rpms/rhel-system-roles
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS rhel-system-roles-1.22.0-1.el8

Browse Source
This commit is contained in:
eabdullin 2023-09-27 14:06:49 +00:00
parent 7a2769efa4
commit 7880c2f408
9 changed files with 631 additions and 244 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
.gitignore vendored
View File

@ -1,27 +1,31 @@
SOURCES/ad_integration-1.0.2.tar.gz SOURCES/ad_integration-1.1.3.tar.gz
SOURCES/ansible-posix-1.5.1.tar.gz SOURCES/ansible-posix-1.5.4.tar.gz
SOURCES/ansible-sshd-v0.18.1.tar.gz SOURCES/ansible-sshd-v0.19.0.tar.gz
SOURCES/auto-maintenance-d6a8e0167e9ed8d089093b7ead1e298241b534e1.tar.gz SOURCES/auto-maintenance-e010c878833e363195dd707d1334ff48a254b092.tar.gz
SOURCES/certificate-1.1.9.tar.gz SOURCES/certificate-1.2.1.tar.gz
SOURCES/cockpit-1.4.3.tar.gz SOURCES/cockpit-1.4.7.tar.gz
SOURCES/community-general-6.3.0.tar.gz SOURCES/community-general-7.3.0.tar.gz
SOURCES/containers-podman-1.10.1.tar.gz SOURCES/containers-podman-1.10.3.tar.gz
SOURCES/crypto_policies-1.2.7.tar.gz SOURCES/crypto_policies-1.2.11.tar.gz
SOURCES/firewall-1.4.2.tar.gz SOURCES/firewall-1.6.3.tar.gz
SOURCES/ha_cluster-1.8.7.tar.gz SOURCES/ha_cluster-1.10.0.tar.gz
SOURCES/journald-1.0.0.tar.gz SOURCES/journald-1.0.5.tar.gz
SOURCES/kdump-1.2.6.tar.gz SOURCES/kdump-1.3.6.tar.gz
SOURCES/kernel_settings-1.1.11.tar.gz SOURCES/kernel_settings-1.1.17.tar.gz
SOURCES/logging-1.11.5.tar.gz SOURCES/keylime_server-1.0.0.tar.gz
SOURCES/metrics-1.8.1.tar.gz SOURCES/logging-1.11.9.tar.gz
SOURCES/nbde_client-1.2.10.tar.gz SOURCES/metrics-1.8.6.tar.gz
SOURCES/nbde_server-1.3.3.tar.gz SOURCES/nbde_client-1.2.14.tar.gz
SOURCES/network-1.11.2.tar.gz SOURCES/nbde_server-1.3.8.tar.gz
SOURCES/podman-1.1.2.tar.gz SOURCES/network-1.13.1.tar.gz
SOURCES/postfix-1.3.3.tar.gz SOURCES/podman-1.3.2.tar.gz
SOURCES/selinux-1.5.6.tar.gz SOURCES/postfix-1.3.8.tar.gz
SOURCES/ssh-1.1.12.tar.gz SOURCES/postgresql-1.1.0.tar.gz
SOURCES/storage-1.9.6.tar.gz SOURCES/rhc-1.2.4.tar.gz
SOURCES/timesync-1.7.2.tar.gz SOURCES/selinux-1.6.1.tar.gz
SOURCES/tlog-1.2.11.tar.gz SOURCES/ssh-1.2.1.tar.gz
SOURCES/vpn-1.5.3.tar.gz SOURCES/storage-1.12.3.tar.gz
SOURCES/systemd-1.0.1.tar.gz
SOURCES/timesync-1.7.6.tar.gz
SOURCES/tlog-1.2.16.tar.gz
SOURCES/vpn-1.5.8.tar.gz

58
.rhel-system-roles.metadata
View File

@ -1,27 +1,31 @@
c531e83edf95f96389a6c1c10ea80ccd2b42cc75 SOURCES/ad_integration-1.0.2.tar.gz 4ed72d2549af3a2bf5232944dcd84c4203ec1f49 SOURCES/ad_integration-1.1.3.tar.gz
f36cb7b1662ecda55c27f5bc15e0a22a1f11a361 SOURCES/ansible-posix-1.5.1.tar.gz da646eb9ba655f1693cc950ecb5c24af39ee1af6 SOURCES/ansible-posix-1.5.4.tar.gz
71c988d6ad9b916727cd93b8e2a2154183f5035a SOURCES/ansible-sshd-v0.18.1.tar.gz edcfa5243b2e74c50ab8fd17f514bbc9df693c06 SOURCES/ansible-sshd-v0.19.0.tar.gz
a59d5ba01d5e536e800bc847528f16c16b961375 SOURCES/auto-maintenance-d6a8e0167e9ed8d089093b7ead1e298241b534e1.tar.gz 7b34305ca31a8df71f3ecec3410c7c4d262201bd SOURCES/auto-maintenance-e010c878833e363195dd707d1334ff48a254b092.tar.gz
0e3826af628625ef7b16e3f57b6156128fd982c0 SOURCES/certificate-1.1.9.tar.gz 4483962040f0c29fa9c80950dc403ce7e9f17ed7 SOURCES/certificate-1.2.1.tar.gz
05148744a2d69d469dc3c678bb1a9fb9747dea26 SOURCES/cockpit-1.4.3.tar.gz 4ed2794a781e7976ff2a0b4c6abbf008859ef982 SOURCES/cockpit-1.4.7.tar.gz
b97ec0ef0ff1390c137323192527129159b7c76f SOURCES/community-general-6.3.0.tar.gz ee7868c57b3d1ce170b61a1d42c840ba1428aeac SOURCES/community-general-7.3.0.tar.gz
ccb070885fd455bb6e7f2b8ca050d40d30609fec SOURCES/containers-podman-1.10.1.tar.gz 711423c6503c1e137d7c38b6a0718e5768f40d21 SOURCES/containers-podman-1.10.3.tar.gz
47e3a2db8790c98fd5c09ab1887318b6ba56ce49 SOURCES/crypto_policies-1.2.7.tar.gz aee5eb307f5a40a8a222a0dd7713b230bc3324a7 SOURCES/crypto_policies-1.2.11.tar.gz
1c414411b4960040eebcef2ddd528eea0b47f05f SOURCES/firewall-1.4.2.tar.gz 81ac41f0c7d06dbb92d70b8d9a0a0b0a6474411c SOURCES/firewall-1.6.3.tar.gz
7cfd7d6fa2164fcb757a316e123cbe048f8f0ac9 SOURCES/ha_cluster-1.8.7.tar.gz aa11011e00fe8a86999688149d60f5d0a4ed5cbf SOURCES/ha_cluster-1.10.0.tar.gz
97edc58624de8ccb3f4b628a48811094a0dc1513 SOURCES/journald-1.0.0.tar.gz 88e721b5d804f00e7b044310d47b2dd40ac83f8f SOURCES/journald-1.0.5.tar.gz
439ea600c242c914c90933f287f3caf8c7869c12 SOURCES/kdump-1.2.6.tar.gz 64680ec0f3ea03fc5c0a5792ceeaa193d6154fdd SOURCES/kdump-1.3.6.tar.gz
49f4bc8f273339cde0cdecccffa7b902359b2601 SOURCES/kernel_settings-1.1.11.tar.gz 43338d3ffdc79961564504822a84462cefa8ff5a SOURCES/kernel_settings-1.1.17.tar.gz
7fe83b26f954e55a282a4d5398e3064a7783a83a SOURCES/logging-1.11.5.tar.gz 81b0e4e1f71f01a008181494eefc542506cd3823 SOURCES/keylime_server-1.0.0.tar.gz
e217af697b4e3205177360726f579d01b145be77 SOURCES/metrics-1.8.1.tar.gz 0963ecef1330048c25bb9a778b5ac15c24e77df2 SOURCES/logging-1.11.9.tar.gz
cf27267d3d54f1537ddda89f6d4db7abbe55b357 SOURCES/nbde_client-1.2.10.tar.gz af61299d39b4a7d5e37507a898ddba55e3f053d6 SOURCES/metrics-1.8.6.tar.gz
274986399c55eb35f281173621e75eb2d7ae00e6 SOURCES/nbde_server-1.3.3.tar.gz b8c7ff7dadbd84aeb13e94c4be3be0f8ee9549cd SOURCES/nbde_client-1.2.14.tar.gz
857b1c3ea5a1a48dc964fb5c139861ba01c9e732 SOURCES/network-1.11.2.tar.gz a5d2a5afd45447edb17f6a9615eabb80501e61f3 SOURCES/nbde_server-1.3.8.tar.gz
fe48a68775bcb87daf3f62ab58a1998ffaa4e6be SOURCES/podman-1.1.2.tar.gz fe9426eaf3e7a5a31ebe5707e4a17770bca7a6b6 SOURCES/network-1.13.1.tar.gz
9244301089661fecca31dfee431b32d4876063be SOURCES/postfix-1.3.3.tar.gz 8b49515b4c5d8b1f5e06be6c7fdeff7ab622c495 SOURCES/podman-1.3.2.tar.gz
bac983e0dcc5041a4c7d4d25849ed31aaf462df7 SOURCES/selinux-1.5.6.tar.gz b91070ba6fa7b4a9072aa2d1a2ef4b169aab0f00 SOURCES/postfix-1.3.8.tar.gz
1bb35bc413249ce3209e471687afd60e0e25dddb SOURCES/ssh-1.1.12.tar.gz 504cde6540ff1b5527b2ddf9aa90a95e29d7ffc3 SOURCES/postgresql-1.1.0.tar.gz
0eea1b45136cb807740fa12435b02eccdb35a7ac SOURCES/storage-1.9.6.tar.gz a6097168bd1b54a46be8b5f4adfdab9b5ec8ddb5 SOURCES/rhc-1.2.4.tar.gz
fefc5b4bd9635bb8fe70a9af9fc178cb5d3e8193 SOURCES/timesync-1.7.2.tar.gz bb2a5e711233e527d0a11914bd566f47a2cfe9e6 SOURCES/selinux-1.6.1.tar.gz
07c42ba749c110a87469a5c477579582c4d0c538 SOURCES/tlog-1.2.11.tar.gz c03dbda563ec7d3c2ae2c7bfd6aab88c6c19fbac SOURCES/ssh-1.2.1.tar.gz
5b5ee7283092a16e9ec1aba47ee651274f784416 SOURCES/vpn-1.5.3.tar.gz 84085e0f750181aee340e02258fd5888d563698e SOURCES/storage-1.12.3.tar.gz
1c7ac80df7288f7d3469e376316305eadd2dc2dc SOURCES/systemd-1.0.1.tar.gz
e4fe253906ffd7ce2ecca71a63a0e96e5f562e0c SOURCES/timesync-1.7.6.tar.gz
544d0591a0ae73b73c1ab5bc280cdc8d5598f322 SOURCES/tlog-1.2.16.tar.gz
1d959b0b5f6bd261d392b0740fd86915c7b35c17 SOURCES/vpn-1.5.8.tar.gz

