blob: c7e0d82ef3ea6766e94cee2a3a06a84edad7e4a3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
# package-latest
This rule checks that package managers install software in a controlled, safe manner.
Package manager modules, such as `ansible.builtin.yum`, include a `state` parameter that configures how Ansible installs software.
In production environments, you should set `state` to `present` and specify a target version to ensure that packages are installed to a planned and tested version.
Setting `state` to `latest` not only installs software, it performs an update and installs additional packages.
This can result in performance degradation or loss of service.
If you do want to update packages to the latest version, you should also set the `update_only` parameter to `true` to avoid installing additional packages.
## Problematic Code
```yaml
---
- name: Example playbook
hosts: localhost
tasks:
- name: Install Ansible
ansible.builtin.yum:
name: ansible
state: latest # <- Installs the latest package.
- name: Install Ansible-lint
ansible.builtin.pip:
name: ansible-lint
args:
state: latest # <- Installs the latest package.
- name: Install some-package
ansible.builtin.package:
name: some-package
state: latest # <- Installs the latest package.
- name: Install Ansible with update_only to false
ansible.builtin.yum:
name: sudo
state: latest
update_only: false # <- Updates and installs packages.
```
## Correct Code
```yaml
---
- name: Example playbook
hosts: localhost
tasks:
- name: Install Ansible
ansible.builtin.yum:
name: ansible-2.12.7.0
state: present # <- Pins the version to install with yum.
- name: Install Ansible-lint
ansible.builtin.pip:
name: ansible-lint
args:
state: present
version: 5.4.0 # <- Pins the version to install with pip.
- name: Install some-package
ansible.builtin.package:
name: some-package
state: present # <- Ensures the package is installed.
- name: Update Ansible with update_only to true
ansible.builtin.yum:
name: sudo
state: latest
update_only: true # <- Updates but does not install additional packages.
```
|
