sw_config/bmra/patched_rhel_packages.yml

   1 # SPDX-FileCopyrightText: 2021 Intel Corporation.
   2 #
   3 # SPDX-License-Identifier: Apache-2.0
   4
   5 ---
   6 - name: enable PowerTools repository on CentOS >= 8 and < 8.3
   7 # noqa 303 - yum is called intenionallly here
   8   command: yum config-manager --set-enabled PowerTools
   9   when:
  10     - ansible_distribution == "CentOS"
  11     - ansible_distribution_version >= '8' and ansible_distribution_version < '8.3'
  12
  13 - name: enable powertools repository on CentOS >= 8.3
  14 # noqa 303 - yum is called intenionallly here
  15   command: yum config-manager --set-enabled powertools
  16   when:
  17     - ansible_distribution == "CentOS"
  18     - ansible_distribution_version >= '8.3'
  19
  20 - name: enable CodeReady Linux Builder repository on RHEL 8
  21   rhsm_repository:
  22     name: codeready-builder-for-rhel-8-x86_64-rpms
  23   when:
  24     - ansible_distribution == "RedHat"
  25     - ansible_distribution_version >= '8'
  26
  27 - name: install epel-release on CentOS
  28   package:
  29     name: epel-release
  30   when:
  31     - ansible_distribution == "CentOS"
  32
  33 - name: obtain EPEL GPG key on RHEL8
  34   rpm_key:
  35     state: present
  36     key: https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-8
  37   when:
  38     - ansible_distribution == "RedHat"
  39     - ansible_distribution_version >= '8'
  40
  41 - name: install epel-release on RHEL8
  42   package:
  43     name: https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
  44   when:
  45     - ansible_distribution == "RedHat"
  46     - ansible_distribution_version >= '8'
  47
  48 - name: get full distribution versions
  49   command: cat /etc/redhat-release
  50   register: release
  51   changed_when: true
  52
  53 - name: set full distribution version
  54   set_fact:
  55     full_dist_version: "{{ release.stdout | regex_replace('.*(\\d+.\\d+.\\d\\d\\d\\d).*', '\\1') }}"
  56
  57 - name: update CentOS Vault yum repository on CentOS 7
  58   yum_repository:
  59     name: C{{ full_dist_version }}-base
  60     description: CentOS-{{ full_dist_version }} - Base
  61     file: CentOS-Vault
  62     baseurl: http://vault.centos.org/{{ full_dist_version }}/os/$basearch/
  63     gpgcheck: yes
  64     gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-{{ ansible_distribution_major_version }}
  65     enabled: yes
  66   when:
  67     - ansible_distribution == "CentOS"
  68     - ansible_distribution_version < '7.9'
  69     - not update_kernel
  70
  71 #- name: update CentOS Vault yum repository on CentOS 8
  72 #  yum_repository:
  73 #    name: C{{ full_dist_version }}-base
  74 #    description: CentOS-{{ full_dist_version }} - Base
  75 #    file: CentOS-Vault
  76 #    baseurl: http://vault.centos.org/{{ full_dist_version }}/BaseOS/$basearch/os/
  77 #    baseurl: http://vault.centos.org/{{ full_dist_version }}/BaseOS/Source/
  78 #    gpgcheck: yes
  79 #    gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
  80 #    enabled: yes
  81 #  when:
  82 #    - ansible_distribution == "CentOS"
  83 #    - ansible_distribution_version >= '8' and ansible_distribution_version < '8.3'
  84 #    - not update_kernel
  85
  86 # CentOS-Vault repo not working for CentOS 8, so install kernel headers directly
  87 - name: pull matching kernel headers on CentOS 8.2
  88   package:
  89     name: "{{ item }}"
  90     state: present
  91   retries: 5
  92   delay: 10
  93   register: source_status
  94   until: source_status is not failed
  95   with_items:
  96     - "https://vault.centos.org/8.2.2004/BaseOS/x86_64/os/Packages/kernel-headers-4.18.0-193.el8.x86_64.rpm"
  97     - "https://vault.centos.org/8.2.2004/BaseOS/x86_64/os/Packages/kernel-devel-4.18.0-193.el8.x86_64.rpm"
  98   when:
  99     - ansible_distribution == "CentOS"
 100     - ansible_distribution_version == '8.2'
 101     - not update_kernel
 102
 103 - name: pull matching kernel headers on CentOS 8.3
 104   package:
 105     name: "{{ item }}"
 106     state: present
 107   register: source_status
 108   with_items:
 109     - "https://vault.centos.org/8.3.2011/BaseOS/x86_64/os/Packages/kernel-headers-4.18.0-240.el8.x86_64.rpm"
 110     - "https://vault.centos.org/8.3.2011/BaseOS/x86_64/os/Packages/kernel-devel-4.18.0-240.el8.x86_64.rpm"
 111   when:
 112     - ansible_distribution == "CentOS"
 113     - ansible_distribution_version == '8.3'
 114     - not update_kernel
 115
 116 - name: pull matching kernel headers on CentOS 8.4
 117   package:
 118     name: "{{ item }}"
 119     state: present
 120   register: source_status
 121   with_items:
 122     - "http://mirror.centos.org/centos/8/BaseOS/x86_64/os/Packages/kernel-headers-4.18.0-305.3.1.el8.x86_64.rpm"
 123     - "http://mirror.centos.org/centos/8/BaseOS/x86_64/os/Packages/kernel-devel-4.18.0-305.3.1.el8.x86_64.rpm"
 124 #    - "https://vault.centos.org/8.4.2105/BaseOS/x86_64/os/Packages/kernel-headers-4.18.0-305.el8.x86_64.rpm"
 125 #    - "https://vault.centos.org/8.4.2105/BaseOS/x86_64/os/Packages/kernel-devel-4.18.0-305.el8.x86_64.rpm"
 126   when:
 127     - ansible_distribution == "CentOS"
 128     - ansible_distribution_version == '8.4'
 129     - not update_kernel
 130
 131 # pull the matching kernel headers if kernel is not updated
 132 - name: pull matching kernel headers from configured repos
 133 # noqa 503 - more than one condition, can't be a handler
 134   package:
 135     name:
 136       - kernel-headers-{{ ansible_kernel }}
 137       - kernel-devel-{{ ansible_kernel }}
 138   register: kernel_source
 139   retries: 3
 140   until: kernel_source is success
 141   when:
 142     - not source_status.changed
 143     - ansible_os_family == "RedHat"
 144     - not update_kernel
 145
 146 - name: install the 'Development tools' package group
 147   package:
 148     name: "@Development tools"
 149   when:
 150     - ansible_os_family == "RedHat"
 151
 152 - name: install pip
 153   package:
 154     name: python-pip
 155   when:
 156     - ansible_distribution in ["RedHat", "CentOS"]
 157     - ansible_distribution_version < '8'
 158
 159 - name: install pip
 160   package:
 161     name: python3-pip
 162   when:
 163     - ansible_distribution in ["RedHat", "CentOS"]
 164     - ansible_distribution_version >= '8'
 165
 166 - name: update all packages
 167   package:
 168     name: '*'
 169     state: latest # noqa 403
 170     exclude: kernel*
 171   when:
 172     - ansible_os_family == "RedHat"
 173     - update_all_packages | default(false)
 174
 175 - name: update to the latest kernel and kernel headers on the Red Hat OS family
 176   package:
 177     name:
 178     - kernel
 179     - kernel-devel
 180     state: latest # noqa 403
 181   notify:
 182     - reboot server
 183   when:
 184     - ansible_os_family == "RedHat"
 185     - update_kernel | default(false)
 186
 187 #note(przemeklal): fixes issue with missing selinux in packet.net CentOS 7 images
 188 - name: ensure selinux is installed on CentOS/RHEL 7
 189   package:
 190     name:
 191     - policycoreutils
 192     - policycoreutils-python
 193     - selinux-policy
 194     - selinux-policy-targeted
 195     - libselinux-utils
 196     - setools
 197     - setools-console
 198     - shtool
 199     - lshw
 200     state: present
 201   when:
 202     - ansible_distribution in ["RedHat", "CentOS"]
 203     - ansible_distribution_version < '8'
 204
 205 # Workaround for Equinix Metal CentOS 7
 206 - name: set selinux to permissive
 207   lineinfile:
 208     path: "/etc/sysconfig/selinux"
 209     regexp: '^SELINUX=enforcing'
 210     line: 'SELINUX=permissive'
 211   when:
 212     - ansible_distribution in ["RedHat", "CentOS"]
 213     - ansible_distribution_version < '8'
 214
 215 - name: set python is python3
 216   alternatives:
 217     name: python
 218     path: /usr/bin/python3
 219     link: /usr/bin/python
 220   when:
 221     - ansible_distribution == 'CentOS' or ansible_distribution == 'RedHat'
 222     - ansible_distribution_version >= '8'
 223
 224 - name: install command line tools to collect hardware details
 225   package:
 226     name:
 227      - hwinfo
 228      - inxi
 229      - jq
 230     state: present
 231   when: ansible_distribution in ["RedHat", "CentOS"]
 232
 233 - name: Add kubic yum repo and install updated version of podman
 234   block:
 235   - name: disable container-tools module
 236     # noqa 305 - shell is used intentionally here
 237     shell: dnf -y module disable container-tools
 238   - name: enable rhcontainerbot/container-selinux repository
 239     # noqa 305 - shell is used intentionally here
 240     shell: dnf -y copr enable rhcontainerbot/container-selinux
 241   - name: Add kubic yum repo
 242     yum_repository:
 243       name: devel_kubic_libcontainers_stable
 244       description: Stable Releases of Upstream github.com/containers packages (CentOS_$releasever)
 245       baseurl: https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/CentOS_$releasever/
 246       gpgcheck: yes
 247       gpgkey: https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/CentOS_$releasever/repodata/repomd.xml.key
 248       keepcache: '0'
 249   - name: install runc
 250     dnf:
 251       name: runc
 252       state: present
 253   - name: install podman package
 254     package:
 255       name: podman
 256       state: present
 257   when:
 258     - ansible_os_family == "RedHat" and ansible_distribution_version >= '8.2'
 259     - '"docker" not in container_runtime'
 260
 261 # SELINUX will be disabled later stage so, these packages are required when container_runtime is docker
 262 - name: install packages in RHEL >= 8.4 when container_runtime is docker
 263   dnf:
 264     name:
 265       - bridge-utils
 266       - lsof
 267       - lvm2
 268       - tcpdump
 269       - iproute-tc
 270       - openssh-server
 271       - chrony
 272       - iputils
 273   when:
 274     - ansible_distribution == "RedHat" and ansible_distribution_version >= '8.4'
 275     - container_runtime == "docker"
 276
 277 # Workaround - Set pip to a version that supports correct version of packages needed
 278 - name: use the correct pip version for CentOS 7
 279   pip:
 280     name:
 281       - pip==9.0.3
 282   when:
 283     - ansible_distribution == "CentOS"
 284     - ansible_distribution_version < '8'
 285
 286 - name: Remove older version of pip3 which causes dpdk setup tasks to fail
 287   yum:
 288     name: python3-pip
 289     state: absent
 290   when:
 291     - ansible_distribution == "CentOS"
 292     - ansible_distribution_version < '8'
 293
 294 - name: Install new version of pip3 required by dpdk tasks
 295   yum:
 296     name: python3-pip
 297     state: present
 298   when:
 299     - ansible_distribution == "CentOS"
 300     - ansible_distribution_version < '8'