.gitignore

@@ -1,28 +1,34 @@
-SOURCES/ad_integration-1.0.2.tar.gz
+SOURCES/ad_integration-1.4.6.tar.gz
-SOURCES/ansible-posix-1.5.1.tar.gz
+SOURCES/ansible-posix-1.5.4.tar.gz
-SOURCES/ansible-sshd-v0.18.1.tar.gz
+SOURCES/ansible-sshd-v0.25.0.tar.gz
-SOURCES/auto-maintenance-d6a8e0167e9ed8d089093b7ead1e298241b534e1.tar.gz
+SOURCES/auto-maintenance-11ad785c9bb72611244e7909450ca4247e12db4d.tar.gz
-SOURCES/certificate-1.1.9.tar.gz
+SOURCES/bootloader-1.0.7.tar.gz
-SOURCES/cockpit-1.4.3.tar.gz
+SOURCES/certificate-1.3.3.tar.gz
-SOURCES/community-general-6.4.0.tar.gz
+SOURCES/cockpit-1.5.10.tar.gz
-SOURCES/containers-podman-1.10.1.tar.gz
+SOURCES/community-general-8.3.0.tar.gz
-SOURCES/crypto_policies-1.2.7.tar.gz
+SOURCES/containers-podman-1.15.4.tar.gz
-SOURCES/firewall-1.4.2.tar.gz
+SOURCES/crypto_policies-1.3.2.tar.gz
-SOURCES/ha_cluster-1.8.7.tar.gz
+SOURCES/fapolicyd-1.1.1.tar.gz
-SOURCES/journald-1.0.0.tar.gz
+SOURCES/firewall-1.7.4.tar.gz
-SOURCES/kdump-1.2.6.tar.gz
+SOURCES/ha_cluster-1.14.0.tar.gz
-SOURCES/kernel_settings-1.1.11.tar.gz
+SOURCES/journald-1.2.3.tar.gz
-SOURCES/logging-1.11.5.tar.gz
+SOURCES/kdump-1.4.4.tar.gz
-SOURCES/metrics-1.8.1.tar.gz
+SOURCES/kernel_settings-1.2.2.tar.gz
-SOURCES/nbde_client-1.2.10.tar.gz
+SOURCES/keylime_server-1.1.2.tar.gz
-SOURCES/nbde_server-1.3.3.tar.gz
+SOURCES/logging-1.13.4.tar.gz
-SOURCES/network-1.11.2.tar.gz
+SOURCES/metrics-1.10.1.tar.gz
-SOURCES/podman-1.1.2.tar.gz
+SOURCES/nbde_client-1.3.0.tar.gz
-SOURCES/postfix-1.3.3.tar.gz
+SOURCES/nbde_server-1.4.3.tar.gz
-SOURCES/rhc-1.1.1.tar.gz
+SOURCES/network-1.15.1.tar.gz
-SOURCES/selinux-1.5.6.tar.gz
+SOURCES/podman-1.4.7.tar.gz
-SOURCES/ssh-1.1.12.tar.gz
+SOURCES/postfix-1.4.3.tar.gz
-SOURCES/storage-1.9.6.tar.gz
+SOURCES/postgresql-1.3.5.tar.gz
-SOURCES/timesync-1.7.2.tar.gz
+SOURCES/rhc-1.6.0.tar.gz
-SOURCES/tlog-1.2.11.tar.gz
+SOURCES/selinux-1.7.4.tar.gz
-SOURCES/vpn-1.5.3.tar.gz
+SOURCES/snapshot-1.3.1.tar.gz
+SOURCES/ssh-1.3.2.tar.gz
+SOURCES/storage-1.16.2.tar.gz
+SOURCES/systemd-1.1.2.tar.gz
+SOURCES/timesync-1.9.0.tar.gz
+SOURCES/tlog-1.3.3.tar.gz
+SOURCES/vpn-1.6.3.tar.gz

.rhel-system-roles.metadata

@@ -1,28 +1,34 @@
-c531e83edf95f96389a6c1c10ea80ccd2b42cc75 SOURCES/ad_integration-1.0.2.tar.gz
+11b58e43e1b78cb75eda26724359f4d748173d5f SOURCES/ad_integration-1.4.6.tar.gz
-f36cb7b1662ecda55c27f5bc15e0a22a1f11a361 SOURCES/ansible-posix-1.5.1.tar.gz
+da646eb9ba655f1693cc950ecb5c24af39ee1af6 SOURCES/ansible-posix-1.5.4.tar.gz
-71c988d6ad9b916727cd93b8e2a2154183f5035a SOURCES/ansible-sshd-v0.18.1.tar.gz
+5829f61d848d1fe52ecd1702c055eeed8ef56e70 SOURCES/ansible-sshd-v0.25.0.tar.gz
-a59d5ba01d5e536e800bc847528f16c16b961375 SOURCES/auto-maintenance-d6a8e0167e9ed8d089093b7ead1e298241b534e1.tar.gz
+e4df3548cf129b61c40b2d013917e07be2f3ba4e SOURCES/auto-maintenance-11ad785c9bb72611244e7909450ca4247e12db4d.tar.gz
-0e3826af628625ef7b16e3f57b6156128fd982c0 SOURCES/certificate-1.1.9.tar.gz
+7ae4b79529d14c0c8958cf9633f8d560d718f4e7 SOURCES/bootloader-1.0.7.tar.gz
-05148744a2d69d469dc3c678bb1a9fb9747dea26 SOURCES/cockpit-1.4.3.tar.gz
+9eaac83b306b2fb8dd8e82bc4b03b30285d2024f SOURCES/certificate-1.3.3.tar.gz
-687a4e36e9d8f73a8a44a448da1c205eb0ce5f1c SOURCES/community-general-6.4.0.tar.gz
+15677bec6ddafb75911d7c29fe1eb1c24b9b4f1c SOURCES/cockpit-1.5.10.tar.gz
-ccb070885fd455bb6e7f2b8ca050d40d30609fec SOURCES/containers-podman-1.10.1.tar.gz
+15fd2f2c08ae17cc47efb76bd14fb9ab6f33bc26 SOURCES/community-general-8.3.0.tar.gz
-47e3a2db8790c98fd5c09ab1887318b6ba56ce49 SOURCES/crypto_policies-1.2.7.tar.gz
+2c0a98aedb2c031bfc94609bc9553d192224b159 SOURCES/containers-podman-1.15.4.tar.gz
-1c414411b4960040eebcef2ddd528eea0b47f05f SOURCES/firewall-1.4.2.tar.gz
+6705818b1fdf3cc82083937265f7942e3d3ccc2d SOURCES/crypto_policies-1.3.2.tar.gz
-7cfd7d6fa2164fcb757a316e123cbe048f8f0ac9 SOURCES/ha_cluster-1.8.7.tar.gz
+29505121f6798f527045c5f66656fd5c19bed5fe SOURCES/fapolicyd-1.1.1.tar.gz
-97edc58624de8ccb3f4b628a48811094a0dc1513 SOURCES/journald-1.0.0.tar.gz
+1a7a875cebbd3e146f6ca554269ee20845cf877b SOURCES/firewall-1.7.4.tar.gz
-439ea600c242c914c90933f287f3caf8c7869c12 SOURCES/kdump-1.2.6.tar.gz
+53e8991ca7e0c5c97ab010e843bc1a7c4a98eb96 SOURCES/ha_cluster-1.14.0.tar.gz
-49f4bc8f273339cde0cdecccffa7b902359b2601 SOURCES/kernel_settings-1.1.11.tar.gz
+e96ba9f5b3ae08a12dbf072f118e316036553b94 SOURCES/journald-1.2.3.tar.gz
-7fe83b26f954e55a282a4d5398e3064a7783a83a SOURCES/logging-1.11.5.tar.gz
+de6c6103b7023aa21782906696e712b428600a92 SOURCES/kdump-1.4.4.tar.gz
-e217af697b4e3205177360726f579d01b145be77 SOURCES/metrics-1.8.1.tar.gz
+0f28a0919874f650ef0149409116bae12d2363e0 SOURCES/kernel_settings-1.2.2.tar.gz
-cf27267d3d54f1537ddda89f6d4db7abbe55b357 SOURCES/nbde_client-1.2.10.tar.gz
+85c14c7e260b247eb7947c8706af82ff5aac07d2 SOURCES/keylime_server-1.1.2.tar.gz
-274986399c55eb35f281173621e75eb2d7ae00e6 SOURCES/nbde_server-1.3.3.tar.gz
+4825923fc0fa29e80c08864b0afc50e2e075be91 SOURCES/logging-1.13.4.tar.gz
-857b1c3ea5a1a48dc964fb5c139861ba01c9e732 SOURCES/network-1.11.2.tar.gz
+e795238995d2dfb2cbdb5cc9bf4923f7410ac49a SOURCES/metrics-1.10.1.tar.gz
-fe48a68775bcb87daf3f62ab58a1998ffaa4e6be SOURCES/podman-1.1.2.tar.gz
+544c5c9e53beef034b0d39ecf944e0bb13231535 SOURCES/nbde_client-1.3.0.tar.gz
-9244301089661fecca31dfee431b32d4876063be SOURCES/postfix-1.3.3.tar.gz
+dce6435ca145b3143c1326a8e413e8173e5655ef SOURCES/nbde_server-1.4.3.tar.gz
-2340277be032405d0ed2be00ff3971837180c5cb SOURCES/rhc-1.1.3.tar.gz
+e89a4d6974a089f035b1f3fc79a1f9cacfa1f933 SOURCES/network-1.15.1.tar.gz
-bac983e0dcc5041a4c7d4d25849ed31aaf462df7 SOURCES/selinux-1.5.6.tar.gz
+fc242b6f776088720ef04e5891c75fd33e6e1e96 SOURCES/podman-1.4.7.tar.gz
-1bb35bc413249ce3209e471687afd60e0e25dddb SOURCES/ssh-1.1.12.tar.gz
+ddb7e2a575e4b96666ce13dbdbaea97cc2f83954 SOURCES/postfix-1.4.3.tar.gz
-0eea1b45136cb807740fa12435b02eccdb35a7ac SOURCES/storage-1.9.6.tar.gz
+bf0f12e78bfc2120d85c5458aa7d53b15738e73c SOURCES/postgresql-1.3.5.tar.gz
-fefc5b4bd9635bb8fe70a9af9fc178cb5d3e8193 SOURCES/timesync-1.7.2.tar.gz
+b519a4e35b55e97bf954916d77f1f1f82ec2615b SOURCES/rhc-1.6.0.tar.gz
-07c42ba749c110a87469a5c477579582c4d0c538 SOURCES/tlog-1.2.11.tar.gz
+458b076a73a1c3597485b60bc734b225f3079a86 SOURCES/selinux-1.7.4.tar.gz
-5b5ee7283092a16e9ec1aba47ee651274f784416 SOURCES/vpn-1.5.3.tar.gz
+8fdcd362f021d41165c4a959ba79136491389343 SOURCES/snapshot-1.3.1.tar.gz
+d2c153993e51ce949db861db2aa15e8ec90b45af SOURCES/ssh-1.3.2.tar.gz
+e08c1df6c6842f6ad37fff34d2e9d96e9cdddd70 SOURCES/storage-1.16.2.tar.gz
+df8f2896ad761da73872d17a0f0cd8cfd34e0671 SOURCES/systemd-1.1.2.tar.gz
+0a9df710ddd8a43e74cbd77e4414d5ea7e90d7b9 SOURCES/timesync-1.9.0.tar.gz
+6d559dc44f44bc7e505602b36b51b4d1b60f2754 SOURCES/tlog-1.3.3.tar.gz
+27395883fa555658257e70287e709f8ccc1d8392 SOURCES/vpn-1.6.3.tar.gz

SOURCES/0001-test-fix-sector-based-disk-size-calculation-from-ans.patch

@@ -0,0 +1,74 @@
+From 8b3cfc1a30da1ab681eb8c250baa2d6395ecc0d2 Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Wed, 3 Apr 2024 15:12:00 +0200
+Subject: [PATCH 01/10] test: fix sector-based disk size calculation from
+ ansible_devices
+
+Device sizes specified in sectors are in general in 512 sectors
+regardless of the actual device physical sector size. Example of
+ansible_devices facts for a 4k sector size drive:
+
+...
+  "sectors": "41943040",
+  "sectorsize": "4096",
+  "size": "20.00 GB"
+...
+
+Resolves: RHEL-30959
+
+Signed-off-by: Vojtech Trefny <vtrefny@redhat.com>
+(cherry picked from commit bb1eb23ccd6e9475cd698f0a6f2f497ffefbccd2)
+---
+ tests/tests_create_lv_size_equal_to_vg.yml | 3 +--
+ tests/tests_misc.yml                       | 3 +--
+ tests/tests_resize.yml                     | 6 ++----
+ 3 files changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/tests/tests_create_lv_size_equal_to_vg.yml b/tests/tests_create_lv_size_equal_to_vg.yml
+index cab4f08..535f73b 100644
+--- a/tests/tests_create_lv_size_equal_to_vg.yml
++++ b/tests/tests_create_lv_size_equal_to_vg.yml
+@@ -8,8 +8,7 @@
+     volume_group_size: '10g'
+     lv_size: '10g'
+     unused_disk_subfact: '{{ ansible_devices[unused_disks[0]] }}'
+-    disk_size: '{{ unused_disk_subfact.sectors | int *
+-                   unused_disk_subfact.sectorsize | int }}'
++    disk_size: '{{ unused_disk_subfact.sectors | int * 512 }}'
+   tags:
+     - tests::lvm
+ 
+diff --git a/tests/tests_misc.yml b/tests/tests_misc.yml
+index 6373897..363d843 100644
+--- a/tests/tests_misc.yml
++++ b/tests/tests_misc.yml
+@@ -8,8 +8,7 @@
+     volume_group_size: "5g"
+     volume1_size: "4g"
+     unused_disk_subfact: "{{ ansible_devices[unused_disks[0]] }}"
+-    too_large_size: "{{ (unused_disk_subfact.sectors | int * 1.2) *
+-                         unused_disk_subfact.sectorsize | int }}"
++    too_large_size: "{{ (unused_disk_subfact.sectors | int * 1.2) * 512 }}"
+   tags:
+     - tests::lvm
+   tasks:
+diff --git a/tests/tests_resize.yml b/tests/tests_resize.yml
+index 06fb375..1cd2176 100644
+--- a/tests/tests_resize.yml
++++ b/tests/tests_resize.yml
+@@ -11,10 +11,8 @@
+     invalid_size1: xyz GiB
+     invalid_size2: none
+     unused_disk_subfact: '{{ ansible_devices[unused_disks[0]] }}'
+-    too_large_size: '{{ unused_disk_subfact.sectors | int * 1.2 *
+-                        unused_disk_subfact.sectorsize | int }}'
+-    disk_size: '{{ unused_disk_subfact.sectors | int *
+-                   unused_disk_subfact.sectorsize | int }}'
++    too_large_size: '{{ unused_disk_subfact.sectors | int * 1.2 * 512 }}'
++    disk_size: '{{ unused_disk_subfact.sectors | int * 512 }}'
+   tags:
+     - tests::lvm
+   tasks:
+-- 
+2.46.0
+

SOURCES/0002-fix-Fix-recreate-check-for-formats-without-labelling.patch

@@ -0,0 +1,64 @@
+From 9f561445271a14fee598e9a793f72297f66eae56 Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Wed, 10 Apr 2024 17:05:46 +0200
+Subject: [PATCH 02/10] fix: Fix recreate check for formats without labelling
+ support
+
+Formats like LUKS or LVMPV don't support labels so we need to skip
+the label check in BlivetVolume._reformat.
+
+Resolves: RHEL-29874
+(cherry picked from commit a70e8108110e30ebc5e7c404d39339c511f9bd09)
+---
+ library/blivet.py              |  3 +++
+ tests/tests_volume_relabel.yml | 20 ++++++++++++++++++++
+ 2 files changed, 23 insertions(+)
+
+diff --git a/library/blivet.py b/library/blivet.py
+index 20389ea..18807de 100644
+--- a/library/blivet.py
++++ b/library/blivet.py
+@@ -826,6 +826,9 @@ class BlivetVolume(BlivetBase):
+         if ((fmt is None and self._device.format.type is None)
+                 or (fmt is not None and self._device.format.type == fmt.type)):
+             # format is the same, no need to run reformatting
++            if not hasattr(self._device.format, "label"):
++                # not all formats support labels
++                return
+             dev_label = '' if self._device.format.label is None else self._device.format.label
+             if dev_label != fmt.label:
+                 # ...but the label has changed - schedule modification action
+diff --git a/tests/tests_volume_relabel.yml b/tests/tests_volume_relabel.yml
+index 8916b73..6624fbd 100644
+--- a/tests/tests_volume_relabel.yml
++++ b/tests/tests_volume_relabel.yml
+@@ -111,6 +111,26 @@
+     - name: Verify role results
+       include_tasks: verify-role-results.yml
+ 
++    - name: Format the device to LVMPV which doesn't support labels
++      include_role:
++        name: linux-system-roles.storage
++      vars:
++        storage_volumes:
++          - name: test1
++            type: disk
++            fs_type: lvmpv
++            disks: "{{ unused_disks }}"
++
++    - name: Rerun to check we don't try to relabel preexisitng LVMPV (regression test for RHEL-29874)
++      include_role:
++        name: linux-system-roles.storage
++      vars:
++        storage_volumes:
++          - name: test1
++            type: disk
++            fs_type: lvmpv
++            disks: "{{ unused_disks }}"
++
+     - name: Clean up
+       include_role:
+         name: linux-system-roles.storage
+-- 
+2.46.0
+

SOURCES/0003-fix-Fix-incorrent-populate-call.patch

@@ -0,0 +1,28 @@
+From 7abfaeddab812e4eec0c3d3d6bcbabe047722c4f Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Wed, 10 Apr 2024 17:08:20 +0200
+Subject: [PATCH 03/10] fix: Fix incorrent populate call
+
+`populate()` is method of DeviceTree, not Blivet.
+
+(cherry picked from commit 6471e65abd429c82df37cbcf07fdf909e4277aa8)
+---
+ library/blivet.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/library/blivet.py b/library/blivet.py
+index 18807de..d82b86b 100644
+--- a/library/blivet.py
++++ b/library/blivet.py
+@@ -630,7 +630,7 @@ class BlivetVolume(BlivetBase):
+             device.original_format._key_file = self._volume.get('encryption_key')
+             device.original_format.passphrase = self._volume.get('encryption_password')
+             if device.isleaf:
+-                self._blivet.populate()
++                self._blivet.devicetree.populate()
+ 
+             if not device.isleaf:
+                 device = device.children[0]
+-- 
+2.46.0
+

SOURCES/0004-tests-Add-a-new-match_sector_size-argument-to-find_u.patch

@@ -0,0 +1,174 @@
+From 912c33982d9cc412eb72bc9baeab6696e29e7f27 Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Tue, 28 May 2024 16:23:48 +0200
+Subject: [PATCH 04/10] tests: Add a new 'match_sector_size' argument to
+ find_unused_disks
+
+Some storage pools cannot be created on disks with different
+sector sizes so we want to be able to find unused disks with the
+same sector sizes for our tests.
+
+Related: RHEL-25994
+(cherry picked from commit 368ecd0214dbaad7c42547eeac0565e51c924546)
+---
+ library/find_unused_disk.py    | 79 ++++++++++++++++++++++------------
+ tests/get_unused_disk.yml      |  1 +
+ tests/unit/test_unused_disk.py |  6 +--
+ 3 files changed, 56 insertions(+), 30 deletions(-)
+
+diff --git a/library/find_unused_disk.py b/library/find_unused_disk.py
+index 09b8ad5..098f235 100644
+--- a/library/find_unused_disk.py
++++ b/library/find_unused_disk.py
+@@ -39,6 +39,11 @@ options:
+         description: Specifies which disk interface will be accepted (scsi, virtio, nvme).
+         default: null
+         type: str
++
++    match_sector_size:
++        description: Specifies whether all returned disks must have the same (logical) sector size.
++        default: false
++        type: bool
+ '''
+ 
+ EXAMPLES = '''
+@@ -138,13 +143,13 @@ def get_partitions(disk_path):
+ 
+ 
+ def get_disks(module):
+-    buf = module.run_command(["lsblk", "-p", "--pairs", "--bytes", "-o", "NAME,TYPE,SIZE,FSTYPE"])[1]
++    buf = module.run_command(["lsblk", "-p", "--pairs", "--bytes", "-o", "NAME,TYPE,SIZE,FSTYPE,LOG-SEC"])[1]
+     disks = dict()
+     for line in buf.splitlines():
+         if not line:
+             continue
+ 
+-        m = re.search(r'NAME="(?P<path>[^"]*)" TYPE="(?P<type>[^"]*)" SIZE="(?P<size>\d+)" FSTYPE="(?P<fstype>[^"]*)"', line)
++        m = re.search(r'NAME="(?P<path>[^"]*)" TYPE="(?P<type>[^"]*)" SIZE="(?P<size>\d+)" FSTYPE="(?P<fstype>[^"]*)" LOG-SEC="(?P<ssize>\d+)"', line)
+         if m is None:
+             module.log(line)
+             continue
+@@ -152,31 +157,16 @@ def get_disks(module):
+         if m.group('type') != "disk":
+             continue
+ 
+-        disks[m.group('path')] = {"type": m.group('type'), "size": m.group('size'), "fstype": m.group('fstype')}
++        disks[m.group('path')] = {"type": m.group('type'), "size": m.group('size'),
++                                  "fstype": m.group('fstype'), "ssize": m.group('ssize')}
+ 
+     return disks
+ 
+ 
+-def run_module():
+-    """Create the module"""
+-    module_args = dict(
+-        max_return=dict(type='int', required=False, default=10),
+-        min_size=dict(type='str', required=False, default='0'),
+-        max_size=dict(type='str', required=False, default='0'),
+-        with_interface=dict(type='str', required=False, default=None)
+-    )
+-
+-    result = dict(
+-        changed=False,
+-        disks=[]
+-    )
+-
+-    module = AnsibleModule(
+-        argument_spec=module_args,
+-        supports_check_mode=True
+-    )
+-
++def filter_disks(module):
++    disks = {}
+     max_size = Size(module.params['max_size'])
++
+     for path, attrs in get_disks(module).items():
+         if is_ignored(path):
+             continue
+@@ -204,14 +194,49 @@ def run_module():
+         if not can_open(path):
+             continue
+ 
+-        result['disks'].append(os.path.basename(path))
+-        if len(result['disks']) >= module.params['max_return']:
+-            break
++        disks[path] = attrs
++
++    return disks
++
++
++def run_module():
++    """Create the module"""
++    module_args = dict(
++        max_return=dict(type='int', required=False, default=10),
++        min_size=dict(type='str', required=False, default='0'),
++        max_size=dict(type='str', required=False, default='0'),
++        with_interface=dict(type='str', required=False, default=None),
++        match_sector_size=dict(type='bool', required=False, default=False)
++    )
++
++    result = dict(
++        changed=False,
++        disks=[]
++    )
++
++    module = AnsibleModule(
++        argument_spec=module_args,
++        supports_check_mode=True
++    )
++
++    disks = filter_disks(module)
++
++    if module.params['match_sector_size']:
++        # pick the most disks with the same sector size
++        sector_sizes = dict()
++        for path, ss in [(path, disks[path]["ssize"]) for path in disks.keys()]:
++            if ss in sector_sizes.keys():
++                sector_sizes[ss].append(path)
++            else:
++                sector_sizes[ss] = [path]
++        disks = [os.path.basename(p) for p in max(sector_sizes.values(), key=len)]
++    else:
++        disks = [os.path.basename(p) for p in disks.keys()]
+ 
+-    if not result['disks']:
++    if not disks:
+         result['disks'] = "Unable to find unused disk"
+     else:
+-        result['disks'].sort()
++        result['disks'] = sorted(disks)[:int(module.params['max_return'])]
+ 
+     module.exit_json(**result)
+ 
+diff --git a/tests/get_unused_disk.yml b/tests/get_unused_disk.yml
+index 685541f..a61487e 100644
+--- a/tests/get_unused_disk.yml
++++ b/tests/get_unused_disk.yml
+@@ -19,6 +19,7 @@
+     max_size: "{{ max_size | d(omit) }}"
+     max_return: "{{ max_return | d(omit) }}"
+     with_interface: "{{ storage_test_use_interface | d(omit) }}"
++    match_sector_size: "{{ match_sector_size | d(omit) }}"
+   register: unused_disks_return
+ 
+ - name: Set unused_disks if necessary
+diff --git a/tests/unit/test_unused_disk.py b/tests/unit/test_unused_disk.py
+index 74c9cf1..ca44d0f 100644
+--- a/tests/unit/test_unused_disk.py
++++ b/tests/unit/test_unused_disk.py
+@@ -10,9 +10,9 @@ import os
+ blkid_data_pttype = [('/dev/sdx', '/dev/sdx: PTTYPE=\"dos\"'),
+                      ('/dev/sdy', '/dev/sdy: PTTYPE=\"test\"')]
+ 
+-blkid_data = [('/dev/sdx', 'UUID=\"hello-1234-56789\" TYPE=\"crypto_LUKS\"'),
+-              ('/dev/sdy', 'UUID=\"this-1s-a-t3st-f0r-ansible\" VERSION=\"LVM2 001\" TYPE=\"LVM2_member\" USAGE=\"raid\"'),
+-              ('/dev/sdz', 'LABEL=\"/data\" UUID=\"a12bcdef-345g-67h8-90i1-234j56789k10\" VERSION=\"1.0\" TYPE=\"ext4\" USAGE=\"filesystem\"')]
++blkid_data = [('/dev/sdx', 'UUID=\"hello-1234-56789\" TYPE=\"crypto_LUKS\" LOG-SEC=\"512\"'),
++              ('/dev/sdy', 'UUID=\"this-1s-a-t3st-f0r-ansible\" VERSION=\"LVM2 001\" TYPE=\"LVM2_member\" USAGE=\"raid\" LOG-SEC=\"512\"'),
++              ('/dev/sdz', 'LABEL=\"/data\" UUID=\"a12bcdef-345g-67h8-90i1-234j56789k10\" VERSION=\"1.0\" TYPE=\"ext4\" USAGE=\"filesystem\" LOG-SEC=\"512\"')]
+ 
+ holders_data_none = [('/dev/sdx', ''),
+                      ('/dev/dm-99', '')]
+-- 
+2.46.0
+

