Merge pull request #6 from gardar/gardar/lint

Fix linting issues

.config/ansible-lint.yml

@@ -1,10 +0,0 @@
----
-skip_list:
-  - experimental
-  - yaml[indentation]  # Violations reported by yamllint.
-  - yaml[line-length]  # Violations reported by yamllint.
-  - name[play]         # Rule for checking task and play names.
-  - name[missing]      # Rule for checking task and play names.
-warn_list:
-  - jinja[spacing]            # Rule that looks inside jinja2 templates.
-  - name[casing]              # Rule for checking task and play names.

.github/workflows/ansible-lint.yml

@@ -1,31 +1,18 @@
 ---
-name: Ansible Lint # feel free to pick your own name
+name: Ansible Lint
 on: [push, pull_request]
 
+env:
+  ANSIBLE_FORCE_COLOR: true
+
 jobs:
-  build:
+  lint:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
-
-      - name: Install community.crypto
-        uses: nick-invision/retry@v2
-        with:
-          timeout_minutes: 3
-          max_attempts: 3
-          command: ansible-galaxy collection install 'community.crypto' -p /github/home/.ansible/collections/
-
-      - name: Install community.general
-        uses: nick-invision/retry@v2
-        with:
-          timeout_minutes: 3
-          max_attempts: 3
-          command: ansible-galaxy collection install 'community.general' -p /github/home/.ansible/collections/
+      - uses: actions/checkout@v3
 
       - name: Lint roles
-        uses: ansible-community/ansible-lint-action@v6
-        env:
-          ANSIBLE_COLLECTIONS_PATH: ansible_collections
+        uses: ansible/ansible-lint-action@main
         with:
           path: roles

galaxy.yml

@@ -1,3 +1,4 @@
+---
 ### REQUIRED
 # The namespace of the collection. This can be a company/brand/organization or product namespace under which all
 # content lives. May only contain alphanumeric lowercase characters and underscores. Namespaces cannot start with
@@ -27,7 +28,7 @@ tags:
 # collection label 'namespace.name'. The value is a version range
 # L(specifiers,https://python-semanticversion.readthedocs.io/en/latest/#requirement-specification). Multiple version
 # range specifiers can be set and are separated by ','
-dependencies: 
+dependencies:
   community.crypto: '>=2.0.0'
   community.general: '>=1.0.0'
 

meta/runtime.yml

@@ -1 +1,2 @@
+---
 requires_ansible: '>=2.9.10'

requirements.yml

@@ -0,0 +1,4 @@
+---
+collections:
+  - community.general
+  - community.crypto

roles/alertmanager/handlers/main.yml

@@ -1,12 +1,14 @@
 ---
-- name: restart alertmanager
+- name: Restart alertmanager
+  listen: "restart alertmanager"
   become: true
   ansible.builtin.systemd:
     daemon_reload: true
     name: alertmanager
     state: restarted
 
-- name: reload alertmanager
+- name: Reload alertmanager
+  listen: "reload alertmanager"
   become: true
   ansible.builtin.systemd:
     name: alertmanager

roles/alertmanager/meta/main.yml

@@ -16,16 +16,16 @@ galaxy_info:
         - buster
     - name: EL
       versions:
-        - 7
-        - 8
+        - '7'
+        - '8'
     - name: Fedora
       versions:
-        - 30
-        - 31
+        - '30'
+        - '31'
   galaxy_tags:
-  - monitoring
-  - prometheus
-  - alerting
-  - alert
+    - monitoring
+    - prometheus
+    - alerting
+    - alert
 
 dependencies: []

roles/alertmanager/molecule/alternative/playbook.yml

@@ -1,5 +1,6 @@
 ---
-- hosts: all
+- name: Converge
+  hosts: all
   any_errors_fatal: true
   roles:
     - alertmanager

roles/alertmanager/molecule/alternative/prepare.yml

@@ -3,14 +3,15 @@
   hosts: localhost
   gather_facts: false
   vars:
-    # Version seeds to be specified here as molecule doesn't have access to ansible_version at this stage
+    # Version needs to be specified here as molecule doesn't have access to ansible_version at this stage
     version: 0.19.0
   tasks:
-    - name: download alertmanager binary to local folder
+    - name: Download alertmanager binary to local folder
       become: false
       ansible.builtin.get_url:
         url: "https://github.com/prometheus/alertmanager/releases/download/v{{ version }}/alertmanager-{{ version }}.linux-amd64.tar.gz"
         dest: "/tmp/alertmanager-{{ version }}.linux-amd64.tar.gz"
+        mode: 0644
       register: _download_archive
       until: _download_archive is succeeded
       retries: 5
@@ -18,7 +19,7 @@
       run_once: true
       check_mode: false
 
-    - name: unpack alertmanager binaries
+    - name: Unpack alertmanager binaries
       become: false
       ansible.builtin.unarchive:
         src: "/tmp/alertmanager-{{ version }}.linux-amd64.tar.gz"
@@ -27,7 +28,7 @@
       run_once: true
       check_mode: false
 
-    - name: link to alertmanager binaries directory
+    - name: Link to alertmanager binaries directory
       become: false
       ansible.builtin.file:
         src: "/tmp/alertmanager-{{ version }}.linux-amd64"

roles/alertmanager/molecule/default/playbook.yml

@@ -1,5 +1,6 @@
 ---
-- hosts: all
+- name: Converge
+  hosts: all
   any_errors_fatal: true
   roles:
     - alertmanager

roles/alertmanager/tasks/configure.yml

@@ -1,5 +1,5 @@
 ---
-- name: copy amtool config
+- name: Copy amtool config
   ansible.builtin.template:
     force: true
     src: "{{ alertmanager_amtool_config_file }}"
@@ -8,7 +8,7 @@
     ansible.builtin.group: alertmanager
     mode: 0644
 
-- name: copy alertmanager config
+- name: Copy alertmanager config
   ansible.builtin.template:
     force: true
     src: "{{ alertmanager_config_file }}"
@@ -30,7 +30,7 @@
   notify:
     - restart alertmanager
 
