Reduce gathering facts in profile Ansible Playbooks #13739
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Skipping CI for Draft Pull Request. |
Set package name at build time instead of run time. This change prevents dependency between a `set_fact` task and a `package` task which complicates the logic of the playbook.
These tasks register a variable but that variable isn't used anywhere.
Instead of gathering service_facts each time when it's needed we will do it at the beginning of the Playbook but after installing all packages.
The goal of this change is to enable and disable all systemd services at the beginning of the Ansible Playbook, after all packages are installed and uninstalled, before `service_facts` are gathered. To make the processing in the Ansible Playbook builder easier for us we will slightly change the templates `service_enabled` and `service_disabled`. We will wrap all tasks in these templates to a block and we will mark this block by a special tag. We will us this special tag to easily identify this block in the Ansible Playbook builder script.
9f2d4b2 to
56f5611
Compare
Mab879
approved these changes
Jul 28, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
This PR introduces additional logic to builder that builds profile oriented Ansible Playbooks. The goal is to reduce amount of
ansible.builtin.package_factsandansible.builtin.service_factsin the built Ansible Playbook.The builder changes order of Ansible Tasks in the Ansible Playbook.
It moves all Ansible Tasks that install or remove packages to the beginning of the Playbook. The outcome of moving these Ansible Tasks is that just two instances of
ansible.builtin.package_factsAnsible Tasks are needed in the Ansible Playbook - first at the beginning of the Ansible Playbook and second after the package installation or removal part.Similarly, tasks that enable or disable systemd services are moved to beginning, right after installing packages, to prevent need for having multiple
ansible.builtin.service_factsin the Ansible Playbook.We can't merge the package installation or removal Ansible Tasks to only 2 Ansible Tasks (one for installation and one for removal) because that would break the use case of skipping or selecting specific rules by using tags.
Rationale:
Our Ansible Playbooks take a long time to run. This change will decrease the time they need to complete. Experiments suggest that the change brings about 15 % speed up of a CIS playbook.
Resolves: https://issues.redhat.com/browse/OPENSCAP-6045
Review Hints:
Contest tests
/hardening/ansible