127
SOURCES/0001-fix-use-command-stdin-for-password-and-do-not-log-pa.patch Normal file
View File

@ -0,0 +1,127 @@
From 1931ebccaa146bd6ee8365c664ab62d294adaa31 Mon Sep 17 00:00:00 2001
From: Rich Megginson <rmeggins@redhat.com>
Date: Fri, 18 Aug 2023 12:35:44 -0600
Subject: [PATCH] fix: use command stdin for password, and do not log password
Cause: The code was constructing the realm join command to be passed
via the shell module, including piping the password into the command,
and was showing the command, including the password, when using
check mode.
Consequence: The clear text password was available in the logs when
using check mode.
Fix: Use command with stdin for the password instead of shell. The
password is not part of the command. command with stdin is more
secure than using shell. The debug output has been changed to
show the command with the `ad_integration_join_parameters` removed,
because we cannot know if those parameters contain data which should
not be logged. Those parameters will still be passed to the actual
realm join command.
Result: The password is not logged. The role is more secure.
Signed-off-by: Rich Megginson <rmeggins@redhat.com>
---
tasks/main.yml | 57 ++++++++++++++++++++++++++++----------------------
1 file changed, 32 insertions(+), 25 deletions(-)
diff --git a/tasks/main.yml b/tasks/main.yml
index fe2602e..265c6fe 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -3,8 +3,7 @@
- name: Ensure that mandatory variable ad_integration_realm is available
fail:
msg: Variable ad_integration_realm must be provided!
- when:
- - not ad_integration_realm
+ when: not ad_integration_realm
- name: Assume managing timesync if timesource is set
set_fact:
@@ -26,8 +25,7 @@
- name: Assume managing crypto policies if allow_rc4_crypto is set
set_fact:
ad_integration_manage_crypto_policies: true
- when:
- - ad_integration_allow_rc4_crypto | bool
+ when: ad_integration_allow_rc4_crypto | bool
- name: Ensure manage_crypt_policies is set with crypto_allow_rc4
fail:
@@ -141,41 +139,50 @@
- name: Build Command - Join to a specific Domain Controller
set_fact:
- __ad_integration_join_command: |
- set -euo pipefail
- echo {{ ad_integration_password | quote }} | realm join -U \
- {{ ad_integration_user | quote }} --membership-software \
- {{ ad_integration_membership_software | quote }} \
- {{ ad_integration_join_parameters }} \
- {{ ad_integration_join_to_dc | quote }}
+ __ad_integration_join_command: >-
+ realm join -U {{ ad_integration_user | quote }} --membership-software
+ {{ ad_integration_membership_software | quote }}
+ {{ ad_integration_join_parameters }}
+ {{ ad_integration_join_to_dc | quote }}
+ __ad_integration_debug_command: >-
+ realm join -U {{ ad_integration_user | quote }} --membership-software
+ {{ ad_integration_membership_software | quote }}
+ {{ ad_integration_join_to_dc | quote }}
no_log: true
- when:
- - ad_integration_join_to_dc is not none
+ when: ad_integration_join_to_dc is not none
- name: Build Join Command - Perform discovery-based realm join operation
set_fact:
- __ad_integration_join_command: |
- set -euo pipefail
- echo {{ ad_integration_password | quote }} | realm join -U \
- {{ ad_integration_user | quote }} --membership-software \
- {{ ad_integration_membership_software | quote }} \
- {{ ad_integration_join_parameters }} \
- {{ ad_integration_realm | quote }}
+ __ad_integration_join_command: >-
+ realm join -U {{ ad_integration_user | quote }} --membership-software
+ {{ ad_integration_membership_software | quote }}
+ {{ ad_integration_join_parameters }}
+ {{ ad_integration_realm | quote }}
+ __ad_integration_debug_command: >-
+ realm join -U {{ ad_integration_user | quote }} --membership-software
+ {{ ad_integration_membership_software | quote }}
+ {{ ad_integration_realm | quote }}
no_log: true
- when:
- - ad_integration_join_to_dc is none
+ when: ad_integration_join_to_dc is none
- name: Show the join command for debug
debug:
- msg: "Would run: '{{ __ad_integration_join_command }}'"
+ msg:
+ - >-
+ Would run the following command. Note that
+ ad_integration_join_parameters have been removed for security purposes,
+ the role will pass them to the actual realm join command when running
+ without check mode.
+ - "{{ __ad_integration_debug_command }}"
when:
- ad_integration_join_to_dc == __ad_integration_sample_dc
or ad_integration_realm == __ad_integration_sample_realm
or ansible_check_mode
- name: Run realm join command
- # noqa command-instead-of-shell
- shell: "{{ __ad_integration_join_command }}"
+ command: "{{ __ad_integration_join_command }}"
+ args:
+ stdin: "{{ ad_integration_password }}"
no_log: true
when:
- ad_integration_join_to_dc != __ad_integration_sample_dc
--
2.41.0

