---
- name: Validate running kernel using uname -r and log bad hosts
  hosts: all
  gather_facts: false
  vars:
    bad_kernel_file: "/tmp/bad_kernels.txt"

  tasks:
    - name: Get running kernel version
      ansible.builtin.command: uname -r
      register: uname_result
      changed_when: false

    - name: Set current kernel fact
      ansible.builtin.set_fact:
        current_kernel: "{{ uname_result.stdout | trim }}"

    - name: Extract patch number using regex_findall
      ansible.builtin.set_fact:
        kernel_patch: >-
          {% set match = current_kernel | regex_findall('4\\.18\\.0-553\\.([0-9]+)\\.1\\.el8_10\\.x86_64') %}
          {% if match and match[0] is defined %}
            {{ match[0] }}
          {% else %}
            {{ '' }}
          {% endif %}

    - name: Determine kernel status
      ansible.builtin.set_fact:
        kernel_status: >-
          {% if kernel_patch == '' %}
            unknown
          {% elif kernel_patch | int == 80 %}
            good
          {% elif kernel_patch | int >= 81 and kernel_patch | int <= 92 %}
            bad
          {% elif kernel_patch | int >= 93 %}
            good
          {% else %}
            unknown
          {% endif %}

    - name: Record host with bad kernel to local file
      when: kernel_status == "bad"
      delegate_to: localhost
      ansible.builtin.lineinfile:
        path: "{{ bad_kernel_file }}"
        line: "{{ inventory_hostname }} {{ current_kernel }}"
        create: true
        mode: '0644'

    - name: Fail on bad kernel
      when: kernel_status == "bad"
      ansible.builtin.fail:
        msg: "Prohibited kernel detected on {{ inventory_hostname }}: {{ current_kernel }}"

    - name: Report result for visibility
      when: kernel_status != "bad"
      ansible.builtin.debug:
        msg: "Kernel check on {{ inventory_hostname }}: {{ kernel_status | upper }} (patch: {{ kernel_patch }})"