-- name: copy alertmanager template files
+- name: Copy alertmanager template files
   ansible.builtin.copy:
     src: "{{ item }}"
     dest: "{{ alertmanager_config_dir }}/templates/"

roles/alertmanager/tasks/install.yml

@@ -26,22 +26,27 @@
     - "{{ alertmanager_db_dir }}"
     - "{{ _alertmanager_amtool_config_dir }}"
 
-- block:
-    - name: download alertmanager binary to local folder
+- name: Get alertmanager binary
+  when: alertmanager_binary_local_dir | length == 0
+  block:
+
+    - name: Download alertmanager binary to local folder
       become: false
       ansible.builtin.get_url:
-        url: "https://github.com/prometheus/alertmanager/releases/download/v{{ alertmanager_version }}/alertmanager-{{ alertmanager_version }}.linux-{{ go_arch }}.tar.gz"
+        url: "https://github.com/prometheus/alertmanager/releases/download/v{{ alertmanager_version }}/
+              alertmanager-{{ alertmanager_version }}.linux-{{ go_arch }}.tar.gz"
         dest: "/tmp/alertmanager-{{ alertmanager_version }}.linux-{{ go_arch }}.tar.gz"
         checksum: "sha256:{{ __alertmanager_checksum }}"
+        mode: 0644
       register: _download_archive
       until: _download_archive is succeeded
       retries: 5
       delay: 2
-      # run_once: true # <-- this can't be set due to multi-arch support
+      # run_once: true  # <-- this can't be set due to multi-arch support
       delegate_to: localhost
       check_mode: false
 
-    - name: unpack alertmanager binaries
+    - name: Unpack alertmanager binaries
       become: false
       ansible.builtin.unarchive:
         src: "/tmp/alertmanager-{{ alertmanager_version }}.linux-{{ go_arch }}.tar.gz"
@@ -51,7 +56,7 @@
       delegate_to: localhost
       check_mode: false
 
-    - name: propagate official alertmanager and amtool binaries
+    - name: Propagate official alertmanager and amtool binaries
       ansible.builtin.copy:
         src: "/tmp/alertmanager-{{ alertmanager_version }}.linux-{{ go_arch }}/{{ item }}"
         dest: "{{ _alertmanager_binary_install_dir }}/{{ item }}"
@@ -63,9 +68,8 @@
         - amtool
       notify:
         - restart alertmanager
-  when: alertmanager_binary_local_dir | length == 0
 
-- name: propagate locally distributed alertmanager and amtool binaries
+- name: Propagate locally distributed alertmanager and amtool binaries
   ansible.builtin.copy:
     src: "{{ alertmanager_binary_local_dir }}/{{ item }}"
     dest: "{{ _alertmanager_binary_install_dir }}/{{ item }}"

roles/alertmanager/tasks/main.yml

@@ -1,23 +1,33 @@
 ---
-- include: preflight.yml
+- name: Preflight
+  ansible.builtin.include_tasks: preflight.yml
   tags:
     - alertmanager_install
     - alertmanager_configure
     - alertmanager_run
 
-- include: install.yml
-  become: true
+- name: Install
+  ansible.builtin.include_tasks:
+    file: install.yml
+    apply:
+      become: true
   tags:
     - alertmanager_install
 
-- import_tasks: selinux.yml
-  become: true
+- name: SELinux
+  ansible.builtin.include_tasks:
+    file: selinux.yml
+    apply:
+      become: true
   when: ansible_selinux.status == "enabled"
   tags:
     - alertmanager_configure
 
-- include: configure.yml
-  become: true
+- name: Configure
+  ansible.builtin.include_tasks:
+    file: configure.yml
+    apply:
+      become: true
   tags:
     - alertmanager_configure
 

roles/alertmanager/tasks/preflight.yml

@@ -16,7 +16,12 @@
   ansible.builtin.set_fact:
     alertmanager_systemd_version: "{{ __systemd_version.stdout_lines[0].split(' ')[-1] }}"
 
-- block:
+- name: Discover latest version
+  when:
+    - alertmanager_version == "latest"
+    - alertmanager_binary_local_dir | length == 0
+  block:
+
     - name: Get latest release
       ansible.builtin.uri:
         url: "https://api.github.com/repos/prometheus/alertmanager/releases/latest"
@@ -35,25 +40,23 @@
       ansible.builtin.set_fact:
         alertmanager_version: "{{ _latest_release.json.tag_name[1:] }}"
         alertmanager_checksum_url: "https://github.com/prometheus/alertmanager/releases/download/v{{ alertmanager_version }}/sha256sums.txt"
-  when:
-    - alertmanager_version == "latest"
-    - alertmanager_binary_local_dir | length == 0
 
-- block:
+- name: Get alertmanager binary checksum
+  delegate_to: localhost
+  when:
+    - alertmanager_binary_local_dir | length == 0
+  block:
     - name: "Get checksum list"
       ansible.builtin.set_fact:
         __alertmanager_checksums: "{{ lookup('url', 'https://github.com/prometheus/alertmanager/releases/download/v' + alertmanager_version + '/sha256sums.txt', wantlist=True) | list }}"
       run_once: true
 
-    - name: "Get checksum for {{ go_arch }} architecture"
+    - name: "Get checksum for {{ go_arch }}"
       ansible.builtin.set_fact:
         __alertmanager_checksum: "{{ item.split(' ')[0] }}"
       with_items: "{{ __alertmanager_checksums }}"
       when:
         - "('linux-' + go_arch + '.tar.gz') in item"
-  delegate_to: localhost
-  when:
-    - alertmanager_binary_local_dir | length == 0
 
 
 - name: Fail when extra config flags are duplicating ansible variables
@@ -80,54 +83,58 @@
     - alertmanager_route == {}
 
 - name: "DEPRECATION WARNING: alertmanager version 0.15 and earlier are no longer supported and will be dropped from future releases"
-  ignore_errors: true
+  failed_when: false
   ansible.builtin.fail:
     msg: "Please use `alertmanager_version >= v0.16.0`"
   when: alertmanager_version is version_compare('0.16.0', '<')
 
