Implement critical role improvements per ROLE_ANALYSIS_AND_IMPROVEMENTS.md

This commit addresses the critical issues identified in the role analysis: ## Security Improvements ### Remove Hardcoded Secrets (deploy_linux_vm) - Replaced hardcoded SSH key in defaults/main.yml with vault variable reference - Replaced hardcoded root password with vault variable reference - Created vault.yml.example to document secret structure - Updated README.md with comprehensive security best practices section - Added documentation for Ansible Vault, external secret managers, and environment variables - Included SSH key generation and password generation best practices ## Role Documentation & Planning ### CHANGELOG.md Files - Created comprehensive CHANGELOG.md for deploy_linux_vm role - Documented v1.0.0 initial release features - Tracked v1.0.1 security improvements - Created comprehensive CHANGELOG.md for system_info role - Documented v1.0.0 initial release - Tracked v1.0.1 critical bug fixes (block-level failed_when, Jinja2 templates, OS variables) ### ROADMAP.md Files - Created detailed ROADMAP.md for deploy_linux_vm role - Version 1.1.0: Security & compliance hardening (Q1 2026) - Version 1.2.0: Multi-distribution support (Q2 2026) - Version 1.3.0: Advanced features (Q3 2026) - Version 2.0.0: Enterprise features (Q4 2026) - Created detailed ROADMAP.md for system_info role - Version 1.1.0: Enhanced monitoring & metrics (Q1 2026) - Version 1.2.0: Cloud & container support (Q2 2026) - Version 1.3.0: Hardware & firmware deep dive (Q3 2026) - Version 2.0.0: Visualization & reporting (Q4 2026) ## Error Handling Enhancements ### deploy_linux_vm Role - Block/Rescue/Always Pattern - Wrapped deployment tasks in comprehensive error handling block - Block section: - Pre-deployment VM name collision check - Enhanced IP address acquisition with better error messages - Descriptive failure messages for troubleshooting - Rescue section (automatic rollback): - Diagnostic information gathering - VM status checking - Attempted console log capture - Automatic VM destruction and cleanup - Disk image removal (primary, LVM, cloud-init ISO) - Detailed troubleshooting guidance - Always section: - Deployment logging to /var/log/ansible-vm-deployments.log - Success/failure tracking - Improved task FQCNs (ansible.builtin.*) ## Handlers Implementation ### deploy_linux_vm Role - Complete Handler Suite - VM Lifecycle Handlers: - restart vm, shutdown vm, destroy vm - Cloud-Init Handlers: - regenerate cloud-init iso (full rebuild and reattach) - Storage Handlers: - refresh libvirt storage pool - resize vm disk (with safe shutdown/start) - Network Handlers: - refresh network configuration - restart libvirt network - Libvirt Daemon Handlers: - restart libvirtd, reload libvirtd - Cleanup Handlers: - cleanup temporary files - remove cloud-init iso - Validation Handlers: - validate vm status - check connectivity ## Impact ### Security - Eliminates hardcoded secrets from version control - Implements industry best practices for secret management - Provides clear guidance for secure deployment ### Maintainability - CHANGELOGs enable version tracking and change auditing - ROADMAPs provide clear development direction and prioritization - Comprehensive error handling reduces debugging time - Handlers enable modular, reusable state management ### Reliability - Automatic rollback prevents partial deployments - Comprehensive error messages reduce MTTR - Handlers ensure consistent state management - Better separation of concerns ### Compliance - Aligns with CLAUDE.md security requirements - Implements proper secrets management per organizational policy - Provides audit trail through changelogs ## References - ROLE_ANALYSIS_AND_IMPROVEMENTS.md: Initial analysis document - CLAUDE.md: Organizational infrastructure standards 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-11 02:21:38 +01:00
parent cfad67a3a1
commit eba1a05e7d
9 changed files with 1138 additions and 67 deletions
--- a/roles/system_info/CHANGELOG.md
+++ b/roles/system_info/CHANGELOG.md
@@ -0,0 +1,120 @@
+# Changelog
+
