From d65b7a5cd13a8dc106ae6a0c58f9acbcaa9a8aa5 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Thu, 7 Nov 2024 15:16:46 +0000 Subject: [PATCH 01/15] wsus script rename --- ansible/roles/win_wsus/files/setup_wsus.ps1 | 1 - .../roles/win_wsus/files/setup_wsus_v1.0.ps1 | 0 ansible/roles/win_wsus/files/wsus_setup.ps1 | 1 + .../roles/win_wsus/files/wsus_setup_v1.0.ps1 | 245 ++++++++++++++++++ ansible/roles/win_wsus/tasks/configure.yml | 26 +- 5 files changed, 259 insertions(+), 14 deletions(-) delete mode 120000 ansible/roles/win_wsus/files/setup_wsus.ps1 delete mode 100644 ansible/roles/win_wsus/files/setup_wsus_v1.0.ps1 create mode 120000 ansible/roles/win_wsus/files/wsus_setup.ps1 create mode 100644 ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 diff --git a/ansible/roles/win_wsus/files/setup_wsus.ps1 b/ansible/roles/win_wsus/files/setup_wsus.ps1 deleted file mode 120000 index ad77cdd..0000000 --- a/ansible/roles/win_wsus/files/setup_wsus.ps1 +++ /dev/null @@ -1 +0,0 @@ -setup_wsus_v1.0.ps1 \ No newline at end of file diff --git a/ansible/roles/win_wsus/files/setup_wsus_v1.0.ps1 b/ansible/roles/win_wsus/files/setup_wsus_v1.0.ps1 deleted file mode 100644 index e69de29..0000000 diff --git a/ansible/roles/win_wsus/files/wsus_setup.ps1 b/ansible/roles/win_wsus/files/wsus_setup.ps1 new file mode 120000 index 0000000..6a4d57f --- /dev/null +++ b/ansible/roles/win_wsus/files/wsus_setup.ps1 @@ -0,0 +1 @@ +wsus_setup_v1.0.ps1 \ No newline at end of file diff --git a/ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 b/ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 new file mode 100644 index 0000000..b0cb5b5 --- /dev/null +++ b/ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 @@ -0,0 +1,245 @@ +############### +## Variables ## +############### + +##//INSTALLATION//## + +# Do you want to install .NET FRAMEWORK 3.5? If true, provide a location for the Windows OS media in the next variable + $DotNet = $True +# Do you want to download and install MS Report Viewer 2008 SP1 (required for WSUS Reports)? + $RepViewer = $True +# WSUS Installation Type. Enter "WID" (for WIndows Internal Database), "SQLExpress" (to download and install a local SQLExpress), or "SQLRemote" (for an existing SQL Instance). + $WSUSType = "WID" +# Location to store WSUS Updates (will be created if doesn't exist) + $WSUSDir = "W:\WSUS" +# Temporary location for installation files (will be created if doesn't exist) + $TempDir = "W:\temp" + +##//CONFIGURATION//## + +# Do you want to configure WSUS (equivalent of WSUS Configuration Wizard, plus some additional options)? If $false, no further variables apply. +# You can customise the configurations, such as Products and Classifications etc, in the "Begin Initial Configuration of WSUS" section of the script. + $ConfigureWSUS = $True +# Do you want to decline some unwanted updates? + $DeclineUpdates = $True +# Do you want to configure and enable the Default Approval Rule? + $DefaultApproval = $True +# Do you want to run the Default Approval Rule after configuring? + $RunDefaultRule = $False + + +# Install .Net Framework 3.5 +if($DotNet -eq $true) +{ +write-host 'Installing .Net Framework 3.5' +Install-WindowsFeature -name NET-Framework-Core +} + +sl "C:\Program Files\Update Services\Tools" +.\wsusutil.exe postinstall CONTENT_DIR=$WSUSDir + +# Get WSUS Server Object +$wsus = Get-WSUSServer + +# Connect to WSUS server configuration +$wsusConfig = $wsus.GetConfiguration() + +# Set to download updates from Microsoft Updates +Set-WsusServerSynchronization -SyncFromMU + +# Set Update Languages to English and save configuration settings +$wsusConfig.AllUpdateLanguagesEnabled = $false +$wsusConfig.SetEnabledUpdateLanguages("en") +$wsusConfig.Save() + + + + +# Get WSUS Subscription and perform initial synchronization to get latest categories +$subscription = $wsus.GetSubscription() +$subscription.StartSynchronizationForCategoryOnly() +write-host 'Beginning first WSUS Sync to get available Products etc' -ForegroundColor Magenta +write-host 'Will take some time to complete' +While ($subscription.GetSynchronizationStatus() -ne 'NotProcessing') { + Write-Host "." -NoNewline + Start-Sleep -Seconds 5 +} +write-host ' ' +Write-Host "Sync is done." -ForegroundColor Green + + + + +# Configure the Platforms that we want WSUS to receive updates +write-host 'Setting WSUS Products' +Get-WsusProduct | where-Object { + $_.Product.Title -in ( + '.NET 5.0', + '.NET 6.0', + '.NET 7.0', + '.NET 8.0', + '.NET Core 2.1', + '.NET Core 3.1', + 'Active Directory Rights Management Services Client 2.0', + 'Active Directory', + 'Developer Tools, Runtimes, and Redistributables', + 'Dictionary Updates for Microsoft IMEs', + 'Kernel Updates', + 'Microsoft 365 Apps/Office 2019/Office LTSC', + 'Microsoft Defender Antivirus', + 'Microsoft Security Essentials', + 'Microsoft Server operating system-21H2', + 'Microsoft Server Operating System-22H2', + 'Microsoft Server Operating System-23H2', + 'Microsoft Server Operating System-24H2', + 'Microsoft SQL Server 2008 R2 - PowerPivot for Microsoft Excel 2010', + 'Microsoft SQL Server 2012', + 'Microsoft SQL Server 2014', + 'Microsoft SQL Server 2016', + 'Microsoft