-- block:
+- name: Check deprecated variable `alertmanager_cli_flags`
+  when: alertmanager_cli_flags is defined
+  block:
     - name: Backward compatibility of variable [part 1]
       ansible.builtin.set_fact:
         alertmanager_config_flags_extra: "{{ alertmanager_cli_flags }}"
 
     - name: "DEPRECATION WARNING: `alertmanager_cli_flags` is no longer supported and will be dropped from future releases"
-      ignore_errors: true
+      failed_when: false
       ansible.builtin.fail:
         msg: "Please use `alertmanager_config_flags_extra` instead of `alertmanager_cli_flags`"
-  when: alertmanager_cli_flags is defined
 
-- block:
+- name: Check deprecated variable `alertmanager_listen_address`
+  when: alertmanager_listen_address is defined
+  block:
     - name: Backward compatibility of variable [part 2]
       ansible.builtin.set_fact:
         alertmanager_web_listen_address: "{{ alertmanager_listen_address }}"
 
     - name: "DEPRECATION WARNING: `alertmanager_listen_address` is no longer supported and will be dropped from future releases"
-      ignore_errors: true
+      failed_when: false
       ansible.builtin.fail:
         msg: "Please use `alertmanager_web_listen_address` instead of `alertmanager_listen_address`"
-  when: alertmanager_listen_address is defined
 
-- block:
+- name: Check deprecated variable `alertmanager_external_url`
+  when: alertmanager_external_url is defined
+  block:
     - name: Backward compatibility of variable [part 3]
       ansible.builtin.set_fact:
         alertmanager_web_external_url: "{{ alertmanager_external_url }}"
 
     - name: "DEPRECATION WARNING: `alertmanager_external_url` is no longer supported and will be dropped from future releases"
-      ignore_errors: true
+      failed_when: false
       ansible.builtin.fail:
         msg: "Please use `alertmanager_web_external_url` instead of `alertmanager_external_url`"
-  when: alertmanager_external_url is defined
 
-- block:
+- name: Check deprecated variable `alertmanager_mesh`
+  when: alertmanager_mesh is defined
+  block:
     - name: HA config compatibility with alertmanager<0.15.0
       ansible.builtin.set_fact:
         alertmanager_cluster: "{{ alertmanager_mesh }}"
 
     - name: "DEPRECATION WARNING: `alertmanager_mesh` is no longer supported and will be dropped from future releases"
-      ignore_errors: true
+      failed_when: false
       ansible.builtin.fail:
         msg: "Please use `alertmanager_cluster` instead of `alertmanager_cluster`"
-  when: alertmanager_mesh is defined
 
 - name: "`alertmanager_child_routes` is no longer supported"
   ansible.builtin.fail:

roles/alertmanager/tasks/selinux.yml

@@ -1,31 +1,15 @@
 ---
-- name: Install selinux python packages [RHEL]
+- name: Install selinux python packages [RedHat]
   ansible.builtin.package:
-    name:
-      - "{{ ( (ansible_facts.distribution_major_version | int) < 8) | ternary('libselinux-python','python3-libselinux') }}"
-      - "{{ ( (ansible_facts.distribution_major_version | int) < 8) | ternary('libselinux-python','python3-policycoreutils') }}"
+    name: "{{ ['libselinux-python', 'python-policycoreutils']
+           if ansible_python_version is version('3', '<') else
+           ['python3-libselinux', 'python3-policycoreutils'] }}"
     state: present
   register: _install_selinux_packages
   until: _install_selinux_packages is success
   retries: 5
   delay: 2
-  when:
-    - (ansible_distribution | lower == "redhat") or
-      (ansible_distribution | lower == "centos")
-
-- name: Install selinux python packages [Fedora]
-  ansible.builtin.package:
-    name:
-      - "{{ ( (ansible_facts.distribution_major_version | int) < 29) | ternary('libselinux-python','python3-libselinux') }}"
-      - "{{ ( (ansible_facts.distribution_major_version | int) < 29) | ternary('libselinux-python','python3-policycoreutils') }}"
-    state: present
-  register: _install_selinux_packages
-  until: _install_selinux_packages is success
-  retries: 5
-  delay: 2
-
-  when:
-    - ansible_distribution | lower == "fedora"
+  when: ansible_os_family | lower == redhat
 
 - name: Install selinux python packages [clearlinux]
   ansible.builtin.package:

roles/blackbox_exporter/handlers/main.yml

@@ -1,12 +1,14 @@
 ---
-- name: restart blackbox exporter
+- name: Restart blackbox exporter
+  listen: "restart blackbox exporter"
   become: true
   ansible.builtin.systemd:
     daemon_reload: true
     name: blackbox_exporter
     state: restarted
 
-- name: reload blackbox exporter
+- name: Reload blackbox exporter
+  listen: "reload blackbox exporter"
   become: true
   ansible.builtin.systemd:
     name: blackbox_exporter

roles/blackbox_exporter/meta/main.yml

@@ -16,18 +16,18 @@ galaxy_info:
         - buster
     - name: EL
       versions:
-        - 7
-        - 8
+        - '7'
+        - '8'
     - name: Fedora
       versions:
-        - 30
-        - 31
+        - '30'
+        - '31'
   galaxy_tags:
-  - exporter
-  - monitoring
-  - prometheus
-  - metrics
-  - blackbox
-  - probe
+    - exporter
+    - monitoring
+    - prometheus
+    - metrics
+    - blackbox
+    - probe
 
 dependencies: []

roles/blackbox_exporter/molecule/default/playbook.yml

@@ -1,5 +1,6 @@
 ---
-- hosts: all
+- name: Converge
+  hosts: all
   any_errors_fatal: true
   roles:
     - blackbox_exporter

roles/blackbox_exporter/tasks/configure.yml

@@ -9,7 +9,7 @@
   notify:
     - restart blackbox exporter
 
-- name: configure blackbox exporter
+- name: Configure blackbox exporter
   ansible.builtin.template:
     src: blackbox_exporter.yml.j2
     dest: /etc/blackbox_exporter.yml

roles/blackbox_exporter/tasks/install.yml

@@ -13,13 +13,15 @@
     ansible.builtin.group: blackbox-exp
     createhome: false
 