SOURCES/0005-tests-Require-same-sector-size-disks-for-LVM-tests.patch

@@ -0,0 +1,96 @@
+From da871866f07e2990f37b3fdea404bbaf091d81b6 Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Thu, 30 May 2024 10:41:26 +0200
+Subject: [PATCH 05/10] tests: Require same sector size disks for LVM tests
+
+LVM VGs cannot be created on top of disks with different sector
+sizes so for tests that need multiple disks we need to make sure
+we get unused disks with the same sector size.
+
+Resolves: RHEL-25994
+(cherry picked from commit d8c5938c28417cc905a647ec30246a0fc4d19297)
+---
+ tests/tests_change_fs_use_partitions.yml            | 2 +-
+ tests/tests_create_lvm_cache_then_remove.yml        | 1 +
+ tests/tests_create_thinp_then_remove.yml            | 1 +
+ tests/tests_fatals_cache_volume.yml                 | 1 +
+ tests/tests_lvm_multiple_disks_multiple_volumes.yml | 1 +
+ tests/tests_lvm_pool_members.yml                    | 1 +
+ 6 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tests/tests_change_fs_use_partitions.yml b/tests/tests_change_fs_use_partitions.yml
+index 52afb7f..87fed69 100644
+--- a/tests/tests_change_fs_use_partitions.yml
++++ b/tests/tests_change_fs_use_partitions.yml
+@@ -31,7 +31,7 @@
+       include_tasks: get_unused_disk.yml
+       vars:
+         min_size: "{{ volume_size }}"
+-        max_return: 2
++        max_return: 1
+ 
+     - name: Create an LVM partition with the default file system type
+       include_role:
+diff --git a/tests/tests_create_lvm_cache_then_remove.yml b/tests/tests_create_lvm_cache_then_remove.yml
+index 1769a78..6b5d0a5 100644
+--- a/tests/tests_create_lvm_cache_then_remove.yml
++++ b/tests/tests_create_lvm_cache_then_remove.yml
+@@ -57,6 +57,7 @@
+         min_size: "{{ volume_group_size }}"
+         max_return: 2
+         disks_needed: 2
++        match_sector_size: true
+ 
+     - name: Create a cached LVM logical volume under volume group 'foo'
+       include_role:
+diff --git a/tests/tests_create_thinp_then_remove.yml b/tests/tests_create_thinp_then_remove.yml
+index bf6c4b1..2e7f046 100644
+--- a/tests/tests_create_thinp_then_remove.yml
++++ b/tests/tests_create_thinp_then_remove.yml
+@@ -23,6 +23,7 @@
+       include_tasks: get_unused_disk.yml
+       vars:
+         max_return: 3
++        match_sector_size: true
+ 
+     - name: Create a thinpool device
+       include_role:
+diff --git a/tests/tests_fatals_cache_volume.yml b/tests/tests_fatals_cache_volume.yml
+index c14cf3f..fcfdbb8 100644
+--- a/tests/tests_fatals_cache_volume.yml
++++ b/tests/tests_fatals_cache_volume.yml
+@@ -29,6 +29,7 @@
+       vars:
+         max_return: 2
+         disks_needed: 2
++        match_sector_size: true
+ 
+     - name: Verify that creating a cached partition volume fails
+       include_tasks: verify-role-failed.yml
+diff --git a/tests/tests_lvm_multiple_disks_multiple_volumes.yml b/tests/tests_lvm_multiple_disks_multiple_volumes.yml
+index 9a01ec5..68f2e76 100644
+--- a/tests/tests_lvm_multiple_disks_multiple_volumes.yml
++++ b/tests/tests_lvm_multiple_disks_multiple_volumes.yml
+@@ -29,6 +29,7 @@
+         min_size: "{{ volume_group_size }}"
+         max_return: 2
+         disks_needed: 2
++        match_sector_size: true
+ 
+     - name: >-
+         Create a logical volume spanning two physical volumes that changes its
+diff --git a/tests/tests_lvm_pool_members.yml b/tests/tests_lvm_pool_members.yml
+index d1b941d..63c10c7 100644
+--- a/tests/tests_lvm_pool_members.yml
++++ b/tests/tests_lvm_pool_members.yml
+@@ -59,6 +59,7 @@
+           vars:
+             min_size: "{{ volume_group_size }}"
+             disks_needed: 3
++            match_sector_size: true
+ 
+         - name: Create volume group 'foo' with 3 PVs
+           include_role:
+-- 
+2.46.0
+

SOURCES/0006-fix-Fix-possibly-used-before-assignment-pylint-issue.patch

@@ -0,0 +1,41 @@
+From 705a9db65a230013a9118481082d2bb548cd113d Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Fri, 31 May 2024 06:31:52 +0200
+Subject: [PATCH 06/10] fix: Fix 'possibly-used-before-assignment' pylint
+ issues (#440)
+
+Latest pylint added a new check for values used before assignment.
+This fixes these issues found in the blivet module. Some of these
+are false positives, some real potential issues.
+
+(cherry picked from commit bfaae50586681bb4b0fcad5df6f6adde2b7c8502)
+---
+ library/blivet.py | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/library/blivet.py b/library/blivet.py
+index d82b86b..a6715d9 100644
+--- a/library/blivet.py
++++ b/library/blivet.py
+@@ -642,6 +642,9 @@ class BlivetVolume(BlivetBase):
+             self._device = None
+             return  # TODO: see if we can create this device w/ the specified name
+ 
++    # pylint doesn't understand that "luks_fmt" is always set when "encrypted" is true
++    # pylint: disable=unknown-option-value
++    # pylint: disable=possibly-used-before-assignment
+     def _update_from_device(self, param_name):
+         """ Return True if param_name's value was retrieved from a looked-up device. """
+         log.debug("Updating volume settings from device: %r", self._device)
+@@ -1717,6 +1720,8 @@ class BlivetLVMPool(BlivetPool):
+ 
+         if auto_size_dev_count > 0:
+             calculated_thinlv_size = available_space / auto_size_dev_count
++        else:
++            calculated_thinlv_size = available_space
+ 
+         for thinlv in thinlvs_to_create:
+ 
+-- 
+2.46.0
+

SOURCES/0007-test-lsblk-can-return-LOG_SEC-or-LOG-SEC.patch

@@ -0,0 +1,54 @@
+From 18edc9af26684f03e44fe2e22c82a8f93182da4a Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Wed, 5 Jun 2024 08:49:19 -0600
+Subject: [PATCH 07/10] test: lsblk can return LOG_SEC or LOG-SEC
+
+get_unused_disk is broken on some systems because `lsblk ... LOG-SEC` can
+return `LOG_SEC` with an underscore instead of the requested
+`LOG-SEC` with a dash.
+
+(cherry picked from commit 64333ce8aa42f4b961c39a443ac43cc6590097b3)
+---
+ library/find_unused_disk.py | 4 ++--
+ tests/get_unused_disk.yml   | 9 +++++++++
+ 2 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/library/find_unused_disk.py b/library/find_unused_disk.py
+index 098f235..270fb58 100644
+--- a/library/find_unused_disk.py
++++ b/library/find_unused_disk.py
+@@ -149,9 +149,9 @@ def get_disks(module):
+         if not line:
+             continue
+ 
+-        m = re.search(r'NAME="(?P<path>[^"]*)" TYPE="(?P<type>[^"]*)" SIZE="(?P<size>\d+)" FSTYPE="(?P<fstype>[^"]*)" LOG-SEC="(?P<ssize>\d+)"', line)
++        m = re.search(r'NAME="(?P<path>[^"]*)" TYPE="(?P<type>[^"]*)" SIZE="(?P<size>\d+)" FSTYPE="(?P<fstype>[^"]*)" LOG[_-]SEC="(?P<ssize>\d+)"', line)
+         if m is None:
+-            module.log(line)
++            module.log("Line did not match: " + line)
+             continue
+ 
+         if m.group('type') != "disk":
+diff --git a/tests/get_unused_disk.yml b/tests/get_unused_disk.yml
+index a61487e..0402770 100644
+--- a/tests/get_unused_disk.yml
++++ b/tests/get_unused_disk.yml
+@@ -22,6 +22,15 @@
+     match_sector_size: "{{ match_sector_size | d(omit) }}"
+   register: unused_disks_return
+ 
++- name: Debug why there are no unused disks
++  shell: |
++    set -x
++    exec 1>&2
++    lsblk -p --pairs --bytes -o NAME,TYPE,SIZE,FSTYPE,LOG-SEC
++    journalctl -ex
++  changed_when: false
++  when: "'Unable to find unused disk' in unused_disks_return.disks"
++
+ - name: Set unused_disks if necessary
+   set_fact:
+     unused_disks: "{{ unused_disks_return.disks }}"
+-- 
+2.46.0
+

SOURCES/0008-test-lvm-pool-members-test-fix.patch

@@ -0,0 +1,34 @@
+From aa6e494963a3bded3b1ca7ef5a81e0106e68d5bc Mon Sep 17 00:00:00 2001
+From: Jan Pokorny <japokorn@redhat.com>
+Date: Thu, 6 Jun 2024 11:54:48 +0200
+Subject: [PATCH 08/10] test: lvm pool members test fix
+
+tests_lvm_pool_members started to fail. It tried to create a device with
+a requested size (20m) that was less than minimal allowed size (300m) for that type of
+volume. Role automatically resized the device to allowed size. That lead to discrepancy
+in actual and expected size values.
+
+Increasing the requested device size to be same or larger than minimal fixes the
+issue.
+
+(cherry picked from commit ee740b7b14d09e09a26dd5eb95e8950aeb15147d)
+---
+ tests/tests_lvm_pool_members.yml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/tests_lvm_pool_members.yml b/tests/tests_lvm_pool_members.yml
+index 63c10c7..320626e 100644
+--- a/tests/tests_lvm_pool_members.yml
++++ b/tests/tests_lvm_pool_members.yml
+@@ -6,7 +6,7 @@
+     storage_safe_mode: false
+     storage_use_partitions: true
+     volume_group_size: '10g'
+-    volume_size: '20m'
++    volume_size: '300m'
+   tags:
+     - tests::lvm
+ 
+-- 
+2.46.0
+

SOURCES/0009-fix-Fix-expected-error-message-in-tests_misc.yml.patch

@@ -0,0 +1,40 @@
+From d2b59ac3758f51ffac5156e9f006b7ce9d8a28eb Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Tue, 4 Jun 2024 10:30:03 +0200
+Subject: [PATCH 09/10] fix: Fix expected error message in tests_misc.yml
+
+Different versions of blivet return a different error message when
+trying to create a filesystem with invalid parameters.
+
+On Fedora 39 and older:
+"Failed to commit changes to disk: (FSError('format failed: 1'),
+'/dev/mapper/foo-test1')"
+
+On Fedora 40 and newer:
+"Failed to commit changes to disk: Process reported exit code 1:
+mke2fs: invalid block size - 512\n"
+
+(cherry picked from commit 7ef66d85bd52f339483b24dbb8bc66e22054b378)
+---
+ tests/tests_misc.yml | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tests/tests_misc.yml b/tests/tests_misc.yml
+index 363d843..432ec16 100644
+--- a/tests/tests_misc.yml
++++ b/tests/tests_misc.yml
+@@ -68,8 +68,9 @@
+       include_tasks: verify-role-failed.yml
+       vars:
+         __storage_failed_regex: >-
+-          Failed to commit changes to disk.*FSError.*format failed:
+-          1.*/dev/mapper/foo-test1
++          Failed to commit changes to disk.*(FSError.*format failed:
++          1.*/dev/mapper/foo-test1|
++          Process reported exit code 1: mke2fs: invalid block size - 512)
+         __storage_failed_msg: >-
+           Unexpected behavior when creating ext4 filesystem with invalid
+           parameter
+-- 
+2.46.0
+

SOURCES/0010-tests-Use-blockdev_info-to-check-volume-mount-points.patch

@@ -0,0 +1,180 @@
+From a86f7e013fe881e477b65509363bbb5af851662f Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Fri, 12 Apr 2024 14:45:15 +0200
+Subject: [PATCH 10/10] tests: Use blockdev_info to check volume mount points
+
+We can use the information from `lsblk` we already use for other
+checks instead of using the Ansible mountinfo facts. This makes
+the check simpler and also makes it easier to check for Stratis
+volume mount points, because of the complicated Stratis devices
+structure in /dev.
+
+(cherry picked from commit 10e657bde68ffa9495b2441ed9f472cf79edbb19)
+---
+ library/blockdev_info.py           |  2 +-
+ tests/test-verify-volume-fs.yml    | 51 ++++++++++++++++--------------
+ tests/test-verify-volume-mount.yml | 48 +++++-----------------------
+ 3 files changed, 37 insertions(+), 64 deletions(-)
+
+diff --git a/library/blockdev_info.py b/library/blockdev_info.py
+index 13858fb..ec018de 100644
+--- a/library/blockdev_info.py
++++ b/library/blockdev_info.py
+@@ -64,7 +64,7 @@ def fixup_md_path(path):
+ 
+ 
+ def get_block_info(module):
+-    buf = module.run_command(["lsblk", "-o", "NAME,FSTYPE,LABEL,UUID,TYPE,SIZE", "-p", "-P", "-a"])[1]
++    buf = module.run_command(["lsblk", "-o", "NAME,FSTYPE,LABEL,UUID,TYPE,SIZE,MOUNTPOINT", "-p", "-P", "-a"])[1]
+     info = dict()
+     for line in buf.splitlines():
+         dev = dict()
+diff --git a/tests/test-verify-volume-fs.yml b/tests/test-verify-volume-fs.yml
+index 8e488c5..63b2770 100644
+--- a/tests/test-verify-volume-fs.yml
++++ b/tests/test-verify-volume-fs.yml
+@@ -1,26 +1,31 @@
+ ---
+ # type
+-- name: Verify fs type
+-  assert:
+-    that: storage_test_blkinfo.info[storage_test_volume._device].fstype ==
+-      storage_test_volume.fs_type or
+-      (storage_test_blkinfo.info[storage_test_volume._device].fstype | length
+-       == 0 and storage_test_volume.fs_type == "unformatted")
+-  when: storage_test_volume.fs_type and _storage_test_volume_present
++- name: Check volume filesystem
++  when: storage_test_volume.type != "stratis"
++  block:
++  - name: Verify fs type
++    assert:
++      that: storage_test_blkinfo.info[storage_test_volume._device].fstype ==
++        storage_test_volume.fs_type or
++        (storage_test_blkinfo.info[storage_test_volume._device].fstype | length
++        == 0 and storage_test_volume.fs_type == "unformatted")
++    when:
++      - storage_test_volume.fs_type
++      - _storage_test_volume_present
+ 
+-# label
+-- name: Verify fs label
+-  assert:
+-    that: storage_test_blkinfo.info[storage_test_volume._device].label ==
+-      storage_test_volume.fs_label
+-    msg: >-
+-      Volume '{{ storage_test_volume.name }}' labels do not match when they
+-      should
+-      ('{{ storage_test_blkinfo.info[storage_test_volume._device].label }}',
+-      '{{ storage_test_volume.fs_label }}')
+-  when:
+-    - _storage_test_volume_present | bool
+-    # label for GFS2 is set manually with the extra `-t` fs_create_options
+-    # so we can't verify it here because it was not set with fs_label so
+-    # the label from blkinfo doesn't match the expected "empty" fs_label
+-    - storage_test_volume.fs_type != "gfs2"
++  # label
++  - name: Verify fs label
++    assert:
++      that: storage_test_blkinfo.info[storage_test_volume._device].label ==
++        storage_test_volume.fs_label
++      msg: >-
++        Volume '{{ storage_test_volume.name }}' labels do not match when they
++        should
++        ('{{ storage_test_blkinfo.info[storage_test_volume._device].label }}',
++        '{{ storage_test_volume.fs_label }}')
++    when:
++      - _storage_test_volume_present | bool
++      # label for GFS2 is set manually with the extra `-t` fs_create_options
++      # so we can't verify it here because it was not set with fs_label so
++      # the label from blkinfo doesn't match the expected "empty" fs_label
++      - storage_test_volume.fs_type != "gfs2"
+diff --git a/tests/test-verify-volume-mount.yml b/tests/test-verify-volume-mount.yml
+index cf86b34..17d2a01 100644
+--- a/tests/test-verify-volume-mount.yml
++++ b/tests/test-verify-volume-mount.yml
+@@ -15,20 +15,13 @@
+ 
+ - name: Set some facts
+   set_fact:
+-    storage_test_mount_device_matches: "{{ ansible_mounts |
+-      selectattr('device', 'match', '^' ~ storage_test_device_path ~ '$') |
+-      list }}"
+-    storage_test_mount_point_matches: "{{ ansible_mounts |
+-      selectattr('mount', 'match',
+-                 '^' ~ mount_prefix ~ storage_test_volume.mount_point ~ '$') |
+-      list if storage_test_volume.mount_point else [] }}"
+-    storage_test_mount_expected_match_count: "{{ 1
+-      if _storage_test_volume_present and storage_test_volume.mount_point and
+-      storage_test_volume.mount_point.startswith('/')
+-      else 0 }}"
+     storage_test_swap_expected_matches: "{{ 1 if
+       _storage_test_volume_present and
+       storage_test_volume.fs_type == 'swap' else 0 }}"
++    storage_test_mount_expected_mount_point: "{{
++      '[SWAP]' if storage_test_volume.fs_type == 'swap' else
++      '' if storage_test_volume.mount_point == 'none' else
++      mount_prefix + storage_test_volume.mount_point if storage_test_volume.mount_point else '' }}"
+   vars:
+     # assumes /opt which is /var/opt in ostree
+     mount_prefix: "{{ '/var' if __storage_is_ostree | d(false)
+@@ -50,23 +43,12 @@
+ #
+ - name: Verify the current mount state by device
+   assert:
+-    that: storage_test_mount_device_matches | length ==
+-      storage_test_mount_expected_match_count | int
++    that: storage_test_blkinfo.info[storage_test_volume._device].mountpoint ==
++      storage_test_mount_expected_mount_point
+     msg: >-
+       Found unexpected mount state for volume
+       '{{ storage_test_volume.name }}' device
+-  when: _storage_test_volume_present and storage_test_volume.mount_point
+-
+-#
+-# Verify mount directory (state, owner, group, permissions).
+-#
+-- name: Verify the current mount state by mount point
+-  assert:
+-    that: storage_test_mount_point_matches | length ==
+-      storage_test_mount_expected_match_count | int
+-    msg: >-
+-      Found unexpected mount state for volume
+-      '{{ storage_test_volume.name }}' mount point
++  when: _storage_test_volume_present
+ 
+ - name: Verify mount directory user
+   assert:
+@@ -104,18 +86,6 @@
+         storage_test_volume.mount_point and
+         storage_test_volume.mount_mode
+ 
+-#
+-# Verify mount fs type.
+-#
+-- name: Verify the mount fs type
+-  assert:
+-    that: storage_test_mount_point_matches[0].fstype ==
+-      storage_test_volume.fs_type
+-    msg: >-
+-      Found unexpected mount state for volume
+-      '{{ storage_test_volume.name }} fs type
+-  when: storage_test_mount_expected_match_count | int == 1
+-
+ #
+ # Verify swap status.
+ #
+@@ -145,10 +115,8 @@
+ 
+ - name: Unset facts
+   set_fact:
+-    storage_test_mount_device_matches: null
+-    storage_test_mount_point_matches: null
+-    storage_test_mount_expected_match_count: null
+     storage_test_swap_expected_matches: null
+     storage_test_sys_node: null
+     storage_test_swaps: null
+     storage_test_found_mount_stat: null
++    storage_test_mount_expected_mount_point: null
+-- 
+2.46.0
+

SOURCES/0101-fix-Add-support-for-check-flag.patch

@@ -0,0 +1,26 @@
+From 36acf32d30d106159ba9f2fa88d723d9577c9f15 Mon Sep 17 00:00:00 2001
+From: Samuel Bancal <Samuel.Bancal@groupe-t2i.com>
+Date: Thu, 14 Mar 2024 10:15:11 +0100
+Subject: [PATCH 101/115] fix: Add support for --check flag
+
+Fix: https://github.com/linux-system-roles/podman/issues/133
+(cherry picked from commit a47e6a95e2a5ee70714bf315d3e03310365d3650)
+---
+ tasks/main.yml | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tasks/main.yml b/tasks/main.yml
+index 1b9ca4a..61f1d1c 100644
+--- a/tasks/main.yml
++++ b/tasks/main.yml
+@@ -21,6 +21,7 @@
+   when: (__podman_packages | difference(ansible_facts.packages))
+ 
+ - name: Get podman version
++  check_mode: false
+   command: podman --version
+   changed_when: false
+   register: __podman_version_output
+-- 
+2.46.0
+

SOURCES/0102-fix-use-correct-user-for-cancel-linger-file-name.patch

@@ -0,0 +1,56 @@
+From 53f83475c59092e2c23d1957c2fc24c8ca4b6ad9 Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Tue, 9 Apr 2024 18:27:25 -0600
+Subject: [PATCH 102/115] fix: use correct user for cancel linger file name
+
+Cause: When processing a list of kube or quadlet items, the
+code was using the user id associated with the list, not the
+item, to specify the linger filename.
+
+Consequence: The linger file does not exist, so the code
+does not cancel linger for the actual user.
+
+Fix: Use the correct username to construct the linger filename.
+
+Result: Lingering is cancelled for the correct users.
+
+QE: The test is now in tests_basic.yml
+
+Signed-off-by: Rich Megginson <rmeggins@redhat.com>
+(cherry picked from commit 67b88b9aa0a1b1123c2ae24bb7ca4a527924cd13)
+---
+ tasks/cancel_linger.yml | 2 +-
+ tests/tests_basic.yml   | 7 +++++++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/tasks/cancel_linger.yml b/tasks/cancel_linger.yml
+index 761778b..ede71fe 100644
+--- a/tasks/cancel_linger.yml
++++ b/tasks/cancel_linger.yml
+@@ -59,4 +59,4 @@
+     - __podman_linger_secrets.stdout == ""
+   changed_when: true
+   args:
+-    removes: /var/lib/systemd/linger/{{ __podman_user }}
++    removes: /var/lib/systemd/linger/{{ __podman_linger_user }}
+diff --git a/tests/tests_basic.yml b/tests/tests_basic.yml
+index a9f01c9..d4f9238 100644
+--- a/tests/tests_basic.yml
++++ b/tests/tests_basic.yml
+@@ -409,6 +409,13 @@
+               ^[  ]*podman-kube@.+-{{ item[0] }}[.]yml[.]service[ ]+loaded[
+               ]+active
+ 
++        - name: Ensure no linger
++          stat:
++            path: /var/lib/systemd/linger/{{ item[1] }}
++          loop: "{{ test_names_users }}"
++          register: __stat
++          failed_when: __stat.stat.exists
++
+       rescue:
+         - name: Dump journal
+           command: journalctl -ex
+-- 
+2.46.0
+