SQL Server 2017', + 'Microsoft SQL Server 2019', + 'Microsoft SQL Server 2022', + 'Microsoft SQL Server Management Studio v17', + 'Microsoft SQL Server Management Studio v18', + 'Microsoft SQL Server Management Studio v19', + 'Microsoft SQL Server Management Studio v20', + 'Microsoft SQL Server PowerPivot for Excel', + 'MS Security Essentials', + 'Office 2013', + 'Office 2016', + 'Office Communications Server And Office Communicator', + 'Office Communicator 2007 R2', + 'Office Live Add-in', + 'Office Live', + 'Office', + 'PowerShell - x64', + 'PowerShell Preview - x64', + 'PowerShell', + 'Remote help', + 'Report Viewer 2005', + 'Report Viewer 2008', + 'Report Viewer 2010', + 'Search Enhancement Pack', + 'Security Essentials', + 'Server 2022 Hotpatch Category', + 'Service Bus for Windows Server 1.1', + 'Silverlight', + 'Silverlight', + 'Visual Studio 2005', + 'Visual Studio 2008', + 'Visual Studio 2010 Tools for Office Runtime', + 'Visual Studio 2010 Tools for Office Runtime', + 'Visual Studio 2010', + 'Visual Studio 2012', + 'Visual Studio 2013', + 'Visual Studio 2015 Update 3', + 'Visual Studio 2015', + 'Visual Studio 2017', + 'Visual Studio 2019', + 'Visual Studio 2022', + 'Windows - Client S, version 21H2 and later, Servicing Drivers', + 'Windows - Client S, version 21H2 and later, Upgrade & Servicing Drivers', + 'Windows - Client, version 21H2 and later, Servicing Drivers', + 'Windows - Client, version 21H2 and later, Upgrade & Servicing Drivers', + 'Windows - Server, version 21H2 and later, Servicing Drivers', + 'Windows - Server, version 21H2 and later, Upgrade & Servicing Drivers', + 'Windows - Server, version 24H2 and later, Upgrade & Servicing Drivers', + 'Windows Dictionary Updates', + 'Windows GDR-Dynamic Update', + 'Windows Insider Pre-Release', + 'Windows Media Dynamic Installer', + 'Windows Next Graphics Driver Dynamic update', + 'Windows RT 8.1', + 'Windows RT', + 'Windows Safe OS Dynamic Update', + 'Windows Security platform', + 'Windows Server 2019 and later, Servicing Drivers', + 'Windows Server 2019 and later, Upgrade & Servicing Drivers', + 'Windows Server 2019', + 'Windows Server 2019', + 'Windows Server Drivers', + 'Windows Server Manager Windows Server Update Services (WSUS) Dynamic Installer', + 'Windows Server Solutions Best Practices Analyzer 1.0', + 'Windows Server Technical Preview Language Packs', + 'Windows Server, version 1903 and later') +} | Set-WsusProduct + +# Configure the Classifications +write-host 'Setting WSUS Classifications' +Get-WsusClassification | Where-Object { + $_.Classification.Title -in ( + 'Critical Updates', + 'Definition Updates', + 'Security Updates') +} | Set-WsusClassification + + + + + +# Prompt to check products are set correctly +write-host 'Before continuing, please open the WSUS Console, cancel the WSUS Configuration Wizard,' - -ForegroundColor Red +write-host 'Go to Options > Products and Classifications, and check that the Products are set correctly.' - -ForegroundColor Red +write-host 'Pausing script' -ForegroundColor Yellow +$Shell = New-Object -ComObject "WScript.Shell" +$Button = $Shell.Popup("Click OK to continue.", 0, "Script Paused", 0) # Using Pop-up in case script is running in ISE + + + + +# Configure Synchronizations +write-host 'Enabling WSUS Automatic Synchronisation' +$subscription.SynchronizeAutomatically=$true + +# Set synchronization scheduled for midnight each night +$subscription.SynchronizeAutomaticallyTimeOfDay= (New-TimeSpan -Hours 0) +$subscription.NumberOfSynchronizationsPerDay=1 +$subscription.Save() + +# Kick off a synchronization +$subscription.StartSynchronization() + + + +# Monitor Progress of Synchronisation + +write-host 'Starting WSUS Sync, will take some time' -ForegroundColor Magenta +Start-Sleep -Seconds 60 # Wait for sync to start before monitoring +while ($subscription.GetSynchronizationProgress().ProcessedItems -ne $subscription.GetSynchronizationProgress().TotalItems) { + Write-Progress -PercentComplete ( + $subscription.GetSynchronizationProgress().ProcessedItems*100/($subscription.GetSynchronizationProgress().TotalItems) + ) -Activity "WSUS Sync Progress" +} +Write-Host "Sync is done." -ForegroundColor Green + + +### DECLINE STUFF + + +#NEED TO try set-wsusproduct -disable + +# Configure Default Approval Rule + +if ($DefaultApproval -eq $True) +{ +write-host 'Configuring default automatic approval rule' +[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") +$rule = $wsus.GetInstallApprovalRules() | Where { + $_.Name -eq "Default Automatic Approval Rule"} +$class = $wsus.GetUpdateClassifications() | ? {$_.Title -In ( + 'Critical Updates', + 'Definition Updates', + 'Feature Packs', + 'Security Updates', + 'Service Packs', + 'Update Rollups', + 'Updates')} +$class_coll = New-Object Microsoft.UpdateServices.Administration.UpdateClassificationCollection +$class_coll.AddRange($class) +$rule.SetUpdateClassifications($class_coll) +$rule.Enabled = $True +$rule.Save() +} + + + diff --git a/ansible/roles/win_wsus/tasks/configure.yml b/ansible/roles/win_wsus/tasks/configure.yml index 2965122..8b9e7b2 100644 --- a/ansible/roles/win_wsus/tasks/configure.yml +++ b/ansible/roles/win_wsus/tasks/configure.yml @@ -2,16 +2,16 @@ - name: Configure WSUS server tags: configure_wsus block: - - name: Ensure Content directory exists - win_file: - path: "{{ wsus_content_directory }}" - state: directory + #- name: Ensure Content directory exists + # win_file: + # path: "{{ wsus_content_directory }}" + # state: directory - - name: Set WSUS Content Directory - tags: set_wsus_content_dir - win_shell: | - CD "C:\Program Files\Update Services\Tools" - .