search

ansible / product-demos

GNU General Public License v3.0
170 stars 173 forks source link

NETWORK / DISA STIG continuously fails with the same error message #152

Open mconig527 opened 4 weeks ago

mconig527 commented 4 weeks ago

When spinning up a Product Demo environment and trying to run a NETWORK / DISA STIG job template, it continues to fail with the same error message:

ERROR! couldn't resolve module/action 'ios_logging'. This often indicates a misspelling, missing collection, or incorrect module path.
The error appears to be in '/runner/project/collections/ansible_collections/demo/compliance/roles/iosxeSTIG/tasks/main.yml': line 378, column 3, but may
be elsewhere in the file depending on the exact syntax problem.
The offending line appears to be:
# Please configure name IP address to a valid one.
- name : stigrule_215837_host
  ^ here

I reviewed the main.yaml file in the iosxe directory to see if the offending line from the error message was the issue, and that seems to be fine (syntax-wise). So I am guessing the root cause lies somewhere else as indicated in the message.

taruch commented 3 weeks ago

I can take this.

jce-redhat commented 3 weeks ago

the cisco.ios.ios_logging module was removed in v5.0.0 of the collection (current version is v8.0.0). prior to the product-demos-ee update, the collection was pinned at v4.4.0 which is why it had been working.

the demo.compliance.iosxeSTIG role used by the "NETWORK / DISA STIG" job template comes from the DISA Supplemental Automation Content site, and was last updated in october 2021. in order to fix this issue, i see three options:

  1. get DISA to fix their role upstream, then update this repo with the latest content. this would be ideal but probably won't happen any time soon, if at all.
  2. fork the DISA content and maintain it in this repo.
  3. create an EE specifically for this job template that includes the 4.x version of the cisco.ios collection.
taruch commented 2 weeks ago

I think option 2 is the best option. That was what I did to demo this, fork it, and turn off the tasks that use ios_logging (there weren't many). As this is just a demo, this is completely reasonable path forward.