summaryrefslogtreecommitdiffstats
path: root/src/ansiblelint/rules/package_latest.md
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-28 16:04:56 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-28 16:04:56 +0000
commitd964cec5e6aa807b75c7a4e7cdc5f11e54b2eda2 (patch)
tree794bc3738a00b5e599f06d1f2f6d79048d87ff8e /src/ansiblelint/rules/package_latest.md
parentInitial commit. (diff)
downloadansible-lint-d964cec5e6aa807b75c7a4e7cdc5f11e54b2eda2.tar.xz
ansible-lint-d964cec5e6aa807b75c7a4e7cdc5f11e54b2eda2.zip
Adding upstream version 6.13.1.upstream/6.13.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'src/ansiblelint/rules/package_latest.md')
-rw-r--r--src/ansiblelint/rules/package_latest.md71
1 files changed, 71 insertions, 0 deletions
diff --git a/src/ansiblelint/rules/package_latest.md b/src/ansiblelint/rules/package_latest.md
new file mode 100644
index 0000000..c7e0d82
--- /dev/null
+++ b/src/ansiblelint/rules/package_latest.md
@@ -0,0 +1,71 @@
+# package-latest
+
+This rule checks that package managers install software in a controlled, safe manner.
+
+Package manager modules, such as `ansible.builtin.yum`, include a `state` parameter that configures how Ansible installs software.
+In production environments, you should set `state` to `present` and specify a target version to ensure that packages are installed to a planned and tested version.
+
+Setting `state` to `latest` not only installs software, it performs an update and installs additional packages.
+This can result in performance degradation or loss of service.
+If you do want to update packages to the latest version, you should also set the `update_only` parameter to `true` to avoid installing additional packages.
+
+## Problematic Code
+
+```yaml
+---
+- name: Example playbook
+ hosts: localhost
+ tasks:
+ - name: Install Ansible
+ ansible.builtin.yum:
+ name: ansible
+ state: latest # <- Installs the latest package.
+
+ - name: Install Ansible-lint
+ ansible.builtin.pip:
+ name: ansible-lint
+ args:
+ state: latest # <- Installs the latest package.
+
+ - name: Install some-package
+ ansible.builtin.package:
+ name: some-package
+ state: latest # <- Installs the latest package.
+
+ - name: Install Ansible with update_only to false
+ ansible.builtin.yum:
+ name: sudo
+ state: latest
+ update_only: false # <- Updates and installs packages.
+```
+
+## Correct Code
+
+```yaml
+---
+- name: Example playbook
+ hosts: localhost
+ tasks:
+ - name: Install Ansible
+ ansible.builtin.yum:
+ name: ansible-2.12.7.0
+ state: present # <- Pins the version to install with yum.
+
+ - name: Install Ansible-lint
+ ansible.builtin.pip:
+ name: ansible-lint
+ args:
+ state: present
+ version: 5.4.0 # <- Pins the version to install with pip.
+
+ - name: Install some-package
+ ansible.builtin.package:
+ name: some-package
+ state: present # <- Ensures the package is installed.
+
+ - name: Update Ansible with update_only to true
+ ansible.builtin.yum:
+ name: sudo
+ state: latest
+ update_only: true # <- Updates but does not install additional packages.
+```