7 changed files with 1038 additions and 918 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,31 +1,34 @@
-SOURCES/ad_integration-1.1.3.tar.gz
+SOURCES/ad_integration-1.4.2.tar.gz
 SOURCES/ansible-posix-1.5.4.tar.gz
-SOURCES/ansible-sshd-v0.19.0.tar.gz
+SOURCES/ansible-sshd-v0.23.2.tar.gz
-SOURCES/auto-maintenance-e010c878833e363195dd707d1334ff48a254b092.tar.gz
+SOURCES/auto-maintenance-11ad785c9bb72611244e7909450ca4247e12db4d.tar.gz
-SOURCES/certificate-1.2.1.tar.gz
+SOURCES/bootloader-1.0.3.tar.gz
-SOURCES/cockpit-1.4.7.tar.gz
+SOURCES/certificate-1.3.3.tar.gz
-SOURCES/community-general-7.3.0.tar.gz
+SOURCES/cockpit-1.5.5.tar.gz
-SOURCES/containers-podman-1.10.3.tar.gz
+SOURCES/community-general-8.3.0.tar.gz
-SOURCES/crypto_policies-1.2.11.tar.gz
+SOURCES/containers-podman-1.12.0.tar.gz
-SOURCES/firewall-1.6.3.tar.gz
+SOURCES/crypto_policies-1.3.2.tar.gz
-SOURCES/ha_cluster-1.10.0.tar.gz
+SOURCES/fapolicyd-1.1.1.tar.gz
-SOURCES/journald-1.0.5.tar.gz
+SOURCES/firewall-1.7.4.tar.gz
-SOURCES/kdump-1.3.6.tar.gz
+SOURCES/ha_cluster-1.14.0.tar.gz
-SOURCES/kernel_settings-1.1.17.tar.gz
+SOURCES/journald-1.2.3.tar.gz
-SOURCES/keylime_server-1.0.0.tar.gz
+SOURCES/kdump-1.4.4.tar.gz
-SOURCES/logging-1.11.9.tar.gz
+SOURCES/kernel_settings-1.2.2.tar.gz
-SOURCES/metrics-1.8.6.tar.gz
+SOURCES/keylime_server-1.1.2.tar.gz
-SOURCES/nbde_client-1.2.14.tar.gz
+SOURCES/logging-1.12.4.tar.gz
-SOURCES/nbde_server-1.3.8.tar.gz
+SOURCES/metrics-1.10.1.tar.gz
-SOURCES/network-1.13.1.tar.gz
+SOURCES/nbde_client-1.2.17.tar.gz
-SOURCES/podman-1.3.2.tar.gz
+SOURCES/nbde_server-1.4.3.tar.gz
-SOURCES/postfix-1.3.8.tar.gz
+SOURCES/network-1.15.1.tar.gz
-SOURCES/postgresql-1.1.0.tar.gz
+SOURCES/podman-1.4.7.tar.gz
-SOURCES/rhc-1.2.4.tar.gz
+SOURCES/postfix-1.4.3.tar.gz
-SOURCES/selinux-1.6.1.tar.gz
+SOURCES/postgresql-1.3.5.tar.gz
-SOURCES/ssh-1.2.1.tar.gz
+SOURCES/rhc-1.6.0.tar.gz
-SOURCES/storage-1.12.3.tar.gz
+SOURCES/selinux-1.7.4.tar.gz
-SOURCES/systemd-1.0.1.tar.gz
+SOURCES/snapshot-1.3.1.tar.gz
-SOURCES/timesync-1.7.6.tar.gz
+SOURCES/ssh-1.3.2.tar.gz
-SOURCES/tlog-1.2.16.tar.gz
+SOURCES/storage-1.16.2.tar.gz
-SOURCES/vpn-1.5.8.tar.gz
+SOURCES/systemd-1.1.2.tar.gz
 SOURCES/timesync-1.8.2.tar.gz
 SOURCES/tlog-1.3.3.tar.gz
 SOURCES/vpn-1.6.3.tar.gz
--- a/.rhel-system-roles.metadata
+++ b/.rhel-system-roles.metadata
@ -1,31 +0,0 @@
 4ed72d2549af3a2bf5232944dcd84c4203ec1f49 SOURCES/ad_integration-1.1.3.tar.gz
 da646eb9ba655f1693cc950ecb5c24af39ee1af6 SOURCES/ansible-posix-1.5.4.tar.gz
 edcfa5243b2e74c50ab8fd17f514bbc9df693c06 SOURCES/ansible-sshd-v0.19.0.tar.gz
 7b34305ca31a8df71f3ecec3410c7c4d262201bd SOURCES/auto-maintenance-e010c878833e363195dd707d1334ff48a254b092.tar.gz
 4483962040f0c29fa9c80950dc403ce7e9f17ed7 SOURCES/certificate-1.2.1.tar.gz
 4ed2794a781e7976ff2a0b4c6abbf008859ef982 SOURCES/cockpit-1.4.7.tar.gz
 ee7868c57b3d1ce170b61a1d42c840ba1428aeac SOURCES/community-general-7.3.0.tar.gz
 711423c6503c1e137d7c38b6a0718e5768f40d21 SOURCES/containers-podman-1.10.3.tar.gz
 aee5eb307f5a40a8a222a0dd7713b230bc3324a7 SOURCES/crypto_policies-1.2.11.tar.gz
 81ac41f0c7d06dbb92d70b8d9a0a0b0a6474411c SOURCES/firewall-1.6.3.tar.gz
 aa11011e00fe8a86999688149d60f5d0a4ed5cbf SOURCES/ha_cluster-1.10.0.tar.gz
 88e721b5d804f00e7b044310d47b2dd40ac83f8f SOURCES/journald-1.0.5.tar.gz
 64680ec0f3ea03fc5c0a5792ceeaa193d6154fdd SOURCES/kdump-1.3.6.tar.gz
 43338d3ffdc79961564504822a84462cefa8ff5a SOURCES/kernel_settings-1.1.17.tar.gz
 81b0e4e1f71f01a008181494eefc542506cd3823 SOURCES/keylime_server-1.0.0.tar.gz
 0963ecef1330048c25bb9a778b5ac15c24e77df2 SOURCES/logging-1.11.9.tar.gz
 af61299d39b4a7d5e37507a898ddba55e3f053d6 SOURCES/metrics-1.8.6.tar.gz
 b8c7ff7dadbd84aeb13e94c4be3be0f8ee9549cd SOURCES/nbde_client-1.2.14.tar.gz
 a5d2a5afd45447edb17f6a9615eabb80501e61f3 SOURCES/nbde_server-1.3.8.tar.gz
 fe9426eaf3e7a5a31ebe5707e4a17770bca7a6b6 SOURCES/network-1.13.1.tar.gz
 8b49515b4c5d8b1f5e06be6c7fdeff7ab622c495 SOURCES/podman-1.3.2.tar.gz
 b91070ba6fa7b4a9072aa2d1a2ef4b169aab0f00 SOURCES/postfix-1.3.8.tar.gz
 504cde6540ff1b5527b2ddf9aa90a95e29d7ffc3 SOURCES/postgresql-1.1.0.tar.gz
 a6097168bd1b54a46be8b5f4adfdab9b5ec8ddb5 SOURCES/rhc-1.2.4.tar.gz
 bb2a5e711233e527d0a11914bd566f47a2cfe9e6 SOURCES/selinux-1.6.1.tar.gz
 c03dbda563ec7d3c2ae2c7bfd6aab88c6c19fbac SOURCES/ssh-1.2.1.tar.gz
 84085e0f750181aee340e02258fd5888d563698e SOURCES/storage-1.12.3.tar.gz
 1c7ac80df7288f7d3469e376316305eadd2dc2dc SOURCES/systemd-1.0.1.tar.gz
 e4fe253906ffd7ce2ecca71a63a0e96e5f562e0c SOURCES/timesync-1.7.6.tar.gz
 544d0591a0ae73b73c1ab5bc280cdc8d5598f322 SOURCES/tlog-1.2.16.tar.gz
 1d959b0b5f6bd261d392b0740fd86915c7b35c17 SOURCES/vpn-1.5.8.tar.gz
--- a/SOURCES/0001-fix-use-command-stdin-for-password-and-do-not-log-pa.patch
+++ b/SOURCES/0001-fix-use-command-stdin-for-password-and-do-not-log-pa.patch
@ -1,127 +0,0 @@
 From 1931ebccaa146bd6ee8365c664ab62d294adaa31 Mon Sep 17 00:00:00 2001
 From: Rich Megginson <rmeggins@redhat.com>
 Date: Fri, 18 Aug 2023 12:35:44 -0600
 Subject: [PATCH] fix: use command stdin for password, and do not log password
 Cause: The code was constructing the realm join command to be passed
 via the shell module, including piping the password into the command,
 and was showing the command, including the password, when using
 check mode.
 Consequence: The clear text password was available in the logs when
 using check mode.
 Fix: Use command with stdin for the password instead of shell.  The
 password is not part of the command.  command with stdin is more
 secure than using shell.  The debug output has been changed to
 show the command with the `ad_integration_join_parameters` removed,
 because we cannot know if those parameters contain data which should
 not be logged.  Those parameters will still be passed to the actual
 realm join command.
 Result: The password is not logged.  The role is more secure.
 Signed-off-by: Rich Megginson <rmeggins@redhat.com>
 ---
 tasks/main.yml | 57 ++++++++++++++++++++++++++++----------------------
 1 file changed, 32 insertions(+), 25 deletions(-)
 diff --git a/tasks/main.yml b/tasks/main.yml
 index fe2602e..265c6fe 100644
 --- a/tasks/main.yml
 +++ b/tasks/main.yml
@@ -3,8 +3,7 @@
 - name: Ensure that mandatory variable ad_integration_realm is available
   fail:
     msg: Variable ad_integration_realm must be provided!