66
SOURCES/CHANGELOG.md
View File

@ -1,7 +1,71 @@
Changelog Changelog
========= =========
[1.21.0-1] - 2023-02-20 [1.22.0] - 2023-08-15
----------------------------
### New Features
- [ALL - fingerprint in config files managed by roles](https://bugzilla.redhat.com/show_bug.cgi?id=2186910)
- [ad_integration - add ad_integration_force_rejoin](https://bugzilla.redhat.com/show_bug.cgi?id=2211723)
- [certificate - add mode parameter to change permissions for cert files](https://bugzilla.redhat.com/show_bug.cgi?id=2218204)
- [firewall - missing module in linux-system-roles.firewall to create an ipset](https://bugzilla.redhat.com/show_bug.cgi?id=2140880)
- [firewall - fix: reload on resetting to defaults](https://bugzilla.redhat.com/show_bug.cgi?id=2224648)
- [firewall - should have option to disable conflicting services](https://bugzilla.redhat.com/show_bug.cgi?id=2222809)
- [ha_cluster - Add possibility to load SBD watchdog kernel modules](https://bugzilla.redhat.com/show_bug.cgi?id=2190478)
- [ha_cluster - cluster and quorum can have distinct passwords](https://bugzilla.redhat.com/show_bug.cgi?id=2216485)
- [ha_cluster - support for resource and operation defaults](https://bugzilla.redhat.com/show_bug.cgi?id=2190483)
- [kdump - support auto_reset_crashkernel, dracut_args, deprecate /etc/sysconfig/kdump](https://bugzilla.redhat.com/show_bug.cgi?id=2211272)
- [keylime_server - system role for managing keylime servers](https://bugzilla.redhat.com/show_bug.cgi?id=2224387)
- [network - Support configuring auto-dns setting](https://bugzilla.redhat.com/show_bug.cgi?id=2211273)
- [network - Support no-aaaa DNS option](https://bugzilla.redhat.com/show_bug.cgi?id=2218595)
- [podman - allow container networking configuration](https://bugzilla.redhat.com/show_bug.cgi?id=2220963)
- [podman - support for healthchecks and healthcheck actions](https://bugzilla.redhat.com/show_bug.cgi?id=2220961)
- [podman - support quadlet units](https://bugzilla.redhat.com/show_bug.cgi?id=2220962)
- [postgresql - [RFE] system role for PostgreSQL management](https://bugzilla.redhat.com/show_bug.cgi?id=2151371)
- [rhc - implement rhc_proxy.scheme](https://bugzilla.redhat.com/show_bug.cgi?id=2211778)
- [rhc - [RFE] New role for Red Hat subscription management, insights management [rhel-8.9.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2179016)
- [ssh - add ssh_backup option with default true](https://bugzilla.redhat.com/show_bug.cgi?id=2216759)
- [storage - RFE for the storage system role to support configuring the stripe size for RAID LVM volumes](https://bugzilla.redhat.com/show_bug.cgi?id=2141961)
- [storage - [RFE] user-specified mount point owner and permissions](https://bugzilla.redhat.com/show_bug.cgi?id=2181661)
- [systemd - system role for managing systemd units](https://bugzilla.redhat.com/show_bug.cgi?id=2224388)
### Bug Fixes
- [ALL - facts being gathered unnecessarily](https://bugzilla.redhat.com/show_bug.cgi?id=2223036)
- [ad_integration - leaks credentials when in check_mode](https://bugzilla.redhat.com/show_bug.cgi?id=2233183)
- [certificate - rhel-system-roles.certificate does not re-issue after updating key_size](https://bugzilla.redhat.com/show_bug.cgi?id=2186057)
- [firewall - fix: reload on resetting to defaults](https://bugzilla.redhat.com/show_bug.cgi?id=2224648)
- [firewall - Check mode fails with replacing previous rules](https://issues.redhat.com/browse/RHEL-899)
- [firewall - Check mode fails when creating new firewall service](https://bugzilla.redhat.com/show_bug.cgi?id=2222433)
- [firewall - Ansible RHEL firewall system role not idempotent when configuring the interface using the role in rhel9](https://issues.redhat.com/browse/RHEL-918)
- [firewall - Don't install python(3)-firewall it's a dependency of firewalld](https://bugzilla.redhat.com/show_bug.cgi?id=2216521)
- [firewall - fix: files: overwrite firewalld.conf on previous replaced](https://issues.redhat.com/browse/RHEL-1496)
- [kdump - use failure_action instead of default on EL9 and later](https://issues.redhat.com/browse/RHEL-907)
- [kdump - role: "Write new authorized_keys if needed" task idempotency issues](https://bugzilla.redhat.com/show_bug.cgi?id=2232391)
- [kdump - system role fails if kdump_ssh_user doesn't have a .ssh/authorized_keys file in home directory](https://bugzilla.redhat.com/show_bug.cgi?id=2232392)
- [kdump - fix: ensure .ssh directory exists for kdump_ssh_user on kdump_ssh_server](https://issues.redhat.com/browse/RHEL-1398)
- [kdump - fix: Ensure authorized_keys management works with multiple hosts](https://issues.redhat.com/browse/RHEL-1500)
- [podman - Podman system role: Unable to use podman_registries_conf to set unqualified-search-registries](https://bugzilla.redhat.com/show_bug.cgi?id=2226077)
- [rhc - system role does not apply Insights tags](https://bugzilla.redhat.com/show_bug.cgi?id=2209441)
- [storage - Cannot set chunk size for RAID: Unsupported parameters for (blivet) module: pools.raid_chunk_size](https://bugzilla.redhat.com/show_bug.cgi?id=2193057)
- [storage - RAID volume pre cleanup - remove existing data from member disks as needed before creation](https://bugzilla.redhat.com/show_bug.cgi?id=2224094)
- [storage - Storage: mounted devices that are in use cannot be resized](https://bugzilla.redhat.com/show_bug.cgi?id=2168738)
- [storage - fix: use stat.pw_name, stat.gr_name instead of owner, group](https://issues.redhat.com/browse/RHEL-1498)
- [tlog - use the proxy provider - the files provider is deprecated in sssd](https://bugzilla.redhat.com/show_bug.cgi?id=2191702)
[1.21.1] - 2023-03-16
----------------------------
### New Features
- [rhc - New Role - Red Hat subscription management, insights management](https://bugzilla.redhat.com/show_bug.cgi?id=2144877)
### Bug Fixes
- none
[1.21.0] - 2023-02-20
---------------------------- ----------------------------
### New Features ### New Features

21
SOURCES/ansible-packaging.inc Normal file
View File

@ -0,0 +1,21 @@
# Helper macros originally from macros.ansible by Igor Raits <ignatenkobrain>
# This file is for maintaining the compatibility with macros and other
# functionality (generators) provided by ansible-packaging on Fedora.
Provides: ansible-collection(%{collection_namespace}.%{collection_name}) = %{collection_version}
# ansible-galaxy is available by ansible-core on RHEL 8.6 and newer at buildtime.
%define ansible_collection_build() ansible-galaxy collection build
%define ansible_collection_install() ansible-galaxy collection install -n -p %{buildroot}%{_datadir}/ansible/collections %{collection_namespace}-%{collection_name}-%{version}.tar.gz
%define ansible_roles_dir %{_datadir}/ansible/roles
%define ansible_collections_dir %{_datadir}/ansible/collections/ansible_collections
# TODO: Officially deprecate this macro and add the following line to the macro
# def after the new approach has gotten more testing and adoption:
# %%{warn: %%{ansible_collection_files} is deprecated. Use %%files -f %%{ansible_collection_filelist} instead.}
%define ansible_collection_files %{shrink:
%{ansible_collections_dir}/%{collection_namespace}/
}
%define ansible_collection_filelist %{__ansible_builddir}/ansible_collection_files