-- name: download blackbox exporter binary to local folder
+- name: Download blackbox exporter binary to local folder
   become: false
   ansible.builtin.unarchive:
-    src: "https://github.com/prometheus/blackbox_exporter/releases/download/v{{ blackbox_exporter_version }}/blackbox_exporter-{{ blackbox_exporter_version }}.linux-{{ go_arch_map[ansible_architecture] | default(ansible_architecture) }}.tar.gz"
+    src: "https://github.com/prometheus/blackbox_exporter/releases/download/v{{ blackbox_exporter_version }}/
+          blackbox_exporter-{{ blackbox_exporter_version }}.linux-{{ go_arch_map[ansible_architecture] | default(ansible_architecture) }}.tar.gz"
     dest: "/tmp"
     remote_src: true
-    creates: "/tmp/blackbox_exporter-{{ blackbox_exporter_version }}.linux-{{ go_arch_map[ansible_architecture] | default(ansible_architecture) }}/blackbox_exporter"
+    creates: "/tmp/blackbox_exporter-{{ blackbox_exporter_version }}.linux-{{ go_arch_map[ansible_architecture] | default(ansible_architecture) }}/
+              blackbox_exporter"
   register: _download_binary
   until: _download_binary is succeeded
   retries: 5
@@ -27,9 +29,10 @@
   delegate_to: localhost
   check_mode: false
 
-- name: propagate blackbox exporter binary
+- name: Propagate blackbox exporter binary
   ansible.builtin.copy:
-    src: "/tmp/blackbox_exporter-{{ blackbox_exporter_version }}.linux-{{ go_arch_map[ansible_architecture] | default(ansible_architecture) }}/blackbox_exporter"
+    src: "/tmp/blackbox_exporter-{{ blackbox_exporter_version }}.linux-{{ go_arch_map[ansible_architecture] | default(ansible_architecture) }}/
+          blackbox_exporter"
     dest: "/usr/local/bin/blackbox_exporter"
     mode: 0750
     owner: blackbox-exp

roles/blackbox_exporter/tasks/main.yml

@@ -1,17 +1,24 @@
 ---
-- include: preflight.yml
+- name: Preflight
+  ansible.builtin.include_tasks: preflight.yml
   tags:
     - blackbox_exporter_install
     - blackbox_exporter_configure
     - blackbox_exporter_run
 
-- include: install.yml
-  become: true
+- name: Install
+  ansible.builtin.include_tasks:
+    file: install.yml
+    apply:
+      become: true
   tags:
     - blackbox_exporter_install
 
-- include: configure.yml
-  become: true
+- name: Configure
+  ansible.builtin.include_tasks:
+    file: configure.yml
+    apply:
+      become: true
   tags:
     - blackbox_exporter_configure
 

roles/node_exporter/handlers/main.yml

@@ -1,5 +1,6 @@
 ---
-- name: restart node_exporter
+- name: Restart node_exporter
+  listen: "restart node_exporter"
   become: true
   ansible.builtin.systemd:
     daemon_reload: true

roles/node_exporter/meta/main.yml

@@ -16,12 +16,12 @@ galaxy_info:
         - buster
     - name: EL
       versions:
-        - 7
-        - 8
+        - '7'
+        - '8'
     - name: Fedora
       versions:
-        - 30
-        - 31
+        - '30'
+        - '31'
   galaxy_tags:
     - monitoring
     - prometheus

roles/node_exporter/molecule/alternative/playbook.yml

@@ -11,11 +11,14 @@
         state: directory
         owner: root
         group: root
+        mode: 0755
+
     - name: Copy cert and key
       ansible.builtin.copy:
         src: "{{ item.src }}"
         dest: "{{ item.dest }}"
-      with_items:
+        mode: "{{ item.mode | default(0644) }}"
+      loop:
         - src: "/tmp/tls.cert"
           dest: "{{ node_exporter_tls_server_config.cert_file }}"
         - src: "/tmp/tls.key"

roles/node_exporter/molecule/alternative/prepare.yml

@@ -9,8 +9,10 @@
     - name: Download node_exporter binary to local folder
       become: false
       ansible.builtin.get_url:
-        url: "https://github.com/prometheus/node_exporter/releases/download/v{{ node_exporter_version }}/node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}.tar.gz"
+        url: "https://github.com/prometheus/node_exporter/releases/download/v{{ node_exporter_version }}/
+              node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}.tar.gz"
         dest: "/tmp/node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}.tar.gz"
+        mode: 0644
       register: _download_binary
       until: _download_binary is succeeded
       retries: 5
@@ -27,7 +29,7 @@
       run_once: true
       check_mode: false
 
-    - name: link to node_exporter binaries directory
+    - name: Link to node_exporter binaries directory
       become: false
       ansible.builtin.file:
         src: "/tmp/node_exporter-{{ node_exporter_version }}.linux-amd64"
@@ -36,7 +38,7 @@
       run_once: true
       check_mode: false
 
-    - name: install pyOpenSSL for certificate generation
+    - name: Install pyOpenSSL for certificate generation
       ansible.builtin.pip:
         name: "pyOpenSSL"
 
@@ -50,7 +52,7 @@
         privatekey_path: "/tmp/tls.key"
 
     - name: Create certificate
-      community.crypto.openssl_certificate:
+      community.crypto.x509_certificate:
         path: "/tmp/tls.cert"
         csr_path: "/tmp/tls.csr"
         privatekey_path: "/tmp/tls.key"

roles/node_exporter/molecule/default/playbook.yml

@@ -1,5 +1,6 @@
 ---
-- hosts: all
+- name: Converge
+  hosts: all
   any_errors_fatal: true
   roles:
     - node_exporter

roles/node_exporter/tasks/configure.yml

@@ -8,7 +8,12 @@
     mode: 0644
   notify: restart node_exporter
 
-- block:
+- name: Configure node_exporter
+  when:
+    ( node_exporter_tls_server_config | length > 0 ) or
+    ( node_exporter_http_server_config | length > 0 ) or
+    ( node_exporter_basic_auth_users | length > 0 )
+  block:
     - name: Create node_exporter config directory
       ansible.builtin.file:
         path: "/etc/node_exporter"
@@ -25,10 +30,6 @@
         ansible.builtin.group: root
         mode: 0644
       notify: restart node_exporter
-  when:
-    ( node_exporter_tls_server_config | length > 0 ) or
-    ( node_exporter_http_server_config | length > 0 ) or
-    ( node_exporter_basic_auth_users | length > 0 )
 