 -  when:
 -    - not ad_integration_realm
 +  when: not ad_integration_realm
 - name: Assume managing timesync if timesource is set
   set_fact:
@@ -26,8 +25,7 @@
 - name: Assume managing crypto policies if allow_rc4_crypto is set
   set_fact:
     ad_integration_manage_crypto_policies: true
 -  when:
 -    - ad_integration_allow_rc4_crypto | bool
 +  when: ad_integration_allow_rc4_crypto | bool
 - name: Ensure manage_crypt_policies is set with crypto_allow_rc4
   fail:
@@ -141,41 +139,50 @@
 - name: Build Command - Join to a specific Domain Controller
   set_fact:
 -    __ad_integration_join_command: |
 -      set -euo pipefail
 -      echo {{ ad_integration_password | quote }} | realm join -U \
 -        {{ ad_integration_user | quote }} --membership-software \
 -        {{ ad_integration_membership_software | quote }} \
 -        {{ ad_integration_join_parameters }} \
 -        {{ ad_integration_join_to_dc | quote }}
 +    __ad_integration_join_command: >-
 +      realm join -U {{ ad_integration_user | quote }} --membership-software
 +      {{ ad_integration_membership_software | quote }}
 +      {{ ad_integration_join_parameters }}
 +      {{ ad_integration_join_to_dc | quote }}
 +    __ad_integration_debug_command: >-
 +      realm join -U {{ ad_integration_user | quote }} --membership-software
 +      {{ ad_integration_membership_software | quote }}
 +      {{ ad_integration_join_to_dc | quote }}
   no_log: true
 -  when:
 -    - ad_integration_join_to_dc is not none
 +  when: ad_integration_join_to_dc is not none
 - name: Build Join Command - Perform discovery-based realm join operation
   set_fact:
 -    __ad_integration_join_command: |
 -      set -euo pipefail
 -      echo {{ ad_integration_password | quote }} | realm join -U \
 -        {{ ad_integration_user | quote }} --membership-software \
 -        {{ ad_integration_membership_software | quote }} \
 -        {{ ad_integration_join_parameters }} \
 -        {{ ad_integration_realm | quote }}
 +    __ad_integration_join_command: >-
 +      realm join -U {{ ad_integration_user | quote }} --membership-software
 +      {{ ad_integration_membership_software | quote }}
 +      {{ ad_integration_join_parameters }}
 +      {{ ad_integration_realm | quote }}
 +    __ad_integration_debug_command: >-
 +      realm join -U {{ ad_integration_user | quote }} --membership-software
 +      {{ ad_integration_membership_software | quote }}
 +      {{ ad_integration_realm | quote }}
   no_log: true
 -  when:
 -    - ad_integration_join_to_dc is none
 +  when: ad_integration_join_to_dc is none
 - name: Show the join command for debug
   debug:
 -    msg: "Would run: '{{ __ad_integration_join_command }}'"
 +    msg:
 +      - >-
 +        Would run the following command. Note that
 +        ad_integration_join_parameters have been removed for security purposes,
 +        the role will pass them to the actual realm join command when running
 +        without check mode.
 +      - "{{ __ad_integration_debug_command }}"
   when:
     - ad_integration_join_to_dc == __ad_integration_sample_dc
       or ad_integration_realm == __ad_integration_sample_realm
       or ansible_check_mode
 - name: Run realm join command
 -  # noqa command-instead-of-shell
 -  shell: "{{ __ad_integration_join_command }}"
 +  command: "{{ __ad_integration_join_command }}"
 +  args:
 +    stdin: "{{ ad_integration_password }}"
   no_log: true
   when:
     - ad_integration_join_to_dc != __ad_integration_sample_dc
 -- 
 2.41.0
--- a/SOURCES/CHANGELOG.md
+++ b/SOURCES/CHANGELOG.md
@ -1,65 +1,112 @@
 Changelog
 =========
 [1.23.0] - 2024-01-15
 ----------------------------
 ### New Features
 - [RHEL for Edge support in system roles](https://issues.redhat.com/browse/RHEL-15872)
 - [ad_integration - feat: Add sssd custom settings](https://issues.redhat.com/browse/RHEL-17667)
 - [ad_integration - Enable AD dynamic DNS updates](https://issues.redhat.com/browse/RHEL-1119)
 - [ad_integration - feat: add ad_integration_preserve_authselect_profile](https://issues.redhat.com/browse/RHEL-21383)
 - [ad_integration - feat: Add SSSD parameters support](https://issues.redhat.com/browse/RHEL-21134)
 - [bootloader - Create bootloader role (MVP)](https://issues.redhat.com/browse/RHEL-3241)
 - [fapolicyd - feat: Import code for fapolicyd system role](https://issues.redhat.com/browse/RHEL-16542)
 - [ha_cluster - [RFE] HA Cluster system role should be able to enable Resilient Storage repository](https://issues.redhat.com/browse/RHEL-14090)
 - [ha_cluster - [FutureFeature] Allow ha_cluster role to configure fencing topology](https://issues.redhat.com/browse/RHEL-4624)
 - [ha_cluster - [FutureFeature] Allow ha_cluster role to configure all qdevice options](https://issues.redhat.com/browse/RHEL-3264)
 - [ha_cluster - Setting cluster members attributes](https://issues.redhat.com/browse/RHEL-22108)
 - [journald - feat: Add support for ForwardToSyslog](https://issues.redhat.com/browse/RHEL-21123)
 - [logging - feat: Add support for the global config option preserveFQDN with a new logg…](https://issues.redhat.com/browse/RHEL-15933)
 - [logging - feat: Add support for general queue and general action parameters](https://issues.redhat.com/browse/RHEL-15440)
 - [metrics - [RFE] Metrics system role support for configuring PMIE webhooks](https://issues.redhat.com/browse/RHEL-18170)
 - [network - Add blackhole type route](https://issues.redhat.com/browse/RHEL-21491)
 - [postgresql - feat: Enable support for Postgresql 16](https://issues.redhat.com/browse/RHEL-18963)
 - [rhc - support RHEL 7 managed nodes](https://issues.redhat.com/browse/RHEL-16977)
 - [rhc - new rhc_insights.ansible_host parameter](https://issues.redhat.com/browse/RHEL-16975)
 - [rhc - new rhc_insights.display_name parameter](https://issues.redhat.com/browse/RHEL-16965)
 - [snapshot - New Role for storage snapshot management (lvm, etc.)](https://issues.redhat.com/browse/RHEL-16553)
 - [sshd - ansible-sshd Manage SSH certificates](https://issues.redhat.com/browse/RHEL-5985)
 - [storage - feat: Support for creating volumes without a FS](https://issues.redhat.com/browse/RHEL-16213)
 - [storage - Basic support for creating shared logical volumes (RHEL 8)](https://issues.redhat.com/browse/RHEL-14022)
 ### Bug Fixes
 - [ha_cluster - high-availability firewall service is not added on qdevice node](https://issues.redhat.com/browse/RHEL-17874)
 - [ha_cluster - Timeout issue between SBD with delay-start and systemd unit](https://issues.redhat.com/browse/RHEL-4684)
 - [kdump - fix: retry read of kexec_crash_size](https://issues.redhat.com/browse/RHEL-3354)
 - [keylime_server - won't detect registrar start failure](https://issues.redhat.com/browse/RHEL-21946)
 - [logging - fix: check that logging_max_message_size is set, not rsyslog_max_message_size](https://issues.redhat.com/browse/RHEL-15038)
 - [nbde_server - fix: Allow tangd socket override directory to be managed outside of the role](https://issues.redhat.com/browse/RHEL-25509)
 - [network - Ansible RHEL network system role issue with ipv6.routing-rules the prefix length for 'from' cannot be zero"](https://issues.redhat.com/browse/RHEL-16501)
 - [podman - fix: cast secret data to string in order to allow JSON valued strings](https://issues.redhat.com/browse/RHEL-22310)
 - [podman - fix: name of volume quadlet service should be basename-volume.service](https://issues.redhat.com/browse/RHEL-21402)
 - [podman - fix: add no_log: true for tasks that can log secret data](https://issues.redhat.com/browse/RHEL-19242)
 - [podman - fix: user linger needed before secrets](https://issues.redhat.com/browse/RHEL-22229)
 - [postgresql - PostgreSQL system role: unable to install PostgreSQL version 15 on RHEL 9](https://issues.redhat.com/browse/RHEL-21400)
 - [selinux - fix: Use `ignore_selinux_state` module option](https://issues.redhat.com/browse/RHEL-15871)
 - [selinux - fix: Print an error message when module to be created doesn't exist](https://issues.redhat.com/browse/RHEL-19044)
 - [selinux - fix: no longer use "item" as a loop variable](https://issues.redhat.com/browse/RHEL-19042)
 [1.22.0] - 2023-08-15
 ----------------------------
 ### New Features
- [ALL - fingerprint in config files managed by roles](https://bugzilla.redhat.com/show_bug.cgi?id=2185062)
+- [ALL - fingerprint in config files managed by roles](https://bugzilla.redhat.com/show_bug.cgi?id=2186910)
- [ad_integration - add ad_integration_force_rejoin](https://bugzilla.redhat.com/show_bug.cgi?id=2186253)
+- [ad_integration - add ad_integration_force_rejoin](https://bugzilla.redhat.com/show_bug.cgi?id=2211723)
- [certificate - add mode parameter to change permissions for cert files](https://bugzilla.redhat.com/show_bug.cgi?id=2180902)
+- [certificate - add mode parameter to change permissions for cert files](https://bugzilla.redhat.com/show_bug.cgi?id=2218204)
- [firewall - missing module in linux-system-roles.firewall to create an ipset](https://bugzilla.redhat.com/show_bug.cgi?id=2229802)
+- [firewall - missing module in linux-system-roles.firewall to create an ipset](https://bugzilla.redhat.com/show_bug.cgi?id=2140880)
- [firewall - should have option to disable conflicting services](https://bugzilla.redhat.com/show_bug.cgi?id=2222761)
+- [firewall - fix: reload on resetting to defaults](https://bugzilla.redhat.com/show_bug.cgi?id=2224648)
- [ha_cluster - Add possibility to load SBD watchdog kernel modules](https://bugzilla.redhat.com/show_bug.cgi?id=2185067)
+- [firewall - should have option to disable conflicting services](https://bugzilla.redhat.com/show_bug.cgi?id=2222809)
- [ha_cluster - support for resource and operation defaults](https://bugzilla.redhat.com/show_bug.cgi?id=2185065)
+- [ha_cluster - Add possibility to load SBD watchdog kernel modules](https://bugzilla.redhat.com/show_bug.cgi?id=2190478)
- [kdump - support auto_reset_crashkernel, dracut_args, deprecate /etc/sysconfig/kdump](https://bugzilla.redhat.com/show_bug.cgi?id=2211187)
+- [ha_cluster - cluster and quorum can have distinct passwords](https://bugzilla.redhat.com/show_bug.cgi?id=2216485)
- [keylime_server - New role - system role for managing keylime servers](https://bugzilla.redhat.com/show_bug.cgi?id=2224385)
+- [ha_cluster - support for resource and operation defaults](https://bugzilla.redhat.com/show_bug.cgi?id=2190483)
- [network - Support no-aaaa DNS option](https://bugzilla.redhat.com/show_bug.cgi?id=2218592)
+- [kdump - support auto_reset_crashkernel, dracut_args, deprecate /etc/sysconfig/kdump](https://bugzilla.redhat.com/show_bug.cgi?id=2211272)
- [network - Support configuring auto-dns setting](https://bugzilla.redhat.com/show_bug.cgi?id=2211194)
+- [keylime_server - system role for managing keylime servers](https://bugzilla.redhat.com/show_bug.cgi?id=2224387)
- [podman - support quadlet units](https://bugzilla.redhat.com/show_bug.cgi?id=2179455)
+- [network - Support configuring auto-dns setting](https://bugzilla.redhat.com/show_bug.cgi?id=2211273)
- [podman - allow container networking configuration](https://bugzilla.redhat.com/show_bug.cgi?id=2161712)
+- [network - Support no-aaaa DNS option](https://bugzilla.redhat.com/show_bug.cgi?id=2218595)
- [podman - support for healthchecks and healthcheck actions](https://bugzilla.redhat.com/show_bug.cgi?id=2179457)
+- [podman - allow container networking configuration](https://bugzilla.redhat.com/show_bug.cgi?id=2220963)
- [podman - use getsubids to look for subuid, subgid for IdM support](https://issues.redhat.com/browse/RHEL-865)
+- [podman - support for healthchecks and healthcheck actions](https://bugzilla.redhat.com/show_bug.cgi?id=2220961)
- [podman - allow to not pull images, continue if image pull fails](https://issues.redhat.com/browse/RHEL-857)
+- [podman - support quadlet units](https://bugzilla.redhat.com/show_bug.cgi?id=2220962)
- [postgresql - New role - system role for PostgreSQL management](https://bugzilla.redhat.com/show_bug.cgi?id=2151373)
+- [postgresql - [RFE] system role for PostgreSQL management](https://bugzilla.redhat.com/show_bug.cgi?id=2151371)
- [rhc - implement rhc_proxy.scheme](https://bugzilla.redhat.com/show_bug.cgi?id=2211748)
+- [rhc - implement rhc_proxy.scheme](https://bugzilla.redhat.com/show_bug.cgi?id=2211778)
- [selinux - use restorecon -T 0 on supported platforms](https://bugzilla.redhat.com/show_bug.cgi?id=2179460)
+- [rhc - [RFE] New role for Red Hat subscription management, insights management [rhel-8.9.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2179016)
- [ssh - add ssh_backup option with default true](https://bugzilla.redhat.com/show_bug.cgi?id=2216753)
+- [ssh - add ssh_backup option with default true](https://bugzilla.redhat.com/show_bug.cgi?id=2216759)
- [storage - mounted devices that are in use cannot be resized](https://bugzilla.redhat.com/show_bug.cgi?id=2168692)
+- [storage - RFE for the storage system role to support configuring the stripe size for RAID LVM volumes](https://bugzilla.redhat.com/show_bug.cgi?id=2141961)
- [storage - support configuring the stripe size for RAID LVM volumes](https://bugzilla.redhat.com/show_bug.cgi?id=2181656)
+- [storage - [RFE] user-specified mount point owner and permissions](https://bugzilla.redhat.com/show_bug.cgi?id=2181661)
- [storage - user-specified mount point owner and permissions](https://bugzilla.redhat.com/show_bug.cgi?id=2181657)
+- [systemd - system role for managing systemd units](https://bugzilla.redhat.com/show_bug.cgi?id=2224388)
 - [systemd - New role - system role for managing systemd units](https://bugzilla.redhat.com/show_bug.cgi?id=2224384)
 ### Bug Fixes
- [ALL - facts being gathered unnecessarily](https://bugzilla.redhat.com/show_bug.cgi?id=2223032)
+- [ALL - facts being gathered unnecessarily](https://bugzilla.redhat.com/show_bug.cgi?id=2223036)
- [ad_integration - leaks credentials when in check_mode](https://bugzilla.redhat.com/show_bug.cgi?id=2232758)
+- [ad_integration - leaks credentials when in check_mode](https://bugzilla.redhat.com/show_bug.cgi?id=2233183)
- [certificate - does not re-issue after updating key_size](https://bugzilla.redhat.com/show_bug.cgi?id=2224138)
+- [certificate - rhel-system-roles.certificate does not re-issue after updating key_size](https://bugzilla.redhat.com/show_bug.cgi?id=2186057)
- [firewall - fix: reload on resetting to defaults](https://bugzilla.redhat.com/show_bug.cgi?id=2223764)
+- [firewall - fix: reload on resetting to defaults](https://bugzilla.redhat.com/show_bug.cgi?id=2224648)
- [firewall - Check mode fails with replacing previous rules](https://issues.redhat.com/browse/RHEL-898)
+- [firewall - Check mode fails with replacing previous rules](https://issues.redhat.com/browse/RHEL-899)
- [firewall - Check mode fails when creating new firewall service](https://bugzilla.redhat.com/show_bug.cgi?id=2222428)
+- [firewall - Check mode fails when creating new firewall service](https://bugzilla.redhat.com/show_bug.cgi?id=2222433)
- [firewall - Ansible RHEL firewall system role not idempotent when configuring the interface using the role in rhel9](https://issues.redhat.com/browse/RHEL-885)
+- [firewall - Ansible RHEL firewall system role not idempotent when configuring the interface using the role in rhel9](https://issues.redhat.com/browse/RHEL-918)
- [firewall - Don't install python(3)-firewall it's a dependency of firewalld](https://bugzilla.redhat.com/show_bug.cgi?id=2216520)
+- [firewall - Don't install python(3)-firewall it's a dependency of firewalld](https://bugzilla.redhat.com/show_bug.cgi?id=2216521)
- [firewall - fix: files: overwrite firewalld.conf on previous replaced](https://issues.redhat.com/browse/RHEL-1495)
+- [firewall - fix: files: overwrite firewalld.conf on previous replaced](https://issues.redhat.com/browse/RHEL-1496)
- [kdump - use failure_action instead of default on EL9 and later](https://issues.redhat.com/browse/RHEL-906)
+- [kdump - use failure_action instead of default on EL9 and later](https://issues.redhat.com/browse/RHEL-907)
- [kdump - "Write new authorized_keys if needed" task idempotency issues](https://bugzilla.redhat.com/show_bug.cgi?id=2232241)
+- [kdump - role: "Write new authorized_keys if needed" task idempotency issues](https://bugzilla.redhat.com/show_bug.cgi?id=2232391)
- [kdump - system role fails if kdump_ssh_user doesn't have a .ssh/authorized_keys file in home directory](https://bugzilla.redhat.com/show_bug.cgi?id=2232231)
+- [kdump - system role fails if kdump_ssh_user doesn't have a .ssh/authorized_keys file in home directory](https://bugzilla.redhat.com/show_bug.cgi?id=2232392)
- [kdump - fix: ensure .ssh directory exists for kdump_ssh_user on kdump_ssh_server](https://issues.redhat.com/browse/RHEL-1397)
+- [kdump - fix: ensure .ssh directory exists for kdump_ssh_user on kdump_ssh_server](https://issues.redhat.com/browse/RHEL-1398)
- [kdump - fix: Ensure authorized_keys management works with multiple hosts](https://issues.redhat.com/browse/RHEL-1499)
+- [kdump - fix: Ensure authorized_keys management works with multiple hosts](https://issues.redhat.com/browse/RHEL-1500)
- [podman - Podman system role:  Unable to use podman_registries_conf to set unqualified-search-registries](https://bugzilla.redhat.com/show_bug.cgi?id=2211984)
+- [podman - Podman system role:  Unable to use podman_registries_conf to set unqualified-search-registries](https://bugzilla.redhat.com/show_bug.cgi?id=2226077)
- [rhc - system role does not apply Insights tags](https://bugzilla.redhat.com/show_bug.cgi?id=2209200)
+- [rhc - system role does not apply Insights tags](https://bugzilla.redhat.com/show_bug.cgi?id=2209441)
- [storage - RAID volume pre cleanup - remove existing data from member disks as needed before creation](https://bugzilla.redhat.com/show_bug.cgi?id=2224090)
+- [storage - Cannot set chunk size for RAID: Unsupported parameters for (blivet) module: pools.raid_chunk_size](https://bugzilla.redhat.com/show_bug.cgi?id=2193057)
- [storage - Cannot set chunk size for RAID: Unsupported parameters for (blivet) module: pools.raid_chunk_size](https://bugzilla.redhat.com/show_bug.cgi?id=2193058)
+- [storage - RAID volume pre cleanup - remove existing data from member disks as needed before creation](https://bugzilla.redhat.com/show_bug.cgi?id=2224094)