12
SOURCES/extrasources.inc
View File

@ -1,10 +1,10 @@
Source801: https://galaxy.ansible.com/download/ansible-posix-1.5.1.tar.gz Source801: https://galaxy.ansible.com/download/ansible-posix-1.5.4.tar.gz
Source901: https://galaxy.ansible.com/download/community-general-6.3.0.tar.gz Source901: https://galaxy.ansible.com/download/community-general-7.3.0.tar.gz
Source902: https://galaxy.ansible.com/download/containers-podman-1.10.1.tar.gz Source902: https://galaxy.ansible.com/download/containers-podman-1.10.3.tar.gz
Provides: bundled(ansible-collection(ansible.posix)) = 1.5.1 Provides: bundled(ansible-collection(ansible.posix)) = 1.5.4
Provides: bundled(ansible-collection(community.general)) = 6.3.0 Provides: bundled(ansible-collection(community.general)) = 7.3.0
Provides: bundled(ansible-collection(containers.podman)) = 1.10.1 Provides: bundled(ansible-collection(containers.podman)) = 1.10.3
Source996: CHANGELOG.rst Source996: CHANGELOG.rst
Source998: collection_readme.sh Source998: collection_readme.sh

104
SOURCES/vendoring-build.inc Normal file
View File

@ -0,0 +1,104 @@
# Unpack tar.gz to retrieve to be vendored modules and place them in the roles library.
# ansible.posix:
# - library:
# - Module selinux and seboolean for the selinux role
# - Module mount for the storage role
declare -A module_map=( ["selinux.py"]="selinux" ["seboolean.py"]="selinux" ["mount.py"]="storage" )
for module in "${!module_map[@]}"; do
role="${module_map[${module}]}"
if [ ! -d $role/library ]; then
mkdir $role/library
fi
cp -pL .external/ansible/posix/plugins/modules/$module $role/library/$module
sed -i -e ':a;N;$!ba;s/description:\n\( *\)/description:\n\1- WARNING: Do not use this module directly! It is only for role internal use.\n\1/' -e "s/ansible_collections.ansible.posix.plugins.module_utils/ansible.module_utils.${role}_lsr/" $role/library/$module
done
# ansible.posix:
# - module_utils:
# - Module_util mount for the storage role
module_map=( ["mount.py"]="storage" )
for module in "${!module_map[@]}"; do
role="${module_map[${module}]}"
if [ ! -d $role/module_utils/${role}_lsr ]; then
mkdir -p $role/module_utils/${role}_lsr
fi
cp -pL .external/ansible/posix/plugins/module_utils/$module $role/module_utils/${role}_lsr/$module
done
# community.general:
# - library:
# - Module seport, sefcontext and selogin for the selinux role rolename2
# - Module ini_file for role tlog
# - rhc modules
# - ha_cluster uses modprobe
module_map=( ["seport.py"]="selinux" ["sefcontext.py"]="selinux" ["selogin.py"]="selinux" ["ini_file.py"]="tlog"
["redhat_subscription.py"]="rhc" ["rhsm_release.py"]="rhc" ["rhsm_repository.py"]="rhc"
["modprobe.py"]="ha_cluster" )
for module in "${!module_map[@]}"; do
role="${module_map[${module}]}"
if [ ! -d $role/library ]; then
mkdir $role/library
fi
# version 5.x seems to be broken?
moduledir=.external/community/general/plugins/modules
if [ ! -f $moduledir/$module ]; then
moduledir=.external/community/general/plugins/modules/system
fi
if [ ! -f $moduledir/$module ]; then
moduledir=.external/community/general/plugins/modules/files
fi
cp -pL $moduledir/$module $role/library/$module
ls -alrtF $role/library/$module
sed -i -e ':a;N;$!ba;s/description:\n\( *\)/description:\n\1- WARNING: Do not use this module directly! It is only for role internal use.\n\1/' $role/library/$module
# Remove doc_fragments
sed -i '/^extends_documentation_fragment:/,/^[^ -]/{/^extends/d;/^[ -]/d}' $role/library/$module
done
# containers.podman:
# - library:
# - Module podman_container_info, podman_image and podman_play for the podman role
module_map=( ["podman_container_info.py"]="podman" ["podman_image.py"]="podman" ["podman_play.py"]="podman"
["podman_secret.py"]="podman" )
for module in "${!module_map[@]}"; do
role="${module_map[${module}]}"
if [ ! -d $role/library ]; then
mkdir $role/library
fi
moduledir=.external/containers/podman/plugins/modules
cp -pL $moduledir/$module $role/library/$module
ls -alrtF $role/library/$module
sed -i -e ':a;N;$!ba;s/description:\n\( *\)/description:\n\1- WARNING: Do not use this module directly! It is only for role internal use.\n\1/' \
-e "s/ansible_collections.containers.podman.plugins.module_utils.podman/ansible.module_utils.${role}_lsr/" \
$role/library/$module
done
# containers.podman:
# - module_utils:
# - Module_util common for the podman role
module_map=( ["common.py"]="podman" )
for module in "${!module_map[@]}"; do
role="${module_map[${module}]}"
if [ ! -d $role/module_utils/${role}_lsr ]; then
mkdir -p $role/module_utils/${role}_lsr
fi
cp -pL .external/containers/podman/plugins/module_utils/podman/$module $role/module_utils/${role}_lsr/$module
done
# remove the temporary .external directory after vendoring
rm -rf .external
# Replacing "linux-system-roles.rolename" with "rhel-system-roles.rolename" in each role
# Replacing "fedora.linux_system_roles." with "redhat.rhel_system_roles" in each role
# This is for the "roles calling other roles" case
# for podman, change the FQCN - using a non-FQCN module name doesn't seem to work,
# even for the legacy role format
# replace community.general for rhc
for rolename in %{rolenames}; do
find $rolename -type f -exec \
sed -e "s/linux-system-roles[.]${rolename}\\>/%{roleinstprefix}${rolename}/g" \
-e "s/fedora[.]linux_system_roles[.]/%{collection_namespace}.%{collection_name}./g" \
-e "s/containers[.]podman[.]/%{collection_namespace}.%{collection_name}./g" \
-e "s/community[.]general[.]/%{collection_namespace}.%{collection_name}./g" \
-i {} \;
done

12
SOURCES/vendoring-prep.inc Normal file
View File

@ -0,0 +1,12 @@
# Untar vendored collection tarballs to corresponding directories
for file in %{SOURCE801} %{SOURCE901} %{SOURCE902}; do
if [[ "$(basename $file)" =~ ([^-]+)-([^-]+)-(.+).tar.gz ]]; then
ns=${BASH_REMATCH[1]}
name=${BASH_REMATCH[2]}
ver=${BASH_REMATCH[3]}
mkdir -p .external/$ns/$name
pushd .external/$ns/$name > /dev/null
tar xfz "$file"
popd > /dev/null
fi
done

