Hostname
+ required:
+ - username
+ - password
+ - host
+ injectors:
+ env:
+ SATELLITE_SERVER: "{% raw %}{ { host }}{% endraw %}"
+ SATELLITE_USERNAME: "{% raw %}{ { username }}{% endraw %}"
+ SATELLITE_PASSWORD: "{% raw %}{ { password }}{% endraw %}"
+ SATELLITE_VALIDATE_CERTS: 'false'
+
+controller_credentials:
+ - name: Satellite Inventory
+ credential_type: Red Hat Satellite 6
+ organization: Default
+ inputs:
+ host: https://satellite.example.com
+ username: admin
+ password: ansible123!
+ - name: Satellite Credential
+ credential_type: Satellite Collection
+ organization: Default
+ inputs:
+ host: https://satellite.example.com
+ username: admin
+ password: ansible123!
+
+controller_inventory_sources:
+- name: Satellite Inventory
+ inventory: Workshop Inventory
+ credential: Satellite Inventory
+ source: satellite6
+ update_on_launch: false
+ execution_environment: Control Plane Execution Environment
+ overwrite: true
+ source_vars:
+ hostnames:
+ - name.split('.')[0]
+ groups:
+ patch_bugs: foreman_content_facet_attributes.errata_counts.bugfix
+ patch_enhancements: foreman_content_facet_attributes.errata_counts.enhancement
+ patch_security: foreman_content_facet_attributes.errata_counts.security
+ keyed_groups:
+ - prefix: env
+ key: foreman_content_facet_attributes.lifecycle_environment_name
+ - prefix: cv
+ key: foreman_content_facet_attributes.content_view_name
+ - prefix: os
+ key: foreman_operatingsystem_name
+ - prefix: scap
+ key: foreman_compliance_status_label
+ validate_certs: no
+
+controller_templates:
+- name: LINUX / Register with Satellite
+ project: Ansible official demo project
+ playbook: satellite/server_register.yml
+ inventory: Workshop Inventory
+ notification_templates_started: Telemetry
+ notification_templates_success: Telemetry
+ notification_templates_error: Telemetry
+ credentials:
+ - Workshop Credential
+ - Satellite Credential
+ extra_vars:
+ org_id: "Default_Organization"
+ survey_enabled: true
+ survey:
+ name: ''
+ description: ''
+ spec:
+ - question_name: Server Name or Pattern
+ type: text
+ variable: HOSTS
+ required: false
+ - question_name: Choose Environment
+ type: multiplechoice
+ variable: env
+ choices:
+ - Dev
+ - QA
+ - Prod
+ required: true
+
+- name: LINUX / Compliance Scan with Satellite
+ project: Ansible official demo project
+ playbook: satellite/server_openscap.yml
+ inventory: Workshop Inventory
+ execution_environment: Ansible Engine 2.9 execution environment
+ notification_templates_started: Telemetry
+ notification_templates_success: Telemetry
+ notification_templates_error: Telemetry
+ credentials:
+ - Satellite Credential
+ - Workshop Credential
+ extra_vars:
+ policy_scan: all
+ survey_enabled: true
+ survey:
+ name: ''
+ description: ''
+ spec:
+ - question_name: Server Name or Pattern
+ type: text
+ variable: HOSTS
+ required: false
+
+- name: SATELLITE / Publish Content View Version
+ project: Ansible official demo project
+ playbook: satellite/satellite_publish.yml
+ inventory: Workshop Inventory
+ notification_templates_started: Telemetry
+ notification_templates_success: Telemetry
+ notification_templates_error: Telemetry
+ credentials:
+ - Satellite Credential
