Merge https://github.com/cisagov/skeleton-ansible-role into lineage/s…

…keleton # Conflicts: # .github/dependabot.yml # meta/main.yml # molecule/default/prepare.yml
cisagov · Jun 2, 2024 · 2eae7ff · 2eae7ff
2 parents 2fee23f + 9e3015c
commit 2eae7ff
Show file tree

Hide file tree

Showing 11 changed files with 253 additions and 25 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -19,8 +19,15 @@ updates:
       - dependency-name: hashicorp/setup-terraform
       - dependency-name: mxschmitt/action-tmate
       - dependency-name: step-security/harden-runner
+<<<<<<< HEAD
       # Managed by cisagov/skeleton-ansible-role
       - dependency-name: github/codeql-action
+=======
+      # # Managed by cisagov/skeleton-ansible-role
+      # - dependency-name: docker/setup-buildx-action
+      # - dependency-name: docker/setup-qemu-action
+      # - dependency-name: github/codeql-action
+>>>>>>> 9e3015cd6965dedb779cafd71c27889a1cc16efc
     package-ecosystem: github-actions
     schedule:
       interval: weekly

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -168,12 +168,30 @@ jobs:
         uses: mxschmitt/action-tmate@v3
         if: env.RUN_TMATE
   test:
+    name: >-
+      test (${{ matrix.scenario }}) -
+      ${{ matrix.platform }}-${{ matrix.architecture }}
     needs:
       - diagnostics
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
+        architecture:
+          - amd64
+          - arm64
+        platform:
+          - amazonlinux2023-systemd
+          - debian10-systemd
+          - debian11-systemd
+          - debian12-systemd
+          - debian13-systemd
+          - fedora39-systemd
+          - fedora40-systemd
+          - kali-systemd
+          - ubuntu-20-systemd
+          - ubuntu-22-systemd
+          - ubuntu-24-systemd
         scenario:
           - default
     steps:
@@ -204,8 +222,15 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install --upgrade --requirement requirements-test.txt
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       - name: Run molecule tests
-        run: molecule test --scenario-name ${{ matrix.scenario }}
+        run: >-
+          molecule test
+          --platform-name ${{ matrix.platform }}-${{ matrix.architecture }}
+          --scenario-name ${{ matrix.scenario }}
       - name: Setup tmate debug session
         uses: mxschmitt/action-tmate@v3
         if: env.RUN_TMATE
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -125,8 +125,9 @@ repos:
     rev: 1.7.7
     hooks:
       - id: bandit
-        # Bandit complains about the use of assert() in tests
-        exclude: molecule/(default|systemd_enabled)/tests
+        # Bandit complains about the use of assert() in tests. This should cover
+        # the tests/ subdirectory for any molecule scenario.
+        exclude: molecule/[^/]+/tests
         args:
           - --config=.bandit.yml
   - repo: https://github.com/psf/black-pre-commit-mirror

diff --git a/meta/main.yml b/meta/main.yml
@@ -10,8 +10,13 @@ galaxy_info:
   company: CISA Cyber Assessments
   description: Install prerequisites and configure grub to handle NVMe drives.
   galaxy_tags:
+<<<<<<< HEAD
     - nvme
   license: CC0
+=======
+    - skeleton
+  license: CC0-1.0
+>>>>>>> 9e3015cd6965dedb779cafd71c27889a1cc16efc
   # With the release of version 2.10, Ansible finally correctly
   # identifies Kali Linux as being the Kali distribution of the Debian
   # OS family.  This simplifies a lot of things for roles that support
@@ -31,14 +36,19 @@ galaxy_info:
         - trixie
     - name: Fedora
       versions:
-        - "38"
         - "39"
+        - "40"
     - name: Kali
       versions:
         - "2023"
     - name: Ubuntu
       versions:
         - focal
         - jammy
+<<<<<<< HEAD
   role_name: nvme
+=======
+        - noble
+  role_name: skeleton
+>>>>>>> 9e3015cd6965dedb779cafd71c27889a1cc16efc
   standalone: true
diff --git a/molecule/default/externally-managed-python.yml b/molecule/default/externally-managed-python.yml
@@ -0,0 +1,49 @@
+---
+# This is in place to restore a destructive action in geerlingguy's Ansible
+# Docker images that we use for testing. The change is fine for the intended
+# purpose of the images but not for how we use them.
+- name: Ensure Python is marked as externally managed if appropriate
+  hosts: all
+  become: true
+  become_method: ansible.builtin.sudo
+  tasks:
+    - name: Ensure Python is marked as externally managed
+      when:
+        - ansible_distribution in ["Debian", "Ubuntu"]
+        - ansible_distribution_release not in ["bullseye", "buster", "focal", "jammy"]
+      block:
+        - name: Gather package facts
+          ansible.builtin.package_facts:
+            manager: auto
+
+        - name: Ensure the EXTERNALLY-MANAGED file is present if Python 3 is installed
+          when: '"python3" in ansible_facts.packages'
+          block:
+            # This gets a unique list of installed Python packages in the form of major.minor
+            # by taking the list of installed Python packages and:
+            # 1. Extracting the version from each package's information
+            # 2. Removing any version information after the major.minor version
+            # 3. Ensuring there are no duplicates
+            #
+            # NOTE:
+            # Since the value of python_versions is a multiline string, the regex expressions used in
+            # the regex_replace filter must use single backslashes for special sequences. If the value
+            # of python_versions were to be changed from a multiline string, the special sequences
+            # must be modified to use double backslashes instead. This is due to how the YAML is
+            # processed when Ansible reads the playbook.
+            - name: Extract version information about installed Python packages
+              ansible.builtin.set_fact:
+                python_versions: >-
+                  {{
+                    ansible_facts.packages["python3"]
+                    | map(attribute="version")
+                    | map("regex_replace", "^(\d+\.\d+)\.\d+.*$", "\1")
+                    | unique
+                  }}
+
+            - name: Restore EXTERNALLY-MANAGED file for Python
+              ansible.builtin.template:
+                dest: /usr/lib/python{{ item }}/EXTERNALLY-MANAGED
+                mode: 0644
+                src: EXTERNALLY-MANAGED.j2
+              loop: "{{ python_versions }}"
diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml
@@ -7,61 +7,115 @@ platforms:
   - cgroupns_mode: host
     command: /lib/systemd/systemd
     image: docker.io/geerlingguy/docker-amazonlinux2023-ansible:latest
-    name: amazonlinux2023-systemd
+    name: amazonlinux2023-systemd-amd64
     platform: amd64
     pre_build_image: true
     privileged: true
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
+  - cgroupns_mode: host
+    command: /lib/systemd/systemd
+    image: docker.io/geerlingguy/docker-amazonlinux2023-ansible:latest
+    name: amazonlinux2023-systemd-arm64
+    platform: arm64
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
   - cgroupns_mode: host
     command: /lib/systemd/systemd
     image: docker.io/geerlingguy/docker-debian10-ansible:latest
-    name: debian10-systemd
+    name: debian10-systemd-amd64
     platform: amd64
     pre_build_image: true
     privileged: true
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
+  - cgroupns_mode: host
+    command: /lib/systemd/systemd
+    image: docker.io/geerlingguy/docker-debian10-ansible:latest
+    name: debian10-systemd-arm64
+    platform: arm64
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
   - cgroupns_mode: host
     command: /lib/systemd/systemd
     image: docker.io/geerlingguy/docker-debian11-ansible:latest
-    name: debian11-systemd
+    name: debian11-systemd-amd64
     platform: amd64
     pre_build_image: true
     privileged: true
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
+  - cgroupns_mode: host
+    command: /lib/systemd/systemd
+    image: docker.io/geerlingguy/docker-debian11-ansible:latest
+    name: debian11-systemd-arm64
+    platform: arm64
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
   - cgroupns_mode: host
     command: /lib/systemd/systemd
     image: docker.io/geerlingguy/docker-debian12-ansible:latest
-    name: debian12-systemd
+    name: debian12-systemd-amd64
     platform: amd64
     pre_build_image: true
     privileged: true
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
+  - cgroupns_mode: host
+    command: /lib/systemd/systemd
+    image: docker.io/geerlingguy/docker-debian12-ansible:latest
+    name: debian12-systemd-arm64
+    platform: arm64
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
   - cgroupns_mode: host
     command: /lib/systemd/systemd
     image: docker.io/cisagov/docker-debian13-ansible:latest
-    name: debian13-systemd
+    name: debian13-systemd-amd64
     platform: amd64
     pre_build_image: true
     privileged: true
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
+  - cgroupns_mode: host
+    command: /lib/systemd/systemd
+    image: docker.io/cisagov/docker-debian13-ansible:latest
+    name: debian13-systemd-arm64
+    platform: arm64
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
   - cgroupns_mode: host
     command: /lib/systemd/systemd
     image: docker.io/cisagov/docker-kali-ansible:latest
-    name: kali-systemd
+    name: kali-systemd-amd64
     platform: amd64
     pre_build_image: true
     privileged: true
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
   - cgroupns_mode: host
     command: /lib/systemd/systemd
-    image: docker.io/geerlingguy/docker-fedora38-ansible:latest
-    name: fedora38-systemd
+    image: docker.io/cisagov/docker-kali-ansible:latest
+    name: kali-systemd-arm64
+    platform: arm64
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+  - cgroupns_mode: host
+    command: /lib/systemd/systemd
+    image: docker.io/geerlingguy/docker-fedora39-ansible:latest
+    name: fedora39-systemd-amd64
     platform: amd64
     pre_build_image: true
     privileged: true
@@ -70,30 +124,84 @@ platforms:
   - cgroupns_mode: host
     command: /lib/systemd/systemd
     image: docker.io/geerlingguy/docker-fedora39-ansible:latest
-    name: fedora39-systemd
+    name: fedora39-systemd-arm64
+    platform: arm64
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+  - cgroupns_mode: host
+    command: /lib/systemd/systemd
+    image: docker.io/geerlingguy/docker-fedora40-ansible:latest
+    name: fedora40-systemd-amd64
     platform: amd64
     pre_build_image: true
     privileged: true
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
+  - cgroupns_mode: host
+    command: /lib/systemd/systemd
+    image: docker.io/geerlingguy/docker-fedora40-ansible:latest
+    name: fedora40-systemd-arm64
+    platform: arm64
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
   - cgroupns_mode: host
     command: /lib/systemd/systemd
     image: docker.io/geerlingguy/docker-ubuntu2004-ansible:latest
-    name: ubuntu-20-systemd
+    name: ubuntu-20-systemd-amd64
     platform: amd64
     pre_build_image: true
     privileged: true
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
+  - cgroupns_mode: host
+    command: /lib/systemd/systemd
+    image: docker.io/geerlingguy/docker-ubuntu2004-ansible:latest
+    name: ubuntu-20-systemd-arm64
+    platform: arm64
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
   - cgroupns_mode: host
     command: /lib/systemd/systemd
     image: docker.io/geerlingguy/docker-ubuntu2204-ansible:latest
-    name: ubuntu-22-systemd
+    name: ubuntu-22-systemd-amd64
     platform: amd64
     pre_build_image: true
     privileged: true
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:rw
+  - cgroupns_mode: host
+    command: /lib/systemd/systemd
+    image: docker.io/geerlingguy/docker-ubuntu2204-ansible:latest
+    name: ubuntu-22-systemd-arm64
+    platform: arm64
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+  - cgroupns_mode: host
+    command: /lib/systemd/systemd
+    image: docker.io/geerlingguy/docker-ubuntu2404-ansible:latest
+    name: ubuntu-24-systemd-amd64
+    platform: amd64
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+  - cgroupns_mode: host
+    command: /lib/systemd/systemd
+    image: docker.io/geerlingguy/docker-ubuntu2404-ansible:latest
+    name: ubuntu-24-systemd-arm64
+    platform: arm64
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
 scenario:
   name: default
 verifier:

diff --git a/molecule/default/prepare.yml b/molecule/default/prepare.yml
@@ -2,6 +2,7 @@
 - name: Import upgrade playbook
   ansible.builtin.import_playbook: upgrade.yml
 
+<<<<<<< HEAD
 # The kmod package is installed anywhere we would be applying this
 # Ansible role
 - name: Prepare
@@ -10,3 +11,7 @@
     - name: Install kmod
       ansible.builtin.package:
         name: kmod
+=======
+- name: Import externally-managed-python playbook
+  ansible.builtin.import_playbook: externally-managed-python.yml
+>>>>>>> 9e3015cd6965dedb779cafd71c27889a1cc16efc