Compare commits
6 Commits
abandon-ga
...
wtome/2.5
| Author | SHA1 | Date | |
|---|---|---|---|
|
4eb0ec2e6b | ||
|
|
0b82706cc2 | ||
|
494d95a53a | ||
|
|
9b11779c2c | ||
|
|
95ebba694f | ||
|
|
93ce1d29b5 |
@@ -1,19 +1,12 @@
|
||||
---
|
||||
profile: production
|
||||
offline: true
|
||||
offline: false
|
||||
|
||||
skip_list:
|
||||
- "galaxy[no-changelog]"
|
||||
|
||||
warn_list:
|
||||
# seems to be a bug, see https://github.com/ansible/ansible-lint/issues/4172
|
||||
- "fqcn[canonical]"
|
||||
# @matferna: really not sure why lint thinks it can't find jmespath, it is installed and functional
|
||||
- "jinja[invalid]"
|
||||
|
||||
exclude_paths:
|
||||
# would be better to move the roles here to the top-level roles directory
|
||||
- collections/ansible_collections/demo/compliance/roles/
|
||||
- roles/redhatofficial.*
|
||||
- .github/
|
||||
- execution_environments/ee_contexts/
|
||||
|
||||
25
.github/workflows/README.md
vendored
25
.github/workflows/README.md
vendored
@@ -1,25 +0,0 @@
|
||||
# GitHub Actions
|
||||
## Background
|
||||
We want to make attempts to run our integration tests in the same manner wether using GitHub actions or on a developers's machine locally. For this reason, the tests are curated to run using conatiner images. As of this writing, two images exist which we would like to test against:
|
||||
- quay.io/ansible-product-demos/apd-ee-24:latest
|
||||
- quay.io/ansible-product-demos/apd-ee-25:latest
|
||||
|
||||
These images are built given the structure defined in their respective EE [definitions][../execution_environments]. Because they differ (mainly due to their python versions), each gets some special handling.
|
||||
|
||||
## Troubleshooting GitHub Actions
|
||||
|
||||
### Interactive
|
||||
It is likely the most straight-forward approach to interactively debug issues. The following podman command can be run from the project root directory to replicate the GitHub action:
|
||||
```
|
||||
podman run \
|
||||
--user root \
|
||||
-v $(pwd):/runner:Z \
|
||||
-it \
|
||||
<image> \
|
||||
/bin/bash
|
||||
```
|
||||
`<image>` is one of `quay.io/ansible-product-demos/apd-ee-25:latest`, `quay.io/ansible-product-demos/apd-ee-24:latest`
|
||||
It is not exact because GitHub seems to run closer to a sidecar container paradigm, and uses docker instead of podman, but hopefully it's close enough.
|
||||
|
||||
For the 24 EE, the python interpreriter verions is set for our pre-commit script like so: `USE_PYTHON=python3.9 ./.github/workflows/run-pc.sh`
|
||||
The 25 EE is similary run but without the need for this variable: `./.github/workflows/run-pc.sh`
|
||||
31
.github/workflows/pre-commit.yml
vendored
31
.github/workflows/pre-commit.yml
vendored
@@ -4,23 +4,16 @@ on:
|
||||
- push
|
||||
- pull_request_target
|
||||
|
||||
jobs:
|
||||
pre-commit-25:
|
||||
container:
|
||||
image: quay.io/ansible-product-demos/apd-ee-25
|
||||
options: --user root
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- run: ./.github/workflows/run-pc.sh
|
||||
shell: bash
|
||||
pre-commit-24:
|
||||
container:
|
||||
image: quay.io/ansible-product-demos/apd-ee-24
|
||||
options: --user root
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- run: USE_PYTHON=python3.9 ./.github/workflows/run-pc.sh
|
||||
shell: bash
|
||||
env:
|
||||
ANSIBLE_GALAXY_SERVER_AH_TOKEN: ${{ secrets.ANSIBLE_GALAXY_SERVER_AH_TOKEN }}
|
||||
|
||||
jobs:
|
||||
pre-commit:
|
||||
name: pre-commit
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-python@v5
|
||||
- uses: pre-commit/action@v3.0.1
|
||||
|
||||
...
|
||||
|
||||
24
.github/workflows/run-pc.sh
vendored
24
.github/workflows/run-pc.sh
vendored
@@ -1,24 +0,0 @@
|
||||
#!/bin/bash -x
|
||||
|
||||
dnf install git-lfs -y
|
||||
|
||||
PYTHON_VARIANT="${USE_PYTHON:-python3.11}"
|
||||
PATH="$PATH:$HOME/.local/bin"
|
||||
|
||||
# intsall pip
|
||||
eval "${PYTHON_VARIANT} -m pip install --user --upgrade pip"
|
||||
|
||||
# try to fix 2.4 incompatibility
|
||||
eval "${PYTHON_VARIANT} -m pip install --user --upgrade setuptools wheel twine check-wheel-contents"
|
||||
|
||||
# intsall pre-commit
|
||||
eval "${PYTHON_VARIANT} -m pip install --user pre-commit"
|
||||
|
||||
# view pip packages
|
||||
eval "${PYTHON_VARIANT} -m pip freeze --local"
|
||||
|
||||
# fix permissions on directory
|
||||
git config --global --add safe.directory $(pwd)
|
||||
|
||||
# run pre-commit
|
||||
pre-commit run --config $(pwd)/.pre-commit-gh.yml --show-diff-on-failure --color=always
|
||||
3
.gitignore
vendored
3
.gitignore
vendored
@@ -10,6 +10,3 @@ choose_demo_example_aws.yml
|
||||
roles/*
|
||||
!roles/requirements.yml
|
||||
.deployment_id
|
||||
.cache/
|
||||
.ansible/
|
||||
**/tmp/
|
||||
|
||||
@@ -3,6 +3,9 @@ repos:
|
||||
- repo: https://github.com/pre-commit/pre-commit-hooks
|
||||
rev: v4.4.0
|
||||
hooks:
|
||||
- id: end-of-file-fixer
|
||||
exclude: rhel[89]STIG/.*$
|
||||
|
||||
- id: trailing-whitespace
|
||||
exclude: rhel[89]STIG/.*$
|
||||
|
||||
@@ -14,12 +17,13 @@ repos:
|
||||
- id: check-json
|
||||
- id: check-symlinks
|
||||
|
||||
- repo: local
|
||||
- repo: https://github.com/ansible/ansible-lint.git
|
||||
# get latest release tag from https://github.com/ansible/ansible-lint/releases/
|
||||
rev: v6.20.3
|
||||
hooks:
|
||||
- id: ansible-lint
|
||||
name: ansible-navigator lint --eei quay.io/ansible-product-demos/apd-ee-25:latest --mode stdout
|
||||
language: python
|
||||
entry: bash -c "ansible-navigator lint --eei quay.io/ansible-product-demos/apd-ee-25 -v --force-color --mode stdout"
|
||||
additional_dependencies:
|
||||
- jmespath
|
||||
|
||||
- repo: https://github.com/psf/black-pre-commit-mirror
|
||||
rev: 23.11.0
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
---
|
||||
repos:
|
||||
- repo: https://github.com/pre-commit/pre-commit-hooks
|
||||
rev: v4.4.0
|
||||
hooks:
|
||||
- id: trailing-whitespace
|
||||
exclude: rhel[89]STIG/.*$
|
||||
|
||||
- id: check-yaml
|
||||
exclude: \.j2.(yaml|yml)$|\.(yaml|yml).j2$
|
||||
args: [--unsafe] # see https://github.com/pre-commit/pre-commit-hooks/issues/273
|
||||
|
||||
- id: check-toml
|
||||
- id: check-json
|
||||
- id: check-symlinks
|
||||
|
||||
- repo: https://github.com/ansible/ansible-lint.git
|
||||
# get latest release tag from https://github.com/ansible/ansible-lint/releases/
|
||||
rev: v6.20.3
|
||||
hooks:
|
||||
- id: ansible-lint
|
||||
additional_dependencies:
|
||||
- jmespath
|
||||
|
||||
- repo: https://github.com/psf/black-pre-commit-mirror
|
||||
rev: 23.11.0
|
||||
hooks:
|
||||
- id: black
|
||||
exclude: rhel[89]STIG/.*$
|
||||
...
|
||||
14
README.md
14
README.md
@@ -1,18 +1,16 @@
|
||||
[](https://red.ht/aap-product-demos)
|
||||
[](https://workspaces.openshift.com/f?url=https://github.com/ansible/product-demos)
|
||||
[](https://github.com/pre-commit/pre-commit)
|
||||
|
||||
# Official Ansible Product Demos
|
||||
|
||||
This is a centralized location for Ansible Product Demos. This project is a collection of use cases implemented with Ansible for use with the [Ansible Automation Platform](https://www.redhat.com/en/technologies/management/ansible).
|
||||
This is a centralized location for Ansible Product Demos. This project is a collection of use cases implemented with Ansible for use with the Ansible Automation Platform.
|
||||
|
||||
| Demo Name | Description |
|
||||
|-----------|-------------|
|
||||
| [Linux](linux/README.md) | Repository of demos for RHEL and Linux automation |
|
||||
| [Windows](windows/README.md) | Repository of demos for Windows Server automation |
|
||||
| [Cloud](cloud/README.md) | Demo for infrastructure and cloud provisioning automation |
|
||||
| [Network](network/README.md) | Network automation demos |
|
||||
| [OpenShift](openshift/README.md) | OpenShift automation demos |
|
||||
| [Network](network/README.md) | Ansible Network automation demos |
|
||||
| [Satellite](satellite/README.md) | Demos of automation with Red Hat Satellite Server |
|
||||
|
||||
## Contributions
|
||||
@@ -21,7 +19,7 @@ If you would like to contribute to this project please refer to [contribution gu
|
||||
|
||||
## Using this project
|
||||
|
||||
This project is tested for compatibility with the [demo.redhat.com Ansible Product Demos](https://demo.redhat.com/catalog?search=product+demos&item=babylon-catalog-prod%2Fopenshift-cnv.aap-product-demos-cnv.prod) lab environment. To use with other Ansible Automation Platform installations, review the [prerequisite documentation](https://github.com/ansible/product-demos-bootstrap).
|
||||
This project is tested for compatibility with the [demo.redhat.com Product Demos Sandbox](https://demo.redhat.com/catalog?search=product+demos&item=babylon-catalog-prod%2Fopenshift-cnv.aap-product-demos-cnv.prod) lab environment. To use with other Ansible Controller installations, review the [prerequisite documentation](https://github.com/RedHatGov/ansible-tower-samples).
|
||||
|
||||
> NOTE: demo.redhat.com is available to Red Hat Associates and Partners with a valid account.
|
||||
|
||||
@@ -39,7 +37,7 @@ This project is tested for compatibility with the [demo.redhat.com Ansible Produ
|
||||
- Image: quay.io/acme_corp/product-demos-ee:latest
|
||||
- Pull: Only pull the image if not present before running
|
||||
|
||||
3. If it is not already created for you, create a Project called `Ansible Product Demos` with this repo as a source. NOTE: if you are using a fork, be sure that you have the correct URL. Update the project.
|
||||
3. If it is not already created for you, create a Project called `Ansible official demo project` with this repo as a source. NOTE: if you are using a fork, be sure that you have the correct URL. Update the project.
|
||||
|
||||
4. Finally, Create a Job Template called `Setup` with the following configuration:
|
||||
|
||||
@@ -59,8 +57,8 @@ This project is tested for compatibility with the [demo.redhat.com Ansible Produ
|
||||
Can't find what you're looking for? Customize this repo to make it your own.
|
||||
|
||||
1. Create a fork of this repo.
|
||||
2. Update the URL of the `Ansible Project Demos` in the Controller.
|
||||
3. Make changes as needed and run the **Product Demos | Single demo setup** job
|
||||
2. Update the URL of the `Ansible official demo project` in the Controller.
|
||||
3. Make changes as needed and run the **Setup** job
|
||||
|
||||
See the [contribution guide](CONTRIBUTING.md) for more details on how to customize the project.
|
||||
|
||||
|
||||
14
ansible.cfg
14
ansible.cfg
@@ -1,19 +1,15 @@
|
||||
[defaults]
|
||||
collections_path=./collections:/usr/share/ansible/collections
|
||||
collections_path=./collections
|
||||
roles_path=./roles
|
||||
|
||||
[galaxy]
|
||||
server_list = certified,validated,galaxy
|
||||
server_list = ah,galaxy
|
||||
|
||||
[galaxy_server.certified]
|
||||
[galaxy_server.ah]
|
||||
# Grab a token at https://console.redhat.com/ansible/automation-hub/token
|
||||
# Then define it in the ANSIBLE_GALAXY_SERVER_CERTIFIED_TOKEN environment variable
|
||||
url=https://console.redhat.com/api/automation-hub/content/published/
|
||||
auth_url=https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token
|
||||
# Then define it using ANSIBLE_GALAXY_SERVER_AH_TOKEN=""
|
||||
|
||||
[galaxy_server.validated]
|
||||
# Define the token in the ANSIBLE_GALAXY_SERVER_VALIDATED_TOKEN environment variable
|
||||
url=https://console.redhat.com/api/automation-hub/content/validated/
|
||||
url=https://console.redhat.com/api/automation-hub/content/published/
|
||||
auth_url=https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token
|
||||
|
||||
[galaxy_server.galaxy]
|
||||
|
||||
@@ -19,11 +19,12 @@ This category of demos shows examples of multi-cloud provisioning and management
|
||||
|
||||
### Jobs
|
||||
|
||||
- [**Cloud / AWS / Create VM**](create_vm.yml) - Create a VM based on a [blueprint](blueprints/) in the selected cloud provider
|
||||
- [**Cloud / AWS / Destroy VM**](destroy_vm.yml) - Destroy a VM that has been created in a cloud provider. VM must be imported into dynamic inventory to be deleted.