+ extra_vars:
+ env: Dev
+ survey_enabled: true
+ survey:
+ name: ''
+ description: ''
+ spec:
+ - question_name: Select Content View
+ variable: content_view
+ type: multiplechoice
+ choices: "{{ satellite_content_views | selectattr('name', 'match', '^RHEL.*$') | map(attribute='name') | list}}"
+ required: true
+
+- name: SATELLITE / Promote Content View Version
+ project: Ansible official demo project
+ playbook: satellite/satellite_promote.yml
+ inventory: Workshop Inventory
+ notification_templates_started: Telemetry
+ notification_templates_success: Telemetry
+ notification_templates_error: Telemetry
+ credentials:
+ - Satellite Credential
+ survey_enabled: true
+ survey:
+ name: ''
+ description: ''
+ spec:
+ - question_name: Select Content View
+ variable: content_view
+ type: multiplechoice
+ choices: "{{ satellite_content_views | selectattr('name', 'match', '^RHEL.*$') | map(attribute='name') | list}}"
+ required: true
+ - question_name: Current Lifecycle Environment
+ variable: current_lifecycle_environment
+ type: multiplechoice
+ choices: "{{ satellite_lifecycle_environments | selectattr('name', 'match', '^RHEL.*$') | map(attribute='name') | list}}"
+ required: true
+ - question_name: Next Lifecycle Environment
+ variable: lifecycle_environment
+ type: multiplechoice
+ choices: "{{ satellite_lifecycle_environments | selectattr('name', 'match', '^RHEL.*$') | map(attribute='name') | list}}"
+ required: true
+
+- name: SETUP / Satellite
+ project: Ansible official demo project
+ playbook: satellite/setup_satellite.yml
+ inventory: Workshop Inventory
+ notification_templates_started: Telemetry
+ notification_templates_success: Telemetry
+ notification_templates_error: Telemetry
+ credentials:
+ - Satellite Credential
+
+
+controller_launch_jobs:
+ - name: SETUP
+ wait: false
+ extra_vars:
+ demo: linux
+
+ - name: SETUP / Satellite
+ wait: false
+
+#######################
+### Satellite Vars ###
+######################
+satellite_components:
+ - content_views
+ #- content_view_publish
+ - lifecycle_environments
+ - activation_keys
+
+satellite_organization: "Default Organization"
+satellite_validate_certs: false
+
+satellite_content_views:
+ # Red Hat Enterprise Linux 7
+ - name: RHEL7
+ content_view: RHEL7
+ repositories:
+ - name: Red Hat Enterprise Linux 7 Server RPMs x86_64 7Server
+ product: 'Red Hat Enterprise Linux Server'
+ - name: Red Hat Enterprise Linux 7 Server - Extras RPMs x86_64
+ product: 'Red Hat Enterprise Linux Server'
+ - name: Red Hat Satellite Client 6 for RHEL 7 Server RPMs x86_64
+ product: 'Red Hat Enterprise Linux Server'
+ # Red Hat Enterprise Linux 8
+ - name: RHEL8
+ content_view: RHEL8
+ repositories:
+ - name: Red Hat Enterprise Linux 8 for x86_64 - BaseOS RPMs 8
+ product: Red Hat Enterprise Linux for x86_64
+ - name: Red Hat Enterprise Linux 8 for x86_64 - AppStream RPMs 8
+ product: Red Hat Enterprise Linux for x86_64
+ - name: Red Hat Satellite Client 6 for RHEL 8 x86_64 RPMs
+ product: Red Hat Enterprise Linux for x86_64
+
+satellite_lifecycle_environments:
+ # Red Hat Enterprise Linux 7
+ - name: "RHEL7_Dev"
+ prior: "Library"
+ - name: "RHEL7_QA"
+ prior: "RHEL7_Dev"
