Generate profile oriented Ansible Playbooks in a different way #11033
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit converts some of the code to a class. Using class allows us to write cleaner code and avoids need to passing data as parameters.
In this commit, we extend the abilities of `generate_bash_scripts.py` to generate also profile oriented Ansible Playbooks. The script now can generate either profile oriented Bash remediation scripts or profile oriented Ansible Playbooks. Consequently, we need to rename this tool to a more generic name `generate_profile_remediations.py`. The profile oriented Ansible Playbooks generated by `generate_profile_remediations.py` are very similar to Playbooks generated by the `oscap xccdf generate fix` command.
We will generate the profile oriented Ansible Playbooks using the new script `generate_profile_remediations.py` which is faster than the current method that calls `oscap` under its hood.
jan-cerny
added
enhancement
|
Start a new ephemeral environment with changes proposed in this pull request: Fedora Environment Oracle Linux 8 Environment |
Reduce the amout of parameters
|
Code Climate has analyzed commit 9546960 and detected 3 issues on this pull request. Here's the issue category breakdown:
The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 53.3% (0.0% change). View more on Code Climate. |
jan-cerny
added a commit
to jan-cerny/scap-security-guide
that referenced
this pull request
Sep 14, 2023
In ComplianceAsCode#11033, we have switched to a new script for generating profile oriented Ansible Playbooks. Unfortunately, when Python 2 is used the generated Ansible Playbooks don't preserve the order of Ansible Tasks in the order defined in the SCAP source data stream. The wrong order of Ansible Tasks in a Playbook might cause an unexpected conflict between them during the run, for example ComplianceAsCode#11104. The root cause of the problem is that dictionaries in Python 2 don't preserve order of elements but starting from Python 3.6 the dictionaries preserve order of its elements. Fixes: ComplianceAsCode#11104
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
Extend the abilities of
generate_bash_scripts.pyto generate also profile oriented Ansible Playbooks. The script now cangenerate either profile oriented Bash remediation scripts or profile oriented Ansible Playbooks. Consequently, we need to rename this tool to a more generic name
generate_profile_remediations.py. The profile oriented Ansible Playbooks generated bygenerate_profile_remediations.pyare very similar to Playbooks generated by theoscap xccdf generate fixcommand.The
generate_profile_remediations.pywill be used to generate profile oriented Ansible Playbooks during the build instead of using scripts that calloscap xccdf generate fixcommand.The PR contains refactoring of the script.
Rationale:
Review Hints:
Build the content from master and from this branch. Then, compare contents of the
build/ansibledirectory in the old and new build usingmeldordiff.