Conditional execution managed by variables

[jtyr]

It would be really great if I could specify what to run as a variable instead of as a tag. For example if I want to always run only audit tasks, I would specify:

rhel6stig_run:
  - audit

and if the task has the following tags:

  tags:
      - cat1
      - high
      - V-38701
      - patch
      - tftp
      - tftp-server
      - unsecure_services

the when: condition would look like this:

when: >
  rhel6stig_run | length == 0 or
  rhel6stig_run in ['cat1', 'high', 'V-38701', 'patch', 'tftp', 'tftp-server', 'unsecure_services']

The above could be extended by rhel6stig_ignore variable which would allow to ignore certain subset of the rhel6stig_run. For example if I would like to run all audit tasks but the V-38701, the rhel6stig_ignore variable would look like this:

rhel6stig_ignore:
  - V-38701

and the when: condition in the task like this:

when: >
  rhel6stig_run | length == 0 or (
    rhel6stig_run in ['cat1', 'high', 'V-38701', 'patch', 'tftp', 'tftp-server', 'unsecure_services'] and
    intersect(['cat1', 'high', 'V-38701', 'patch', 'tftp', 'tftp-server', 'unsecure_services'], rhel6stig_ignore) | len == 0
  )  

Of course the rhel6stig_run as well as the rhel6stig_ignore can have more than one item:

# Expressing: 'audit' in tasks AND 'high' in tasks
rhel6stig_run:
  - audit
  - high

# Expressing: 'ssh' in tasks OR 'rlogin' in tasks OR ''v-38668' in tasks
rhel6stig_ignore:
  - ssh
  - rlogin
  - V-38668

That would run all tasks marked as audit AND high and ignore all tasks marked as ssh, rlogin and V-38668 tasks.

[juliedavila]

I think for this to work we would need a jinja2 filter that is the equivalent of the python all() and any() builtin methods. This is true for situations where rhel6stig_run/ignore have multiple elements.

For example
where a = [1,2] and b = [1,2,3]
a in b returns False

[jtyr]

Such filters exist and I have used it in the example above.

[juliedavila]

Yes, I'm aware of our combinatorial filters, the OCD side of me is just bothered by the verboseness in how it would need to be implemented. I think it'd be cleaner to see smth like

when: rhel6stig_run | length == 0 or (any(tag in 38701_tags for tag in rhel6stig_run) and not any(ignore_tag in 38701_tags for ignor_tag in rhel6stig_ignore)

[jamescassell]

I think this is mostly implemented in the RHEL7-STIG role...