SOURCES/0103-test-do-not-check-for-root-linger.patch

@@ -0,0 +1,28 @@
+From dd93ef65b0d1929184d458914386086fca8b8d7a Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Wed, 10 Apr 2024 16:06:28 -0600
+Subject: [PATCH 103/115] test: do not check for root linger
+
+Do not check if there is a linger file for root.
+
+Signed-off-by: Rich Megginson <rmeggins@redhat.com>
+(cherry picked from commit 2b29e049daa28ba6c3b38f514cff9c62be5f3caf)
+---
+ tests/tests_basic.yml | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tests/tests_basic.yml b/tests/tests_basic.yml
+index d4f9238..d578b15 100644
+--- a/tests/tests_basic.yml
++++ b/tests/tests_basic.yml
+@@ -412,6 +412,7 @@
+         - name: Ensure no linger
+           stat:
+             path: /var/lib/systemd/linger/{{ item[1] }}
++          when: item[1] != "root"
+           loop: "{{ test_names_users }}"
+           register: __stat
+           failed_when: __stat.stat.exists
+-- 
+2.46.0
+

SOURCES/0104-fix-do-not-use-become-for-changing-hostdir-ownership.patch

@@ -0,0 +1,210 @@
+From b2e79348094ea8d89b71727d82a80a9f3cfbb1ce Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Tue, 9 Apr 2024 18:28:19 -0600
+Subject: [PATCH 104/115] fix: do not use become for changing hostdir
+ ownership, and expose subuid/subgid info
+
+When creating host directories, do not use `become`, because if
+it needs to change ownership, that must be done by `root`, not
+as the rootless podman user.
+
+In order to test this, I have changed the role to export the subuid and subgid
+information for the rootless users as two dictionaries:
+`podman_subuid_info` and `podman_subgid_info`.  See `README.md` for
+usage.
+
+NOTE that depending on the namespace used by your containers, you might not
+be able to use the subuid and subgid information, which comes from `getsubids`
+if available, or directly from the files `/etc/subuid` and `/etc/subgid` on
+the host.
+
+QE: The test tests_basic.yml has been extended for this.
+
+Signed-off-by: Rich Megginson <rmeggins@redhat.com>
+(cherry picked from commit 3d02eb725355088df6c707717547f5ad6b7c400c)
+---
+ README.md                            | 28 ++++++++++++
+ tasks/create_update_kube_spec.yml    |  2 -
+ tasks/create_update_quadlet_spec.yml |  2 -
+ tasks/handle_user_group.yml          | 66 +++++++++++++++++++++-------
+ tests/tests_basic.yml                |  2 +
+ 5 files changed, 79 insertions(+), 21 deletions(-)
+
+diff --git a/README.md b/README.md
+index ea1edfb..e5a7c12 100644
+--- a/README.md
++++ b/README.md
+@@ -418,6 +418,34 @@ PodmanArgs=--secret=my-app-pwd,type=env,target=MYAPP_PASSWORD
+ {% endif %}
+ ```
+ 
++### podman_subuid_info, podman_subgid_info
++
++The role needs to ensure any users and groups are present in the subuid and
++subgid information.  Once it extracts this data, it will be available in
++`podman_subuid_info` and `podman_subgid_info`. These are dicts.  The key is the
++user or group name, and the value is a `dict` with two fields:
++
++* `start` - the start of the id range for that user or group, as an `int`
++* `range` - the id range for that user or group, as an `int`
++
++```yaml
++podman_host_directories:
++  "/var/lib/db":
++    mode: "0777"
++    owner: "{{ 1001 + podman_subuid_info['dbuser']['start'] - 1 }}"
++    group: "{{ 1001 + podman_subgid_info['dbgroup']['start'] - 1 }}"
++```
++
++Where `1001` is the uid for user `dbuser`, and `1001` is the gid for group
++`dbgroup`.
++
++**NOTE**: depending on the namespace used by your containers, you might not be
++able to use the subuid and subgid information, which comes from `getsubids` if
++available, or directly from the files `/etc/subuid` and `/etc/subgid` on the
++host.  See
++[podman user namespace modes](https://www.redhat.com/sysadmin/rootless-podman-user-namespace-modes)
++for more information.
++
+ ## Example Playbooks
+ 
+ Create rootless container with volume mount:
+diff --git a/tasks/create_update_kube_spec.yml b/tasks/create_update_kube_spec.yml
+index 95d7d35..7a8ba9c 100644
+--- a/tasks/create_update_kube_spec.yml
++++ b/tasks/create_update_kube_spec.yml
+@@ -32,8 +32,6 @@
+     __defaults: "{{ {'path': item} | combine(__podman_hostdirs_defaults) |
+       combine(__owner_group) }}"
+   loop: "{{ __podman_volumes }}"
+-  become: "{{ __podman_rootless | ternary(true, omit) }}"
+-  become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
+   when:
+     - podman_create_host_directories | bool
+     - __podman_volumes | d([]) | length > 0
+diff --git a/tasks/create_update_quadlet_spec.yml b/tasks/create_update_quadlet_spec.yml
+index c3e0095..062c105 100644
+--- a/tasks/create_update_quadlet_spec.yml
++++ b/tasks/create_update_quadlet_spec.yml
+@@ -16,8 +16,6 @@
+     __defaults: "{{ {'path': item} | combine(__podman_hostdirs_defaults) |
+       combine(__owner_group) }}"
+   loop: "{{ __podman_volumes }}"
+-  become: "{{ __podman_rootless | ternary(true, omit) }}"
+-  become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
+   when:
+     - podman_create_host_directories | bool
+     - __podman_volumes | d([]) | length > 0
+diff --git a/tasks/handle_user_group.yml b/tasks/handle_user_group.yml
+index 17300b6..ea9984d 100644
+--- a/tasks/handle_user_group.yml
++++ b/tasks/handle_user_group.yml
+@@ -52,10 +52,26 @@
+     - name: Check user with getsubids
+       command: getsubids {{ __podman_user | quote }}
+       changed_when: false
++      register: __podman_register_subuids
+ 
+     - name: Check group with getsubids
+       command: getsubids -g {{ __podman_group_name | quote }}
+       changed_when: false
++      register: __podman_register_subgids
++
++    - name: Set user subuid and subgid info
++      set_fact:
++        podman_subuid_info: "{{ podman_subuid_info | d({}) |
++          combine({__podman_user:
++            {'start': __subuid_data[2] | int, 'range': __subuid_data[3] | int}})
++          if __subuid_data | length > 0 else podman_subuid_info | d({}) }}"
++        podman_subgid_info: "{{ podman_subgid_info | d({}) |
++          combine({__podman_group_name:
++            {'start': __subgid_data[2] | int, 'range': __subgid_data[3] | int}})
++          if __subgid_data | length > 0 else podman_subgid_info | d({}) }}"
++      vars:
++        __subuid_data: "{{ __podman_register_subuids.stdout.split() | list }}"
++        __subgid_data: "{{ __podman_register_subgids.stdout.split() | list }}"
+ 
+ - name: Check subuid, subgid files if no getsubids
+   when:
+@@ -63,32 +79,48 @@
+     - __podman_user not in ["root", "0"]
+     - __podman_group not in ["root", "0"]
+   block:
+-    - name: Check if user is in subuid file
+-      find:
+-        path: /etc
+-        pattern: subuid
+-        use_regex: true
+-        contains: "^{{ __podman_user }}:.*$"
+-      register: __podman_uid_line_found
++    - name: Get subuid file
++      slurp:
++        path: /etc/subuid
++      register: __podman_register_subuids
++
++    - name: Get subgid file
++      slurp:
++        path: /etc/subgid
++      register: __podman_register_subgids
++
++    - name: Set user subuid and subgid info
++      set_fact:
++        podman_subuid_info: "{{ podman_subuid_info | d({}) |
++          combine({__podman_user:
++            {'start': __subuid_data[1] | int, 'range': __subuid_data[2] | int}})
++          if __subuid_data else podman_subuid_info | d({}) }}"
++        podman_subgid_info: "{{ podman_subgid_info | d({}) |
++          combine({__podman_group_name:
++            {'start': __subgid_data[1] | int, 'range': __subgid_data[2] | int}})
++          if __subgid_data else podman_subgid_info | d({}) }}"
++      vars:
++        __subuid_match_line: "{{
++          (__podman_register_subuids.content | b64decode).split('\n') | list |
++          select('match', '^' ~ __podman_user ~ ':') | list }}"
++        __subuid_data: "{{ __subuid_match_line[0].split(':') | list
++          if __subuid_match_line else null }}"
++        __subgid_match_line: "{{
++          (__podman_register_subgids.content | b64decode).split('\n') | list |
++          select('match', '^' ~ __podman_group_name ~ ':') | list }}"
++        __subgid_data: "{{ __subgid_match_line[0].split(':') | list
++          if __subgid_match_line else null }}"
+ 
+     - name: Fail if user not in subuid file
+       fail:
+         msg: >
+           The given podman user [{{ __podman_user }}] is not in the
+           /etc/subuid file - cannot continue
+-      when: not __podman_uid_line_found.matched
+-
+-    - name: Check if group is in subgid file
+-      find:
+-        path: /etc
+-        pattern: subgid
+-        use_regex: true
+-        contains: "^{{ __podman_group_name }}:.*$"
+-      register: __podman_gid_line_found
++      when: not __podman_user in podman_subuid_info
+ 
+     - name: Fail if group not in subgid file
+       fail:
+         msg: >
+           The given podman group [{{ __podman_group_name }}] is not in the
+           /etc/subgid file - cannot continue
+-      when: not __podman_gid_line_found.matched
++      when: not __podman_group_name in podman_subuid_info
+diff --git a/tests/tests_basic.yml b/tests/tests_basic.yml
+index d578b15..121c3a7 100644
+--- a/tests/tests_basic.yml
++++ b/tests/tests_basic.yml
+@@ -8,6 +8,8 @@
+     podman_host_directories:
+       "/tmp/httpd1-create":
+         mode: "0777"
++        owner: "{{ 1001 + podman_subuid_info['user1']['start'] - 1 }}"
++        group: "{{ 1001 + podman_subgid_info['user1']['start'] - 1 }}"
+     podman_run_as_user: root
+     test_names_users:
+       - [httpd1, user1, 1001]
+-- 
+2.46.0
+

SOURCES/0105-chore-change-no_log-false-to-true-fix-comment.patch

@@ -0,0 +1,42 @@
+From 7978bed4d52e44feae114ba56e9b5035b7dd2c1c Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Wed, 17 Apr 2024 10:14:21 -0600
+Subject: [PATCH 105/115] chore: change no_log false to true; fix comment
+
+Forgot to change a `no_log: false` back to `no_log: true` when debugging.
+Fix an error in a comment
+
+Signed-off-by: Rich Megginson <rmeggins@redhat.com>
+(cherry picked from commit b37ee8fc7e12317660cca765760c32bd4ba91035)
+---
+ tasks/handle_secret.yml | 2 +-
+ vars/main.yml           | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tasks/handle_secret.yml b/tasks/handle_secret.yml
+index b3677ef..02bc15b 100644
+--- a/tasks/handle_secret.yml
++++ b/tasks/handle_secret.yml
+@@ -39,7 +39,7 @@
+   become: "{{ __podman_rootless | ternary(true, omit) }}"
+   become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
+   when: not __podman_rootless or __podman_xdg_stat.stat.exists
+-  no_log: false
++  no_log: true
+   vars:
+     __params: |
+       {% set rc = {} %}
+diff --git a/vars/main.yml b/vars/main.yml
+index 47293c5..38402ff 100644
+--- a/vars/main.yml
++++ b/vars/main.yml
+@@ -74,5 +74,5 @@ __podman_user_kube_path: "/.config/containers/ansible-kubernetes.d"
+ # location for system quadlet files
+ __podman_system_quadlet_path: "/etc/containers/systemd"
+ 
+-# location for user kubernetes yaml files
++# location for user quadlet files
+ __podman_user_quadlet_path: "/.config/containers/systemd"
+-- 
+2.46.0
+

SOURCES/0106-fix-make-kube-cleanup-idempotent.patch

@@ -0,0 +1,214 @@
+From 07053a415b4a0bde557f28f6f607250915e908e6 Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Wed, 17 Apr 2024 11:35:52 -0600
+Subject: [PATCH 106/115] fix: make kube cleanup idempotent
+
+Cause: The task that calls podman_play was not checking if the kube yaml
+file existed when cleaning up.
+
+Consequence: The task would give an error that the pod could not be
+removed.
+
+Fix: Do not attempt to remove the pod if the kube yaml file does not
+exist.
+
+Result: Calling the podman role repeatedly to remove a kube spec
+will not fail and will not report changes for subsequent removals.
+
+QE: tests_basic.yml has been changed to check for this case
+
+Signed-off-by: Rich Megginson <rmeggins@redhat.com>
+(cherry picked from commit e506f39b6608613a5801190091a72b013b85a888)
+---
+ tasks/cleanup_kube_spec.yml |  9 +++++-
+ tests/tests_basic.yml       | 62 ++++++++++++++++++++++++++-----------
+ 2 files changed, 52 insertions(+), 19 deletions(-)
+
+diff --git a/tasks/cleanup_kube_spec.yml b/tasks/cleanup_kube_spec.yml
+index c864179..b6b47bd 100644
+--- a/tasks/cleanup_kube_spec.yml
++++ b/tasks/cleanup_kube_spec.yml
+@@ -25,6 +25,11 @@
+   vars:
+     __service_error: Could not find the requested service
+ 
++- name: Check if kube file exists
++  stat:
++    path: "{{ __podman_kube_file }}"
++  register: __podman_kube_file_stat
++
+ - name: Remove pod/containers
+   containers.podman.podman_play: "{{ __podman_kube_spec |
+     combine({'kube_file': __podman_kube_file}) }}"
+@@ -33,7 +38,9 @@
+   become: "{{ __podman_rootless | ternary(true, omit) }}"
+   become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
+   register: __podman_removed
+-  when: not __podman_rootless or __podman_xdg_stat.stat.exists
++  when:
++    - not __podman_rootless or __podman_xdg_stat.stat.exists
++    - __podman_kube_file_stat.stat.exists
+ 
+ - name: Remove kubernetes yaml file
+   file:
+diff --git a/tests/tests_basic.yml b/tests/tests_basic.yml
+index 121c3a7..b8ddc50 100644
+--- a/tests/tests_basic.yml
++++ b/tests/tests_basic.yml
+@@ -6,13 +6,16 @@
+     - vars/test_vars.yml
+   vars:
+     podman_host_directories:
+-      "/tmp/httpd1-create":
++      "{{ __test_tmpdir.path ~ '/httpd1-create' }}":
+         mode: "0777"
+-        owner: "{{ 1001 + podman_subuid_info['user1']['start'] - 1 }}"
+-        group: "{{ 1001 + podman_subgid_info['user1']['start'] - 1 }}"
++        owner: "{{ 1001 +
++          podman_subuid_info[__podman_test_username]['start'] - 1 }}"
++        group: "{{ 1001 +
++          podman_subgid_info[__podman_test_username]['start'] - 1 }}"
+     podman_run_as_user: root
++    __podman_test_username: podman_basic_user
+     test_names_users:
+-      - [httpd1, user1, 1001]
++      - [httpd1, "{{ __podman_test_username }}", 1001]
+       - [httpd2, root, 0]
+       - [httpd3, root, 0]
+     podman_create_host_directories: true
+@@ -26,7 +29,7 @@
+       - state: started
+         debug: true
+         log_level: debug
+-        run_as_user: user1
++        run_as_user: "{{ __podman_test_username }}"
+         kube_file_content:
+           apiVersion: v1
+           kind: Pod
+@@ -57,10 +60,10 @@
+             volumes:
+               - name: www
+                 hostPath:
+-                  path: /tmp/httpd1
++                  path: "{{ __test_tmpdir.path ~ '/httpd1' }}"
+               - name: create
+                 hostPath:
+-                  path: /tmp/httpd1-create
++                  path: "{{ __test_tmpdir.path ~ '/httpd1-create' }}"
+       - state: started
+         debug: true
+         log_level: debug
+@@ -94,10 +97,10 @@
+             volumes:
+               - name: www
+                 hostPath:
+-                  path: /tmp/httpd2
++                  path: "{{ __test_tmpdir.path ~ '/httpd2' }}"
+               - name: create
+                 hostPath:
+-                  path: /tmp/httpd2-create
++                  path: "{{ __test_tmpdir.path ~ '/httpd2-create' }}"
+     __podman_kube_file_content: |
+       apiVersion: v1
+       kind: Pod
+@@ -128,11 +131,23 @@
+         volumes:
+           - name: www
+             hostPath:
+-              path: /tmp/httpd3
++              path: "{{ __test_tmpdir.path ~ '/httpd3' }}"
+           - name: create
+             hostPath:
+-              path: /tmp/httpd3-create
++              path: "{{ __test_tmpdir.path ~ '/httpd3-create' }}"
+   tasks:
++    - name: Create tmpdir for testing
++      tempfile:
++        state: directory
++        prefix: lsr_
++        suffix: _podman
++      register: __test_tmpdir
++
++    - name: Change tmpdir permissions
++      file:
++        path: "{{ __test_tmpdir.path }}"
++        mode: "0777"
++
+     - name: Run basic tests
+       vars:
+         __podman_use_kube_file:
+@@ -156,7 +171,7 @@
+ 
+         - name: Create user
+           user:
+-            name: user1
++            name: "{{ __podman_test_username }}"
+             uid: 1001
+ 
+         - name: Create tempfile for kube_src
+@@ -171,12 +186,12 @@
+           copy:
+             content: "{{ __podman_kube_file_content }}"
+             dest: "{{ __kube_file_src.path }}"
+-            mode: 0600
++            mode: "0600"
+           delegate_to: localhost
+ 
+         - name: Create host directories for data
+           file:
+-            path: /tmp/{{ item[0] }}
++            path: "{{ __test_tmpdir.path ~ '/' ~ item[0] }}"
+             state: directory
+             mode: "0755"
+             owner: "{{ item[1] }}"
+@@ -184,7 +199,7 @@
+ 
+         - name: Create data files
+           copy:
+-            dest: /tmp/{{ item[0] }}/index.txt
++            dest: "{{ __test_tmpdir.path ~ '/' ~ item[0] ~ '/index.txt' }}"
+             content: "123"
+             mode: "0644"
+             owner: "{{ item[1] }}"
+@@ -315,7 +330,7 @@
+           loop: [15001, 15002]
+ 
+         - name: Check host directories
+-          command: ls -alrtF /tmp/{{ item[0] }}-create
++          command: ls -alrtF {{ __test_tmpdir.path ~ '/' ~ item[0] }}-create
+           loop: "{{ test_names_users }}"
+           changed_when: false
+ 
+@@ -419,6 +434,18 @@
+           register: __stat
+           failed_when: __stat.stat.exists
+ 
++        - name: Remove pods and units again - test idempotence
++          include_role:
++            name: linux-system-roles.podman
++          vars:
++            # noqa jinja[spacing]
++            podman_kube_specs: "{{ __podman_kube_specs |
++              union([__podman_use_kube_file]) |
++              map('combine', {'state':'absent'}) | list }}"
++            podman_create_host_directories: false
++            podman_firewall: []
++            podman_selinux_ports: []
++
+       rescue:
+         - name: Dump journal
+           command: journalctl -ex
+@@ -438,9 +465,8 @@
+ 
+         - name: Clean up host directories
+           file:
+-            path: /tmp/{{ item }}
++            path: "{{ __test_tmpdir.path }}"
+             state: absent
+-          loop: [httpd1, httpd2, httpd3]
+           tags:
+             - tests::cleanup
+ 
+-- 
+2.46.0
+

SOURCES/0107-chore-use-none-in-jinja-code-not-null.patch

@@ -0,0 +1,35 @@
+From 0a8ce32cdc093c388718d4fe28007259ac86854d Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Thu, 18 Apr 2024 08:39:33 -0600
+Subject: [PATCH 107/115] chore: use none in jinja code, not null
+
+Must use `none` in Jinja code, not `null`, which is used in YAML.
+
+Signed-off-by: Rich Megginson <rmeggins@redhat.com>
+(cherry picked from commit fdf98595e9ecdacfed80d40c2539b18c7d715368)
+---
+ tasks/handle_user_group.yml | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tasks/handle_user_group.yml b/tasks/handle_user_group.yml
+index ea9984d..0b98d99 100644
+--- a/tasks/handle_user_group.yml
++++ b/tasks/handle_user_group.yml
+@@ -104,12 +104,12 @@
+           (__podman_register_subuids.content | b64decode).split('\n') | list |
+           select('match', '^' ~ __podman_user ~ ':') | list }}"
+         __subuid_data: "{{ __subuid_match_line[0].split(':') | list
+-          if __subuid_match_line else null }}"
++          if __subuid_match_line else none }}"
+         __subgid_match_line: "{{
+           (__podman_register_subgids.content | b64decode).split('\n') | list |
+           select('match', '^' ~ __podman_group_name ~ ':') | list }}"
+         __subgid_data: "{{ __subgid_match_line[0].split(':') | list
+-          if __subgid_match_line else null }}"
++          if __subgid_match_line else none }}"
+ 
+     - name: Fail if user not in subuid file
+       fail:
+-- 
+2.46.0
+

SOURCES/0108-uid-1001-conflicts-on-some-test-systems.patch

@@ -0,0 +1,44 @@
+From 4824891e596c197e49557d9d2679cabc76e598e9 Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Fri, 19 Apr 2024 07:33:41 -0600
+Subject: [PATCH 108/115] uid 1001 conflicts on some test systems
+
+(cherry picked from commit 5b7ad16d23b78f6f0f68638c0d69015ebb26b3b0)
+---
+ tests/tests_basic.yml | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tests/tests_basic.yml b/tests/tests_basic.yml
+index b8ddc50..c91cc5f 100644
+--- a/tests/tests_basic.yml
++++ b/tests/tests_basic.yml
+@@ -8,14 +8,14 @@
+     podman_host_directories:
+       "{{ __test_tmpdir.path ~ '/httpd1-create' }}":
+         mode: "0777"
+-        owner: "{{ 1001 +
++        owner: "{{ 3001 +
+           podman_subuid_info[__podman_test_username]['start'] - 1 }}"
+-        group: "{{ 1001 +
++        group: "{{ 3001 +
+           podman_subgid_info[__podman_test_username]['start'] - 1 }}"
+     podman_run_as_user: root
+     __podman_test_username: podman_basic_user
+     test_names_users:
+-      - [httpd1, "{{ __podman_test_username }}", 1001]
++      - [httpd1, "{{ __podman_test_username }}", 3001]
+       - [httpd2, root, 0]
+       - [httpd3, root, 0]
+     podman_create_host_directories: true
+@@ -172,7 +172,7 @@
+         - name: Create user
+           user:
+             name: "{{ __podman_test_username }}"
+-            uid: 1001
++            uid: 3001
+ 
+         - name: Create tempfile for kube_src
+           tempfile:
+-- 
+2.46.0
+

SOURCES/0109-fix-ansible-lint-octal-value-issues.patch

@@ -0,0 +1,26 @@
+From 2343663a17a42e71aa5b78ad5deca72823a0afb0 Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Mon, 3 Jun 2024 13:15:07 -0600
+Subject: [PATCH 109/115] fix ansible-lint octal value issues
+
+(cherry picked from commit c684c68151f106b4a494bed865e138a0b54ecb43)
+---
+ tests/tests_quadlet_demo.yml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/tests_quadlet_demo.yml b/tests/tests_quadlet_demo.yml
+index a719f9c..259a694 100644
+--- a/tests/tests_quadlet_demo.yml
++++ b/tests/tests_quadlet_demo.yml
+@@ -98,7 +98,7 @@
+           get_url:
+             url: https://localhost:8000
+             dest: /run/out
+-            mode: 0600
++            mode: "0600"
+             validate_certs: false
+           register: __web_status
+           until: __web_status is success
+-- 
+2.46.0
+

SOURCES/0110-fix-grab-name-of-network-to-remove-from-quadlet-file.patch

@@ -0,0 +1,308 @@
+From 6a5722ce2a591c57e50ac4ff702c810bf452431d Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Thu, 6 Jun 2024 15:20:22 -0600
+Subject: [PATCH 110/115] fix: grab name of network to remove from quadlet file
+
+Cause: The code was using "systemd-" + name of quadlet for
+the network name when removing networks.
+
+Consequence: If the quadlet had a different NetworkName, the
+removal would fail.
+
+Fix: Grab the network quadlet file and grab the NetworkName from
+the file to use to remove the network.
+
+Result: The removal of quadlet networks will work both with and
+without a custom NetworkName in the quadlet file.
+
+Signed-off-by: Rich Megginson <rmeggins@redhat.com>
+
+This also adds a fix for el10 and Fedora which installs the iptables-nft
+package to allow rootless podman to manage networks using nftables.
+
+(cherry picked from commit bcd5a750250736a07605c72f98e50c1babcddf16)
