ansible-lockdown / RHEL7-STIG

Ansible role for Red Hat 7 STIG Baseline
MIT License
282 stars 144 forks source link

Offline usage - ERROR! 'collections' is not a valid attribute for a RoleMetadata #459

Open hearts1137 opened 5 months ago

hearts1137 commented 5 months ago

Question Pose question here.

Environment (please complete the following information): ansible --version ansible 2.4.2.0 config file = /etc/ansible/ansible.cfg configured module search path = [u'/home/user1/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python2.7/site-packages/ansible executable location = /bin/ansible python version = 2.7.5 (default, Oct 6 2023, 09:53:10) [GCC 4.8.5 20150623 (Red Hat 4.8.5-44)]

Looking to add this to our offline network. Kind of an ansible newbie but have run and modified existing playbooks previously. We have a plain RHEL 7.9 server with 'some STIGS's applied. Would like to give these playbooks a go but off to a bad start. Pretty sure I'm missing a ton of dependencies.

Error is: ERROR! 'collections' is not a valid attribute for a RoleMetadata

Any help would be appreciated

georgenalen commented 5 months ago

Hey @hearts1137, From the environment setup you posted (thanks for sending that) it looks like you are on a pretty old version of Ansible, 2.4. which came out around 2017. Can you confirm that is the version of the Ansible CLI or Ansible Core software you are using? If you are on version 2.4 of the Ansible CLI/Ansible Core would you be able to upgrade Ansible to a newer version (you'll probably have to move to python3 as well)?

The gist is in late 2.9 they introduced the concept of collections and I think around 2.10 they forced collections. So we had to adjust to make our roles into collection supported roles. There were some other changes along the way with how Ansible handles linting and other things that caused us to make additional changes as well that don't work with older versions. Which is why the minimum supported version for the roles is 2.12.

hearts1137 commented 5 months ago

The ansible version 2.4.2.0 is the only one in our internal repo. How do you want me to check the Ansible CLI and Core version numbers? Sorry for the noob questions and thank you for the fast response.

`(base) [root@server1 ~]# yum info ansible.noarch Loaded plugins: product-id, search-disabled-repos, subscription-manager

This system is not registered with an entitlement server. You can use subscription-manager to register.

Installed Packages Name : ansible Arch : noarch Version : 2.4.2.0 Release : 2.el7 Size : 38 M Repo : installed From repo : rhui-REGION-rhel-server-extras Summary : SSH-based configuration management, deployment, and task execution system URL : http://ansible.com License : GPLv3+ Description : : Ansible is a radically simple model-driven configuration management, : multi-node deployment, and remote task execution system. Ansible works : over SSH and does not require any software or daemons to be installed : on remote nodes. Extension modules can be written in any language and : are transferred to managed machines automatically.

(base) [root@server1 ~]# python --version Python 3.8.18 `

I would have to spin up a RHEL 7.9 connected to the internet and download ansible 2.12 and all the related dependencies and upload to my offline server. I have a RedHat developer account for personal use and can add a subscription to a VOM on my local laptop.

hearts1137 commented 5 months ago

I'm reading that ansible 2.10 and later is not supported in RHEL7. I do have a rhel8 on my local network with redhat subscription access. Seems like RHEL8 has 2.15.3 in the repo

`[root@server2 ~]# yum info ansible.noarch Updating Subscription Management repositories. Last metadata expiration check: 0:00:09 ago on Mon 25 Mar 2024 04:38:57 PM CDT. Available Packages Name : ansible Version : 8.3.0 Release : 1.el8 Architecture : noarch Size : 41 M Source : ansible-8.3.0-1.el8.src.rpm Repository : epel Summary : Curated set of Ansible collections included in addition to ansible-core URL : https://ansible.com License : GPL-3.0-or-later AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND MIT AND MPL-2.0 AND PSF-2.0 Description : Ansible is a radically simple model-driven configuration management, : multi-node deployment, and remote task execution system. Ansible works : over SSH and does not require any software or daemons to be installed : on remote nodes. Extension modules can be written in any language and : are transferred to managed machines automatically. : : This package provides a curated set of Ansible collections included in addition : to ansible-core.

[root@server2 ~]# yum info ansible-core.x86_64 Updating Subscription Management repositories. Last metadata expiration check: 0:00:40 ago on Mon 25 Mar 2024 04:38:57 PM CDT. Installed Packages Name : ansible-core Version : 2.15.3 Release : 1.el8 Architecture : x86_64 Size : 14 M Source : ansible-core-2.15.3-1.el8.src.rpm Repository : @System From repo : rhel-8-for-x86_64-appstream-rpms Summary : SSH-based configuration management, deployment, and task execution system URL : http://ansible.com License : GPLv3+ Description : Ansible is a radically simple model-driven configuration management, : multi-node deployment, and remote task execution system. Ansible works : over SSH and does not require any software or daemons to be installed : on remote nodes. Extension modules can be written in any language and : are transferred to managed machines automatically. `

Is it possible to get these playbooks running on RHEL7 or do I need RHEL8? Our systems that are air-gapped are all RHEL7.9.

uk-bolly commented 4 months ago

hi @hearts1137

Ideally, it would be good to have a rhel8 (9 preferably) control node for ansible within your airgapped environment, this will future proof you for some time and make life alot easier.

The playbooks should run on ansible 2.10, you will also need the jmespath library installed in order for the playbook to run. Alternatively you could add a later version of python (3.8+) on your system and install a later ansible versions.

I hope that helps, please let us know if you have any further questions.

uk-bolly