f89d87c4b5
With minimal facts gathering we will experience failures while trying to evaluate amount of threads for apis or mounts for hardening. So to avoid gathering full hardware subset, we add common-task which will gather only specific subset that can be additionally filtered. Gathering processor or mounts subsent simply does not work with ansible and result in full hardware subset as well. Change-Id: Ia5802b4ec0b18271b8c5fbcc5574b484c5233a01
44 lines
1.5 KiB
YAML
44 lines
1.5 KiB
YAML
---
|
|
# Copyright 2016, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
# As an additional safeguard, this playbook requires the
|
|
# 'apply_security_hardening' boolean set to True for it to apply security
|
|
# hardening standards to a system.
|
|
|
|
- name: Gather security hardening facts
|
|
hosts: "{{ security_host_group|default('hosts') }}"
|
|
gather_facts: "{{ osa_gather_facts | default(True) }}"
|
|
tags:
|
|
- always
|
|
|
|
- name: Apply security hardening configurations
|
|
hosts: "{{ security_host_group|default('hosts') }}"
|
|
gather_facts: false
|
|
user: root
|
|
pre_tasks:
|
|
- name: Gather additional facts
|
|
include_tasks: "common-tasks/gather-hardware-facts.yml"
|
|
vars:
|
|
deployment_extra_facts_filter: ansible_mounts
|
|
deployment_extra_facts_subset: "!all,hardware"
|
|
tags:
|
|
- always
|
|
roles:
|
|
- role: "ansible-hardening"
|
|
when: apply_security_hardening | bool
|
|
environment: "{{ deployment_environment_variables | default({}) }}"
|
|
tags:
|
|
- security
|