+---
+ .ostree/packages-runtime-CentOS-10.txt |  3 ++
+ .ostree/packages-runtime-Fedora.txt    |  3 ++
+ .ostree/packages-runtime-RedHat-10.txt |  3 ++
+ tasks/cleanup_quadlet_spec.yml         | 43 +++++++++++++++++++++++++-
+ tests/files/quadlet-basic.network      |  5 +++
+ tests/tests_quadlet_basic.yml          | 31 +++++++------------
+ tests/tests_quadlet_demo.yml           | 19 +++---------
+ vars/CentOS_10.yml                     |  7 +++++
+ vars/Fedora.yml                        |  7 +++++
+ vars/RedHat_10.yml                     |  7 +++++
+ 10 files changed, 94 insertions(+), 34 deletions(-)
+ create mode 100644 .ostree/packages-runtime-CentOS-10.txt
+ create mode 100644 .ostree/packages-runtime-Fedora.txt
+ create mode 100644 .ostree/packages-runtime-RedHat-10.txt
+ create mode 100644 tests/files/quadlet-basic.network
+ create mode 100644 vars/CentOS_10.yml
+ create mode 100644 vars/Fedora.yml
+ create mode 100644 vars/RedHat_10.yml
+
+diff --git a/.ostree/packages-runtime-CentOS-10.txt b/.ostree/packages-runtime-CentOS-10.txt
+new file mode 100644
+index 0000000..16b8eae
+--- /dev/null
++++ b/.ostree/packages-runtime-CentOS-10.txt
+@@ -0,0 +1,3 @@
++iptables-nft
++podman
++shadow-utils-subid
+diff --git a/.ostree/packages-runtime-Fedora.txt b/.ostree/packages-runtime-Fedora.txt
+new file mode 100644
+index 0000000..16b8eae
+--- /dev/null
++++ b/.ostree/packages-runtime-Fedora.txt
+@@ -0,0 +1,3 @@
++iptables-nft
++podman
++shadow-utils-subid
+diff --git a/.ostree/packages-runtime-RedHat-10.txt b/.ostree/packages-runtime-RedHat-10.txt
+new file mode 100644
+index 0000000..16b8eae
+--- /dev/null
++++ b/.ostree/packages-runtime-RedHat-10.txt
+@@ -0,0 +1,3 @@
++iptables-nft
++podman
++shadow-utils-subid
+diff --git a/tasks/cleanup_quadlet_spec.yml b/tasks/cleanup_quadlet_spec.yml
+index ba68771..8ea069b 100644
+--- a/tasks/cleanup_quadlet_spec.yml
++++ b/tasks/cleanup_quadlet_spec.yml
+@@ -30,6 +30,43 @@
+   vars:
+     __service_error: Could not find the requested service
+ 
++- name: See if quadlet file exists
++  stat:
++    path: "{{ __podman_quadlet_file }}"
++  register: __podman_network_stat
++  when: __podman_quadlet_type == "network"
++
++- name: Get network quadlet network name
++  when:
++    - __podman_quadlet_type == "network"
++    - __podman_network_stat.stat.exists
++  block:
++    - name: Create tempdir
++      tempfile:
++        prefix: podman_
++        suffix: _lsr.ini
++        state: directory
++      register: __podman_network_tmpdir
++      delegate_to: localhost
++
++    - name: Fetch the network quadlet
++      fetch:
++        dest: "{{ __podman_network_tmpdir.path }}/network.ini"
++        src: "{{ __podman_quadlet_file }}"
++        flat: true
++
++    - name: Get the network name
++      set_fact:
++        __podman_network_name: "{{
++          lookup('ini', 'NetworkName section=Network file=' ~
++                 __podman_network_tmpdir.path ~ '/network.ini') }}"
++  always:
++    - name: Remove tempdir
++      file:
++        path: "{{ __podman_network_tmpdir.path }}"
++        state: absent
++      delegate_to: localhost
++
+ - name: Remove quadlet file
+   file:
+     path: "{{ __podman_quadlet_file }}"
+@@ -62,10 +99,14 @@
+       changed_when: true
+ 
+     - name: Remove network
+-      command: podman network rm systemd-{{ __podman_quadlet_name }}
++      command: podman network rm {{ __name | quote }}
+       changed_when: true
+       when: __podman_quadlet_type == "network"
+       environment:
+         XDG_RUNTIME_DIR: "{{ __podman_xdg_runtime_dir }}"
+       become: "{{ __podman_rootless | ternary(true, omit) }}"
+       become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
++      vars:
++        __name: "{{ __podman_network_name if
++          __podman_network_name | d('') | length > 0
++          else 'systemd-' ~ __podman_quadlet_name }}"
+diff --git a/tests/files/quadlet-basic.network b/tests/files/quadlet-basic.network
+new file mode 100644
+index 0000000..7db6e0d
+--- /dev/null
++++ b/tests/files/quadlet-basic.network
+@@ -0,0 +1,5 @@
++[Network]
++Subnet=192.168.29.0/24
++Gateway=192.168.29.1
++Label=app=wordpress
++NetworkName=quadlet-basic
+diff --git a/tests/tests_quadlet_basic.yml b/tests/tests_quadlet_basic.yml
+index 1b472be..2891b1a 100644
+--- a/tests/tests_quadlet_basic.yml
++++ b/tests/tests_quadlet_basic.yml
+@@ -19,12 +19,8 @@
+         state: present
+         data: "{{ __json_secret_data | string }}"
+     __podman_quadlet_specs:
+-      - name: quadlet-basic
+-        type: network
+-        Network:
+-          Subnet: 192.168.29.0/24
+-          Gateway: 192.168.29.1
+-          Label: app=wordpress
++      - file_src: files/quadlet-basic.network
++        state: started
+       - name: quadlet-basic-mysql
+         type: volume
+         Volume: {}
+@@ -197,7 +193,8 @@
+           failed_when: not __stat.stat.exists
+ 
+         # must clean up networks last - cannot remove a network
+-        # in use by a container
++        # in use by a container - using reverse assumes the network
++        # is defined first in the list
+         - name: Cleanup user
+           include_role:
+             name: linux-system-roles.podman
+@@ -206,10 +203,7 @@
+             __absent: {"state":"absent"}
+             podman_secrets: "{{ __podman_secrets | map('combine', __absent) |
+               list }}"
+-            podman_quadlet_specs: "{{ ((__podman_quadlet_specs |
+-              rejectattr('type', 'match', '^network$') | list) +
+-              (__podman_quadlet_specs |
+-               selectattr('type', 'match', '^network$') | list)) |
++            podman_quadlet_specs: "{{ __podman_quadlet_specs | reverse |
+               map('combine', __absent) | list }}"
+ 
+         - name: Ensure no linger
+@@ -242,6 +236,11 @@
+           changed_when: false
+ 
+       rescue:
++        - name: Check AVCs
++          command: grep type=AVC /var/log/audit/audit.log
++          changed_when: false
++          failed_when: false
++
+         - name: Dump journal
+           command: journalctl -ex
+           changed_when: false
+@@ -258,10 +257,7 @@
+                 __absent: {"state":"absent"}
+                 podman_secrets: "{{ __podman_secrets |
+                   map('combine', __absent) | list }}"
+-                podman_quadlet_specs: "{{ ((__podman_quadlet_specs |
+-                  rejectattr('type', 'match', '^network$') | list) +
+-                  (__podman_quadlet_specs |
+-                  selectattr('type', 'match', '^network$') | list)) |
++                podman_quadlet_specs: "{{ __podman_quadlet_specs | reverse |
+                   map('combine', __absent) | list }}"
+ 
+             - name: Remove test user
+@@ -277,10 +273,7 @@
+                 __absent: {"state":"absent"}
+                 podman_secrets: "{{ __podman_secrets |
+                   map('combine', __absent) | list }}"
+-                podman_quadlet_specs: "{{ ((__podman_quadlet_specs |
+-                  rejectattr('type', 'match', '^network$') | list) +
+-                  (__podman_quadlet_specs |
+-                  selectattr('type', 'match', '^network$') | list)) |
++                podman_quadlet_specs: "{{ __podman_quadlet_specs | reverse |
+                   map('combine', __absent) | list }}"
+ 
+           rescue:
+diff --git a/tests/tests_quadlet_demo.yml b/tests/tests_quadlet_demo.yml
+index 259a694..b6c27ef 100644
+--- a/tests/tests_quadlet_demo.yml
++++ b/tests/tests_quadlet_demo.yml
+@@ -11,7 +11,7 @@
+     podman_use_copr: false  # disable copr for CI testing
+     podman_fail_if_too_old: false
+     podman_create_host_directories: true
+-    podman_quadlet_specs:
++    __podman_quadlet_specs:
+       - file_src: quadlet-demo.network
+       - file_src: quadlet-demo-mysql.volume
+       - template_src: quadlet-demo-mysql.container.j2
+@@ -45,6 +45,7 @@
+           include_role:
+             name: linux-system-roles.podman
+           vars:
++            podman_quadlet_specs: "{{ __podman_quadlet_specs }}"
+             podman_pull_retry: true
+             podman_secrets:
+               - name: mysql-root-password-container
+@@ -149,19 +150,9 @@
+               include_role:
+                 name: linux-system-roles.podman
+               vars:
+-                podman_quadlet_specs:
+-                  - template_src: quadlet-demo-mysql.container.j2
+-                    state: absent
+-                  - file_src: quadlet-demo-mysql.volume
+-                    state: absent
+-                  - file_src: envoy-proxy-configmap.yml
+-                    state: absent
+-                  - file_src: quadlet-demo.kube
+-                    state: absent
+-                  - template_src: quadlet-demo.yml.j2
+-                    state: absent
+-                  - file_src: quadlet-demo.network
+-                    state: absent
++                __absent: {"state":"absent"}
++                podman_quadlet_specs: "{{ __podman_quadlet_specs |
++                  reverse | map('combine', __absent) | list }}"
+                 podman_secrets:
+                   - name: mysql-root-password-container
+                     state: absent
+diff --git a/vars/CentOS_10.yml b/vars/CentOS_10.yml
+new file mode 100644
+index 0000000..83589d5
+--- /dev/null
++++ b/vars/CentOS_10.yml
+@@ -0,0 +1,7 @@
++# SPDX-License-Identifier: MIT
++---
++# shadow-utils-subid for getsubids
++__podman_packages:
++  - iptables-nft
++  - podman
++  - shadow-utils-subid
+diff --git a/vars/Fedora.yml b/vars/Fedora.yml
+new file mode 100644
+index 0000000..83589d5
+--- /dev/null
++++ b/vars/Fedora.yml
+@@ -0,0 +1,7 @@
++# SPDX-License-Identifier: MIT
++---
++# shadow-utils-subid for getsubids
++__podman_packages:
++  - iptables-nft
++  - podman
++  - shadow-utils-subid
+diff --git a/vars/RedHat_10.yml b/vars/RedHat_10.yml
+new file mode 100644
+index 0000000..83589d5
+--- /dev/null
++++ b/vars/RedHat_10.yml
+@@ -0,0 +1,7 @@
++# SPDX-License-Identifier: MIT
++---
++# shadow-utils-subid for getsubids
++__podman_packages:
++  - iptables-nft
++  - podman
++  - shadow-utils-subid
+-- 
+2.46.0
+

SOURCES/0111-fix-proper-cleanup-for-networks-ensure-cleanup-of-re.patch

@@ -0,0 +1,615 @@
+From e11e1ff198f0840fcef6cbe75c74ca69dd22f694 Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Mon, 8 Jul 2024 16:35:29 -0600
+Subject: [PATCH 111/115] fix: proper cleanup for networks; ensure cleanup of
+ resources
+
+Cause: The code was not managing network systemd quadlet units.
+
+Consequence: Network systemd quadlet units were not being stopped and
+disabled.  Subsequent runs would fail due to the network units not
+being cleaned up properly.
+
+Fix: The role manages network systemd quadlet units, including stopping
+and removing.
+
+Result: Systemd quadlet network units are properly cleaned up.
+
+In addition - improve the removal of all types of quadlet resources,
+and include code which can be used to test and debug quadlet resource
+removal.
+
+(cherry picked from commit a85908ec7f6f8e19908f8d4d18d6d7b64ab1d31e)
+---
+ README.md                                     |   6 +
+ defaults/main.yml                             |   4 +
+ tasks/cancel_linger.yml                       |   2 +-
+ tasks/cleanup_quadlet_spec.yml                | 188 +++++++++++++-----
+ tasks/handle_quadlet_spec.yml                 |   2 +
+ tasks/manage_linger.yml                       |   2 +-
+ tasks/parse_quadlet_file.yml                  |  57 ++++++
+ tests/files/quadlet-basic.network             |   2 +-
+ .../templates/quadlet-demo-mysql.container.j2 |   2 +-
+ tests/tests_quadlet_basic.yml                 |  69 ++++++-
+ tests/tests_quadlet_demo.yml                  |  33 +++
+ 11 files changed, 309 insertions(+), 58 deletions(-)
+ create mode 100644 tasks/parse_quadlet_file.yml
+
+diff --git a/README.md b/README.md
+index e5a7c12..8b6496e 100644
+--- a/README.md
++++ b/README.md
+@@ -388,6 +388,12 @@ a newer version.  For example, if you attempt to manage quadlet or secrets with
+ podman 4.3 or earlier, the role will fail with an error. If you want the role to
+ be skipped instead, use `podman_fail_if_too_old: false`.
+ 
++### podman_prune_images
++
++Boolean - default is `false` - by default, the role will not prune unused images
++when removing quadlets and other resources.  Set this to `true` to tell the role
++to remove unused images when cleaning up.
++
+ ## Variables Exported by the Role
+ 
+ ### podman_version
+diff --git a/defaults/main.yml b/defaults/main.yml
+index 92e4eb8..02453c9 100644
+--- a/defaults/main.yml
++++ b/defaults/main.yml
+@@ -109,3 +109,7 @@ podman_continue_if_pull_fails: false
+ # If true, if a pull attempt fails, it will be retried according
+ # to the default Ansible `until` behavior.
+ podman_pull_retry: false
++
++# Prune images when removing quadlets/kube specs -
++# this will remove all unused/unreferenced images
++podman_prune_images: false
+diff --git a/tasks/cancel_linger.yml b/tasks/cancel_linger.yml
+index ede71fe..f233fc4 100644
+--- a/tasks/cancel_linger.yml
++++ b/tasks/cancel_linger.yml
+@@ -49,7 +49,7 @@
+   when: __podman_xdg_stat.stat.exists
+ 
+ - name: Cancel linger if no more resources are in use
+-  command: loginctl disable-linger {{ __podman_linger_user }}
++  command: loginctl disable-linger {{ __podman_linger_user | quote }}
+   when:
+     - __podman_xdg_stat.stat.exists
+     - __podman_container_info.containers | length == 0
+diff --git a/tasks/cleanup_quadlet_spec.yml b/tasks/cleanup_quadlet_spec.yml
+index 8ea069b..df69243 100644
+--- a/tasks/cleanup_quadlet_spec.yml
++++ b/tasks/cleanup_quadlet_spec.yml
+@@ -33,39 +33,11 @@
+ - name: See if quadlet file exists
+   stat:
+     path: "{{ __podman_quadlet_file }}"
+-  register: __podman_network_stat
+-  when: __podman_quadlet_type == "network"
++  register: __podman_quadlet_stat
+ 
+-- name: Get network quadlet network name
+-  when:
+-    - __podman_quadlet_type == "network"
+-    - __podman_network_stat.stat.exists
+-  block:
+-    - name: Create tempdir
+-      tempfile:
+-        prefix: podman_
+-        suffix: _lsr.ini
+-        state: directory
+-      register: __podman_network_tmpdir
+-      delegate_to: localhost
+-
+-    - name: Fetch the network quadlet
+-      fetch:
+-        dest: "{{ __podman_network_tmpdir.path }}/network.ini"
+-        src: "{{ __podman_quadlet_file }}"
+-        flat: true
+-
+-    - name: Get the network name
+-      set_fact:
+-        __podman_network_name: "{{
+-          lookup('ini', 'NetworkName section=Network file=' ~
+-                 __podman_network_tmpdir.path ~ '/network.ini') }}"
+-  always:
+-    - name: Remove tempdir
+-      file:
+-        path: "{{ __podman_network_tmpdir.path }}"
+-        state: absent
+-      delegate_to: localhost
++- name: Parse quadlet file
++  include_tasks: parse_quadlet_file.yml
++  when: __podman_quadlet_stat.stat.exists
+ 
+ - name: Remove quadlet file
+   file:
+@@ -73,40 +45,158 @@
+     state: absent
+   register: __podman_file_removed
+ 
++- name: Refresh systemd  # noqa no-handler
++  systemd:
++    daemon_reload: true
++    scope: "{{ __podman_systemd_scope }}"
++  become: "{{ __podman_rootless | ternary(true, omit) }}"
++  become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
++  environment:
++    XDG_RUNTIME_DIR: "{{ __podman_xdg_runtime_dir }}"
++  when: __podman_file_removed is changed  # noqa no-handler
++
++- name: Remove managed resource
++  command: >-
++    podman {{ 'rm' if __podman_quadlet_type == 'container'
++      else 'network rm' if __podman_quadlet_type == 'network'
++      else 'volume rm' if __podman_quadlet_type == 'volume' }}
++    {{ __podman_quadlet_resource_name | quote }}
++  register: __podman_rm
++  failed_when:
++    - __podman_rm is failed
++    - not __podman_rm.stderr is search(__str)
++  changed_when: __podman_rm.rc == 0
++  become: "{{ __podman_rootless | ternary(true, omit) }}"
++  become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
++  environment:
++    XDG_RUNTIME_DIR: "{{ __podman_xdg_runtime_dir }}"
++  vars:
++    __str: " found: no such "
++    __type_to_name:  # map quadlet type to quadlet property name
++      container:
++        section: Container
++        name: ContainerName
++      network:
++        section: Network
++        name: NetworkName
++      volume:
++        section: Volume
++        name: VolumeName
++    __section: "{{ __type_to_name[__podman_quadlet_type]['section'] }}"
++    __name: "{{ __type_to_name[__podman_quadlet_type]['name'] }}"
++    __podman_quadlet_resource_name: "{{
++      __podman_quadlet_parsed[__section][__name]
++      if __section in __podman_quadlet_parsed
++      and __name in __podman_quadlet_parsed[__section]
++      else 'systemd-' ~ __podman_quadlet_name }}"
++  when:
++    - __podman_file_removed is changed  # noqa no-handler
++    - __podman_quadlet_type in __type_to_name
++    - not __podman_rootless or __podman_xdg_stat.stat.exists
++    - __podman_service_name | length > 0
++  no_log: true
++
++- name: Remove volumes
++  command: podman volume rm {{ item | quote }}
++  loop: "{{ __volume_names }}"
++  when:
++    - __podman_file_removed is changed  # noqa no-handler
++    - not __podman_rootless or __podman_xdg_stat.stat.exists
++    - __podman_service_name | length == 0
++    - __podman_quadlet_file.endswith(".yml") or
++      __podman_quadlet_file.endswith(".yaml")
++  changed_when: true
++  vars:
++    __volumes: "{{ __podman_quadlet_parsed |
++      selectattr('apiVersion', 'defined') | selectattr('spec', 'defined') |
++      map(attribute='spec') | selectattr('volumes', 'defined') |
++      map(attribute='volumes') | flatten }}"
++    __config_maps: "{{ __volumes | selectattr('configMap', 'defined') |
++      map(attribute='configMap') | selectattr('name', 'defined') |
++      map(attribute='name') | list }}"
++    __secrets: "{{ __volumes | selectattr('secret', 'defined') |
++      map(attribute='secret') | selectattr('secretName', 'defined') |
++      map(attribute='secretName') | list }}"
++    __pvcs: "{{ __volumes | selectattr('persistentVolumeClaim', 'defined') |
++      map(attribute='persistentVolumeClaim') | selectattr('claimName', 'defined') |
++      map(attribute='claimName') | list }}"
++    __volume_names: "{{ __config_maps + __secrets + __pvcs }}"
++  no_log: true
++
++- name: Clear parsed podman variable
++  set_fact:
++    __podman_quadlet_parsed: null
++
++- name: Prune images no longer in use
++  command: podman image prune --all -f
++  when:
++    - podman_prune_images | bool
++    - not __podman_rootless or __podman_xdg_stat.stat.exists
++  changed_when: true
++  become: "{{ __podman_rootless | ternary(true, omit) }}"
++  become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
++  environment:
++    XDG_RUNTIME_DIR: "{{ __podman_xdg_runtime_dir }}"
++
+ - name: Manage linger
+   include_tasks: manage_linger.yml
+   vars:
+     __podman_item_state: absent
+ 
+-- name: Cleanup container resources
+-  when: __podman_file_removed is changed  # noqa no-handler
++- name: Collect information for testing/debugging
++  when:
++    - __podman_test_debug | d(false)
++    - not __podman_rootless or __podman_xdg_stat.stat.exists
+   block:
+-    - name: Reload systemctl  # noqa no-handler
+-      systemd:
+-        daemon_reload: true
+-        scope: "{{ __podman_systemd_scope }}"
++    - name: For testing and debugging - images
++      command: podman images -n
++      register: __podman_test_debug_images
++      changed_when: false
+       become: "{{ __podman_rootless | ternary(true, omit) }}"
+       become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
+       environment:
+         XDG_RUNTIME_DIR: "{{ __podman_xdg_runtime_dir }}"
+ 
+-    - name: Prune images no longer in use
+-      command: podman image prune -f
++    - name: For testing and debugging - volumes
++      command: podman volume ls -n
++      register: __podman_test_debug_volumes
++      changed_when: false
++      become: "{{ __podman_rootless | ternary(true, omit) }}"
++      become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
+       environment:
+         XDG_RUNTIME_DIR: "{{ __podman_xdg_runtime_dir }}"
++
++    - name: For testing and debugging - containers
++      command: podman ps --noheading
++      register: __podman_test_debug_containers
++      changed_when: false
+       become: "{{ __podman_rootless | ternary(true, omit) }}"
+       become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
+-      changed_when: true
++      environment:
++        XDG_RUNTIME_DIR: "{{ __podman_xdg_runtime_dir }}"
++
++    - name: For testing and debugging - networks
++      command: podman network ls -n -q
++      register: __podman_test_debug_networks
++      changed_when: false
++      become: "{{ __podman_rootless | ternary(true, omit) }}"
++      become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
++      environment:
++        XDG_RUNTIME_DIR: "{{ __podman_xdg_runtime_dir }}"
+ 
+-    - name: Remove network
+-      command: podman network rm {{ __name | quote }}
+-      changed_when: true
+-      when: __podman_quadlet_type == "network"
++    - name: For testing and debugging - secrets
++      command: podman secret ls -n -q
++      register: __podman_test_debug_secrets
++      changed_when: false
++      no_log: true
++      become: "{{ __podman_rootless | ternary(true, omit) }}"
++      become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
+       environment:
+         XDG_RUNTIME_DIR: "{{ __podman_xdg_runtime_dir }}"
++
++    - name: For testing and debugging - services
++      service_facts:
+       become: "{{ __podman_rootless | ternary(true, omit) }}"
+       become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
+-      vars:
+-        __name: "{{ __podman_network_name if
+-          __podman_network_name | d('') | length > 0
+-          else 'systemd-' ~ __podman_quadlet_name }}"
++      environment:
++        XDG_RUNTIME_DIR: "{{ __podman_xdg_runtime_dir }}"
+diff --git a/tasks/handle_quadlet_spec.yml b/tasks/handle_quadlet_spec.yml
+index ce6ef67..851c8a3 100644
+--- a/tasks/handle_quadlet_spec.yml
++++ b/tasks/handle_quadlet_spec.yml
+@@ -129,6 +129,8 @@
+       if __podman_quadlet_type in ['container', 'kube']
+       else __podman_quadlet_name ~ '-volume.service'
+       if __podman_quadlet_type in ['volume']
++      else __podman_quadlet_name ~ '-network.service'
++      if __podman_quadlet_type in ['network']
+       else none }}"
+ 
+ - name: Set per-container variables part 4
+diff --git a/tasks/manage_linger.yml b/tasks/manage_linger.yml
+index b506b70..be69490 100644
+--- a/tasks/manage_linger.yml
++++ b/tasks/manage_linger.yml
+@@ -10,7 +10,7 @@
+     - __podman_item_state | d('present') != 'absent'
+   block:
+     - name: Enable linger if needed
+-      command: loginctl enable-linger {{ __podman_user }}
++      command: loginctl enable-linger {{ __podman_user | quote }}
+       when: __podman_rootless | bool
+       args:
+         creates: /var/lib/systemd/linger/{{ __podman_user }}