 - name: Create textfile collector dir
   ansible.builtin.file:
@@ -41,7 +42,7 @@
   when: node_exporter_textfile_dir | length > 0
 
 - name: Allow node_exporter port in SELinux on RedHat OS family
-  seport:
+  community.general.seport:
     ports: "{{ node_exporter_web_listen_address.split(':')[-1] }}"
     proto: tcp
     setype: http_port_t

roles/node_exporter/tasks/install.yml

@@ -17,11 +17,15 @@
     home: /
   when: _node_exporter_system_user != "root"
 
-- block:
+- name: Discover latest version
+  when: node_exporter_binary_local_dir | length == 0
+  block:
+
     - name: Download node_exporter binary to local folder
       become: false
       ansible.builtin.get_url:
-        url: "https://github.com/prometheus/node_exporter/releases/download/v{{ node_exporter_version }}/node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}.tar.gz"
+        url: "https://github.com/prometheus/node_exporter/releases/download/v{{ node_exporter_version }}/
+              node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}.tar.gz"
         dest: "/tmp/node_exporter-{{ node_exporter_version }}.linux-{{ go_arch }}.tar.gz"
         checksum: "sha256:{{ node_exporter_checksum }}"
         mode: '0644'
@@ -50,9 +54,8 @@
         ansible.builtin.group: root
       notify: restart node_exporter
       when: not ansible_check_mode
-  when: node_exporter_binary_local_dir | length == 0
 
-- name: propagate locally distributed node_exporter binary
+- name: Propagate locally distributed node_exporter binary
   ansible.builtin.copy:
     src: "{{ node_exporter_binary_local_dir }}/node_exporter"
     dest: "{{ _node_exporter_binary_install_dir }}/node_exporter"

roles/node_exporter/tasks/main.yml

@@ -1,28 +1,40 @@
 ---
-- import_tasks: preflight.yml
+- name: Preflight
+  ansible.builtin.include_tasks: preflight.yml
   tags:
     - node_exporter_install
     - node_exporter_configure
     - node_exporter_run
 
-- import_tasks: install.yml
-  become: true
+- name: Install
+  ansible.builtin.include_tasks:
+    file: install.yml
+    apply:
+      become: true
   when:
     ( not __node_exporter_is_installed.stat.exists ) or
-    ( (__node_exporter_current_version_output.stderr_lines | length > 0) and (__node_exporter_current_version_output.stderr_lines[0].split(" ")[2] != node_exporter_version) ) or
-    ( (__node_exporter_current_version_output.stdout_lines | length > 0) and (__node_exporter_current_version_output.stdout_lines[0].split(" ")[2] != node_exporter_version) ) or
+    ( (__node_exporter_current_version_output.stderr_lines | length > 0)
+      and (__node_exporter_current_version_output.stderr_lines[0].split(" ")[2] != node_exporter_version) ) or
+    ( (__node_exporter_current_version_output.stdout_lines | length > 0)
+      and (__node_exporter_current_version_output.stdout_lines[0].split(" ")[2] != node_exporter_version) ) or
     ( node_exporter_binary_local_dir | length > 0 )
   tags:
     - node_exporter_install
 
-- import_tasks: selinux.yml
-  become: true
+- name: SELinux
+  ansible.builtin.include_tasks:
+    file: selinux.yml
+    apply:
+      become: true
   when: ansible_selinux.status == "enabled"
   tags:
     - node_exporter_configure
 
-- import_tasks: configure.yml
-  become: true
+- name: Configure
+  ansible.builtin.include_tasks:
+    file: configure.yml
+    apply:
+      become: true
   tags:
     - node_exporter_configure
 

roles/node_exporter/tasks/preflight.yml

@@ -27,7 +27,9 @@
       - "item not in node_exporter_enabled_collectors"
   with_items: "{{ node_exporter_disabled_collectors }}"
 
-- block:
+- name: Assert that TLS config is correct
+  when: node_exporter_tls_server_config | length > 0
+  block:
     - name: Assert that TLS key and cert path are set
       ansible.builtin.assert:
         that:
@@ -49,7 +51,6 @@
         that:
           - "{{ __node_exporter_cert_file.stat.exists }}"
           - "{{ __node_exporter_key_file.stat.exists }}"
-  when: node_exporter_tls_server_config | length > 0
 
 - name: Check if node_exporter is installed
   ansible.builtin.stat:
@@ -71,7 +72,13 @@
     - node_exporter_install
     - skip_ansible_lint
 
-- block:
+- name: Discover latest version
+  when:
+    - node_exporter_version == "latest"
+    - node_exporter_binary_local_dir | length == 0
+  delegate_to: localhost
+  run_once: true
+  block:
     - name: Get latest release
       ansible.builtin.uri:
         url: "https://api.github.com/repos/prometheus/node_exporter/releases/latest"
@@ -89,23 +96,19 @@
     - name: "Set node_exporter version to {{ _latest_release.json.tag_name[1:] }}"
       ansible.builtin.set_fact:
         node_exporter_version: "{{ _latest_release.json.tag_name[1:] }}"
-  when:
-    - node_exporter_version == "latest"
-    - node_exporter_binary_local_dir | length == 0
-  delegate_to: localhost
-  run_once: true
 
-- block:
+- name: Get node_exporter binary checksum
+  delegate_to: localhost
+  when: node_exporter_binary_local_dir | length == 0
+  block:
     - name: Get checksum list from github
       ansible.builtin.set_fact:
         _checksums: "{{ lookup('url', 'https://github.com/prometheus/node_exporter/releases/download/v' + node_exporter_version + '/sha256sums.txt', wantlist=True) | list }}"
       run_once: true
 
