---
- name: Validate running kernel using uname -r and log bad hosts
  hosts: all
  gather_facts: false
  vars:
    bad_kernel_file: "/tmp/bad_kernels.txt"

  tasks:
    - name: Get running kernel version
      ansible.builtin.command: uname -r
      register: uname_result
      changed_when: false

    - name: Set current kernel fact
      ansible.builtin.set_fact:
        current_kernel: "{{ uname_result.stdout | trim }}"

    - name: Extract patch number from kernel string
      ansible.builtin.set_fact:
        kernel_patch: >-
          {{ current_kernel
             | regex_search('4\\.18\\.0-553\\.([0-9]+)\\.1\\.el8_10\\.x86_64', '\\1')
             | first
             | default(omit)
             | int
          }}

    - name: Determine kernel status
      ansible.builtin.set_fact:
        kernel_status: >-
          {% if kernel_patch is not defined %}
          unknown
          {% elif kernel_patch == 80 %}
          good
          {% elif kernel_patch >= 81 and kernel_patch <= 92 %}
          bad
          {% elif kernel_patch >= 93 %}
          good
          {% else %}
          unknown
          {% endif %}

    - name: Record host with bad kernel to local file
      when: kernel_status == "bad"
      delegate_to: localhost
      ansible.builtin.lineinfile:
        path: "{{ bad_kernel_file }}"
        line: "{{ inventory_hostname }} {{ current_kernel }}"
        create: true
        mode: '0644'

    - name: Fail on bad kernel
      when: kernel_status == "bad"
      ansible.builtin.fail:
        msg: "Prohibited kernel detected on {{ inventory_hostname }}: {{ current_kernel }}"

    - name: Report result for visibility
      when: kernel_status != "bad"
      ansible.builtin.debug:
        msg: "Kernel check on {{ inventory_hostname }}: {{ kernel_status | upper }}"