417
SPECS/rhel-system-roles.spec
View File

@ -1,15 +1,12 @@
# NOTE: Even though ansible-core is in 8.6, it is only available # NOTE: ansible-core is in rhel-8.6 and newer, but not installable
# at *runtime*, not at *buildtime* - so we can't have # in buildroot as it depended on modular Python.
# ansible-core as a build_dep on RHEL8 # It has been installable at buildtime in 8.8 and newer.
%if 0%{?fedora} || 0%{?rhel} >= 9
%bcond_without ansible
%if 0%{?fedora} %if 0%{?fedora}
BuildRequires: ansible-packaging BuildRequires: ansible-packaging
%else %else
%if 0%{?rhel} >= 8
BuildRequires: ansible-core >= 2.11.0 BuildRequires: ansible-core >= 2.11.0
%endif %endif
%else
%bcond_with ansible
%endif %endif
%bcond_with collection_artifact %bcond_with collection_artifact
@ -29,8 +26,8 @@ Name: linux-system-roles
%endif %endif
Url: https://github.com/linux-system-roles Url: https://github.com/linux-system-roles
Summary: Set of interfaces for unified system management Summary: Set of interfaces for unified system management
Version: 1.21.0 Version: 1.22.0
Release: 2%{?dist} Release: 1%{?dist}
License: GPLv3+ and MIT and BSD and Python License: GPLv3+ and MIT and BSD and Python
%global _pkglicensedir %{_licensedir}/%{name} %global _pkglicensedir %{_licensedir}/%{name}
@ -45,24 +42,6 @@ License: GPLv3+ and MIT and BSD and Python
%global collection_version %{version} %global collection_version %{version}
# Helper macros originally from macros.ansible by Igor Raits <ignatenkobrain>
# On RHEL, not available, so we must define those macros locally
# On Fedora, provided by ansible-packager
# Not used (yet). Could be made to point to AH in RHEL - but what about CentOS Stream?
#%%{!?ansible_collection_url:%%define ansible_collection_url() https://galaxy.ansible.com/%%{collection_namespace}/%%{collection_name}}
%if 0%{?rhel}
Provides: ansible-collection(%{collection_namespace}.%{collection_name}) = %{collection_version}
%global ansible_collection_files %{_datadir}/ansible/collections/ansible_collections/%{collection_namespace}/
%define ansible_roles_dir %{_datadir}/ansible/roles
%if %{without ansible}
# Untar and copy everything instead of galaxy-installing the built artifact when ansible is not available
%define ansible_collection_build() tar -cf %{_tmppath}/%{collection_namespace}-%{collection_name}-%{version}.tar.gz .
%define ansible_collection_install() mkdir -p %{buildroot}%{ansible_collection_files}%{collection_name}; (cd %{buildroot}%{ansible_collection_files}%{collection_name}; tar -xf %{_tmppath}/%{collection_namespace}-%{collection_name}-%{version}.tar.gz)
%else
%define ansible_collection_build() ansible-galaxy collection build
%define ansible_collection_install() ansible-galaxy collection install -n -p %{buildroot}%{_datadir}/ansible/collections %{collection_namespace}-%{collection_name}-%{version}.tar.gz
%endif
%endif
# be compatible with the usual Fedora Provides: # be compatible with the usual Fedora Provides:
Provides: ansible-collection-%{collection_namespace}-%{collection_name} = %{collection_version}-%{release} Provides: ansible-collection-%{collection_namespace}-%{collection_name} = %{collection_version}-%{release}
@ -107,83 +86,92 @@ Requires: (ansible-core >= 2.11.0 or ansible >= 2.9.0)
%%global rolestodir %%{?rolestodir} %%{roletodir%{1}} %%global rolestodir %%{?rolestodir} %%{roletodir%{1}}
} }
%global mainid d6a8e0167e9ed8d089093b7ead1e298241b534e1 %global mainid e010c878833e363195dd707d1334ff48a254b092
Source: %{url}/auto-maintenance/archive/%{mainid}/auto-maintenance-%{mainid}.tar.gz Source: %{url}/auto-maintenance/archive/%{mainid}/auto-maintenance-%{mainid}.tar.gz
# BEGIN AUTOGENERATED SOURCES # BEGIN AUTOGENERATED SOURCES
%global rolename1 postfix %global rolename1 postfix
%deftag 1 1.3.3 %deftag 1 1.3.8
%global rolename2 selinux %global rolename2 selinux
%deftag 2 1.5.6 %deftag 2 1.6.1
%global rolename3 timesync %global rolename3 timesync
%deftag 3 1.7.2 %deftag 3 1.7.6
%global rolename4 kdump %global rolename4 kdump
%deftag 4 1.2.6 %deftag 4 1.3.6
%global rolename5 network %global rolename5 network
%deftag 5 1.11.2 %deftag 5 1.13.1
%global rolename6 storage %global rolename6 storage
%deftag 6 1.9.6 %deftag 6 1.12.3
%global rolename7 metrics %global rolename7 metrics
%deftag 7 1.8.1 %deftag 7 1.8.6
%global rolename8 tlog %global rolename8 tlog
%deftag 8 1.2.11 %deftag 8 1.2.16
%global rolename9 kernel_settings %global rolename9 kernel_settings
%deftag 9 1.1.11 %deftag 9 1.1.17
%global rolename10 logging %global rolename10 logging
%deftag 10 1.11.5 %deftag 10 1.11.9
%global rolename11 nbde_server %global rolename11 nbde_server
%deftag 11 1.3.3 %deftag 11 1.3.8
%global rolename12 nbde_client %global rolename12 nbde_client
%deftag 12 1.2.10 %deftag 12 1.2.14
%global rolename13 certificate %global rolename13 certificate
%deftag 13 1.1.9 %deftag 13 1.2.1
%global rolename14 crypto_policies %global rolename14 crypto_policies
%deftag 14 1.2.7 %deftag 14 1.2.11
%global forgeorg15 https://github.com/willshersystems %global forgeorg15 https://github.com/willshersystems
%global repo15 ansible-sshd %global repo15 ansible-sshd
%global rolename15 sshd %global rolename15 sshd
%deftag 15 v0.18.1 %deftag 15 v0.19.0
%global rolename16 ssh %global rolename16 ssh
%deftag 16 1.1.12 %deftag 16 1.2.1
%global rolename17 ha_cluster %global rolename17 ha_cluster
%deftag 17 1.8.7 %deftag 17 1.10.0
%global rolename18 vpn %global rolename18 vpn
%deftag 18 1.5.3 %deftag 18 1.5.8
%global rolename19 firewall %global rolename19 firewall
%deftag 19 1.4.2 %deftag 19 1.6.3
%global rolename20 cockpit %global rolename20 cockpit
%deftag 20 1.4.3 %deftag 20 1.4.7
%global rolename21 podman %global rolename21 podman
%deftag 21 1.1.2 %deftag 21 1.3.2
%global rolename22 ad_integration %global rolename22 ad_integration
%deftag 22 1.0.2 %deftag 22 1.1.3
#%%global rolename23 rhc %global rolename23 rhc
#%%deftag 23 1.1.0 %deftag 23 1.2.4
%global rolename24 journald %global rolename24 journald
%deftag 24 1.0.0 %deftag 24 1.0.5
%global rolename25 postgresql
%deftag 25 1.1.0
%global rolename26 systemd
%deftag 26 1.0.1
%global rolename27 keylime_server
%deftag 27 1.0.0
Source1: %{archiveurl1} Source1: %{archiveurl1}
Source2: %{archiveurl2} Source2: %{archiveurl2}
@ -207,8 +195,11 @@ Source19: %{archiveurl19}
Source20: %{archiveurl20} Source20: %{archiveurl20}
Source21: %{archiveurl21} Source21: %{archiveurl21}
Source22: %{archiveurl22} Source22: %{archiveurl22}
#Source23: %{archiveurl23} Source23: %{archiveurl23}
Source24: %{archiveurl24} Source24: %{archiveurl24}
Source25: %{archiveurl25}
Source26: %{archiveurl26}
Source27: %{archiveurl27}
# END AUTOGENERATED SOURCES # END AUTOGENERATED SOURCES
# Includes with definitions/tags that differ between RHEL and Fedora # Includes with definitions/tags that differ between RHEL and Fedora
@ -216,8 +207,18 @@ Source1001: extrasources.inc
%include %{SOURCE1001} %include %{SOURCE1001}
# Includes with ansible_collection_build/_install that differ between RHEL versions
Source1002: ansible-packaging.inc
%include %{SOURCE1002}
Source1003: vendoring-prep.inc
Source1004: vendoring-build.inc