-    - name: "Get checksum for {{ go_arch }} architecture"
+    - name: "Get checksum for {{ go_arch }}"
       ansible.builtin.set_fact:
         node_exporter_checksum: "{{ item.split(' ')[0] }}"
       with_items: "{{ _checksums }}"
       when:
         - "('linux-' + go_arch + '.tar.gz') in item"
-  delegate_to: localhost
-  when: node_exporter_binary_local_dir | length == 0

roles/node_exporter/tasks/selinux.yml

@@ -1,31 +1,15 @@
 ---
-- name: Install selinux python packages [RHEL]
+- name: Install selinux python packages [RedHat]
   ansible.builtin.package:
-    name:
-      - "{{ ( (ansible_facts.distribution_major_version | int) < 8) | ternary('libselinux-python','python3-libselinux') }}"
-      - "{{ ( (ansible_facts.distribution_major_version | int) < 8) | ternary('policycoreutils-python','python3-policycoreutils') }}"
+    name: "{{ ['libselinux-python', 'python-policycoreutils']
+           if ansible_python_version is version('3', '<') else
+           ['python3-libselinux', 'python3-policycoreutils'] }}"
     state: present
   register: _install_selinux_packages
   until: _install_selinux_packages is success
   retries: 5
   delay: 2
-  when:
-    - (ansible_distribution | lower == "redhat") or
-      (ansible_distribution | lower == "centos")
-
-- name: Install selinux python packages [Fedora]
-  ansible.builtin.package:
-    name:
-      - "{{ ( (ansible_facts.distribution_major_version | int) < 29) | ternary('libselinux-python','python3-libselinux') }}"
-      - "{{ ( (ansible_facts.distribution_major_version | int) < 29) | ternary('policycoreutils-python','python3-policycoreutils') }}"
-    state: present
-  register: _install_selinux_packages
-  until: _install_selinux_packages is success
-  retries: 5
-  delay: 2
-
-  when:
-    - ansible_distribution | lower == "fedora"
+  when: ansible_os_family | lower == redhat
 
 - name: Install selinux python packages [clearlinux]
   ansible.builtin.package:

roles/prometheus/defaults/main.yml

@@ -90,7 +90,7 @@ prometheus_static_targets_files:
   - prometheus/targets/*.yml
   - prometheus/targets/*.json
 
-prometheus_alert_rules:
+prometheus_alert_rules:  # noqa yaml[line-length]  # noqa line-length
   - alert: Watchdog
     expr: vector(1)
     for: 10m

roles/prometheus/handlers/main.yml

@@ -1,12 +1,14 @@
 ---
-- name: restart prometheus
+- name: Restart prometheus
+  listen: "restart prometheus"
   become: true
   ansible.builtin.systemd:
     daemon_reload: true
     name: prometheus
     state: restarted
 
-- name: reload prometheus
+- name: Reload prometheus
+  listen: "reload prometheus"
   become: true
   ansible.builtin.systemd:
     name: prometheus

roles/prometheus/meta/main.yml

@@ -16,19 +16,19 @@ galaxy_info:
         - buster
     - name: EL
       versions:
-        - 7
-        - 8
+        - '7'
+        - '8'
     - name: Fedora
       versions:
-        - 30
-        - 31
+        - '30'
+        - '31'
   galaxy_tags:
-  - monitoring
-  - prometheus
-  - metrics
-  - alerts
-  - alerting
-  - molecule
-  - cloud
+    - monitoring
+    - prometheus
+    - metrics
+    - alerts
+    - alerting
+    - molecule
+    - cloud
 
 dependencies: []

roles/prometheus/molecule/alternative/prepare.yml

@@ -12,6 +12,7 @@
       ansible.builtin.get_url:
         url: "https://github.com/prometheus/prometheus/releases/download/v{{ version }}/prometheus-{{ version }}.linux-amd64.tar.gz"
         dest: "/tmp/prometheus-{{ version }}.linux-amd64.tar.gz"
+        mode: 0644
       register: _download_archive
       until: _download_archive is succeeded
       retries: 5
@@ -19,7 +20,7 @@
       run_once: true
       check_mode: false
 
-    - name: unpack prometheus binaries
+    - name: Unpack prometheus binaries
       become: false
       ansible.builtin.unarchive:
         src: "/tmp/prometheus-{{ version }}.linux-amd64.tar.gz"
@@ -28,7 +29,7 @@
       run_once: true
       check_mode: false
 
-    - name: link to prometheus binaries directory
+    - name: Link to prometheus binaries directory
       become: false
       ansible.builtin.file:
         src: "/tmp/prometheus-{{ version }}.linux-amd64"

roles/prometheus/tasks/configure.yml

@@ -1,5 +1,5 @@
 ---
-- name: alerting rules file
+- name: Alerting rules file
   ansible.builtin.template:
     src: "alert.rules.j2"
     dest: "{{ prometheus_config_dir }}/rules/ansible_managed.rules"
@@ -12,7 +12,7 @@
   notify:
     - reload prometheus
 
-- name: copy custom alerting rule files
+- name: Copy custom alerting rule files
   ansible.builtin.copy:
     src: "{{ item }}"
     dest: "{{ prometheus_config_dir }}/rules/"
@@ -24,7 +24,7 @@
   notify:
     - reload prometheus
 
-- name: configure prometheus
+- name: Configure prometheus
   ansible.builtin.template:
     src: "{{ prometheus_config_file }}"
     dest: "{{ prometheus_config_dir }}/prometheus.yml"
@@ -36,29 +36,29 @@
   notify:
     - reload prometheus
 
-- name: configure Prometheus web
+- name: Configure Prometheus web
   ansible.builtin.template:
-    content: "{{ prometheus_web_config | to_nice_yaml(indent=2,sort_keys=False) }}"
+    content: "{{ prometheus_web_config | to_nice_yaml(indent=2, sort_keys=False) }}"
     dest: "{{ prometheus_config_dir }}/web.yml"
     force: true
     owner: root
     ansible.builtin.group: prometheus
     mode: 0640
 
-- name: configure prometheus static targets
+- name: Configure prometheus static targets
   ansible.builtin.template:
     content: |
-      #jinja2: lstrip_blocks: True
-      {{ item.value | to_nice_yaml(indent=2,sort_keys=False) }}
+      {{ item.value | to_nice_yaml(indent=2, sort_keys=False) }}
+    lstrip_blocks: true
     dest: "{{ prometheus_config_dir }}/file_sd/{{ item.key }}.yml"
     force: true
     owner: root
-    ansible.builtin.group: prometheus
+    group: prometheus
     mode: 0640
   with_dict: "{{ prometheus_targets }}"
   when: prometheus_targets != {}
 
-- name: copy prometheus custom static targets
+- name: Copy prometheus custom static targets
   ansible.builtin.copy:
     src: "{{ item }}"
     dest: "{{ prometheus_config_dir }}/file_sd/"

roles/prometheus/tasks/install.yml

@@ -34,13 +34,20 @@
     - "{{ prometheus_config_dir }}/rules"
     - "{{ prometheus_config_dir }}/file_sd"
 
-- block:
-    - name: download prometheus binary to local folder
+- name: Get prometheus binary
+  when:
+    - prometheus_binary_local_dir | length == 0
+    - not prometheus_skip_install
+  block:
+
+    - name: Download prometheus binary to local folder
       become: false
       ansible.builtin.get_url:
-        url: "https://github.com/prometheus/prometheus/releases/download/v{{ prometheus_version }}/prometheus-{{ prometheus_version }}.linux-{{ go_arch }}.tar.gz"
+        url: "https://github.com/prometheus/prometheus/releases/download/v{{ prometheus_version }}/
+              prometheus-{{ prometheus_version }}.linux-{{ go_arch }}.tar.gz"
         dest: "/tmp/prometheus-{{ prometheus_version }}.linux-{{ go_arch }}.tar.gz"
         checksum: "sha256:{{ __prometheus_checksum }}"
+        mode: 0644
       register: _download_archive
       until: _download_archive is succeeded
       retries: 5
@@ -49,7 +56,7 @@
       delegate_to: localhost
       check_mode: false
 
-    - name: unpack prometheus binaries
+    - name: Unpack prometheus binaries
       become: false
       ansible.builtin.unarchive:
         src: "/tmp/prometheus-{{ prometheus_version }}.linux-{{ go_arch }}.tar.gz"
@@ -58,7 +65,7 @@
       delegate_to: localhost
       check_mode: false
 
-    - name: propagate official prometheus and promtool binaries
+    - name: Propagate official prometheus and promtool binaries
       ansible.builtin.copy:
         src: "/tmp/prometheus-{{ prometheus_version }}.linux-{{ go_arch }}/{{ item }}"
         dest: "{{ _prometheus_binary_install_dir }}/{{ item }}"
@@ -71,7 +78,7 @@
       notify:
         - restart prometheus
 
-    - name: propagate official console templates
+    - name: Propagate official console templates
       ansible.builtin.copy:
         src: "/tmp/prometheus-{{ prometheus_version }}.linux-{{ go_arch }}/{{ item }}/"
         dest: "{{ prometheus_config_dir }}/{{ item }}/"
@@ -83,11 +90,8 @@
         - consoles
       notify:
         - restart prometheus
-  when:
-    - prometheus_binary_local_dir | length == 0
-    - not prometheus_skip_install
 
-- name: propagate locally distributed prometheus and promtool binaries
+- name: Propagate locally distributed prometheus and promtool binaries
   ansible.builtin.copy:
     src: "{{ prometheus_binary_local_dir }}/{{ item }}"
     dest: "{{ _prometheus_binary_install_dir }}/{{ item }}"
@@ -115,9 +119,8 @@
 
 - name: Install SELinux dependencies
   ansible.builtin.package:
-    name: "{{ item }}"
+    name: "{{ _prometheus_selinux_packages }}"
     state: present
-  with_items: "{{ prometheus_selinux_packages }}"
   register: _install_packages
   until: _install_packages is succeeded
   retries: 5

roles/prometheus/tasks/main.yml

@@ -1,29 +1,24 @@
 ---
-- name: Gather variables for each operating system
-  ansible.builtin.include_vars: "{{ item }}"
-  with_first_found:
-    - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version }}.yml"
-    - "{{ ansible_distribution | lower }}.yml"
-    - "{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower }}.yml"
-    - "{{ ansible_os_family | lower }}.yml"
+- name: Preflight
+  ansible.builtin.include_tasks: preflight.yml
   tags:
     - prometheus_configure
     - prometheus_install
     - prometheus_run
 
-- include: preflight.yml
-  tags:
-    - prometheus_configure
-    - prometheus_install
-    - prometheus_run
-
-- include: install.yml
-  become: true
+- name: Install
+  ansible.builtin.include_tasks:
+    file: install.yml
+    apply:
+      become: true
   tags:
     - prometheus_install
 
-- include: configure.yml
-  become: true
+- name: Configure
+  ansible.builtin.include_tasks:
+    file: configure.yml
+    apply:
+      become: true
   tags:
     - prometheus_configure
 

roles/prometheus/tasks/preflight.yml

@@ -72,7 +72,13 @@
     - prometheus_alertmanager_config == []
     - prometheus_alert_rules != []
 
-- block:
+- name: Discover latest version
+  when:
+    - prometheus_version == "latest"
+    - prometheus_binary_local_dir | length == 0
+    - not prometheus_skip_install
+  block:
+
     - name: Get latest release
       ansible.builtin.uri:
         url: "https://api.github.com/repos/prometheus/prometheus/releases/latest"
@@ -91,24 +97,21 @@
     - name: "Set prometheus version to {{ _latest_release.json.tag_name[1:] }}"
       ansible.builtin.set_fact:
         prometheus_version: "{{ _latest_release.json.tag_name[1:] }}"
+
+- name: Get prometheus binary checksum
+  delegate_to: localhost
   when:
-    - prometheus_version == "latest"
     - prometheus_binary_local_dir | length == 0
     - not prometheus_skip_install
-
-- block:
+  block:
     - name: "Get checksum list"
       ansible.builtin.set_fact:
         __prometheus_checksums: "{{ lookup('url', 'https://github.com/prometheus/prometheus/releases/download/v' + prometheus_version + '/sha256sums.txt', wantlist=True) | list }}"
       run_once: true
 