|
||||
- [**Cloud / AWS / Snapshot EC2**](snapshot_ec2.yml) - Snapshot a VM that has been created in a cloud provider. VM must be imported into dynamic inventory to be snapshot.
|
||||
- [**Cloud / AWS / Restore EC2 from Snapshot**](snapshot_ec2.yml) - Restore a VM that has been created in a cloud provider. By default, volumes will be restored from their latest snapshot. VM must be imported into dynamic inventory to be patched.
|
||||
- [**Cloud / Resize EC2**](resize_ec2.yml) - Re-size an EC2 instance.
|
||||
- [**Cloud / Create Infra**](create_infra.yml) - Creates a VPC with required routing and firewall rules for provisioning VMs
|
||||
- [**Cloud / Create Keypair**](aws_key.yml) - Creates a keypair for connecting to EC2 instances
|
||||
- [**Cloud / Create VM**](create_vm.yml) - Create a VM based on a [blueprint](blueprints/) in the selected cloud provider
|
||||
- [**Cloud / Destroy VM**](destroy_vm.yml) - Destroy a VM that has been created in a cloud provider. VM must be imported into dynamic inventory to be deleted.
|
||||
- [**Cloud / Snapshot EC2**](snapshot_ec2.yml) - Snapshot a VM that has been created in a cloud provider. VM must be imported into dynamic inventory to be snapshot.
|
||||
- [**Cloud / Restore EC2 from Snapshot**](snapshot_ec2.yml) - Restore a VM that has been created in a cloud provider. By default, volumes will be restored from their latest snapshot. VM must be imported into dynamic inventory to be patched.
|
||||
|
||||
### Inventory
|
||||
|
||||
@@ -58,13 +59,11 @@ After running the setup job template, there are a few steps required to make the
|
||||
|
||||
## Suggested Usage
|
||||
|
||||
**Deploy Cloud Stack in AWS** - This workflow builds out many helpful and convient resources in AWS. Given an AWS region, key, and some organizational paremetres for tagging it builds a default VPC, keypair, five VMs (three RHEL and two Windows), and even provides a report for cloud stats. It is the typical starting point for using Ansible Product-Demos in AWS.
|
||||
**Cloud / Create Keypair** - The Create Keypair job creates an EC2 keypair which can be used when creating EC2 instances to enable SSH access.
|
||||
|
||||
**Cloud / Create VM** - The Create VM job builds a VM in the given provider based on the included `demo.cloud` collection. VM [blueprints](blueprints/) define variables for each provider that override the defaults in the collection. When creating VMs it is recommended to follow naming conventions that can be used as host patterns. (eg. VM names: `win1`, `win2`, `win3`. Host Pattern: `win*` )
|
||||
|
||||
**Cloud / AWS / Patch EC2 Workflow** - Create a VPC and one or more linux VM(s) in AWS using the `Cloud / Create VPC` and `Cloud / Create VM` templates. Run the workflow and observe the instance snapshots followed by patching operation. Optionally, use the survey to force a patch failure in order to demonstrate the restore path. At this time, the workflow does not support patching Windows instances.
|
||||
|
||||
**Cloud / AWS / Resize EC2** - Given an EC2 instance, change its size. This takes an AWS region, target host pattern, and a target instance size as parameters. As a final step, this job refreshes the AWS inventory so the re-created instance is accessible from AAP.
|
||||
|
||||
## Known Issues
|
||||
Azure does not work without a custom execution environment that includes the Azure dependencies.
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
- name: Create Cloud Infra
|
||||
hosts: localhost
|
||||
gather_facts: false
|
||||
|
||||
vars:
|
||||
aws_vpc_name: aws-test-vpc
|
||||
aws_owner_tag: default
|
||||
@@ -14,27 +13,6 @@
|
||||
aws_subnet_name: aws-test-subnet
|
||||
aws_rt_name: aws-test-rt
|
||||
|
||||
# map of availability zones to use per region, added since not all
|
||||
# instance types are available in all AZs. must match the drop-down
|
||||
# list for the create_vm_aws_region variable described in cloud/setup.yml
|
||||
_azs:
|
||||
us-east-1:
|
||||
- us-east-1a
|
||||
- us-east-1b
|
||||
- us-east-1c
|
||||
us-east-2:
|
||||
- us-east-2a
|
||||
- us-east-2b
|
||||
- us-east-2c
|
||||
us-west-1:
|
||||
# us-west-1a not available when last checked 20250218
|
||||
- us-west-1b
|
||||
- us-west-1c
|
||||
us-west-2:
|
||||
- us-west-2a
|
||||
- us-west-2b
|
||||
- us-west-2c
|
||||
|
||||
tasks:
|
||||
- name: Create VPC
|
||||
amazon.aws.ec2_vpc_net:
|
||||
@@ -117,13 +95,12 @@
|
||||
owner: "{{ aws_owner_tag }}"
|
||||
purpose: "{{ aws_purpose_tag }}"
|
||||
|
||||
- name: Create a subnet in the VPC
|
||||
- name: Create a subnet on the VPC
|
||||
amazon.aws.ec2_vpc_subnet:
|
||||
state: present
|
||||
vpc_id: "{{ aws_vpc.vpc.id }}"
|
||||
cidr: "{{ aws_subnet_cidr }}"
|
||||
region: "{{ create_vm_aws_region }}"
|
||||
az: "{{ _azs[create_vm_aws_region] | shuffle | first }}"
|
||||
map_public: true
|
||||
tags:
|
||||
Name: "{{ aws_subnet_name }}"
|
||||
|
||||
@@ -1,10 +0,0 @@
|
||||
---
|
||||
- name: Resize ec2 instances
|
||||
hosts: "{{ _hosts | default(omit) }}"
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Include snapshot role
|
||||
ansible.builtin.include_role:
|
||||
name: "demo.cloud.aws"
|
||||
tasks_from: resize_ec2
|
||||
@@ -114,7 +114,7 @@ controller_templates:
|
||||
organization: Default
|
||||
credentials:
|
||||
- AWS
|
||||
project: Ansible Product Demos
|
||||
project: Ansible official demo project
|
||||
playbook: cloud/snapshot_ec2.yml
|
||||
inventory: Demo Inventory
|
||||
notification_templates_started: Telemetry
|
||||
@@ -145,7 +145,7 @@ controller_templates:
|
||||
organization: Default
|
||||
credentials:
|
||||
- AWS
|
||||
project: Ansible Product Demos
|
||||
project: Ansible official demo project
|
||||
playbook: cloud/restore_ec2.yml
|
||||
inventory: Demo Inventory
|
||||
notification_templates_started: Telemetry
|
||||
@@ -176,7 +176,7 @@ controller_templates:
|
||||
organization: Default
|
||||
credentials:
|
||||
- AWS
|
||||
project: Ansible Product Demos
|
||||
project: Ansible official demo project
|
||||
playbook: cloud/display-ec2-stats.yml
|
||||
inventory: Demo Inventory
|
||||
notification_templates_started: Telemetry
|
||||
@@ -186,7 +186,7 @@ controller_templates:
|
||||
- name: "LINUX / Patching"
|
||||
job_type: check
|
||||
inventory: "Demo Inventory"
|
||||
project: "Ansible Product Demos"
|
||||
project: "Ansible official demo project"
|
||||
playbook: "linux/patching.yml"
|
||||
execution_environment: Default execution environment
|
||||
notification_templates_started: Telemetry
|
||||
@@ -283,7 +283,7 @@ controller_workflows:
|
||||
- identifier: Deploy Windows GUI Blueprint
|
||||
unified_job_template: Cloud / AWS / Create VM
|
||||
extra_data:
|
||||
create_vm_vm_name: aws-dc
|
||||
create_vm_vm_name: aws_dc
|
||||
vm_blueprint: windows_full
|
||||
success_nodes:
|
||||
- Update Inventory
|
||||
@@ -368,7 +368,7 @@ controller_workflows:
|
||||
default: os_linux
|
||||
simplified_workflow_nodes:
|
||||
- identifier: Project Sync
|
||||
unified_job_template: Ansible Product Demos
|
||||
unified_job_template: Ansible official demo project
|
||||
success_nodes:
|
||||
- Take Snapshot
|
||||
- identifier: Inventory Sync
|
||||
|
||||
@@ -1,45 +0,0 @@
|
||||
---
|
||||
# parameters
|
||||
# instance_type: new instance type, e.g. t3.large
|
||||
- name: AWS | RESIZE VM
|
||||
delegate_to: localhost
|
||||
vars:
|
||||
controller_dependency_check: false # noqa: var-naming[no-role-prefix]
|
||||
controller_inventory_sources:
|
||||
- name: AWS Inventory
|
||||
inventory: Demo Inventory
|
||||
organization: Default
|
||||
wait: true
|
||||
block:
|
||||
- name: AWS | RESIZE EC2 | assert required vars
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- instance_id is defined
|
||||
- aws_region is defined
|
||||
fail_msg: "instance_id, aws_region is required for resize operations"
|
||||
|
||||
- name: AWS | RESIZE EC2 | shutdown instance
|
||||
amazon.aws.ec2_instance:
|
||||
instance_ids: "{{ instance_id }}"
|
||||
region: "{{ aws_region }}"
|
||||
state: stopped
|
||||
wait: true
|
||||
|
||||
- name: AWS | RESIZE EC2 | update instance type
|
||||
amazon.aws.ec2_instance:
|
||||
region: "{{ aws_region }}"
|
||||
instance_ids: "{{ instance_id }}"
|
||||
instance_type: "{{ instance_type }}"
|
||||
wait: true
|
||||
|
||||
- name: AWS | RESIZE EC2 | start instance
|
||||
amazon.aws.ec2_instance:
|
||||
instance_ids: "{{ instance_id }}"
|
||||
region: "{{ aws_region }}"
|
||||
state: started
|
||||
wait: true
|
||||
|
||||
- name: Synchronize inventory
|
||||
run_once: true
|
||||
ansible.builtin.include_role:
|
||||
name: infra.controller_configuration.inventory_source_update
|
||||
@@ -3,7 +3,7 @@ rhel8STIG_stigrule_230225_Manage: True
|
||||
rhel8STIG_stigrule_230225_banner_Line: banner /etc/issue
|
||||
# R-230226 RHEL-08-010050
|
||||
rhel8STIG_stigrule_230226_Manage: True
|
||||
rhel8STIG_stigrule_230226__etc_dconf_db_local_d_01_banner_message_Value: "''You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.''"
|
||||
rhel8STIG_stigrule_230226__etc_dconf_db_local_d_01_banner_message_Value: '''You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.'''
|
||||
# R-230227 RHEL-08-010060
|
||||
rhel8STIG_stigrule_230227_Manage: True
|
||||
rhel8STIG_stigrule_230227__etc_issue_Dest: /etc/issue
|
||||
@@ -43,6 +43,9 @@ rhel8STIG_stigrule_230241_policycoreutils_State: installed
|
||||
# R-230244 RHEL-08-010200
|
||||
rhel8STIG_stigrule_230244_Manage: True
|
||||
rhel8STIG_stigrule_230244_ClientAliveCountMax_Line: ClientAliveCountMax 1
|
||||
# R-230252 RHEL-08-010291
|
||||
rhel8STIG_stigrule_230252_Manage: True
|
||||
rhel8STIG_stigrule_230252__etc_sysconfig_sshd_Line: '# CRYPTO_POLICY='
|
||||
# R-230255 RHEL-08-010294
|
||||
rhel8STIG_stigrule_230255_Manage: True
|
||||
rhel8STIG_stigrule_230255__etc_crypto_policies_back_ends_opensslcnf_config_Line: 'MinProtocol = TLSv1.2'
|
||||
@@ -135,9 +138,16 @@ rhel8STIG_stigrule_230346__etc_security_limits_conf_Line: '* hard maxlogins 10'
|
||||
# R-230347 RHEL-08-020030
|
||||
rhel8STIG_stigrule_230347_Manage: True
|
||||
rhel8STIG_stigrule_230347__etc_dconf_db_local_d_00_screensaver_Value: 'true'
|
||||
# R-230348 RHEL-08-020040
|
||||
rhel8STIG_stigrule_230348_Manage: True
|
||||
rhel8STIG_stigrule_230348_ensure_tmux_is_installed_State: installed
|
||||
rhel8STIG_stigrule_230348__etc_tmux_conf_Line: 'set -g lock-command vlock'
|
||||
# R-230352 RHEL-08-020060
|
||||
rhel8STIG_stigrule_230352_Manage: True
|
||||
rhel8STIG_stigrule_230352__etc_dconf_db_local_d_00_screensaver_Value: 'uint32 900'
|
||||
# R-230353 RHEL-08-020070
|
||||
rhel8STIG_stigrule_230353_Manage: True
|
||||
rhel8STIG_stigrule_230353__etc_tmux_conf_Line: 'set -g lock-after-time 900'
|
||||
# R-230354 RHEL-08-020080
|
||||
rhel8STIG_stigrule_230354_Manage: True
|
||||
rhel8STIG_stigrule_230354__etc_dconf_db_local_d_locks_session_Line: '/org/gnome/desktop/screensaver/lock-delay'
|
||||
@@ -325,8 +335,8 @@ rhel8STIG_stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b32_Line: '
|
||||
rhel8STIG_stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b64_Line: '-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'
|
||||
# R-230439 RHEL-08-030361
|
||||
rhel8STIG_stigrule_230439_Manage: True
|
||||
rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32_Line: '-a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete'
|
||||
rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64_Line: '-a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete'
|
||||
rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32_Line: '-a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=unset -k module_chng'
|
||||
rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64_Line: '-a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=unset -k module_chng'
|
||||
# R-230444 RHEL-08-030370
|
||||
rhel8STIG_stigrule_230444_Manage: True
|
||||
rhel8STIG_stigrule_230444__etc_audit_rules_d_audit_rules__usr_bin_gpasswd_Line: '-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd'
|
||||
@@ -422,8 +432,7 @@ rhel8STIG_stigrule_230527_Manage: True
|
||||
rhel8STIG_stigrule_230527_RekeyLimit_Line: RekeyLimit 1G 1h
|
||||
# R-230529 RHEL-08-040170
|
||||
rhel8STIG_stigrule_230529_Manage: True
|
||||
rhel8STIG_stigrule_230529_ctrl_alt_del_target_disable_Enabled: false
|
||||
rhel8STIG_stigrule_230529_ctrl_alt_del_target_mask_Masked: true
|
||||
rhel8STIG_stigrule_230529_systemctl_mask_ctrl_alt_del_target_Command: systemctl mask ctrl-alt-del.target
|
||||
# R-230531 RHEL-08-040172
|
||||
rhel8STIG_stigrule_230531_Manage: True
|
||||
rhel8STIG_stigrule_230531__etc_systemd_system_conf_Value: 'none'
|
||||
@@ -505,9 +514,6 @@ rhel8STIG_stigrule_244523__usr_lib_systemd_system_emergency_service_Value: '-/us
|
||||
# R-244525 RHEL-08-010201
|
||||
rhel8STIG_stigrule_244525_Manage: True
|
||||
rhel8STIG_stigrule_244525_ClientAliveInterval_Line: ClientAliveInterval 600
|
||||
# R-244526 RHEL-08-010287
|
||||
rhel8STIG_stigrule_244526_Manage: True
|
||||
rhel8STIG_stigrule_244526__etc_sysconfig_sshd_Line: '# CRYPTO_POLICY='
|
||||
# R-244527 RHEL-08-010472
|
||||
rhel8STIG_stigrule_244527_Manage: True
|
||||
rhel8STIG_stigrule_244527_rng_tools_State: installed
|
||||
@@ -520,6 +526,9 @@ rhel8STIG_stigrule_244535__etc_dconf_db_local_d_00_screensaver_Value: 'uint32 5'
|
||||
# R-244536 RHEL-08-020032
|
||||
rhel8STIG_stigrule_244536_Manage: True
|
||||
rhel8STIG_stigrule_244536__etc_dconf_db_local_d_02_login_screen_Value: 'true'
|
||||
# R-244537 RHEL-08-020039
|
||||
rhel8STIG_stigrule_244537_Manage: True
|
||||
rhel8STIG_stigrule_244537_tmux_State: installed
|
||||
# R-244538 RHEL-08-020081
|
||||
rhel8STIG_stigrule_244538_Manage: True
|
||||
rhel8STIG_stigrule_244538__etc_dconf_db_local_d_locks_session_idle_delay_Line: '/org/gnome/desktop/session/idle-delay'
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -6,25 +6,6 @@
|
||||
service:
|
||||
name: sshd
|
||||
state: restarted
|
||||
- name: rsyslog_restart
|
||||
service:
|
||||
name: rsyslog
|
||||
state: restarted
|
||||
- name: sysctl_load_settings
|
||||
command: sysctl --system
|
||||
- name: daemon_reload
|
||||
systemd:
|
||||
daemon_reload: true
|
||||
- name: networkmanager_reload
|
||||
service:
|
||||
name: NetworkManager
|
||||
state: reloaded
|
||||
- name: logind_restart
|
||||
service:
|
||||
name: systemd-logind
|
||||
state: restarted
|
||||
- name: with_faillock_enable
|
||||
command: authselect enable-feature with-faillock
|
||||
- name: do_reboot
|
||||
reboot:
|
||||
pre_reboot_delay: 60
|
||||
|
||||
@@ -88,6 +88,16 @@
|
||||
when:
|
||||
- rhel8STIG_stigrule_230244_Manage
|
||||
- "'openssh-server' in packages"
|
||||
# R-230252 RHEL-08-010291
|
||||
- name: stigrule_230252__etc_sysconfig_sshd
|
||||
lineinfile:
|
||||
path: /etc/sysconfig/sshd
|
||||
regexp: '^# CRYPTO_POLICY='
|
||||
line: "{{ rhel8STIG_stigrule_230252__etc_sysconfig_sshd_Line }}"
|
||||
create: yes
|
||||
notify: do_reboot
|
||||
when:
|
||||
- rhel8STIG_stigrule_230252_Manage
|
||||
# R-230255 RHEL-08-010294
|
||||
- name: stigrule_230255__etc_crypto_policies_back_ends_opensslcnf_config
|
||||
lineinfile:
|
||||
@@ -101,7 +111,6 @@
|
||||
- name: stigrule_230256__etc_crypto_policies_back_ends_gnutls_config
|
||||
lineinfile:
|
||||
path: /etc/crypto-policies/back-ends/gnutls.config
|
||||
regexp: '^\+VERS'
|
||||
line: "{{ rhel8STIG_stigrule_230256__etc_crypto_policies_back_ends_gnutls_config_Line }}"
|
||||
create: yes
|
||||
when:
|
||||
@@ -413,6 +422,20 @@
|
||||
when:
|
||||
- rhel8STIG_stigrule_230347_Manage
|
||||
- "'dconf' in packages"
|
||||
# R-230348 RHEL-08-020040
|
||||
- name: stigrule_230348_ensure_tmux_is_installed
|
||||
yum:
|
||||
name: tmux
|
||||
state: "{{ rhel8STIG_stigrule_230348_ensure_tmux_is_installed_State }}"
|
||||
when: rhel8STIG_stigrule_230348_Manage
|
||||
# R-230348 RHEL-08-020040
|
||||
- name: stigrule_230348__etc_tmux_conf
|
||||
lineinfile:
|
||||
path: /etc/tmux.conf
|
||||
line: "{{ rhel8STIG_stigrule_230348__etc_tmux_conf_Line }}"
|
||||
create: yes
|
||||
when:
|
||||
- rhel8STIG_stigrule_230348_Manage
|
||||
# R-230352 RHEL-08-020060
|
||||
- name: stigrule_230352__etc_dconf_db_local_d_00_screensaver
|
||||
ini_file:
|
||||
@@ -425,13 +448,20 @@
|
||||
when:
|
||||
- rhel8STIG_stigrule_230352_Manage
|
||||
- "'dconf' in packages"
|
||||
# R-230353 RHEL-08-020070
|
||||
- name: stigrule_230353__etc_tmux_conf
|
||||
lineinfile:
|
||||
path: /etc/tmux.conf
|
||||
line: "{{ rhel8STIG_stigrule_230353__etc_tmux_conf_Line }}"
|
||||
create: yes
|
||||
when:
|
||||
- rhel8STIG_stigrule_230353_Manage
|
||||
# R-230354 RHEL-08-020080
|
||||
- name: stigrule_230354__etc_dconf_db_local_d_locks_session
|
||||
lineinfile:
|
||||
path: /etc/dconf/db/local.d/locks/session
|
||||
line: "{{ rhel8STIG_stigrule_230354__etc_dconf_db_local_d_locks_session_Line }}"
|
||||
create: yes
|
||||
notify: dconf_update
|
||||
when:
|
||||
- rhel8STIG_stigrule_230354_Manage
|
||||
# R-230357 RHEL-08-020110
|
||||
@@ -986,7 +1016,7 @@
|
||||
- name : stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32
|
||||
lineinfile:
|
||||
path: /etc/audit/rules.d/audit.rules
|
||||
regexp: '^-a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete$'
|
||||
regexp: '^-a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=unset -k module_chng$'
|
||||
line: "{{ rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32_Line }}"
|
||||
notify: auditd_restart
|
||||
when: rhel8STIG_stigrule_230439_Manage
|
||||
@@ -994,7 +1024,7 @@
|
||||
- name : stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64
|
||||
lineinfile:
|
||||
path: /etc/audit/rules.d/audit.rules
|
||||
regexp: '^-a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete$'
|
||||
regexp: '^-a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=unset -k module_chng$'
|
||||
line: "{{ rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64_Line }}"
|
||||
notify: auditd_restart
|
||||
when: rhel8STIG_stigrule_230439_Manage
|
||||
@@ -1307,33 +1337,13 @@
|
||||
- rhel8STIG_stigrule_230527_Manage
|
||||
- "'openssh-server' in packages"
|
||||
# R-230529 RHEL-08-040170
|
||||
- name: check if ctrl-alt-del.target is installed
|
||||
shell: ! systemctl list-unit-files | grep "^ctrl-alt-del.target[ \t]\+"
|
||||
changed_when: False
|
||||
check_mode: no
|
||||
register: result
|
||||
failed_when: result.rc > 1
|
||||
- name: stigrule_230529_ctrl_alt_del_target_disable
|
||||
systemd_service:
|
||||
- name: stigrule_230529_systemctl_mask_ctrl_alt_del_target
|
||||
systemd:
|
||||
name: ctrl-alt-del.target
|
||||
enabled: "{{ rhel8STIG_stigrule_230529_ctrl_alt_del_target_disable_Enabled }}"
|
||||
enabled: no
|
||||
masked: yes
|
||||
when:
|
||||
- rhel8STIG_stigrule_230529_Manage
|
||||
- result.rc == 0
|
||||
# R-230529 RHEL-08-040170
|
||||
- name: check if ctrl-alt-del.target is installed
|
||||
shell: ! systemctl list-unit-files | grep "^ctrl-alt-del.target[ \t]\+"
|
||||
changed_when: False
|
||||
check_mode: no
|
||||
register: result
|
||||
failed_when: result.rc > 1
|
||||
- name: stigrule_230529_ctrl_alt_del_target_mask
|
||||
systemd_service:
|
||||
name: ctrl-alt-del.target
|
||||
masked: "{{ rhel8STIG_stigrule_230529_ctrl_alt_del_target_mask_Masked }}"
|
||||
when:
|
||||
- rhel8STIG_stigrule_230529_Manage
|
||||
- result.rc == 0
|
||||
# R-230531 RHEL-08-040172
|
||||
- name: stigrule_230531__etc_systemd_system_conf
|
||||
ini_file:
|
||||
@@ -1613,16 +1623,6 @@
|
||||
when:
|
||||
- rhel8STIG_stigrule_244525_Manage
|
||||
- "'openssh-server' in packages"
|
||||
# R-244526 RHEL-08-010287
|
||||
- name: stigrule_244526__etc_sysconfig_sshd
|
||||
lineinfile:
|
||||
path: /etc/sysconfig/sshd
|
||||
regexp: '^# CRYPTO_POLICY='
|
||||
line: "{{ rhel8STIG_stigrule_244526__etc_sysconfig_sshd_Line }}"
|
||||
create: yes
|
||||
notify: do_reboot
|
||||
when:
|
||||
- rhel8STIG_stigrule_244526_Manage
|
||||
# R-244527 RHEL-08-010472
|
||||
- name: stigrule_244527_rng_tools
|
||||
yum:
|
||||
@@ -1663,13 +1663,18 @@
|
||||
when:
|
||||
- rhel8STIG_stigrule_244536_Manage
|
||||
- "'dconf' in packages"
|
||||
# R-244537 RHEL-08-020039
|
||||
- name: stigrule_244537_tmux
|
||||
yum:
|
||||
name: tmux
|
||||
state: "{{ rhel8STIG_stigrule_244537_tmux_State }}"
|
||||
when: rhel8STIG_stigrule_244537_Manage
|
||||
# R-244538 RHEL-08-020081
|
||||
- name: stigrule_244538__etc_dconf_db_local_d_locks_session_idle_delay
|
||||
lineinfile:
|
||||
path: /etc/dconf/db/local.d/locks/session
|
||||
line: "{{ rhel8STIG_stigrule_244538__etc_dconf_db_local_d_locks_session_idle_delay_Line }}"
|
||||
create: yes
|
||||
notify: dconf_update
|
||||
when:
|
||||
- rhel8STIG_stigrule_244538_Manage
|
||||
# R-244539 RHEL-08-020082
|
||||
@@ -1678,7 +1683,6 @@
|
||||
path: /etc/dconf/db/local.d/locks/session
|
||||
line: "{{ rhel8STIG_stigrule_244539__etc_dconf_db_local_d_locks_session_lock_enabled_Line }}"
|
||||
create: yes
|
||||
notify: dconf_update
|
||||
when:
|
||||
- rhel8STIG_stigrule_244539_Manage
|
||||
# R-244542 RHEL-08-030181
|
||||
|
||||
@@ -159,7 +159,7 @@ rhel9STIG_stigrule_257834_Manage: True
|
||||
rhel9STIG_stigrule_257834_tuned_State: removed
|
||||
# R-257835 RHEL-09-215060
|
||||
rhel9STIG_stigrule_257835_Manage: True
|
||||
rhel9STIG_stigrule_257835_tftp_server_State: removed
|
||||
rhel9STIG_stigrule_257835_tftp_State: removed
|
||||
# R-257836 RHEL-09-215065
|
||||
rhel9STIG_stigrule_257836_Manage: True
|
||||
rhel9STIG_stigrule_257836_quagga_State: removed
|
||||
@@ -302,6 +302,10 @@ rhel9STIG_stigrule_257916__var_log_messages_owner_Owner: root
|
||||
rhel9STIG_stigrule_257917_Manage: True
|
||||
rhel9STIG_stigrule_257917__var_log_messages_group_owner_Dest: /var/log/messages
|
||||
rhel9STIG_stigrule_257917__var_log_messages_group_owner_Group: root
|
||||
# R-257933 RHEL-09-232265
|
||||
rhel9STIG_stigrule_257933_Manage: True
|
||||
rhel9STIG_stigrule_257933__etc_crontab_mode_Dest: /etc/crontab
|
||||
rhel9STIG_stigrule_257933__etc_crontab_mode_Mode: '0600'
|
||||
# R-257934 RHEL-09-232270
|
||||
rhel9STIG_stigrule_257934_Manage: True
|
||||
rhel9STIG_stigrule_257934__etc_shadow_mode_Dest: /etc/shadow
|
||||
@@ -451,6 +455,9 @@ rhel9STIG_stigrule_257985_PermitRootLogin_Line: PermitRootLogin no
|
||||
# R-257986 RHEL-09-255050
|
||||
rhel9STIG_stigrule_257986_Manage: True
|
||||
rhel9STIG_stigrule_257986_UsePAM_Line: UsePAM yes
|
||||
# R-257989 RHEL-09-255065
|
||||
rhel9STIG_stigrule_257989_Manage: True
|
||||
rhel9STIG_stigrule_257989__etc_crypto_policies_back_ends_openssh_config_Line: 'Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr'
|
||||
# R-257992 RHEL-09-255080
|
||||
rhel9STIG_stigrule_257992_Manage: True
|
||||
rhel9STIG_stigrule_257992_HostbasedAuthentication_Line: HostbasedAuthentication no
|
||||
@@ -502,6 +509,9 @@ rhel9STIG_stigrule_258008_StrictModes_Line: StrictModes yes
|
||||
# R-258009 RHEL-09-255165
|
||||
rhel9STIG_stigrule_258009_Manage: True
|
||||
rhel9STIG_stigrule_258009_PrintLastLog_Line: PrintLastLog yes
|
||||
# R-258010 RHEL-09-255170
|
||||
rhel9STIG_stigrule_258010_Manage: True
|
||||
rhel9STIG_stigrule_258010_UsePrivilegeSeparation_Line: UsePrivilegeSeparation sandbox
|
||||
# R-258011 RHEL-09-255175
|
||||
rhel9STIG_stigrule_258011_Manage: True
|
||||
rhel9STIG_stigrule_258011_X11UseLocalhost_Line: X11UseLocalhost yes
|
||||
@@ -550,9 +560,10 @@ rhel9STIG_stigrule_258026__etc_dconf_db_local_d_locks_session_lock_delay_Line: '
|
||||
# R-258027 RHEL-09-271085
|
||||
rhel9STIG_stigrule_258027_Manage: True
|
||||
rhel9STIG_stigrule_258027__etc_dconf_db_local_d_00_security_settings_Value: "''"
|
||||
# R-258027 RHEL-09-271085
|
||||
rhel9STIG_stigrule_258027_Manage: True
|
||||
rhel9STIG_stigrule_258027__etc_dconf_db_local_d_locks_00_security_settings_lock_picture_uri_Line: '/org/gnome/desktop/screensaver/picture-uri'
|
||||
# R-258029 RHEL-09-271095
|
||||
rhel9STIG_stigrule_258029_Manage: True
|
||||
rhel9STIG_stigrule_258029__etc_dconf_db_local_d_00_security_settings_Value: "'true'"
|
||||
# R-258030 RHEL-09-271100
|
||||
rhel9STIG_stigrule_258030_Manage: True
|
||||
rhel9STIG_stigrule_258030__etc_dconf_db_local_d_locks_session_disable_restart_buttons_Line: '/org/gnome/login-screen/disable-restart-buttons'
|
||||
@@ -572,8 +583,6 @@ rhel9STIG_stigrule_258034__etc_modprobe_d_usb_storage_conf_blacklist_usb_storage
|
||||
# R-258035 RHEL-09-291015
|
||||
rhel9STIG_stigrule_258035_Manage: True
|
||||
rhel9STIG_stigrule_258035_usbguard_State: installed
|
||||
rhel9STIG_stigrule_258035_usbguard_enable_Enabled: yes
|
||||
rhel9STIG_stigrule_258035_usbguard_start_State: started
|
||||
# R-258036 RHEL-09-291020
|
||||
rhel9STIG_stigrule_258036_Manage: True
|
||||
rhel9STIG_stigrule_258036_usbguard_enable_Enabled: yes
|
||||
@@ -612,6 +621,12 @@ rhel9STIG_stigrule_258057__etc_security_faillock_conf_Line: 'unlock_time = 0'
|
||||
# R-258060 RHEL-09-411105
|
||||
rhel9STIG_stigrule_258060_Manage: True
|
||||
rhel9STIG_stigrule_258060__etc_security_faillock_conf_Line: 'dir = /var/log/faillock'
|
||||
# R-258063 RHEL-09-412010
|
||||
rhel9STIG_stigrule_258063_Manage: True
|
||||
rhel9STIG_stigrule_258063_tmux_State: installed
|
||||
# R-258066 RHEL-09-412025
|
||||
rhel9STIG_stigrule_258066_Manage: True
|
||||
rhel9STIG_stigrule_258066__etc_tmux_conf_Line: 'set -g lock-after-time 900'
|
||||
# R-258069 RHEL-09-412040
|
||||
rhel9STIG_stigrule_258069_Manage: True
|
||||
rhel9STIG_stigrule_258069__etc_security_limits_conf_Line: '* hard maxlogins 10'
|
||||
@@ -673,6 +688,9 @@ rhel9STIG_stigrule_258104__etc_login_defs_Line: 'PASS_MIN_DAYS 1'
|
||||
# R-258107 RHEL-09-611090
|
||||
rhel9STIG_stigrule_258107_Manage: True
|
||||
rhel9STIG_stigrule_258107__etc_security_pwquality_conf_Line: 'minlen = 15'
|
||||
# R-258108 RHEL-09-611095
|
||||
rhel9STIG_stigrule_258108_Manage: True
|
||||
rhel9STIG_stigrule_258108__etc_login_defs_Line: 'PASS_MIN_LEN 15'
|
||||
# R-258109 RHEL-09-611100
|
||||
rhel9STIG_stigrule_258109_Manage: True
|
||||
rhel9STIG_stigrule_258109__etc_security_pwquality_conf_Line: 'ocredit = -1'
|
||||
@@ -700,6 +718,9 @@ rhel9STIG_stigrule_258116__etc_libuser_conf_Value: 'sha512'
|
||||
# R-258117 RHEL-09-611140
|
||||
rhel9STIG_stigrule_258117_Manage: True
|
||||
rhel9STIG_stigrule_258117__etc_login_defs_Line: 'ENCRYPT_METHOD SHA512'
|
||||
# R-258119 RHEL-09-611150
|
||||
rhel9STIG_stigrule_258119_Manage: True
|
||||
rhel9STIG_stigrule_258119__etc_login_defs_Line: 'SHA_CRYPT_MIN_ROUNDS 5000'
|
||||
# R-258121 RHEL-09-611160
|
||||
rhel9STIG_stigrule_258121_Manage: True
|
||||
rhel9STIG_stigrule_258121__etc_opensc_conf_Line: 'card_drivers = cac;'
|
||||
@@ -738,6 +759,9 @@ rhel9STIG_stigrule_258142_rsyslog_start_State: started
|
||||
# R-258144 RHEL-09-652030
|
||||
rhel9STIG_stigrule_258144_Manage: True
|
||||
rhel9STIG_stigrule_258144__etc_rsyslog_conf_Line: 'auth.*;authpriv.*;daemon.* /var/log/secure'
|
||||
# R-258145 RHEL-09-652035
|
||||
rhel9STIG_stigrule_258145_Manage: True
|
||||
rhel9STIG_stigrule_258145__etc_audit_plugins_d_syslog_conf_Line: 'active = yes'
|
||||
# R-258146 RHEL-09-652040
|
||||
rhel9STIG_stigrule_258146_Manage: True
|
||||
rhel9STIG_stigrule_258146__etc_rsyslog_conf_Line: '$ActionSendStreamDriverAuthMode x509/name'
|
||||
@@ -976,9 +1000,12 @@ rhel9STIG_stigrule_258228__etc_audit_rules_d_audit_rules_loginuid_immutable_Line
|
||||
# R-258229 RHEL-09-654275
|
||||
rhel9STIG_stigrule_258229_Manage: True
|
||||
rhel9STIG_stigrule_258229__etc_audit_rules_d_audit_rules_e2_Line: '-e 2'
|
||||
# R-258234 RHEL-09-215100
|
||||
# R-258234 RHEL-09-672010
|
||||
rhel9STIG_stigrule_258234_Manage: True
|
||||
rhel9STIG_stigrule_258234_crypto_policies_State: installed
|
||||
# R-272488 RHEL-09-215101
|
||||
rhel9STIG_stigrule_272488_Manage: True
|
||||
rhel9STIG_stigrule_272488_postfix_State: installed
|
||||
# R-258239 RHEL-09-672035
|
||||
rhel9STIG_stigrule_258239_Manage: True
|
||||
rhel9STIG_stigrule_258239__etc_pki_tls_openssl_cnf_Line: '.include = /etc/crypto-policies/back-ends/opensslcnf.config'
|
||||
# R-258240 RHEL-09-672040
|
||||
rhel9STIG_stigrule_258240_Manage: True
|
||||
rhel9STIG_stigrule_258240__etc_crypto_policies_back_ends_opensslcnf_config_Line: 'TLS.MinProtocol = TLSv1.2'
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -474,10 +474,10 @@
|
||||
state: "{{ rhel9STIG_stigrule_257834_tuned_State }}"
|
||||
when: rhel9STIG_stigrule_257834_Manage
|
||||
# R-257835 RHEL-09-215060
|
||||
- name: stigrule_257835_tftp_server
|
||||
- name: stigrule_257835_tftp
|
||||
yum:
|
||||
name: tftp-server
|
||||
state: "{{ rhel9STIG_stigrule_257835_tftp_server_State }}"
|
||||
name: tftp
|
||||
state: "{{ rhel9STIG_stigrule_257835_tftp_State }}"
|
||||
when: rhel9STIG_stigrule_257835_Manage
|
||||
# R-257836 RHEL-09-215065
|
||||
- name: stigrule_257836_quagga
|
||||
@@ -764,6 +764,13 @@
|
||||
group: "{{ rhel9STIG_stigrule_257917__var_log_messages_group_owner_Group }}"
|
||||
when:
|
||||
- rhel9STIG_stigrule_257917_Manage
|
||||
# R-257933 RHEL-09-232265
|
||||
- name: stigrule_257933__etc_crontab_mode
|
||||
file:
|
||||
dest: "{{ rhel9STIG_stigrule_257933__etc_crontab_mode_Dest }}"
|
||||
mode: "{{ rhel9STIG_stigrule_257933__etc_crontab_mode_Mode }}"
|
||||
when:
|
||||
- rhel9STIG_stigrule_257933_Manage
|
||||
# R-257934 RHEL-09-232270
|
||||
- name: stigrule_257934__etc_shadow_mode
|
||||
file:
|
||||
@@ -1230,6 +1237,16 @@
|
||||
when:
|
||||
- rhel9STIG_stigrule_257986_Manage
|
||||
- "'openssh-server' in packages"
|
||||
# R-257989 RHEL-09-255065
|
||||
- name: stigrule_257989__etc_crypto_policies_back_ends_openssh_config
|
||||
lineinfile:
|
||||
path: /etc/crypto-policies/back-ends/openssh.config
|
||||
regexp: '^\s*Ciphers\s+\S+\s*$'
|
||||
line: "{{ rhel9STIG_stigrule_257989__etc_crypto_policies_back_ends_openssh_config_Line }}"
|
||||
create: yes
|
||||
notify: do_reboot
|
||||
when:
|
||||
- rhel9STIG_stigrule_257989_Manage
|
||||
# R-257992 RHEL-09-255080
|
||||
- name: stigrule_257992_HostbasedAuthentication
|
||||
lineinfile:
|
||||
@@ -1381,6 +1398,16 @@
|
||||
when:
|
||||
- rhel9STIG_stigrule_258009_Manage
|
||||
- "'openssh-server' in packages"
|
||||
# R-258010 RHEL-09-255170
|
||||
- name: stigrule_258010_UsePrivilegeSeparation
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '(?i)^\s*UsePrivilegeSeparation\s+'
|
||||
line: "{{ rhel9STIG_stigrule_258010_UsePrivilegeSeparation_Line }}"
|
||||
notify: ssh_restart
|
||||
when:
|
||||
- rhel9STIG_stigrule_258010_Manage
|
||||
- "'openssh-server' in packages"
|
||||
# R-258011 RHEL-09-255175
|
||||
- name: stigrule_258011_X11UseLocalhost
|
||||
lineinfile:
|
||||
@@ -1567,6 +1594,18 @@
|
||||
when:
|
||||
- rhel9STIG_stigrule_258027_Manage
|
||||
- "'dconf' in packages"
|
||||
# R-258029 RHEL-09-271095
|
||||
- name: stigrule_258029__etc_dconf_db_local_d_00_security_settings
|
||||
ini_file:
|
||||
path: /etc/dconf/db/local.d/00-security-settings
|
||||
section: org/gnome/login-screen
|
||||
option: disable-restart-buttons
|
||||
value: "{{ rhel9STIG_stigrule_258029__etc_dconf_db_local_d_00_security_settings_Value }}"
|
||||
no_extra_spaces: yes
|
||||
notify: dconf_update
|
||||
when:
|
||||
- rhel9STIG_stigrule_258029_Manage
|
||||
- "'dconf' in packages"
|
||||
# R-258030 RHEL-09-271100
|
||||
- name: stigrule_258030__etc_dconf_db_local_d_locks_session_disable_restart_buttons
|
||||
lineinfile:
|
||||
@@ -1635,34 +1674,6 @@
|
||||
name: usbguard
|
||||
state: "{{ rhel9STIG_stigrule_258035_usbguard_State }}"
|
||||
when: rhel9STIG_stigrule_258035_Manage
|
||||
# R-258035 RHEL-09-291015
|
||||
- name: check if usbguard.service is installed
|
||||
shell: ! systemctl list-unit-files | grep "^usbguard.service[ \t]\+"
|
||||
changed_when: False
|
||||
check_mode: no
|
||||
register: result
|
||||
failed_when: result.rc > 1
|
||||
- name: stigrule_258035_usbguard_enable
|
||||
service:
|
||||
name: usbguard.service
|
||||
enabled: "{{ rhel9STIG_stigrule_258035_usbguard_enable_Enabled }}"
|
||||
when:
|
||||
- rhel9STIG_stigrule_258035_Manage
|
||||
- result.rc == 0
|
||||
# R-258035 RHEL-09-291015
|
||||
- name: check if usbguard.service is installed
|
||||
shell: ! systemctl list-unit-files | grep "^usbguard.service[ \t]\+"
|
||||
changed_when: False
|
||||
check_mode: no
|
||||
register: result
|
||||
failed_when: result.rc > 1
|
||||
- name: stigrule_258035_usbguard_start
|
||||
service:
|
||||
name: usbguard.service
|
||||
state: "{{ rhel9STIG_stigrule_258035_usbguard_start_State }}"
|
||||
when:
|
||||
- rhel9STIG_stigrule_258035_Manage
|
||||
- result.rc == 0
|
||||
# R-258036 RHEL-09-291020
|
||||
- name: check if usbguard.service is installed
|
||||
shell: ! systemctl list-unit-files | grep "^usbguard.service[ \t]\+"
|
||||
@@ -1810,6 +1821,20 @@
|
||||
notify: with_faillock_enable
|
||||
when:
|
||||
- rhel9STIG_stigrule_258060_Manage
|
||||
# R-258063 RHEL-09-412010
|
||||
- name: stigrule_258063_tmux
|
||||
yum:
|
||||
name: tmux
|
||||
state: "{{ rhel9STIG_stigrule_258063_tmux_State }}"
|
||||
when: rhel9STIG_stigrule_258063_Manage
|
||||
# R-258066 RHEL-09-412025
|
||||
- name: stigrule_258066__etc_tmux_conf
|
||||
lineinfile:
|
||||
path: /etc/tmux.conf
|
||||
line: "{{ rhel9STIG_stigrule_258066__etc_tmux_conf_Line }}"
|
||||
create: yes
|
||||
when:
|
||||
- rhel9STIG_stigrule_258066_Manage
|
||||
# R-258069 RHEL-09-412040
|
||||
- name: stigrule_258069__etc_security_limits_conf
|
||||
lineinfile:
|
||||
@@ -2000,6 +2025,15 @@
|
||||
create: yes
|
||||
when:
|
||||
- rhel9STIG_stigrule_258107_Manage
|
||||
# R-258108 RHEL-09-611095
|
||||
- name: stigrule_258108__etc_login_defs
|
||||
lineinfile:
|
||||
path: /etc/login.defs
|
||||
regexp: '^PASS_MIN_LEN'
|
||||
line: "{{ rhel9STIG_stigrule_258108__etc_login_defs_Line }}"
|
||||
create: yes
|
||||
when:
|
||||
- rhel9STIG_stigrule_258108_Manage
|
||||
# R-258109 RHEL-09-611100
|
||||
- name: stigrule_258109__etc_security_pwquality_conf
|
||||
lineinfile:
|
||||
@@ -2082,6 +2116,15 @@
|
||||
create: yes
|
||||
when:
|
||||
- rhel9STIG_stigrule_258117_Manage
|
||||
# R-258119 RHEL-09-611150
|
||||
- name: stigrule_258119__etc_login_defs
|
||||
lineinfile:
|
||||
path: /etc/login.defs
|
||||
regexp: '^SHA_CRYPT_MIN_ROUNDS'
|
||||
line: "{{ rhel9STIG_stigrule_258119__etc_login_defs_Line }}"
|
||||
create: yes
|
||||
when:
|
||||
- rhel9STIG_stigrule_258119_Manage
|
||||
# R-258121 RHEL-09-611160
|
||||
- name: stigrule_258121__etc_opensc_conf
|
||||
lineinfile:
|
||||
@@ -2221,6 +2264,16 @@
|
||||
notify: rsyslog_restart
|
||||
when:
|
||||
- rhel9STIG_stigrule_258144_Manage
|
||||
# R-258145 RHEL-09-652035
|
||||
- name: stigrule_258145__etc_audit_plugins_d_syslog_conf
|
||||
lineinfile:
|
||||
path: /etc/audit/plugins.d/syslog.conf
|
||||
regexp: '^\s*active\s*='
|
||||
line: "{{ rhel9STIG_stigrule_258145__etc_audit_plugins_d_syslog_conf_Line }}"
|
||||
create: yes
|
||||
notify: auditd_restart
|
||||
when:
|
||||
- rhel9STIG_stigrule_258145_Manage
|
||||
# R-258146 RHEL-09-652040
|
||||
- name: stigrule_258146__etc_rsyslog_conf
|
||||
lineinfile:
|
||||
@@ -2976,15 +3029,27 @@
|
||||
line: "{{ rhel9STIG_stigrule_258229__etc_audit_rules_d_audit_rules_e2_Line }}"
|
||||
notify: auditd_restart
|
||||
when: rhel9STIG_stigrule_258229_Manage
|
||||
# R-258234 RHEL-09-215100
|
||||
# R-258234 RHEL-09-672010
|
||||
- name: stigrule_258234_crypto_policies
|
||||
yum:
|
||||
name: crypto-policies
|
||||
state: "{{ rhel9STIG_stigrule_258234_crypto_policies_State }}"
|
||||
when: rhel9STIG_stigrule_258234_Manage
|
||||
# R-272488 RHEL-09-215101
|
||||
- name: stigrule_272488_postfix
|
||||
yum:
|
||||
name: postfix
|
||||
state: "{{ rhel9STIG_stigrule_272488_postfix_State }}"
|
||||
when: rhel9STIG_stigrule_272488_Manage
|
||||
# R-258239 RHEL-09-672035
|
||||
- name: stigrule_258239__etc_pki_tls_openssl_cnf
|
||||
lineinfile:
|
||||
path: /etc/pki/tls/openssl.cnf
|
||||
line: "{{ rhel9STIG_stigrule_258239__etc_pki_tls_openssl_cnf_Line }}"
|
||||
create: yes
|
||||
when:
|
||||
- rhel9STIG_stigrule_258239_Manage
|
||||
# R-258240 RHEL-09-672040
|
||||
- name: stigrule_258240__etc_crypto_policies_back_ends_opensslcnf_config
|
||||
lineinfile:
|
||||
path: /etc/crypto-policies/back-ends/opensslcnf.config
|
||||
regexp: '^\s*TLS.MinProtocol\s*='
|
||||
line: "{{ rhel9STIG_stigrule_258240__etc_crypto_policies_back_ends_opensslcnf_config_Line }}"
|
||||
create: yes
|
||||
notify: do_reboot
|
||||
when:
|
||||
- rhel9STIG_stigrule_258240_Manage
|
||||
|
||||
@@ -31,7 +31,3 @@
|
||||
- name: Display link to inventory report
|
||||
ansible.builtin.debug:
|
||||
msg: "Please go to http://{{ hostvars[report_server]['ansible_host'] }}/reports/linux.html"
|
||||
|
||||
- name: Display link with a new path
|
||||
ansible.builtin.debug:
|
||||
msg: "Please go to http://{{ hostvars[report_server]['ansible_host'] }}/reports/linux.html"
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
# required collections are installed in the Product Demos EE.
|
||||
# additional collections needed during testing can be added here.
|
||||
collections: []
|
||||
|
||||
collections:
|
||||
- name: infra.aap_configuration
|
||||
type: git
|
||||
source: https://github.com/redhat-cop/infra.aap_configuration.git
|
||||
...
|
||||
|
||||
@@ -1,11 +1,13 @@
|
||||
---
|
||||
controller_execution_environments:
|
||||
- name: product-demos
|
||||
image: quay.io/acme_corp/product-demos-ee:latest
|
||||
- name: Cloud Services Execution Environment
|
||||
image: quay.io/scottharwell/cloud-ee:latest
|
||||
|
||||
controller_organizations:
|
||||
- name: Default
|
||||
default_environment: Product Demos EE
|
||||
default_environment: product-demos
|
||||
|
||||
controller_projects:
|
||||
- name: Ansible Cloud Content Lab - AWS
|
||||
@@ -60,8 +62,7 @@ controller_inventory_sources:
|
||||
prefix: purpose
|
||||
- key: tags.deployment
|
||||
prefix: deployment
|
||||
- key: tags.Compliance
|
||||
separator: ''
|
||||
|
||||
controller_groups:
|
||||
- name: cloud_aws
|
||||
inventory: Demo Inventory
|
||||
@@ -72,8 +73,6 @@ controller_groups:
|
||||
variables:
|
||||
ansible_connection: winrm
|
||||
ansible_winrm_transport: credssp
|
||||
ansible_winrm_server_cert_validation: ignore
|
||||
ansible_port: 5986
|
||||
|
||||
controller_templates:
|
||||
- name: SUBMIT FEEDBACK
|
||||
@@ -277,44 +276,6 @@ controller_templates:
|
||||
variable: _hosts
|
||||
required: true
|
||||
|
||||
- name: Cloud / AWS / Resize EC2
|
||||
job_type: run
|
||||
organization: Default
|
||||
credentials:
|
||||
- AWS
|
||||
- Controller Credential
|
||||
project: Ansible Product Demos
|
||||
playbook: cloud/resize_ec2.yml
|
||||
inventory: Demo Inventory
|
||||
notification_templates_started: Telemetry
|
||||
notification_templates_success: Telemetry
|
||||
notification_templates_error: Telemetry
|
||||
survey_enabled: true
|
||||
survey:
|
||||
name: ''
|
||||
description: ''
|
||||
spec:
|
||||
- question_name: AWS Region
|
||||
type: multiplechoice
|
||||
variable: aws_region
|
||||
required: true
|
||||
default: us-east-1
|
||||
choices:
|
||||
- us-east-1
|
||||
- us-east-2
|
||||
- us-west-1
|
||||
- us-west-2
|
||||
- question_name: Specify target hosts
|
||||
type: text
|
||||
variable: _hosts
|
||||
required: true
|
||||
|
||||
- question_name: Specify target instance type
|
||||
type: text
|
||||
variable: instance_type
|
||||
default: t3a.medium
|
||||
required: true
|
||||
|
||||
controller_notifications:
|
||||
- name: Telemetry
|
||||
organization: Default
|
||||
@@ -323,7 +284,7 @@ controller_notifications:
|
||||
url: https://script.google.com/macros/s/AKfycbzxUObvCJ6ZbzfJyicw4RvxlGE3AZdrK4AR5-TsedCYd7O-rtTOVjvsRvqyb3rx6B0g8g/exec
|
||||
http_method: POST
|
||||
headers: {}
|
||||
|
||||
controller_settings:
|
||||
- name: SESSION_COOKIE_AGE
|
||||
value: 180000
|
||||
# Has this moved out of controller?
|
||||
# controller_settings:
|
||||
# - name: SESSION_COOKIE_AGE
|
||||
# value: 180000
|
||||
|
||||
@@ -7,11 +7,8 @@ Currently these execution environment images are created manually using the `bui
|
||||
## Building the execution environment images
|
||||
|
||||
1. `podman login registry.redhat.io` in order to pull the base EE images
|
||||
2. `export ANSIBLE_GALAXY_SERVER_CERTIFIED_TOKEN="<token>"` obtained from [Automation Hub](https://console.redhat.com/ansible/automation-hub/token)
|
||||
3. `export ANSIBLE_GALAXY_SERVER_VALIDATED_TOKEN="<token>"` (same as above)
|
||||
4. `./build.sh` to build the EE images and add them to your local podman image cache
|
||||
2. `./build.sh` to build the EE images and add them to your local podman image cache
|
||||
|
||||
The `build.sh` script creates multiple EE images, each based on the ee-minimal image that comes with a different minor version of AAP. These images are created in the "quay.io/ansible-product-demos" namespace. Currently the script builds the following images:
|
||||
|
||||
* quay.io/ansible-product-demos/apd-ee-24
|
||||
* quay.io/ansible-product-demos/apd-ee-25
|
||||
|
||||
@@ -3,14 +3,9 @@ version: 3
|
||||
images:
|
||||
base_image:
|
||||
name: registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel9:latest
|
||||
|
||||
dependencies:
|
||||
galaxy: requirements-25.yml
|
||||
system:
|
||||
- python3.11-devel [platform:rpm]
|
||||
python:
|
||||
- pywinrm>=0.4.3
|
||||
python_interpreter:
|
||||
python_path: /usr/bin/python3.11
|
||||
galaxy: requirements.yml
|
||||
|
||||
additional_build_files:
|
||||
# https://access.redhat.com/solutions/7024259
|
||||
@@ -25,9 +20,6 @@ options:
|
||||
|
||||
additional_build_steps:
|
||||
prepend_base:
|
||||
# AgnosticD can use this to deterine it is running from an EE
|
||||
# see https://github.com/redhat-cop/agnosticd/blob/development/ansible/install_galaxy_roles.yml
|
||||
- ENV LAUNCHED_BY_RUNNER=1
|
||||
- RUN $PYCMD -m pip install --upgrade pip setuptools
|
||||
- COPY _build/rpms/openshift-clients*.rpm /tmp/openshift-clients.rpm
|
||||
- RUN $PKGMGR -y update && $PKGMGR -y install bash-completion && $PKGMGR clean all
|
||||
|
||||
@@ -3,13 +3,10 @@
|
||||
# array of images to build
|
||||
ee_images=(
|
||||
"apd-ee-24"
|
||||
"apd-ee-25"
|
||||
)
|
||||
|
||||
for ee in "${ee_images[@]}"
|
||||
do
|
||||
echo "Building EE image ${ee}"
|
||||
|
||||
# build EE image
|
||||
ansible-builder build \
|
||||
--file ${ee}.yml \
|
||||
|
||||
@@ -1,77 +0,0 @@
|
||||
---
|
||||
collections:
|
||||
# AAP config as code
|
||||
- name: ansible.controller
|
||||
version: ">=4.6.0"
|
||||
# TODO this fails trying to install a different version of
|
||||
# the python-systemd package
|
||||
# - name: ansible.eda # fails trying to install systemd-python package
|
||||
# version: ">=2.1.0"
|
||||
- name: ansible.hub
|
||||
version: ">=1.0.0"
|
||||
- name: ansible.platform
|
||||
version: ">=2.5.0"
|
||||
- name: infra.ah_configuration
|
||||
version: ">=2.0.6"
|
||||
- name: infra.controller_configuration
|
||||
version: ">=2.11.0"
|
||||
# linux demos
|
||||
- name: ansible.posix
|
||||
version: ">=1.5.4"
|
||||
- name: community.general
|
||||
version: ">=8.0.0"
|
||||
- name: containers.podman
|
||||
version: ">=1.12.1"
|
||||
- name: redhat.insights
|
||||
version: ">=1.2.2"
|
||||
- name: redhat.rhel_system_roles
|
||||
version: ">=1.23.0"
|
||||
# windows demos
|
||||
- name: microsoft.ad
|
||||
version: "1.9"
|
||||
- name: ansible.windows
|
||||
version: ">=2.3.0"
|
||||
- name: chocolatey.chocolatey
|
||||
version: ">=1.5.1"
|
||||
- name: community.windows
|
||||
version: ">=2.2.0"
|
||||
# cloud demos
|
||||
- name: amazon.aws
|
||||
version: ">=7.5.0"
|
||||
# satellite demos
|
||||
- name: redhat.satellite
|
||||
version: ">=4.0.0"
|
||||
# network demos
|
||||
- name: ansible.netcommon
|
||||
version: ">=6.0.0"
|
||||
- name: cisco.ios
|
||||
version: ">=7.0.0"
|
||||
- name: cisco.iosxr
|
||||
version: ">=8.0.0"
|
||||
- name: cisco.nxos
|
||||
version: ">=7.0.0"
|
||||
- name: network.backup
|
||||
version: ">=3.0.0"
|
||||
# TODO on 2.5 ee-minimal-rhel9 this tries to build and install
|
||||
# a different version of python netifaces, which fails
|
||||
# - name: infoblox.nios_modules
|
||||
# version: ">=1.6.1"
|
||||
# openshift demos
|
||||
- name: kubernetes.core
|
||||
version: ">=4.0.0"
|
||||
- name: redhat.openshift
|
||||
version: ">=3.0.1"
|
||||
- name: redhat.openshift_virtualization
|
||||
version: ">=1.4.0"
|
||||
# for RHDP
|
||||
- name: ansible.utils
|
||||
version: ">=5.1.0"
|
||||
- name: kubevirt.core
|
||||
version: ">=2.1.0"
|
||||
- name: community.okd
|
||||
version: ">=4.0.0"
|
||||
- name: https://github.com/rhpds/assisted_installer.git
|
||||
type: git
|
||||
version: "v0.0.1"
|
||||
|
||||
...
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
collections:
|
||||
- name: ansible.controller
|
||||
version: "<4.6.0"
|
||||
version: ">=4.5.5"
|
||||
- name: infra.ah_configuration
|
||||
version: ">=2.0.6"
|
||||
- name: infra.controller_configuration
|
||||
@@ -20,8 +20,6 @@ collections:
|
||||
- name: redhat.rhel_system_roles
|
||||
version: ">=1.23.0"
|
||||
# windows
|
||||
- name: microsoft.ad
|
||||
version: "1.9"
|
||||
- name: ansible.windows
|
||||
version: ">=2.3.0"
|
||||
- name: chocolatey.chocolatey
|
||||
|
||||
@@ -13,3 +13,4 @@
|
||||
- name: Run Compliance Profile
|
||||
ansible.builtin.include_role:
|
||||
name: "redhatofficial.rhel{{ ansible_distribution_major_version }}-{{ compliance_profile }}"
|
||||
...
|
||||
@@ -9,17 +9,9 @@
|
||||
- openscap-utils
|
||||
- scap-security-guide
|
||||
compliance_profile: ospp
|
||||
# install httpd and use it to host compliance report
|
||||
use_httpd: true
|
||||
|
||||
tasks:
|
||||
- name: Assert memory meets minimum requirements
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- ansible_memfree_mb >= 1000
|
||||
- ansible_memtotal_mb >= 2000
|
||||
fail_msg: "OpenSCAP is a memory intensive operation, the specified enepoint does not meet minimum requirements. See https://access.redhat.com/articles/6999111 for details."
|
||||
|
||||
- name: Get our facts straight
|
||||
ansible.builtin.set_fact:
|
||||
_profile: '{{ compliance_profile | replace("pci_dss", "pci-dss") }}'
|
||||
@@ -88,28 +80,11 @@
|
||||
group: root
|
||||
mode: 0644
|
||||
|
||||
- name: Debug output for report
|
||||
ansible.builtin.debug:
|
||||
msg: "http://{{ ansible_host }}/oscap-reports/{{ _profile }}/report-{{ ansible_date_time.iso8601 }}.html"
|
||||
when: use_httpd | bool
|
||||
|
||||
- name: Tag instance as {{ compliance_profile | upper }}_OUT_OF_COMPLIANCE # noqa name[template]
|
||||
delegate_to: localhost
|
||||
amazon.aws.ec2_tag:
|
||||
region: "{{ placement.region }}"
|
||||
resource: "{{ instance_id }}"
|
||||
state: present
|
||||
tags:
|
||||
Compliance: "{{ compliance_profile | upper }}_OUT_OF_COMPLIANCE"
|
||||
when:
|
||||
- _oscap.rc == 2
|
||||
- instance_id is defined
|
||||
become: false
|
||||
|
||||
handlers:
|
||||
- name: Restart httpd
|
||||
ansible.builtin.service:
|
||||
name: httpd
|
||||
state: restarted
|
||||
enabled: true
|
||||
|
||||
...
|
||||
@@ -11,7 +11,6 @@
|
||||
ansible.builtin.yum:
|
||||
name: yum-utils
|
||||
state: installed
|
||||
check_mode: false
|
||||
|
||||
- name: Include patching role
|
||||
ansible.builtin.include_role:
|
||||
@@ -46,16 +45,6 @@
|
||||
name: firewalld
|
||||
state: started
|
||||
|
||||
- name: Enable firewall http service
|
||||
ansible.posix.firewalld:
|
||||
service: '{{ item }}'
|
||||
state: enabled
|
||||
immediate: true
|
||||
permanent: true
|
||||
loop:
|
||||
- http
|
||||
- https
|
||||
|
||||
- name: Build report server
|
||||
ansible.builtin.include_role:
|
||||
name: "{{ item }}"
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
---
|
||||
- name: Apply compliance profile as part of workflow.
|
||||
hosts: "{{ compliance_profile | default('stig') | upper }}_OUT_OF_COMPLIANCE"
|
||||
become: true
|
||||
tasks:
|
||||
- name: Check os type
|
||||
ansible.builtin.assert:
|
||||
that: "ansible_os_family == 'RedHat'"
|
||||
|
||||
- name: Run Compliance Profile
|
||||
ansible.builtin.include_role:
|
||||
name: "redhatofficial.rhel{{ ansible_distribution_major_version }}-{{ compliance_profile }}"
|
||||
...
|
||||
@@ -334,33 +334,11 @@ controller_templates:
|
||||
- full
|
||||
required: true
|
||||
|
||||
- name: "LINUX / Compliance Enforce"
|
||||
job_type: run
|
||||
inventory: "Demo Inventory"
|
||||
project: "Ansible Product Demos"
|
||||
playbook: "linux/remediate_out_of_compliance.yml"
|
||||
notification_templates_started: Telemetry
|
||||
notification_templates_success: Telemetry
|
||||
notification_templates_error: Telemetry
|
||||
credentials:
|
||||
- "Demo Credential"
|
||||
extra_vars:
|
||||
sudo_remove_nopasswd: false
|
||||
survey_enabled: true
|
||||
survey:
|
||||
name: ''
|
||||
description: ''
|
||||
spec:
|
||||
- question_name: Server Name or Pattern
|
||||
type: text
|
||||
variable: _hosts
|
||||
required: true
|
||||
|
||||
- name: "LINUX / DISA STIG"
|
||||
job_type: run
|
||||
inventory: "Demo Inventory"
|
||||
project: "Ansible Product Demos"
|
||||
playbook: "linux/disa_stig.yml"
|
||||
playbook: "linux/compliance.yml"
|
||||
notification_templates_started: Telemetry
|
||||
notification_templates_success: Telemetry
|
||||
notification_templates_error: Telemetry
|
||||
@@ -382,13 +360,12 @@ controller_templates:
|
||||
job_type: run
|
||||
inventory: "Demo Inventory"
|
||||
project: "Ansible Product Demos"
|
||||
playbook: "linux/multi_profile_compliance.yml"
|
||||
playbook: "linux/compliance-enforce.yml"
|
||||
notification_templates_started: Telemetry
|
||||
notification_templates_success: Telemetry
|
||||
notification_templates_error: Telemetry
|
||||
credentials:
|
||||
- "Demo Credential"
|
||||
- "AWS"
|
||||
extra_vars:
|
||||
# used by CIS profile role
|
||||
sudo_require_authentication: false
|
||||
@@ -429,13 +406,12 @@ controller_templates:
|
||||
job_type: run
|
||||
inventory: "Demo Inventory"
|
||||
project: "Ansible Product Demos"
|
||||
playbook: "linux/multi_profile_compliance_report.yml"
|
||||
playbook: "linux/compliance-report.yml"
|
||||
notification_templates_started: Telemetry
|
||||
notification_templates_success: Telemetry
|
||||
notification_templates_error: Telemetry
|
||||
credentials:
|
||||
- "Demo Credential"
|
||||
- "AWS"
|
||||
survey_enabled: true
|
||||
survey:
|
||||
name: ''
|
||||
@@ -516,52 +492,4 @@ controller_templates:
|
||||
variable: application
|
||||
required: true
|
||||
|
||||
controller_workflows:
|
||||
- name: "Linux / Compliance Workflow"
|
||||
description: A workflow to generate a SCAP report and run enforce on findings
|
||||
organization: Default
|
||||
notification_templates_started: Telemetry
|
||||
notification_templates_success: Telemetry
|
||||
notification_templates_error: Telemetry
|
||||
survey_enabled: true
|
||||
survey:
|
||||
name: ''
|
||||
description: ''
|
||||
spec:
|
||||
- question_name: Server Name or Pattern
|
||||
type: text
|
||||
default: aws_rhel*
|
||||
variable: _hosts
|
||||
required: true
|
||||
- question_name: Compliance Profile
|
||||
type: multiplechoice
|
||||
variable: compliance_profile
|
||||
required: true
|
||||
choices:
|
||||
- cis
|
||||
- cjis
|
||||
- cui
|
||||
- hipaa
|
||||
- ospp
|
||||
- pci_dss
|
||||
- stig
|
||||
- question_name: Use httpd on the target host(s) to access reports locally?
|
||||
type: multiplechoice
|
||||
variable: use_httpd
|
||||
required: true
|
||||
choices:
|
||||
- "true"
|
||||
- "false"
|
||||
default: "true"
|
||||
simplified_workflow_nodes:
|
||||
- identifier: Compliance Report
|
||||
unified_job_template: "LINUX / Multi-profile Compliance Report"
|
||||
success_nodes:
|
||||
- Update Inventory
|
||||
- identifier: Update Inventory
|
||||
unified_job_template: AWS Inventory
|
||||
success_nodes:
|
||||
- Compliance Enforce
|
||||
- identifier: Compliance Enforce
|
||||
unified_job_template: "LINUX / Compliance Enforce"
|
||||
...
|
||||
|
||||
@@ -15,5 +15,3 @@
|
||||
- name: Default Components
|
||||
ansible.builtin.include_role:
|
||||
name: "infra.controller_configuration.job_launch"
|
||||
vars:
|
||||
controller_dependency_check: false # noqa: var-naming[no-role-prefix]
|
||||
|
||||
@@ -12,8 +12,6 @@
|
||||
This category of demos shows examples of network operations and management with Ansible Automation Platform. The list of demos can be found below. See the [Suggested Usage](#suggested-usage) section of this document for recommendations on how to best use these demos.
|
||||
- [**NETWORK / Configuration**](https://github.com/nleiva/ansible-net-modules/blob/main/main.yml) - Deploy golden configurations for different resources to Cisco IOS, IOSXR, and NXOS.
|
||||
|
||||
To run the demos, deploy them using Infrastructure as Code, run either the "Product Demos | Multi-demo setup" or the "Product Demos | Single demo setup" and select 'Network' in the "Product Demos" deployment, or utilize the steps in the repo level README.
|
||||
|
||||
### Project
|
||||
|
||||
These demos leverage playbooks from a [git repo](https://github.com/nleiva/ansible-net-modules) that is added as the **`Network Golden Configs`** Project in your Ansible Controller. Review this repo for the playbooks to configure different resources and network config templates that will be configured.
|
||||
@@ -27,7 +25,7 @@ A **`Demo Inventory`** is created when setting up these demos and a dynamic sour
|
||||
## Suggested Usage
|
||||
|
||||
**NETWORK / Report** - Use this job to gather facts from Cisco Network devices and create a report with information about the device such as code version, along with configuration information about layers 1, 2, and 3. This shows how Ansible can be used to gather facts and build reports. Generating html pages is just one potential output. This information can be used in a number of ways, such as integration with different network management tools.
|
||||
- to run this you will first need to run the **`Deploy Cloud Stack in AWS`** job template to deploy the report server. If using a demo.redhat.com Product Demos instance you should use the public key provided in the demo page in the Bastion Host Credentials section. If you are using a different environment, you may need to update the "Demo Credential".
|
||||
- to run this you will first need to run the **`Deploy Cloud Stack in AWS`** job template to deploy the report server. This will ask you for an SSH public key. After running this playbook, you will need to add the SSH private key to the **`Demo Credential`** before you can run the report, so it can connect to the report server.
|
||||
|
||||
**NETWORK / Configuration** - Use this job to execute different [Ansible Network Resource Modules](https://docs.ansible.com/ansible/latest/network/user_guide/network_resource_modules.html) to deploy golden configs. Below is a list of the different resources the can be configured with a link to their golden config.
|
||||
- [acls](https://github.com/nleiva/ansible-net-modules/blob/main/acls.cfg)
|
||||
@@ -79,11 +77,3 @@ A **`Demo Inventory`** is created when setting up these demos and a dynamic sour
|
||||
},
|
||||
"_ansible_no_log": false
|
||||
}
|
||||
|
||||
**NETWORK / BACKUP** - Use this job to show how Ansible can be used to backup network devices using Red Hat validated content. Job Template will create a backup file on the reports server where they can be viewed as a webpage. This is just an example - backups can also be sent to other repositories such as a Git repo (Github, Gitlab, etc).
|
||||
|
||||
To run this demo, you will need to complete a couple of prerequisites:
|
||||
- to run this you will first need to run the **`Deploy Cloud Stack in AWS`** job template to deploy the report server.
|
||||
- If using a demo.redhat.com Product Demos instance you should use the public key provided in the demo page in the 'Bastion Host Credentials' section. If you are using a different environment, you may need to update the "Demo Credential".
|
||||
- This works with Product Demos for AAP v2.5; which includes the "Product Demos EE" includes the \
|
||||
network.backup collection.
|
||||
@@ -1,63 +0,0 @@
|
||||
---
|
||||
- name: Create network reports server
|
||||
hosts: reports
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Build report server
|
||||
ansible.builtin.include_role:
|
||||
name: "{{ item }}"
|
||||
loop:
|
||||
- demo.patching.report_server
|
||||
|
||||
- name: Create a backup directory if it does not exist
|
||||
run_once: true
|
||||
ansible.builtin.file:
|
||||
path: "/var/www/html/backups"
|
||||
state: directory
|
||||
owner: ec2-user
|
||||
group: ec2-user
|
||||
mode: '0755'
|
||||
|
||||
- name: Play to Backup Cisco Always-On Network Devices
|
||||
hosts: routers
|
||||
gather_facts: false
|
||||
vars:
|
||||
report_server: reports
|
||||
backup_dir: "/tmp/network_backups"
|
||||
|
||||
tasks:
|
||||
- name: Network Backup and Resource Manager
|
||||
ansible.builtin.include_role:
|
||||
name: network.backup.run
|
||||
vars: # noqa var-naming[no-role-prefix]
|
||||
operation: backup
|
||||
type: full
|
||||
data_store:
|
||||
local: "{{ backup_dir }}"
|
||||
|
||||
# This task removes the Current configuration... from the top of IOS routers show run
|
||||
- name: Remove non config lines - regexp
|
||||
delegate_to: localhost
|
||||
ansible.builtin.lineinfile:
|
||||
path: "{{ backup_dir }}/{{ inventory_hostname }}.txt"
|
||||
line: "Building configuration..."
|
||||
state: absent
|
||||
|
||||
- name: Copy backup file
|
||||
delegate_to: "{{ report_server }}"
|
||||
ansible.builtin.copy:
|
||||
src: "{{ backup_dir }}/{{ inventory_hostname }}.txt"
|
||||
dest: "/var/www/html/backups/{{ inventory_hostname }}.cfg"
|
||||
backup: true
|
||||
owner: ec2-user
|
||||
group: ec2-user
|
||||
mode: '0644'
|
||||
|
||||
- name: Review backup on report server
|
||||
delegate_to: "{{ report_server }}"
|
||||
run_once: true
|
||||
ansible.builtin.debug:
|
||||
msg: "To review backed up configurations, go to http://{{ ansible_host }}/backups/"
|
||||
|
||||
...
|
||||
@@ -1,42 +0,0 @@
|
||||
[ios]
|
||||
sandbox-iosxe-latest-1.cisco.com
|
||||
|
||||
[ios:vars]
|
||||
ansible_network_os=cisco.ios.ios
|
||||
ansible_password=C1sco12345
|
||||
ansible_ssh_password=C1sco12345
|
||||
ansible_port=22
|
||||
ansible_user=admin
|
||||
|
||||
[iosxr]
|
||||
sandbox-iosxr-1.cisco.com
|
||||
|
||||
[iosxr:vars]
|
||||
ansible_network_os=cisco.iosxr.iosxr
|
||||
ansible_password=C1sco12345
|
||||
ansible_ssh_pass=C1sco12345
|
||||
ansible_port=22
|
||||
ansible_user=admin
|
||||
|
||||
[nxos]
|
||||
sbx-nxos-mgmt.cisco.com
|
||||
sandbox-nxos-1.cisco.com
|
||||
|
||||
[nxos:vars]
|
||||
ansible_network_os=cisco.nxos.nxos
|
||||
ansible_password=Admin_1234!
|
||||
ansible_ssh_pass=Admin_1234!
|
||||
ansible_port=22
|
||||
ansible_user=admin
|
||||
|
||||
[routers]
|
||||
sbx-nxos-mgmt.cisco.com
|
||||
sandbox-nxos-1.cisco.com
|
||||
sandbox-iosxr-1.cisco.com
|
||||
sandbox-iosxe-latest-1.cisco.com
|
||||
|
||||
[routers:vars]
|
||||
ansible_connection=ansible.netcommon.network_cli
|
||||
|
||||
[webservers]
|
||||
reports ansible_host=ec2-18-118-189-162.us-east-2.compute.amazonaws.com ansible_user=ec2-user
|
||||
@@ -11,9 +11,7 @@ controller_projects:
|
||||
scm_type: git
|
||||
scm_url: https://github.com/nleiva/ansible-net-modules
|
||||
update_project: true
|
||||
wait: false
|
||||
controller_request_timeout: 20
|
||||
controller_configuration_async_retries: 40
|
||||
wait: true
|
||||
default_environment: Networking Execution Environment
|
||||
|
||||
controller_inventories:
|
||||
@@ -25,8 +23,8 @@ controller_inventory_sources:
|
||||
source: scm
|
||||
inventory: Demo Inventory
|
||||
overwrite: true
|
||||
source_project: Ansible Product Demos
|
||||
source_path: network/hosts
|
||||
source_project: Network Golden Configs
|
||||
source_path: hosts
|
||||
|
||||
controller_templates:
|
||||
- name: NETWORK / Configuration
|
||||
@@ -35,8 +33,6 @@ controller_templates:
|
||||
survey_enabled: true
|
||||
project: Network Golden Configs
|
||||
playbook: main.yml
|
||||
credentials:
|
||||
- "Demo Credential"
|
||||
execution_environment: Networking Execution Environment
|
||||
notification_templates_started: Telemetry
|
||||
notification_templates_success: Telemetry
|
||||
@@ -99,23 +95,9 @@ controller_templates:
|
||||
inventory: Demo Inventory
|
||||
project: "Ansible Product Demos"
|
||||
playbook: "network/compliance.yml"
|
||||
credentials:
|
||||
- "Demo Credential"
|
||||
notification_templates_started: Telemetry
|
||||
notification_templates_success: Telemetry
|
||||
notification_templates_error: Telemetry
|
||||
use_fact_cache: true
|
||||
ask_job_type_on_launch: true
|
||||
survey_enabled: true
|
||||
|
||||
- name: "NETWORK / Backup"
|
||||
job_type: run
|
||||
organization: Default
|
||||
inventory: Demo Inventory
|
||||
project: "Ansible Product Demos"
|
||||
playbook: "network/backup.yml"
|
||||
credentials:
|
||||
- "Demo Credential"
|
||||
notification_templates_started: Telemetry
|
||||
notification_templates_success: Telemetry
|
||||
notification_templates_error: Telemetry
|
||||
|
||||
@@ -14,6 +14,10 @@ This category of demos shows examples of OpenShift operations and management wit
|
||||
- [**OpenShift / Dev Spaces**](devspaces.yml) - Install and deploy dev spaces on OCP cluster. After this job has run successfully, login to your OCP cluster, click the application icon (to the left of the bell icon in the top right) to access Dev Spaces
|
||||
- [**OpenShift / GitLab**](gitlab.yml) - Install and deploy GitLab on OCP.
|
||||
- [**OpenShift / EDA / Install Controller**](eda/install.yml) - Install and deploy EDA Controller instance using the AAP OpenShift operator.
|
||||
- **OpenShift / CNV / Deploy Automation Hub and sync EEs and Collections** - Workflow Job Template to deploy a functional Automaiton Hub instance in OCP.
|
||||
- [**OpenShift / Hub / Install Automation Hub**](hub/install.yml) - Install and deploy Automation Hub instance using the AAP OpenShift operator.
|
||||
- [**OpenShift / Hub / Sync EE Registries**](hub/registries.yml) - Synchronize Execution Environments from console.redhat.com.
|
||||
- [**OpenShift / Hub / Sync Collection Repositories**](hub/collections.yml) - Synchronize collections from console.redhat.com.
|
||||
- [**OpenShift / CNV / Install Operator**](cnv/install.yml) - Install the Container Native Virtualization (CNV) operator and all its required dependencies.
|
||||
- **OpenShift / CNV / Infra Stack** - Workflow Job Template to build out infrastructure necessary to run jobs against VMs in OpenShift Virtualization.
|
||||
- [**OpenShift / CNV / Create RHEL VM**](cnv/install.yml) - Install the Container Native Virtualization (CNV) operator and all its required dependencies.
|
||||
|
||||
@@ -94,4 +94,3 @@
|
||||
name: "{{ vm_name }}"
|
||||
namespace: "{{ vm_namespace }}"
|
||||
wait: true
|
||||
wait_timeout: 240
|
||||
|
||||
@@ -101,21 +101,6 @@
|
||||
retries: 10
|
||||
delay: 30
|
||||
|
||||
- name: Get available charts from gitlab operator repo
|
||||
register: gitlab_chart_versions
|
||||
ansible.builtin.uri:
|
||||
url: https://gitlab.com/gitlab-org/cloud-native/gitlab-operator/-/raw/master/CHART_VERSIONS?ref_type=heads
|
||||
method: GET
|
||||
return_content: true
|
||||
|
||||
- name: Debug gitlab_chart_versions
|
||||
ansible.builtin.debug:
|
||||
var: gitlab_chart_versions.content | from_yaml
|
||||
|
||||
- name: Get latest chart from available_chart_versions
|
||||
ansible.builtin.set_fact:
|
||||
gitlab_chart_version: "{{ (gitlab_chart_versions.content | split())[0] }}"
|
||||
|
||||
- name: Grab url for Gitlab spec
|
||||
ansible.builtin.set_fact:
|
||||
cluster_domain: "apps{{ lookup('ansible.builtin.env', 'K8S_AUTH_HOST') | regex_search('\\.[^:]*') }}"
|
||||
@@ -148,20 +133,3 @@
|
||||
route.openshift.io/termination: "edge"
|
||||
certmanager-issuer:
|
||||
email: "{{ cert_email | default('nobody@nowhere.nosite') }}"
|
||||
|
||||
- name: Print out warning and initial details about deployment
|
||||
vars:
|
||||
msg: |
|
||||
If not immediately successful be aware that the Gitlab instance can take
|
||||
a couple minutes to come up, so be patient.
|
||||
|
||||
URL for Gitlab instance:
|
||||
https://gitlab.{{ cluster_domain }}
|
||||
|
||||
The initial login user is 'root', and the password can be found by logging
|
||||
into the OpenShift cluster portal, and on the left hand side of the administrator
|
||||
portal, under workloads, select Secrets and look for 'gitlab-gitlab-initial-root-password'
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ msg.split('\n') }}"
|
||||
|
||||
...
|
||||
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
gitlab_chart_version: "8.5.1"
|
||||
gitlab_chart_version: "8.0.1"
|
||||
|
||||
@@ -268,10 +268,6 @@ controller_workflows:
|
||||
type: text
|
||||
variable: rh_subscription_org
|
||||
required: true
|
||||
- question_name: Email
|
||||
type: text
|
||||
variable: email
|
||||
required: true
|
||||
simplified_workflow_nodes:
|
||||
- identifier: Deploy RHEL8 VM
|
||||
unified_job_template: OpenShift / CNV / Create RHEL VM
|
||||
|
||||
@@ -2,65 +2,45 @@
|
||||
roles:
|
||||
# RHEL 7 compliance roles from ComplianceAsCode
|
||||
- name: redhatofficial.rhel7-cis
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel7-cis
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel7-cjis
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel7-cjis
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel7-cui
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel7-cui
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel7-hipaa
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel7-hipaa
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel7-ospp
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel7-ospp
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel7-pci-dss
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel7-pci-dss
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel7-stig
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel7-stig
|
||||
version: 0.1.72
|
||||
# RHEL 8 compliance roles from ComplianceAsCode
|
||||
- name: redhatofficial.rhel8-cis
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel8-cis
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel8-cjis
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel8-cjis
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel8-cui
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel8-cui
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel8-hipaa
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel8-hipaa
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel8-ospp
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel8-ospp
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel8-pci-dss
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel8-pci-dss
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel8-stig
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel8-stig
|
||||
version: 0.1.72
|
||||
# RHEL 9 compliance roles from ComplianceAsCode
|
||||
- name: redhatofficial.rhel9-cis
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel9-cis
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel9-cui
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel9-cui
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel9-hipaa
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel9-hipaa
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel9-ospp
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel9-ospp
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel9-pci-dss
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel9-pci-dss
|
||||
version: 0.1.72
|
||||
- name: redhatofficial.rhel9-stig
|
||||
src: https://github.com/RedHatOfficial/ansible-role-rhel9-stig
|
||||
version: 0.1.72
|
||||
...
|
||||
|
||||
@@ -16,9 +16,7 @@
|
||||
|
||||
- name: Create common demo resources
|
||||
ansible.builtin.include_role:
|
||||
name: infra.controller_configuration.dispatch
|
||||
vars:
|
||||
controller_dependency_check: false # noqa: var-naming[no-role-prefix]
|
||||
name: infra.aap_configuration.dispatch
|
||||
|
||||
- name: Setup demo
|
||||
hosts: localhost
|
||||
@@ -29,9 +27,7 @@
|
||||
|
||||
- name: Demo Components
|
||||
ansible.builtin.include_role:
|
||||
name: infra.controller_configuration.dispatch
|
||||
vars:
|
||||
controller_dependency_check: false # noqa: var-naming[no-role-prefix]
|
||||
name: infra.aap_configuration.dispatch
|
||||
|
||||
- name: Log Demo
|
||||
ansible.builtin.uri:
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
../execution_environments/requirements-25.yml
|
||||
@@ -12,17 +12,14 @@
|
||||
- name: Update the hostname
|
||||
ansible.windows.win_hostname:
|
||||
name: "{{ inventory_hostname.split('.')[0] }}"
|
||||
register: r_rename_hostname
|
||||
|
||||
- name: Reboot to apply new hostname
|
||||
# noqa no-handler
|
||||
when: r_rename_hostname is changed
|
||||
ansible.windows.win_reboot:
|
||||
reboot_timeout: 3600
|
||||
|
||||
- name: Create new domain in a new forest on the target host
|
||||
register: r_create_domain
|
||||
microsoft.ad.domain:
|
||||
ansible.windows.win_domain:
|
||||
dns_domain_name: ansible.local
|
||||
safe_mode_password: "{{ lookup('community.general.random_string', min_lower=1, min_upper=1, min_special=1, min_numeric=1) }}"
|
||||
|
||||
@@ -33,7 +30,7 @@
|
||||
file: tasks/domain_services_check.yml
|
||||
|
||||
- name: Create some groups
|
||||
microsoft.ad.group:
|
||||
community.windows.win_domain_group:
|
||||
name: "{{ item.name }}"
|
||||
scope: global
|
||||
loop:
|
||||
@@ -44,7 +41,7 @@
|
||||
delay: 10
|
||||
|
||||
- name: Create some users
|
||||
microsoft.ad.user:
|
||||
community.windows.win_domain_user:
|
||||
name: "{{ item.name }}"
|
||||
groups: "{{ item.groups }}"
|
||||
password: "{{ lookup('community.general.random_string', min_lower=1, min_upper=1, min_special=1, min_numeric=1) }}"
|
||||
|
||||
5
windows/group_vars/os_windows.yml
Normal file
5
windows/group_vars/os_windows.yml
Normal file
@@ -0,0 +1,5 @@
|
||||
---
|
||||
ansible_connection: winrm
|
||||
ansible_winrm_transport: ntlm
|
||||
ansible_winrm_server_cert_validation: ignore
|
||||
ansible_port: 5986
|
||||
@@ -10,7 +10,7 @@
|
||||
# Example result: ['&Qw2|E[-']
|
||||
|
||||
- name: Create new user
|
||||
microsoft.ad.user:
|
||||
community.windows.win_domain_user:
|
||||
name: "{{ firstname }} {{ surname }}"
|
||||
firstname: "{{ firstname }}"
|
||||
surname: "{{ surname }}"
|
||||
|
||||
@@ -16,7 +16,7 @@
|
||||
- name: Ensure Demo OU exists
|
||||
run_once: true
|
||||
delegate_to: "{{ domain_controller }}"
|
||||
microsoft.ad.ou:
|
||||
community.windows.win_domain_ou:
|
||||
name: Demo
|
||||
state: present
|
||||
|
||||
@@ -26,7 +26,7 @@
|
||||
|
||||
- name: Join ansible.local domain
|
||||
register: r_domain_membership
|
||||
microsoft.ad.membership:
|
||||
ansible.windows.win_domain_membership:
|
||||
dns_domain_name: ansible.local
|
||||
hostname: "{{ inventory_hostname.split('.')[0] }}"
|
||||
domain_admin_user: "{{ ansible_user }}@ansible.local"
|
||||
|
||||
@@ -5,12 +5,6 @@
|
||||
report_server: aws_win1
|
||||
|
||||
tasks:
|
||||
|
||||
- name: Assert that host is in webservers group
|
||||
ansible.builtin.assert:
|
||||
that: "'{{ report_server }}' in groups.os_windows"
|
||||
msg: "Please run the 'Deploy Cloud Stack in AWS' Workflow Job Template first"
|
||||
|
||||
- name: Patch windows server
|
||||
ansible.builtin.include_role:
|
||||
name: demo.patching.patch_windows
|
||||
|
||||
@@ -40,6 +40,7 @@ controller_templates:
|
||||
inventory: "Demo Inventory"
|
||||
project: "Ansible Product Demos"
|
||||
playbook: "windows/patching.yml"
|
||||
execution_environment: Default execution environment
|
||||
notification_templates_started: Telemetry
|
||||
notification_templates_success: Telemetry
|
||||
notification_templates_error: Telemetry
|
||||
@@ -85,6 +86,7 @@ controller_templates:
|
||||
inventory: "Demo Inventory"
|
||||
project: "Ansible Product Demos"
|
||||
playbook: "windows/rollback.yml"
|
||||
execution_environment: Default execution environment
|
||||
notification_templates_started: Telemetry
|
||||
notification_templates_success: Telemetry
|
||||
notification_templates_error: Telemetry
|
||||
@@ -109,6 +111,7 @@ controller_templates:
|
||||
inventory: "Demo Inventory"
|
||||
project: "Ansible Product Demos"
|
||||
playbook: "windows/connect.yml"
|
||||
execution_environment: Default execution environment
|
||||
notification_templates_started: Telemetry
|
||||
notification_templates_success: Telemetry
|
||||
notification_templates_error: Telemetry
|
||||
@@ -417,7 +420,7 @@ controller_workflows:
|
||||
unified_job_template: Cloud / AWS / Create VM
|
||||
job_type: run
|
||||
extra_data:
|
||||
create_vm_vm_name: dc01
|
||||
create_vm_vm_name: dc01.ansible.local
|
||||
create_vm_vm_purpose: domain_controller
|
||||
create_vm_vm_deployment: domain_ansible_local
|
||||
vm_blueprint: windows_full
|
||||
@@ -427,7 +430,7 @@ controller_workflows:
|
||||
unified_job_template: Cloud / AWS / Create VM
|
||||
job_type: run
|
||||
extra_data:
|
||||
create_vm_vm_name: winston
|
||||
create_vm_vm_name: winston.ansible.local
|
||||
create_vm_vm_purpose: domain_computer
|
||||
create_vm_vm_deployment: domain_ansible_local
|
||||
vm_blueprint: windows_core
|
||||
@@ -437,7 +440,7 @@ controller_workflows:
|
||||
unified_job_template: Cloud / AWS / Create VM
|
||||
job_type: run
|
||||
extra_data:
|
||||
create_vm_vm_name: winthrop
|
||||
create_vm_vm_name: winthrop.ansible.local
|
||||
create_vm_vm_purpose: domain_computer
|
||||
create_vm_vm_deployment: domain_ansible_local
|
||||
vm_blueprint: windows_core
|
||||
@@ -471,7 +474,7 @@ controller_workflows:
|
||||
job_type: run
|
||||
extra_data:
|
||||
_hosts: purpose_domain_computer
|
||||
domain_controller: dc01
|
||||
domain_controller: dc01.ansible.local
|
||||
failure_nodes:
|
||||
- Cleanup Resources
|
||||
success_nodes:
|
||||
|
||||
Reference in New Issue
Block a user