Move to Ansible 3.4.0 (#7672)

* Ansible: move to Ansible 3.4.0 which uses ansible-base 2.10.10

* Docs: add a note about ansible upgrade post 2.9.x

* CI: ensure ansible is removed before ansible 3.x is installed to avoid pip failures

* Ansible: use newer ansible-lint

* Fix ansible-lint 5.0.11 found issues

* syntax issues
* risky-file-permissions
* var-naming
* role-name
* molecule tests

* Mitogen: use 0.3.0rc1 which adds support for ansible 2.10+

* Pin ansible-base to 2.10.11 to get package fix on RHEL8

roles/bootstrap-os/tasks/bootstrap-centos.yml

@@ -12,6 +12,7 @@
     value: "{{ http_proxy | default(omit) }}"
     state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
     no_extra_spaces: true
+    mode: 0644
   become: true
   when: not skip_http_proxy_on_os_packages
 
@@ -32,6 +33,7 @@
     section: "{{ item }}"
     option: enabled
     value: "1"
+    mode: 0644
   with_items:
     - ol7_latest
     - ol7_addons
@@ -56,6 +58,7 @@
     section: "ol{{ ansible_distribution_major_version }}_addons"
     option: "{{ item.option }}"
     value: "{{ item.value }}"
+    mode: 0644
   with_items:
     - { option: "name", value: "ol{{ ansible_distribution_major_version }}_addons" }
     - { option: "enabled", value: "1" }

roles/bootstrap-os/tasks/bootstrap-fedora-coreos.yml

@@ -11,7 +11,7 @@
 - name: Remove podman network cni
   raw: "podman network rm podman"
   become: true
-  ignore_errors: yes
+  ignore_errors: true  # noqa ignore-errors
   when: need_bootstrap.rc != 0
 
 - name: Clean up possible pending packages on fedora coreos
@@ -43,7 +43,7 @@
 - name: Reboot immediately for updated ostree, please run playbook again if failed first time.
   raw: "nohup bash -c 'sleep 5s && shutdown -r now'"
   become: true
-  ignore_errors: yes
+  ignore_errors: true  # noqa ignore-errors
   ignore_unreachable: yes
   when: need_bootstrap.rc != 0
 

roles/bootstrap-os/tasks/bootstrap-fedora.yml

@@ -17,6 +17,7 @@
     value: "{{ http_proxy | default(omit) }}"
     state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
     no_extra_spaces: true
+    mode: 0644
   become: true
   when: not skip_http_proxy_on_os_packages
 

roles/bootstrap-os/tasks/bootstrap-opensuse.yml

@@ -10,7 +10,7 @@
   register: stat_result
 
 - name: Create the /etc/sysconfig/proxy empty file
-  file:
+  file:  # noqa risky-file-permissions
     path: /etc/sysconfig/proxy
     state: touch
   when:

roles/bootstrap-os/tasks/bootstrap-redhat.yml

@@ -12,6 +12,7 @@
     value: "{{ http_proxy | default(omit) }}"
     state: "{{ http_proxy | default(False) | ternary('present', 'absent') }}"
     no_extra_spaces: true
+    mode: 0644
   become: true
   when: not skip_http_proxy_on_os_packages
 
@@ -19,7 +20,7 @@
   command: /sbin/subscription-manager status
   register: rh_subscription_status
   changed_when: "rh_subscription_status != 0"
-  ignore_errors: true
+  ignore_errors: true  # noqa ignore-errors
   become: true
 
 - name: RHEL subscription Organization ID/Activation Key registration
@@ -35,12 +36,13 @@
       service_level_agreement: "{{ rh_subscription_sla }}"
       sync: true
   notify: RHEL auto-attach subscription
-  ignore_errors: true
+  ignore_errors: true  # noqa ignore-errors
   become: true
   when:
     - rh_subscription_org_id is defined
     - rh_subscription_status.changed
 
+# this task has no_log set to prevent logging security sensitive information such as subscription passwords
 - name: RHEL subscription Username/Password registration
   redhat_subscription:
     state: present
@@ -54,8 +56,9 @@
       service_level_agreement: "{{ rh_subscription_sla }}"
       sync: true
   notify: RHEL auto-attach subscription
-  ignore_errors: true
+  ignore_errors: true  # noqa ignore-errors
   become: true
+  no_log: true
   when:
     - rh_subscription_username is defined
     - rh_subscription_status.changed