Source995: CHANGELOG.md Source995: CHANGELOG.md
Patch2201: 0001-fix-use-command-stdin-for-password-and-do-not-log-pa.patch
BuildArch: noarch BuildArch: noarch
%if %{with html} %if %{with html}
@ -234,6 +235,8 @@ BuildRequires: highlight
# Requirements for galaxy_transform.py # Requirements for galaxy_transform.py
BuildRequires: python3 BuildRequires: python3
BuildRequires: python%{python3_pkgversion}-ruamel-yaml BuildRequires: python%{python3_pkgversion}-ruamel-yaml
# Requirements for release_collection.py
BuildRequires: python3-setuptools
# We must put %%description within the if block to avoid empty lines showing up. # We must put %%description within the if block to avoid empty lines showing up.
%if 0%{?rhel} %if 0%{?rhel}
@ -275,24 +278,11 @@ end
%prep %prep
# BEGIN AUTOGENERATED SETUP # BEGIN AUTOGENERATED SETUP
#%%setup -q -a1 -a2 -a3 -a4 -a5 -a6 -a7 -a8 -a9 -a10 -a11 -a12 -a13 -a14 -a15 -a16 -a17 -a18 -a19 -a20 -a21 -a22 -a23 -a24 -n %{getarchivedir 0} %setup -q -a1 -a2 -a3 -a4 -a5 -a6 -a7 -a8 -a9 -a10 -a11 -a12 -a13 -a14 -a15 -a16 -a17 -a18 -a19 -a20 -a21 -a22 -a23 -a24 -a25 -a26 -a27 -n %{getarchivedir 0}
%setup -q -a1 -a2 -a3 -a4 -a5 -a6 -a7 -a8 -a9 -a10 -a11 -a12 -a13 -a14 -a15 -a16 -a17 -a18 -a19 -a20 -a21 -a22 -a24 -n %{getarchivedir 0}
# END AUTOGENERATED SETUP # END AUTOGENERATED SETUP
%if 0%{?rhel} # vendoring prep steps, if any
# Untar vendored collection tarballs to corresponding directories %include %{SOURCE1003}
for file in %{SOURCE801} %{SOURCE901} %{SOURCE902}; do
if [[ "$(basename $file)" =~ ([^-]+)-([^-]+)-(.+).tar.gz ]]; then
ns=${BASH_REMATCH[1]}
name=${BASH_REMATCH[2]}
ver=${BASH_REMATCH[3]}
mkdir -p .external/$ns/$name
pushd .external/$ns/$name > /dev/null
tar xfz "$file"
popd > /dev/null
fi
done
%endif
declare -A ROLESTODIR=(%{rolestodir}) declare -A ROLESTODIR=(%{rolestodir})
for rolename in %{rolenames}; do for rolename in %{rolenames}; do
@ -320,11 +310,12 @@ cd ../..
cd %{rolename15} cd %{rolename15}
find -P tests examples -name \*.yml | while read file; do find -P tests examples -name \*.yml | while read file; do
sed -r -i -e "s/ansible-sshd/linux-system-roles.sshd/" \ sed -r -i -e "s/willshersystems:ansible-sshd/system_role:sshd/" \
-e "s/ansible-sshd/linux-system-roles.sshd/" \
-e "s/ willshersystems.sshd/ linux-system-roles.sshd/" "$file" -e "s/ willshersystems.sshd/ linux-system-roles.sshd/" "$file"
done done
sed -r -i -e "s/ willshersystems.sshd/ linux-system-roles.sshd/" README.md sed -r -i -e "s/ willshersystems.sshd/ linux-system-roles.sshd/" README.md
sed -r -i -e "s/min_ansible_version: 2.8/min_ansible_version: 2.9/" meta/main.yml sed -r -i -e 's/min_ansible_version: 2.8/min_ansible_version: "2.9"/' meta/main.yml
cd .. cd ..
cd %{rolename7} cd %{rolename7}
@ -340,106 +331,12 @@ if [ "$rolesdir" != "$realrolesdir" ]; then
fi fi
cd .. cd ..
%if 0%{?rhel} cd %{rolename22}
# Unpack tar.gz to retrieve to be vendored modules and place them in the roles library. %patch2201 -p1
# ansible.posix: cd ..
# - library:
# - Module selinux and seboolean for the selinux role
# - Module mount for the storage role
declare -A module_map=( ["selinux.py"]="selinux" ["seboolean.py"]="selinux" ["mount.py"]="storage" )
for module in "${!module_map[@]}"; do
role="${module_map[${module}]}"
if [ ! -d $role/library ]; then
mkdir $role/library
fi
cp -pL .external/ansible/posix/plugins/modules/$module $role/library/$module
sed -i -e ':a;N;$!ba;s/description:\n\( *\)/description:\n\1- WARNING: Do not use this module directly! It is only for role internal use.\n\1/' -e "s/ansible_collections.ansible.posix.plugins.module_utils/ansible.module_utils.${role}_lsr/" $role/library/$module
done
# ansible.posix: # vendoring build steps, if any
# - module_utils: %include %{SOURCE1004}
# - Module_util mount for the storage role
module_map=( ["mount.py"]="storage" )
for module in "${!module_map[@]}"; do
role="${module_map[${module}]}"
if [ ! -d $role/module_utils/${role}_lsr ]; then
mkdir -p $role/module_utils/${role}_lsr
fi
cp -pL .external/ansible/posix/plugins/module_utils/$module $role/module_utils/${role}_lsr/$module
done
# community.general:
# - library:
# - Module seport, sefcontext and selogin for the selinux role rolename2
# - Module ini_file for role tlog
# - rhc modules
# ["redhat_subscription.py"]="rhc" ["rhsm_release.py"]="rhc" ["rhsm_repository.py"]="rhc" )
module_map=( ["seport.py"]="selinux" ["sefcontext.py"]="selinux" ["selogin.py"]="selinux" ["ini_file.py"]="tlog" )
for module in "${!module_map[@]}"; do
role="${module_map[${module}]}"
if [ ! -d $role/library ]; then
mkdir $role/library
fi
# version 5.x seems to be broken?
moduledir=.external/community/general/plugins/modules
if [ ! -f $moduledir/$module ]; then
moduledir=.external/community/general/plugins/modules/system
fi
if [ ! -f $moduledir/$module ]; then
moduledir=.external/community/general/plugins/modules/files
fi
cp -pL $moduledir/$module $role/library/$module
ls -alrtF $role/library/$module
sed -i -e ':a;N;$!ba;s/description:\n\( *\)/description:\n\1- WARNING: Do not use this module directly! It is only for role internal use.\n\1/' $role/library/$module
done
# containers.podman:
# - library:
# - Module podman_container_info, podman_image and podman_play for the podman role
module_map=( ["podman_container_info.py"]="podman" ["podman_image.py"]="podman" ["podman_play.py"]="podman" )
for module in "${!module_map[@]}"; do
role="${module_map[${module}]}"
if [ ! -d $role/library ]; then
mkdir $role/library
fi
moduledir=.external/containers/podman/plugins/modules
cp -pL $moduledir/$module $role/library/$module
ls -alrtF $role/library/$module
sed -i -e ':a;N;$!ba;s/description:\n\( *\)/description:\n\1- WARNING: Do not use this module directly! It is only for role internal use.\n\1/' \
-e "s/ansible_collections.containers.podman.plugins.module_utils.podman/ansible.module_utils.${role}_lsr/" \
$role/library/$module
done
# containers.podman:
# - module_utils:
# - Module_util common for the podman role
module_map=( ["common.py"]="podman" )
for module in "${!module_map[@]}"; do
role="${module_map[${module}]}"
if [ ! -d $role/module_utils/${role}_lsr ]; then
mkdir -p $role/module_utils/${role}_lsr
fi
cp -pL .external/containers/podman/plugins/module_utils/podman/$module $role/module_utils/${role}_lsr/$module
done
# remove the temporary .external directory after vendoring
rm -rf .external
# Replacing "linux-system-roles.rolename" with "rhel-system-roles.rolename" in each role
# Replacing "fedora.linux_system_roles." with "redhat.rhel_system_roles" in each role
# This is for the "roles calling other roles" case
# for podman, change the FQCN - using a non-FQCN module name doesn't seem to work,
# even for the legacy role format
# replace community.general for rhc
for rolename in %{rolenames}; do
find $rolename -type f -exec \
sed -e "s/linux-system-roles[.]${rolename}\\>/%{roleinstprefix}${rolename}/g" \
-e "s/fedora[.]linux_system_roles[.]/%{collection_namespace}.%{collection_name}./g" \
-e "s/containers[.]podman[.]/%{collection_namespace}.%{collection_name}./g" \
-e "s/community[.]general[.]/%{collection_namespace}.%{collection_name}./g" \
-i {} \;
done
%endif
# Removing symlinks in tests/roles # Removing symlinks in tests/roles
for rolename in %{rolenames}; do for rolename in %{rolenames}; do
@ -461,14 +358,36 @@ rm %{rolename5}/tests/ensure_provider_tests.py
# Drop storage tests/scripts # Drop storage tests/scripts
rm -rf %{rolename6}/tests/scripts rm -rf %{rolename6}/tests/scripts
# fix system_roles fingerprint in "external" roles
python3 lsr_fingerprint.py
# transform ambiguous #!/usr/bin/env python shebangs to python3 to stop brp-mangle-shebangs complaining # transform ambiguous #!/usr/bin/env python shebangs to python3 to stop brp-mangle-shebangs complaining
find -type f -executable -name '*.py' -exec \ find -type f -executable -name '*.py' -exec \
sed -i -r -e '1s@^(#! */usr/bin/env python)(\s|$)@#\13\2@' '{}' + sed -i -r -e '1s@^(#! */usr/bin/env python)(\s|$)@#\13\2@' '{}' +
%build %build
# remove upstream-only documentation - for example, documentation
# about collection dependencies is not needed in Fedora and EL RPMs
# since the dependencies are already provided
sed -e '/^## Requirements/,/^#/s/^See below$/None/' \
-e '/^### Collection requirements/,/^#/ {/^### Collection/d;/^#/!d}' \
-i */README.md
# sshd README is not in the same format
sed -e '/^### Optional requirements/,/^Role variables/ {/^### Optional/d;/^Role variables/!d}' \
-i sshd/README.md
%if %{with html} %if %{with html}
# HACK HACK HACK
# pandoc/asciidoc on rhel 8.9 does not like the journald README badge links
# remove all of the badge links from all README.md files
# in the first 14 lines of the file, remove any line that looks like a
# github action badge
# HACK HACK HACK
readmes="" readmes=""
matchstr="actions/workflows/"
for role in %{rolenames}; do for role in %{rolenames}; do
sed -e "1,14 {\\,${matchstr},d; /\!\[/d}" -i $role/README.md
readmes="${readmes} $role/README.md" readmes="${readmes} $role/README.md"
done done
sh md2html.sh $readmes sh md2html.sh $readmes
@ -478,7 +397,7 @@ mkdir .collections
%if 0%{?rhel} %if 0%{?rhel}
# Convert the upstream collection readme to the downstream one # Convert the upstream collection readme to the downstream one
%{SOURCE998} lsr_role2collection/collection_readme.md %{SOURCE998} lsr_role2collection/collection_readme.md
./galaxy_transform.py "%{collection_namespace}" "%{collection_name}" "%{collection_version}" \ %{python3} ./galaxy_transform.py "%{collection_namespace}" "%{collection_name}" "%{collection_version}" \
"Red Hat Enterprise Linux System Roles Ansible Collection" \ "Red Hat Enterprise Linux System Roles Ansible Collection" \
"https://linux-system-roles.github.io" \ "https://linux-system-roles.github.io" \
"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/administration_and_configuration_tasks_using_system_roles_in_rhel" \ "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/administration_and_configuration_tasks_using_system_roles_in_rhel" \
@ -511,7 +430,7 @@ extra_mapping="--extra-mapping fedora.linux_system_roles:%{collection_namespace}
%else %else
extra_mapping="" extra_mapping=""
%endif %endif
LANG=C.utf-8 LC_ALL=C.utf-8 python3 release_collection.py --galaxy-yml galaxy.yml \ LANG=C.utf-8 LC_ALL=C.utf-8 %{python3} release_collection.py --galaxy-yml galaxy.yml \
--src-path $(pwd) --dest-path $(pwd)/.collections $includes --force --no-update \ --src-path $(pwd) --dest-path $(pwd)/.collections $includes --force --no-update \
--src-owner %{name} --skip-git --skip-check --skip-changelog $extra_mapping --debug --src-owner %{name} --skip-git --skip-check --skip-changelog $extra_mapping --debug
@ -583,16 +502,20 @@ for role in %{rolenames}; do
"%{buildroot}%{_pkglicensedir}/$role.LICENSE" "%{buildroot}%{_pkglicensedir}/$role.LICENSE"
fi fi
if [ -d "%{buildroot}%{ansible_roles_dir}/%{roleinstprefix}$role/examples" ]; then if [ -d "%{buildroot}%{ansible_roles_dir}/%{roleinstprefix}$role/examples" ]; then
for file in "%{buildroot}%{ansible_roles_dir}/%{roleinstprefix}$role/examples/"*.yml ; do for file in "%{buildroot}%{ansible_roles_dir}/%{roleinstprefix}$role/examples/"* ; do
basename=$(basename "$file" .yml) if [[ "$file" == *.yml ]]; then
newname="$basename" basename=$(basename "$file" .yml)
if [[ "$newname" != example-* ]]; then newname="$basename"
newname="example-$newname" if [[ "$newname" != example-* ]]; then
newname="example-$newname"
fi
if [[ "$newname" != *-playbook ]]; then
newname="${newname}-playbook"
fi
cp "$file" "%{buildroot}%{_pkgdocdir}/$role/${newname}.yml"
else
cp "$file" "%{buildroot}%{_pkgdocdir}/$role"
fi fi
if [[ "$newname" != *-playbook ]]; then
newname="${newname}-playbook"
fi
cp "$file" "%{buildroot}%{_pkgdocdir}/$role/${newname}.yml"
rm "$file" rm "$file"
done done
if [ -f "%{buildroot}%{ansible_roles_dir}/%{roleinstprefix}$role/examples/inventory" ]; then if [ -f "%{buildroot}%{ansible_roles_dir}/%{roleinstprefix}$role/examples/inventory" ]; then
@ -606,7 +529,7 @@ for role in %{rolenames}; do
fi fi
done done
rm %{buildroot}%{ansible_roles_dir}/%{roleinstprefix}*/semaphore rm -f %{buildroot}%{ansible_roles_dir}/%{roleinstprefix}*/semaphore
rm -r %{buildroot}%{ansible_roles_dir}/%{roleinstprefix}*/molecule rm -r %{buildroot}%{ansible_roles_dir}/%{roleinstprefix}*/molecule
rm -r %{buildroot}%{ansible_roles_dir}/%{roleinstprefix}*/.[A-Za-z]* rm -r %{buildroot}%{ansible_roles_dir}/%{roleinstprefix}*/.[A-Za-z]*
@ -749,6 +672,134 @@ find %{buildroot}%{ansible_roles_dir} -mindepth 1 -maxdepth 1 | \
%endif %endif
%changelog %changelog
* Tue Aug 15 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-1
- Resolves:rhbz#2233183 : ad_integration - red hat "rhel system role" ad_integration leaks credentials when in check_mode
- Resolves:rhbz#2232391 : kdump - role: "Write new authorized_keys if needed" task idempotency issues
- Resolves:rhbz#2232392 : kdump - system role fails if kdump_ssh_user doesn't have a .ssh/authorized_keys file in home directory
- Resolves RHEL-1398 : kdump - fix: ensure .ssh directory exists for kdump_ssh_user on kdump_ssh_server
- Resolves RHEL-1500 : kdump - fix: Ensure authorized_keys management works with multiple hosts
- Resolves:rhbz#2224648 : firewall - fix: reload on resetting to defaults
- Resolves RHEL-1496 : firewall - fix: files: overwrite firewalld.conf on previous replaced
- Resolves RHEL-1498 : storage - fix: use stat.pw_name, stat.gr_name instead of owner, group
sshd README remove upstream only docs
first RC for 1.22.0 rhel 8.9 and 9.3
fix firewall reload test gather facts
* Thu Aug 10 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.21
- Resolves:rhbz#2220962 : podman - support quadlet units
support for rootless quadlets, secrets
* Wed Aug 09 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.20
- Resolves:rhbz#2140880 : firewall - missing module in linux-system-roles.firewall to create an ipset
* Tue Aug 01 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.19
- Resolves RHEL-866 : podman - use getsubids to look for subuid, subgid for IdM support
- Resolves RHEL-858 : podman - allow to not pull images, continue if image pull fails
- Resolves:rhbz#2224648 : firewall - fix: reload on resetting to defaults