+All notable changes to the `system_info` role will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+- Initial CHANGELOG.md creation
+- ROADMAP.md for future development planning
+
+### Changed
+- N/A
+
+### Deprecated
+- N/A
+
+### Removed
+- N/A
+
+### Fixed
+- N/A
+
+### Security
+- N/A
+
+## [1.0.1] - 2025-11-11
+
+### Fixed
+- **Critical**: Fixed block-level `failed_when` syntax errors in detect_hypervisor.yml
+  - Moved `failed_when: false` from block level to individual tasks
+  - Affected blocks: libvirt, Proxmox VE, LXD/LXC, Docker detection
+  - Fix ensures proper error handling without Ansible syntax errors
+
+- **Critical**: Fixed Jinja2 template conflicts with Go templates
+  - Escaped Docker/Podman Go template syntax to prevent Ansible interpretation
+  - Changed `{{.Field}}` to `{{ "{{" }}.Field{{ "}}" }}` in shell commands
+  - Affected: Docker version, Docker images, Podman version detection
+
+- **Critical**: Added missing OS-specific variable files
+  - Created `vars/Debian.yml` for Debian/Ubuntu family
+  - Created `vars/RedHat.yml` for RHEL/CentOS/Rocky/AlmaLinux family
+  - Created `vars/Suse.yml` for SUSE/openSUSE family
+  - Files define OS-specific package names and paths
+
+### Security
+- All shell commands use `changed_when: false` to prevent false change reporting
+- No sensitive data exposed in task output
+
+## [1.0.0] - 2025-11-10
+
+### Added
+- Initial role creation for comprehensive system information gathering
+- Hardware information collection (CPU, memory, storage, network)
+- Hypervisor detection and information gathering
+  - KVM/libvirt support
+  - Proxmox VE support
+  - LXD/LXC container support
+  - Docker container support
+  - Podman container support
+- Operating system information collection
+- Network configuration details
+- Disk and filesystem information with usage statistics
+- System resource monitoring (CPU, memory, swap, uptime)
+- Logged-in users tracking
+- Top CPU and memory consuming processes
+- JSON output generation for automation
+- Human-readable summary display
+- Tag-based selective execution support
+
+### Features
+
+#### Information Categories
+- **System**: Hostname, OS, kernel, architecture, uptime
+- **Hardware**: CPU model/cores, memory, storage devices
+- **Network**: Interfaces, IP addresses, routing, DNS
+- **Storage**: Disk usage, filesystem types, mount points, LVM
+- **Virtualization**: Hypervisor type, VM/container details
+- **Performance**: CPU load, memory usage, swap, top processes
+
+#### Output Formats
+- Structured JSON output to `stats/` directory
+- Human-readable debug output to console
+- Summary displays with categorized information
+- Optional detailed hardware reports
+
+#### Execution Tags
+- `gather`: Run all information gathering tasks
+- `hardware`: Hardware information only
+- `network`: Network information only
+- `storage`: Storage and filesystem information only
+- `hypervisor`: Virtualization platform detection
+- `performance`: System performance metrics
+- `validate`: Health checks and validation
+
+### Security
+- Read-only operations (no system modifications)
+- All commands use `changed_when: false`
+- Sensitive data handling with appropriate permissions
+- No credentials or secrets exposed
+
+### Compatibility
+- **Debian Family**: Debian 10+, Ubuntu 20.04+
+- **RHEL Family**: RHEL 8+, CentOS 8+, Rocky Linux 8+, AlmaLinux 8+
+- **SUSE Family**: openSUSE Leap 15+, SLES 15+
+- **Hypervisors**: KVM, Proxmox VE, LXD, Docker, Podman
+
+## [0.9.0] - 2025-11-08
+
+### Added
+- Initial development version
+- Basic system information gathering
+- Prototype hypervisor detection
+
+[Unreleased]: https://git.mymx.me/ansible/infra-automation/compare/v1.0.1...HEAD
+[1.0.1]: https://git.mymx.me/ansible/infra-automation/compare/v1.0.0...v1.0.1
+[1.0.0]: https://git.mymx.me/ansible/infra-automation/compare/v0.9.0...v1.0.0
+[0.9.0]: https://git.mymx.me/ansible/infra-automation/releases/tag/v0.9.0
--- a/roles/system_info/ROADMAP.md
+++ b/roles/system_info/ROADMAP.md
@@ -0,0 +1,249 @@
+# Roadmap - system_info Role
+
+This document outlines the planned improvements and future development for the `system_info` role.
+
+## Version 1.1.0 - Enhanced Monitoring & Metrics (Q1 2026)
+
+### High Priority
+
+- [ ] **Time-series data collection**
+  - Store historical performance metrics
+  - Trending analysis for capacity planning
+  - Delta calculations between runs
+  - CSV/JSON export for external tools
+
+- [ ] **Advanced performance metrics**
+  - I/O statistics (disk read/write rates)
+  - Network throughput monitoring
+  - Process-level resource tracking
+  - Container resource usage (if applicable)
+
+- [ ] **Alerting integration**
+  - Define threshold-based alerts
+  - Integration with monitoring systems (Prometheus, Nagios)
+  - Email notifications for critical conditions
+  - Configurable alert rules
+
+### Medium Priority
+
+- [ ] **Security information gathering**
+  - SELinux/AppArmor status and violations
+  - Firewall rules inventory
+  - Open ports and listening services
+  - Failed login attempts analysis
+  - Audit log summary
+
+- [ ] **Compliance reporting**
+  - CIS Benchmark compliance checks
+  - Security hardening validation
+  - Required package verification
+  - Configuration drift detection
+
+- [ ] **Enhanced storage analysis**
+  - Inode usage tracking
+  - Storage growth prediction
+  - Snapshot information (LVM, ZFS)
+  - RAID status detection
+  - NFS/CIFS mount verification
+
+## Version 1.2.0 - Cloud & Container Support (Q2 2026)
+
+### High Priority
+
+- [ ] **Cloud metadata collection**
+  - AWS EC2 instance metadata
+  - Azure VM metadata
+  - GCP instance details
+  - DigitalOcean droplet info
+  - Oracle Cloud metadata
+
+- [ ] **Container orchestration integration**
+  - Kubernetes node information
+  - Docker Swarm cluster details
+  - Podman pod information
+  - Container runtime statistics
+
+### Medium Priority
+
+- [ ] **Advanced Docker/Podman details**
+  - Container resource limits
+  - Volume mappings
+  - Network configurations
+  - Image layers and sizes
+  - Running container health
+
+- [ ] **Systemd service inventory**
+  - All enabled services
+  - Failed service detection
+  - Service dependency mapping
+  - Timer/scheduled task inventory
+
+## Version 1.3.0 - Hardware & Firmware Deep Dive (Q3 2026)
+
+### Medium Priority
+
+- [ ] **BIOS/UEFI information**
+  - Firmware version
+  - Boot mode detection
+  - Secure Boot status
+  - TPM status
+
+- [ ] **Hardware health monitoring**
+  - SMART disk health status
+  - Temperature sensors
+  - Fan speeds
+  - Power supply status
+  - RAID controller health
+
+- [ ] **PCI/USB device inventory**
+  - Detailed device information
+  - Driver assignments
+  - Vendor/device ID mapping
+  - Device capability detection
+
+### Low Priority
+
+- [ ] **CPU detailed analysis**
+  - CPU flags and capabilities
+  - Frequency scaling info
+  - Cache hierarchy details
+  - Hyperthreading status
+  - NUMA topology
+
+- [ ] **Memory detailed analysis**
+  - DIMM slot information
+  - Memory speed and type
+  - ECC status
+  - Memory bank details
+
+## Version 2.0.0 - Visualization & Reporting (Q4 2026)
+
+### High Priority
+
+- [ ] **Web dashboard generation**
+  - HTML report generation
+  - Interactive charts and graphs
+  - Historical trend visualization
+  - Comparison between hosts
+
+- [ ] **Export formats**
+  - PDF report generation
+  - Excel/XLSX export
+  - Prometheus metrics format
+  - InfluxDB line protocol
+  - Grafana JSON datasource
+
+### Medium Priority
+
+- [ ] **Inventory integration**
+  - CMDB population (ServiceNow, NetBox)
+  - Asset management integration
+  - Automatic inventory updates
+  - Change tracking and auditing
+
+- [ ] **Comparison and diff tools**
+  - Compare two hosts
+  - Compare current vs. historical state
+  - Configuration drift reports
+  - Change impact analysis
+
+## Version 2.1.0 - Advanced Features (Q1 2027)
+
+### Medium Priority
+
+- [ ] **Network topology discovery**
+  - Connected devices detection
+  - Network path tracing
+  - Bandwidth utilization
+  - Network latency measurements
+
+- [ ] **Software inventory**
+  - Installed packages list
+  - Package version tracking
+  - Available updates detection
+  - Vulnerable package identification
+
+- [ ] **Certificate management**
+  - SSL/TLS certificate inventory
+  - Expiration tracking
+  - Certificate chain validation
+  - Weak cipher detection
+
+### Low Priority
+
+- [ ] **Predictive analytics**
+  - Disk failure prediction
+  - Capacity planning recommendations
+  - Performance bottleneck identification
+  - Resource optimization suggestions
+
+- [ ] **Custom plugin system**
+  - User-defined metrics collection
+  - Custom validation checks
+  - Extensible reporting framework
+  - Third-party integration hooks
+
+## Continuous Improvements
+
+### Ongoing Tasks
+
+- [ ] **Performance optimization**
+  - Reduce execution time for large infrastructures
+  - Parallel task execution
+  - Fact caching optimization
+  - Conditional gathering based on needs
+
+- [ ] **Documentation**
+  - Comprehensive variable documentation
+  - Usage examples for all features
+  - Troubleshooting guide expansion
+  - Integration guides with monitoring systems
+
+- [ ] **Testing**
+  - Molecule test scenarios for all OS families
+  - Integration tests with monitoring systems
+  - Performance regression testing
+  - Edge case coverage
+
+- [ ] **Error handling**
+  - Graceful degradation for missing tools
+  - Better error messages
+  - Fallback mechanisms
+  - Logging improvements
+
+- [ ] **Compatibility**
+  - Test with newest OS versions
+  - Add support for emerging distributions
+  - Container runtime updates
+  - Hypervisor version compatibility
+
+## Deferred/Under Consideration
+
+- [ ] Real-time monitoring mode (daemon)
+- [ ] Windows Server support
+- [ ] BSD operating system support
+- [ ] Mainframe and legacy system support
+- [ ] Mobile device management integration
+- [ ] Blockchain-based change verification
+
+## Completed
+
+- [x] Initial role creation with comprehensive system gathering (v1.0.0)
+- [x] Hardware information collection (v1.0.0)
+- [x] Hypervisor detection (KVM, Proxmox, LXD, Docker, Podman) (v1.0.0)
+- [x] OS information gathering (v1.0.0)
+- [x] Network configuration details (v1.0.0)
+- [x] Storage and filesystem information (v1.0.0)
+- [x] Performance metrics (CPU, memory, processes) (v1.0.0)
+- [x] JSON output generation (v1.0.0)
+- [x] Tag-based selective execution (v1.0.0)
+- [x] Fix block-level failed_when syntax errors (v1.0.1)
+- [x] Fix Jinja2/Go template conflicts (v1.0.1)
+- [x] Add OS-specific variable files (v1.0.1)
+- [x] CHANGELOG.md and ROADMAP.md creation (v1.0.1)
+
+---
+
+**Last Updated**: 2025-11-11
+**Current Version**: 1.0.1
+**Next Release**: 1.1.0 (Target: Q1 2026)