+diff --git a/tasks/parse_quadlet_file.yml b/tasks/parse_quadlet_file.yml
+new file mode 100644
+index 0000000..5f5297f
+--- /dev/null
++++ b/tasks/parse_quadlet_file.yml
+@@ -0,0 +1,57 @@
++---
++# Input:
++# * __podman_quadlet_file - path to quadlet file to parse
++# Output:
++# * __podman_quadlet_parsed - dict
++- name: Slurp quadlet file
++  slurp:
++    path: "{{ __podman_quadlet_file }}"
++  register: __podman_quadlet_raw
++  no_log: true
++
++- name: Parse quadlet file
++  set_fact:
++    __podman_quadlet_parsed: |-
++      {% set rv = {} %}
++      {% set section = ["DEFAULT"] %}
++      {% for line in __val %}
++      {%   if line.startswith("[") %}
++      {%     set val = line.replace("[", "").replace("]", "") %}
++      {%     set _ = section.__setitem__(0, val) %}
++      {%   else %}
++      {%     set ary = line.split("=", 1) %}
++      {%     set key = ary[0] %}
++      {%     set val = ary[1] %}
++      {%     if key in rv.get(section[0], {}) %}
++      {%       set curval = rv[section[0]][key] %}
++      {%       if curval is string %}
++      {%         set newary = [curval, val] %}
++      {%         set _ = rv[section[0]].__setitem__(key, newary) %}
++      {%       else %}
++      {%         set _ = rv[section[0]][key].append(val) %}
++      {%       endif %}
++      {%     else %}
++      {%       set _ = rv.setdefault(section[0], {}).__setitem__(key, val) %}
++      {%     endif %}
++      {%   endif %}
++      {% endfor %}
++      {{ rv }}
++  vars:
++    __val: "{{ (__podman_quadlet_raw.content | b64decode).split('\n') |
++      select | reject('match', '#') | list }}"
++  when: __podman_service_name | length > 0
++  no_log: true
++
++- name: Parse quadlet yaml file
++  set_fact:
++    __podman_quadlet_parsed: "{{ __podman_quadlet_raw.content | b64decode |
++      from_yaml_all }}"
++  when:
++    - __podman_service_name | length == 0
++    - __podman_quadlet_file.endswith(".yml") or
++      __podman_quadlet_file.endswith(".yaml")
++  no_log: true
++
++- name: Reset raw variable
++  set_fact:
++    __podman_quadlet_raw: null
+diff --git a/tests/files/quadlet-basic.network b/tests/files/quadlet-basic.network
+index 7db6e0d..5b002ba 100644
+--- a/tests/files/quadlet-basic.network
++++ b/tests/files/quadlet-basic.network
+@@ -2,4 +2,4 @@
+ Subnet=192.168.29.0/24
+ Gateway=192.168.29.1
+ Label=app=wordpress
+-NetworkName=quadlet-basic
++NetworkName=quadlet-basic-name
+diff --git a/tests/templates/quadlet-demo-mysql.container.j2 b/tests/templates/quadlet-demo-mysql.container.j2
+index c84f0e8..92097d4 100644
+--- a/tests/templates/quadlet-demo-mysql.container.j2
++++ b/tests/templates/quadlet-demo-mysql.container.j2
+@@ -9,7 +9,7 @@ Volume=/tmp/quadlet_demo:/var/lib/quadlet_demo:Z
+ Network=quadlet-demo.network
+ {% if podman_version is version("4.5", ">=") %}
+ Secret=mysql-root-password-container,type=env,target=MYSQL_ROOT_PASSWORD
+-HealthCmd=/usr/bin/true
++HealthCmd=/bin/true
+ HealthOnFailure=kill
+ {% else %}
+ PodmanArgs=--secret=mysql-root-password-container,type=env,target=MYSQL_ROOT_PASSWORD
+diff --git a/tests/tests_quadlet_basic.yml b/tests/tests_quadlet_basic.yml
+index 2891b1a..0fdced4 100644
+--- a/tests/tests_quadlet_basic.yml
++++ b/tests/tests_quadlet_basic.yml
+@@ -21,7 +21,14 @@
+     __podman_quadlet_specs:
+       - file_src: files/quadlet-basic.network
+         state: started
++      - name: quadlet-basic-unused-network
++        type: network
++        Network: {}
+       - name: quadlet-basic-mysql
++        type: volume
++        Volume:
++          VolumeName: quadlet-basic-mysql-name
++      - name: quadlet-basic-unused-volume
+         type: volume
+         Volume: {}
+       - name: quadlet-basic-mysql
+@@ -30,7 +37,7 @@
+           WantedBy: default.target
+         Container:
+           Image: "{{ mysql_image }}"
+-          ContainerName: quadlet-basic-mysql
++          ContainerName: quadlet-basic-mysql-name
+           Volume: quadlet-basic-mysql.volume:/var/lib/mysql
+           Network: quadlet-basic.network
+           # Once 4.5 is released change this line to use the quadlet Secret key
+@@ -192,13 +199,14 @@
+           register: __stat
+           failed_when: not __stat.stat.exists
+ 
+-        # must clean up networks last - cannot remove a network
+-        # in use by a container - using reverse assumes the network
+-        # is defined first in the list
++        # must clean up in the reverse order of creating - and
++        # ensure networks are removed last
+         - name: Cleanup user
+           include_role:
+             name: linux-system-roles.podman
+           vars:
++            podman_prune_images: true
++            __podman_test_debug: true
+             podman_run_as_user: user_quadlet_basic
+             __absent: {"state":"absent"}
+             podman_secrets: "{{ __podman_secrets | map('combine', __absent) |
+@@ -206,6 +214,22 @@
+             podman_quadlet_specs: "{{ __podman_quadlet_specs | reverse |
+               map('combine', __absent) | list }}"
+ 
++        - name: Ensure no resources
++          assert:
++            that:
++              - __podman_test_debug_images.stdout == ""
++              - __podman_test_debug_networks.stdout_lines |
++                reject("match", "^podman$") |
++                reject("match", "^podman-default-kube-network$") |
++                list | length == 0
++              - __podman_test_debug_volumes.stdout == ""
++              - __podman_test_debug_containers.stdout == ""
++              - __podman_test_debug_secrets.stdout == ""
++              - ansible_facts["services"] | dict2items |
++                rejectattr("value.status", "match", "not-found") |
++                selectattr("key", "match", "quadlet-demo") |
++                list | length == 0
++
+         - name: Ensure no linger
+           stat:
+             path: /var/lib/systemd/linger/user_quadlet_basic
+@@ -230,12 +254,28 @@
+             - quadlet-basic-mysql.volume
+ 
+         - name: Check JSON
+-          command: podman exec quadlet-basic-mysql cat /tmp/test.json
++          command: podman exec quadlet-basic-mysql-name cat /tmp/test.json
+           register: __result
+           failed_when: __result.stdout != __json_secret_data
+           changed_when: false
+ 
+       rescue:
++        - name: Debug3
++          shell: |
++            set -x
++            set -o pipefail
++            exec 1>&2
++            #podman volume rm --all
++            #podman network prune -f
++            podman volume ls
++            podman network ls
++            podman secret ls
++            podman container ls
++            podman pod ls
++            podman images
++            systemctl list-units | grep quadlet
++          changed_when: false
++
+         - name: Check AVCs
+           command: grep type=AVC /var/log/audit/audit.log
+           changed_when: false
+@@ -253,6 +293,7 @@
+               include_role:
+                 name: linux-system-roles.podman
+               vars:
++                podman_prune_images: true
+                 podman_run_as_user: user_quadlet_basic
+                 __absent: {"state":"absent"}
+                 podman_secrets: "{{ __podman_secrets |
+@@ -270,12 +311,30 @@
+               include_role:
+                 name: linux-system-roles.podman
+               vars:
++                podman_prune_images: true
++                __podman_test_debug: true
+                 __absent: {"state":"absent"}
+                 podman_secrets: "{{ __podman_secrets |
+                   map('combine', __absent) | list }}"
+                 podman_quadlet_specs: "{{ __podman_quadlet_specs | reverse |
+                   map('combine', __absent) | list }}"
+ 
++            - name: Ensure no resources
++              assert:
++                that:
++                  - __podman_test_debug_images.stdout == ""
++                  - __podman_test_debug_networks.stdout_lines |
++                    reject("match", "^podman$") |
++                    reject("match", "^podman-default-kube-network$") |
++                    list | length == 0
++                  - __podman_test_debug_volumes.stdout == ""
++                  - __podman_test_debug_containers.stdout == ""
++                  - __podman_test_debug_secrets.stdout == ""
++                  - ansible_facts["services"] | dict2items |
++                    rejectattr("value.status", "match", "not-found") |
++                    selectattr("key", "match", "quadlet-demo") |
++                    list | length == 0
++
+           rescue:
+             - name: Dump journal
+               command: journalctl -ex
+diff --git a/tests/tests_quadlet_demo.yml b/tests/tests_quadlet_demo.yml
+index b6c27ef..1cc7e62 100644
+--- a/tests/tests_quadlet_demo.yml
++++ b/tests/tests_quadlet_demo.yml
+@@ -84,6 +84,11 @@
+           changed_when: false
+           failed_when: false
+ 
++        - name: Check volumes
++          command: podman volume ls
++          changed_when: false
++          failed_when: false
++
+         - name: Check pods
+           command: podman pod ps --ctr-ids --ctr-names --ctr-status
+           changed_when: false
+@@ -150,6 +155,8 @@
+               include_role:
+                 name: linux-system-roles.podman
+               vars:
++                podman_prune_images: true
++                __podman_test_debug: true
+                 __absent: {"state":"absent"}
+                 podman_quadlet_specs: "{{ __podman_quadlet_specs |
+                   reverse | map('combine', __absent) | list }}"
+@@ -161,7 +168,33 @@
+                   - name: envoy-certificates
+                     state: absent
+ 
++            - name: Ensure no resources
++              assert:
++                that:
++                  - __podman_test_debug_images.stdout == ""
++                  - __podman_test_debug_networks.stdout_lines |
++                    reject("match", "^podman$") |
++                    reject("match", "^podman-default-kube-network$") |
++                    list | length == 0
++                  - __podman_test_debug_volumes.stdout == ""
++                  - __podman_test_debug_containers.stdout == ""
++                  - __podman_test_debug_secrets.stdout == ""
++                  - ansible_facts["services"] | dict2items |
++                    rejectattr("value.status", "match", "not-found") |
++                    selectattr("key", "match", "quadlet-demo") |
++                    list | length == 0
++
+           rescue:
++            - name: Debug
++              shell: |
++                exec 1>&2
++                set -x
++                set -o pipefail
++                systemctl list-units --plain -l --all | grep quadlet || :
++                systemctl list-unit-files --all | grep quadlet || :
++                systemctl list-units --plain --failed -l --all | grep quadlet || :
++              changed_when: false
++
+             - name: Get journald
+               command: journalctl -ex
+               changed_when: false
+-- 
+2.46.0
+

SOURCES/0112-fix-Ensure-user-linger-is-closed-on-EL10.patch

@@ -0,0 +1,72 @@
+From 7473a31e3a0201131e42281bce9bbf9c88ac04ca Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Wed, 31 Jul 2024 18:52:57 -0600
+Subject: [PATCH 112/115] fix: Ensure user linger is closed on EL10
+
+Cause: There is an issue with loginctl on EL10 - doing cancel-linger
+will leave the user session in the closing state.
+
+Consequence: User sessions accumulate, and the test user cannot
+be removed.
+
+Fix: As suggested in the systemd issue, the fix is to shutdown and
+restart systemd-logind in this situation.
+
+Result: User cancel-linger works as expected.
+
+Signed-off-by: Rich Megginson <rmeggins@redhat.com>
+(cherry picked from commit 0ceea96a12bf0b462ca62d012d86cdcbd4f20eaa)
+---
+ tasks/cancel_linger.yml | 37 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+diff --git a/tasks/cancel_linger.yml b/tasks/cancel_linger.yml
+index f233fc4..00d38c2 100644
+--- a/tasks/cancel_linger.yml
++++ b/tasks/cancel_linger.yml
+@@ -58,5 +58,42 @@
+       list | length == 0
+     - __podman_linger_secrets.stdout == ""
+   changed_when: true
++  register: __cancel_linger
+   args:
+     removes: /var/lib/systemd/linger/{{ __podman_linger_user }}
++
++- name: Wait for user session to exit closing state  # noqa no-handler
++  command: loginctl show-user -P State {{ __podman_linger_user | quote }}
++  register: __user_state
++  changed_when: false
++  until: __user_state.stdout != "closing"
++  when: __cancel_linger is changed
++  ignore_errors: true
++
++# see https://github.com/systemd/systemd/issues/26744#issuecomment-2261509208
++- name: Handle user stuck in closing state
++  when:
++    - __cancel_linger is changed
++    - __user_state is failed
++  block:
++    - name: Stop logind
++      service:
++        name: systemd-logind
++        state: stopped
++
++    - name: Wait for user session to exit closing state
++      command: loginctl show-user -P State {{ __podman_linger_user | quote }}
++      changed_when: false
++      register: __user_state
++      until: __user_state.stderr is match(__pat) or
++        __user_state.stdout != "closing"
++      failed_when:
++        - not __user_state.stderr is match(__pat)
++        - __user_state.stdout == "closing"
++      vars:
++        __pat: "Failed to get user: User ID .* is not logged in or lingering"
++
++    - name: Restart logind
++      service:
++        name: systemd-logind
++        state: started
+-- 
+2.46.0
+

SOURCES/0113-test-skip-quadlet-tests-on-non-x86_64.patch

@@ -0,0 +1,70 @@
+From acc8e5458170cd653681beee8cec162e1d3e4f1f Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Mon, 19 Aug 2024 10:11:05 -0600
+Subject: [PATCH 113/115] test: skip quadlet tests on non-x86_64
+
+The images we currently use for quadlet testing are only available
+on x86_64
+
+Signed-off-by: Rich Megginson <rmeggins@redhat.com>
+(cherry picked from commit 4a2ab77cafd9ae330f9260a5180680036707bf92)
+---
+ tests/tests_quadlet_basic.yml | 11 +++++++++++
+ tests/tests_quadlet_demo.yml  | 12 ++++++++++++
+ 2 files changed, 23 insertions(+)
+
+diff --git a/tests/tests_quadlet_basic.yml b/tests/tests_quadlet_basic.yml
+index 0fdced4..5a06864 100644
+--- a/tests/tests_quadlet_basic.yml
++++ b/tests/tests_quadlet_basic.yml
+@@ -48,6 +48,17 @@
+             - FOO=/bin/busybox-extras
+             - BAZ=test
+   tasks:
++    - name: Test is only supported on x86_64
++      debug:
++        msg: >
++          This test is only supported on x86_64 because the test images used are only
++          available on that platform.
++      when: ansible_facts["architecture"] != "x86_64"
++
++    - name: End test
++      meta: end_play
++      when: ansible_facts["architecture"] != "x86_64"
++
+     - name: Run test
+       block:
+         - name: See if not pulling images fails
+diff --git a/tests/tests_quadlet_demo.yml b/tests/tests_quadlet_demo.yml
+index 1cc7e62..f08d482 100644
+--- a/tests/tests_quadlet_demo.yml
++++ b/tests/tests_quadlet_demo.yml
+@@ -2,6 +2,7 @@
+ ---
+ - name: Deploy the quadlet demo app
+   hosts: all
++  gather_facts: true
+   vars_files:
+     - vars/test_vars.yml
+   vars:
+@@ -28,6 +29,17 @@
+       "/tmp/quadlet_demo":
+         mode: "0777"
+   tasks:
++    - name: Test is only supported on x86_64
++      debug:
++        msg: >
++          This test is only supported on x86_64 because the test images used are only
++          available on that platform.
++      when: ansible_facts["architecture"] != "x86_64"
++
++    - name: End test
++      meta: end_play
++      when: ansible_facts["architecture"] != "x86_64"
++
+     - name: Run tests
+       block:
+         - name: Generate certificates
+-- 
+2.46.0
+

SOURCES/0114-fix-subgid-maps-user-to-gids-not-group-to-gids.patch

@@ -0,0 +1,208 @@
+From 5367219c4d12b988b531b00a90625cb6747baf13 Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Thu, 29 Aug 2024 08:47:03 -0600
+Subject: [PATCH 114/115] fix: subgid maps user to gids, not group to gids
+
+Cause: The podman role was looking up groups in the subgid values, not
+users.
+
+Consequence: If the user name was different from the group name, the role
+would fail to lookup the subgid values.
+
+Fix: Ensure that the user is used to lookup the subgid values.
+
+Result: The subgid values are looked up correctly.
+
+Signed-off-by: Rich Megginson <rmeggins@redhat.com>
+(cherry picked from commit ad01b0091707fc4eae6f98f694f1a213fb9f8521)
+---
+ README.md                   | 45 ++++++++++++++++++-------------------
+ tasks/handle_user_group.yml | 32 ++++++++------------------
+ 2 files changed, 31 insertions(+), 46 deletions(-)
+
+diff --git a/README.md b/README.md
+index 8b6496e..6222098 100644
+--- a/README.md
++++ b/README.md
+@@ -35,12 +35,11 @@ restrictions:
+ * They must be already present on the system - the role will not create the
+   users or groups - the role will exit with an error if a non-existent user or
+   group is specified
+-* They must already exist in `/etc/subuid` and `/etc/subgid`, or are otherwise
+-  provided by your identity management system - the role will exit with an error
+-  if a specified user is not present in `/etc/subuid`, or if a specified group
+-  is not in `/etc/subgid`.  The role uses `getsubids` to check the user and
+-  group if available, or checks the files directly if `getsubids` is not
+-  available.
++* The user must already exist in `/etc/subuid` and `/etc/subgid`, or otherwise
++  be provided by your identity management system - the role will exit with an
++  error if a specified user is not present in `/etc/subuid` and `/etc/subgid`.
++  The role uses `getsubids` to check the user and group if available, or checks
++  the files directly if `getsubids` is not available.
+ 
+ ## Role Variables
+ 
+@@ -56,14 +55,15 @@ except for the following:
+   * `started` - Create the pods and systemd services, and start them running
+   * `created` - Create the pods and systemd services, but do not start them
+   * `absent` - Remove the pods and systemd services
+-* `run_as_user` - Use this to specify a per-pod user.  If you do not
+-  specify this, then the global default `podman_run_as_user` value will be used.
++* `run_as_user` - Use this to specify a per-pod user.  If you do not specify
++  this, then the global default `podman_run_as_user` value will be used.
+   Otherwise, `root` will be used.  NOTE: The user must already exist - the role
+-  will not create one.  The user must be present in `/etc/subuid`.
+-* `run_as_group` - Use this to specify a per-pod group.  If you do not
+-  specify this, then the global default `podman_run_as_group` value will be
+-  used.  Otherwise, `root` will be used.  NOTE: The group must already exist -
+-  the role will not create one.  The group must be present in `/etc/subgid`.
++  will not create one.  The user must be present in `/etc/subuid` and
++  `/etc/subgid`.
++* `run_as_group` - Use this to specify a per-pod group.  If you do not specify
++  this, then the global default `podman_run_as_group` value will be used.
++  Otherwise, `root` will be used.  NOTE: The group must already exist - the role
++  will not create one.
+ * `systemd_unit_scope` - The scope to use for the systemd unit.  If you do not
+   specify this, then the global default `podman_systemd_unit_scope` will be
+   used.  Otherwise, the scope will be `system` for root containers, and `user`
+@@ -278,14 +278,13 @@ podman_selinux_ports:
+ This is the name of the user to use for all rootless containers.  You can also
+ specify per-container username with `run_as_user` in `podman_kube_specs`.  NOTE:
+ The user must already exist - the role will not create one.  The user must be
+-present in `/etc/subuid`.
++present in `/etc/subuid` and `/etc/subgid`.
+ 
+ ### podman_run_as_group
+ 
+ This is the name of the group to use for all rootless containers.  You can also
+ specify per-container group name with `run_as_group` in `podman_kube_specs`.
+-NOTE: The group must already exist - the role will not create one.  The group must
+-be present in `/etc/subgid`.
++NOTE: The group must already exist - the role will not create one.
+ 
+ ### podman_systemd_unit_scope
+ 
+@@ -426,24 +425,24 @@ PodmanArgs=--secret=my-app-pwd,type=env,target=MYAPP_PASSWORD
+ 
+ ### podman_subuid_info, podman_subgid_info
+ 
+-The role needs to ensure any users and groups are present in the subuid and
++The role needs to ensure any users are present in the subuid and
+ subgid information.  Once it extracts this data, it will be available in
+ `podman_subuid_info` and `podman_subgid_info`. These are dicts.  The key is the
+-user or group name, and the value is a `dict` with two fields:
++user name, and the value is a `dict` with two fields:
+ 
+-* `start` - the start of the id range for that user or group, as an `int`
+-* `range` - the id range for that user or group, as an `int`
++* `start` - the start of the id range for that user, as an `int`
++* `range` - the id range for that user, as an `int`
+ 
+ ```yaml
+ podman_host_directories:
+   "/var/lib/db":
+     mode: "0777"
+     owner: "{{ 1001 + podman_subuid_info['dbuser']['start'] - 1 }}"
+-    group: "{{ 1001 + podman_subgid_info['dbgroup']['start'] - 1 }}"
++    group: "{{ 2001 + podman_subgid_info['dbuser']['start'] - 1 }}"
+ ```
+ 
+-Where `1001` is the uid for user `dbuser`, and `1001` is the gid for group
+-`dbgroup`.
++Where `1001` is the uid for user `dbuser`, and `2001` is the gid for the
++group you want to use.
+ 
+ **NOTE**: depending on the namespace used by your containers, you might not be
+ able to use the subuid and subgid information, which comes from `getsubids` if
+diff --git a/tasks/handle_user_group.yml b/tasks/handle_user_group.yml
+index 0b98d99..2e19cdd 100644
+--- a/tasks/handle_user_group.yml
++++ b/tasks/handle_user_group.yml
+@@ -25,19 +25,6 @@
+       {{ ansible_facts["getent_passwd"][__podman_user][2] }}
+       {%- endif -%}
+ 
+-- name: Get group information
+-  getent:
+-    database: group
+-    key: "{{ __podman_group }}"
+-    fail_key: false
+-  when: "'getent_group' not in ansible_facts or
+-    __podman_group not in ansible_facts['getent_group']"
+-
+-- name: Set group name
+-  set_fact:
+-    __podman_group_name: "{{ ansible_facts['getent_group'].keys() |
+-      list | first }}"
+-
+ - name: See if getsubids exists
+   stat:
+     path: /usr/bin/getsubids
+@@ -49,13 +36,13 @@
+     - __podman_user not in ["root", "0"]
+     - __podman_stat_getsubids.stat.exists
+   block:
+-    - name: Check user with getsubids
++    - name: Check with getsubids for user subuids
+       command: getsubids {{ __podman_user | quote }}
+       changed_when: false
+       register: __podman_register_subuids
+ 
+-    - name: Check group with getsubids
+-      command: getsubids -g {{ __podman_group_name | quote }}
++    - name: Check with getsubids for user subgids
++      command: getsubids -g {{ __podman_user | quote }}
+       changed_when: false
+       register: __podman_register_subgids
+ 
+@@ -66,7 +53,7 @@
+             {'start': __subuid_data[2] | int, 'range': __subuid_data[3] | int}})
+           if __subuid_data | length > 0 else podman_subuid_info | d({}) }}"
+         podman_subgid_info: "{{ podman_subgid_info | d({}) |
+-          combine({__podman_group_name:
++          combine({__podman_user:
+             {'start': __subgid_data[2] | int, 'range': __subgid_data[3] | int}})
+           if __subgid_data | length > 0 else podman_subgid_info | d({}) }}"
+       vars:
+@@ -77,7 +64,6 @@
+   when:
+     - not __podman_stat_getsubids.stat.exists
+     - __podman_user not in ["root", "0"]
+-    - __podman_group not in ["root", "0"]
+   block:
+     - name: Get subuid file
+       slurp:
+@@ -96,7 +82,7 @@
+             {'start': __subuid_data[1] | int, 'range': __subuid_data[2] | int}})
+           if __subuid_data else podman_subuid_info | d({}) }}"
+         podman_subgid_info: "{{ podman_subgid_info | d({}) |
+-          combine({__podman_group_name:
++          combine({__podman_user:
+             {'start': __subgid_data[1] | int, 'range': __subgid_data[2] | int}})
+           if __subgid_data else podman_subgid_info | d({}) }}"
+       vars:
+@@ -107,7 +93,7 @@
+           if __subuid_match_line else none }}"
+         __subgid_match_line: "{{
+           (__podman_register_subgids.content | b64decode).split('\n') | list |
+-          select('match', '^' ~ __podman_group_name ~ ':') | list }}"
++          select('match', '^' ~ __podman_user ~ ':') | list }}"
+         __subgid_data: "{{ __subgid_match_line[0].split(':') | list
+           if __subgid_match_line else none }}"
+ 
+@@ -118,9 +104,9 @@
+           /etc/subuid file - cannot continue
+       when: not __podman_user in podman_subuid_info
+ 
+-    - name: Fail if group not in subgid file
++    - name: Fail if user not in subgid file
+       fail:
+         msg: >
+-          The given podman group [{{ __podman_group_name }}] is not in the
++          The given podman user [{{ __podman_user }}] is not in the
+           /etc/subgid file - cannot continue
+-      when: not __podman_group_name in podman_subuid_info
++      when: not __podman_user in podman_subgid_info
+-- 
+2.46.0
+

SOURCES/0115-fix-Cannot-remove-volumes-from-kube-yaml-need-to-con.patch

@@ -0,0 +1,38 @@
+From c78741d6d5a782f599ee42c6deb89b80426e403d Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Fri, 6 Sep 2024 14:15:20 -0600
+Subject: [PATCH 115/115] fix: Cannot remove volumes from kube yaml - need to
+ convert yaml to list
+
+Cause: __podman_quadlet_parsed was not converted to a list.
+
+Consequence: On older versions of Ansible, the volumes from the kube yaml
+were not removed when removing quadlets.
+
+Fix: Convert __podman_quadlet_parsed to a list after parsing.
+
+Result: Older versions of Ansible can remove volumes specified
+in kube yaml files.
+
+Signed-off-by: Rich Megginson <rmeggins@redhat.com>
+(cherry picked from commit 423c98342c82893aca891d49c63713193dc96222)
+---
+ tasks/parse_quadlet_file.yml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tasks/parse_quadlet_file.yml b/tasks/parse_quadlet_file.yml
+index 5f5297f..2d58c4e 100644
+--- a/tasks/parse_quadlet_file.yml
++++ b/tasks/parse_quadlet_file.yml
+@@ -45,7 +45,7 @@
+ - name: Parse quadlet yaml file
+   set_fact:
+     __podman_quadlet_parsed: "{{ __podman_quadlet_raw.content | b64decode |
+-      from_yaml_all }}"
++      from_yaml_all | list }}"
+   when:
+     - __podman_service_name | length == 0
+     - __podman_quadlet_file.endswith(".yml") or
+-- 
+2.46.0
+

SOURCES/0116-fix-ignore-pod-not-found-errors-when-removing-kube-s.patch

@@ -0,0 +1,68 @@
+From e2040d110ac24ec044973674afc8269ab9ef7c11 Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Fri, 25 Oct 2024 08:55:27 -0600
+Subject: [PATCH 116/117] fix: ignore pod not found errors when removing kube
+ specs
+
+Cause: The module uses the `podman kube play --done` command to remove
+the pod specified by the kube spec, but does not check if the pod has
+already been removed.  That is, it is not idempotent.  The command
+gives an error if the pod is not found.  This only happens with
+podman 4.4.1 on EL8.8 and EL9.2.
+
+Consequence: The podman role gives an error that the pod specified
+by the kube spec cannot be found when removing.
+
+Fix: The role ignores the 'pod not found' error when removing
+a kube spec.
+
+Result: The role does not give an error when removing a kube
+spec.
+
+NOTE: This has been fixed in the containers.podman.podman_play
+module upstream but has not yet been released.
+https://github.com/containers/ansible-podman-collections/pull/863/files#diff-6672fb7f52e2bec3450c2dd7ed9a4385accd9bab8429ea6eecf4d56447f5a1b8R304
+
+Signed-off-by: Rich Megginson <rmeggins@redhat.com>
+(cherry picked from commit 3edc125005c5912926add1539be96cf3b990bb96)
+---
+ tasks/cleanup_kube_spec.yml | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/tasks/cleanup_kube_spec.yml b/tasks/cleanup_kube_spec.yml
+index b6b47bd..36610e6 100644
+--- a/tasks/cleanup_kube_spec.yml
++++ b/tasks/cleanup_kube_spec.yml
+@@ -30,6 +30,11 @@
+     path: "{{ __podman_kube_file }}"
+   register: __podman_kube_file_stat
+ 
++# NOTE: removing kube specs is not idempotent and will give an error on
++# RHEL 8.8 and 9.2 - seems ok on other platforms - this was fixed in the
++# module but is not released yet (as of 20241024)
++# https://github.com/containers/ansible-podman-collections/pull/863/files#diff-6672fb7f52e2bec3450c2dd7ed9a4385accd9bab8429ea6eecf4d56447f5a1b8R304
++# remove this hack when the fix is available
+ - name: Remove pod/containers
+   containers.podman.podman_play: "{{ __podman_kube_spec |
+     combine({'kube_file': __podman_kube_file}) }}"
+@@ -38,9 +43,17 @@
+   become: "{{ __podman_rootless | ternary(true, omit) }}"
+   become_user: "{{ __podman_rootless | ternary(__podman_user, omit) }}"
+   register: __podman_removed
++  failed_when:
++    - __podman_removed is failed
++    - not __podman_removed.msg is search(__err_msg)
++    - not __is_affected_platform
+   when:
+     - not __podman_rootless or __podman_xdg_stat.stat.exists
+     - __podman_kube_file_stat.stat.exists
++  vars:
++    __err_msg: Failed to delete .* with {{ __podman_kube_file }}
++    __is_affected_platform: "{{ ansible_facts['distribution'] == 'RedHat' and
++      ansible_facts['distribution_version'] in ['8.8', '9.2'] }}"
+ 
+ - name: Remove kubernetes yaml file
+   file:
+-- 
+2.47.0
+

SOURCES/0117-test-need-grubby-for-el8-testing-for-ostree.patch

@@ -0,0 +1,33 @@
+From f5d7e3088a8662798ced2294ca9059799b7e1c33 Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Fri, 25 Oct 2024 11:12:08 -0600
+Subject: [PATCH 117/117] test: need grubby for el8 testing for ostree
+
+EL8 tests need grubby for ostree building
+
+Signed-off-by: Rich Megginson <rmeggins@redhat.com>
+(cherry picked from commit 881a03569b6dbebaf9fc9720ffe85039d1d0b72d)
+---
+ .ostree/packages-testing-CentOS-8.txt | 1 +
+ .ostree/packages-testing-RedHat-8.txt | 1 +
+ 2 files changed, 2 insertions(+)
+ create mode 100644 .ostree/packages-testing-CentOS-8.txt
+ create mode 100644 .ostree/packages-testing-RedHat-8.txt
+
+diff --git a/.ostree/packages-testing-CentOS-8.txt b/.ostree/packages-testing-CentOS-8.txt
+new file mode 100644
+index 0000000..ae5e93e
+--- /dev/null
++++ b/.ostree/packages-testing-CentOS-8.txt
+@@ -0,0 +1 @@
++grubby
+diff --git a/.ostree/packages-testing-RedHat-8.txt b/.ostree/packages-testing-RedHat-8.txt
+new file mode 100644
+index 0000000..ae5e93e
+--- /dev/null
++++ b/.ostree/packages-testing-RedHat-8.txt
+@@ -0,0 +1 @@
++grubby
+-- 
+2.47.0
+

SOURCES/0118-fix-make-role-work-on-el-8.8-and-el-9.2-and-podman-v.patch

@@ -0,0 +1,89 @@
+From e8961d4e5ca7765e97d76a76e4741825e697aa8d Mon Sep 17 00:00:00 2001
+From: Rich Megginson <rmeggins@redhat.com>
+Date: Mon, 28 Oct 2024 10:27:59 -0600
+Subject: [PATCH] fix: make role work on el 8.8 and el 9.2 and podman version
+ less than 4.7.0
+
+Cause: Role was using podman and loginctl features not supported on el 8.8/9.2
+and podman versions less than 4.7.0.  NetworkName and VolumeName not supported
+until podman 4.7.0.  loginctl -P not supported in el 8.8/9.2.
+
+Consequence: The role would give failures when managing el 8.8/9.2 machines.
+
+Fix: Do not test with NetworkName and VolumeName when podman version is less
+than 4.7.0.  Use loginctl --value -p instead of -P which will work on all
+versions.
+
+Result: The role can manage el 8.8/9.2 machines.
+
+Signed-off-by: Rich Megginson <rmeggins@redhat.com>
+(cherry picked from commit f16c3fb3c884cf3af446d19aeda86f27dafd1d1e)
+---
+ tasks/cancel_linger.yml                                     | 4 ++--
+ .../quadlet-basic.network.j2}                               | 2 ++
+ tests/tests_quadlet_basic.yml                               | 6 +++---
+ 3 files changed, 7 insertions(+), 5 deletions(-)
+ rename tests/{files/quadlet-basic.network => templates/quadlet-basic.network.j2} (62%)
+
+diff --git a/tasks/cancel_linger.yml b/tasks/cancel_linger.yml
+index 00d38c2..9eb67ff 100644
+--- a/tasks/cancel_linger.yml
++++ b/tasks/cancel_linger.yml
+@@ -63,7 +63,7 @@
+     removes: /var/lib/systemd/linger/{{ __podman_linger_user }}
+ 
+ - name: Wait for user session to exit closing state  # noqa no-handler
+-  command: loginctl show-user -P State {{ __podman_linger_user | quote }}
++  command: loginctl show-user --value -p State {{ __podman_linger_user | quote }}
+   register: __user_state
+   changed_when: false
+   until: __user_state.stdout != "closing"
+@@ -82,7 +82,7 @@
+         state: stopped
+ 
+     - name: Wait for user session to exit closing state
+-      command: loginctl show-user -P State {{ __podman_linger_user | quote }}
++      command: loginctl show-user --value -p State {{ __podman_linger_user | quote }}
+       changed_when: false
+       register: __user_state
+       until: __user_state.stderr is match(__pat) or
+diff --git a/tests/files/quadlet-basic.network b/tests/templates/quadlet-basic.network.j2
+similarity index 62%
+rename from tests/files/quadlet-basic.network
+rename to tests/templates/quadlet-basic.network.j2
+index 5b002ba..3419e3d 100644
+--- a/tests/files/quadlet-basic.network
++++ b/tests/templates/quadlet-basic.network.j2
+@@ -2,4 +2,6 @@
+ Subnet=192.168.29.0/24
+ Gateway=192.168.29.1
+ Label=app=wordpress
++{% if podman_version is version("4.7.0", ">=") %}
+ NetworkName=quadlet-basic-name
++{% endif %}
+diff --git a/tests/tests_quadlet_basic.yml b/tests/tests_quadlet_basic.yml
+index 5a06864..9563a60 100644
+--- a/tests/tests_quadlet_basic.yml
++++ b/tests/tests_quadlet_basic.yml
+@@ -19,15 +19,15 @@
+         state: present
+         data: "{{ __json_secret_data | string }}"
+     __podman_quadlet_specs:
+-      - file_src: files/quadlet-basic.network
++      - template_src: templates/quadlet-basic.network.j2
+         state: started
+       - name: quadlet-basic-unused-network
+         type: network
+         Network: {}
+       - name: quadlet-basic-mysql
+         type: volume
+-        Volume:
+-          VolumeName: quadlet-basic-mysql-name
++        Volume: "{{ {} if podman_version is version('4.7.0', '<')
++          else {'VolumeName': 'quadlet-basic-mysql-name'} }}"
+       - name: quadlet-basic-unused-volume
+         type: volume
+         Volume: {}
+-- 
+2.47.0
+

SOURCES/CHANGELOG.md

@@ -1,23 +1,141 @@
 Changelog
 =========
 
-[1.21.2] - 2023-07-12
+[1.23.0-3] - 2024-09-11
 ----------------------------
 
- ### New Features
+### New Features
 
- - none
+- [bootloader - bootloader role tests do not work on ostree [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58917)
+- [logging - RFE - system-roles - logging: Add truncate options for local file inputs [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58485)
+- [logging - redhat.rhel_system_roles.logging role fails to process logging_outputs: of type: "custom" [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58481)
+- [logging - [RFE] Add the umask settings or enable a variable in linux-system-roles.logging [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58477)
+- [nbde_client - feat: Allow initrd configuration to be skipped [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58519)
 
- ### Bug Fixes
+### Bug Fixes
 
- - [rhc - system role does not apply Insights tags](https://bugzilla.redhat.com/show_bug.cgi?id=2209200)
+- [ - package rhel-system-roles.noarch does not provide docs for ansible-doc [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58465)
+- [ad_integration - fix: Sets domain name lower case in realmd.conf section header [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58494)
+- [bootloader - fix: Set user.cfg path to /boot/grub2/ on EL 9 UEFI [rhel-8]](https://issues.redhat.com/browse/RHEL-45711)
+- [cockpit - cockpit install all wildcard match does not work in newer el9 [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58515)
+- [logging - Setup imuxsock using rhel-system-roles.logging causing an error EL8](https://issues.redhat.com/browse/RHEL-37550)
+- [podman - fix: proper cleanup for networks; ensure cleanup of resources [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58525)
+- [podman - fix: grab name of network to remove from quadlet file [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58511)
+- [podman - Create podman secret when skip_existing=True and it does not exist [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58507)
+- [podman - fix: do not use become for changing hostdir ownership, and expose subuid/subgid info [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58503)
+- [podman - fix: use correct user for cancel linger file name [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58498)
+- [podman - redhat.rhel_system_roles.podman fails to configure and run containers with podman rootless using different username and groupname. [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58460)
+- [sshd - second SSHD service broken [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58473)
+- [storage - rhel-system-role.storage is not idempotent [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58469)
+- [timesync - System Roles: No module documentation [rhel-8.10.z]](https://issues.redhat.com/browse/RHEL-58489)
+
+[1.23.0] - 2024-01-15
+----------------------------
+
+### New Features
+
+- [RHEL for Edge support in system roles](https://issues.redhat.com/browse/RHEL-15872)
+- [ad_integration - feat: Add sssd custom settings](https://issues.redhat.com/browse/RHEL-17667)
+- [ad_integration - Enable AD dynamic DNS updates](https://issues.redhat.com/browse/RHEL-1119)
+- [ad_integration - feat: add ad_integration_preserve_authselect_profile](https://issues.redhat.com/browse/RHEL-21383)
+- [ad_integration - feat: Add SSSD parameters support](https://issues.redhat.com/browse/RHEL-21134)
+- [bootloader - Create bootloader role (MVP)](https://issues.redhat.com/browse/RHEL-3241)
+- [fapolicyd - feat: Import code for fapolicyd system role](https://issues.redhat.com/browse/RHEL-16542)
+- [ha_cluster - [RFE] HA Cluster system role should be able to enable Resilient Storage repository](https://issues.redhat.com/browse/RHEL-14090)
+- [ha_cluster - [FutureFeature] Allow ha_cluster role to configure fencing topology](https://issues.redhat.com/browse/RHEL-4624)
+- [ha_cluster - [FutureFeature] Allow ha_cluster role to configure all qdevice options](https://issues.redhat.com/browse/RHEL-3264)
+- [ha_cluster - Setting cluster members attributes](https://issues.redhat.com/browse/RHEL-22108)
+- [journald - feat: Add support for ForwardToSyslog](https://issues.redhat.com/browse/RHEL-21123)
+- [logging - feat: Add support for the global config option preserveFQDN with a new logg…](https://issues.redhat.com/browse/RHEL-15933)
+- [logging - feat: Add support for general queue and general action parameters](https://issues.redhat.com/browse/RHEL-15440)
+- [metrics - [RFE] Metrics system role support for configuring PMIE webhooks](https://issues.redhat.com/browse/RHEL-18170)
+- [network - Add blackhole type route](https://issues.redhat.com/browse/RHEL-21491)
+- [postgresql - feat: Enable support for Postgresql 16](https://issues.redhat.com/browse/RHEL-18963)
+- [rhc - support RHEL 7 managed nodes](https://issues.redhat.com/browse/RHEL-16977)
+- [rhc - new rhc_insights.ansible_host parameter](https://issues.redhat.com/browse/RHEL-16975)
+- [rhc - new rhc_insights.display_name parameter](https://issues.redhat.com/browse/RHEL-16965)
+- [snapshot - New Role for storage snapshot management (lvm, etc.)](https://issues.redhat.com/browse/RHEL-16553)
+- [sshd - ansible-sshd Manage SSH certificates](https://issues.redhat.com/browse/RHEL-5985)
+- [storage - feat: Support for creating volumes without a FS](https://issues.redhat.com/browse/RHEL-16213)
+- [storage - Basic support for creating shared logical volumes (RHEL 8)](https://issues.redhat.com/browse/RHEL-14022)
+
+### Bug Fixes
+
+- [ha_cluster - high-availability firewall service is not added on qdevice node](https://issues.redhat.com/browse/RHEL-17874)
+- [ha_cluster - Timeout issue between SBD with delay-start and systemd unit](https://issues.redhat.com/browse/RHEL-4684)
+- [kdump - fix: retry read of kexec_crash_size](https://issues.redhat.com/browse/RHEL-3354)
+- [keylime_server - won't detect registrar start failure](https://issues.redhat.com/browse/RHEL-21946)
+- [logging - fix: check that logging_max_message_size is set, not rsyslog_max_message_size](https://issues.redhat.com/browse/RHEL-15038)
+- [nbde_server - fix: Allow tangd socket override directory to be managed outside of the role](https://issues.redhat.com/browse/RHEL-25509)
+- [network - Ansible RHEL network system role issue with ipv6.routing-rules the prefix length for 'from' cannot be zero"](https://issues.redhat.com/browse/RHEL-16501)
+- [podman - fix: cast secret data to string in order to allow JSON valued strings](https://issues.redhat.com/browse/RHEL-22310)
+- [podman - fix: name of volume quadlet service should be basename-volume.service](https://issues.redhat.com/browse/RHEL-21402)
+- [podman - fix: add no_log: true for tasks that can log secret data](https://issues.redhat.com/browse/RHEL-19242)
+- [podman - fix: user linger needed before secrets](https://issues.redhat.com/browse/RHEL-22229)
+- [postgresql - PostgreSQL system role: unable to install PostgreSQL version 15 on RHEL 9](https://issues.redhat.com/browse/RHEL-21400)
+- [selinux - fix: Use `ignore_selinux_state` module option](https://issues.redhat.com/browse/RHEL-15871)
+- [selinux - fix: Print an error message when module to be created doesn't exist](https://issues.redhat.com/browse/RHEL-19044)
+- [selinux - fix: no longer use "item" as a loop variable](https://issues.redhat.com/browse/RHEL-19042)
+
+[1.22.0] - 2023-08-15
+----------------------------
+
+### New Features
+
+- [ALL - fingerprint in config files managed by roles](https://bugzilla.redhat.com/show_bug.cgi?id=2186910)
+- [ad_integration - add ad_integration_force_rejoin](https://bugzilla.redhat.com/show_bug.cgi?id=2211723)
+- [certificate - add mode parameter to change permissions for cert files](https://bugzilla.redhat.com/show_bug.cgi?id=2218204)
+- [firewall - missing module in linux-system-roles.firewall to create an ipset](https://bugzilla.redhat.com/show_bug.cgi?id=2140880)
+- [firewall - fix: reload on resetting to defaults](https://bugzilla.redhat.com/show_bug.cgi?id=2224648)
+- [firewall - should have option to disable conflicting services](https://bugzilla.redhat.com/show_bug.cgi?id=2222809)
+- [ha_cluster - Add possibility to load SBD watchdog kernel modules](https://bugzilla.redhat.com/show_bug.cgi?id=2190478)
+- [ha_cluster - cluster and quorum can have distinct passwords](https://bugzilla.redhat.com/show_bug.cgi?id=2216485)
+- [ha_cluster - support for resource and operation defaults](https://bugzilla.redhat.com/show_bug.cgi?id=2190483)
+- [kdump - support auto_reset_crashkernel, dracut_args, deprecate /etc/sysconfig/kdump](https://bugzilla.redhat.com/show_bug.cgi?id=2211272)
+- [keylime_server - system role for managing keylime servers](https://bugzilla.redhat.com/show_bug.cgi?id=2224387)
+- [network - Support configuring auto-dns setting](https://bugzilla.redhat.com/show_bug.cgi?id=2211273)
+- [network - Support no-aaaa DNS option](https://bugzilla.redhat.com/show_bug.cgi?id=2218595)
+- [podman - allow container networking configuration](https://bugzilla.redhat.com/show_bug.cgi?id=2220963)
+- [podman - support for healthchecks and healthcheck actions](https://bugzilla.redhat.com/show_bug.cgi?id=2220961)
+- [podman - support quadlet units](https://bugzilla.redhat.com/show_bug.cgi?id=2220962)
+- [postgresql - [RFE] system role for PostgreSQL management](https://bugzilla.redhat.com/show_bug.cgi?id=2151371)
+- [rhc - implement rhc_proxy.scheme](https://bugzilla.redhat.com/show_bug.cgi?id=2211778)
+- [rhc - [RFE] New role for Red Hat subscription management, insights management [rhel-8.9.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2179016)
+- [ssh - add ssh_backup option with default true](https://bugzilla.redhat.com/show_bug.cgi?id=2216759)
+- [storage - RFE for the storage system role to support configuring the stripe size for RAID LVM volumes](https://bugzilla.redhat.com/show_bug.cgi?id=2141961)
+- [storage - [RFE] user-specified mount point owner and permissions](https://bugzilla.redhat.com/show_bug.cgi?id=2181661)
+- [systemd - system role for managing systemd units](https://bugzilla.redhat.com/show_bug.cgi?id=2224388)
+
+### Bug Fixes
+
+- [ALL - facts being gathered unnecessarily](https://bugzilla.redhat.com/show_bug.cgi?id=2223036)
+- [ad_integration - leaks credentials when in check_mode](https://bugzilla.redhat.com/show_bug.cgi?id=2233183)
+- [certificate - rhel-system-roles.certificate does not re-issue after updating key_size](https://bugzilla.redhat.com/show_bug.cgi?id=2186057)
+- [firewall - fix: reload on resetting to defaults](https://bugzilla.redhat.com/show_bug.cgi?id=2224648)
+- [firewall - Check mode fails with replacing previous rules](https://issues.redhat.com/browse/RHEL-899)
+- [firewall - Check mode fails when creating new firewall service](https://bugzilla.redhat.com/show_bug.cgi?id=2222433)
+- [firewall - Ansible RHEL firewall system role not idempotent when configuring the interface using the role in rhel9](https://issues.redhat.com/browse/RHEL-918)
+- [firewall - Don't install python(3)-firewall it's a dependency of firewalld](https://bugzilla.redhat.com/show_bug.cgi?id=2216521)
+- [firewall - fix: files: overwrite firewalld.conf on previous replaced](https://issues.redhat.com/browse/RHEL-1496)
+- [kdump - use failure_action instead of default on EL9 and later](https://issues.redhat.com/browse/RHEL-907)
+- [kdump - role: "Write new authorized_keys if needed" task idempotency issues](https://bugzilla.redhat.com/show_bug.cgi?id=2232391)
+- [kdump - system role fails if kdump_ssh_user doesn't have a .ssh/authorized_keys file in home directory](https://bugzilla.redhat.com/show_bug.cgi?id=2232392)