- Resolves:rhbz#2226077 : podman - Podman system role: Unable to use podman_registries_conf to set unqualified-search-registries
- Resolves RHEL-918 : firewall - Ansible RHEL firewall system role not idempotent when configuring the interface using the role in rhel9
- Resolves RHEL-907 : kdump - use failure_action instead of default on EL9 and later
- Resolves RHEL-899 : firewall - Check mode fails with replacing previous rules
- Resolves:rhbz#2227823 : rhc - baseurl in rhsm.conf is empty when rhc_baseurl is not specified
* Wed Jul 26 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.18
- Resolves:rhbz#2224388 : systemd - system role for managing systemd units
* Tue Jul 25 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.17
- Resolves:rhbz#2224387 : keylime_server - system role for managing keylime servers
* Fri Jul 21 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.16
- Resolves:rhbz#2220963 : podman - allow container networking configuration
- Resolves:rhbz#2220961 : podman - support for healthchecks and healthcheck actions
- Resolves:rhbz#2220962 : podman - support quadlet units
- Resolves:rhbz#2224388 : systemd - system role for managing systemd units
- Resolves:rhbz#2223036 : ALL - facts being gathered unnecessarily
- Resolves:rhbz#2186057 : certificate - rhel-system-roles.certificate does not re-issue after updating key_size
- Resolves:rhbz#2222433 : firewall - Check mode fails when creating new firewall service
- Resolves:rhbz#2222809 : firewall - should have option to disable conflicting services
- Resolves:rhbz#2222808 : firewall - when firewalld.service is masked, firewall role fails
- Resolves:rhbz#2224094 : storage - RAID volume pre cleanup - remove existing data from member disks as needed before creation
* Mon Jul 10 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.15
- Resolves:rhbz#2218204 : certificate - add mode parameter to change permissions for cert files
- Resolves:rhbz#2218595 : network - Support no-aaaa DNS option
* Sun Jul 09 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.14
- Resolves:rhbz#2218899 : storage - [RHEL8] Unexpected behavior when creating ext4 filesystem with invalid parameter
* Fri Jun 23 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.13
- Resolves:rhbz#2216759 : ssh - add ssh_backup option with default true
- Resolves:rhbz#2216521 : firewall - Don't install python(3)-firewall it's a dependency of firewalld
* Thu Jun 22 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.12
- Resolves:rhbz#2168738 : storage - Storage: mounted devices that are in use cannot be resized
* Tue Jun 20 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.11
- Resolves:rhbz#2211272 : kdump - support auto_reset_crashkernel, dracut_args, deprecate /etc/sysconfig/kdump
* Wed Jun 07 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.10
- Resolves:rhbz#2211723 : ad_integration - add ad_integration_force_rejoin
* Tue Jun 06 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.9
- Resolves:rhbz#2211273 : network - Support configuring auto-dns setting
- Resolves:rhbz#2211778 : rhc - implement rhc_proxy.scheme
- Resolves:rhbz#2141961 : storage - RFE for the storage system role to support configuring the stripe size for RAID LVM volumes
- Resolves:rhbz#2211271 : selinux - use restorecon -T 0 on supported platforms
- Resolves:rhbz#2211247 : storage - Failed to commit changes to disk: Failed to format device: Input/output error
* Tue May 30 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.8
- Resolves:rhbz#2181661 : storage - [RFE] user-specified mount point owner and permissions
- Resolves:rhbz#2193057 : storage - Cannot set chunk size for RAID: Unsupported parameters for (blivet) module: pools.raid_chunk_size
- Resolves:rhbz#2211247 : storage - Failed to commit changes to disk: Failed to format device: Input/output error
* Tue May 23 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.7
- remove upstream only docs from README.md files
- python3-setuptools is now required for release_collection.py
- fix ruamel issue described at https://github.com/linux-system-roles/auto-maintenance/pull/272
- Resolves:rhbz#2209441 : rhc - system role does not apply Insights tags
- Resolves:rhbz#2191702 : tlog - use the proxy provider - the files provider is deprecated in sssd
- Resolves:rhbz#2190500 : roles should support running with gather_facts: false
- READMEs for all roles contain only downstream applicable docs
- All roles/tests now work with ansible-core 2.15
- Fix some roles to work with remove-cloud-init
* Thu May 04 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.6
- Resolves:rhbz#2186910 : fingerprint in config files managed by roles
- Resolves:rhbz#2190478 : ha_cluster - Add possibility to load SBD watchdog kernel modules
- Resolves:rhbz#2190483 : ha_cluster - support for resource and operation defaults
- Resolves:rhbz#2151371 : postgresql - [RFE] system role for PostgreSQL management
- Resolves:rhbz#2179016 : rhc - [RFE] New role for Red Hat subscription management, insights management [rhel-8.9.0]
- Resolves:rhbz#2190480 : ha_cluster - use pcs to setup qdevice certificates if available
- Resolves:rhbz#2186198 : spec: Remove doc fragments from vendored modules
- Resolves:rhbz#2190500 : roles should support running with gather_facts: false
- Resolves:rhbz#2175326 : use ansible-galaxy collection build/install instead of tar
- Resolves:rhbz#2186908 : rhc - RHC system role: activation key registration fails if system is already registered
- Resolves:rhbz#2190499 : selinux - failing test - sshd/tests_firewall_selinux.yml - No package matching 'firewalld' found available, installed or updated
* Wed May 3 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.5
- fix issue with postgresql tests
* Tue May 2 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.4
- fix issue with ha_cluster vendoring modprobe
- move vendoring into included files
* Thu Apr 27 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.3
- fix issues in some tests with ANSIBLE_GATHERING=explicit
- add testing for fingerprints in config files
- fix podman jinja 2.7 issue
- sshd - skip firewall testing if not supported
* Thu Apr 6 2023 Rich Megginson <rmeggins@redhat.com> - 1.22.0-0.2
- initial 8.9/9.3
* Thu Apr 6 2023 Sergei Petrosian <spetrosi@redhat.com> - 1.21.1-2
- Resolves: rhbz#2185002 : Remove doc fragments from vendored modules
- Build collection artifact in the same directory on Fedora and RHEL
* Thu Mar 16 2023 Rich Megginson <rmeggins@redhat.com> - 1.21.1-1
- Resolves:rhbz#2144877 : rhc - new role for subscription management/registration/insights
- includes the fix for tests_proxy.yml selinux and some test refactoring
* Wed Feb 22 2023 Rich Megginson <rmeggins@redhat.com> - 1.21.0-2 * Wed Feb 22 2023 Rich Megginson <rmeggins@redhat.com> - 1.21.0-2
- Resolves:rhbz#2144877 : rhc - new role for subscription management/registration/insights - Resolves:rhbz#2144877 : rhc - new role for subscription management/registration/insights
- remove role until https://bugzilla.redhat.com/show_bug.cgi?id=2171829 is fixed - remove role until https://bugzilla.redhat.com/show_bug.cgi?id=2171829 is fixed