-    - name: "Get checksum for {{ go_arch }} architecture"
+    - name: "Get checksum for {{ go_arch }}"
       ansible.builtin.set_fact:
         __prometheus_checksum: "{{ item.split(' ')[0] }}"
       with_items: "{{ __prometheus_checksums }}"
       when:
         - "('linux-' + go_arch + '.tar.gz') in item"
-  delegate_to: localhost
-  when:
-    - prometheus_binary_local_dir | length == 0
-    - not prometheus_skip_install

roles/prometheus/vars/centos-8.yml

@@ -1,4 +0,0 @@
----
-prometheus_selinux_packages:
-  - python3-libselinux
-  - python3-policycoreutils

roles/prometheus/vars/centos.yml

@@ -1,4 +0,0 @@
----
-prometheus_selinux_packages:
-  - libselinux-python
-  - policycoreutils-python

roles/prometheus/vars/debian.yml

@@ -1,4 +0,0 @@
----
-prometheus_selinux_packages:
-  - python-selinux
-  - policycoreutils

roles/prometheus/vars/fedora.yml

@@ -1,4 +0,0 @@
----
-prometheus_selinux_packages:
-  - python3-libselinux
-  - python3-policycoreutils

roles/prometheus/vars/main.yml

@@ -8,3 +8,7 @@ go_arch_map:
 
 go_arch: "{{ go_arch_map[ansible_architecture] | default(ansible_architecture) }}"
 _prometheus_binary_install_dir: '/usr/local/bin'
+
+_prometheus_selinux_packages: "{{ ['libselinux-python', 'python-policycoreutils']
+                               if ansible_python_version is version('3', '<') else
+                               ['python3-libselinux', 'python3-policycoreutils'] }}"

roles/prometheus/vars/redhat-8.yml

@@ -1,4 +0,0 @@
----
-prometheus_selinux_packages:
-  - python3-libselinux
-  - python3-policycoreutils

roles/prometheus/vars/redhat.yml

@@ -1,4 +0,0 @@
----
-prometheus_selinux_packages:
-  - libselinux-python
-  - policycoreutils-python

roles/snmp_exporter/handlers/main.yml

@@ -1,11 +1,13 @@
 ---
-- name: reload snmp exporter
+- name: Reload snmp exporter
+  listen: "reload snmp exporter"
   ansible.builtin.systemd:
     daemon_reload: true
     name: snmp_exporter
     state: reloaded
 
-- name: restart snmp exporter
+- name: Restart snmp exporter
+  listen: "restart snmp exporter"
   ansible.builtin.systemd:
     daemon_reload: true
     name: snmp_exporter

roles/snmp_exporter/meta/main.yml

@@ -16,18 +16,18 @@ galaxy_info:
         - buster
     - name: EL
       versions:
-        - 7
-        - 8
+        - '7'
+        - '8'
     - name: Fedora
       versions:
-        - 30
-        - 31
+        - '30'
+        - '31'
   galaxy_tags:
-  - monitoring
-  - prometheus
-  - exporter
-  - system
-  - network
-  - metrics
+    - monitoring
+    - prometheus
+    - exporter
+    - system
+    - network
+    - metrics
 
 dependencies: []

roles/snmp_exporter/molecule/alternative/playbook.yml

@@ -1,5 +1,6 @@
 ---
-- hosts: all
+- name: Converge
+  hosts: all
   roles:
     - snmp_exporter
   vars:

roles/snmp_exporter/molecule/default/playbook.yml

@@ -1,5 +1,6 @@
 ---
-- hosts: all
+- name: Converge
+  hosts: all
   roles:
     - snmp_exporter
   vars:

roles/snmp_exporter/tasks/install.yml

@@ -2,9 +2,11 @@
 - name: Download snmp_exporter binary to local folder
   become: false
   ansible.builtin.get_url:
-    url: "https://github.com/prometheus/snmp_exporter/releases/download/v{{ snmp_exporter_version }}/snmp_exporter-{{ snmp_exporter_version }}.linux-{{ go_arch_map[ansible_architecture] | default(ansible_architecture) }}.tar.gz"
+    url: "https://github.com/prometheus/snmp_exporter/releases/download/v{{ snmp_exporter_version }}/
+          snmp_exporter-{{ snmp_exporter_version }}.linux-{{ go_arch_map[ansible_architecture] | default(ansible_architecture) }}.tar.gz"
     dest: "/tmp"
     checksum: "sha256:{{ snmp_exporter_checksum }}"
+    mode: 0644
   register: _download_binary
   until: _download_binary is success
   retries: 5

roles/snmp_exporter/tasks/main.yml

@@ -1,17 +1,24 @@
 ---
-- include: preflight.yml
+- name: Preflight
+  ansible.builtin.include_tasks: preflight.yml
   tags:
     - snmp_exporter_install
     - snmp_exporter_configure
     - snmp_exporter_run
 
-- include: install.yml
-  become: true
+- name: Install
+  ansible.builtin.include_tasks:
+    file: install.yml
+    apply:
+      become: true
   tags:
     - snmp_exporter_install
 
-- include: configure.yml
-  become: true
+- name: Configure
+  ansible.builtin.include_tasks:
+    file: configure.yml
+    apply:
+      become: true
   tags:
     - snmp_exporter_configure
 

roles/snmp_exporter/tasks/preflight.yml

@@ -1,5 +1,5 @@
 ---
-- name: "Get checksum for {{ go_arch_map[ansible_architecture] | default(ansible_architecture) }} architecture"
+- name: "Get checksum for {{ go_arch_map[ansible_architecture] | default(ansible_architecture) }}"
   ansible.builtin.set_fact:
     snmp_exporter_checksum: "{{ item.split(' ')[0] }}"
   with_items: