add playbook

Add RHDP dependencies to APD EE definition (#203 )
A few small bug fixes around OCP CNV demos (#202 )
2024-11-18 21:03:20 -05:00 · 2024-11-18 16:18:54 -05:00 · 2024-11-12 08:47:39 -07:00 · 2024-11-11 15:04:03 -07:00 · 2024-11-11 11:02:47 -05:00 · 2024-11-05 11:53:57 -05:00
85 changed files with 13485 additions and 1312 deletions
--- a/.ansible-lint
+++ b/.ansible-lint
@@ -10,3 +10,4 @@ exclude_paths:
  - collections/ansible_collections/demo/compliance/roles/
  - roles/redhatofficial.*
  - .github/
+  - execution_environments/ee_contexts/
--- a/.github/images/setup_domain_final_state.png
+++ b/.github/images/setup_domain_final_state.png
--- a/.github/images/setup_domain_workflow.png
+++ b/.github/images/setup_domain_workflow.png
--- a/.github/images/setup_domain_workflow_domain.png
+++ b/.github/images/setup_domain_workflow_domain.png
--- a/.github/images/setup_domain_workflow_inventory.png
+++ b/.github/images/setup_domain_workflow_inventory.png
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -5,13 +5,16 @@ on:
 - pull_request_target

 env:
-  ANSIBLE_GALAXY_SERVER_AH_TOKEN: ${{ secrets.ANSIBLE_GALAXY_SERVER_AH_TOKEN }}
+  ANSIBLE_GALAXY_SERVER_CERTIFIED_TOKEN: ${{ secrets.ANSIBLE_GALAXY_SERVER_CERTIFIED_TOKEN }}
+  ANSIBLE_GALAXY_SERVER_VALIDATED_TOKEN: ${{ secrets.ANSIBLE_GALAXY_SERVER_VALIDATED_TOKEN }}

 jobs:
  pre-commit:
    name: pre-commit
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-python@v3
-    - uses: pre-commit/action@v3.0.0
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
+    - uses: pre-commit/action@v3.0.1
+
+...
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,6 @@ choose_demo_example_aws.yml
 .ansible.cfg
 *.gz
 *artifact*.json
-**/roles/*
-!**/roles/requirements.yml
+roles/*
+!roles/requirements.yml
 .deployment_id
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -3,8 +3,8 @@ repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.4.0
    hooks:
-      - id: end-of-file-fixer
      - id: trailing-whitespace
+        exclude: rhel[89]STIG/.*$

      - id: check-yaml
        exclude: \.j2.(yaml|yml)$|\.(yaml|yml).j2$
@@ -26,4 +26,5 @@ repos:
    rev: 23.11.0
    hooks:
      - id: black
+        exclude: rhel[89]STIG/.*$
 ...
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -1,3 +1,4 @@
 {
-    "editor.renderWhitespace": "all"
+    "editor.renderWhitespace": "all",
+    "ansible.python.interpreterPath": "/usr/local/bin/python3"
 }
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,12 +0,0 @@
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [v-0.0.1](https://github.com/ansible/product-demos/-/tree/v-0.0.1) - 2024-01-12
-
-### Added
-
- Initial release  ([1af584b4ea6d77812bfcb2f6474fee6ee1b13666](https://github.com/ansible/product-demos/-/commit/1af584b4ea6d77812bfcb2f6474fee6ee1b13666))
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -18,6 +18,7 @@ This document aims to outline the requirements for the various forms of contribu
 - PRs should be rebased against the `main` branch to avoid conflicts.
 - PRs should not impact more than a single directory/demo section.
 - PRs should not rely on external infrastructure or configuration unless the dependency is automated or specified in the `user_message` of `setup.yml`.
+- PR titles should describe the work done in the PR.  Titles should not be generic ("Added new demo") and should not refer to an issue number ("Fix for issue #123").

 ## Adding a New Demo
 1) Create a new branch based on main. (eg. `git checkout -b <branch name>`)
@@ -31,7 +32,7 @@ This document aims to outline the requirements for the various forms of contribu
   1) You can copy paste an existing one and edit it.
   2) Ensure you edit the name, playbook path, survey etc.
 5) Add any needed roles/collections to the [requirements.yml](/collections/requirements.yml)
-6) Test via [demo.redhat.com](https://demo.redhat.com/catalog?item=babylon-catalog-prod/sandboxes-gpte.aap-product-demos.prod&utm_source=webapp&utm_medium=share-link), specify your branch name within the project configuration.
+6) Test via [demo.redhat.com](https://demo.redhat.com/catalog?search=product&item=babylon-catalog-prod%2Fopenshift-cnv.aap-product-demos-cnv.prod), specifying your branch name within the project configuration.

 > NOTE: demo.redhat.com is available to Red Hat Associates and Partners with a valid account.

@@ -43,13 +44,10 @@ This document aims to outline the requirements for the various forms of contribu
    ---
    user_message: ''

-    controller_components:
-    - job_templates
-
    controller_templates:
    ...
    ```
-   - `controller_components` can be any of the roles defined [here](https://github.com/redhat-cop/controller_configuration/tree/devel/roles)
+   - Configuration variables can be from any of the roles defined in the [infra.controller_configuration collection](https://github.com/redhat-cop/controller_configuration/tree/devel/roles)
   - Add variables for each component listed
 3) Include a README.md in the subdirectory

@@ -72,76 +70,3 @@ Copy the token value and execute the following command:
 ```bash
 export ANSIBLE_GALAXY_SERVER_AH_TOKEN=<token>
 ```
-
-## Release Process
-
-We follow a structured release process for this project. Here are the steps involved:
-
-1. **Create a Release Branch:**
-   - Start by creating a new release branch from the `main` branch.
-
-   ```bash
-   git checkout -b release/v-<version>
-   ```
-
-2. **Update Changelog:**
-   - Open the `CHANGELOG.md` file to manually add your change to the appropriate section.
-   - Our changelog follows the [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) format and includes the following categories of changes:
-
-     - `Added` for new features.
-     - `Changed` for changes in existing functionality.
-     - `Deprecated` for features that will be removed in upcoming releases.
-     - `Fixed` for bug fixes.
-     - `Removed` for deprecated features that were removed.
-     - `Security` for security-related changes.
-
-   - Add a new entry under the relevant category. Include a brief summary of the change and the merge request commit tag.
-
-     ```markdown
-     ## [Unreleased]
-
-     ### Added
-
-     - New feature or enhancement ([Merge Request Commit](https://github.com/ansible/product-demos/-/commit/<commit-hash>))
-     ```
-
-   - Replace `<commit-hash>` with the actual commit hash from the merge request.
-
-3. **Commit Changes:**
-   - Commit the changes made to the `CHANGELOG.md` file.
-
-   ```bash
-   git add CHANGELOG.md
-   git commit -m "Update CHANGELOG for release <version>"
-   ```
-
-4. **Create a Pull Request:**
-   - Open a pull request from the release branch to the `main` branch.
-
-5. **Review and Merge:**
-   - Review the pull request and merge it into the `main` branch.
-
-6. **Tag the Release:**
-   - Once the pull request is merged, tag the release with the version number.
-
-   ```bash
-   git tag -a v-<version> -m "Release <version>"
-   git push origin v-<version>
-   ```
-
-7. **Publish the Release:**
-   - After the successful completion of the pull request and merging into the `main` branch, an automatic GitHub Action will be triggered to publish the release.
-
-     The GitHub Action will perform the following steps:
-     - Parse the `CHANGELOG.md` file.
-     - Generate a release note based on the changes.
-     - Attach relevant files (such as `LICENSE`, `CHANGELOG.md`, and the generated `CHANGELOG.txt`) to the GitHub Release.
-
-     No manual intervention is required for this step; the GitHub Action will handle the release process automatically.
-
-8. **Cleanup:**
-   - Delete the release branch.
-
-   ```bash
-   git branch -d release/v-<version>
-   ```
--- a/README.md
+++ b/README.md
@@ -1,16 +1,18 @@
 [![Lab](https://img.shields.io/badge/Try%20Me-EE0000?style=for-the-badge&logo=redhat&logoColor=white)](https://red.ht/aap-product-demos)
 [![Dev Spaces](https://img.shields.io/badge/Customize%20Here-0078d7.svg?style=for-the-badge&logo=visual-studio-code&logoColor=white)](https://workspaces.openshift.com/f?url=https://github.com/ansible/product-demos)
+[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit)

 # Official Ansible Product Demos

-This is a centralized location for Ansible Product Demos. This project is a collection of use cases implemented with Ansible for use with the Ansible Automation Platform.
+This is a centralized location for Ansible Product Demos. This project is a collection of use cases implemented with Ansible for use with the [Ansible Automation Platform](https://www.redhat.com/en/technologies/management/ansible).

 | Demo Name | Description |
 |-----------|-------------|
 | [Linux](linux/README.md) | Repository of demos for RHEL and Linux automation |
 | [Windows](windows/README.md) | Repository of demos for Windows Server automation |
 | [Cloud](cloud/README.md) | Demo for infrastructure and cloud provisioning automation |
-| [Network](network/README.md) | Ansible Network automation demos |
+| [Network](network/README.md) | Network automation demos |
+| [OpenShift](openshift/README.md) | OpenShift automation demos |
 | [Satellite](satellite/README.md) | Demos of automation with Red Hat Satellite Server |

 ## Contributions
@@ -19,7 +21,7 @@ If you would like to contribute to this project please refer to [contribution gu

 ## Using this project

-This project is tested for compatibility with the [demo.redhat.com Product Demos Sandbox]([red.ht/aap-product-demos](https://demo.redhat.com/catalog?item=babylon-catalog-prod/sandboxes-gpte.aap-product-demos.prod&utm_source=webapp&utm_medium=share-link)) lab environment. To use with other Ansible Controller installations, review the [prerequisite documentation](https://github.com/RedHatGov/ansible-tower-samples).
+This project is tested for compatibility with the [demo.redhat.com Ansible Product Demos](https://demo.redhat.com/catalog?search=product+demos&item=babylon-catalog-prod%2Fopenshift-cnv.aap-product-demos-cnv.prod) lab environment. To use with other Ansible Automation Platform installations, review the [prerequisite documentation](https://github.com/ansible/product-demos-bootstrap).

 > NOTE: demo.redhat.com is available to Red Hat Associates and Partners with a valid account.

@@ -37,7 +39,7 @@ This project is tested for compatibility with the [demo.redhat.com Product Demos
     - Image: quay.io/acme_corp/product-demos-ee:latest
     - Pull: Only pull the image if not present before running

-3. If it is not already created for you, create a Project called `Ansible official demo project` with this repo as a source. NOTE: if you are using a fork, be sure that you have the correct URL. Update the project.
+3. If it is not already created for you, create a Project called `Ansible Product Demos` with this repo as a source. NOTE: if you are using a fork, be sure that you have the correct URL. Update the project.

 4. Finally, Create a Job Template called `Setup` with the following configuration:

@@ -57,8 +59,8 @@ This project is tested for compatibility with the [demo.redhat.com Product Demos
 Can't find what you're looking for? Customize this repo to make it your own.

 1. Create a fork of this repo.
-2. Update the URL of the `Ansible official demo project` in the Controller.
-3. Make changes as needed and run the **Setup** job
+2. Update the URL of the `Ansible Project Demos` in the Controller.
+3. Make changes as needed and run the **Product Demos | Single demo setup** job

 See the [contribution guide](CONTRIBUTING.md) for more details on how to customize the project.

--- a/ansible.cfg
+++ b/ansible.cfg
@@ -3,14 +3,18 @@ collections_path=./collections
 roles_path=./roles

 [galaxy]
-server_list = ah,galaxy
+server_list = certified,validated,galaxy

-[galaxy_server.ah]
+[galaxy_server.certified]
 # Grab a token at https://console.redhat.com/ansible/automation-hub/token
-# Then define it using ANSIBLE_GALAXY_SERVER_AH_TOKEN=""
-
+# Then define it in the ANSIBLE_GALAXY_SERVER_CERTIFIED_TOKEN environment variable
 url=https://console.redhat.com/api/automation-hub/content/published/
 auth_url=https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token

+[galaxy_server.validated]
+# Define the token in the ANSIBLE_GALAXY_SERVER_VALIDATED_TOKEN environment variable
+url=https://console.redhat.com/api/automation-hub/content/validated/
+auth_url=https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token
+
 [galaxy_server.galaxy]
 url=https://galaxy.ansible.com/
--- a/cloud/README.md
+++ b/cloud/README.md
@@ -10,7 +10,7 @@
    - [Configure Credentials](#configure-credentials)
    - [Add Workshop Credential Password](#add-workshop-credential-password)
    - [Remove Inventory Variables](#remove-inventory-variables)
-    - [Getting your Puiblic Key for Create Keypair Job](#getting-your-puiblic-key-for-create-keypair-job)
+    - [Getting your Public Key for Create Keypair Job](#getting-your-public-key-for-create-keypair-job)
  - [Suggested Usage](#suggested-usage)
  - [Known Issues](#known-issues)

@@ -49,11 +49,11 @@ After running the setup job template, there are a few steps required to make the

 1) Remove Workshop Inventory variables on the Details page of the inventory. Required until [RFE](https://github.com/ansible/workshops/issues/1597]) is complete

-### Getting your Puiblic Key for Create Keypair Job
+### Getting your Public Key for Create Keypair Job

 1) Connect to the command line of your Controller server. This is easiest to do by opening the VS Code Web Editor from the landing page where you found the Controller login details.
 2) Open a Terminal Window in the VS Code Web Editor.
-3) SSH to one of your linux nodes (eg. `ssh node1`). This should log you into the node as `ec2-user`
+3) SSH to one of your linux nodes (eg. `ssh aws_rhel9`). This should log you into the node as `ec2-user`
 4) `cat .ssh/authorized_keys` and copy the key listed including the  `ssh-rsa` prefix


--- a/cloud/aws_key.yml
+++ b/cloud/aws_key.yml
@@ -23,3 +23,8 @@
        state: present
        tags:
          owner: "{{ aws_keypair_owner }}"
+
+    - name: Set VPC stats
+      ansible.builtin.set_stats:
+        data:
+          stat_aws_key_pair: '{{ aws_key_name }}'
--- a/cloud/create_vpc.yml
+++ b/cloud/create_vpc.yml
@@ -122,3 +122,12 @@
          Name: "{{ aws_rt_name }}"
          owner: "{{ aws_owner_tag }}"
          purpose: "{{ aws_purpose_tag }}"
+
+    - name: Set VPC stats
+      ansible.builtin.set_stats:
+        data:
+          stat_aws_region: '{{ create_vm_aws_region }}'
+          stat_aws_vpc_id: '{{ aws_vpc.vpc.id }}'
+          stat_aws_vpc_cidr: '{{ aws_vpc_cidr_block }}'
+          stat_aws_subnet_id: '{{ aws_subnet.subnet.id }}'
+          stat_aws_subnet_cidr: '{{ aws_subnet_cidr }}'
--- a/cloud/display-ec2-stats.yml
+++ b/cloud/display-ec2-stats.yml
@@ -0,0 +1,18 @@
+---
+- name: Display EC2 stats
+  hosts: localhost
+  gather_facts: false
+
+  tasks:
+    - name: Display stats for EC2 VPC and key pair
+      ansible.builtin.debug:
+        var: '{{ item }}'
+      loop:
+        - stat_aws_region
+        - stat_aws_key_pair
+        - stat_aws_vpc_id
+        - stat_aws_vpc_cidr
+        - stat_aws_subnet_id
+        - stat_aws_subnet_cidr
+
+...
--- a/cloud/setup.yml
+++ b/cloud/setup.yml
@@ -3,82 +3,6 @@ _deployment_id: "{{ lookup('file', playbook_dir + '/.deployment_id') }}"

 user_message:

-controller_execution_environments:
-  - name: Cloud Services Execution Environment
-    image: quay.io/scottharwell/cloud-ee:latest
-
-controller_projects:
-  - name: Ansible Cloud Content Lab - AWS
-    organization: Default
-    scm_type: git
-    wait: true
-    scm_url: https://github.com/ansible-content-lab/aws.infrastructure_config_demos.git
-    default_environment: Cloud Services Execution Environment
-
-controller_credentials:
-  - name: AWS
-    credential_type: Amazon Web Services
-    organization: Default
-    update_secrets: false
-    state: exists
-    inputs:
-      username: REPLACEME
-      password: REPLACEME
-
-#  - name: Azure
-#    credential_type: Microsoft Azure Resource Manager
-#    organization: Default
-#    update_secrets: false
-#    inputs:
-#      subscription: REPLACEME
-
-controller_inventory_sources:
-  - name: AWS Inventory
-    organization: Default
-    source: ec2
-    inventory: Demo Inventory
-    credential: AWS
-    overwrite: true
-    source_vars:
-      hostnames:
-        - tag:Name
-      compose:
-        ansible_host: public_ip_address
-        ansible_user: 'ec2-user'
-      groups:
-        cloud_aws: true
-        os_linux: tags.blueprint.startswith('rhel')
-      keyed_groups:
-        - key: platform
-          prefix: os
-        - key: tags.blueprint
-          prefix: blueprint
-        - key: tags.owner
-          prefix: owner
-
-#  - name: Azure Inventory
-#    organization: Default
-#    source: azure_rm
-#   inventory: Demo Inventory
-#    credential: Azure
-#    execution_environment: Ansible Engine 2.9 execution environment
-#    overwrite: true
-#    source_vars:
-#      hostnames:
-#        - tags.Name
-#        - default
-#      keyed_groups:
-#        - key: os_profile.system
-#          prefix: os
-#      conditional_groups:
-#        cloud_azure: true
-
-controller_groups:
-  - name: cloud_aws
-    inventory: Demo Inventory
-    variables:
-      ansible_user: ec2-user
-
 controller_templates:
  - name: Cloud / AWS / Create Peer Infrastructure
    job_type: run
@@ -140,168 +64,21 @@ controller_templates:
    extra_vars:
      aws_region: us-east-1

-  - name: Cloud / AWS / Create VPC
-    job_type: run
-    organization: Default
-    credentials:
-      - AWS
-    project: Ansible official demo project
-    playbook: cloud/create_vpc.yml
-    inventory: Demo Inventory
-    notification_templates_started: Telemetry
-    notification_templates_success: Telemetry
-    notification_templates_error: Telemetry
-    survey_enabled: true
-    survey:
-      name: ''
-      description: ''
-      spec:
-        - question_name: AWS Region
-          type: multiplechoice
-          variable: create_vm_aws_region
-          required: true
-          choices:
-            - us-east-1
-            - us-east-2
-            - us-west-1
-            - us-west-2
-        - question_name: Owner
-          type: text
-          variable: aws_owner_tag
-          required: true
-
-  - name: Cloud / AWS / Create VM
-    job_type: run
-    organization: Default
-    credentials:
-      - AWS
-      - Demo Credential
-    project: Ansible Cloud Content Lab - AWS
-    playbook: playbooks/create_vm.yml
-    inventory: Demo Inventory
-    notification_templates_started: Telemetry
-    notification_templates_success: Telemetry
-    notification_templates_error: Telemetry
-    survey_enabled: true
-    allow_simultaneous: true
-    survey:
-      name: ''
-      description: ''
-      spec:
-        - question_name: AWS Region
-          type: multiplechoice
-          variable: create_vm_aws_region
-          required: true
-          choices:
-            - us-east-1
-            - us-east-2
-            - us-west-1
-            - us-west-2
-        - question_name: Name
-          type: text
-          variable: create_vm_vm_name
-          required: true
-        - question_name: Owner
-          type: text
-          variable: create_vm_vm_owner
-          required: true
-        - question_name: Deployment
-          type: text
-          variable: create_vm_vm_deployment
-          required: true
-        - question_name: Environment
-          type: multiplechoice
-          variable: create_vm_vm_environment
-          required: true
-          choices:
-            - Dev
-            - QA
-            - Prod
-        - question_name: Blueprint
-          type: multiplechoice
-          variable: vm_blueprint
-          required: true
-          choices:
-            - windows_core
-            - windows_full
-            - rhel9
-            - rhel8
-            - rhel7
-            - al2023
-        - question_name: Subnet
-          type: text
-          variable: create_vm_aws_vpc_subnet_name
-          required: true
-          default: aws-test-subnet
-        - question_name: Security Group
-          type: text
-          variable: create_vm_aws_securitygroup_name
-          required: true
-          default: aws-test-sg
-        - question_name: SSH Keypair
-          type: text
-          variable: create_vm_aws_keypair_name
-          required: true
-          default: aws-test-key
-        - question_name: AWS Instance Type (defaults to blueprint value)
-          type: text
-          variable: create_vm_aws_instance_size
-          required: false
-        - question_name: AWS Image Filter (defaults to blueprint value)
-          type: text
-          variable: create_vm_aws_image_filter
-          required: false
-
-  - name: Cloud / AWS / Delete VM
-    job_type: run
-    organization: Default
-    credentials:
-      - AWS
-      - Demo Credential
-    project: Ansible Cloud Content Lab - AWS
-    playbook: playbooks/delete_inventory_vm.yml
-    inventory: Demo Inventory
-    notification_templates_started: Telemetry
-    notification_templates_success: Telemetry
-    notification_templates_error: Telemetry
-    survey_enabled: true
-    survey:
-      name: ''
-      description: ''
-      spec:
-        - question_name: Name or Pattern
-          type: text
-          variable: _hosts
-          required: true
-
  - name: Cloud / AWS / VPC Report
    job_type: run
    organization: Default
    credentials:
      - AWS
-    project: Ansible Cloud Content Lab - AWS
-    playbook: playbooks/create_reports.yml
+    project: Ansible Cloud AWS Demos
+    playbook: playbooks/cloud_report.yml
    inventory: Demo Inventory
+    execution_environment: Cloud Services Execution Environment
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
    notification_templates_error: Telemetry
    extra_vars:
-      aws_report: vpc
      reports_aws_bucket_name: reports-pd-{{ _deployment_id }}
-    survey_enabled: true
-    survey:
-      name: ''
-      description: ''
-      spec:
-        - question_name: AWS Region
-          type: multiplechoice
-          variable: create_vm_aws_region
-          required: true
-          choices:
-            - us-east-1
-            - us-east-2
-            - us-west-1
-            - us-west-2
+      reports_aws_region: "us-east-1"

  - name: Cloud / AWS / Tags Report
    job_type: run
@@ -332,51 +109,12 @@ controller_templates:
            - us-west-1
            - us-west-2

-  - name: Cloud / AWS / Create Keypair
-    job_type: run
-    organization: Default
-    credentials:
-      - AWS
-    project: Ansible official demo project
-    playbook: cloud/aws_key.yml
-    inventory: Demo Inventory
-    notification_templates_started: Telemetry
-    notification_templates_success: Telemetry
-    notification_templates_error: Telemetry
-    survey_enabled: true
-    survey:
-      name: ''
-      description: ''
-      spec:
-        - question_name: AWS Region
-          type: multiplechoice
-          variable: create_vm_aws_region
-          required: true
-          choices:
-            - us-east-1
-            - us-east-2
-            - us-west-1
-            - us-west-2
-        - question_name: Keypair Name
-          type: text
-          variable: aws_key_name
-          required: true
-          default: aws-test-key
-        - question_name: Keypair Public Key
-          type: textarea
-          variable: aws_public_key
-          required: true
-        - question_name: Owner
-          type: text
-          variable: aws_keypair_owner
-          required: true
-
  - name: Cloud / AWS / Snapshot EC2
    job_type: run
    organization: Default
    credentials:
      - AWS
-    project: Ansible official demo project
+    project: Ansible Product Demos
    playbook: cloud/snapshot_ec2.yml
    inventory: Demo Inventory
    notification_templates_started: Telemetry
@@ -407,7 +145,7 @@ controller_templates:
    organization: Default
    credentials:
      - AWS
-    project: Ansible official demo project
+    project: Ansible Product Demos
    playbook: cloud/restore_ec2.yml
    inventory: Demo Inventory
    notification_templates_started: Telemetry
@@ -433,10 +171,22 @@ controller_templates:
          variable: _hosts
          required: false

+  - name: Cloud / AWS / Display EC2 Stats
+    job_type: run
+    organization: Default
+    credentials:
+      - AWS
+    project: Ansible Product Demos
+    playbook: cloud/display-ec2-stats.yml
+    inventory: Demo Inventory
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+
  - name: "LINUX / Patching"
    job_type: check
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/patching.yml"
    execution_environment: Default execution environment
    notification_templates_started: Telemetry
@@ -503,19 +253,24 @@ controller_workflows:
      - identifier: Create Keypair
        unified_job_template: Cloud / AWS / Create Keypair
        success_nodes:
-          - VPC Report
+          - EC2 Stats
        failure_nodes:
          - Ticket - Keypair Failed
      - identifier: Create VPC
        unified_job_template: Cloud / AWS / Create VPC
        success_nodes:
-          - VPC Report
+          - EC2 Stats
        failure_nodes:
          - Ticket - VPC Failed
      - identifier: Ticket - Keypair Failed
        unified_job_template: 'SUBMIT FEEDBACK'
        extra_data:
          feedback: Failed to create AWS keypair
+      - identifier: EC2 Stats
+        unified_job_template: Cloud / AWS / Display EC2 Stats
+        all_parents_must_converge: true
+        always_nodes:
+          - VPC Report
      - identifier: VPC Report
        unified_job_template: Cloud / AWS / VPC Report
        all_parents_must_converge: true
@@ -524,6 +279,7 @@ controller_workflows:
          - Deploy RHEL8 Blueprint
          - Deploy RHEL9 Blueprint
          - Deploy Windows Core Blueprint
+          - Deploy Report Server
      - identifier: Deploy Windows GUI Blueprint
        unified_job_template: Cloud / AWS / Create VM
        extra_data:
@@ -560,10 +316,15 @@ controller_workflows:
          - Update Inventory
        failure_nodes:
          - Ticket - Instance Failed
-      - identifier: Ticket - VPC Failed
-        unified_job_template: 'SUBMIT FEEDBACK'
+      - identifier: Deploy Report Server
+        unified_job_template: Cloud / AWS / Create VM
        extra_data:
-          feedback: Failed to create AWS VPC
+          create_vm_vm_name: reports
+          vm_blueprint: rhel9
+        success_nodes:
+          - Update Inventory
+        failure_nodes:
+          - Ticket - Instance Failed
      - identifier: Update Inventory
        unified_job_template: AWS Inventory
        success_nodes:
@@ -574,6 +335,10 @@ controller_workflows:
          feedback: Failed to create AWS instance
      - identifier: Tag Report
        unified_job_template: Cloud / AWS / Tags Report
+      - identifier: Ticket - VPC Failed
+        unified_job_template: 'SUBMIT FEEDBACK'
+        extra_data:
+          feedback: Failed to create AWS VPC

  - name: Cloud / AWS / Patch EC2 Workflow
    description: A workflow to patch ec2 instances with snapshot and restore on failure.
@@ -603,7 +368,7 @@ controller_workflows:
          default: os_linux
    simplified_workflow_nodes:
      - identifier: Project Sync
-        unified_job_template: Ansible official demo project
+        unified_job_template: Ansible Product Demos
        success_nodes:
          - Take Snapshot
      - identifier: Inventory Sync
--- a/collections/ansible_collections/demo/compliance/playbooks/playbook.yml
+++ b/collections/ansible_collections/demo/compliance/playbooks/playbook.yml
@@ -0,0 +1,7 @@
+---
+- hosts: localhost
+  gather_facts: no
+
+  tasks:
+  - debug:
+      msg: Hello world!
--- a/collections/ansible_collections/demo/compliance/roles/iosxeSTIG/tasks/main.yml
+++ b/collections/ansible_collections/demo/compliance/roles/iosxeSTIG/tasks/main.yml
@@ -137,14 +137,14 @@
    - (cmd_result.stdout|join('\n')).find('ip dns server') != -1
    - iosxeSTIG_stigrule_215823_Manage
 # R-215823 CISC-ND-000470
- name : stigrule_215823_disable_identd
-  ignore_errors: "{{ ignore_all_errors }}"
-  notify: "save configuration"
-  ios_config:
-    defaults: yes
-    lines: "{{ iosxeSTIG_stigrule_215823_disable_identd_Lines }}"
-  when:
-    - iosxeSTIG_stigrule_215823_Manage
+# - name : stigrule_215823_disable_identd
+#   ignore_errors: "{{ ignore_all_errors }}"
+#   notify: "save configuration"
+#   ios_config:
+#     defaults: yes
+#     lines: "{{ iosxeSTIG_stigrule_215823_disable_identd_Lines }}"
+#   when:
+#     - iosxeSTIG_stigrule_215823_Manage
 # R-215823 CISC-ND-000470
 - name : stigrule_215823_disable_finger
  ignore_errors: "{{ ignore_all_errors }}"
@@ -378,9 +378,9 @@
 - name : stigrule_215837_host
  ignore_errors: "{{ ignore_all_errors }}"
  notify: "save configuration"
-  ios_logging:
-    dest: host
-    name: "{{ iosxeSTIG_stigrule_215837_host_Name }}"
+  ios_config:
+    lines:
+      - "logging {{ iosxeSTIG_stigrule_215837_host_Name }}"
  when: iosxeSTIG_stigrule_215837_Manage
 # R-215837 CISC-ND-001000
 # Please configure name IP address to a valid one.
@@ -397,16 +397,18 @@
 - name : stigrule_215838_ntp_server_1
  ignore_errors: "{{ ignore_all_errors }}"
  notify: "save configuration"
-  ios_ntp:
-    server: "{{ iosxeSTIG_stigrule_215838_ntp_server_1_Server }}"
+  cisco.ios.ios_config:
+    lines:
+      - "ntp server {{ iosxeSTIG_stigrule_215838_ntp_server_1_Server }}"
  when: iosxeSTIG_stigrule_215838_Manage
 # R-215838 CISC-ND-001030
 # Replace ntp servers' IP address before enabling.
 - name : stigrule_215838_ntp_server_2
  ignore_errors: "{{ ignore_all_errors }}"
  notify: "save configuration"
-  ios_ntp:
-    server: "{{ iosxeSTIG_stigrule_215838_ntp_server_2_Server }}"
+  cisco.ios.ios_config:
+    lines:
+      - "ntp server {{ iosxeSTIG_stigrule_215838_ntp_server_2_Server }}"
  when: iosxeSTIG_stigrule_215838_Manage
 # R-215840 CISC-ND-001050
 # service timestamps log datetime localtime is set in 215817.
--- a/collections/ansible_collections/demo/compliance/roles/rhel8STIG/callback_plugins/stig_xml.py
+++ b/collections/ansible_collections/demo/compliance/roles/rhel8STIG/callback_plugins/stig_xml.py
@@ -1,5 +1,4 @@
-from __future__ import absolute_import, division, print_function
-
+from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type

 from ansible.plugins.callback import CallbackBase
@@ -12,82 +11,76 @@ import os
 import xml.etree.ElementTree as ET
 import xml.dom.minidom

-
 class CallbackModule(CallbackBase):
    CALLBACK_VERSION = 2.0
-    CALLBACK_TYPE = "xml"
-    CALLBACK_NAME = "stig_xml"
+    CALLBACK_TYPE = 'xml'
+    CALLBACK_NAME = 'stig_xml'

    CALLBACK_NEEDS_WHITELIST = True

    def _get_STIG_path(self):
-        cwd = os.path.abspath(".")
+        cwd = os.path.abspath('.')
        for dirpath, dirs, files in os.walk(cwd):
-            if os.path.sep + "files" in dirpath and ".xml" in files[0]:
+            if os.path.sep + 'files' in dirpath and '.xml' in files[0]:
                return os.path.join(cwd, dirpath, files[0])

    def __init__(self):
        super(CallbackModule, self).__init__()
        self.rules = {}
-        self.stig_path = os.environ.get("STIG_PATH")
-        self.XML_path = os.environ.get("XML_PATH")
+        self.stig_path = os.environ.get('STIG_PATH')
+        self.XML_path = os.environ.get('XML_PATH')
        if self.stig_path is None:
            self.stig_path = self._get_STIG_path()
-        self._display.display("Using STIG_PATH: {}".format(self.stig_path))
+        self._display.display('Using STIG_PATH: {}'.format(self.stig_path))
        if self.XML_path is None:
            self.XML_path = tempfile.mkdtemp() + "/xccdf-results.xml"
-        self._display.display("Using XML_PATH: {}".format(self.XML_path))
+        self._display.display('Using XML_PATH: {}'.format(self.XML_path))

        print("Writing: {}".format(self.XML_path))
        STIG_name = os.path.basename(self.stig_path)
-        ET.register_namespace("cdf", "http://checklists.nist.gov/xccdf/1.2")
-        self.tr = ET.Element("{http://checklists.nist.gov/xccdf/1.2}TestResult")
-        self.tr.set(
-            "id",
-            "xccdf_mil.disa.stig_testresult_scap_mil.disa_comp_{}".format(STIG_name),
-        )
+        ET.register_namespace('cdf', 'http://checklists.nist.gov/xccdf/1.2')
+        self.tr = ET.Element('{http://checklists.nist.gov/xccdf/1.2}TestResult')
+        self.tr.set('id', 'xccdf_mil.disa.stig_testresult_scap_mil.disa_comp_{}'.format(STIG_name))
        endtime = strftime("%Y-%m-%dT%H:%M:%S", gmtime())
-        self.tr.set("end-time", endtime)
-        tg = ET.SubElement(self.tr, "{http://checklists.nist.gov/xccdf/1.2}target")
+        self.tr.set('end-time', endtime)
+        tg = ET.SubElement(self.tr, '{http://checklists.nist.gov/xccdf/1.2}target')
        tg.text = platform.node()

    def _get_rev(self, nid):
-        with open(self.stig_path, "r") as f:
-            r = "SV-{}r(?P<rev>\d+)_rule".format(nid)
+        with open(self.stig_path, 'r') as f:
+            r = 'SV-{}r(?P<rev>\d+)_rule'.format(nid)
            m = re.search(r, f.read())
        if m:
-            rev = m.group("rev")
+            rev = m.group('rev')
        else:
-            rev = "0"
+            rev = '0'
        return rev

    def v2_runner_on_ok(self, result):
        name = result._task.get_name()
-        m = re.search("stigrule_(?P<id>\d+)", name)
+        m = re.search('stigrule_(?P<id>\d+)', name)
        if m:
-            nid = m.group("id")
+            nid = m.group('id')
        else:
            return
        rev = self._get_rev(nid)
        key = "{}r{}".format(nid, rev)
-        if self.rules.get(key, "Unknown") != False:
+        if self.rules.get(key, 'Unknown') != False:
            self.rules[key] = result.is_changed()

    def v2_playbook_on_stats(self, stats):
        for rule, changed in self.rules.items():
-            state = "fail" if changed else "pass"
-            rr = ET.SubElement(
-                self.tr, "{http://checklists.nist.gov/xccdf/1.2}rule-result"
-            )
-            rr.set("idref", "xccdf_mil.disa.stig_rule_SV-{}_rule".format(rule))
-            rs = ET.SubElement(rr, "{http://checklists.nist.gov/xccdf/1.2}result")
+            state = 'fail' if changed else 'pass'
+            rr = ET.SubElement(self.tr, '{http://checklists.nist.gov/xccdf/1.2}rule-result')
+            rr.set('idref', 'xccdf_mil.disa.stig_rule_SV-{}_rule'.format(rule))
+            rs = ET.SubElement(rr, '{http://checklists.nist.gov/xccdf/1.2}result')
            rs.text = state
        passing = len(self.rules) - sum(self.rules.values())
-        sc = ET.SubElement(self.tr, "{http://checklists.nist.gov/xccdf/1.2}score")
-        sc.set("maximum", str(len(self.rules)))
-        sc.set("system", "urn:xccdf:scoring:flat-unweighted")
+        sc = ET.SubElement(self.tr, '{http://checklists.nist.gov/xccdf/1.2}score')
+        sc.set('maximum', str(len(self.rules)))
+        sc.set('system', 'urn:xccdf:scoring:flat-unweighted')
        sc.text = str(passing)
-        with open(self.XML_path, "wb") as f:
+        with open(self.XML_path, 'wb') as f:
            out = ET.tostring(self.tr)
-            pretty = xml.dom.minidom.parseString(out).toprettyxml(encoding="utf-8")
+            pretty = xml.dom.minidom.parseString(out).toprettyxml(encoding='utf-8')
            f.write(pretty)
--- a/collections/ansible_collections/demo/compliance/roles/rhel8STIG/defaults/main.yml
+++ b/collections/ansible_collections/demo/compliance/roles/rhel8STIG/defaults/main.yml
@@ -142,9 +142,6 @@ rhel8STIG_stigrule_230347__etc_dconf_db_local_d_00_screensaver_Value: 'true'
 rhel8STIG_stigrule_230348_Manage: True
 rhel8STIG_stigrule_230348_ensure_tmux_is_installed_State: installed
 rhel8STIG_stigrule_230348__etc_tmux_conf_Line: 'set -g lock-command vlock'
-# R-230349 RHEL-08-020041
-rhel8STIG_stigrule_230349_Manage: True
-rhel8STIG_stigrule_230349__etc_bashrc_Line: '[ -n "$PS1" -a -z "$TMUX" ] && exec tmux'
 # R-230352 RHEL-08-020060
 rhel8STIG_stigrule_230352_Manage: True
 rhel8STIG_stigrule_230352__etc_dconf_db_local_d_00_screensaver_Value: 'uint32 900'
@@ -232,9 +229,6 @@ rhel8STIG_stigrule_230394__etc_audit_auditd_conf_Line: 'name_format = hostname'
 # R-230395 RHEL-08-030063
 rhel8STIG_stigrule_230395_Manage: True
 rhel8STIG_stigrule_230395__etc_audit_auditd_conf_Line: 'log_format = ENRICHED'
-# R-230396 RHEL-08-030070
-rhel8STIG_stigrule_230396_Manage: True
-rhel8STIG_stigrule_230396__etc_audit_auditd_conf_Line: 'log_group = root'
 # R-230398 RHEL-08-030090
 # A duplicate of 230396
 # duplicate of 230396
@@ -569,3 +563,6 @@ rhel8STIG_stigrule_244553_net_ipv4_conf_all_accept_redirects_Value: 0
 # R-244554 RHEL-08-040286
 rhel8STIG_stigrule_244554_Manage: True
 rhel8STIG_stigrule_244554__etc_sysctl_d_99_sysctl_conf_Line: 'net.core.bpf_jit_harden = 2'
+# R-256974 RHEL-08-010358
+rhel8STIG_stigrule_256974_Manage: True
+rhel8STIG_stigrule_256974_mailx_State: installed
--- a/collections/ansible_collections/demo/compliance/roles/rhel8STIG/files/U_RHEL_8_STIG_V1R13_Manual-xccdf.xml
+++ b/collections/ansible_collections/demo/compliance/roles/rhel8STIG/files/U_RHEL_8_STIG_V1R13_Manual-xccdf.xml
--- a/collections/ansible_collections/demo/compliance/roles/rhel8STIG/tasks/main.yml
+++ b/collections/ansible_collections/demo/compliance/roles/rhel8STIG/tasks/main.yml
@@ -4,7 +4,7 @@
 - name: stigrule_230225_banner
  lineinfile:
    path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)banner\s+'
+    regexp: '(?i)^\s*banner\s+'
    line: "{{ rhel8STIG_stigrule_230225_banner_Line }}"
  notify: ssh_restart
  when:
@@ -82,7 +82,7 @@
 - name: stigrule_230244_ClientAliveCountMax
  lineinfile:
    path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)ClientAliveCountMax\s+'
+    regexp: '(?i)^\s*ClientAliveCountMax\s+'
    line: "{{ rhel8STIG_stigrule_230244_ClientAliveCountMax_Line }}"
  notify: ssh_restart
  when:
@@ -249,7 +249,7 @@
 - name: stigrule_230288_StrictModes
  lineinfile:
    path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)StrictModes\s+'
+    regexp: '(?i)^\s*StrictModes\s+'
    line: "{{ rhel8STIG_stigrule_230288_StrictModes_Line }}"
  notify: ssh_restart
  when:
@@ -259,7 +259,7 @@
 - name: stigrule_230290_IgnoreUserKnownHosts
  lineinfile:
    path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)IgnoreUserKnownHosts\s+'
+    regexp: '(?i)^\s*IgnoreUserKnownHosts\s+'
    line: "{{ rhel8STIG_stigrule_230290_IgnoreUserKnownHosts_Line }}"
  notify: ssh_restart
  when:
@@ -269,7 +269,7 @@
 - name: stigrule_230291_KerberosAuthentication
  lineinfile:
    path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)KerberosAuthentication\s+'
+    regexp: '(?i)^\s*KerberosAuthentication\s+'
    line: "{{ rhel8STIG_stigrule_230291_KerberosAuthentication_Line }}"
  notify: ssh_restart
  when:
@@ -279,7 +279,7 @@
 - name: stigrule_230296_PermitRootLogin
  lineinfile:
    path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)PermitRootLogin\s+'
+    regexp: '(?i)^\s*PermitRootLogin\s+'
    line: "{{ rhel8STIG_stigrule_230296_PermitRootLogin_Line }}"
  notify: ssh_restart
  when:
@@ -395,7 +395,7 @@
 - name: stigrule_230330_PermitUserEnvironment
  lineinfile:
    path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)PermitUserEnvironment\s+'
+    regexp: '(?i)^\s*PermitUserEnvironment\s+'
    line: "{{ rhel8STIG_stigrule_230330_PermitUserEnvironment_Line }}"
  notify: ssh_restart
  when:
@@ -436,14 +436,6 @@
    create: yes
  when:
    - rhel8STIG_stigrule_230348_Manage
-# R-230349 RHEL-08-020041
- name: stigrule_230349__etc_bashrc
-  lineinfile:
-    path: /etc/bashrc
-    line: "{{ rhel8STIG_stigrule_230349__etc_bashrc_Line }}"
-    create: yes
-  when:
-    - rhel8STIG_stigrule_230349_Manage
 # R-230352 RHEL-08-020060
 - name: stigrule_230352__etc_dconf_db_local_d_00_screensaver
  ini_file:
@@ -602,7 +594,7 @@
 - name: stigrule_230382_PrintLastLog
  lineinfile:
    path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)PrintLastLog\s+'
+    regexp: '(?i)^\s*PrintLastLog\s+'
    line: "{{ rhel8STIG_stigrule_230382_PrintLastLog_Line }}"
  notify: ssh_restart
  when:
@@ -726,16 +718,6 @@
  notify: auditd_restart
  when:
    - rhel8STIG_stigrule_230395_Manage
-# R-230396 RHEL-08-030070
- name: stigrule_230396__etc_audit_auditd_conf
-  lineinfile:
-    path: /etc/audit/auditd.conf
-    regexp: '^log_group = '
-    line: "{{ rhel8STIG_stigrule_230396__etc_audit_auditd_conf_Line }}"
-    create: yes
-  notify: auditd_restart
-  when:
-    - rhel8STIG_stigrule_230396_Manage
 # R-230402 RHEL-08-030121
 - name : stigrule_230402__etc_audit_rules_d_audit_rules_e2
  lineinfile:
@@ -1348,7 +1330,7 @@
 - name: stigrule_230527_RekeyLimit
  lineinfile:
    path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)RekeyLimit\s+'
+    regexp: '(?i)^\s*RekeyLimit\s+'
    line: "{{ rhel8STIG_stigrule_230527_RekeyLimit_Line }}"
  notify: ssh_restart
  when:
@@ -1569,7 +1551,7 @@
 - name: stigrule_230555_X11Forwarding
  lineinfile:
    path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)X11Forwarding\s+'
+    regexp: '(?i)^\s*X11Forwarding\s+'
    line: "{{ rhel8STIG_stigrule_230555_X11Forwarding_Line }}"
  notify: ssh_restart
  when:
@@ -1579,7 +1561,7 @@
 - name: stigrule_230556_X11UseLocalhost
  lineinfile:
    path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)X11UseLocalhost\s+'
+    regexp: '(?i)^\s*X11UseLocalhost\s+'
    line: "{{ rhel8STIG_stigrule_230556_X11UseLocalhost_Line }}"
  notify: ssh_restart
  when:
@@ -1635,7 +1617,7 @@
 - name: stigrule_244525_ClientAliveInterval
  lineinfile:
    path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)ClientAliveInterval\s+'
+    regexp: '(?i)^\s*ClientAliveInterval\s+'
    line: "{{ rhel8STIG_stigrule_244525_ClientAliveInterval_Line }}"
  notify: ssh_restart
  when:
@@ -1651,7 +1633,7 @@
 - name: stigrule_244528_GSSAPIAuthentication
  lineinfile:
    path: /etc/ssh/sshd_config
-    regexp: '^\s*(?i)GSSAPIAuthentication\s+'
+    regexp: '(?i)^\s*GSSAPIAuthentication\s+'
    line: "{{ rhel8STIG_stigrule_244528_GSSAPIAuthentication_Line }}"
  notify: ssh_restart
  when:
@@ -1798,3 +1780,9 @@
    create: yes
  when:
    - rhel8STIG_stigrule_244554_Manage
+# R-256974 RHEL-08-010358
+- name: stigrule_256974_mailx
+  yum:
+    name: mailx
+    state: "{{ rhel8STIG_stigrule_256974_mailx_State }}"
+  when: rhel8STIG_stigrule_256974_Manage
--- a/collections/ansible_collections/demo/compliance/roles/rhel9STIG/callback_plugins/stig_xml.py
+++ b/collections/ansible_collections/demo/compliance/roles/rhel9STIG/callback_plugins/stig_xml.py
@@ -0,0 +1,86 @@
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+from ansible.plugins.callback import CallbackBase
+from time import gmtime, strftime
+import platform
+import tempfile
+import re
+import sys
+import os
+import xml.etree.ElementTree as ET
+import xml.dom.minidom
+
+class CallbackModule(CallbackBase):
+    CALLBACK_VERSION = 2.0
+    CALLBACK_TYPE = 'xml'
+    CALLBACK_NAME = 'stig_xml'
+
+    CALLBACK_NEEDS_WHITELIST = True
+
+    def _get_STIG_path(self):
+        cwd = os.path.abspath('.')
+        for dirpath, dirs, files in os.walk(cwd):
+            if os.path.sep + 'files' in dirpath and '.xml' in files[0]:
+                return os.path.join(cwd, dirpath, files[0])
+
+    def __init__(self):
+        super(CallbackModule, self).__init__()
+        self.rules = {}
+        self.stig_path = os.environ.get('STIG_PATH')
+        self.XML_path = os.environ.get('XML_PATH')
+        if self.stig_path is None:
+            self.stig_path = self._get_STIG_path()
+        self._display.display('Using STIG_PATH: {}'.format(self.stig_path))
+        if self.XML_path is None:
+            self.XML_path = tempfile.mkdtemp() + "/xccdf-results.xml"
+        self._display.display('Using XML_PATH: {}'.format(self.XML_path))
+
+        print("Writing: {}".format(self.XML_path))
+        STIG_name = os.path.basename(self.stig_path)
+        ET.register_namespace('cdf', 'http://checklists.nist.gov/xccdf/1.2')
+        self.tr = ET.Element('{http://checklists.nist.gov/xccdf/1.2}TestResult')
+        self.tr.set('id', 'xccdf_mil.disa.stig_testresult_scap_mil.disa_comp_{}'.format(STIG_name))
+        endtime = strftime("%Y-%m-%dT%H:%M:%S", gmtime())
+        self.tr.set('end-time', endtime)
+        tg = ET.SubElement(self.tr, '{http://checklists.nist.gov/xccdf/1.2}target')
+        tg.text = platform.node()
+
+    def _get_rev(self, nid):
+        with open(self.stig_path, 'r') as f:
+            r = 'SV-{}r(?P<rev>\d+)_rule'.format(nid)
+            m = re.search(r, f.read())
+        if m:
+            rev = m.group('rev')
+        else:
+            rev = '0'
+        return rev
+
+    def v2_runner_on_ok(self, result):
+        name = result._task.get_name()
+        m = re.search('stigrule_(?P<id>\d+)', name)
+        if m:
+            nid = m.group('id')
+        else:
+            return
+        rev = self._get_rev(nid)
+        key = "{}r{}".format(nid, rev)
+        if self.rules.get(key, 'Unknown') != False:
+            self.rules[key] = result.is_changed()
+
+    def v2_playbook_on_stats(self, stats):
+        for rule, changed in self.rules.items():
+            state = 'fail' if changed else 'pass'
+            rr = ET.SubElement(self.tr, '{http://checklists.nist.gov/xccdf/1.2}rule-result')
+            rr.set('idref', 'xccdf_mil.disa.stig_rule_SV-{}_rule'.format(rule))
+            rs = ET.SubElement(rr, '{http://checklists.nist.gov/xccdf/1.2}result')
+            rs.text = state
+        passing = len(self.rules) - sum(self.rules.values())
+        sc = ET.SubElement(self.tr, '{http://checklists.nist.gov/xccdf/1.2}score')
+        sc.set('maximum', str(len(self.rules)))
+        sc.set('system', 'urn:xccdf:scoring:flat-unweighted')
+        sc.text = str(passing)
+        with open(self.XML_path, 'wb') as f:
+            out = ET.tostring(self.tr)
+            pretty = xml.dom.minidom.parseString(out).toprettyxml(encoding='utf-8')
+            f.write(pretty)
--- a/collections/ansible_collections/demo/compliance/roles/rhel9STIG/defaults/main.yml
+++ b/collections/ansible_collections/demo/compliance/roles/rhel9STIG/defaults/main.yml
--- a/collections/ansible_collections/demo/compliance/roles/rhel9STIG/files/U_RHEL_9_STIG_V1R2_Manual-xccdf.xml
+++ b/collections/ansible_collections/demo/compliance/roles/rhel9STIG/files/U_RHEL_9_STIG_V1R2_Manual-xccdf.xml
--- a/collections/ansible_collections/demo/compliance/roles/rhel9STIG/handlers/main.yml
+++ b/collections/ansible_collections/demo/compliance/roles/rhel9STIG/handlers/main.yml
@@ -0,0 +1,30 @@
+- name: dconf_update
+  command: dconf update
+- name: auditd_restart
+  command: /usr/sbin/service auditd restart
+- name: ssh_restart
+  service:
+    name: sshd
+    state: restarted
+- name: rsyslog_restart
+  service:
+    name: rsyslog
+    state: restarted
+- name: sysctl_load_settings
+  command: sysctl --system
+- name: daemon_reload
+  systemd:
+    daemon_reload: true
+- name: networkmanager_reload
+  service:
+    name: NetworkManager
+    state: reloaded
+- name: logind_restart
+  service:
+    name: systemd-logind
+    state: restarted
+- name: with_faillock_enable
+  command: authselect enable-feature with-faillock
+- name: do_reboot
+  reboot:
+    pre_reboot_delay: 60
--- a/collections/ansible_collections/demo/compliance/roles/rhel9STIG/tasks/main.yml
+++ b/collections/ansible_collections/demo/compliance/roles/rhel9STIG/tasks/main.yml
--- a/collections/ansible_collections/demo/openshift/roles/eda_controller/.yamllint
+++ b/collections/ansible_collections/demo/openshift/roles/eda_controller/.yamllint
@@ -0,0 +1,13 @@
+---
+extends: default
+
+rules:
+  comments:
+    require-starting-space: false
+    min-spaces-from-content: 1
+  comments-indentation: disable
+  indentation:
+    indent-sequences: consistent
+  line-length:
+    max: 120
+    allow-non-breakable-inline-mappings: true
--- a/collections/ansible_collections/demo/openshift/roles/eda_controller/defaults/main.yml
+++ b/collections/ansible_collections/demo/openshift/roles/eda_controller/defaults/main.yml
@@ -0,0 +1,16 @@
+---
+# --------------------------------------------------------
+# Ansible Automation Platform Controller URL
+# --------------------------------------------------------
+# eda_controller_aap_controller_url: [Required]
+
+# --------------------------------------------------------
+# Workload: eda_controller
+# --------------------------------------------------------
+eda_controller_project: "aap"
+eda_controller_project_app_name: "eda-controller"
+
+# eda_controller_admin_password: "{{ common_password }}"
+
+eda_controller_cluster_rolebinding_name: eda_default
+eda_controller_cluster_rolebinding_role: cluster-admin
--- a/collections/ansible_collections/demo/openshift/roles/eda_controller/meta/main.yml
+++ b/collections/ansible_collections/demo/openshift/roles/eda_controller/meta/main.yml
@@ -0,0 +1,14 @@
+---
+galaxy_info:
+  role_name: eda_controller
+  author: Mitesh Sharma (mitsharm@redhat.com)
+  description: |
+    Installs EDA on OpenShift
+  license: GPLv3
+  min_ansible_version: "2.9"
+  platforms: []
+  galaxy_tags:
+    - eda
+    - openshift
+    - aap
+dependencies: []
--- a/collections/ansible_collections/demo/openshift/roles/eda_controller/readme.adoc
+++ b/collections/ansible_collections/demo/openshift/roles/eda_controller/readme.adoc
@@ -0,0 +1,6 @@
+== eda_controller
+
+This role installs EDA on OpenShift, mostly copied from https://github.com/redhat-cop/agnosticd/.
+
+== Dependencies
+Role: automation_controller_platform
--- a/collections/ansible_collections/demo/openshift/roles/eda_controller/tasks/main.yml
+++ b/collections/ansible_collections/demo/openshift/roles/eda_controller/tasks/main.yml
@@ -0,0 +1,54 @@
+---
+- name: Setup environment vars
+  block:
+    - name: Create secret and Install EDA
+      kubernetes.core.k8s:
+        state: present
+        definition: "{{ lookup('template', __definition) }}"
+      loop:
+        - eda_admin_secret.j2
+        - eda_controller.j2
+      loop_control:
+        loop_var: __definition
+
+    - name: Retrieve created route
+      kubernetes.core.k8s_info:
+        api_version: "route.openshift.io/v1"
+        kind: Route
+        name: "{{ eda_controller_project_app_name }}"
+        namespace: "{{ eda_controller_project }}"
+      register: r_eda_route
+      until: r_eda_route.resources[0].spec.host is defined
+      retries: 30
+      delay: 45
+
+    - name: Get eda-controller route hostname
+      ansible.builtin.set_fact:
+        eda_controller_hostname: "{{ r_eda_route.resources[0].spec.host }}"
+
+    - name: Wait for eda_controller to be running
+      ansible.builtin.uri:
+        url: https://{{ eda_controller_hostname }}/api/eda/v1/users/me/awx-tokens/
+        user: "admin"
+        password: "{{ lookup('ansible.builtin.env', 'CONTROLLER_PASSWORD') }}"
+        method: GET
+        force_basic_auth: true
+        validate_certs: false
+        body_format: json
+        status_code: 200
+      register: r_result
+      until: not r_result.failed
+      retries: 60
+      delay: 45
+
+    - name: Create Rolebinding for Rulebook Activations
+      kubernetes.core.k8s:
+        state: present
+        definition: "{{ lookup('template', 'cluster_rolebinding.j2') }}"
+
+    - name: Display EDA Controller URL
+      ansible.builtin.debug:
+        msg:
+          - "EDA Controller URL: https://{{ eda_controller_hostname }}"
+          - "EDA Controller Admin Login: admin"
+          - "EDA Controller Admin Password: <same as the Controller Admin password>"
--- a/collections/ansible_collections/demo/openshift/roles/eda_controller/templates/cluster_rolebinding.j2
+++ b/collections/ansible_collections/demo/openshift/roles/eda_controller/templates/cluster_rolebinding.j2
@@ -0,0 +1,13 @@
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ eda_controller_cluster_rolebinding_name }}
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: {{ eda_controller_project }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ eda_controller_cluster_rolebinding_role }}
--- a/collections/ansible_collections/demo/openshift/roles/eda_controller/templates/eda_admin_secret.j2
+++ b/collections/ansible_collections/demo/openshift/roles/eda_controller/templates/eda_admin_secret.j2
@@ -0,0 +1,15 @@
+---
+kind: Secret
+apiVersion: v1
+metadata:
+  name: {{ eda_controller_project_app_name }}-admin-password
+  namespace: {{ eda_controller_project }}
+  labels:
+    app.kubernetes.io/component: eda
+    app.kubernetes.io/managed-by: eda-operator
+    app.kubernetes.io/name: {{ eda_controller_project_app_name }}
+    app.kubernetes.io/operator-version: '2.4'
+    app.kubernetes.io/part-of: {{ eda_controller_project_app_name }}
+data:
+  password: "{{ lookup('ansible.builtin.env', 'CONTROLLER_PASSWORD') | b64encode }}"
+type: Opaque
--- a/collections/ansible_collections/demo/openshift/roles/eda_controller/templates/eda_controller.j2
+++ b/collections/ansible_collections/demo/openshift/roles/eda_controller/templates/eda_controller.j2
@@ -0,0 +1,26 @@
+---
+apiVersion: eda.ansible.com/v1alpha1
+kind: EDA
+metadata:
+  name: {{ eda_controller_project_app_name }}
+  namespace: {{ eda_controller_project }}
+spec:
+  route_tls_termination_mechanism: Edge
+  ingress_type: Route
+  loadbalancer_port: 80
+  no_log: true
+  image_pull_policy: IfNotPresent
+  ui:
+    replicas: 1
+  set_self_labels: true
+  api:
+    gunicorn_workers: 2
+    replicas: 1
+  redis:
+    replicas: 1
+  admin_user: admin
+  loadbalancer_protocol: http
+  worker:
+    replicas: 3
+  automation_server_url: '{{ lookup('ansible.builtin.env', 'CONTROLLER_HOST') }}'
+  admin_password_secret: {{ eda_controller_project_app_name }}-admin-password
--- a/collections/ansible_collections/demo/openshift/roles/snapshot/tasks/create.yml
+++ b/collections/ansible_collections/demo/openshift/roles/snapshot/tasks/create.yml
@@ -0,0 +1,49 @@
+---
+- name: Get state of VirtualMachine
+  redhat.openshift_virtualization.kubevirt_vm_info:
+    name: "{{ item }}"
+    namespace: "{{ vm_namespace }}"
+  register: state
+
+- name: Stop VirtualMachine
+  redhat.openshift_virtualization.kubevirt_vm:
+    name: "{{ item }}"
+    namespace: "{{ vm_namespace }}"
+    running: false
+    wait: true
+  when: state.resources.0.spec.running
+
+- name: Create a VirtualMachineSnapshot
+  kubernetes.core.k8s:
+    definition:
+      apiVersion: snapshot.kubevirt.io/v1alpha1
+      kind: VirtualMachineSnapshot
+      metadata:
+        generateName: "{{ item }}-{{ ansible_date_time.epoch }}"
+        namespace: "{{ vm_namespace }}"
+      spec:
+        source:
+          apiGroup: kubevirt.io
+          kind: VirtualMachine
+          name: "{{ item }}"
+    wait: true
+    wait_condition:
+      type: Ready
+  register: snapshot
+
+- name: Start VirtualMachine
+  redhat.openshift_virtualization.kubevirt_vm:
+    name: "{{ item }}"
+    namespace: "{{ vm_namespace }}"
+    running: true
+    wait: true
+  when: state.resources.0.spec.running
+
+- name: Export snapshot name
+  ansible.builtin.set_stats:
+    data:
+      restore_snapshot_name: "{{ snapshot.result.metadata.name }}"
+
+- name: Output snapshot name
+  ansible.builtin.debug:
+    msg: "Successfully created snapshot {{ snapshot.result.metadata.name }}"
--- a/collections/ansible_collections/demo/openshift/roles/snapshot/tasks/main.yml
+++ b/collections/ansible_collections/demo/openshift/roles/snapshot/tasks/main.yml
@@ -0,0 +1,12 @@
+---
+# parameters
+# snapshot_opeation: <ceate/restore>
+- name: Show hostnames we care about
+  ansible.builtin.debug:
+    msg: "About to {{ snapshot_operation }} snapshot(s) for the following hosts:
+{{ lookup('ansible.builtin.inventory_hostnames', snapshot_hosts) | split(',') | difference(['localhost']) }}"
+
+- name: Manage snapshots based on operation
+  ansible.builtin.include_tasks:
+    file: "{{ snapshot_operation }}.yml"
+  loop: "{{ lookup('ansible.builtin.inventory_hostnames', snapshot_hosts) | regex_replace(vm_namespace + '-', '') | split(',') | difference(['localhost']) }}"
--- a/collections/ansible_collections/demo/openshift/roles/snapshot/tasks/restore.yml
+++ b/collections/ansible_collections/demo/openshift/roles/snapshot/tasks/restore.yml
@@ -0,0 +1,51 @@
+---
+- name: Get state of VirtualMachine
+  redhat.openshift_virtualization.kubevirt_vm_info:
+    name: "{{ item }}"
+    namespace: "{{ vm_namespace }}"
+  register: state
+
+- name: List snapshots
+  kubernetes.core.k8s_info:
+    api_version: snapshot.kubevirt.io/v1alpha1
+    kind: VirtualMachineSnapshot
+    namespace: "{{ vm_namespace }}"
+  register: snapshot
+
+- name: Set snapshot name for {{ item }}
+  ansible.builtin.set_fact:
+    latest_snapshot: "{{ snapshot.resources | selectattr('spec.source.name', 'equalto', item) | sort(attribute='metadata.creationTimestamp') | first }}"
+
+- name: Stop VirtualMachine
+  redhat.openshift_virtualization.kubevirt_vm:
+    name: "{{ item }}"
+    namespace: "{{ vm_namespace }}"
+    running: false
+    wait: true
+  when: state.resources.0.spec.running
+
+- name: Restore a VirtualMachineSnapshot
+  kubernetes.core.k8s:
+    definition:
+      apiVersion: snapshot.kubevirt.io/v1alpha1
+      kind: VirtualMachineRestore
+      metadata:
+        generateName: "{{ latest_snapshot.metadata.generateName }}"
+        namespace: "{{ vm_namespace }}"
+      spec:
+        target:
+          apiGroup: kubevirt.io
+          kind: VirtualMachine
+          name: "{{ item }}"
+        virtualMachineSnapshotName: "{{ latest_snapshot.metadata.name }}"
+    wait: true
+    wait_condition:
+      type: Ready
+
+- name: Start VirtualMachine
+  redhat.openshift_virtualization.kubevirt_vm:
+    name: "{{ item }}"
+    namespace: "{{ vm_namespace }}"
+    running: true
+    wait: true
+  when: state.resources.0.spec.running
--- a/collections/ansible_collections/demo/patching/roles/build_report_network/tasks/main.yml
+++ b/collections/ansible_collections/demo/patching/roles/build_report_network/tasks/main.yml
@@ -6,32 +6,34 @@
    mode: "0755"

 - name: Create HTML report
+  check_mode: false
  ansible.builtin.template:
    src: report.j2
    dest: "{{ file_path }}/network.html"
    mode: "0644"
-  check_mode: false

 - name: Copy CSS over
+  check_mode: false
  ansible.builtin.copy:
    src: "css"
    dest: "{{ file_path }}"
    directory_mode: true
    mode: "0775"
-  check_mode: false

 - name: Copy logos over
-  ansible.builtin.copy:
-    src: "{{ item }}"
-    dest: "{{ file_path }}"
-    directory_mode: true
-    mode: "0644"
  loop:
    - "webpage_logo.png"
    - "redhat-ansible-logo.svg"
    - "router.png"
+  loop_control:
+    loop_var: logo
  check_mode: false
+  ansible.builtin.copy:
+    src: "{{ logo }}"
+    dest: "{{ file_path }}"
+    directory_mode: true
+    mode: "0644"

-# - name: Display link to Linux patch report
-#   ansible.builtin.debug:
-#     msg: "Please go to http://{{ hostvars[report_server]['ansible_host'] }}/reports/network.html"
+- name: Display link to Linux patch report
+  ansible.builtin.debug:
+    msg: "Please go to http://{{ hostvars[report_server]['ansible_host'] }}/reports/network.html"
--- a/collections/ansible_collections/demo/patching/roles/report_server/tasks/apache.yml
+++ b/collections/ansible_collections/demo/patching/roles/report_server/tasks/apache.yml
@@ -2,14 +2,6 @@
 - name: Include system variables
  ansible.builtin.include_vars: "{{ ansible_system }}.yml"

- name: Permit traffic in default zone for http service
-  ansible.posix.firewalld:
-    service: http
-    permanent: true
-    state: enabled
-    immediate: true
-  check_mode: false
-
 - name: Install httpd package
  ansible.builtin.yum:
    name: httpd
@@ -30,8 +22,10 @@
    mode: "0644"
  check_mode: false

- name: Install httpd service
+- name: Start httpd service
  ansible.builtin.service:
    name: httpd
    state: started
  check_mode: false
+
+...
--- a/collections/requirements.yml
+++ b/collections/requirements.yml
@@ -1,53 +1,6 @@
 ---
-# This file is mainly used by product-demos CI,
-# See cloin/ee-builds/product-demos-ee/requirements.yml 
-# for configuring collections and collection versions.
-collections:
-  - name: ansible.controller
-    version: ">=4.5.5"
-  - name: infra.ah_configuration
-    version: ">=2.0.6"
-  - name: infra.controller_configuration
-    version: ">=2.7.1"
-  - name: redhat_cop.controller_configuration
-    version: ">=2.3.1"
-  # linux
-  - name: ansible.posix
-    version: ">=1.5.4"
-  - name: community.general
-    version: ">=8.0.0"
-  - name: containers.podman
-    version: ">=1.12.1"
-  - name: redhat.insights
-    version: ">=1.2.2"
-  - name: redhat.rhel_system_roles
-    version: ">=1.23.0"
-  # windows
-  - name: ansible.windows
-    version: ">=2.3.0"
-  - name: chocolatey.chocolatey
-    version: ">=1.5.1"
-  - name: community.windows
-    version: ">=2.2.0"
-  # cloud
-  - name: amazon.aws
-    version: ">=7.5.0"
-  # satellite
-  - name: redhat.satellite
-    version: ">=4.0.0"
-  # network
-  - name: ansible.netcommon
-    version: ">=6.0.0"
-  - name: cisco.ios
-    version: ">=7.0.0"
-  - name: cisco.iosxr
-    version: ">=8.0.0"
-  - name: cisco.nxos
-    version: ">=7.0.0"
-  # openshift
-  - name: kubernetes.core
-    version: ">=4.0.0"
-  - name: redhat.openshift
-    version: ">=3.0.1"
-  - name: redhat.openshift_virtualization
-    version: ">=1.4.0"
+# required collections are installed in the Product Demos EE.
+# additional collections needed during testing can be added here.
+collections: []
+
+...
--- a/common/README.md
+++ b/common/README.md
@@ -0,0 +1,3 @@
+# Common Prerequisites
+
+Demos from some categories (cloud, linux, windows, etc.) have become dependent on controller resources defined in other demo categories.  The setup.yml file in this directory is used to configure these common prerequisites so that they are available before setup for a demo category is called.
--- a/common/setup.yml
+++ b/common/setup.yml
@@ -0,0 +1,288 @@
+---
+controller_execution_environments:
+  - name: Cloud Services Execution Environment
+    image: quay.io/scottharwell/cloud-ee:latest
+
+controller_organizations:
+  - name: Default
+    default_environment: Product Demos EE
+
+controller_projects:
+  - name: Ansible Cloud Content Lab - AWS
+    organization: Default
+    scm_type: git
+    wait: true
+    scm_url: https://github.com/ansible-content-lab/aws.infrastructure_config_demos.git
+    default_environment: Cloud Services Execution Environment
+
+  - name: Ansible Cloud AWS Demos
+    organization: Default
+    scm_type: git
+    wait: true
+    scm_url: https://github.com/ansible-cloud/aws_demos.git
+    default_environment: Cloud Services Execution Environment
+
+controller_credentials:
+  - name: AWS
+    credential_type: Amazon Web Services
+    organization: Default
+    update_secrets: false
+    state: exists
+    inputs:
+      username: REPLACEME
+      password: REPLACEME
+
+controller_inventory_sources:
+  - name: AWS Inventory
+    organization: Default
+    source: ec2
+    inventory: Demo Inventory
+    credential: AWS
+    overwrite: true
+    source_vars:
+      hostnames:
+        - tag:Name
+      compose:
+        ansible_host: public_ip_address
+        ansible_user: 'ec2-user'
+      groups:
+        cloud_aws: true
+        os_linux: tags.blueprint.startswith('rhel')
+        os_windows: tags.blueprint.startswith('win')
+      keyed_groups:
+        - key: platform
+          prefix: os
+        - key: tags.blueprint
+          prefix: blueprint
+        - key: tags.owner
+          prefix: owner
+        - key: tags.purpose
+          prefix: purpose
+        - key: tags.deployment
+          prefix: deployment
+
+controller_groups:
+  - name: cloud_aws
+    inventory: Demo Inventory
+    variables:
+      ansible_user: ec2-user
+  - name: os_windows
+    inventory: Demo Inventory
+    variables:
+      ansible_connection: winrm
+      ansible_winrm_transport: credssp
+
+controller_templates:
+  - name: SUBMIT FEEDBACK
+    job_type: run
+    inventory: Demo Inventory
+    project: Ansible Product Demos
+    playbook: feedback.yml
+    execution_environment: Default execution environment
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    survey_enabled: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: Name/Email/Contact
+          type: text
+          variable: email
+          required: true
+        - question_name: Issue or Feedback
+          type: textarea
+          variable: feedback
+          required: true
+
+  - name: Cloud / AWS / Create VPC
+    job_type: run
+    organization: Default
+    credentials:
+      - AWS
+    project: Ansible Product Demos
+    playbook: cloud/create_vpc.yml
+    inventory: Demo Inventory
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    survey_enabled: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: AWS Region
+          type: multiplechoice
+          variable: create_vm_aws_region
+          required: true
+          choices:
+            - us-east-1
+            - us-east-2
+            - us-west-1
+            - us-west-2
+        - question_name: Owner
+          type: text
+          variable: aws_owner_tag
+          required: true
+
+  - name: Cloud / AWS / Create Keypair
+    job_type: run
+    organization: Default
+    credentials:
+      - AWS
+    project: Ansible Product Demos
+    playbook: cloud/aws_key.yml
+    inventory: Demo Inventory
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    survey_enabled: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: AWS Region
+          type: multiplechoice
+          variable: create_vm_aws_region
+          required: true
+          choices:
+            - us-east-1
+            - us-east-2
+            - us-west-1
+            - us-west-2
+        - question_name: Keypair Name
+          type: text
+          variable: aws_key_name
+          required: true
+          default: aws-test-key
+        - question_name: Keypair Public Key
+          type: textarea
+          variable: aws_public_key
+          required: true
+        - question_name: Owner
+          type: text
+          variable: aws_keypair_owner
+          required: true
+
+  - name: Cloud / AWS / Create VM
+    job_type: run
+    organization: Default
+    credentials:
+      - AWS
+      - Demo Credential
+    project: Ansible Cloud Content Lab - AWS
+    playbook: playbooks/create_vm.yml
+    inventory: Demo Inventory
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    survey_enabled: true
+    allow_simultaneous: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: AWS Region
+          type: multiplechoice
+          variable: create_vm_aws_region
+          required: true
+          choices:
+            - us-east-1
+            - us-east-2
+            - us-west-1
+            - us-west-2
+        - question_name: Name
+          type: text
+          variable: create_vm_vm_name
+          required: true
+        - question_name: Owner
+          type: text
+          variable: create_vm_vm_owner
+          required: true
+        - question_name: Deployment
+          type: text
+          variable: create_vm_vm_deployment
+          required: true
+        - question_name: Purpose
+          type: text
+          variable: create_vm_vm_purpose
+          required: true
+          default: demo
+        - question_name: Environment
+          type: multiplechoice
+          variable: create_vm_vm_environment
+          required: true
+          choices:
+            - Dev
+            - QA
+            - Prod
+        - question_name: Blueprint
+          type: multiplechoice
+          variable: vm_blueprint
+          required: true
+          choices:
+            - windows_core
+            - windows_full
+            - rhel9
+            - rhel8
+            - rhel7
+            - al2023
+        - question_name: Subnet
+          type: text
+          variable: create_vm_aws_vpc_subnet_name
+          required: true
+          default: aws-test-subnet
+        - question_name: Security Group
+          type: text
+          variable: create_vm_aws_securitygroup_name
+          required: true
+          default: aws-test-sg
+        - question_name: SSH Keypair
+          type: text
+          variable: create_vm_aws_keypair_name
+          required: true
+          default: aws-test-key
+        - question_name: AWS Instance Type (defaults to blueprint value)
+          type: text
+          variable: create_vm_aws_instance_size
+          required: false
+        - question_name: AWS Image Filter (defaults to blueprint value)
+          type: text
+          variable: create_vm_aws_image_filter
+          required: false
+
+  - name: Cloud / AWS / Delete VM
+    job_type: run
+    organization: Default
+    credentials:
+      - AWS
+      - Demo Credential
+    project: Ansible Cloud Content Lab - AWS
+    playbook: playbooks/delete_inventory_vm.yml
+    inventory: Demo Inventory
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    survey_enabled: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: Name or Pattern
+          type: text
+          variable: _hosts
+          required: true
+
+controller_notifications:
+  - name: Telemetry
+    organization: Default
+    notification_type: webhook
+    notification_configuration:
+      url: https://script.google.com/macros/s/AKfycbzxUObvCJ6ZbzfJyicw4RvxlGE3AZdrK4AR5-TsedCYd7O-rtTOVjvsRvqyb3rx6B0g8g/exec
+      http_method: POST
+      headers: {}
+
+controller_settings:
+  - name: SESSION_COOKIE_AGE
+    value: 180000
--- a/execution_environments/.gitattributes
+++ b/execution_environments/.gitattributes
@@ -0,0 +1 @@
+openshift-clients-4.16.0-202408021139.p0.ge8fb3c0.assembly.stream.el9.x86_64.rpm filter=lfs diff=lfs merge=lfs -text
--- a/execution_environments/README.md
+++ b/execution_environments/README.md
@@ -0,0 +1,14 @@
+# Execution Environment Images for Ansible Product Demos
+
+When the Ansible Product Demos setup job template is run, it creates a number of execution environment definitions on the automation controller.  The content of this directory is used to create and update the default execution environment images defined during the setup process.
+
+Currently these execution environment images are created manually using the `build.sh` script, with a future goal of building in a CI pipeline when any EE definitions or requirements are updated.
+
+## Building the execution environment images
+
+1. `podman login registry.redhat.io` in order to pull the base EE images
+2. `./build.sh` to build the EE images and add them to your local podman image cache
+
+The `build.sh` script creates multiple EE images, each based on the ee-minimal image that comes with a different minor version of AAP.  These images are created in the "quay.io/ansible-product-demos" namespace.  Currently the script builds the following images:
+
+* quay.io/ansible-product-demos/apd-ee-24
--- a/execution_environments/ansible.cfg
+++ b/execution_environments/ansible.cfg
@@ -0,0 +1,15 @@
+[defaults]
+
+[galaxy]
+server_list = certified, validated, community_galaxy
+
+[galaxy_server.certified]
+url=https://cloud.redhat.com/api/automation-hub/content/published/
+auth_url=https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token
+
+[galaxy_server.validated]
+url=https://cloud.redhat.com/api/automation-hub/content/validated/
+auth_url=https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token
+
+[galaxy_server.community_galaxy]
+url=https://galaxy.ansible.com/
--- a/execution_environments/apd-ee-24.yml
+++ b/execution_environments/apd-ee-24.yml
@@ -0,0 +1,32 @@
+---
+version: 3
+images:
+  base_image:
+    name: registry.redhat.io/ansible-automation-platform-24/ee-minimal-rhel9:latest
+
+dependencies:
+  galaxy: requirements.yml
+
+additional_build_files:
+  # https://access.redhat.com/solutions/7024259
+  # download from access.redhat.com -> Downloads -> OpenShift Container Platform -> Packages
+  - src: openshift-clients-4.16.0-202408021139.p0.ge8fb3c0.assembly.stream.el9.x86_64.rpm
+    dest: rpms
+  - src: ansible.cfg
+    dest: configs
+
+options:
+  package_manager_path: /usr/bin/microdnf
+
+additional_build_steps:
+  prepend_base:
+    - RUN $PYCMD -m pip install --upgrade pip setuptools
+    - COPY _build/rpms/openshift-clients*.rpm /tmp/openshift-clients.rpm
+    - RUN $PKGMGR -y update && $PKGMGR -y install bash-completion && $PKGMGR clean all
+    - RUN rpm -ivh /tmp/openshift-clients.rpm && rm /tmp/openshift-clients.rpm
+  prepend_galaxy:
+    - ADD _build/configs/ansible.cfg /etc/ansible/ansible.cfg
+    - ARG ANSIBLE_GALAXY_SERVER_CERTIFIED_TOKEN
+    - ARG ANSIBLE_GALAXY_SERVER_VALIDATED_TOKEN
+
+...
--- a/execution_environments/apd-ee-25.yml
+++ b/execution_environments/apd-ee-25.yml
@@ -0,0 +1,37 @@
+---
+version: 3
+images:
+  base_image:
+    name: registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel9:latest
+
+dependencies:
+  galaxy: requirements-25.yml
+  python_interpreter:
+    python_path: /usr/bin/python3.11
+
+additional_build_files:
+  # https://access.redhat.com/solutions/7024259
+  # download from access.redhat.com -> Downloads -> OpenShift Container Platform -> Packages
+  - src: openshift-clients-4.16.0-202408021139.p0.ge8fb3c0.assembly.stream.el9.x86_64.rpm
+    dest: rpms
+  - src: ansible.cfg
+    dest: configs
+
+options:
+  package_manager_path: /usr/bin/microdnf
+
+additional_build_steps:
+  prepend_base:
+    # AgnosticD can use this to deterine it is running from an EE
+    # see https://github.com/redhat-cop/agnosticd/blob/development/ansible/install_galaxy_roles.yml
+    - ENV LAUNCHED_BY_RUNNER=1
+    - RUN $PYCMD -m pip install --upgrade pip setuptools
+    - COPY _build/rpms/openshift-clients*.rpm /tmp/openshift-clients.rpm
+    - RUN $PKGMGR -y update && $PKGMGR -y install bash-completion && $PKGMGR clean all
+    - RUN rpm -ivh /tmp/openshift-clients.rpm && rm /tmp/openshift-clients.rpm
+  prepend_galaxy:
+    - ADD _build/configs/ansible.cfg /etc/ansible/ansible.cfg
+    - ARG ANSIBLE_GALAXY_SERVER_CERTIFIED_TOKEN
+    - ARG ANSIBLE_GALAXY_SERVER_VALIDATED_TOKEN
+
+...
--- a/execution_environments/build.sh
+++ b/execution_environments/build.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+# array of images to build
+ee_images=(
+    "apd-ee-24"
+    "apd-ee-25"
+)
+
+for ee in "${ee_images[@]}"
+do
+    echo "Building EE image ${ee}"
+
+    # build EE image
+    ansible-builder build \
+        --file ${ee}.yml \
+        --context ./ee_contexts/${ee} \
+        --build-arg ANSIBLE_GALAXY_SERVER_CERTIFIED_TOKEN \
+        --build-arg ANSIBLE_GALAXY_SERVER_VALIDATED_TOKEN \
+        -v 3 \
+        -t quay.io/ansible-product-demos/${ee}:$(date +%Y%m%d)
+
+    if [[ $? == 0 ]]
+    then
+        # tag EE image as latest
+        podman tag \
+            quay.io/ansible-product-demos/${ee}:$(date +%Y%m%d) \
+            quay.io/ansible-product-demos/${ee}:latest
+    fi
+done
--- a/execution_environments/openshift-clients-4.16.0-202408021139.p0.ge8fb3c0.assembly.stream.el9.x86_64.rpm
+++ b/execution_environments/openshift-clients-4.16.0-202408021139.p0.ge8fb3c0.assembly.stream.el9.x86_64.rpm
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f637eb0440f14f1458800c7a9012adcb9b58eb2131c02f64dfa4ca515e182093
+size 54960859
--- a/execution_environments/requirements-25.yml
+++ b/execution_environments/requirements-25.yml
@@ -0,0 +1,73 @@
+---
+collections:
+  # AAP config as code
+  - name: ansible.controller
+    version: ">=4.6.0"
+  # TODO this fails trying to install a different version of
+  # the python-systemd package
+  # - name: ansible.eda  # fails trying to install systemd-python package
+  #   version: ">=2.1.0"
+  - name: ansible.hub
+    version: ">=1.0.0"
+  - name: ansible.platform
+    version: ">=2.5.0"
+  - name: infra.ah_configuration
+    version: ">=2.0.6"
+  - name: infra.controller_configuration
+    version: ">=2.11.0"
+  # linux demos
+  - name: ansible.posix
+    version: ">=1.5.4"
+  - name: community.general
+    version: ">=8.0.0"
+  - name: containers.podman
+    version: ">=1.12.1"
+  - name: redhat.insights
+    version: ">=1.2.2"
+  - name: redhat.rhel_system_roles
+    version: ">=1.23.0"
+  # windows demos
+  - name: ansible.windows
+    version: ">=2.3.0"
+  - name: chocolatey.chocolatey
+    version: ">=1.5.1"
+  - name: community.windows
+    version: ">=2.2.0"
+  # cloud demos
+  - name: amazon.aws
+    version: ">=7.5.0"
+  # satellite demos
+  - name: redhat.satellite
+    version: ">=4.0.0"
+  # network demos
+  - name: ansible.netcommon
+    version: ">=6.0.0"
+  - name: cisco.ios
+    version: ">=7.0.0"
+  - name: cisco.iosxr
+    version: ">=8.0.0"
+  - name: cisco.nxos
+    version: ">=7.0.0"
+  # TODO on 2.5 ee-minimal-rhel9 this tries to build and install
+  # a different version of python netifaces, which fails
+  # - name: infoblox.nios_modules
+  #   version: ">=1.6.1"
+  # openshift demos
+  - name: kubernetes.core
+    version: ">=4.0.0"
+  - name: redhat.openshift
+    version: ">=3.0.1"
+  - name: redhat.openshift_virtualization
+    version: ">=1.4.0"
+  # for RHDP
+  - name: ansible.utils
+    version: ">=5.1.0"
+  - name: kubevirt.core
+    version: ">=2.1.0"
+  - name: community.okd
+    version: ">=4.0.0"
+  - name: https://github.com/rhpds/assisted_installer.git
+    type: git
+    version: "v0.0.1"
+
+...
--- a/execution_environments/requirements.yml
+++ b/execution_environments/requirements.yml
@@ -0,0 +1,52 @@
+---
+collections:
+  - name: ansible.controller
+    version: "<4.6.0"
+  - name: infra.ah_configuration
+    version: ">=2.0.6"
+  - name: infra.controller_configuration
+    version: ">=2.9.0"
+  - name: redhat_cop.controller_configuration
+    version: ">=2.3.1"
+  # linux
+  - name: ansible.posix
+    version: ">=1.5.4"
+  - name: community.general
+    version: ">=8.0.0"
+  - name: containers.podman
+    version: ">=1.12.1"
+  - name: redhat.insights
+    version: ">=1.2.2"
+  - name: redhat.rhel_system_roles
+    version: ">=1.23.0"
+  # windows
+  - name: ansible.windows
+    version: ">=2.3.0"
+  - name: chocolatey.chocolatey
+    version: ">=1.5.1"
+  - name: community.windows
+    version: ">=2.2.0"
+  # cloud
+  - name: amazon.aws
+    version: ">=7.5.0"
+  # satellite
+  - name: redhat.satellite
+    version: ">=4.0.0"
+  # network
+  - name: ansible.netcommon
+    version: ">=6.0.0"
+  - name: cisco.ios
+    version: ">=7.0.0"
+  - name: cisco.iosxr
+    version: ">=8.0.0"
+  - name: cisco.nxos
+    version: ">=7.0.0"
+  - name: infoblox.nios_modules
+    version: ">=1.6.1"
+  # openshift
+  - name: kubernetes.core
+    version: ">=4.0.0"
+  - name: redhat.openshift
+    version: ">=3.0.1"
+  - name: redhat.openshift_virtualization
+    version: ">=1.4.0"
--- a/linux/README.md
+++ b/linux/README.md
@@ -60,7 +60,7 @@ Edit the `Linux / System Roles` job to include the list of roles that you wish t

 **Linux / Temporary Sudo** - Use this job to show how to grant sudo access with automated cleanup to a server. The user must exist on the system. Using the student user is a good example (ie. student1)

-**Linux / Patching** - Use this job to apply updates or audit for missing updates and produce an html report of systems with missing updates. See the end of the job for the URL to view the report. In other environments this report could be uploaded to a wiki, email, other system. This demo also shows installing a webserver on a linux server. The report is places on the system defined by the `report_server` variable. By default, `report_server` is configured as `node1`. This may be overridden with `extra_vars` on the Job Template.
+**Linux / Patching** - Use this job to apply updates or audit for missing updates and produce an html report of systems with missing updates. See the end of the job for the URL to view the report. In other environments this report could be uploaded to a wiki, email, other system. This demo also shows installing a webserver on a linux server. The report is places on the system defined by the `report_server` variable. By default, `report_server` is configured as `reports`. This may be overridden with `extra_vars` on the Job Template.

 **Linux / Run Shell Script** - Use this job to demonstrate running shell commands or an existing shell script across a group of systems as root. This can be preferred over using Ad-Hoc commands due to the ability to control usage with RBAC. This is helpful in showing the scalable of execution of an existing shell script. It is always recommended to convert shell scripts to playbooks over time. Example usage would be getting the public key used in the environment with the command `cat .ssh/authorized_keys`.

--- a/linux/compliance-enforce.yml
+++ b/linux/compliance-enforce.yml
@@ -12,5 +12,5 @@

    - name: Run Compliance Profile
      ansible.builtin.include_role:
-        name: "redhatofficial.rhel{{ ansible_distribution_major_version }}_{{ compliance_profile }}"
+        name: "redhatofficial.rhel{{ ansible_distribution_major_version }}-{{ compliance_profile }}"
 ...
--- a/linux/patching.yml
+++ b/linux/patching.yml
@@ -3,7 +3,7 @@
  hosts: "{{ _hosts | default(omit) }}"
  become: true
  vars:
-    report_server: node1
+    report_server: reports

  tasks:
    # Install yum-utils if it's not there
@@ -45,6 +45,16 @@
            name: firewalld
            state: started

+        - name: Enable firewall http service
+          ansible.posix.firewalld:
+            service: '{{ item }}'
+            state: enabled
+            immediate: true
+            permanent: true
+          loop:
+            - http
+            - https
+
        - name: Build report server
          ansible.builtin.include_role:
            name: "{{ item }}"
--- a/linux/setup.yml
+++ b/linux/setup.yml
@@ -36,7 +36,7 @@ controller_inventory_sources:
  - name: Insights Inventory
    inventory: Demo Inventory
    source: scm
-    source_project: Ansible official demo project
+    source_project: Ansible Product Demos
    source_path: linux/inventory.insights.yml
    credential: Insights Inventory

@@ -44,7 +44,7 @@ controller_templates:
  - name: "LINUX / Register with Insights"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/ec2_register.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -83,7 +83,7 @@ controller_templates:
  - name: "LINUX / Troubleshoot"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/tshoot.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -104,7 +104,7 @@ controller_templates:
  - name: "LINUX / Temporary Sudo"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/temp_sudo.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -133,7 +133,7 @@ controller_templates:
  - name: "LINUX / Patching"
    job_type: check
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/patching.yml"
    execution_environment: Default execution environment
    notification_templates_started: Telemetry
@@ -156,7 +156,7 @@ controller_templates:
  - name: "LINUX / Start Service"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/service_start.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -181,7 +181,7 @@ controller_templates:
  - name: "LINUX / Stop Service"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/service_stop.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -206,7 +206,7 @@ controller_templates:
  - name: "LINUX / Run Shell Script"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/run_script.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -228,7 +228,7 @@ controller_templates:
          required: true

  - name: "LINUX / Fact Scan"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: linux/fact_scan.yml
    inventory: Demo Inventory
    execution_environment: Default execution environment
@@ -251,7 +251,7 @@ controller_templates:
  - name: "LINUX / Podman Webserver"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/podman.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -276,7 +276,7 @@ controller_templates:
  - name: "LINUX / System Roles"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/system_roles.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -303,7 +303,7 @@ controller_templates:
  - name: "LINUX / Install Web Console (cockpit)"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/system_roles.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -337,7 +337,7 @@ controller_templates:
  - name: "LINUX / DISA STIG"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/compliance.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -359,7 +359,7 @@ controller_templates:
  - name: "LINUX / Multi-profile Compliance"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/compliance-enforce.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -377,6 +377,9 @@ controller_templates:
      # used by the CJIS profile role
      service_firewalld_enabled: false
      firewalld_sshd_port_enabled: false
+      # used by the PCI-DSS profile role
+      firewalld_loopback_traffic_restricted: false
+      firewalld_loopback_traffic_trusted: false
    survey_enabled: true
    survey:
      name: ''
@@ -396,13 +399,13 @@ controller_templates:
            - cui
            - hipaa
            - ospp
-            - pci_dss
+            - pci-dss
            - stig

  - name: "LINUX / Multi-profile Compliance Report"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/compliance-report.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -442,7 +445,7 @@ controller_templates:
  - name: "LINUX / Insights Compliance Scan"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/insights_compliance_scan.yml"
    credentials:
      - "Demo Credential"
@@ -467,7 +470,7 @@ controller_templates:
  - name: "LINUX / Deploy Application"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "linux/deploy_application.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
--- a/multi_select_setup.yml
+++ b/multi_select_setup.yml
@@ -4,15 +4,16 @@
  gather_facts: false
  vars:
    launch_jobs:
-      name: "SETUP"
+      name: "Product Demos | Single demo setup"
      wait: true
  tasks:
    - name: Build controller launch jobs
      ansible.builtin.set_fact:
-        controller_launch_jobs: "{{ (controller_launch_jobs | d([]))
-        + [launch_jobs | combine( {'extra_vars': { 'demo':  item }})] }}"
+        controller_launch_jobs: "{{ (controller_launch_jobs | d([])) + [launch_jobs | combine({'extra_vars': {'demo': item}})] }}"
      loop: "{{ demos }}"

    - name: Default Components
      ansible.builtin.include_role:
        name: "infra.controller_configuration.job_launch"
+      vars:
+        controller_dependency_check: false  # noqa: var-naming[no-role-prefix]
--- a/network/README.md
+++ b/network/README.md
@@ -18,12 +18,15 @@ These demos leverage playbooks from a [git repo](https://github.com/nleiva/ansib

 ### Inventory

-These demos leverage "always-on" instances for Cisco IOS, IOSXR, and NXOS from [Cisco DevNet Sandboxes](https://developer.cisco.com/docs/sandbox/#!getting-started/always-on-sandboxes). These instances are shared and do not provide admin access but they are instantly avaible all the time meaning not setup time is required.
+These demos leverage "always-on" instances for Cisco IOS, IOSXR, and NXOS from [Cisco DevNet Sandboxes](https://developer.cisco.com/docs/sandbox/#!getting-started/always-on-sandboxes). These instances are shared and do not provide admin access but they are instantly avaible all the time meaning no setup time is required.

-A **`Network Inventory`** is created when setting up these demos and a dynamic source is added to populate the Always-On instances. Review the inventory file [here](https://github.com/nleiva/ansible-net-modules/blob/main/hosts).
+A **`Demo Inventory`** is created when setting up these demos and a dynamic source is added to populate the Always-On instances. Review the inventory file [here](https://github.com/nleiva/ansible-net-modules/blob/main/hosts).  Demo Inventory is the default inventory for **`Product Demos`**.

 ## Suggested Usage

+**NETWORK / Report** - Use this job to gather facts from Cisco Network devices and create a report with information about the device such as code version, along with configuration information about layers 1, 2, and 3.  This shows how Ansible can be used to gather facts and build reports.  Generating html pages is just one potential output.  This information can be used in a number of ways, such as integration with different network management tools.
+  - to run this you will first need to run the **`Deploy Cloud Stack in AWS`** job template to deploy the report server.  This will ask you for an SSH public key.  After running this playbook, you will need to add the SSH private key to the **`Demo Credential`** before you can run the report, so it can connect to the report server.
+
 **NETWORK / Configuration** - Use this job to execute different [Ansible Network Resource Modules](https://docs.ansible.com/ansible/latest/network/user_guide/network_resource_modules.html) to deploy golden configs. Below is a list of the different resources the can be configured with a link to their golden config.
  - [acls](https://github.com/nleiva/ansible-net-modules/blob/main/acls.cfg)
  - [banner](https://github.com/nleiva/ansible-net-modules/blob/main/banner.cfg)
@@ -36,3 +39,41 @@ A **`Network Inventory`** is created when setting up these demos and a dynamic s
  - [prefix_lists](https://github.com/nleiva/ansible-net-modules/blob/main/prefix_lists.cfg)
  - [snmp](https://github.com/nleiva/ansible-net-modules/blob/main/snmp.cfg)
  - [user](https://github.com/nleiva/ansible-net-modules/blob/main/user.cfg)
+
+**NETWORK / DISA STIG** - Use this job to run the DISA STIG role (in check mode) and show how Ansible can be used for configuration compliance of network devices.  Click into tasks to see what is changed for each compliance rule, i.e.:
+{
+  "changed": true,
+  "warnings": [
+    "To ensure idempotency and correct diff the input configuration lines should be similar to how they appear if present in the running configuration on device"
+  ],
+  "commands": [
+    "ip http max-connections 2"
+  ],
+  "updates": [
+    "ip http max-connections 2"
+  ],
+  "banners": {},
+  "invocation": {
+    "module_args": {
+      "defaults": true,
+      "lines": [
+        "ip http max-connections 2"
+      ],
+      "match": "line",
+      "replace": "line",
+      "multiline_delimiter": "@",
+      "backup": false,
+      "save_when": "never",
+      "src": null,
+      "parents": null,
+      "before": null,
+      "after": null,
+      "running_config": null,
+      "intended_config": null,
+      "backup_options": null,
+      "diff_against": null,
+      "diff_ignore_lines": null
+    }
+  },
+  "_ansible_no_log": false
+}
--- a/network/report.yml
+++ b/network/report.yml
@@ -20,22 +20,19 @@
        gather_network_resources: all
      when: ansible_network_os == 'cisco.nxos.nxos'

+    # TODO figure out why this keeps failing
    - name: Gather all network resource and minimal legacy facts [Cisco IOS XR]
+      ignore_errors: true  # noqa: ignore-errors
      cisco.iosxr.iosxr_facts:
        gather_subset: min
        gather_network_resources: all
      when: ansible_network_os == 'cisco.iosxr.iosxr'

-#   # The dig lookup requires the python 'dnspython' library
-#   - name: Resolve IP address
-#     ansible.builtin.set_fact:
-#       ansible_host: "{{ lookup('community.general.dig', inventory_hostname)}}"
-
 - name: Create network reports
  hosts: "{{ report_server }}"
  become: true
  vars:
-    report_server: node1
+    report_server: reports
    web_path: /var/www/html/reports/

  tasks:
--- a/network/setup.yml
+++ b/network/setup.yml
@@ -15,28 +15,21 @@ controller_projects:
    default_environment: Networking Execution Environment

 controller_inventories:
-  - name: Network Inventory
+  - name: Demo Inventory
    organization: Default

 controller_inventory_sources:
  - name: DevNet always-on sandboxes
    source: scm
-    inventory: Network Inventory
+    inventory: Demo Inventory
    overwrite: true
    source_project: Network Golden Configs
    source_path: hosts

-controller_hosts:
-  - name: node1
-    inventory: Network Inventory
-    variables:
-      ansible_user: rhel
-      ansible_host: node1
-
 controller_templates:
  - name: NETWORK / Configuration
    organization: Default
-    inventory: Network Inventory
+    inventory: Demo Inventory
    survey_enabled: true
    project: Network Golden Configs
    playbook: main.yml
@@ -70,8 +63,8 @@ controller_templates:
  - name: "NETWORK / Report"
    job_type: check
    organization: Default
-    inventory: Network Inventory
-    project: "Ansible official demo project"
+    inventory: Demo Inventory
+    project: "Ansible Product Demos"
    playbook: "network/report.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -99,8 +92,8 @@ controller_templates:
  - name: "NETWORK / DISA STIG"
    job_type: check
    organization: Default
-    inventory: Network Inventory
-    project: "Ansible official demo project"
+    inventory: Demo Inventory
+    project: "Ansible Product Demos"
    playbook: "network/compliance.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
--- a/openshift/README.md
+++ b/openshift/README.md
@@ -5,16 +5,45 @@
  - [Table of Contents](#table-of-contents)
  - [About These Demos](#about-these-demos)
    - [Jobs](#jobs)
-  - [Pre Setup](#pre-setup)
+  - [Suggested Usage](#suggested-usage)

 ## About These Demos
-This category of demos shows examples of openshift operations and management with Ansible Automation Platform. The list of demos can be found below. See the [Suggested Usage](#suggested-usage) section of this document for recommendations on how to best use these demos.
+This category of demos shows examples of OpenShift operations and management with Ansible Automation Platform. The list of demos can be found below. See the [Suggested Usage](#suggested-usage) section of this document for recommendations on how to best use these demos.

 ### Jobs
 - [**OpenShift / Dev Spaces**](devspaces.yml) - Install and deploy dev spaces on OCP cluster. After this job has run successfully, login to your OCP cluster, click the application icon (to the left of the bell icon in the top right) to access Dev Spaces
+- [**OpenShift / GitLab**](gitlab.yml) - Install and deploy GitLab on OCP.
+- [**OpenShift / EDA / Install Controller**](eda/install.yml) - Install and deploy EDA Controller instance using the AAP OpenShift operator.
+- [**OpenShift / CNV / Install Operator**](cnv/install.yml) - Install the Container Native Virtualization (CNV) operator and all its required dependencies.
+- **OpenShift / CNV / Infra Stack** - Workflow Job Template to build out infrastructure necessary to run jobs against VMs in OpenShift Virtualization.
+    - [**OpenShift / CNV / Create RHEL VM**](cnv/install.yml) - Install the Container Native Virtualization (CNV) operator and all its required dependencies.
+- **OpenShift / CNV / Patch CNV Workflow** - Workflow Job Template to snapshot and patch VMs deployed in OpenShift Virtualization.
+    - [**OpenShift / CNV / Create VM Snapshots**](cnv/snapshot.yml) - Create snapshot of VMs running in CNV.
+    - [**OpenShift / CNV / Patch**](cnv/patch.yml) - Patch VMs in OpenShift CNV, when run in `run` mode build out container native patching report and display link to the user.
+    - [**OpenShift / CNV / Restore Latest VM Snapshots**](cnv/snapshot.yml) - Restore VM in CNV to last snapshot.
+- [**OpenShift / CNV / Delete VM**](cnv/install.yml) - Deletes VMs in OpenShift CNV.

 ## Pre Setup
-This demo requires an OpenShift cluster to deploy to. If you do not have a cluster to use, one can be requested from [demo.redhat.com](https://demo.redhat.com).
- Search for the [Red Hat OpenShift Container Platform 4.12 Workshop](https://demo.redhat.com/catalog?item=babylon-catalog-prod/sandboxes-gpte.ocp412-wksp.prod&utm_source=webapp&utm_medium=share-link) item in the catalog and request with the number of users you would like for Dev Spaces.
- Login using the admin credentials provided. Click the `admin` username at the top right and select `Copy login command`.
- Authenticate and click `Display Token`. This information will be used to populate the OpenShift Credential after you run the setup.
+These demos require an OpenShift cluster to deploy to. Luckily the default Ansible Product Demos item from [demo.redhat.com](https://demo.redhat.com) includes an OpenShift cluster. Most of the jobs require an `OpenShift or Kubernetes API Bearer Token` credential in order to interact with OpenShift. When ordered from RHDP this credential is configured for the user.
+
+## Suggested Usage
+**OpenShift / EDA / Install Controller** - This job uses the `admin` Controller user's password to configure the EDA controller login of the same name. This job displays the created route after finished and takes roughly 2.5 minutes to run.
+
+**OpenShift / CNV /  Deploy Automation Hub and sync EEs and Collections** - A custom credential type is created for the use in this WJT, `Usable Hub Credential` and it must be filled out in order to pull content from console.redhat.com. This workflow takes roughly 30 minutes to run. This workflow includes the following Job Templates:
+- **OpenShift / Hub / Install Automation Hub** - This job does not require a hub credential
+
+- **OpenShift / Hub / Sync EE Registries** - The registries can be configured via `extra_vars` and conforms roughly to those described in [infra.ah_configuration.ah_ee_registry](https://console.redhat.com/ansible/automation-hub/repo/validated/infra/ah_configuration/content/module/ah_ee_registry/).
+
+- **OpenShift / Hub / Sync Collection Repositories** - The collections can be configured via `extra_vars` and conforms roughly to those described in [infra.ah_configuration.collection_repository_sync](https://console.redhat.com/ansible/automation-hub/repo/validated/infra/ah_configuration/content/role/collection_repository_sync/).
+
+**OpenShift / CNV / Install Operator** - This job takes no parameters, to ensure the CNV operator is fully operational it provisions a VM in CNV which is cleaned up upon success.
+
+**OpenShift / CNV / Infra Stack** - This workflow takes three parameters, SSH public key, RHEL activation key, and org ID. The SSH public key is placed as an SSH authorized key, thus in order to then authenticate to these VMs the `Machine Credential` `Demo Credential` must be configured with the private key pair associated with the SSH public key. The RHEL activation key and ID are to receive updates from the DNF repositories for the final patching job. This workflow includes the following Job Templates:
+- **OpenShift / CNV / Create RHEL VM** - creates a VM using OpenShift Virtualization
+**OpenShift / CNV / Patch CNV Workflow** - This workflow takes an ansible host string as a parameter, by default the hosts generated by APD in CNV are of the format `<namespace>-<vm name>`, for example `openshift-cnv-rhel9`. This workflow includes the following Job Templates:
+
+- **OpenShift / CNV / Create VM Snapshots** - Creates snapshots of VMs relevant to the workflow
+- **OpenShift / CNV / Patch** - Patches relevant VMs and generate patching report
+- **OpenShift / CNV / Restore Latest VM Snapshots** - restores VMs to their latest snapshot, for the workflow this is invoked upon failure of the patching job. The same host string is used by this job template as the others in the workflow.
+
+**OpenShift / CNV / Delete VM** - Delete VMs based on host string pattern, similar to the other CNV jobs.
--- a/openshift/cnv/provision.yml
+++ b/openshift/cnv/provision.yml
@@ -1,7 +1,12 @@
 ---
- name: De-Provision OCP-CNV VM
+- name: De-Provision OCP-CNV VMs
  hosts: localhost
  tasks:
+    - name: Show VM(s) we are about to make {{ instance_state }}
+      ansible.builtin.debug:
+        msg: "Setting the following hosts to {{ instance_state }}
+{{ lookup('ansible.builtin.inventory_hostnames', vm_host_string) | split(',') | difference(['localhost']) }}"
+
    - name: Define resources
      kubernetes.core.k8s:
        wait: true
@@ -10,23 +15,23 @@
          apiVersion: kubevirt.io/v1
          kind: VirtualMachine
          metadata:
-            name: "{{ vm_name }}"
+            name: "{{ item }}"
            namespace: "{{ vm_namespace }}"
            labels:
-              app: "{{ vm_name }}"
+              app: "{{ item }}"
              os.template.kubevirt.io/fedora36: 'true'
-              vm.kubevirt.io/name: "{{ vm_name }}"
+              vm.kubevirt.io/name: "{{ item }}"
          spec:
            dataVolumeTemplates:
              - apiVersion: cdi.kubevirt.io/v1beta1
                kind: DataVolume
                metadata:
                  creationTimestamp: null
-                  name: "{{ vm_name }}"
+                  name: "{{ item }}"
                spec:
                  sourceRef:
                    kind: DataSource
-                    name: "{{ os_version |default('rhel9') }}"
+                    name: "{{ os_version | default('rhel9') }}"
                    namespace: openshift-virtualization-os-images
                  storage:
                    resources:
@@ -41,7 +46,7 @@
                  vm.kubevirt.io/workload: server
                creationTimestamp: null
                labels:
-                  kubevirt.io/domain: "{{ vm_name }}"
+                  kubevirt.io/domain: "{{ item }}"
                  kubevirt.io/size: small
              spec:
                domain:
@@ -72,5 +77,6 @@
                terminationGracePeriodSeconds: 180
                volumes:
                  - dataVolume:
-                      name: "{{ vm_name }}"
+                      name: "{{ item }}"
                    name: rootdisk
+      loop: "{{ lookup('ansible.builtin.inventory_hostnames', vm_host_string) | regex_replace(vm_namespace + '-', '') | split(',') | difference(['localhost']) }}"
--- a/openshift/cnv/provision_rhel.yml
+++ b/openshift/cnv/provision_rhel.yml
@@ -94,3 +94,4 @@
        name: "{{ vm_name }}"
        namespace: "{{ vm_namespace }}"
        wait: true
+        wait_timeout: 240
--- a/openshift/cnv/snapshot.yml
+++ b/openshift/cnv/snapshot.yml
@@ -0,0 +1,9 @@
+---
+- name: Manage CNV snapshots
+  hosts: localhost
+  tasks:
+    - name: Include snapshot role
+      ansible.builtin.include_role:
+        name: "demo.openshift.snapshot"
+      vars:
+        snapshot_hosts: "{{ _hosts }}"
--- a/openshift/cnv/wait.yml
+++ b/openshift/cnv/wait.yml
@@ -6,7 +6,7 @@
    - name: Wait for
      ansible.builtin.wait_for:
        port: 22
-        host: '{{ (ansible_ssh_host|default(ansible_host))|default(inventory_hostname) }}'
+        host: '{{ (ansible_ssh_host | default(ansible_host)) | default(inventory_hostname) }}'
        search_regex: OpenSSH
        delay: 10
      retries: 10
--- a/openshift/eda/install.yml
+++ b/openshift/eda/install.yml
@@ -0,0 +1,8 @@
+---
+- name: Deploy EDA Controller attached to the same AAP
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: Include role
+      ansible.builtin.include_role:
+        name: demo.openshift.eda_controller
--- a/openshift/host_vars/localhost.yml
+++ b/openshift/host_vars/localhost.yml
@@ -1,2 +1,2 @@
 ---
-gitlab_chart_version: "8.0.1"
+gitlab_chart_version: "8.5.1"
--- a/openshift/inventory.kubevirt.yml
+++ b/openshift/inventory.kubevirt.yml
@@ -5,19 +5,19 @@ connections:
  - namespaces:
      - openshift-cnv
 compose:
-  ansible_user: "'cloud-user' if 'rhel' in annotations['vm.kubevirt.io/os']"
-  annotations: "annotations | ansible.utils.replace_keys(target=[
+  ansible_user: "'cloud-user' if 'rhel' in vmi_annotations['vm.kubevirt.io/os']"
+  vmi_annotations: "vmi_annotations | ansible.utils.replace_keys(target=[
                {'before':'vm.kubevirt.io/os', 'after':'os'},
                {'before':'vm.kubevirt.io/flavor', 'after':'flavor'},
                {'before':'vm.kubevirt.io/workload', 'after':'workload'},
                {'before':'kubevirt.io/vm-generation', 'after':'vm-generation'},
                {'before':'kubevirt.io/latest-observed-api-version', 'after':'latest-observed-api-version'},
                {'before':'kubevirt.io/storage-observed-api-version', 'after':'storage-observed-api-version' }] )"
-  labels: "labels | ansible.utils.replace_keys(target=[
+  labels: "vmi_labels | ansible.utils.replace_keys(target=[
                {'before':'kubevirt.io/nodeName', 'after':'nodeName'},
                {'before':'kubevirt.io/size', 'after':'size'},
                {'before':'kubevirt.io/domain', 'after':'domain' }] )"
 keyed_groups:
-  - key: annotations.os
+  - key: vmi_annotations.os
    prefix: "cnv"
    separator: "_"
--- a/openshift/setup.yml
+++ b/openshift/setup.yml
@@ -7,29 +7,6 @@ controller_components:
  - job_templates
  - workflow_job_templates

-controller_credential_types:
-  # Ideally, we would not need to use this and could just re-use the OCP credential for the inventory plugin
-  - name: OCPV inventory credential
-    kind: cloud
-    inputs:
-      fields:
-        - id: host
-          type: string
-          label: OpenShift or Kubernetes API Endpoint
-          secret: false
-        - id: bearer_token
-          type: string
-          label: API authentication bearer token
-          secret: true
-        - id: verify_ssl
-          type: boolean
-          label: Verify SSL
-    injectors:
-      env:
-        K8S_AUTH_HOST: "{% raw %}{  { host  }}{% endraw %}"
-        K8S_AUTH_API_KEY: "{% raw %}{  { bearer_token  }}{% endraw %}"
-        K8S_AUTH_VERIFY_SSL: "{% raw %}{  { verify_ssl  }}{% endraw %}"
-
 controller_credentials:
  - name: OpenShift Credential
    organization: Default
@@ -40,29 +17,34 @@ controller_credentials:
      bearer_token: CHANGEME
      verify_ssl: false

-  - name: OCP-V Inventory Credential
-    organization: Default
-    credential_type: OCPV inventory credential
-    state: exists
-    inputs:
-      host: CHANGEME
-      bearer_token: CHANGEME
-      verify_ssl: false
-
 controller_inventory_sources:
  - name: OpenShift CNV Inventory
    inventory: Demo Inventory
    source: scm
-    source_project: Ansible official demo project
+    source_project: Ansible Product Demos
    source_path: openshift/inventory.kubevirt.yml
-    credential: OCP-V Inventory Credential
-    update_on_launch: true
+    credential: OpenShift Credential
+    update_on_launch: false
+    overwrite: true

 controller_templates:
-  - name: OpenShift / CNV / Install
+  - name: OpenShift / EDA / Install Controller
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
+    playbook: "openshift/eda/install.yml"
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    survey_enabled: true
+    credentials:
+      - "OpenShift Credential"
+      - "Controller Credential"
+
+  - name: OpenShift / CNV / Install Operator
+    job_type: run
+    inventory: "Demo Inventory"
+    project: "Ansible Product Demos"
    playbook: "openshift/cnv/install.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -74,7 +56,7 @@ controller_templates:
  - name: OpenShift / CNV / Create RHEL VM
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "openshift/cnv/provision_rhel.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -115,24 +97,25 @@ controller_templates:
    credentials:
      - "OpenShift Credential"

-  - name: OpenShift / CNV / Delete VM
+  - name: OpenShift / CNV / Create VM Snapshots
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
-    playbook: "openshift/cnv/provision.yml"
+    project: "Ansible Product Demos"
+    playbook: "openshift/cnv/snapshot.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
    notification_templates_error: Telemetry
-    survey_enabled: true
    extra_vars:
-      state: absent
+      snapshot_operation: create
+    survey_enabled: true
    survey:
      name: ''
      description: ''
      spec:
-        - question_name: VM name
+        - question_name: Server Name or Pattern
          type: text
-          variable: vm_name
+          variable: _hosts
+          default: "openshift-cnv-rhel*"
          required: true
        - question_name: VM NameSpace
          type: text
@@ -142,10 +125,66 @@ controller_templates:
    credentials:
      - "OpenShift Credential"

-  - name: OpenShift / CNV / Patching
+  - name: OpenShift / CNV / Restore Latest VM Snapshots
+    job_type: run
+    inventory: "Demo Inventory"
+    project: "Ansible Product Demos"
+    playbook: "openshift/cnv/snapshot.yml"
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    extra_vars:
+      snapshot_operation: restore
+    survey_enabled: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: Server Name or Pattern
+          type: text
+          variable: _hosts
+          default: "openshift-cnv-rhel*"
+          required: true
+        - question_name: VM NameSpace
+          type: text
+          variable: vm_namespace
+          default: openshift-cnv
+          required: true
+    credentials:
+      - "OpenShift Credential"
+
+  - name: OpenShift / CNV / Delete VM
+    job_type: run
+    inventory: "Demo Inventory"
+    project: "Ansible Product Demos"
+    playbook: "openshift/cnv/delete.yml"
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    survey_enabled: true
+    extra_vars:
+      instance_state: absent
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: VM host string
+          type: text
+          variable: vm_host_string
+          required: true
+        - question_name: VM NameSpace
+          type: text
+          variable: vm_namespace
+          default: openshift-cnv
+          required: true
+
+    credentials:
+      - "OpenShift Credential"
+
+  - name: OpenShift / CNV / Patch
    job_type: check
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "openshift/cnv/patch.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -167,7 +206,7 @@ controller_templates:

  - name: OpenShift / CNV / Wait Hosts
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "openshift/cnv/wait.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -186,7 +225,7 @@ controller_templates:
  - name: OpenShift / Dev Spaces
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "openshift/devspaces.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -197,7 +236,7 @@ controller_templates:
  - name: OpenShift / GitLab
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "openshift/gitlab.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -229,6 +268,10 @@ controller_workflows:
          type: text
          variable: rh_subscription_org
          required: true
+        - question_name: Email
+          type: text
+          variable: email
+          required: true
    simplified_workflow_nodes:
      - identifier: Deploy RHEL8 VM
        unified_job_template: OpenShift / CNV / Create RHEL VM
@@ -254,3 +297,48 @@ controller_workflows:
        unified_job_template: 'SUBMIT FEEDBACK'
        extra_data:
          feedback: Failed to create CNV instance
+
+  - name: OpenShift / CNV / Patch CNV Workflow
+    description: A workflow to patch CNV instances with snapshot and restore on failure.
+    organization: Default
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    survey_enabled: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: Specify target hosts
+          type: text
+          variable: _hosts
+          required: true
+          default: "openshift-cnv-rhel*"
+    simplified_workflow_nodes:
+      - identifier: Project Sync
+        unified_job_template: Ansible Product Demos
+        success_nodes:
+          - Patch Instance
+      # We need to do an invnetory sync *after* creating snapshots, as turning VMs on/off changes their IP
+      - identifier: Inventory Sync
+        unified_job_template: OpenShift CNV Inventory
+        success_nodes:
+          - Patch Instance
+      - identifier: Take Snapshot
+        unified_job_template: OpenShift / CNV / Create VM Snapshots
+        success_nodes:
+          - Project Sync
+          - Inventory Sync
+      - identifier: Patch Instance
+        unified_job_template: OpenShift / CNV / Patch
+        job_type: run
+        failure_nodes:
+          - Restore from Snapshot
+      - identifier: Restore from Snapshot
+        unified_job_template: OpenShift / CNV / Restore Latest VM Snapshots
+        failure_nodes:
+          - Ticket - Restore Failed
+      - identifier: Ticket - Restore Failed
+        unified_job_template: 'SUBMIT FEEDBACK'
+        extra_data:
+          feedback: OpenShift / CNV / Patch CNV Workflow | Failed to restore CNV VM from snapshot
--- a/roles/requirements.yml
+++ b/roles/requirements.yml
@@ -1,46 +1,46 @@
 ---
 roles:
  # RHEL 7 compliance roles from ComplianceAsCode
-  - name: redhatofficial.rhel7_cis
-    version: 0.1.69
-  - name: redhatofficial.rhel7_cjis
-    version: 0.1.69
-  - name: redhatofficial.rhel7_cui
-    version: 0.1.67
-  - name: redhatofficial.rhel7_hipaa
-    version: 0.1.69
-  - name: redhatofficial.rhel7_ospp
-    version: 0.1.69
-  - name: redhatofficial.rhel7_pci_dss
-    version: 0.1.69
-  - name: redhatofficial.rhel7_stig
-    version: 0.1.69
+  - name: redhatofficial.rhel7-cis
+    version: 0.1.72
+  - name: redhatofficial.rhel7-cjis
+    version: 0.1.72
+  - name: redhatofficial.rhel7-cui
+    version: 0.1.72
+  - name: redhatofficial.rhel7-hipaa
+    version: 0.1.72
+  - name: redhatofficial.rhel7-ospp
+    version: 0.1.72
+  - name: redhatofficial.rhel7-pci-dss
+    version: 0.1.72
+  - name: redhatofficial.rhel7-stig
+    version: 0.1.72
  # RHEL 8 compliance roles from ComplianceAsCode
-  - name: redhatofficial.rhel8_cis
-    version: 0.1.69
-  - name: redhatofficial.rhel8_cjis
-    version: 0.1.69
-  - name: redhatofficial.rhel8_cui
-    version: 0.1.69
-  - name: redhatofficial.rhel8_hipaa
-    version: 0.1.69
-  - name: redhatofficial.rhel8_ospp
-    version: 0.1.69
-  - name: redhatofficial.rhel8_pci_dss
-    version: 0.1.69
-  - name: redhatofficial.rhel8_stig
-    version: 0.1.69
+  - name: redhatofficial.rhel8-cis
+    version: 0.1.72
+  - name: redhatofficial.rhel8-cjis
+    version: 0.1.72
+  - name: redhatofficial.rhel8-cui
+    version: 0.1.72
+  - name: redhatofficial.rhel8-hipaa
+    version: 0.1.72
+  - name: redhatofficial.rhel8-ospp
+    version: 0.1.72
+  - name: redhatofficial.rhel8-pci-dss
+    version: 0.1.72
+  - name: redhatofficial.rhel8-stig
+    version: 0.1.72
  # RHEL 9 compliance roles from ComplianceAsCode
-  - name: redhatofficial.rhel9_cis
-    version: 0.1.68
-  - name: redhatofficial.rhel9_cui
-    version: 0.1.64
-  - name: redhatofficial.rhel9_hipaa
-    version: 0.1.68
-  - name: redhatofficial.rhel9_ospp
-    version: 0.1.68
-  - name: redhatofficial.rhel9_pci_dss
-    version: 0.1.68
-  - name: redhatofficial.rhel9_stig
-    version: 0.1.64
+  - name: redhatofficial.rhel9-cis
+    version: 0.1.72
+  - name: redhatofficial.rhel9-cui
+    version: 0.1.72
+  - name: redhatofficial.rhel9-hipaa
+    version: 0.1.72
+  - name: redhatofficial.rhel9-ospp
+    version: 0.1.72
+  - name: redhatofficial.rhel9-pci-dss
+    version: 0.1.72
+  - name: redhatofficial.rhel9-stig
+    version: 0.1.72
 ...
--- a/satellite/setup.yml
+++ b/satellite/setup.yml
@@ -74,7 +74,7 @@ controller_inventory_sources:

 controller_templates:
  - name: LINUX / Register with Satellite
-    project: Ansible official demo project
+    project: Ansible Product Demos
    playbook: satellite/server_register.yml
    inventory: Demo Inventory
    notification_templates_started: Telemetry
@@ -104,7 +104,7 @@ controller_templates:
          required: true

  - name: LINUX / Compliance Scan with Satellite
-    project: Ansible official demo project
+    project: Ansible Product Demos
    playbook: satellite/server_openscap.yml
    inventory: Demo Inventory
    # execution_environment: Ansible Engine 2.9 execution environment
@@ -127,7 +127,7 @@ controller_templates:
          required: false

  - name: SATELLITE / Publish Content View Version
-    project: Ansible official demo project
+    project: Ansible Product Demos
    playbook: satellite/satellite_publish.yml
    inventory: Demo Inventory
    notification_templates_started: Telemetry
@@ -149,7 +149,7 @@ controller_templates:
          required: true

  - name: SATELLITE / Promote Content View Version
-    project: Ansible official demo project
+    project: Ansible Product Demos
    playbook: satellite/satellite_promote.yml
    inventory: Demo Inventory
    notification_templates_started: Telemetry
@@ -179,7 +179,7 @@ controller_templates:
          required: true

  - name: SETUP / Satellite
-    project: Ansible official demo project
+    project: Ansible Product Demos
    playbook: satellite/setup_satellite.yml
    inventory: Demo Inventory
    notification_templates_started: Telemetry
--- a/setup_demo.yml
+++ b/setup_demo.yml
@@ -1,63 +1,37 @@
 ---
- name: Setup demo
+- name: Setup common prerequisites
  hosts: localhost
  gather_facts: false
-  tasks:
-    - name: Default Components
-      ansible.builtin.include_role:
-        name: infra.controller_configuration.dispatch
-      vars:  # noqa var-naming[no-role-prefix]
-        controller_execution_environments:
-          - name: product-demos
-            image: quay.io/acme_corp/product-demos-ee:latest
-        controller_organizations:
-          - name: Default
-            default_environment: product-demos
-        controller_notifications:
-          - name: Telemetry
-            organization: Default
-            notification_type: webhook
-            notification_configuration:
-              url: https://script.google.com/macros/s/AKfycbzxUObvCJ6ZbzfJyicw4RvxlGE3AZdrK4AR5-TsedCYd7O-rtTOVjvsRvqyb3rx6B0g8g/exec
-              http_method: POST
-              headers: {}
-        controller_templates:
-          - name: "SUBMIT FEEDBACK"
-            job_type: run
-            inventory: "Demo Inventory"
-            project: "Ansible official demo project"
-            playbook: "feedback.yml"
-            execution_environment: Default execution environment
-            notification_templates_started: Telemetry
-            notification_templates_success: Telemetry
-            notification_templates_error: Telemetry
-            survey_enabled: true
-            survey:
-              name: ''
-              description: ''
-              spec:
-                - question_name: Name/Email/Contact
-                  type: text
-                  variable: email
-                  required: true
-                - question_name: Issue or Feedback
-                  type: textarea
-                  variable: feedback
-                  required: true
-        controller_settings:
-          - name: "SESSION_COOKIE_AGE"
-            value: 180000

+  # vars_files should be scoped to a play so variables defined in the
+  # files should not be available in subsequent plays, so certain
+  # resources won't be retried
+  vars_files:
+    - common/setup.yml
+
+  tasks:
    - name: Create reusable deployment ID
      ansible.builtin.set_fact:
        _deployment_id: '{{ lookup("ansible.builtin.password", "{{ playbook_dir }}/.deployment_id", chars=["ascii_lowercase", "digits"], length=5) }}'

-    - name: "Include configuration for {{ demo }}"
+    - name: Create common demo resources
+      ansible.builtin.include_role:
+        name: infra.controller_configuration.dispatch
+      vars:
+        controller_dependency_check: false  # noqa: var-naming[no-role-prefix]
+
+- name: Setup demo
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: Include configuration for {{ demo }}
      ansible.builtin.include_vars: "{{ demo }}/setup.yml"

    - name: Demo Components
      ansible.builtin.include_role:
-        name: "infra.controller_configuration.dispatch"
+        name: infra.controller_configuration.dispatch
+      vars:
+        controller_dependency_check: false  # noqa: var-naming[no-role-prefix]

    - name: Log Demo
      ansible.builtin.uri:
@@ -70,3 +44,5 @@
      ansible.builtin.debug:
        msg: "{{ user_message }}"
      when: user_message is defined
+
+...
--- a/tests/requirements.yml
+++ b/tests/requirements.yml
@@ -0,0 +1 @@
+../execution_environments/requirements.yml
--- a/windows/README.md
+++ b/windows/README.md
@@ -4,12 +4,17 @@
 - [Windows Demos](#windows-demos)
  - [Table of Contents](#table-of-contents)
  - [About These Demos](#about-these-demos)
+    - [Known Issues](#known-issues)
    - [Jobs](#jobs)
+    - [Workflows](#workflows)
  - [Suggested Usage](#suggested-usage)

 ## About These Demos
 This category of demos shows examples of Windows Server operations and management with Ansible Automation Platform. The list of demos can be found below. See the [Suggested Usage](#suggested-usage) section of this document for recommendations on how to best use these demos.

+### Known Issues
+We are currently investigating an intermittent connectivity issue related to the credentials for Windows hosts. If encountered, re-provision your demo environment. You can track the issue and related work [here](https://github.com/ansible/product-demos/issues/176).
+
 ### Jobs

 - [**WINDOWS / Install IIS**](install_iis.yml) - Install IIS feature with a configurable index.html
@@ -23,8 +28,13 @@ This category of demos shows examples of Windows Server operations and managemen
 - [**WINDOWS / Helpdesk new user portal**](helpdesk_new_user_portal.yml) - Create user in AD Domain
 - [**WINDOWS / Join Active Directory Domain**](join_ad_domain.yml) - Join computer to AD Domain

+### Workflows
+- [**Setup Active Directory Domain**](setup_domain_workflow.md) - A workflow to create a domain controller with two domain-joined Windows hosts
+
 ## Suggested Usage

+**Setup Active Directory Domain** - One-click domain setup, infrastructure included.
+
 **WINDOWS / Create Active Directory Domain** - This job can take some to complete. It is recommended to run ahead of time if you would like to demo creating a helpdesk user.

 **WINDOWS / Helpdesk new user portal** - This job is dependant on the Create Active Directory Domain completing before users can be created.
--- a/windows/backup.yml
+++ b/windows/backup.yml
@@ -1,7 +0,0 @@
---
- name: Rollback playbook
-  hosts: windows
-  tasks:
-    - name: "Rollback this step"
-      ansible.builtin.debug:
-        msg: "Rolling back this step"
--- a/windows/connect.yml
+++ b/windows/connect.yml
@@ -0,0 +1,15 @@
+---
+- name: Connectivity test
+  hosts: "{{ _hosts | default('os_windows') }}"
+  gather_facts: false
+
+  tasks:
+    - name: Wait 600 seconds for target connection to become reachable/usable
+      ansible.builtin.wait_for_connection:
+        connect_timeout: "{{ wait_for_timeout_sec | default(5) }}"
+        delay: "{{ wait_for_delay_sec | default(0) }}"
+        sleep: "{{ wait_for_sleep_sec | default(1) }}"
+        timeout: "{{ wait_for_timeout_sec | default(300) }}"
+
+    - name: Ping the windows host
+      ansible.windows.win_ping:
--- a/windows/create_ad_domain.yml
+++ b/windows/create_ad_domain.yml
@@ -9,18 +9,25 @@
        name: Administrator
        password: "{{ ansible_password }}"

+    - name: Update the hostname
+      ansible.windows.win_hostname:
+        name: "{{ inventory_hostname.split('.')[0] }}"
+
+    - name: Reboot to apply new hostname
+      ansible.windows.win_reboot:
+        reboot_timeout: 3600
+
    - name: Create new domain in a new forest on the target host
+      register: r_create_domain
      ansible.windows.win_domain:
        dns_domain_name: ansible.local
        safe_mode_password: "{{ lookup('community.general.random_string', min_lower=1, min_upper=1, min_special=1, min_numeric=1) }}"
-      notify:
-        - Reboot host
-        - Wait for AD services
-        - Reboot again
-        - Wait for AD services again

-    - name: Flush handlers
-      ansible.builtin.meta: flush_handlers
+    - name: Verify domain services running
+      # noqa no-handler
+      when: r_create_domain is changed
+      ansible.builtin.include_tasks:
+        file: tasks/domain_services_check.yml

    - name: Create some groups
      community.windows.win_domain_group:
@@ -48,28 +55,3 @@
          groups: "GroupC"
      retries: 5
      delay: 10
-
-  handlers:
-    - name: Reboot host
-      ansible.windows.win_reboot:
-        reboot_timeout: 3600
-
-    - name: Wait for AD services
-      community.windows.win_wait_for_process:
-        process_name_exact: Microsoft.ActiveDirectory.WebServices
-        pre_wait_delay: 60
-        state: present
-        timeout: 600
-        sleep: 10
-
-    - name: Reboot again
-      ansible.windows.win_reboot:
-        reboot_timeout: 3600
-
-    - name: Wait for AD services again
-      community.windows.win_wait_for_process:
-        process_name_exact: Microsoft.ActiveDirectory.WebServices
-        pre_wait_delay: 60
-        state: present
-        timeout: 600
-        sleep: 10
--- a/windows/join_ad_domain.yml
+++ b/windows/join_ad_domain.yml
@@ -4,22 +4,31 @@
  gather_facts: false

  tasks:
+    - name: Extract domain controller private ip
+      ansible.builtin.set_fact:
+        domain_controller_private_ip: "{{ hostvars[groups['purpose_domain_controller'][0]]['private_ip_address'] }}"
+
    - name: Set a single address on the adapter named Ethernet
      ansible.windows.win_dns_client:
        adapter_names: 'Ethernet*'
-        dns_servers: "{{ hostvars[domain_controller]['private_ip_address'] }}"
+        dns_servers: "{{ domain_controller_private_ip }}"

    - name: Ensure Demo OU exists
+      run_once: true
      delegate_to: "{{ domain_controller }}"
      community.windows.win_domain_ou:
        name: Demo
        state: present

+    - name: Update the hostname
+      ansible.windows.win_hostname:
+        name: "{{ inventory_hostname.split('.')[0] }}"
+
    - name: Join ansible.local domain
      register: r_domain_membership
      ansible.windows.win_domain_membership:
        dns_domain_name: ansible.local
-        hostname: "{{ inventory_hostname }}"
+        hostname: "{{ inventory_hostname.split('.')[0] }}"
        domain_admin_user: "{{ ansible_user }}@ansible.local"
        domain_admin_password: "{{ ansible_password }}"
        domain_ou_path: "OU=Demo,DC=ansible,DC=local"
--- a/windows/patching.yml
+++ b/windows/patching.yml
@@ -2,7 +2,7 @@
 - name: Windows updates
  hosts: "{{ _hosts | default('os_windows') }}"
  vars:
-    report_server: win1
+    report_server: aws_win1

  tasks:
    - name: Patch windows server
--- a/windows/rollback.yml
+++ b/windows/rollback.yml
@@ -0,0 +1,9 @@
+---
+- name: Rollback playbook
+  hosts: "{{ _hosts | default('os_windows') }}"
+  gather_facts: false
+
+  tasks:
+    - name: Rollback this step
+      ansible.builtin.debug:
+        msg: "{{ rollback_msg | default('rolling back this step') }}"
--- a/windows/setup.yml
+++ b/windows/setup.yml
@@ -12,7 +12,7 @@ controller_templates:
  - name: "WINDOWS / Install IIS"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "windows/install_iis.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -38,7 +38,7 @@ controller_templates:
    job_type: check
    ask_job_type_on_launch: true
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "windows/patching.yml"
    execution_environment: Default execution environment
    notification_templates_started: Telemetry
@@ -81,10 +81,56 @@ controller_templates:
            - 'Yes'
            - 'No'

+  - name: "WINDOWS / Rollback"
+    job_type: run
+    inventory: "Demo Inventory"
+    project: "Ansible Product Demos"
+    playbook: "windows/rollback.yml"
+    execution_environment: Default execution environment
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    credentials:
+      - "Demo Credential"
+    survey_enabled: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: Server Name or Pattern
+          type: text
+          variable: _hosts
+          required: false
+        - question_name: Rollback Message
+          type: text
+          variable: rollback_msg
+          required: false
+
+  - name: "WINDOWS / Test Connectivity"
+    job_type: run
+    inventory: "Demo Inventory"
+    project: "Ansible Product Demos"
+    playbook: "windows/connect.yml"
+    execution_environment: Default execution environment
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    credentials:
+      - "Demo Credential"
+    survey_enabled: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: Server Name or Pattern
+          type: text
+          variable: _hosts
+          required: false
+
  - name: "WINDOWS / Chocolatey install multiple"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "windows/windows_choco_multiple.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -104,7 +150,7 @@ controller_templates:
  - name: "WINDOWS / Chocolatey install specific"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "windows/windows_choco_specific.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -128,7 +174,7 @@ controller_templates:
  - name: "WINDOWS / Run PowerShell"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "windows/powershell.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -153,7 +199,7 @@ controller_templates:
  - name: "WINDOWS / Query Services"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "windows/powershell_script.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -181,7 +227,7 @@ controller_templates:
  - name: "WINDOWS / Configuring Password Requirements"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "windows/powershell_dsc.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -201,7 +247,7 @@ controller_templates:
  - name: "WINDOWS / AD / Create Domain"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "windows/create_ad_domain.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -221,7 +267,7 @@ controller_templates:
  - name: "WINDOWS / AD / Join Domain"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "windows/join_ad_domain.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -246,7 +292,7 @@ controller_templates:
  - name: "WINDOWS / AD / New User"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "windows/helpdesk_new_user_portal.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -290,7 +336,7 @@ controller_templates:
  - name: "WINDOWS / DISA STIG"
    job_type: run
    inventory: "Demo Inventory"
-    project: "Ansible official demo project"
+    project: "Ansible Product Demos"
    playbook: "windows/compliance.yml"
    notification_templates_started: Telemetry
    notification_templates_success: Telemetry
@@ -306,3 +352,142 @@ controller_templates:
          type: text
          variable: HOSTS
          required: false
+
+controller_workflows:
+  - name: Setup Active Directory Domain
+    description: A workflow to create a domain controller with two domain-joined Windows hosts.
+    organization: Default
+    notification_templates_started: Telemetry
+    notification_templates_success: Telemetry
+    notification_templates_error: Telemetry
+    extra_vars:
+      create_vm_aws_image_owners:
+        - amazon
+    survey_enabled: true
+    survey:
+      name: ''
+      description: ''
+      spec:
+        - question_name: AWS Region
+          type: multiplechoice
+          variable: create_vm_aws_region
+          required: true
+          default: us-east-2
+          choices:
+            - us-east-1
+            - us-east-2
+            - us-west-1
+            - us-west-2
+        - question_name: Keypair Public Key
+          type: textarea
+          variable: aws_public_key
+          required: true
+        # Create VM variables
+        - question_name: Owner
+          type: text
+          variable: create_vm_vm_owner
+          required: true
+        - question_name: Environment
+          type: multiplechoice
+          variable: create_vm_vm_environment
+          required: true
+          choices:
+            - Dev
+            - QA
+            - Prod
+        - question_name: Subnet
+          type: text
+          variable: create_vm_aws_vpc_subnet_name
+          required: true
+          default: aws-test-subnet
+        - question_name: Security Group
+          type: text
+          variable: create_vm_aws_securitygroup_name
+          required: true
+          default: aws-test-sg
+    simplified_workflow_nodes:
+      - identifier: Create Keypair
+        unified_job_template: Cloud / AWS / Create Keypair
+        success_nodes:
+          - Create VPC
+      - identifier: Create VPC
+        unified_job_template: Cloud / AWS / Create VPC
+        success_nodes:
+          - Create Domain Controller
+          - Create Computer (1)
+          - Create Computer (2)
+      - identifier: Create Domain Controller
+        unified_job_template: Cloud / AWS / Create VM
+        job_type: run
+        extra_data:
+          create_vm_vm_name: dc01.ansible.local
+          create_vm_vm_purpose: domain_controller
+          create_vm_vm_deployment: domain_ansible_local
+          vm_blueprint: windows_full
+        success_nodes:
+          - Inventory Sync
+      - identifier: Create Computer (1)
+        unified_job_template: Cloud / AWS / Create VM
+        job_type: run
+        extra_data:
+          create_vm_vm_name: winston.ansible.local
+          create_vm_vm_purpose: domain_computer
+          create_vm_vm_deployment: domain_ansible_local
+          vm_blueprint: windows_core
+        success_nodes:
+          - Inventory Sync
+      - identifier: Create Computer (2)
+        unified_job_template: Cloud / AWS / Create VM
+        job_type: run
+        extra_data:
+          create_vm_vm_name: winthrop.ansible.local
+          create_vm_vm_purpose: domain_computer
+          create_vm_vm_deployment: domain_ansible_local
+          vm_blueprint: windows_core
+        success_nodes:
+          - Inventory Sync
+      - identifier: Inventory Sync
+        unified_job_template: AWS Inventory
+        all_parents_must_converge: true
+        success_nodes:
+          - Test Connectivity
+      - identifier: Test Connectivity
+        unified_job_template: WINDOWS / Test Connectivity
+        job_type: run
+        extra_data:
+          _hosts: deployment_domain_ansible_local
+        failure_nodes:
+          - Cleanup Resources
+        success_nodes:
+          - Create Domain
+      - identifier: Create Domain
+        unified_job_template: WINDOWS / AD / Create Domain
+        job_type: run
+        extra_data:
+          _hosts: purpose_domain_controller
+        failure_nodes:
+          - Cleanup Resources
+        success_nodes:
+          - Join Domain
+      - identifier: Join Domain
+        unified_job_template: WINDOWS / AD / Join Domain
+        job_type: run
+        extra_data:
+          _hosts: purpose_domain_computer
+          domain_controller: dc01.ansible.local
+        failure_nodes:
+          - Cleanup Resources
+        success_nodes:
+          - PowerShell Validation
+      - identifier: Cleanup Resources
+        unified_job_template: WINDOWS / Rollback
+        job_type: run
+        extra_data:
+          _hosts: localhost
+          rollback_msg: "Domain setup failed. Cleaning up resources..."
+      - identifier: PowerShell Validation
+        unified_job_template: WINDOWS / Run PowerShell
+        job_type: run
+        extra_data:
+          _hosts: purpose_domain_controller
+          ps_script: "Get-ADComputer -Filter * | Select-Object -Property 'Name'"
--- a/windows/setup_domain_workflow.md
+++ b/windows/setup_domain_workflow.md
@@ -0,0 +1,27 @@
+# Setup Active Directory Domain
+
+A workflow to create a domain controller with two domain-joined Windows hosts.
+
+## The Workflow
+
+![Workflow Visualization](../.github/images/setup_domain_workflow.png)
+
+## Ansible Inventory
+
+There are additional groups created in the **Demo Inventory** for interacting with different components of the domain:
+
+- **deployment_domain_ansible_local**: all hosts in the domain
+- **purpose_domain_controller**: domain controller instances (1)
+- **purpose_domain_computer**: domain computers (2)
+
+![Inventory](../.github/images/setup_domain_workflow_inventory.png)
+
+## Domain (ansible.local)
+
+![Domain Topology](../.github/images/setup_domain_workflow_domain.png)
+
+## PowerShell Validation
+
+In the validation step, you can expect to see the following output based on querying AD computers:
+
+![Expected Output](../.github/images/setup_domain_final_state.png)
--- a/windows/tasks/domain_services_check.yml
+++ b/windows/tasks/domain_services_check.yml
@@ -0,0 +1,37 @@
+---
+- name: Initial services check
+  block:
+    - name: Initial reboot
+      ansible.windows.win_reboot:
+        reboot_timeout: 3600
+
+    - name: Wait for AD services
+      community.windows.win_wait_for_process:
+        process_name_exact: Microsoft.ActiveDirectory.WebServices
+        pre_wait_delay: 60
+        state: present
+        timeout: 600
+        sleep: 10
+  rescue:
+    - name: Note initial failure
+      ansible.builtin.debug:
+        msg: "Initial services check failed, rebooting again..."
+
+- name: Secondary services check
+  block:
+    - name: Reboot again
+      ansible.windows.win_reboot:
+        reboot_timeout: 3600
+
+    - name: Wait for AD services again
+      community.windows.win_wait_for_process:
+        process_name_exact: Microsoft.ActiveDirectory.WebServices
+        pre_wait_delay: 60
+        state: present
+        timeout: 600
+        sleep: 10
+  rescue:
+    - name: Note secondary failure
+      failed_when: true
+      ansible.builtin.debug:
+        msg: "Secondary services check failed, bailing out..."
Author	SHA1	Message	Date
willtome	c86bfd0a10	add playbook	2024-11-18 21:03:20 -05:00
Matthew Fernandez	3137ce1090	Add RHDP dependencies to APD EE definition (#203 )	2024-11-18 16:18:54 -05:00
Matthew Fernandez	5581e790f6	A few small bug fixes around OCP CNV demos (#202 )	2024-11-12 08:47:39 -07:00
Chris Edillon	90d28aabbe	Resolved firewalld issue on patch report server (#200 )	2024-11-11 15:04:03 -07:00
shebistar	b523a48b23	Update chart version for gitlab to 8.5.1 (#199 )	2024-11-11 11:02:47 -05:00
Matthew Fernandez	d085007b55	Update APD EE for use with AgnosticD (#198 )	2024-11-05 11:53:57 -05:00
Matthew Fernandez	c98732009c	update common to use new default EE (#197 )	2024-10-28 14:14:27 -06:00
Chris Edillon	0f1e4828a3	apply single-demo fix to multi-demo JT (#196 )	2024-10-28 13:35:06 -04:00
Chris Edillon	fbb6d95736	added 2.5 EE to build script (#195 )	2024-10-28 13:10:31 -04:00
Chris Edillon	1e266f457a	hotfix: disable controller_configuration check see https://github.com/redhat-cop/infra.aap_configuration/issues/942	2024-10-28 12:58:31 -04:00
Chris Edillon	fd9405ef02	Switch to the new product demos EE and bootstrap repo (#194 )	2024-10-28 11:58:30 -04:00
Chris Edillon	fe006bdb9e	Fix latest pre-commit errors (#189 )	2024-10-22 09:55:55 -04:00
Sean Cavanaugh	a257597a7d	Fix Cloud Report (#190 )	2024-09-24 09:28:42 -04:00
Chris Edillon	6c65b53ac9	added local build script for product demos EEs (#184 )	2024-09-23 15:15:53 -04:00
Todd Ruch	a359559cb2	Resolve issue #107 to restore network report demo (#175 ) Co-authored-by: Todd Ruch <truch@redhat.com> Co-authored-by: Chris Edillon <67980205+jce-redhat@users.noreply.github.com>	2024-09-18 11:27:11 -04:00
Zach LeBlanc	0c4030d932	Specify Windows image owner to prevent licensing error (#185 ) Closes #186	2024-09-18 11:11:31 -04:00
Matthew Fernandez	ae7f24e8a4	Updating openshift/README.md to include recently added demos (#183 ) Yay docs	2024-09-09 12:37:04 -06:00
Chris Edillon	c192aa2c55	Fixed linting issues causing GitHub action failures (#180 )	2024-08-30 10:51:28 -04:00
Matthew Fernandez	28eb5be812	Adding a workflow to patch CNV instances with snapshot and restore on failure. (#171 )	2024-08-29 15:34:43 -04:00
Zach LeBlanc	8a99b66adc	Workflow to setup Windows Domain with DC and hosts (#168 ) Co-authored-by: willtome <wtome@redhat.com> Co-authored-by: Chris Edillon <67980205+jce-redhat@users.noreply.github.com>	2024-08-29 14:15:40 -04:00
Chris Edillon	035f815486	Added set_stats example to cloud workflow (#173 )	2024-08-27 09:46:35 -04:00
Chris Edillon	552acdcb6c	Updated versions of compliance-related roles (#170 )	2024-08-20 13:30:48 -04:00
Chris Edillon	40515ac65b	Create common prerequisites configuration (#169 )	2024-08-16 14:07:59 -04:00
Todd Ruch	70d7c46604	Resolves NETWORK / DISA STIG job logging error (#164 )	2024-08-12 15:18:11 -04:00
Chris Edillon	7455e7fa70	Removed release process from contributor guidelines (#167 )	2024-08-12 15:11:51 -04:00
Matthew Fernandez	d80cc0ac7a	Fix 'Delete VM' JT to actually delete VMs and remove unnecessary CNV … (#162 )	2024-08-05 15:04:33 -04:00
Chris Edillon	120fe3068f	Update pre-commit actions to latest versions (#159 )	2024-07-22 15:35:35 -04:00
Matthew Fernandez	0babde7960	Add EDA Controller Job template (#155 ) Co-authored-by: Chris Edillon <67980205+jce-redhat@users.noreply.github.com>	2024-07-22 15:34:57 -04:00
Matthew Fernandez	4588ef9892	Fix ocp-v inventory to match changes upstream (#157 )	2024-07-22 15:33:29 -04:00
Chris Edillon	19de077c3b	create report server instance (#153 )	2024-07-18 14:45:57 -04:00
Matthew Fernandez	716f2fa74b	add some small fixes (#156 )	2024-06-25 12:55:29 -06:00
				`@@ -0,0 +1 @@`
				`openshift-clients-4.16.0-202408021139.p0.ge8fb3c0.assembly.stream.el9.x86_64.rpm filter=lfs diff=lfs merge=lfs -text`