Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Ansible Tasks order #11117

Merged
merged 1 commit into from
Sep 15, 2023
Merged

Conversation

jan-cerny
Copy link
Collaborator

@jan-cerny jan-cerny commented Sep 14, 2023

In #11033, we have switched to a new script for generating profile oriented Ansible Playbooks. Unfortunately, when Python 2 is used the generated Ansible Playbooks don't preserve the order of Ansible Tasks in the order defined in the SCAP source data stream. The wrong order of Ansible Tasks in a Playbook might cause an unexpected conflict between them during the run, for example #11104. The root cause of the problem is that dictionaries in Python 2 don't preserve order of elements but starting from Python 3.6 the dictionaries preserve order of its elements.

Fixes: #11104

Review Hints:

  1. Build a scratch build for RHEL 7.9 from this PR branch
  2. Run /hardening/ansible/anssi_nt28_high from contest against a RHEL 7.9 machine where that scratch build is installed
  3. Check that the test passes.
  4. Check the after guest reboot results of mount point related rules

In ComplianceAsCode#11033, we
have switched to a new script for generating profile oriented
Ansible Playbooks. Unfortunately, when Python 2 is used the
generated Ansible Playbooks don't preserve the order of Ansible
Tasks in the order defined in the SCAP source data stream.
The wrong order of Ansible Tasks in a Playbook might cause
an unexpected conflict between them during the run, for example
ComplianceAsCode#11104.
The root cause of the problem is that dictionaries in Python 2
don't preserve order of elements but starting from Python 3.6
the dictionaries preserve order of its elements.

Fixes: ComplianceAsCode#11104
@openshift-ci
Copy link

openshift-ci bot commented Sep 14, 2023

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Sep 14, 2023
@github-actions
Copy link

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

@codeclimate
Copy link

codeclimate bot commented Sep 14, 2023

Code Climate has analyzed commit b86685b and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 53.8% (0.0% change).

View more on Code Climate.

@jan-cerny jan-cerny added the bugfix Fixes to reported bugs. label Sep 15, 2023
@jan-cerny jan-cerny added this to the 0.1.70 milestone Sep 15, 2023
@jan-cerny jan-cerny marked this pull request as ready for review September 15, 2023 07:50
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Sep 15, 2023
@jan-cerny jan-cerny added Infrastructure Our content build system Ansible Ansible remediation update. labels Sep 15, 2023
@vojtapolasek vojtapolasek self-assigned this Sep 15, 2023
Copy link
Collaborator

@vojtapolasek vojtapolasek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @jan-cerny for the fix. I tested it according to provided hints and the issue seems to be solved.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Ansible Ansible remediation update. bugfix Fixes to reported bugs. Infrastructure Our content build system
Projects
None yet
Development

Successfully merging this pull request may close these issues.

mount_option related rules are failing in ANSSI NT28 High profile evaluation
2 participants