---
- name: Validate running kernel using uname -r and log bad hosts
  hosts: all
  gather_facts: false
  vars:
    # Acceptable explicit versions
    good_kernels:
      - "4.18.0-553.80.1.el8_10.x86_64"
      - "4.18.0-553.93.1.el8_10.x86_64"
    # Local file on Ansible controller to record bad hosts
    bad_kernel_file: "/tmp/bad_kernels.txt"

  tasks:
    - name: Get running kernel version
      ansible.builtin.command: uname -r
      register: uname_result
      changed_when: false

    - name: Set current kernel fact
      ansible.builtin.set_fact:
        current_kernel: "{{ uname_result.stdout | trim }}"

    - name: Extract patch number (e.g., 80 from 4.18.0-553.80.1.el8_10.x86_64)
      ansible.builtin.set_fact:
        patch_match: "{{ current_kernel | regex_search('4\\.18\\.0-553\\.([0-9]+)\\.1\\.el8_10\\.x86_64', '\\1') }}"

    - name: Determine kernel status
      ansible.builtin.set_fact:
        kernel_status: |
          {% if current_kernel in good_kernels %}
            good
          {% elif patch_match | length > 0 and (patch_match[0] | int) >= 93 %}
            good
          {% elif patch_match | length > 0 and ((patch_match[0] | int) == 81 or ((patch_match[0] | int) >= 83 and (patch_match[0] | int) <= 92)) %}
            bad
          {% else %}
            unknown
          {% endif %

    - name: Record host with bad kernel to local file
      when: kernel_status == "bad"
      delegate_to: localhost
      run_once: false
      ansible.builtin.lineinfile:
        path: "{{ bad_kernel_file }}"
        line: "{{ inventory_hostname }} {{ current_kernel }}"
        create: true
        mode: '0644'

    - name: (Optional) Fail on bad kernel
      ansible.builtin.fail:
        msg: "Prohibited kernel detected: {{ current_kernel }}"
      when: kernel_status == "bad"

    - name: Report result for visibility
      ansible.builtin.debug:
        msg: "Kernel check: {{ 'PASS' if kernel_status == 'good' else 'UNKNOWN' }}"
      when: kernel_status != "bad"