- [storage - fix: use stat.pw_name, stat.gr_name instead of owner, group](https://issues.redhat.com/browse/RHEL-1497)
+- [storage - Storage: mounted devices that are in use cannot be resized](https://bugzilla.redhat.com/show_bug.cgi?id=2168738)
- [tlog - use the proxy provider - the files provider is deprecated in sssd](https://bugzilla.redhat.com/show_bug.cgi?id=2179458)
+- [storage - fix: use stat.pw_name, stat.gr_name instead of owner, group](https://issues.redhat.com/browse/RHEL-1498)
 - [tlog - use the proxy provider - the files provider is deprecated in sssd](https://bugzilla.redhat.com/show_bug.cgi?id=2191702)
 [1.21.1] - 2023-03-16
 ----------------------------
 ### New Features
- [rhc - New Role - Red Hat subscription management, insights management](https://bugzilla.redhat.com/show_bug.cgi?id=2141330)
+- [rhc - New Role - Red Hat subscription management, insights management](https://bugzilla.redhat.com/show_bug.cgi?id=2144877)
 ### Bug Fixes
@ -70,88 +117,76 @@ Changelog
 ### New Features
- [ad_integration - New role - manage AD integration, join to AD domain](https://bugzilla.redhat.com/show_bug.cgi?id=2140795)
+- [ad_integration - [RFE] new role to support AD integration, join to AD domain](https://bugilla.redhat.com/show_bug.cgi?id=2144876)
- [cockpit - convert cockpit role to use firewall, selinux role, and certificate role](https://bugzilla.redhat.com/show_bug.cgi?id=2137663)
+- [cockpit - [RFE] convert cockpit role to use firewall, selinux role, and certificate role](https://bugzilla.redhat.com/show_bug.cgi?id=2137667)
- [ha_cluster - Allow quorum device configuration](https://bugzilla.redhat.com/show_bug.cgi?id=2140804)
+- [ha_cluster - Allow quorum device configuration](https://bugzilla.redhat.com/show_bug.cgi?id=2143814)
- [ha_cluster - convert ha_cluster role to use firewall, selinux and certificate role](https://bugzilla.redhat.com/show_bug.cgi?id=2130010)
+- [ha_cluster - [RFE] convert ha_cluster role to use firewall, selinux and certificate role](https://bugzilla.redhat.com/show_bug.cgi?id=2130019)
- [journald - New role - manage systemd-journald](https://bugzilla.redhat.com/show_bug.cgi?id=2165175)
+- [journald - New role - journald - manage systemd-journald](https://bugzilla.redhat.com/show_bug.cgi?id=2165176)
- [logging - convert logging role to use firewall, selinux role, and certificate role](https://bugzilla.redhat.com/show_bug.cgi?id=2130357)
+- [logging - [RFE] convert logging role to use firewall, selinux role, and certificate role](https://bugzilla.redhat.com/show_bug.cgi?id=2130362)
- [metrics - convert metrics role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2133528)
+- [metrics - [RFE] convert metrics role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2133532)
- [nbde_server - convert nbde_server role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2133930)
+- [nbde_server - [RFE] convert nbde_server role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2133931)
- [network - Support cloned MAC address](https://bugzilla.redhat.com/show_bug.cgi?id=2143768)
+- [network - Support cloned MAC address](https://bugzilla.redhat.com/show_bug.cgi?id=2143458)
- [network - Support setting the metric of the default route for initscripts provider](https://bugzilla.redhat.com/show_bug.cgi?id=2134202)
+- [network - [RFE] Support setting the metric of the default route for initscripts provider](https://bugzilla.redhat.com/show_bug.cgi?id=2134201)
- [network - Support the DNS priority](https://bugzilla.redhat.com/show_bug.cgi?id=2133858)
+- [network - [RFE] Support the DNS priority](https://bugzilla.redhat.com/show_bug.cgi?id=2133856)
- [network - Support looking up named route table in routing rule](https://bugzilla.redhat.com/show_bug.cgi?id=2131293)
+- [network - Support looking up named route table in routing rule](https://bugzilla.redhat.com/show_bug.cgi?id=2129620)
- [podman - New role - manage podman containers and systemd](https://bugzilla.redhat.com/show_bug.cgi?id=2143427)
+- [podman - [RFE] role for managing podman containers and systemd](https://bugzilla.redhat.com/show_bug.cgi?id=2066864)
- [postfix - convert postfix role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2130329)
+- [postfix - [RFE] convert postfix role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2130332)
- [selinux - add support for the 'local' parameter](https://bugzilla.redhat.com/show_bug.cgi?id=2128843)
+- [selinux - add support for the 'local' parameter](https://bugzilla.redhat.com/show_bug.cgi?id=2143385)
- [vpn - Add parameters shared_key_content, ike, esp, type, leftid, rightid](https://bugzilla.redhat.com/show_bug.cgi?id=2119102)
+- [vpn - Add parameters shared_key_content, ike, esp, type, leftid, rightid](https://bugzilla.redhat.com/show_bug.cgi?id=2119600)
- [vpn - convert vpn role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2130344)
+- [vpn - [RFE] convert vpn role to use firewall and selinux role](https://bugzilla.redhat.com/show_bug.cgi?id=2130345)
 ### Bug Fixes
- [ha_cluster - use no_log in tasks looping over pot. secret parameters](https://bugzilla.redhat.com/show_bug.cgi?id=2143816)
+- [ha_cluster - Fix stonith watchdog timeout](https://bugzilla.redhat.com/show_bug.cgi?id=2167941)
- [ha_cluster - Allow enabled SBD on disabled cluster](https://bugzilla.redhat.com/show_bug.cgi?id=2153030)
+- [ha_cluster - Allow enabled SBD on disabled cluster](https://bugzilla.redhat.com/show_bug.cgi?id=2153081)
- [ha_cluster - Fix stonith watchdog timeout](https://bugzilla.redhat.com/show_bug.cgi?id=2167528)
+- [ha_cluster - use no_log in tasks looping over pot. secret parameters](https://bugzilla.redhat.com/show_bug.cgi?id=2127497)
- [nbde_client - must handle clevis-luks-askpass and clevis-luks-askpass@ systemd unit names](https://bugzilla.redhat.com/show_bug.cgi?id=2126959)
+- [nbde_client - nbde_client_clevis fails with a traceback and prints sensitive data](https://bugzilla.redhat.com/show_bug.cgi?id=2159972)
- [nbde_client - nbde_client_clevis fails with a traceback and prints sensitive data](https://bugzilla.redhat.com/show_bug.cgi?id=2162782)
+- [nbde_client - must handle clevis-luks-askpass and clevis-luks-askpass@ systemd unit names](https://bugzilla.redhat.com/show_bug.cgi?id=2126960)
- [network - should route traffic via correct bond](https://bugzilla.redhat.com/show_bug.cgi?id=2168735)
+- [network - should route traffic via correct bond](https://bugzilla.redhat.com/show_bug.cgi?id=2168733)
- [selinux - managing modules is not idempotent](https://bugzilla.redhat.com/show_bug.cgi?id=2160152)
+- [selinux - managing modules is not idempotent](https://bugzilla.redhat.com/show_bug.cgi?id=2164879)
- [sshd,ssh,timesync - Unexpected templating type error - expected str instance, int found](https://bugzilla.redhat.com/show_bug.cgi?id=2129401)
+- [sshd,ssh,timesync - Unexpected templating type error - expected str instance, int found](https://bugzilla.redhat.com/show_bug.cgi?id=2143401)
- [tlog - Unconditionally enable the files provider](https://bugzilla.redhat.com/show_bug.cgi?id=2153043)
+- [tlog - Unconditionally enable the files provider](https://bugzilla.redhat.com/show_bug.cgi?id=2153080)
-[1.20.1] - 2022-09-27
+[1.20.0] - 2022-08-09
 ----------------------------
 ### New Features
- [ssh,sshd - Sync on final OpenSSH option name RequiredRSASize in ssh and sshd roles](https://bugzilla.redhat.com/show_bug.cgi?id=2129873)
+- [cockpit - Add customization of port](https://bugzilla.redhat.com/show_bug.cgi?id=2115159)
 - [firewall - RFE: firewall-system-role: add ability to add interface to zone by PCI device ID](https://bugzilla.redhat.com/show_bug.cgi?id=2100939)
 - [firewall - support for firewall_config - gather firewall facts](https://bugzilla.redhat.com/show_bug.cgi?id=2115160)
 - [logging - [RFE] Support startmsg.regex and endmsg.regex in the files inputs](https://bugzilla.redhat.com/show_bug.cgi?id=2112143)
 - [selinux - Added setting of seuser and selevel for completeness](https://bugzilla.redhat.com/show_bug.cgi?id=2115162)
 ### Bug Fixes
- none
+- [nbde_client - Sets proper spacing for parameter rd.neednet=1](https://bugzilla.redhat.com/show_bug.cgi?id=2115161)
-
+- [network - fix IPRouteUtils.get_route_tables_mapping() to accept any whitespace sequence](https://bugzilla.redhat.com/show_bug.cgi?id=2115884)
-[1.20.0] - 2022-08-05
+- [ssh sshd - ssh, sshd: RSAMinSize parameter definition is missing](https://bugzilla.redhat.com/show_bug.cgi?id=2109997)
----------------------------
+- [storage - [RHEL8] [WARNING]: The loop variable 'storage_test_volume' is already in use. You should set the `loop_var` value in the `loop_control` option for the task to something else to avoid variable collisions and unexpected behavior.](https://bugzilla.redhat.com/show_bug.cgi?id=2082391)
 ### New Features
 - [cockpit - Add customization of port](https://bugzilla.redhat.com/show_bug.cgi?id=2115152)
 - [firewall - RFE: firewall-system-role: add ability to add interface to zone by PCI device ID](https://bugzilla.redhat.com/show_bug.cgi?id=2100942)
 - [firewall - support for firewall_config - gather firewall facts](https://bugzilla.redhat.com/show_bug.cgi?id=2115154)
 - [logging - [RFE] Support startmsg.regex and endmsg.regex in the files inputs](https://bugzilla.redhat.com/show_bug.cgi?id=2112145)
 - [selinux - Added setting of seuser and selevel for completeness](https://bugzilla.redhat.com/show_bug.cgi?id=2115157)
 ### Bug Fixes
 - [nbde_client - Sets proper spacing for parameter rd.neednet=1](https://bugzilla.redhat.com/show_bug.cgi?id=2115156)
 - [network - fix IPRouteUtils.get_route_tables_mapping() to accept any whitespace sequence](https://bugzilla.redhat.com/show_bug.cgi?id=2115886)
 - [ssh sshd - ssh, sshd: RSAMinSize parameter definition is missing](https://bugzilla.redhat.com/show_bug.cgi?id=2109998)
 - [storage - [RHEL9] [WARNING]: The loop variable 'storage_test_volume' is already in use. You should set the `loop_var` value in the `loop_control` option for the task to something else to avoid variable collisions and unexpected behavior.](https://bugzilla.redhat.com/show_bug.cgi?id=2082736)
 [1.19.3] - 2022-07-01
 ----------------------------
 ### New Features
- [firewall - support add/modify/delete services](https://bugzilla.redhat.com/show_bug.cgi?id=2100292)
+- [firewall - support add/modify/delete services](https://bugzilla.redhat.com/show_bug.cgi?id=2100297)
- [network - [RFE] [network] Support managing the network through nmstate schema](https://bugzilla.redhat.com/show_bug.cgi?id=2072385)
+- [network - [RFE] [network] Support managing the network through nmstate schema](https://bugzilla.redhat.com/show_bug.cgi?id=2100979)
- [storage - support for adding/removing disks to/from storage pools](https://bugzilla.redhat.com/show_bug.cgi?id=2072742)
+- [storage - support for adding/removing disks to/from storage pools](https://bugzilla.redhat.com/show_bug.cgi?id=2066880)
- [storage - support for attaching cache volumes to existing volumes](https://bugzilla.redhat.com/show_bug.cgi?id=2072746)
+- [storage - support for attaching cache volumes to existing volumes](https://bugzilla.redhat.com/show_bug.cgi?id=2066881)
 ### Bug Fixes
- [firewall - forward_port should accept list of string or list of dict](https://bugzilla.redhat.com/show_bug.cgi?id=2100605)
+- [firewall - forward_port should accept list of string or list of dict](https://bugzilla.redhat.com/show_bug.cgi?id=2101607)
- [metrics - document minimum supported redis version required by rhel-system-roles](https://bugzilla.redhat.com/show_bug.cgi?id=2100286)
+- [metrics - document minimum supported redis version required by rhel-system-roles](https://bugzilla.redhat.com/show_bug.cgi?id=2100285)
- [metrics - restart pmie, pmlogger if changed, do not wait for handler](https://bugzilla.redhat.com/show_bug.cgi?id=2100294)
+- [metrics - restart pmie, pmlogger if changed, do not wait for handler](https://bugzilla.redhat.com/show_bug.cgi?id=2100298)
 - [storage - [RHEL9] _storage_test_pool_pvs get wrong data type in  test-verify-pool-members.yml](https://bugzilla.redhat.com/show_bug.cgi?id=2044119)
 [1.19.2] - 2022-06-15
 ----------------------------
 ### New Features
- [sshd - system role should be able to optionally manage /etc/ssh/sshd_config on RHEL 9](https://bugzilla.redhat.com/show_bug.cgi?id=2052086)
+- [sshd - system role should be able to optionally manage /etc/ssh/sshd_config on RHEL 9](https://bugzilla.redhat.com/show_bug.cgi?id=2086935)
 ### Bug Fixes
@ -162,8 +197,8 @@ Changelog
 ### New Features
- [storage - support for creating and managing LVM thin pools/LVs](https://bugzilla.redhat.com/show_bug.cgi?id=2072745)
+- [storage - support for creating and managing LVM thin pools/LVs](https://bugzilla.redhat.com/show_bug.cgi?id=2066876)
- [All roles should support running with gather_facts: false](https://bugzilla.redhat.com/show_bug.cgi?id=2078989)
+- [All roles should support running with gather_facts: false](https://bugzilla.redhat.com/show_bug.cgi?id=2079008)
 ### Bug Fixes
@ -174,56 +209,55 @@ Changelog
 ### New Features
- [storage - support for creating and managing LVM thin pools/LVs](https://bugzilla.redhat.com/show_bug.cgi?id=2072745)
+- [storage - support for creating and managing LVM thin pools/LVs](https://bugzilla.redhat.com/show_bug.cgi?id=2066876)
- [firewall - state no longer required for masquerade and ICMP block inversion](https://bugzilla.redhat.com/show_bug.cgi?id=2093423)
+- [firewall - state no longer required for masquerade and ICMP block inversion](https://bugzilla.redhat.com/show_bug.cgi?id=2093437)
 ### Bug Fixes
- [storage - role raid_level "striped" is not supported](https://bugzilla.redhat.com/show_bug.cgi?id=2083410)
+- [storage - role raid_level "striped" is not supported](https://bugzilla.redhat.com/show_bug.cgi?id=2083426)
-[1.18.0] - 2022-05-02
+[1.18.0] - 2022-05-26
 ----------------------------
 ### New Features
- [firewall - [Improvement] Allow System Role to reset to default Firewalld Settings](https://bugzilla.redhat.com/show_bug.cgi?id=2043010)
+- [firewall - [Improvement] Allow System Role to reset to default Firewalld Settings](https://bugzilla.redhat.com/show_bug.cgi?id=2043009)
- [metrics - [RFE] add an option to the metrics role to enable postfix metric collection](https://bugzilla.redhat.com/show_bug.cgi?id=2051737)
+- [metrics - [RFE] add an option to the metrics role to enable postfix metric collection](https://bugzilla.redhat.com/show_bug.cgi?id=2079114)
- [network - Rework the infiniband support](https://bugzilla.redhat.com/show_bug.cgi?id=2086965)
+- [network - Rework the infiniband support](https://bugzilla.redhat.com/show_bug.cgi?id=2086869)
- [sshd - system role should not assume that RHEL 9 /etc/ssh/sshd_config has "Include > /etc/ssh/sshd_config.d/*.conf"](https://bugzilla.redhat.com/show_bug.cgi?id=2052081)
+- [sshd - system role should not assume that RHEL 9 /etc/ssh/sshd_config has "Include > /etc/ssh/sshd_config.d/*.conf"](https://bugzilla.redhat.com/show_bug.cgi?id=2086934)
- [sshd - system role should be able to optionally manage /etc/ssh/sshd_config on RHEL 9](https://bugzilla.redhat.com/show_bug.cgi?id=2052086)
+- [sshd - system role should be able to optionally manage /etc/ssh/sshd_config on RHEL 9](https://bugzilla.redhat.com/show_bug.cgi?id=2086935)
 ### Bug Fixes
- [storage - role cannot set mount_options for volumes](https://bugzilla.redhat.com/show_bug.cgi?id=2083376)
+- [storage - role cannot set mount_options for volumes](https://bugzilla.redhat.com/show_bug.cgi?id=2083378)
 [1.17.0] - 2022-04-25
 ----------------------------
 ### New Features
- [All roles should support running with gather_facts: false](https://bugzilla.redhat.com/show_bug.cgi?id=2078989)
+- [All roles should support running with gather_facts: false](https://bugzilla.redhat.com/show_bug.cgi?id=2079008)
- [ha_cluster - support advanced corosync configuration](https://bugzilla.redhat.com/show_bug.cgi?id=2065337)
+- [ha_cluster - support advanced corosync configuration](https://bugzilla.redhat.com/show_bug.cgi?id=2065339)
- [ha_cluster - support SBD fencing](https://bugzilla.redhat.com/show_bug.cgi?id=2079626)
+- [ha_cluster - support SBD fencing](https://bugzilla.redhat.com/show_bug.cgi?id=2066868)
- [ha_cluster - add support for configuring bundle resources](https://bugzilla.redhat.com/show_bug.cgi?id=2073519)
+- [ha_cluster - add support for configuring bundle resources](https://bugzilla.redhat.com/show_bug.cgi?id=2073518)
- [logging - Logging - RFE - support template, severity and facility options](https://bugzilla.redhat.com/show_bug.cgi?id=2075119)
+- [logging - Logging - RFE - support template, severity and facility options](https://bugzilla.redhat.com/show_bug.cgi?id=2075116)
- [metrics - consistently use ansible_managed in configuration files managed by role [rhel-9.1.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065392)
+- [metrics - consistently use ansible_managed in configuration files managed by role [rhel-8.7.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065215)
- [metrics - [RFE] add an option to the metrics role to enable postfix metric collection](https://bugzilla.redhat.com/show_bug.cgi?id=2051737)
+- [metrics - [RFE] add an option to the metrics role to enable postfix metric collection](https://bugzilla.redhat.com/show_bug.cgi?id=2079114)
- [network - [RFE] Extend rhel-system-roles.network feature set to support routing rules](https://bugzilla.redhat.com/show_bug.cgi?id=2079622)
+- [network - [RFE] Extend rhel-system-roles.network feature set to support routing rules](https://bugzilla.redhat.com/show_bug.cgi?id=1996731)
- [postfix - Postfix RHEL System Role should provide the ability to replace config and reset configuration back to default [rhel-9.1.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065383)
+- [network - consistently use ansible_managed in configuration files managed by role [rhel-8.7.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065670)
- [storage - RFE storage Less verbosity by default](https://bugzilla.redhat.com/show_bug.cgi?id=2079627)
+- [postfix - consistently use ansible_managed in configuration files managed by role [rhel-8.7.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065216)
 - [postfix - Postfix RHEL System Role should provide the ability to replace config and reset configuration back to default [rhel-8.7.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065218)
 ### Bug Fixes
- [firewall - Firewall system role Ansible deprecation warning related to "include"](https://bugzilla.redhat.com/show_bug.cgi?id=2061511)
+- [firewall - Firewall system role Ansible deprecation warning related to "include"](https://bugzilla.redhat.com/show_bug.cgi?id=2078650)
- [kernel_settings - error configobj not found on RHEL 8.6 managed hosts](https://bugzilla.redhat.com/show_bug.cgi?id=2060525)
+- [kernel_settings - error configobj not found on RHEL 8.6 managed hosts [rhel-8.7.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2060378)
- [logging - tests fail during cleanup if no cloud-init on system](https://bugzilla.redhat.com/show_bug.cgi?id=2058799)
+- [metrics - Metrics role, with "metrics_from_mssql" option does not configure /var/lib/pcp/pmdas/mssql/mssql.conf on first run [rhel-8.7.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2060377)
- [metrics - Metrics role, with "metrics_from_mssql" option does not configure /var/lib/pcp/pmdas/mssql/mssql.conf on first run](https://bugzilla.redhat.com/show_bug.cgi?id=2060523)
+- [nbde_client - NBDE client system role does not support servers with static IP addresses [rhel-8.7.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2071011)
- [nbde_client - NBDE client system role does not support servers with static IP addresses [rhel-9.1.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2070462)
+- [network - bond: fix typo in supporting the infiniband ports in active-backup mode](https://bugzilla.redhat.com/show_bug.cgi?id=2064067)
- [network - bond: fix typo in supporting the infiniband ports in active-backup mode [rhel-9.1.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065394)
+- [sshd - FIPS mode detection in SSHD role is wrong](https://bugzilla.redhat.com/show_bug.cgi?id=2075338)
- [network - consistently use ansible_managed in configuration files managed by role [rhel-9.1.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065382)
+- [storage - RFE storage Less verbosity by default](https://bugzilla.redhat.com/show_bug.cgi?id=2056480)
- [postfix - consistently use ansible_managed in configuration files managed by role [rhel-9.1.0]](https://bugzilla.redhat.com/show_bug.cgi?id=2065393)
+- [tlog - Tlog role - Enabling session recording configuration does not work due to RHEL9 SSSD files provider default](https://bugzilla.redhat.com/show_bug.cgi?id=2072749)
 - [sshd - FIPS mode detection in SSHD role is wrong](https://bugzilla.redhat.com/show_bug.cgi?id=2073605)
 - [tlog - Tlog role - Enabling session recording configuration does not work due to RHEL9 SSSD files provider default](https://bugzilla.redhat.com/show_bug.cgi?id=2071804)
 [1.16.3] - 2022-04-07
 ----------------------------
@ -296,7 +330,7 @@ Changelog
 - [metrics - Metrics role, with "metrics_from_mssql" option does not configure /var/lib/pcp/pmdas/mssql/mssql.conf on first run](https://bugzilla.redhat.com/show_bug.cgi?id=2058655)
 - [firewall - ensure target changes take effect immediately](https://bugzilla.redhat.com/show_bug.cgi?id=2057172)
-[1.14.0] - 2022-02-21
+[1.14.0] - 2022-02-14
 ----------------------------
 ### New Features
@ -310,7 +344,19 @@ Changelog
 - [ha_cluster - set permissions for haclient group](https://bugzilla.redhat.com/show_bug.cgi?id=2049747)
-[1.13.0] - 2022-02-14
+[1.13.1] - 2022-02-08
 ----------------------------
 ### New Features
 - none
 ### Bug Fixes
 - [vpn - vpn: template error while templating string: no filter named 'vpn_ipaddr'](https://bugzilla.redhat.com/show_bug.cgi?id=2050341)
 - [kdump - kdump: Unable to start service kdump: Job for kdump.service failed because the control process exited with error code.](https://bugzilla.redhat.com/show_bug.cgi?id=2052105)
 [1.13.0] - 2022-02-01
 ----------------------------
 ### New Features
@ -327,7 +373,7 @@ Changelog
 - [network - Failure to activate connection: nm-manager-error-quark: No suitable device found for this connection](https://bugzilla.redhat.com/show_bug.cgi?id=2034908)
 - [network - Set DNS search setting only for enabled IP protocols](https://bugzilla.redhat.com/show_bug.cgi?id=2041627)
-[1.12.1] - 2022-02-08
+[1.12.0] - 2022-01-27
 ----------------------------
 ### New Features
@ -336,18 +382,6 @@ Changelog
 ### Bug Fixes
 - [vpn - vpn: template error while templating string: no filter named 'vpn_ipaddr'](https://bugzilla.redhat.com/show_bug.cgi?id=2050341)
 - [kdump - kdump: Unable to start service kdump: Job for kdump.service failed because the control process exited with error code.](https://bugzilla.redhat.com/show_bug.cgi?id=2052105)
 [1.12.0] - 2022-02-03
 ----------------------------
 ### New Features
 - [Support ansible-core 2.11+](https://bugzilla.redhat.com/show_bug.cgi?id=2012316)
 ### Bug Fixes
 - [logging - Logging role "logging_purge_confs" option not properly working](https://bugzilla.redhat.com/show_bug.cgi?id=2040812)
 - [kernel_settings - role should use ansible_managed in its configuration file](https://bugzilla.redhat.com/show_bug.cgi?id=2047504)
@ -392,18 +426,7 @@ Changelog
 - [nbde_client - add regenerate-all to the dracut command](https://bugzilla.redhat.com/show_bug.cgi?id=2021682)
 - [certificate - certificates: "group" option keeps certificates inaccessible to the group](https://bugzilla.redhat.com/show_bug.cgi?id=2021683)
-[1.9.0] - 2021-10-26
+[1.7.3] - 2021-08-26
 ----------------------------
 ### New Features
 - [logging - [RFE]  logging - Add user and password](https://bugzilla.redhat.com/show_bug.cgi?id=1990490)
 ### Bug Fixes
 - [Replace `# {{ ansible_managed }}` with `{{ ansible_managed | comment }}`](https://bugzilla.redhat.com/show_bug.cgi?id=2006230)
 [1.8.3] - 2021-08-26
 ----------------------------
 ### New Features
@ -414,7 +437,7 @@ Changelog
 - none
-[1.8.2] - 2021-08-24
+[1.7.2] - 2021-08-24
 ----------------------------
 ### New Features
@ -425,7 +448,7 @@ Changelog
 - [logging - Update the certificates copy tasks](https://bugzilla.redhat.com/show_bug.cgi?id=1996777)
-[1.8.1] - 2021-08-16
+[1.7.1] - 2021-08-16
 ----------------------------
 ### New Features
@ -436,7 +459,7 @@ Changelog
 - [metrics - role: the bpftrace role does not properly configure bpftrace agent](https://bugzilla.redhat.com/show_bug.cgi?id=1994180)
-[1.8.0] - 2021-08-12
+[1.7.0] - 2021-08-12
 ----------------------------
 ### New Features
@ -447,7 +470,7 @@ Changelog
 - [sshd - sshd: failed to validate: error:Missing Match criteria for all Bad Match condition](https://bugzilla.redhat.com/show_bug.cgi?id=1991598)
-[1.7.5] - 2021-08-10
+[1.6.6] - 2021-08-06
 ----------------------------
 ### New Features
@ -458,7 +481,7 @@ Changelog
 - none
-[1.7.4] - 2021-08-06
+[1.6.2] - 2021-07-30
 ----------------------------
 ### New Features
@ -469,19 +492,18 @@ Changelog
 - [metrics - role: Grafana dashboard not working after metrics role run unless services manually restarted](https://bugzilla.redhat.com/show_bug.cgi?id=1984150)
-[1.7.0] - 2021-07-28
+[1.6.0] - 2021-07-28
 ----------------------------
 ### New Features
 - [logging - [RFE] logging - Add a support for list value to server_host in the elasticsearch output](https://bugzilla.redhat.com/show_bug.cgi?id=1986460)
 - [storage - [RFE] storage: support volume sizes as a percentage of pool](https://bugzilla.redhat.com/show_bug.cgi?id=1984583)
 ### Bug Fixes
 - none
-[1.6.0] - 2021-07-15
+[1.5.0] - 2021-07-15
 ----------------------------
 ### New Features
@ -492,7 +514,7 @@ Changelog
 - none
-[1.5.0] - 2021-07-15
+[1.4.3] - 2021-07-15
 ----------------------------
 ### New Features
@ -523,7 +545,7 @@ Changelog
 ### Bug Fixes
- [network - Re-running the network system role results in "changed: true" when nothing has actually changed](https://bugzilla.redhat.com/show_bug.cgi?id=1980871)
+- [network - Re-running the network system role results in "changed: true" when nothing has actually changed](https://bugzilla.redhat.com/show_bug.cgi?id=1943384)
 [1.4.0] - 2021-07-08
 ----------------------------
@ -541,17 +563,19 @@ Changelog
 ### New Features
- [storage - RFE: Request that VDO be added to the Ansible (redhat-system-roles)](https://bugzilla.redhat.com/show_bug.cgi?id=1978488)
+- [ha_cluster - RFE: add pacemaker resources configuration](https://bugzilla.redhat.com/show_bug.cgi?id=1963283)
- [sshd - RFE: sshd - support for appending a snippet to configuration file](https://bugzilla.redhat.com/show_bug.cgi?id=1978752)
+- [network - [Network] RFE: Support ignoring default gateway retrieved by DHCP/IPv6-RA](https://bugzilla.redhat.com/show_bug.cgi?id=1897565)
- [timesync - RFE: timesync support for Network Time Security (NTS)](https://bugzilla.redhat.com/show_bug.cgi?id=1978753)
+- [storage - RFE: Request that VDO be added to the Ansible (redhat-system-roles)](https://bugzilla.redhat.com/show_bug.cgi?id=1882475)
 - [sshd - RFE: sshd - support for appending a snippet to configuration file](https://bugzilla.redhat.com/show_bug.cgi?id=1970642)
 - [timesync - RFE: timesync support for Network Time Security (NTS)](https://bugzilla.redhat.com/show_bug.cgi?id=1970664)
 ### Bug Fixes
- [postfix - Postfix RHEL system role README.md missing variables under the "Role Variables" section](https://bugzilla.redhat.com/show_bug.cgi?id=1978734)
+- [postfix - Postfix RHEL system role README.md missing variables under the "Role Variables" section](https://bugzilla.redhat.com/show_bug.cgi?id=1961858)
- [postfix - the postfix role is not idempotent](https://bugzilla.redhat.com/show_bug.cgi?id=1978760)
+- [postfix - the postfix role is not idempotent](https://bugzilla.redhat.com/show_bug.cgi?id=1960375)
- [selinux - task for semanage says Fedora in name but also runs on RHEL/CentOS 8](https://bugzilla.redhat.com/show_bug.cgi?id=1978740)
+- [selinux - task for semanage says Fedora in name but also runs on RHEL/CentOS 8](https://bugzilla.redhat.com/show_bug.cgi?id=1966681)
- [metrics - role task to enable logging for targeted hosts not working](https://bugzilla.redhat.com/show_bug.cgi?id=1978746)
+- [metrics - role task to enable logging for targeted hosts not working](https://bugzilla.redhat.com/show_bug.cgi?id=1967335)
- [sshd ssh - Unable to set sshd_hostkey_group and sshd_hostkey_mode](https://bugzilla.redhat.com/show_bug.cgi?id=1978745)
+- [sshd ssh - Unable to set sshd_hostkey_group and sshd_hostkey_mode](https://bugzilla.redhat.com/show_bug.cgi?id=1966711)
 [1.2.3] - 2021-06-17
 ----------------------------
@ -569,11 +593,12 @@ Changelog
 ### New Features
- none
+- [timesync - Add hybrid_e2e option to PTP domain](https://bugzilla.redhat.com/show_bug.cgi?id=1957849)
 ### Bug Fixes
 - [Internal links in README.md are broken](https://bugzilla.redhat.com/show_bug.cgi?id=1962976)
 - [ha_cluster - cannot read preshared key in binary format](https://bugzilla.redhat.com/show_bug.cgi?id=1952620)
 [1.2.1] - 2021-05-21
 ----------------------------
@ -586,7 +611,7 @@ Changelog
 - [Internal links in README.md are broken](https://bugzilla.redhat.com/show_bug.cgi?id=1962976)
-[1.2.0] - 2021-05-21
+[1.2.0] - 2021-05-17
 ----------------------------
 ### New Features
@ -595,11 +620,9 @@ Changelog
 ### Bug Fixes
 - [postfix - the postfix role is not idempotent](https://bugzilla.redhat.com/show_bug.cgi?id=1960375)
 - [postfix - postfix: Use FQRN in README](https://bugzilla.redhat.com/show_bug.cgi?id=1958963)
 - [postfix - Documentation error in rhel-system-roles postfix readme file](https://bugzilla.redhat.com/show_bug.cgi?id=1866544)
 - [storage - storage: calltrace observed when set type: partition for storage_pools](https://bugzilla.redhat.com/show_bug.cgi?id=1854187)
 - [ha_cluster - cannot read preshared key in binary format](https://bugzilla.redhat.com/show_bug.cgi?id=1952620)
 [1.1.0] - 2021-05-13
 ----------------------------
@ -619,6 +642,61 @@ Changelog
 - [timesync - do not use ignore_errors in timesync role](https://bugzilla.redhat.com/show_bug.cgi?id=1938014)
 - [selinux - rhel-system-roles should not reload the SELinux policy if its not changed](https://bugzilla.redhat.com/show_bug.cgi?id=1757869)
 [1.0.0] - 2021-02-23
 ----------------------------
 ### New Features
 - [network - RFE: [network] Support of DNS with options](https://bugzilla.redhat.com/show_bug.cgi?id=1893959)
 - [network - RFE: [network] Embrace Inclusive language](https://bugzilla.redhat.com/show_bug.cgi?id=1893957)
 - [ssh - [8.4] [RFE] Release Ansible role for ssh client in rhel-system-roles](https://bugzilla.redhat.com/show_bug.cgi?id=1893712)
 - [clusterha - [8.4] [RFE] Release Ansible role for cluster HA in rhel-system-roles](https://bugzilla.redhat.com/show_bug.cgi?id=1893743)
 - [logging - Logging - Support RELP secure transport in the logging role configuration](https://bugzilla.redhat.com/show_bug.cgi?id=1889484)
 - [metrics - [8.4] [RFE] add exporting-metric-data-to-elasticsearch functionality in the metrics role](https://bugzilla.redhat.com/show_bug.cgi?id=1895188)
 - [metrics - release SQL server configuration support in the metrics role](https://bugzilla.redhat.com/show_bug.cgi?id=1893908)
 - [[8.4] Package rhel-system-roles in the collection format in addition to the legacy role format](https://bugzilla.redhat.com/show_bug.cgi?id=1893906)
 ### Bug Fixes
 - [logging - Logging - Integrating ELK with RHV-4.4 fails as RHVH is missing 'rsyslog-gnutls' package.](https://bugzilla.redhat.com/show_bug.cgi?id=1927943)
 - [storage - storage: omitted parameters on existing pool/volume is interpreted as "use the default"](https://bugzilla.redhat.com/show_bug.cgi?id=1894651)
 - [storage - storage: must list disks in order to identify an existing pool](https://bugzilla.redhat.com/show_bug.cgi?id=1894676)
 - [storage - storage: pool metadata usage must be accounted for by the user](https://bugzilla.redhat.com/show_bug.cgi?id=1894647)
 - [selinux - Merged fix incorrect default value (there is no variable named "present")](https://bugzilla.redhat.com/show_bug.cgi?id=1926947)
 - [storage - storage: tests_luks.yml partition case failed with nvme disk](https://bugzilla.redhat.com/show_bug.cgi?id=1865990)
 [1.0] - 2021-01-15
 ----------------------------
 ### New Features
 - [tlog - Add exclude_users and exclude_groups support](https://bugzilla.redhat.com/show_bug.cgi?id=1895472)
 - [crypto_policies - [8.4] [RFE] Release Ansible role for crypto policies in rhel-system-roles](https://bugzilla.redhat.com/show_bug.cgi?id=1893699)
 - [sshd - [8.4] [RFE] Release Ansible role for sshd in rhel-system-roles](https://bugzilla.redhat.com/show_bug.cgi?id=1893696)
 - [metrics - role should automate the setup of Grafana datasources](https://bugzilla.redhat.com/show_bug.cgi?id=1855544)
 - [network role: Support -K|--features|--offload ethtool options](https://bugzilla.redhat.com/show_bug.cgi?id=1696703)
 - [network role: Atomic changes](https://bugzilla.redhat.com/show_bug.cgi?id=1695161)
 ### Bug Fixes
 - [storage - safe mode of storage role does not prevent accidentally losing data when toggling encryption on a volume, disk or pool](https://bugzilla.redhat.com/show_bug.cgi?id=1881524)
 - [storage - storage: ext2/3/4 resize function doesn't work](https://bugzilla.redhat.com/show_bug.cgi?id=1862867)
 - [logging - [logging role] cannot setup machine with tls](https://bugzilla.redhat.com/show_bug.cgi?id=1861318)
 - [certificate - role: The role is not idempotent in rhel7](https://bugzilla.redhat.com/show_bug.cgi?id=1859547)
 - [logging - Logging - Bug fixes](https://bugzilla.redhat.com/show_bug.cgi?id=1854546)
 - [logging - [logging role] support scenario for client without key/cert, just CA cert](https://bugzilla.redhat.com/show_bug.cgi?id=1860896)
 - [metrics - role incorrectly sets up multiple primary pmie processes in multi-host mode](https://bugzilla.redhat.com/show_bug.cgi?id=1855539)
 - [certificate - role cannot manage EL7 hosts](https://bugzilla.redhat.com/show_bug.cgi?id=1848745)
 - [network - [network] Support state:down persistent_state:absent for non-existent profile](https://bugzilla.redhat.com/show_bug.cgi?id=1822777)
 - [network - Creating active bonded interface fails with the initscripts provider](https://bugzilla.redhat.com/show_bug.cgi?id=1848472)
 - [logging - Logging role had performance issues](https://bugzilla.redhat.com/show_bug.cgi?id=1848762)
 - [certificate - role does not work on controller hosts which use jinja2 2.10](https://bugzilla.redhat.com/show_bug.cgi?id=1848742)
 - [nbde_client - fix idempotency, check_mode issues with nbde_client role](https://bugzilla.redhat.com/show_bug.cgi?id=1848766)
 - [storage - Storage role can remove existing filesystems and volume groups without warning](https://bugzilla.redhat.com/show_bug.cgi?id=1763242)
 - [network role: Minimize service disruption](https://bugzilla.redhat.com/show_bug.cgi?id=1695157)
 - [typo in selinux/tests/tests_selinux_disabled.yml: Invalid options for assert: mgs](https://bugzilla.redhat.com/show_bug.cgi?id=1677743)
 - [Check mode problems in rhel-system-roles](https://bugzilla.redhat.com/show_bug.cgi?id=1685904)
 [0.6] - 2018-05-11
 ----------------------------
--- a/SOURCES/extrasources.inc
+++ b/SOURCES/extrasources.inc
@ -1,10 +1,10 @@
 Source801: https://galaxy.ansible.com/download/ansible-posix-1.5.4.tar.gz
-Source901: https://galaxy.ansible.com/download/community-general-7.3.0.tar.gz
+Source901: https://galaxy.ansible.com/download/community-general-8.3.0.tar.gz
-Source902: https://galaxy.ansible.com/download/containers-podman-1.10.3.tar.gz
+Source902: https://galaxy.ansible.com/download/containers-podman-1.12.0.tar.gz
 Provides: bundled(ansible-collection(ansible.posix)) = 1.5.4
-Provides: bundled(ansible-collection(community.general)) = 7.3.0
+Provides: bundled(ansible-collection(community.general)) = 8.3.0
-Provides: bundled(ansible-collection(containers.podman)) = 1.10.3
+Provides: bundled(ansible-collection(containers.podman)) = 1.12.0
 Source996: CHANGELOG.rst
 Source998: collection_readme.sh
--- a/SOURCES/vendoring-build.inc
+++ b/SOURCES/vendoring-build.inc
@ -1,104 +1,102 @@
-# Unpack tar.gz to retrieve to be vendored modules and place them in the roles library.
+# maps the source file to the roles that use that file
-# ansible.posix:
+# value can be string or space delimited list of strings
-#   - library:
+# role name `__collection` means - do not vendor into
-#     - Module selinux and seboolean for the selinux role
+# role, just vendor directly into the collection
-#     - Module mount for the storage role
+declare -A plugin_map=(
-declare -A module_map=( ["selinux.py"]="selinux" ["seboolean.py"]="selinux" ["mount.py"]="storage" )
+  [ansible/posix/plugins/modules/selinux.py]=selinux
-for module in "${!module_map[@]}"; do
+  [ansible/posix/plugins/modules/seboolean.py]=selinux
-  role="${module_map[${module}]}"
+  [ansible/posix/plugins/modules/mount.py]=storage
-  if [ ! -d $role/library ]; then
+  [ansible/posix/plugins/modules/rhel_facts.py]=__collection
-    mkdir $role/library
+  [ansible/posix/plugins/modules/rhel_rpm_ostree.py]=__collection
-  fi
+  [ansible/posix/plugins/module_utils/mount.py]=storage
-  cp -pL .external/ansible/posix/plugins/modules/$module $role/library/$module
+  [community/general/plugins/modules/ini_file.py]="tlog ad_integration"
-  sed -i -e ':a;N;$!ba;s/description:\n\( *\)/description:\n\1- WARNING: Do not use this module directly! It is only for role internal use.\n\1/' -e "s/ansible_collections.ansible.posix.plugins.module_utils/ansible.module_utils.${role}_lsr/" $role/library/$module
+  [community/general/plugins/modules/modprobe.py]=ha_cluster
-done
+  [community/general/plugins/modules/redhat_subscription.py]=rhc
  [community/general/plugins/modules/rhsm_release.py]=rhc
  [community/general/plugins/modules/rhsm_repository.py]=rhc
  [community/general/plugins/modules/seport.py]=selinux
  [community/general/plugins/modules/sefcontext.py]=selinux
  [community/general/plugins/modules/selogin.py]=selinux
  [containers/podman/plugins/modules/podman_container_info.py]=podman
  [containers/podman/plugins/modules/podman_image.py]=podman
  [containers/podman/plugins/modules/podman_play.py]=podman
  [containers/podman/plugins/modules/podman_secret.py]=podman
  [containers/podman/plugins/module_utils/podman/common.py]=podman
 )
-# ansible.posix:
+declare -a modules mod_utils collection_plugins
-#   - module_utils:
+declare -A dests
-#     - Module_util mount for the storage role
+# vendor in plugin files - fix documentation, fragments
-module_map=( ["mount.py"]="storage" )
+for src in "${!plugin_map[@]}"; do
-for module in "${!module_map[@]}"; do
+  roles="${plugin_map["$src"]}"
-  role="${module_map[${module}]}"
+  if [ "$roles" = __collection ]; then
-  if [ ! -d $role/module_utils/${role}_lsr ]; then
+    collection_plugins+=("$src")
-    mkdir -p $role/module_utils/${role}_lsr
+  else
    case "$src" in
    */plugins/modules/*) srcdir=plugins/modules; subdir=library; modules+=("$src") ;;
    */plugins/module_utils/*) srcdir=plugins/module_utils; mod_utils+=("$src") ;;
    */plugins/action/*) srcdir=plugins/action ;;
    esac
  fi
-  cp -pL .external/ansible/posix/plugins/module_utils/$module $role/module_utils/${role}_lsr/$module
+  for role in $roles; do
-done
+    if [ "$role" = __collection ]; then
-
+      dest="%{collection_build_path}/plugins${src/#*plugins/}"
-# community.general:
+      dests["$dest"]=__collection
-#   - library:
+    else
-#     - Module seport, sefcontext and selogin for the selinux role rolename2
+      case "$src" in
-#     - Module ini_file for role tlog
+      */plugins/module_utils/*) subdir="module_utils/${role}_lsr" ;;
-#     - rhc modules
+      esac
-#     - ha_cluster uses modprobe
+      dest="$role/${src/#*${srcdir}/${subdir}}"
-module_map=( ["seport.py"]="selinux" ["sefcontext.py"]="selinux" ["selogin.py"]="selinux" ["ini_file.py"]="tlog"
+      dests["$dest"]="$role"
-  ["redhat_subscription.py"]="rhc" ["rhsm_release.py"]="rhc" ["rhsm_repository.py"]="rhc"
+    fi
-  ["modprobe.py"]="ha_cluster" )
+    destdir="$(dirname "$dest")"
-for module in "${!module_map[@]}"; do
+    if [ ! -d "$destdir" ]; then
-  role="${module_map[${module}]}"
+      mkdir -p "$destdir"
-  if [ ! -d $role/library ]; then
+    fi
-    mkdir $role/library
+    cp -pL ".external/$src" "$dest"
-  fi
+    sed -e ':a;N;$!ba;s/description:\n\( *\)/description:\n\1- WARNING: Do not use this plugin directly! It is only for role internal use.\n\1/' \
-  # version 5.x seems to be broken?
+      -e '/^extends_documentation_fragment:/,/^[^ -]/{/^extends/d;/^[ -]/d}' \
-  moduledir=.external/community/general/plugins/modules
+      -i "$dest"
-  if [ ! -f $moduledir/$module ]; then
+  done
    moduledir=.external/community/general/plugins/modules/system
  fi
  if [ ! -f $moduledir/$module ]; then
    moduledir=.external/community/general/plugins/modules/files
  fi
  cp -pL $moduledir/$module $role/library/$module
  ls -alrtF $role/library/$module
  sed -i -e ':a;N;$!ba;s/description:\n\( *\)/description:\n\1- WARNING: Do not use this module directly! It is only for role internal use.\n\1/' $role/library/$module
  # Remove doc_fragments
  sed -i '/^extends_documentation_fragment:/,/^[^ -]/{/^extends/d;/^[ -]/d}' $role/library/$module
 done
 # containers.podman:
 #   - library:
 #     - Module podman_container_info, podman_image and podman_play for the podman role
 module_map=( ["podman_container_info.py"]="podman" ["podman_image.py"]="podman" ["podman_play.py"]="podman"
  ["podman_secret.py"]="podman" )
 for module in "${!module_map[@]}"; do
  role="${module_map[${module}]}"
  if [ ! -d $role/library ]; then
    mkdir $role/library
  fi
  moduledir=.external/containers/podman/plugins/modules
  cp -pL $moduledir/$module $role/library/$module
  ls -alrtF $role/library/$module
  sed -i -e ':a;N;$!ba;s/description:\n\( *\)/description:\n\1- WARNING: Do not use this module directly! It is only for role internal use.\n\1/' \
    -e "s/ansible_collections.containers.podman.plugins.module_utils.podman/ansible.module_utils.${role}_lsr/" \
    $role/library/$module
 done
 # containers.podman:
 #   - module_utils:
 #     - Module_util common for the podman role
 module_map=( ["common.py"]="podman" )
 for module in "${!module_map[@]}"; do
  role="${module_map[${module}]}"
  if [ ! -d $role/module_utils/${role}_lsr ]; then
    mkdir -p $role/module_utils/${role}_lsr
  fi
  cp -pL .external/containers/podman/plugins/module_utils/podman/$module $role/module_utils/${role}_lsr/$module
 done
 # remove the temporary .external directory after vendoring
 rm -rf .external
 # fix python imports to point from the old name to the new name
 for dest in "${!dests[@]}"; do
  role="${dests["$dest"]}"
  for module in "${modules[@]}"; do
    python_name="$(dirname "$module")"
    python_name="${python_name////[.]}"
    sed -e "s/ansible_collections[.]${python_name}[.]/ansible.modules./" -i "$dest"
  done
  for mod_util in "${mod_utils[@]}"; do
    # some mod_utils have subdirs, some do not
    split=(${mod_util//// })
    python_name="ansible_collections[.]${split[0]}[.]${split[1]}[.]plugins[.]module_utils[.]"
    sed -e "s/${python_name}/ansible.module_utils.${role}_lsr./" -i "$dest"
  done
  for plugin in "${collection_plugins[@]}"; do
    python_name="$(dirname "$plugin")"
    dest_python_name="%{collection_namespace}/%{collection_name}/plugins${python_name/#*plugins/}"
    src_python_name="ansible_collections.${python_name////[.]}"
    dest_python_name="ansible_collections.${dest_python_name////.}"
    sed -e "s/${src_python_name}/${dest_python_name}/" -i "$dest"
  done
 done
 # Replacing "linux-system-roles.rolename" with "rhel-system-roles.rolename" in each role
 # Replacing "fedora.linux_system_roles." with "redhat.rhel_system_roles" in each role
 # This is for the "roles calling other roles" case
 # for podman, change the FQCN - using a non-FQCN module name doesn't seem to work,
 # even for the legacy role format
 # replace community.general for rhc
 for rolename in %{rolenames}; do
-    find $rolename -type f -exec \
+    find "$rolename" -type f -exec \
         sed -e "s/linux-system-roles[.]${rolename}\\>/%{roleinstprefix}${rolename}/g" \
             -e "s/fedora[.]linux_system_roles[.]/%{collection_namespace}.%{collection_name}./g" \
             -e "s/containers[.]podman[.]/%{collection_namespace}.%{collection_name}./g" \
             -e "s/community[.]general[.]/%{collection_namespace}.%{collection_name}./g" \
             -e "s/ansible[.]posix[.]/%{collection_namespace}.%{collection_name}./g" \
             -i {} \;
 done
--- a/SPECS/linux-system-roles.spec
+++ b/SPECS/linux-system-roles.spec