\wsusutil.exe postinstall CONTENT_DIR=W:\WSUS + #- name: Set WSUS Content Directory + # tags: set_wsus_content_dir + # win_shell: | + # CD "C:\Program Files\Update Services\Tools" + # .\wsusutil.exe postinstall CONTENT_DIR=W:\WSUS - name: WSUS Script tags: wsus_script @@ -19,13 +19,13 @@ - name: Copy WSUS script win_copy: src: "{{ wsus_script }}" - dest: "powershell {{ script_dir }}\\{{ wsus_script }}" + dest: "{{ script_dir }}\\{{ wsus_script }}" force: true tags: copy_wsus_script - - name: Apply WSUS script - win_shell: "powershell {{ script_dir }}\\{{ wsus_script }}" - tags: apply_wsus_script + #- name: Apply WSUS script + #win_shell: "powershell {{ script_dir }}\\{{ wsus_script }}" + #tags: apply_wsus_script From 9529181adb181516feac1f09f5a2eba23d37e29f Mon Sep 17 00:00:00 2001 From: abrown38 Date: Fri, 22 Nov 2024 16:21:14 +0000 Subject: [PATCH 02/15] small changes --- .../roles/win_wsus/files/wsus_setup_v1.0.ps1 | 51 ++------- ansible/roles/win_wsus/tasks/configure.yml | 100 ++---------------- 2 files changed, 17 insertions(+), 134 deletions(-) diff --git a/ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 b/ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 index b0cb5b5..ec7aeae 100644 --- a/ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 +++ b/ansible/roles/win_wsus/files/wsus_setup_v1.0.ps1 @@ -35,8 +35,12 @@ write-host 'Installing .Net Framework 3.5' Install-WindowsFeature -name NET-Framework-Core } -sl "C:\Program Files\Update Services\Tools" -.\wsusutil.exe postinstall CONTENT_DIR=$WSUSDir +if (Test-Path -Path $WSUSDir) { + Write-Host 'Content Directory Exists' +} else { + sl "C:\Program Files\Update Services\Tools" + .\wsusutil.exe postinstall CONTENT_DIR=$WSUSDir +} # Get WSUS Server Object $wsus = Get-WSUSServer @@ -80,11 +84,7 @@ Get-WsusProduct | where-Object { '.NET 8.0', '.NET Core 2.1', '.NET Core 3.1', - 'Active Directory Rights Management Services Client 2.0', 'Active Directory', - 'Developer Tools, Runtimes, and Redistributables', - 'Dictionary Updates for Microsoft IMEs', - 'Kernel Updates', 'Microsoft 365 Apps/Office 2019/Office LTSC', 'Microsoft Defender Antivirus', 'Microsoft Security Essentials', @@ -92,7 +92,6 @@ Get-WsusProduct | where-Object { 'Microsoft Server Operating System-22H2', 'Microsoft Server Operating System-23H2', 'Microsoft Server Operating System-24H2', - 'Microsoft SQL Server 2008 R2 - PowerPivot for Microsoft Excel 2010', 'Microsoft SQL Server 2012', 'Microsoft SQL Server 2014', 'Microsoft SQL Server 2016', @@ -103,33 +102,13 @@ Get-WsusProduct | where-Object { 'Microsoft SQL Server Management Studio v18', 'Microsoft SQL Server Management Studio v19', 'Microsoft SQL Server Management Studio v20', - 'Microsoft SQL Server PowerPivot for Excel', 'MS Security Essentials', - 'Office 2013', - 'Office 2016', - 'Office Communications Server And Office Communicator', - 'Office Communicator 2007 R2', - 'Office Live Add-in', - 'Office Live', - 'Office', 'PowerShell - x64', - 'PowerShell Preview - x64', 'PowerShell', - 'Remote help', - 'Report Viewer 2005', - 'Report Viewer 2008', - 'Report Viewer 2010', - 'Search Enhancement Pack', 'Security Essentials', 'Server 2022 Hotpatch Category', - 'Service Bus for Windows Server 1.1', 'Silverlight', 'Silverlight', - 'Visual Studio 2005', - 'Visual Studio 2008', - 'Visual Studio 2010 Tools for Office Runtime', - 'Visual Studio 2010 Tools for Office Runtime', - 'Visual Studio 2010', 'Visual Studio 2012', 'Visual Studio 2013', 'Visual Studio 2015 Update 3', @@ -137,21 +116,11 @@ Get-WsusProduct | where-Object { 'Visual Studio 2017', 'Visual Studio 2019', 'Visual Studio 2022', - 'Windows - Client S, version 21H2 and later, Servicing Drivers', - 'Windows - Client S, version 21H2 and later, Upgrade & Servicing Drivers', - 'Windows - Client, version 21H2 and later, Servicing Drivers', - 'Windows - Client, version 21H2 and later, Upgrade & Servicing Drivers', + 'Windows Admin Center', 'Windows - Server, version 21H2 and later, Servicing Drivers', 'Windows - Server, version 21H2 and later, Upgrade & Servicing Drivers', 'Windows - Server, version 24H2 and later, Upgrade & Servicing Drivers', 'Windows Dictionary Updates', - 'Windows GDR-Dynamic Update', - 'Windows Insider Pre-Release', - 'Windows Media Dynamic Installer', - 'Windows Next Graphics Driver Dynamic update', - 'Windows RT 8.1', - 'Windows RT', - 'Windows Safe OS Dynamic Update', 'Windows Security platform', 'Windows Server 2019 and later, Servicing Drivers', 'Windows Server 2019 and later, Upgrade & Servicing Drivers', @@ -159,11 +128,13 @@ Get-WsusProduct | where-Object { 'Windows Server 2019', 'Windows Server Drivers', 'Windows Server Manager Windows Server Update Services (WSUS) Dynamic Installer', - 'Windows