+ - name: "RHEL7_Prod"
+ prior: "RHEL7_QA"
+ # Red Hat Enterprise Linux 8
+ - name: "RHEL8_Dev"
+ prior: "Library"
+ - name: "RHEL8_QA"
+ prior: "RHEL8_Dev"
+ - name: "RHEL8_Prod"
+ prior: "RHEL8_QA"
+
+satellite_activation_keys:
+ # Red Hat Enterprise Linux 7
+ - name: "RHEL7_Dev"
+ lifecycle_environment: "RHEL7_Dev"
+ content_view: "RHEL7"
+ - name: "RHEL7_QA"
+ lifecycle_environment: "RHEL7_QA"
+ content_view: "RHEL7"
+ - name: "RHEL7_Prod"
+ lifecycle_environment: "RHEL7_Prod"
+ content_view: "RHEL7"
+ # Red Hat Enterprise Linux 8
+ - name: "RHEL8_Dev"
+ lifecycle_environment: "RHEL8_Dev"
+ content_view: "RHEL8"
+ - name: "RHEL8_QA"
+ lifecycle_environment: "RHEL8_QA"
+ content_view: "RHEL8"
+ - name: "RHEL8_Prod"
+ lifecycle_environment: "RHEL8_Prod"
+ content_view: "RHEL8"
diff --git a/satellite/setup_satellite.yml b/satellite/setup_satellite.yml
new file mode 100644
index 0000000..c70fa47
--- /dev/null
+++ b/satellite/setup_satellite.yml
@@ -0,0 +1,54 @@
+---
+- hosts: localhost
+ gather_facts: no
+ vars_files: setup.yml
+ vars:
+ refresh_satellite_manifest: true
+
+ tasks:
+ - name: refresh manifest
+ redhat.satellite.subscription_manifest:
+ organization: "Default Organization"
+ state: refreshed
+ when: refresh_satellite_manifest
+
+ - name: Setup CV
+ include_role:
+ name: redhat.satellite.content_views
+
+ - name: Publish CV
+ include_role:
+ name: redhat.satellite.content_view_publish
+ vars:
+ satellite_content_views:
+ - RHEL7
+ - RHEL8
+
+ - name: Setup Lifecycle Environment
+ include_role:
+ name: redhat.satellite.lifecycle_environments
+
+ - name: redhat.satellite.content_view_publish CV
+ redhat.satellite.content_view_version:
+ organization: "{{ satellite_organization }}"
+ content_view: "{{ item }}"
+ lifecycle_environments:
+ - "{{ item }}_Dev"
+ - "{{ item }}_QA"
+ - "{{ item }}_Prod"
+ loop:
+ - RHEL7
+ - RHEL8
+
+ - name: Setup activation_keys
+ include_role:
+ name: redhat.satellite.activation_keys
+
+ - name: Add SCAP Tailoring File
+ redhat.satellite.scap_tailoring_file:
+ name: RHEL7_STIG
+ organizations: "{{ satellite_organization }}"
+ scap_file: "{{ item }}"
+ loop:
+ - files/ssg-rhel7-ds-tailoring.xml
+ - files/ssg-rhel8-ds-tailoring-stig-gui.xml
diff --git a/setup_demo.yml b/setup_demo.yml
index bc51eba..0850b63 100644
--- a/setup_demo.yml
+++ b/setup_demo.yml
@@ -13,6 +13,12 @@
- notification_templates
- job_templates
- settings
+ controller_execution_environments:
+ - name: product-demos
+ image: http://quay.io/acme_corp/product-demos-ee:latest
+ controller_organizations:
+ - name: Default
+ default_environment: product-demos
controller_notifications:
- name: Telemetry
organization: Default
@@ -22,7 +28,7 @@
http_method: POST
headers: {}
controller_templates:
- - name: "FEEDBACK"
+ - name: "SUBMIT FEEDBACK"
job_type: run
inventory: "Workshop Inventory"
project: "Ansible official demo project"
diff --git a/windows/create_ad_domain.yml b/windows/create_ad_domain.yml
index 2a085e8..bddbed6 100644
--- a/windows/create_ad_domain.yml
+++ b/windows/create_ad_domain.yml
@@ -4,7 +4,6 @@
gather_facts: false
tasks:
-
- name: Set Local Admin Password
ansible.windows.win_user:
name: Administrator
+
+