Playbook #3756
/home/ssh-gateway/ansible/kuly/RM10132-find-snowflakes-repos.yaml
Execution
Date 12 Sep 2025 11:34:36 +0100
Duration 00:04:54.71
Controller ssh-gw-4.layershift.com
User root
Versions
Ansible 2.16.11
ara 1.7.3 / 1.7.3
Python 3.10.10
Summary
401 Hosts
7 Tasks
2370 Results
2 Plays
1 Files
0 Records
remote_user:root check:False tags:all

File: /home/ssh-gateway/ansible/kuly/RM10132-find-snowflakes-repos.yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
---
- name: Delete existing snowflakes report file
  hosts: localhost
  tasks:
    - name: Delete file
      ansible.builtin.file:
        path: RM10132_find_snowflakes_repos.txt
        state: absent
        force: true
      delegate_to: 127.0.0.1

- name: Check for Third-Party Yum/DNF Repositories
  hosts: all
  gather_facts: false
  vars:
    allowed_repos:
      - appstream
      - baseos
      - extras
      - ha
      - powertools
      - crb
      - epel
      - epel-modular
      - layershift
      - kernelcare
      - mariadb
      - mod-pagespeed
      - repo.cloudlinux.com_cloudlinux_8_BaseOS_x86_64_os_
    allowed_repos_wildcard:
      - 'imunify360*'
      - 'cloudlinux*'
      - 'PLESK_*'
      - 'plesk*'
      - 'alt*'
      - 'powerdns*'
      - 'zimbra*'
      - 'zabbix*'
      - 'newrelic*'

  tasks:
    - name: Get list of enabled repositories
      ansible.builtin.shell: |
        dnf repolist --enabled --quiet
      changed_when: false
      register: enabled_repos_raw
      check_mode: false

    - name: Create a list of enabled repo IDs
      ansible.builtin.set_fact:
        enabled_repos_list: "{{ enabled_repos_raw.stdout_lines | map('split') | map('first') | list }}"

    - name: Identify non-standard repositories (with wildcard support)
      ansible.builtin.set_fact:
        third_party_repos: >-
          {{
            enabled_repos_list
            | difference(allowed_repos)
            | reject('match', '^(' + (allowed_repos_wildcard | default([]) | map('replace', '*', '.*') | join('|')) + ')$')
            | reject('equalto', 'repo')
            | reject('equalto', '')
            | list
          }}

    - name: Assemble report data
      ansible.builtin.set_fact:
        repo_report:
          hostname: "{{ inventory_hostname }}"
          status: "{% if third_party_repos | length > 0 %}non-compliant{% else %}compliant{% endif %}"
          third_party_repos: "{{ third_party_repos }}"
      check_mode: false

    - name: Output report in JSON format
      ansible.builtin.debug:
        msg: "{{ repo_report | to_nice_json }}"
      changed_when: repo_report.status == "non-compliant"

    - name: Make a list of non-compliants
      when: repo_report.status == "non-compliant"
      ansible.builtin.lineinfile:
        path: RM10132_find_snowflakes_repos.txt
        create: true
        mode: '0644'
        line: "{{ inventory_hostname }} - BAD REPOS: {{ third_party_repos | join(', ') }}"
      delegate_to: 127.0.0.1