+- [kdump - fix: ensure .ssh directory exists for kdump_ssh_user on kdump_ssh_server](https://issues.redhat.com/browse/RHEL-1398)
+- [kdump - fix: Ensure authorized_keys management works with multiple hosts](https://issues.redhat.com/browse/RHEL-1500)
+- [podman - Podman system role:  Unable to use podman_registries_conf to set unqualified-search-registries](https://bugzilla.redhat.com/show_bug.cgi?id=2226077)
+- [rhc - system role does not apply Insights tags](https://bugzilla.redhat.com/show_bug.cgi?id=2209441)
+- [storage - Cannot set chunk size for RAID: Unsupported parameters for (blivet) module: pools.raid_chunk_size](https://bugzilla.redhat.com/show_bug.cgi?id=2193057)
+- [storage - RAID volume pre cleanup - remove existing data from member disks as needed before creation](https://bugzilla.redhat.com/show_bug.cgi?id=2224094)
+- [storage - Storage: mounted devices that are in use cannot be resized](https://bugzilla.redhat.com/show_bug.cgi?id=2168738)
+- [storage - fix: use stat.pw_name, stat.gr_name instead of owner, group](https://issues.redhat.com/browse/RHEL-1498)
+- [tlog - use the proxy provider - the files provider is deprecated in sssd](https://bugzilla.redhat.com/show_bug.cgi?id=2191702)
 
 [1.21.1] - 2023-03-16
 ----------------------------
 
 ### New Features
 
-- [rhc - New Role - Red Hat subscription management, insights management](https://bugzilla.redhat.com/show_bug.cgi?id=2141330)
+- [rhc - New Role - Red Hat subscription management, insights management](https://bugzilla.redhat.com/show_bug.cgi?id=2144877)
 
 ### Bug Fixes
 
@@ -28,88 +146,76 @@ Changelog
 
 ### New Features
 
-- [ad_integration - New role - manage AD integration, join to AD domain](https://bugzilla.redhat.com/show_bug.cgi?id=2140795)
+- [ad_integration - [RFE] new role to support AD integration, join to AD domain](https://bugilla.redhat.com/show_bug.cgi?id=2144876)
-- [cockpit - convert cockpit role to use firewall, selinux role, and certificate role](https://bugzilla.redhat.com/show_bug.cgi?id=2137663)
+- [cockpit - [RFE] convert cockpit role to use firewall, selinux role, and certificate role](https://bugzilla.redhat.com/show_bug.cgi?id=2137667)
-- [ha_cluster - Allow quorum device configuration](https://bugzilla.redhat.com/show_bug.cgi?id=2140804)
+- [ha_cluster - Allow quorum device configuration](https://bugzilla.redhat.com/show_bug.cgi?id=2143814)
-- [ha_cluster - convert ha_cluster role to use firewall, selinux and certificate role](https://bugzilla.redhat.com/show_bug.cgi?id=2130010)
+- [ha_cluster - [RFE] convert ha_cluster role to use firewall, selinux and certificate role](https://bugzilla.redhat.com/show_bug.cgi?id=2130019)
-- [journald - New role - manage systemd-journald](https://bugzilla.redhat.com/show_bug.cgi?id=2165175)
+- [journald - New role - journald - manage systemd-journald](https://bugzilla.redhat.com/show_bug.cgi?id=2165176)
-- [logging - convert logging role to use firewall, selinux role, and certificate role](https://bugzilla.redhat.com/show_bug.cgi?id=2130357)
+- [logging - [RFE] convert logging role to use firewall, selinux role, and certificate role](https://bugzilla.redhat.com/show_bug.cgi?id=2130362)
-- [metrics - convert metrics role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2133528)
+- [metrics - [RFE] convert metrics role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2133532)
-- [nbde_server - convert nbde_server role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2133930)
+- [nbde_server - [RFE] convert nbde_server role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2133931)
-- [network - Support cloned MAC address](https://bugzilla.redhat.com/show_bug.cgi?id=2143768)
+- [network - Support cloned MAC address](https://bugzilla.redhat.com/show_bug.cgi?id=2143458)
-- [network - Support setting the metric of the default route for initscripts provider](https://bugzilla.redhat.com/show_bug.cgi?id=2134202)
+- [network - [RFE] Support setting the metric of the default route for initscripts provider](https://bugzilla.redhat.com/show_bug.cgi?id=2134201)
-- [network - Support the DNS priority](https://bugzilla.redhat.com/show_bug.cgi?id=2133858)
+- [network - [RFE] Support the DNS priority](https://bugzilla.redhat.com/show_bug.cgi?id=2133856)
-- [network - Support looking up named route table in routing rule](https://bugzilla.redhat.com/show_bug.cgi?id=2131293)
+- [network - Support looking up named route table in routing rule](https://bugzilla.redhat.com/show_bug.cgi?id=2129620)
-- [podman - New role - manage podman containers and systemd](https://bugzilla.redhat.com/show_bug.cgi?id=2143427)
+- [podman - [RFE] role for managing podman containers and systemd](https://bugzilla.redhat.com/show_bug.cgi?id=2066864)
-- [postfix - convert postfix role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2130329)
+- [postfix - [RFE] convert postfix role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2130332)
-- [selinux - add support for the 'local' parameter](https://bugzilla.redhat.com/show_bug.cgi?id=2128843)
+- [selinux - add support for the 'local' parameter](https://bugzilla.redhat.com/show_bug.cgi?id=2143385)
-- [vpn - Add parameters shared_key_content, ike, esp, type, leftid, rightid](https://bugzilla.redhat.com/show_bug.cgi?id=2119102)
+- [vpn - Add parameters shared_key_content, ike, esp, type, leftid, rightid](https://bugzilla.redhat.com/show_bug.cgi?id=2119600)
-- [vpn - convert vpn role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2130344)
+- [vpn - [RFE] convert vpn role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2130345)
 
 ### Bug Fixes
 
-- [ha_cluster - use no_log in tasks looping over pot. secret parameters](https://bugzilla.redhat.com/show_bug.cgi?id=2143816)
+- [ha_cluster - Fix stonith watchdog timeout](https://bugzilla.redhat.com/show_bug.cgi?id=2167941)
-- [ha_cluster - Allow enabled SBD on disabled cluster](https://bugzilla.redhat.com/show_bug.cgi?id=2153030)
+- [ha_cluster - Allow enabled SBD on disabled cluster](https://bugzilla.redhat.com/show_bug.cgi?id=2153081)
-- [ha_cluster - Fix stonith watchdog timeout](https://bugzilla.redhat.com/show_bug.cgi?id=2167528)
+- [ha_cluster - use no_log in tasks looping over pot. secret parameters](https://bugzilla.redhat.com/show_bug.cgi?id=2127497)
-- [nbde_client - must handle clevis-luks-askpass and clevis-luks-askpass@ systemd unit names](https://bugzilla.redhat.com/show_bug.cgi?id=2126959)
+- [nbde_client - nbde_client_clevis fails with a traceback and prints sensitive data](https://bugzilla.redhat.com/show_bug.cgi?id=2159972)
-- [nbde_client - nbde_client_clevis fails with a traceback and prints sensitive data](https://bugzilla.redhat.com/show_bug.cgi?id=2162782)
+- [nbde_client - must handle clevis-luks-askpass and clevis-luks-askpass@ systemd unit names](https://bugzilla.redhat.com/show_bug.cgi?id=2126960)
-- [network - should route traffic via correct bond](https://bugzilla.redhat.com/show_bug.cgi?id=2168735)
+- [network - should route traffic via correct bond](https://bugzilla.redhat.com/show_bug.cgi?id=2168733)
-- [selinux - managing modules is not idempotent](https://bugzilla.redhat.com/show_bug.cgi?id=2160152)
+- [selinux - managing modules is not idempotent](https://bugzilla.redhat.com/show_bug.cgi?id=2164879)
-- [sshd,ssh,timesync - Unexpected templating type error - expected str instance, int found](https://bugzilla.redhat.com/show_bug.cgi?id=2129401)
+- [sshd,ssh,timesync - Unexpected templating type error - expected str instance, int found](https://bugzilla.redhat.com/show_bug.cgi?id=2143401)
-- [tlog - Unconditionally enable the files provider](https://bugzilla.redhat.com/show_bug.cgi?id=2153043)
+- [tlog - Unconditionally enable the files provider](https://bugzilla.redhat.com/show_bug.cgi?id=2153080)
 
-[1.20.1] - 2022-09-27
+[1.20.0] - 2022-08-09
 ----------------------------
 
 ### New Features
 
-- [ssh,sshd - Sync on final OpenSSH option name RequiredRSASize in ssh and sshd roles](https://bugzilla.redhat.com/show_bug.cgi?id=2129873)
+- [cockpit - Add customization of port](https://bugzilla.redhat.com/show_bug.cgi?id=2115159)
+- [firewall - RFE: firewall-system-role: add ability to add interface to zone by PCI device ID](https://bugzilla.redhat.com/show_bug.cgi?id=2100939)
+- [firewall - support for firewall_config - gather firewall facts](https://bugzilla.redhat.com/show_bug.cgi?id=2115160)
+- [logging - [RFE] Support startmsg.regex and endmsg.regex in the files inputs](https://bugzilla.redhat.com/show_bug.cgi?id=2112143)
+- [selinux - Added setting of seuser and selevel for completeness](https://bugzilla.redhat.com/show_bug.cgi?id=2115162)
 
 ### Bug Fixes
 
-- none
+- [nbde_client - Sets proper spacing for parameter rd.neednet=1](https://bugzilla.redhat.com/show_bug.cgi?id=2115161)
-
+- [network - fix IPRouteUtils.get_route_tables_mapping() to accept any whitespace sequence](https://bugzilla.redhat.com/show_bug.cgi?id=2115884)
-[1.20.0] - 2022-08-05
+- [ssh sshd - ssh, sshd: RSAMinSize parameter definition is missing](https://bugzilla.redhat.com/show_bug.cgi?id=2109997)
-----------------------------
+- [storage - [RHEL8] [WARNING]: The loop variable 'storage_test_volume' is already in use. You should set the `loop_var` value in the `loop_control` option for the task to something else to avoid variable collisions and unexpected behavior.](https://bugzilla.redhat.com/show_bug.cgi?id=2082391)
-
-### New Features
-
-- [cockpit - Add customization of port](https://bugzilla.redhat.com/show_bug.cgi?id=2115152)
-- [firewall - RFE: firewall-system-role: add ability to add interface to zone by PCI device ID](https://bugzilla.redhat.com/show_bug.cgi?id=2100942)
-- [firewall - support for firewall_config - gather firewall facts](https://bugzilla.redhat.com/show_bug.cgi?id=2115154)
-- [logging - [RFE] Support startmsg.regex and endmsg.regex in the files inputs](https://bugzilla.redhat.com/show_bug.cgi?id=2112145)
-- [selinux - Added setting of seuser and selevel for completeness](https://bugzilla.redhat.com/show_bug.cgi?id=2115157)
-
-### Bug Fixes
-
-- [nbde_client - Sets proper spacing for parameter rd.neednet=1](https://bugzilla.redhat.com/show_bug.cgi?id=2115156)
-- [network - fix IPRouteUtils.get_route_tables_mapping() to accept any whitespace sequence](https://bugzilla.redhat.com/show_bug.cgi?id=2115886)
-- [ssh sshd - ssh, sshd: RSAMinSize parameter definition is missing](https://bugzilla.redhat.com/show_bug.cgi?id=2109998)
-- [storage - [RHEL9] [WARNING]: The loop variable 'storage_test_volume' is already in use. You should set the `loop_var` value in the `loop_control` option for the task to something else to avoid variable collisions and unexpected behavior.](https://bugzilla.redhat.com/show_bug.cgi?id=2082736)
 
 [1.19.3] - 2022-07-01
 ----------------------------
 
 ### New Features
 
-- [firewall - support add/modify/delete services](https://bugzilla.redhat.com/show_bug.cgi?id=2100292)
+- [firewall - support add/modify/delete services](https://bugzilla.redhat.com/show_bug.cgi?id=2100297)
-- [network - [RFE] [network] Support managing the network through nmstate schema](https://bugzilla.redhat.com/show_bug.cgi?id=2072385)
+- [network - [RFE] [network] Support managing the network through nmstate schema](https://bugzilla.redhat.com/show_bug.cgi?id=2100979)
-- [storage - support for adding/removing disks to/from storage pools](https://bugzilla.redhat.com/show_bug.cgi?id=2072742)
+- [storage - support for adding/removing disks to/from storage pools](https://bugzilla.redhat.com/show_bug.cgi?id=2066880)
-- [storage - support for attaching cache volumes to existing volumes](https://bugzilla.redhat.com/show_bug.cgi?id=2072746)
+- [storage - support for attaching cache volumes to existing volumes](https://bugzilla.redhat.com/show_bug.cgi?id=2066881)
 
 ### Bug Fixes
 
-- [firewall - forward_port should accept list of string or list of dict](https://bugzilla.redhat.com/show_bug.cgi?id=2100605)
+- [firewall - forward_port should accept list of string or list of dict](https://bugzilla.redhat.com/show_bug.cgi?id=2101607)
-- [metrics - document minimum supported redis version required by rhel-system-roles](https://bugzilla.redhat.com/show_bug.cgi?id=2100286)
+- [metrics - document minimum supported redis version required by rhel-system-roles](https://bugzilla.redhat.com/show_bug.cgi?id=2100285)
-- [metrics - restart pmie, pmlogger if changed, do not wait for handler](https://bugzilla.redhat.com/show_bug.cgi?id=2100294)
+- [metrics - restart pmie, pmlogger if changed, do not wait for handler](https://bugzilla.redhat.com/show_bug.cgi?id=2100298)
-- [storage - [RHEL9] _storage_test_pool_pvs get wrong data type in  test-verify-pool-members.yml](https://bugzilla.redhat.com/show_bug.cgi?id=2044119)
 
 [1.19.2] - 2022-06-15
 ----------------------------
 
 ### New Features
 
-- [sshd - system role should be able to optionally manage /etc/ssh/sshd_config on RHEL 9](https://bugzilla.redhat.com/show_bug.cgi?id=2052086)
+- [sshd - system role should be able to optionally manage /etc/ssh/sshd_config on RHEL 9](https://bugzilla.redhat.com/show_bug.cgi?id=2086935)
 
 ### Bug Fixes
 
@@ -120,8 +226,8 @@ Changelog
 
 ### New Features
 
-- [storage - support for creating and managing LVM thin pools/LVs](https://bugzilla.redhat.com/show_bug.cgi?id=2072745)
+- [storage - support for creating and managing LVM thin pools/LVs](https://bugzilla.redhat.com/show_bug.cgi?id=2066876)
-- [All roles should support running with gather_facts: false](https://bugzilla.redhat.com/show_bug.cgi?id=2078989)
+- [All roles should support running with gather_facts: false](https://bugzilla.redhat.com/show_bug.cgi?id=2079008)
 
 ### Bug Fixes
 
@@ -132,56 +238,55 @@ Changelog
 
 ### New Features
 
-- [storage - support for creating and managing LVM thin pools/LVs](https://bugzilla.redhat.com/show_bug.cgi?id=2072745)
+- [storage - support for creating and managing LVM thin pools/LVs](https://bugzilla.redhat.com/show_bug.cgi?id=2066876)
-- [firewall - state no longer required for masquerade and ICMP block inversion](https://bugzilla.redhat.com/show_bug.cgi?id=2093423)
+- [firewall - state no longer required for masquerade and ICMP block inversion](https://bugzilla.redhat.com/show_bug.cgi?id=2093437)
 
 ### Bug Fixes
 
-- [storage - role raid_level "striped" is not supported](https://bugzilla.redhat.com/show_bug.cgi?id=2083410)
+- [storage - role raid_level "striped" is not supported](https://bugzilla.redhat.com/show_bug.cgi?id=2083426)
 
-[1.18.0] - 2022-05-02
+[1.18.0] - 2022-05-26
 ----------------------------
 
 ### New Features
 
-- [firewall - [Improvement] Allow System Role to reset to default Firewalld Settings](https://bugzilla.redhat.com/show_bug.cgi?id=2043010)
+- [firewall - [Improvement] Allow System Role to reset to default Firewalld Settings](https://bugzilla.redhat.com/show_bug.cgi?id=2043009)
-- [metrics - [RFE] add an option to the metrics role to enable postfix metric collection](https://bugzilla.redhat.com/show_bug.cgi?id=2051737)
+- [metrics - [RFE] add an option to the metrics role to enable postfix metric collection](https://bugzilla.redhat.com/show_bug.cgi?id=2079114)
-- [network - Rework the infiniband support](https://bugzilla.redhat.com/show_bug.cgi?id=2086965)
+- [network - Rework the infiniband support](https://bugzilla.redhat.com/show_bug.cgi?id=2086869)
-- [sshd - system role should not assume that RHEL 9 /etc/ssh/sshd_config has "Include > /etc/ssh/sshd_config.d/*.conf"](https://bugzilla.redhat.com/show_bug.cgi?id=2052081)
+- [sshd - system role should not assume that RHEL 9 /etc/ssh/sshd_config has "Include > /etc/ssh/sshd_config.d/*.conf"](https://bugzilla.redhat.com/show_bug.cgi?id=2086934)
-- [sshd - system role should be able to optionally manage /etc/ssh/sshd_config on RHEL 9](https://bugzilla.redhat.com/show_bug.cgi?id=2052086)
+- [sshd - system role should be able to optionally manage /etc/ssh/sshd_config on RHEL 9](https://bugzilla.redhat.com/show_bug.cgi?id=2086935)
 
 ### Bug Fixes
 
-- [storage - role cannot set mount_options for volumes](https://bugzilla.redhat.com/show_bug.cgi?id=2083376)
+- [storage - role cannot set mount_options for volumes](https://bugzilla.redhat.com/show_bug.cgi?id=2083378)
 
 [1.17.0] - 2022-04-25
 ----------------------------
 
 ### New Features
 
-- [All roles should support running with gather_facts: false](https://bugzilla.redhat.com/show_bug.cgi?id=2078989)
+- [All roles should support running with gather_facts: false](https://bugzilla.redhat.com/show_bug.cgi?id=2079008)
-- [ha_cluster - support advanced corosync configuration](https://bugzilla.redhat.com/show_bug.cgi?id=2065337)
+- [ha_cluster - support advanced corosync configuration](https://bugzilla.redhat.com/show_bug.cgi?id=2065339)
-- [ha_cluster - support SBD fencing](https://bugzilla.redhat.com/show_bug.cgi?id=2079626)
+- [ha_cluster - support SBD fencing](https://bugzilla.redhat.com/show_bug.cgi?id=2066868)
-- [ha_cluster - add support for configuring bundle resources](https://bugzilla.redhat.com/show_bug.cgi?id=2073519)
+- [ha_cluster - add support for configuring bundle resources](https://bugzilla.redhat.com/show_bug.cgi?id=2073518)
-- [logging - Logging - RFE - support template, severity and facility options](https://bugzilla.redhat.com/show_bug.cgi?id=2075119)
+- [logging - Logging - RFE - support template, severity and facility options](https://bugzilla.redhat.com/show_bug.cgi?id=2075116)
-- [metrics - consistently use ansible_managed in configuration files managed by role [rhel-9.1.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065392)
+- [metrics - consistently use ansible_managed in configuration files managed by role [rhel-8.7.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065215)
-- [metrics - [RFE] add an option to the metrics role to enable postfix metric collection](https://bugzilla.redhat.com/show_bug.cgi?id=2051737)
+- [metrics - [RFE] add an option to the metrics role to enable postfix metric collection](https://bugzilla.redhat.com/show_bug.cgi?id=2079114)
-- [network - [RFE] Extend rhel-system-roles.network feature set to support routing rules](https://bugzilla.redhat.com/show_bug.cgi?id=2079622)
+- [network - [RFE] Extend rhel-system-roles.network feature set to support routing rules](https://bugzilla.redhat.com/show_bug.cgi?id=1996731)
-- [postfix - Postfix RHEL System Role should provide the ability to replace config and reset configuration back to default [rhel-9.1.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065383)
+- [network - consistently use ansible_managed in configuration files managed by role [rhel-8.7.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065670)
-- [storage - RFE storage Less verbosity by default](https://bugzilla.redhat.com/show_bug.cgi?id=2079627)
+- [postfix - consistently use ansible_managed in configuration files managed by role [rhel-8.7.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065216)
+- [postfix - Postfix RHEL System Role should provide the ability to replace config and reset configuration back to default [rhel-8.7.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065218)
 
 ### Bug Fixes
 
-- [firewall - Firewall system role Ansible deprecation warning related to "include"](https://bugzilla.redhat.com/show_bug.cgi?id=2061511)
+- [firewall - Firewall system role Ansible deprecation warning related to "include"](https://bugzilla.redhat.com/show_bug.cgi?id=2078650)
-- [kernel_settings - error configobj not found on RHEL 8.6 managed hosts](https://bugzilla.redhat.com/show_bug.cgi?id=2060525)
+- [kernel_settings - error configobj not found on RHEL 8.6 managed hosts [rhel-8.7.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2060378)
-- [logging - tests fail during cleanup if no cloud-init on system](https://bugzilla.redhat.com/show_bug.cgi?id=2058799)
+- [metrics - Metrics role, with "metrics_from_mssql" option does not configure /var/lib/pcp/pmdas/mssql/mssql.conf on first run [rhel-8.7.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2060377)
-- [metrics - Metrics role, with "metrics_from_mssql" option does not configure /var/lib/pcp/pmdas/mssql/mssql.conf on first run](https://bugzilla.redhat.com/show_bug.cgi?id=2060523)
+- [nbde_client - NBDE client system role does not support servers with static IP addresses [rhel-8.7.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2071011)
-- [nbde_client - NBDE client system role does not support servers with static IP addresses [rhel-9.1.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2070462)
+- [network - bond: fix typo in supporting the infiniband ports in active-backup mode](https://bugzilla.redhat.com/show_bug.cgi?id=2064067)
-- [network - bond: fix typo in supporting the infiniband ports in active-backup mode [rhel-9.1.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065394)
+- [sshd - FIPS mode detection in SSHD role is wrong](https://bugzilla.redhat.com/show_bug.cgi?id=2075338)
-- [network - consistently use ansible_managed in configuration files managed by role [rhel-9.1.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065382)
+- [storage - RFE storage Less verbosity by default](https://bugzilla.redhat.com/show_bug.cgi?id=2056480)
-- [postfix - consistently use ansible_managed in configuration files managed by role [rhel-9.1.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065393)
+- [tlog - Tlog role - Enabling session recording configuration does not work due to RHEL9 SSSD files provider default](https://bugzilla.redhat.com/show_bug.cgi?id=2072749)
-- [sshd - FIPS mode detection in SSHD role is wrong](https://bugzilla.redhat.com/show_bug.cgi?id=2073605)
-- [tlog - Tlog role - Enabling session recording configuration does not work due to RHEL9 SSSD files provider default](https://bugzilla.redhat.com/show_bug.cgi?id=2071804)
 
 [1.16.3] - 2022-04-07
 ----------------------------
@@ -254,7 +359,7 @@ Changelog
 - [metrics - Metrics role, with "metrics_from_mssql" option does not configure /var/lib/pcp/pmdas/mssql/mssql.conf on first run](https://bugzilla.redhat.com/show_bug.cgi?id=2058655)
 - [firewall - ensure target changes take effect immediately](https://bugzilla.redhat.com/show_bug.cgi?id=2057172)
 
-[1.14.0] - 2022-02-21
+[1.14.0] - 2022-02-14
 ----------------------------
 
 ### New Features
@@ -268,7 +373,19 @@ Changelog
 
 - [ha_cluster - set permissions for haclient group](https://bugzilla.redhat.com/show_bug.cgi?id=2049747)
 
-[1.13.0] - 2022-02-14
+[1.13.1] - 2022-02-08
+----------------------------
+
+### New Features
+
+- none
+
+### Bug Fixes
+
+- [vpn - vpn: template error while templating string: no filter named 'vpn_ipaddr'](https://bugzilla.redhat.com/show_bug.cgi?id=2050341)
+- [kdump - kdump: Unable to start service kdump: Job for kdump.service failed because the control process exited with error code.](https://bugzilla.redhat.com/show_bug.cgi?id=2052105)
+
+[1.13.0] - 2022-02-01
 ----------------------------
 
 ### New Features
@@ -285,7 +402,7 @@ Changelog
 - [network - Failure to activate connection: nm-manager-error-quark: No suitable device found for this connection](https://bugzilla.redhat.com/show_bug.cgi?id=2034908)
 - [network - Set DNS search setting only for enabled IP protocols](https://bugzilla.redhat.com/show_bug.cgi?id=2041627)
 
-[1.12.1] - 2022-02-08
+[1.12.0] - 2022-01-27
 ----------------------------
 
 ### New Features
@@ -294,18 +411,6 @@ Changelog
 
 ### Bug Fixes
 
-- [vpn - vpn: template error while templating string: no filter named 'vpn_ipaddr'](https://bugzilla.redhat.com/show_bug.cgi?id=2050341)
-- [kdump - kdump: Unable to start service kdump: Job for kdump.service failed because the control process exited with error code.](https://bugzilla.redhat.com/show_bug.cgi?id=2052105)
-
-[1.12.0] - 2022-02-03
-----------------------------
-
-### New Features
-
-- [Support ansible-core 2.11+](https://bugzilla.redhat.com/show_bug.cgi?id=2012316)
-
-### Bug Fixes
-
 - [logging - Logging role "logging_purge_confs" option not properly working](https://bugzilla.redhat.com/show_bug.cgi?id=2040812)
 - [kernel_settings - role should use ansible_managed in its configuration file](https://bugzilla.redhat.com/show_bug.cgi?id=2047504)
 
@@ -350,18 +455,7 @@ Changelog
 - [nbde_client - add regenerate-all to the dracut command](https://bugzilla.redhat.com/show_bug.cgi?id=2021682)
 - [certificate - certificates: "group" option keeps certificates inaccessible to the group](https://bugzilla.redhat.com/show_bug.cgi?id=2021683)
 
-[1.9.0] - 2021-10-26
+[1.7.3] - 2021-08-26
-----------------------------
-
-### New Features
-
-- [logging - [RFE]  logging - Add user and password](https://bugzilla.redhat.com/show_bug.cgi?id=1990490)
-
-### Bug Fixes
-
-- [Replace `# {{ ansible_managed }}` with `{{ ansible_managed | comment }}`](https://bugzilla.redhat.com/show_bug.cgi?id=2006230)
-
-[1.8.3] - 2021-08-26
 ----------------------------
 
 ### New Features
@@ -372,7 +466,7 @@ Changelog
 
 - none
 
-[1.8.2] - 2021-08-24
+[1.7.2] - 2021-08-24
 ----------------------------
 
 ### New Features
@@ -383,7 +477,7 @@ Changelog
 
 - [logging - Update the certificates copy tasks](https://bugzilla.redhat.com/show_bug.cgi?id=1996777)
 
-[1.8.1] - 2021-08-16
+[1.7.1] - 2021-08-16
 ----------------------------
 
 ### New Features
@@ -394,7 +488,7 @@ Changelog
 
 - [metrics - role: the bpftrace role does not properly configure bpftrace agent](https://bugzilla.redhat.com/show_bug.cgi?id=1994180)
 
-[1.8.0] - 2021-08-12
+[1.7.0] - 2021-08-12
 ----------------------------
 
 ### New Features
@@ -405,7 +499,7 @@ Changelog
 
 - [sshd - sshd: failed to validate: error:Missing Match criteria for all Bad Match condition](https://bugzilla.redhat.com/show_bug.cgi?id=1991598)
 
-[1.7.5] - 2021-08-10
+[1.6.6] - 2021-08-06
 ----------------------------
 
 ### New Features
@@ -416,7 +510,7 @@ Changelog
 
 - none
 
-[1.7.4] - 2021-08-06
+[1.6.2] - 2021-07-30
 ----------------------------
 
 ### New Features
@@ -427,19 +521,18 @@ Changelog
 
 - [metrics - role: Grafana dashboard not working after metrics role run unless services manually restarted](https://bugzilla.redhat.com/show_bug.cgi?id=1984150)
 
-[1.7.0] - 2021-07-28
+[1.6.0] - 2021-07-28
 ----------------------------
 
 ### New Features
 
-- [logging - [RFE] logging - Add a support for list value to server_host in the elasticsearch output](https://bugzilla.redhat.com/show_bug.cgi?id=1986460)
 - [storage - [RFE] storage: support volume sizes as a percentage of pool](https://bugzilla.redhat.com/show_bug.cgi?id=1984583)
 
 ### Bug Fixes
 
 - none
 
-[1.6.0] - 2021-07-15
+[1.5.0] - 2021-07-15
 ----------------------------
 
 ### New Features
@@ -450,7 +543,7 @@ Changelog
 
 - none
 
-[1.5.0] - 2021-07-15
+[1.4.3] - 2021-07-15
 ----------------------------
 
 ### New Features
@@ -481,7 +574,7 @@ Changelog
 
 ### Bug Fixes
 
-- [network - Re-running the network system role results in "changed: true" when nothing has actually changed](https://bugzilla.redhat.com/show_bug.cgi?id=1980871)
+- [network - Re-running the network system role results in "changed: true" when nothing has actually changed](https://bugzilla.redhat.com/show_bug.cgi?id=1943384)
 
 [1.4.0] - 2021-07-08
 ----------------------------
@@ -499,17 +592,19 @@ Changelog
 
 ### New Features
 
-- [storage - RFE: Request that VDO be added to the Ansible (redhat-system-roles)](https://bugzilla.redhat.com/show_bug.cgi?id=1978488)
+- [ha_cluster - RFE: add pacemaker resources configuration](https://bugzilla.redhat.com/show_bug.cgi?id=1963283)
-- [sshd - RFE: sshd - support for appending a snippet to configuration file](https://bugzilla.redhat.com/show_bug.cgi?id=1978752)
+- [network - [Network] RFE: Support ignoring default gateway retrieved by DHCP/IPv6-RA](https://bugzilla.redhat.com/show_bug.cgi?id=1897565)
-- [timesync - RFE: timesync support for Network Time Security (NTS)](https://bugzilla.redhat.com/show_bug.cgi?id=1978753)
+- [storage - RFE: Request that VDO be added to the Ansible (redhat-system-roles)](https://bugzilla.redhat.com/show_bug.cgi?id=1882475)
+- [sshd - RFE: sshd - support for appending a snippet to configuration file](https://bugzilla.redhat.com/show_bug.cgi?id=1970642)
+- [timesync - RFE: timesync support for Network Time Security (NTS)](https://bugzilla.redhat.com/show_bug.cgi?id=1970664)
 
 ### Bug Fixes
 
-- [postfix - Postfix RHEL system role README.md missing variables under the "Role Variables" section](https://bugzilla.redhat.com/show_bug.cgi?id=1978734)
+- [postfix - Postfix RHEL system role README.md missing variables under the "Role Variables" section](https://bugzilla.redhat.com/show_bug.cgi?id=1961858)
-- [postfix - the postfix role is not idempotent](https://bugzilla.redhat.com/show_bug.cgi?id=1978760)
+- [postfix - the postfix role is not idempotent](https://bugzilla.redhat.com/show_bug.cgi?id=1960375)
-- [selinux - task for semanage says Fedora in name but also runs on RHEL/CentOS 8](https://bugzilla.redhat.com/show_bug.cgi?id=1978740)
+- [selinux - task for semanage says Fedora in name but also runs on RHEL/CentOS 8](https://bugzilla.redhat.com/show_bug.cgi?id=1966681)
-- [metrics - role task to enable logging for targeted hosts not working](https://bugzilla.redhat.com/show_bug.cgi?id=1978746)
+- [metrics - role task to enable logging for targeted hosts not working](https://bugzilla.redhat.com/show_bug.cgi?id=1967335)
-- [sshd ssh - Unable to set sshd_hostkey_group and sshd_hostkey_mode](https://bugzilla.redhat.com/show_bug.cgi?id=1978745)
+- [sshd ssh - Unable to set sshd_hostkey_group and sshd_hostkey_mode](https://bugzilla.redhat.com/show_bug.cgi?id=1966711)
 
 [1.2.3] - 2021-06-17
 ----------------------------
@@ -527,11 +622,12 @@ Changelog
 
 ### New Features
 
-- none
+- [timesync - Add hybrid_e2e option to PTP domain](https://bugzilla.redhat.com/show_bug.cgi?id=1957849)
 
 ### Bug Fixes
 
 - [Internal links in README.md are broken](https://bugzilla.redhat.com/show_bug.cgi?id=1962976)
+- [ha_cluster - cannot read preshared key in binary format](https://bugzilla.redhat.com/show_bug.cgi?id=1952620)
 
 [1.2.1] - 2021-05-21
 ----------------------------
@@ -544,7 +640,7 @@ Changelog
 
 - [Internal links in README.md are broken](https://bugzilla.redhat.com/show_bug.cgi?id=1962976)
 
-[1.2.0] - 2021-05-21
+[1.2.0] - 2021-05-17
 ----------------------------
 
 ### New Features
@@ -553,11 +649,9 @@ Changelog
 
 ### Bug Fixes
 
-- [postfix - the postfix role is not idempotent](https://bugzilla.redhat.com/show_bug.cgi?id=1960375)
 - [postfix - postfix: Use FQRN in README](https://bugzilla.redhat.com/show_bug.cgi?id=1958963)
 - [postfix - Documentation error in rhel-system-roles postfix readme file](https://bugzilla.redhat.com/show_bug.cgi?id=1866544)
 - [storage - storage: calltrace observed when set type: partition for storage_pools](https://bugzilla.redhat.com/show_bug.cgi?id=1854187)
-- [ha_cluster - cannot read preshared key in binary format](https://bugzilla.redhat.com/show_bug.cgi?id=1952620)
 
 [1.1.0] - 2021-05-13
 ----------------------------
@@ -577,6 +671,61 @@ Changelog
 - [timesync - do not use ignore_errors in timesync role](https://bugzilla.redhat.com/show_bug.cgi?id=1938014)
 - [selinux - rhel-system-roles should not reload the SELinux policy if its not changed](https://bugzilla.redhat.com/show_bug.cgi?id=1757869)
 
+[1.0.0] - 2021-02-23
+----------------------------
+
+### New Features
+
+- [network - RFE: [network] Support of DNS with options](https://bugzilla.redhat.com/show_bug.cgi?id=1893959)
+- [network - RFE: [network] Embrace Inclusive language](https://bugzilla.redhat.com/show_bug.cgi?id=1893957)
+- [ssh - [8.4] [RFE] Release Ansible role for ssh client in rhel-system-roles](https://bugzilla.redhat.com/show_bug.cgi?id=1893712)
+- [clusterha - [8.4] [RFE] Release Ansible role for cluster HA in rhel-system-roles](https://bugzilla.redhat.com/show_bug.cgi?id=1893743)
+- [logging - Logging - Support RELP secure transport in the logging role configuration](https://bugzilla.redhat.com/show_bug.cgi?id=1889484)
+- [metrics - [8.4] [RFE] add exporting-metric-data-to-elasticsearch functionality in the metrics role](https://bugzilla.redhat.com/show_bug.cgi?id=1895188)
+- [metrics - release SQL server configuration support in the metrics role](https://bugzilla.redhat.com/show_bug.cgi?id=1893908)
+- [[8.4] Package rhel-system-roles in the collection format in addition to the legacy role format](https://bugzilla.redhat.com/show_bug.cgi?id=1893906)
+
+### Bug Fixes
+
+- [logging - Logging - Integrating ELK with RHV-4.4 fails as RHVH is missing 'rsyslog-gnutls' package.](https://bugzilla.redhat.com/show_bug.cgi?id=1927943)
+- [storage - storage: omitted parameters on existing pool/volume is interpreted as "use the default"](https://bugzilla.redhat.com/show_bug.cgi?id=1894651)
+- [storage - storage: must list disks in order to identify an existing pool](https://bugzilla.redhat.com/show_bug.cgi?id=1894676)
+- [storage - storage: pool metadata usage must be accounted for by the user](https://bugzilla.redhat.com/show_bug.cgi?id=1894647)
+- [selinux - Merged fix incorrect default value (there is no variable named "present")](https://bugzilla.redhat.com/show_bug.cgi?id=1926947)
+- [storage - storage: tests_luks.yml partition case failed with nvme disk](https://bugzilla.redhat.com/show_bug.cgi?id=1865990)
+
+[1.0] - 2021-01-15
+----------------------------
+
+### New Features
+
+- [tlog - Add exclude_users and exclude_groups support](https://bugzilla.redhat.com/show_bug.cgi?id=1895472)
+- [crypto_policies - [8.4] [RFE] Release Ansible role for crypto policies in rhel-system-roles](https://bugzilla.redhat.com/show_bug.cgi?id=1893699)
+- [sshd - [8.4] [RFE] Release Ansible role for sshd in rhel-system-roles](https://bugzilla.redhat.com/show_bug.cgi?id=1893696)
+- [metrics - role should automate the setup of Grafana datasources](https://bugzilla.redhat.com/show_bug.cgi?id=1855544)
+- [network role: Support -K|--features|--offload ethtool options](https://bugzilla.redhat.com/show_bug.cgi?id=1696703)
+- [network role: Atomic changes](https://bugzilla.redhat.com/show_bug.cgi?id=1695161)
+
+### Bug Fixes
+
+- [storage - safe mode of storage role does not prevent accidentally losing data when toggling encryption on a volume, disk or pool](https://bugzilla.redhat.com/show_bug.cgi?id=1881524)
+- [storage - storage: ext2/3/4 resize function doesn't work](https://bugzilla.redhat.com/show_bug.cgi?id=1862867)
+- [logging - [logging role] cannot setup machine with tls](https://bugzilla.redhat.com/show_bug.cgi?id=1861318)
+- [certificate - role: The role is not idempotent in rhel7](https://bugzilla.redhat.com/show_bug.cgi?id=1859547)
+- [logging - Logging - Bug fixes](https://bugzilla.redhat.com/show_bug.cgi?id=1854546)
+- [logging - [logging role] support scenario for client without key/cert, just CA cert](https://bugzilla.redhat.com/show_bug.cgi?id=1860896)
+- [metrics - role incorrectly sets up multiple primary pmie processes in multi-host mode](https://bugzilla.redhat.com/show_bug.cgi?id=1855539)
+- [certificate - role cannot manage EL7 hosts](https://bugzilla.redhat.com/show_bug.cgi?id=1848745)
+- [network - [network] Support state:down persistent_state:absent for non-existent profile](https://bugzilla.redhat.com/show_bug.cgi?id=1822777)
+- [network - Creating active bonded interface fails with the initscripts provider](https://bugzilla.redhat.com/show_bug.cgi?id=1848472)
+- [logging - Logging role had performance issues](https://bugzilla.redhat.com/show_bug.cgi?id=1848762)
+- [certificate - role does not work on controller hosts which use jinja2 2.10](https://bugzilla.redhat.com/show_bug.cgi?id=1848742)
+- [nbde_client - fix idempotency, check_mode issues with nbde_client role](https://bugzilla.redhat.com/show_bug.cgi?id=1848766)
+- [storage - Storage role can remove existing filesystems and volume groups without warning](https://bugzilla.redhat.com/show_bug.cgi?id=1763242)
+- [network role: Minimize service disruption](https://bugzilla.redhat.com/show_bug.cgi?id=1695157)
+- [typo in selinux/tests/tests_selinux_disabled.yml: Invalid options for assert: mgs](https://bugzilla.redhat.com/show_bug.cgi?id=1677743)
+- [Check mode problems in rhel-system-roles](https://bugzilla.redhat.com/show_bug.cgi?id=1685904)
+
 [0.6] - 2018-05-11
 ----------------------------
 

SOURCES/ansible-packaging.inc

@@ -0,0 +1,21 @@
+# Helper macros originally from macros.ansible by Igor Raits <ignatenkobrain>
+# This file is for maintaining the compatibility with macros and other
+# functionality (generators) provided by ansible-packaging on Fedora.
+
+Provides: ansible-collection(%{collection_namespace}.%{collection_name}) = %{collection_version}
+
+# ansible-galaxy is available by ansible-core on RHEL 8.6 and newer at buildtime.
+%define ansible_collection_build() ansible-galaxy collection build
+%define ansible_collection_install() ansible-galaxy collection install -n -p %{buildroot}%{_datadir}/ansible/collections %{collection_namespace}-%{collection_name}-%{version}.tar.gz
+
+%define ansible_roles_dir %{_datadir}/ansible/roles
+%define ansible_collections_dir %{_datadir}/ansible/collections/ansible_collections
+
+# TODO: Officially deprecate this macro and add the following line to the macro
+# def after the new approach has gotten more testing and adoption:
+# %%{warn: %%{ansible_collection_files} is deprecated. Use %%files -f %%{ansible_collection_filelist} instead.}
+%define ansible_collection_files %{shrink:
+%{ansible_collections_dir}/%{collection_namespace}/
+}
+
+%define ansible_collection_filelist %{__ansible_builddir}/ansible_collection_files

SOURCES/extrasources.inc

@@ -1,10 +1,10 @@
-Source801: https://galaxy.ansible.com/download/ansible-posix-1.5.1.tar.gz
+Source801: https://galaxy.ansible.com/download/ansible-posix-1.5.4.tar.gz
-Source901: https://galaxy.ansible.com/download/community-general-6.4.0.tar.gz
+Source901: https://galaxy.ansible.com/download/community-general-8.3.0.tar.gz
-Source902: https://galaxy.ansible.com/download/containers-podman-1.10.1.tar.gz
+Source902: https://galaxy.ansible.com/download/containers-podman-1.15.4.tar.gz
 
-Provides: bundled(ansible-collection(ansible.posix)) = 1.5.1
+Provides: bundled(ansible-collection(ansible.posix)) = 1.5.4
-Provides: bundled(ansible-collection(community.general)) = 6.4.0
+Provides: bundled(ansible-collection(community.general)) = 8.3.0
-Provides: bundled(ansible-collection(containers.podman)) = 1.10.1
+Provides: bundled(ansible-collection(containers.podman)) = 1.15.4
 
 Source996: CHANGELOG.rst
 Source998: collection_readme.sh

SOURCES/vendoring-build.inc

@@ -0,0 +1,152 @@
+# maps the source file to the roles that use that file
+# value can be string or space delimited list of strings
+# role name `__collection` means - do not vendor into
+# role, just vendor directly into the collection
+declare -A plugin_map=(
+  [ansible/posix/plugins/modules/selinux.py]=selinux
+  [ansible/posix/plugins/modules/seboolean.py]=selinux
+  [ansible/posix/plugins/modules/mount.py]=storage
+  [ansible/posix/plugins/modules/rhel_facts.py]=__collection
+  [ansible/posix/plugins/modules/rhel_rpm_ostree.py]=__collection
+  [ansible/posix/plugins/module_utils/mount.py]=storage
+  [community/general/plugins/modules/ini_file.py]="tlog ad_integration"
+  [community/general/plugins/modules/modprobe.py]=ha_cluster
+  [community/general/plugins/modules/redhat_subscription.py]=rhc
+  [community/general/plugins/modules/rhsm_release.py]=rhc
+  [community/general/plugins/modules/rhsm_repository.py]=rhc
+  [community/general/plugins/modules/seport.py]=selinux
+  [community/general/plugins/modules/sefcontext.py]=selinux
+  [community/general/plugins/modules/selogin.py]=selinux
+  [containers/podman/plugins/modules/podman_container_info.py]=podman
+  [containers/podman/plugins/modules/podman_image.py]=podman
+  [containers/podman/plugins/modules/podman_play.py]=podman
+  [containers/podman/plugins/modules/podman_secret.py]=podman
+  [containers/podman/plugins/module_utils/podman/common.py]=podman
+  [containers/podman/plugins/module_utils/podman/quadlet.py]=podman
+)
+
+# fix the following issue
+# ERROR: Found 1 pylint issue(s) which need to be resolved:
+# ERROR: plugins/modules/rhsm_repository.py:263:8: wrong-collection-deprecated: Wrong collection name ('community.general') found in call to Display.deprecated or AnsibleModule.deprecate
+sed "s/collection_name='community.general'/collection_name='%{collection_namespace}.%{collection_name}'/" \
+  -i .external/community/general/plugins/modules/rhsm_repository.py
+
+fix_module_documentation() {
+  local module_src doc_fragment_name df_dest_dir
+  local -a paths
+  module_src=".external/$1"
+  sed ':a;N;$!ba;s/description:\n\( *\)/description:\n\1- "WARNING: Do not use this plugin directly! It is only for role internal use."\n\1/' \
+    -i "$module_src"
+  # grab documentation fragments
+  for doc_fragment_name in $(awk -F'[ -]+' '/^extends_documentation_fragment:/ {reading = 1; next}; /^[ -]/ {if (reading) {print $2}; next}; /^[^ -]/ {if (reading) {exit}}' "$module_src"); do
+    if [ "$doc_fragment_name" = files ]; then continue; fi  # this one is built-in
+    df_dest_dir="%{collection_build_path}/plugins/doc_fragments"
+    if [ ! -d "$df_dest_dir" ]; then
+      mkdir -p "$df_dest_dir"
+    fi
+    paths=(${doc_fragment_name//./ })
+    # if we ever have two different collections that have the same doc_fragment name
+    # with different contents, we will be in trouble . . .
+    # will have to make the doc fragment files unique, then edit $dest to use
+    # the unique name
+    cp ".external/${paths[0]}/${paths[1]}/plugins/doc_fragments/${paths[2]}.py" "$df_dest_dir"
+  done
+}
+
+declare -a modules mod_utils collection_plugins
+declare -A dests
+# vendor in plugin files - fix documentation, fragments
+for src in "${!plugin_map[@]}"; do
+  roles="${plugin_map["$src"]}"
+  if [ "$roles" = __collection ]; then
+    collection_plugins+=("$src")
+    case "$src" in
+    */plugins/modules/*) fix_module_documentation "$src";;
+    esac
+  else
+    case "$src" in
+    */plugins/modules/*) srcdir=plugins/modules; subdir=library; modules+=("$src"); fix_module_documentation "$src";;
+    */plugins/module_utils/*) srcdir=plugins/module_utils; mod_utils+=("$src") ;;
+    */plugins/action/*) srcdir=plugins/action ;;
+    esac
+  fi
+  for role in $roles; do
+    if [ "$role" = __collection ]; then
+      dest="%{collection_build_path}/plugins${src/#*plugins/}"
+      dests["$dest"]=__collection
+    else
+      case "$src" in
+      */plugins/module_utils/*) subdir="module_utils/${role}_lsr" ;;
+      esac
+      dest="$role/${src/#*${srcdir}/${subdir}}"
+      dests["$dest"]="$role"
+    fi
+    destdir="$(dirname "$dest")"
+    if [ ! -d "$destdir" ]; then
+      mkdir -p "$destdir"
+    fi
+    cp -pL ".external/$src" "$dest"
+  done
+done
+
+# remove the temporary .external directory after vendoring
+rm -rf .external
+
+# fix python imports to point from the old name to the new name
+for dest in "${!dests[@]}"; do
+  role="${dests["$dest"]}"
+  for module in "${modules[@]}"; do
+    python_name="$(dirname "$module")"
+    python_name="${python_name////[.]}"
+    sed -e "s/ansible_collections[.]${python_name}[.]/ansible.modules./" -i "$dest"
+  done
+  for mod_util in "${mod_utils[@]}"; do
+    # some mod_utils have subdirs, some do not
+    split=(${mod_util//// })
+    python_name="ansible_collections[.]${split[0]}[.]${split[1]}[.]plugins[.]module_utils[.]"
+    sed -e "s/${python_name}/ansible.module_utils.${role}_lsr./" -i "$dest"
+  done
+  for plugin in "${collection_plugins[@]}"; do
+    python_name="$(dirname "$plugin")"
+    dest_python_name="%{collection_namespace}/%{collection_name}/plugins${python_name/#*plugins/}"
+    src_python_name="ansible_collections.${python_name////[.]}"
+    dest_python_name="ansible_collections.${dest_python_name////.}"
+    sed -e "s/${src_python_name}/${dest_python_name}/" -i "$dest"
+  done
+done
+
+# Replacing "linux-system-roles.rolename" with "rhel-system-roles.rolename" in each role
+# Replacing "fedora.linux_system_roles." with "redhat.rhel_system_roles" in each role
+# This is for the "roles calling other roles" case
+# for podman, change the FQCN - using a non-FQCN module name doesn't seem to work,
+# even for the legacy role format
+for rolename in %{rolenames}; do
+  find "$rolename" -type f -exec \
+    sed -e "s/linux-system-roles[.]${rolename}\\>/%{roleinstprefix}${rolename}/g" \
+        -e "s/fedora[.]linux_system_roles[.]/%{collection_namespace}.%{collection_name}./g" \
+        -e "s/containers[.]podman[.]/%{collection_namespace}.%{collection_name}./g" \
+        -e "s/community[.]general[.]/%{collection_namespace}.%{collection_name}./g" \
+        -e "s/ansible[.]posix[.]/%{collection_namespace}.%{collection_name}./g" \
+        -i {} \;
+done
+
+# add ansible-test ignores needed due to vendoring
+for ansible_ver in 2.14 2.15 2.16; do
+  ignore_file="podman/.sanity-ansible-ignore-${ansible_ver}.txt"
+  cat >> "$ignore_file" <<EOF
+plugins/module_utils/podman_lsr/podman/quadlet.py compile-2.7!skip
+plugins/module_utils/podman_lsr/podman/quadlet.py import-2.7!skip
+plugins/modules/podman_image.py import-2.7!skip
+plugins/modules/podman_play.py import-2.7!skip
+EOF
+done
+# these platforms still use python 3.5
+for ansible_ver in 2.14 2.15; do
+  ignore_file="podman/.sanity-ansible-ignore-${ansible_ver}.txt"
+  cat >> "$ignore_file" <<EOF
+plugins/module_utils/podman_lsr/podman/quadlet.py compile-3.5!skip
+plugins/module_utils/podman_lsr/podman/quadlet.py import-3.5!skip
+plugins/modules/podman_image.py import-3.5!skip
+plugins/modules/podman_play.py import-3.5!skip
+EOF
+done

SOURCES/vendoring-prep.inc

@@ -0,0 +1,12 @@
+# Untar vendored collection tarballs to corresponding directories
+for file in %{SOURCE801} %{SOURCE901} %{SOURCE902}; do
+    if [[ "$(basename $file)" =~ ([^-]+)-([^-]+)-(.+).tar.gz ]]; then
+        ns=${BASH_REMATCH[1]}
+        name=${BASH_REMATCH[2]}
+        ver=${BASH_REMATCH[3]}
+        mkdir -p .external/$ns/$name
+        pushd .external/$ns/$name > /dev/null
+        tar xfz "$file"
+        popd > /dev/null
+    fi
+done