blob: c96554804e82c1353a82ea9e968de941f32f6810 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
|
# package-latest
This rule checks that package managers install software in a controlled, safe manner.
Package manager modules, such as `ansible.builtin.yum`, include a `state` parameter that configures how Ansible installs software.
In production environments, you should set `state` to `present` and specify a target version to ensure that packages are installed to a planned and tested version.
Setting `state` to `latest` not only installs software, it performs an update and installs additional packages.
This can result in performance degradation or loss of service.
If you do want to update packages to the latest version, you should also set the `update_only` or `only_upgrade` parameter to `true` based on package manager to avoid installing additional packages.
## Problematic Code
```yaml
---
- name: Example playbook
hosts: localhost
tasks:
- name: Install Ansible
ansible.builtin.yum:
name: ansible
state: latest # <- Installs the latest package.
- name: Install Ansible-lint
ansible.builtin.pip:
name: ansible-lint
args:
state: latest # <- Installs the latest package.
- name: Install some-package
ansible.builtin.package:
name: some-package
state: latest # <- Installs the latest package.
- name: Install sudo with update_only to false
ansible.builtin.yum:
name: sudo
state: latest
update_only: false # <- Updates and installs packages.
- name: Install sudo with only_upgrade to false
ansible.builtin.apt:
name: sudo
state: latest
only_upgrade: false # <- Upgrades and installs packages
```
## Correct Code
```yaml
---
- name: Example playbook
hosts: localhost
tasks:
- name: Install Ansible
ansible.builtin.yum:
name: ansible-2.12.7.0
state: present # <- Pins the version to install with yum.
- name: Install Ansible-lint
ansible.builtin.pip:
name: ansible-lint
args:
state: present
version: 5.4.0 # <- Pins the version to install with pip.
- name: Install some-package
ansible.builtin.package:
name: some-package
state: present # <- Ensures the package is installed.
- name: Update sudo with update_only to true
ansible.builtin.yum:
name: sudo
state: latest
update_only: true # <- Updates but does not install additional packages.
- name: Install sudo with only_upgrade to true
ansible.builtin.apt:
name: sudo
state: latest
only_upgrade: true # <- Upgrades but does not install additional packages.
```
|