Server Solutions Best Practices Analyzer 1.0', 'Windows Server Technical Preview Language Packs', 'Windows Server, version 1903 and later') } | Set-WsusProduct +Get-WsusProduct | where-Object { $_.Product.Title -eq 'Windows' } | Set-WsusProduct -Disable +Get-WsusProduct | where-Object { $_.Product.Title -eq 'Developer Tools, Runtimes, and Redistributables' } | Set-WsusProduct -Disable + # Configure the Classifications write-host 'Setting WSUS Classifications' Get-WsusClassification | Where-Object { @@ -241,5 +212,5 @@ $rule.Enabled = $True $rule.Save() } - +$Apply = $rule.ApplyRule() diff --git a/ansible/roles/win_wsus/tasks/configure.yml b/ansible/roles/win_wsus/tasks/configure.yml index 8b9e7b2..cc328a3 100644 --- a/ansible/roles/win_wsus/tasks/configure.yml +++ b/ansible/roles/win_wsus/tasks/configure.yml @@ -2,16 +2,18 @@ - name: Configure WSUS server tags: configure_wsus block: - #- name: Ensure Content directory exists - # win_file: + #- name: Check if Content directory already exists + # win_stat: # path: "{{ wsus_content_directory }}" - # state: directory + # register: folder + # failed_when: folder.stat.exists #- name: Set WSUS Content Directory # tags: set_wsus_content_dir # win_shell: | # CD "C:\Program Files\Update Services\Tools" - # .\wsusutil.exe postinstall CONTENT_DIR=W:\WSUS + # .\wsusutil.exe postinstall CONTENT_DIR={{ wsus_content_directory }} + # when: not folder.stat.exists - name: WSUS Script tags: wsus_script @@ -27,93 +29,3 @@ #win_shell: "powershell {{ script_dir }}\\{{ wsus_script }}" #tags: apply_wsus_script - - -#- name: Ensure WSUS server is deployed (UpdateServicesDSC) - Errors here :( -# tags: testing -# win_dsc: -# resource_name: UpdateServicesServer -# Ensure: Present -# ContentDir: '{{ wsus_content_directory }}' -# Languages: en -# #Products: "{{ wsus_products }}" -# Products: "Windows Admin Center" -# PsDscRunAsCredential_username: Administrator -# PsDscRunAsCredential_password: "{{ ansible_password }}" -# #ErrorRecord: test -# Classifications: -# - "{{ CriticalUpdates }}" -# #- "{{ DefinitionUpdates }}" -# #- "{{ SecurityUpdates }}" -# #- "{{ ServicePacks }}" -# #- "{{ UpdateRollups }}" -# #- "{{ Updates }}" -# #Synchronize: True -# SynchronizeAutomatically: True -# SynchronizeAutomaticallyTimeOfDay: '15:30:00' -# ClientTargetingMode: "{{ wsus_client_targeting_mode }}" - - - - - - -##- name: Configure WSUS server -## block: -## - name: Ensure Content directory exists -## win_file: -## path: '{{ wsus_content_dir }}' -## state: directory -## - name: Ensure WSUS server is deployed (UpdateServicesDSC) - Errors here :( -## win_dsc: -## resource_name: UpdateServicesServer -## Ensure: Present -## ContentDir: '{{ wsus_content_dir }}' -## Languages: en -## Products: "{{ wsus_products }}" -## Classifications: -## - "{{ wsus_category_names['CriticalUpdates'].id }}" -## #- "{{ wsus_category_names['DefinitionUpdates'].id }}" -## #- "{{ wsus_category_names['SecurityUpdates'].id }}" -## #- "{{ wsus_category_names['ServicePacks'].id }}" -## #- "{{ wsus_category_names['UpdateRollups'].id }}" -## #- "{{ wsus_category_names['Updates'].id }}" -## # Ignore upstream as we don't have one yet... -## #UpstreamServerName: "{{ wsus_upstream_server_name | default(omit) }}" -## #UpstreamServerPort: "{{ wsus_upstream_server_port | default(omit) }}" -## #UpstreamServerSSL: "{{ wsus_upstream_server_ssl | default(omit) }}" -## Synchronize: True -## SynchronizeAutomatically: True -## SynchronizeAutomaticallyTimeOfDay: '01:30:00' -## ClientTargetingMode: "{{ wsus_client_targeting_mode }}" -## ignore_errors: true -## retries: 2 -## - name: Apply approval rules (UpdateServicesDSC) -## win_dsc: -## resource_name: UpdateServicesApprovalRule -## Name: "{{ wsus_category_names[item].name }}" -## Classifications: "{{ wsus_category_names[item].id }}" -## Enabled: True -## RunRuleNow: True -## loop: -## - CriticalUpdates -## #- DefinitionUpdates -## #- SecurityUpdates -## #- ServicePacks -## #- UpdateRollups -## #- Updates -## - name: Clean up updates (UpdateServicesDSC) -## win_dsc: -## resource_name: UpdateServicesCleanup -## Ensure: Present -## DeclineExpiredUpdates: True -## DeclineSupersededUpdates: True -## CleanupObsoleteUpdates: True -## CleanupUnneededContentFiles: True -## # Might be handy: https://github.com/slopez888/vsphere-ansible/blob/master/roles/wsus-server-configure/tasks/max_xml_per_request.yml -## - name: obtain WSUS DB name -## win_reg_stat: -## path: HKLM:\SOFTWARE\Microsoft\Update Services\Server\Setup -## name: SqlDatabaseName -## register: wsus_db_name -## when: inventory_hostname in groups['meta-Tags_wsus'] From 5d3981b380517ac8b408acc9c0b25558849af636 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Wed, 4 Dec 2024 10:03:32 +0000 Subject: [PATCH 03/15] Fix typo --- ansible/vars/protected.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/vars/protected.yml b/ansible/vars/protected.yml index 829b901..092b892 100644 --- a/ansible/vars/protected.yml +++ b/ansible/vars/protected.yml @@ -75,7 +75,7 @@ remote_ip_rules: - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "Allow ICMP"} - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"} - { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent"} - - { direction: "engress", protocol: "tcp", port_min: 8000, port_max: 8010, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent TLS Registration"} + - { direction: "egress", protocol: "tcp", port_min: 8000, port_max: 8010, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent TLS Registration"} - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "169.254.169.254", comment: "Openstack metadata"} - { direction: "egress", protocol: "udp", port_min: 67, port_max: 67, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "DHCP"} - { direction: "egress", protocol: "tcp", port_min: 1688, port_max: 1688, group: "domain_member", remote_ip: "172.16.26.19/32", comment: "Windows Activation"} From f6d1fa267f11ed5afce8f22702f029bd5ac0f724 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Wed, 4 Dec 2024 10:03:55 +0000 Subject: [PATCH 04/15] use true instead of yes --- ansible/playbooks/win_proxy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/playbooks/win_proxy.yml b/ansible/playbooks/win_proxy.yml index 57c461a..dac75e9 100644 --- a/ansible/playbooks/win_proxy.yml +++ b/ansible/playbooks/win_proxy.yml @@ -9,6 +9,6 @@ - ../vars/common.yml roles: - role: win_proxy - become: yes + become: true tags: win_proxy when: project_zone == 'protected' \ No newline at end of file From 001db69fe01bfda582785ca42e93d328ae4a154a Mon Sep 17 00:00:00 2001 From: abrown38 Date: Wed, 4 Dec 2024 10:05:31 +0000 Subject: [PATCH 05/15] reworked to register hosts for TLS with the server --- ansible/playbooks/checkmk.yml | 114 ++++++++++++++++++++++------------ 1 file changed, 76 insertions(+), 38 deletions(-) diff --git a/ansible/playbooks/checkmk.yml b/ansible/playbooks/checkmk.yml index f315106..8d4bb18 100644 --- a/ansible/playbooks/checkmk.yml +++ b/ansible/playbooks/checkmk.yml @@ -1,4 +1,72 @@ --- +- name: CheckMK Hosts + hosts: "meta-win_project_{{ win_project }}:&meta-os_windows" + gather_facts: false + vars_files: + - ../vars/checkmk.yml + - ../vars/common.yml + tasks: + - name: "Create folder for eidf project" + checkmk.general.folder: + server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" + site: "{{ checkmk_agent_site }}" + automation_user: "{{ checkmk_agent_user }}" + automation_secret: "{{ checkmk_password }}" + path: "/{{ os_project }}-{{ win_project }}" + name: "{{ os_project }}-{{ win_project }}" + state: "{{ state }}" # might need to create hosts them move so teardown works??? or leave folder after teardown or add only teardown task after + run_once: true + delegate_to: "localhost" + tags: + - checkmk_host + - checkmk_all + + - name: Add Windows host into check + checkmk.general.host: + server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" + site: "{{ checkmk_agent_site }}" + validate_certs: "true" + automation_user: "{{ checkmk_agent_user }}" + automation_secret: "{{ checkmk_password }}" + folder: "/{{ os_project }}-{{ win_project }}" + name: "{{ inventory_hostname }}" + attributes: + ipaddress: "{{ hostvars[inventory_hostname].ansible_host }}" + state: "{{ state }}" + delegate_to: "localhost" + notify: "activate changes" + tags: + - checkmk_host + - checkmk_all + + - name: "Create folder for eidf project" + checkmk.general.folder: + server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" + site: "{{ checkmk_agent_site }}" + automation_user: "{{ checkmk_agent_user }}" + automation_secret: "{{ checkmk_password }}" + path: "/{{ os_project }}-{{ win_project }}" + name: "{{ os_project }}-{{ win_project }}" + state: "{{ state }}" # might need to create hosts them move so teardown works??? or leave folder after teardown or add only teardown task after + run_once: true + notify: "activate changes" + delegate_to: "localhost" + tags: + - teardown + + handlers: + - name: "Activate Changes" + listen: activate changes + checkmk.general.activation: + server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" + site: "{{ checkmk_agent_site }}" + automation_user: "{{ checkmk_agent_user }}" + automation_secret: "{{ checkmk_password }}" + force_foreign_changes: "false" + validate_certs: "true" + delegate_to: "localhost" + run_once: true + - name: CheckMK Agent hosts: "meta-win_project_{{ win_project }}:&meta-os_windows" gather_facts: false @@ -24,41 +92,11 @@ - checkmk_all - checkmk_agent -- name: CheckMK Hosts - hosts: "meta-win_project_{{ win_project }}:&meta-os_windows" - gather_facts: false - vars_files: - - ../vars/checkmk.yml - - ../vars/common.yml - tasks: - - name: Add Windows host into check - checkmk.general.host: - server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" - site: "{{ checkmk_agent_site }}" - validate_certs: "true" - automation_user: "{{ checkmk_agent_user }}" - automation_secret: "{{ checkmk_password }}" - folder: "/" - name: "{{ inventory_hostname }}" - attributes: - ipaddress: "{{ hostvars[inventory_hostname].ansible_host }}" - state: "{{ state }}" - delegate_to: "localhost" - notify: "activate changes" - tags: - - checkmk_host - - checkmk_all - - teardown - - handlers: - - name: "Activate Changes" - listen: activate changes - checkmk.general.activation: - server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" - site: "{{ checkmk_agent_site }}" - automation_user: "{{ checkmk_agent_user }}" - automation_secret: "{{ checkmk_password }}" - force_foreign_changes: "false" - validate_certs: "true" - delegate_to: "localhost" - run_once: true \ No newline at end of file + - name: register for TLS + win_shell: | + sl 'C:\Program Files (x86)\checkmk\service' + .\cmk-agent-ctl register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert + tags: + - checkmk_host + - checkmk_tls + - checkmk_all \ No newline at end of file From 41c8ecdddcc684ec94016788f433bf2fd065a743 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Wed, 4 Dec 2024 15:50:33 +0000 Subject: [PATCH 06/15] WIP changes for adding hosts to checkmk --- ansible/playbooks/checkmk.yml | 26 +++++++++++++---- ansible/roles/win_proxy/handlers/main.yml | 13 ++++++++- ansible/roles/win_proxy/tasks/checkmk.yml | 35 +++++++++++++++++++++++ ansible/roles/win_proxy/tasks/main.yml | 7 ++++- ansible/vars/protected.yml | 4 +++ 5 files changed, 77 insertions(+), 8 deletions(-) create mode 100644 ansible/roles/win_proxy/tasks/checkmk.yml diff --git a/ansible/playbooks/checkmk.yml b/ansible/playbooks/checkmk.yml index 8d4bb18..a8b914d 100644 --- a/ansible/playbooks/checkmk.yml +++ b/ansible/playbooks/checkmk.yml @@ -21,7 +21,7 @@ - checkmk_host - checkmk_all - - name: Add Windows host into check + - name: Add Windows host into checkMK checkmk.general.host: server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" site: "{{ checkmk_agent_site }}" @@ -92,11 +92,25 @@ - checkmk_all - checkmk_agent - - name: register for TLS - win_shell: | - sl 'C:\Program Files (x86)\checkmk\service' - .\cmk-agent-ctl register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert + - name: TLS registrtion + block: + - name: register for TLS + win_shell: | + sl 'C:\Program Files (x86)\checkmk\service' + .\cmk-agent-ctl register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert + #when: project_zone == 'standard' or + # inventory_hostname in groups['meta-type_server'] + + #- name: register TLS on client (Protected) + # vars: + # ansible_connection: local + # shell: | + # sudo cmk-agent-ctl proxy-register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert + # delegate_to: localhost + # when: project_zone == 'protected' and + # inventory_hostname in groups['meta-type_client'] tags: - checkmk_host - checkmk_tls - - checkmk_all \ No newline at end of file + - checkmk_all + \ No newline at end of file diff --git a/ansible/roles/win_proxy/handlers/main.yml b/ansible/roles/win_proxy/handlers/main.yml index 4cc7bbe..8b0f3fb 100644 --- a/ansible/roles/win_proxy/handlers/main.yml +++ b/ansible/roles/win_proxy/handlers/main.yml @@ -3,4 +3,15 @@ - name: Restart squid ansible.builtin.service: name: "{{ squid_service }}" - state: restarted \ No newline at end of file + state: restarted + +- name: "Activate Changes" + listen: activate changes + checkmk.general.activation: + server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" + site: "{{ checkmk_agent_site }}" + automation_user: "{{ checkmk_agent_user }}" + automation_secret: "{{ checkmk_password }}" + force_foreign_changes: "false" + validate_certs: "false" + run_once: true \ No newline at end of file diff --git a/ansible/roles/win_proxy/tasks/checkmk.yml b/ansible/roles/win_proxy/tasks/checkmk.yml new file mode 100644 index 0000000..6acaaf7 --- /dev/null +++ b/ansible/roles/win_proxy/tasks/checkmk.yml @@ -0,0 +1,35 @@ +--- + +- name: Gather the package facts + ansible.builtin.package_facts: + manager: apt + +- name: Setup CheckMK agent + block: + - name: Include CheckMK variables + ansible.builtin.include_vars: + file: ../vars/checkmk.yml + + - name: Add proxy host into checkMK + checkmk.general.host: + server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" + site: "{{ checkmk_agent_site }}" + validate_certs: "true" + automation_user: "{{ checkmk_agent_user }}" + automation_secret: "{{ checkmk_password }}" + folder: "/" + name: "{{ inventory_hostname }}" + attributes: + ipaddress: "{{ hostvars[inventory_hostname].ansible_host }}" + state: "present" + notify: "activate changes" + + - name: Install CheckMK Agent + import_role: + name: checkmk.general.agent + when: ansible_facts.packages['check-mk-agent'] | default('Missing') == 'Missing' + + - name: register agent for TLS + shell: | + cmk-agent-ctl proxy-register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert + \ No newline at end of file diff --git a/ansible/roles/win_proxy/tasks/main.yml b/ansible/roles/win_proxy/tasks/main.yml index 2cc1aa4..4474f14 100644 --- a/ansible/roles/win_proxy/tasks/main.yml +++ b/ansible/roles/win_proxy/tasks/main.yml @@ -69,4 +69,9 @@ state: started enabled: true when: - - not ansible_check_mode \ No newline at end of file + - not ansible_check_mode + +- name: Import checkmk.yml + import_tasks: + file: checkmk.yml + tags: proxy_cmk \ No newline at end of file diff --git a/ansible/vars/protected.yml b/ansible/vars/protected.yml index 092b892..63bf494 100644 --- a/ansible/vars/protected.yml +++ b/ansible/vars/protected.yml @@ -80,7 +80,11 @@ remote_ip_rules: - { direction: "egress", protocol: "udp", port_min: 67, port_max: 67, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "DHCP"} - { direction: "egress", protocol: "tcp", port_min: 1688, port_max: 1688, group: "domain_member", remote_ip: "172.16.26.19/32", comment: "Windows Activation"} - { direction: "egress", protocol: "tcp", port_min: 1514, port_max: 1515, group: "domain_member", remote_ip: "10.22.10.200/32", comment: "Wawzuh Agent"} + - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Wawzuh Agent"} # Proxy - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.4.71/32", comment: "SSH rundeck 1"} - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.172/32", comment: "SSH rundeck 2"} - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.242/32", comment: "SSH rundeck 3"} + - { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "proxy", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK"} + - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK ICMP"} + From dfb7640b22dba23114d7a3af77fe1fd68f7716fd Mon Sep 17 00:00:00 2001 From: abrown38 Date: Thu, 5 Dec 2024 10:19:10 +0000 Subject: [PATCH 07/15] Allow ICMP for host check (CMK) --- ansible/vars/protected.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/ansible/vars/protected.yml b/ansible/vars/protected.yml index 63bf494..3ca4fa8 100644 --- a/ansible/vars/protected.yml +++ b/ansible/vars/protected.yml @@ -86,5 +86,6 @@ remote_ip_rules: - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.172/32", comment: "SSH rundeck 2"} - { direction: "ingress", protocol: "tcp", port_min: 22, port_max: 22, group: "proxy", remote_ip: "10.24.3.242/32", comment: "SSH rundeck 3"} - { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "proxy", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK"} + - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "proxy", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK ICMP"} - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "Allow CheckMK ICMP"} From a5a058985a98355dd8ba09bec260517f745f32a3 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Thu, 5 Dec 2024 10:19:29 +0000 Subject: [PATCH 08/15] user correct cmk-agent-ctl command --- ansible/roles/win_proxy/tasks/checkmk.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/roles/win_proxy/tasks/checkmk.yml b/ansible/roles/win_proxy/tasks/checkmk.yml index 6acaaf7..c9701a8 100644 --- a/ansible/roles/win_proxy/tasks/checkmk.yml +++ b/ansible/roles/win_proxy/tasks/checkmk.yml @@ -31,5 +31,5 @@ - name: register agent for TLS shell: | - cmk-agent-ctl proxy-register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert + cmk-agent-ctl register --hostname {{ inventory_hostname }} --server {{ checkmk_server }} --site {{ checkmk_agent_site }} --user {{ checkmk_agent_user }} --password '{{ checkmk_password }}' --trust-cert \ No newline at end of file From 36197c64c802c4c43adaeda6b307e00b34cffb2c Mon Sep 17 00:00:00 2001 From: abrown38 Date: Thu, 5 Dec 2024 10:20:22 +0000 Subject: [PATCH 09/15] Move Proxy to the correct folder --- ansible/playbooks/checkmk.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/ansible/playbooks/checkmk.yml b/ansible/playbooks/checkmk.yml index a8b914d..7d961e1 100644 --- a/ansible/playbooks/checkmk.yml +++ b/ansible/playbooks/checkmk.yml @@ -54,6 +54,22 @@ tags: - teardown + - name: Move Proxy to project specific checkmk folder + checkmk.general.host: + server_url: "{{ checkmk_agent_protocol }}://{{ checkmk_server }}:80/" + site: "{{ checkmk_agent_site }}" + validate_certs: "true" + automation_user: "{{ checkmk_agent_user }}" + automation_secret: "{{ checkmk_password }}" + folder: "/{{ os_project }}-{{ win_project }}" + name: "{{ os_project }}-{{ win_project }}-proxy" + state: "present" + run_once: true + delegate_to: "localhost" + notify: "activate changes" + when: project_zone == 'protected' + tags: checkmk_proxy + handlers: - name: "Activate Changes" listen: activate changes From afc4f48e835c4ed17d79ea0c521bfc5df6a2e4da Mon Sep 17 00:00:00 2001 From: abrown38 Date: Mon, 9 Dec 2024 16:50:09 +0000 Subject: [PATCH 10/15] rename file --- ansible/roles/win_client/tasks/main.yml | 2 +- ansible/roles/win_client/tasks/{rd_gateway.yml => rdgw.yml} | 0 2 files changed, 1 insertion(+), 1 deletion(-) rename ansible/roles/win_client/tasks/{rd_gateway.yml => rdgw.yml} (100%) diff --git a/ansible/roles/win_client/tasks/main.yml b/ansible/roles/win_client/tasks/main.yml index 88eb80f..2ba3891 100644 --- a/ansible/roles/win_client/tasks/main.yml +++ b/ansible/roles/win_client/tasks/main.yml @@ -1,5 +1,5 @@ --- - import_tasks: features.yml - import_tasks: chocolatey.yml -- import_tasks: rd_gateway.yml +- import_tasks: rdgw.yml - import_tasks: start_menu.yml diff --git a/ansible/roles/win_client/tasks/rd_gateway.yml b/ansible/roles/win_client/tasks/rdgw.yml similarity index 100% rename from ansible/roles/win_client/tasks/rd_gateway.yml rename to ansible/roles/win_client/tasks/rdgw.yml From 57e99b8fc0da16316c95ab7fee8ddcc0ebccaac8 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 10 Dec 2024 15:12:30 +0000 Subject: [PATCH 11/15] add extra attributes --- ansible/playbooks/checkmk.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ansible/playbooks/checkmk.yml b/ansible/playbooks/checkmk.yml index 7d961e1..d7f9219 100644 --- a/ansible/playbooks/checkmk.yml +++ b/ansible/playbooks/checkmk.yml @@ -18,6 +18,7 @@ run_once: true delegate_to: "localhost" tags: + - checkmk_folder - checkmk_host - checkmk_all @@ -32,6 +33,8 @@ name: "{{ inventory_hostname }}" attributes: ipaddress: "{{ hostvars[inventory_hostname].ansible_host }}" + tag_Variant: "{{ hostvars[inventory_hostname].openstack.metadata.variant }}" + tag_project_zone: "{{ project_zone }}" state: "{{ state }}" delegate_to: "localhost" notify: "activate changes" From ed8c29f99419a564a7c80662f0548e0ef6392f76 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 10 Dec 2024 15:12:59 +0000 Subject: [PATCH 12/15] add checkmk attribuutes to proxy VM --- ansible/roles/win_proxy/tasks/checkmk.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ansible/roles/win_proxy/tasks/checkmk.yml b/ansible/roles/win_proxy/tasks/checkmk.yml index c9701a8..bcb6256 100644 --- a/ansible/roles/win_proxy/tasks/checkmk.yml +++ b/ansible/roles/win_proxy/tasks/checkmk.yml @@ -21,6 +21,8 @@ name: "{{ inventory_hostname }}" attributes: ipaddress: "{{ hostvars[inventory_hostname].ansible_host }}" + tag_Variant: "proxy" + tag_project_zone: "{{ project_zone }}" state: "present" notify: "activate changes" From fa8520a07993471509ace49bc32b858e8b286c65 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Wed, 11 Dec 2024 11:59:30 +0000 Subject: [PATCH 13/15] Fix api endpoint, get exec id from file and wrap VMs in data key --- register_vms.sh | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/register_vms.sh b/register_vms.sh index 0b14d8f..2f57fe6 100644 --- a/register_vms.sh +++ b/register_vms.sh @@ -5,7 +5,8 @@ declare -gr OS_PROJECT=$1 declare -gr WIN_PROJECT=$2 declare -gr API_TOKEN=$3 declare -g RD_JOB_ID=$4 -declare -g RD_EXEC_ID=$5 +#declare -g RD_EXEC_ID=$5 +declare -g RD_EXEC_ID=$(cat /deployments/$OS_PROJECT-$WIN_PROJECT/EXEC_ID) export OS_CLIENT_CONFIG_FILE=/deployments/$OS_PROJECT-$WIN_PROJECT/clouds.yaml @@ -26,10 +27,12 @@ initialize_json() { "job_id": "'$RD_JOB_ID'", "execution_id": "'$RD_EXEC_ID'", "status": "ok", - "DC": {}, - "WB": {"load_balancer": true, VM: []}, - "APP": {"load_balancer": false, VM: []}, - "GPU": {"load_balancer": false, VM: []} + "data": { + "DC": {}, + "WB": {"load_balancer": true, VM: []}, + "APP": {"load_balancer": false, VM: []}, + "GPU": {"load_balancer": false, VM: []} + } }' > $OUTPUT_FILE declare -g -r VM_JSON="/deployments/$OS_PROJECT-$WIN_PROJECT/data.json" } @@ -42,16 +45,16 @@ add_vm() { declare -r TYPE=$4 if [[ $TYPE == "DC" ]]; then - jq ".${TYPE} += {\"name\": \"${NAME}\", \"ip\": \"${IP}\", \"uuid\": \"${UUID}\"}" $VM_JSON > temp.json + jq ".data.${TYPE} += {\"name\": \"${NAME}\", \"ip\": \"${IP}\", \"uuid\": \"${UUID}\"}" $VM_JSON > temp.json mv -f temp.json $VM_JSON else - jq ".${TYPE}.VM += [{\"name\": \"${NAME}\", \"ip\": \"${IP}\", \"uuid\": \"${UUID}\"}]" $VM_JSON > temp.json + jq ".data.${TYPE}.VM += [{\"name\": \"${NAME}\", \"ip\": \"${IP}\", \"uuid\": \"${UUID}\"}]" $VM_JSON > temp.json mv -f temp.json $VM_JSON fi } post_request() { - declare -r API_ENDPOINT='https://projects.eidf.ac.uk/testportal/job/api/notification' + declare -r API_ENDPOINT='https://portal.eidf.ac.uk/job/api/notification' jq -c . $VM_JSON curl \ -X POST \ From 01e963d27760d23a5acb748904e973154660d746 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Wed, 11 Dec 2024 11:59:48 +0000 Subject: [PATCH 14/15] End task if VM have already been created --- ansible/playbooks/openstack-vms.yml | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/ansible/playbooks/openstack-vms.yml b/ansible/playbooks/openstack-vms.yml index 7733d27..16e3685 100644 --- a/ansible/playbooks/openstack-vms.yml +++ b/ansible/playbooks/openstack-vms.yml @@ -1,9 +1,16 @@ --- - hosts: localhost + vars: + vm_status: "{{ lookup('file', '/deployments/{{ os_project }}-{{ win_project }}/VM_STATUS') }}" vars_files: - ../vars/common.yml - ../vars/{{ project_zone }}.yml tasks: + - name: End early if VM already created + block: + - meta: end_play + when: vm_status == 'created' + - name: Create workbench VMs (ASYNCHRONUS) tags: teardown os_server: @@ -298,4 +305,14 @@ type: server variant: web_proxy os: linux - when: project_zone == 'protected' \ No newline at end of file + when: project_zone == 'protected' + + - name: Set VM Status + vars: + ansible_connection: local + replace: + path: /deployments/{{ os_project }}-{{ win_project }}/VM_STATUS + regexp: '^pending$' + replace: 'created' + delegate_to: localhost + run_once: True \ No newline at end of file From 6486a81493d900c35742f695e87668c30001baf8 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Wed, 11 Dec 2024 12:01:02 +0000 Subject: [PATCH 15/15] comment for needed action --- ansible/roles/win_initial/tasks/initial.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/ansible/roles/win_initial/tasks/initial.yml b/ansible/roles/win_initial/tasks/initial.yml index e9beea7..f699a0e 100644 --- a/ansible/roles/win_initial/tasks/initial.yml +++ b/ansible/roles/win_initial/tasks/initial.yml @@ -32,6 +32,7 @@ - name: Reboot VMs before continuing win_reboot: + # Need a condition here for reruns - name: Remove Local Admin tags: