---
- name: Check kernel version and log bad hosts
  hosts: all
  gather_facts: true
  vars:
    good_kernels:
      - "4.18.0-553.80.1.el8_10.x86_64"
      - "4.18.0-553.93.1.el8_10.x86_64"
    bad_kernel_file: "/home/ssh-gateway/ansible/kuly/bad_kernels.txt"

  tasks:
    - name: Extract patch version from kernel
      ansible.builtin.set_fact:
        current_kernel: "{{ ansible_kernel }}"
        patch_match: "{{ ansible_kernel | regex_search('4\\.18\\.0-553\\.([0-9]+)\\.1\\.el8_10\\.x86_64', '\\1') }}"

    - name: Mark kernel status
      ansible.builtin.set_fact:
        kernel_status: |
          {% if current_kernel in good_kernels %}
            good
          {% elif patch_match | length > 0 and (patch_match[0] | int) >= 93 %}
            good
          {% elif patch_match | length > 0 and ((patch_match[0] | int) == 81 or ((patch_match[0] | int) >= 83 and (patch_match[0] | int) <= 92)) %}
            bad
          {% else %}
            unknown
          {% endif %}

    - name: Record bad kernel host to local file
      when: kernel_status == "bad"
      delegate_to: localhost
      run_once: false
      ansible.builtin.lineinfile:
        path: "{{ bad_kernel_file }}"
        line: "{{ inventory_hostname }} (kernel: {{ current_kernel }})"
        create: true
        mode: '0644'

    - name: (Optional) Fail on bad kernel
      ansible.builtin.fail:
        msg: "Host has prohibited kernel: {{ current_kernel }}"
      when: kernel_status == "bad"

    - name: Report acceptable kernel
      ansible.builtin.debug:
        msg: "Kernel OK: {{ current_kernel }}"
      when: kernel_status in ["good", "unknown"]