Fixes and improvements for package installation during image builds

src/ansible/group_vars/all

@@ -57,16 +57,6 @@ user: {
   }
 }
 
-freeipa_packages: {
-    server: [ freeipa-server, freeipa-server-dns, freeipa-server-trust-ad ],
-    client: [ freeipa-client, ]
-}
-
-ipa_packages: {
-    server: [ ipa-server-dns, ipa-server, ipa-server-trust-ad ],
-    client: [ ipa-client, ]
-}
-
 join_samba: yes
 join_ipa: yes
 join_ldap: yes

src/ansible/roles/facts/tasks/CentOS8.yml → src/ansible/roles/facts/tasks/CentOS.yml

@@ -1,6 +1,7 @@
 - name: 'Facts are the same as in Fedora'
   include_tasks: 'Fedora.yml'
 
-- name: Set distribution specific facts
+- name: Set distribution specific facts for CentOS 8
   set_fact:
     passkey_support: No
+  when: ansible_distribution_major_version < '9'

src/ansible/roles/facts/tasks/Fedora.yml

@@ -8,6 +8,6 @@
     buildroot: yes
     debuginfo: yes
     passkey_support: Yes
-    ipa: '{{ freeipa_packages }}'
+    ipa_package: freeipa
     ca_trust_dir: /etc/pki/ca-trust/source/anchors/
     ca_trust_update: update-ca-trust

src/ansible/roles/facts/tasks/RedHat.yml

@@ -1,17 +1,8 @@
-- name: 'Facts are the same as in CentOS {{ ansible_distribution_major_version }}'
-  include_tasks: '{{ include_centos }}'
-  loop_control:
-    loop_var: include_centos
-  with_first_found:
-  - files: '{{ "CentOS" | distro_includes(ansible_distribution_major_version) }}'
+- name: 'Facts are the same as in CentOS'
+  include_tasks: 'CentOS.yml'
 
 - name: Set distribution specific facts
   set_fact:
     buildroot: no
     debuginfo: no
-    ipa: '{{ ipa_packages }}'
-
-- name: Set distribution specific facts for RHEL 7
-  set_fact:
-    passkey_support: No
-  when: ansible_distribution_major_version == '7'
+    ipa_package: ipa

src/ansible/roles/facts/tasks/Ubuntu.yml

@@ -1,10 +1,6 @@
+- name: 'Facts are the same as in Debian'
+  include_tasks: 'Debian.yml'
+
 - name: Set distribution specific facts
   set_fact:
-    systemd:
-      services:
-        kadmin: krb5-admin-server.service
-        krb5kdc: krb5-kdc.service
-        sshd: ssh.service
     passkey_support: Yes
-    ca_trust_dir: /etc/ssl/certs
-    ca_trust_update: update-ca-certificates

src/ansible/roles/facts/tasks/main.yml

@@ -1,6 +1,2 @@
-- name: 'Include distribution specific tasks [{{ ansible_distribution }} {{ ansible_distribution_major_version }}]'
-  include_tasks: '{{ include_file }}'
-  loop_control:
-    loop_var: include_file
-  with_first_found:
-  - files: '{{ ansible_distribution | distro_includes(ansible_distribution_major_version) }}'
+- name: 'Include distribution specific tasks [{{ ansible_distribution }}]'
+  include_tasks: '{{ ansible_distribution }}.yml'

src/ansible/roles/packages/tasks/CentOS.yml

@@ -0,0 +1,24 @@
+- name: Install additional repositories
+  block:
+  - name: Install buildroot repository
+    yum_repository:
+      name: buildroot
+      description: "CentOS Stream $releasever - Buildroot"
+      baseurl: "https://kojihub.stream.centos.org/kojifiles/repos/c{{ ansible_distribution_major_version }}s-build/latest/$basearch"
+      gpgcheck: false
+    when: buildroot
+
+  - name: Enable IdM module
+    command: dnf -y module enable idm:DL1
+    when: "ansible_distribution_major_version == '8'"
+
+  - name: Install EPEL repository
+    dnf:
+      state: present
+      name: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-{{ ansible_distribution_major_version }}.noarch.rpm"
+      disable_gpg_check: yes
+    when: extended_packageset
+  when: "'base_ground' in group_names"
+
+- name: 'Packages are the same as in Fedora'
+  include_tasks: 'Fedora.yml'

src/ansible/roles/packages/tasks/Debian.yml

@@ -3,7 +3,7 @@
   - name: Install systemd and common tools
     apt:
       state: present
-      update_cache: yes
+      cache_valid_time: 3600
       name:
       - bash-completion
       - bind9utils
@@ -39,73 +39,75 @@
   when: "'base_ground' in group_names"
 
 - name: Enable backports repo to install freeipa
-  block:
-  - name: Enable backports repo
-    copy:
-      dest: /etc/apt/sources.list.d/backports.list
-      content: "deb http://deb.debian.org/debian bullseye-backports main"
-      owner: root
-      group: root
-      mode: '0644'
+  apt_repository:
+    repo: deb http://deb.debian.org/debian bullseye-backports main
+    state: present
+  when:
+  - ansible_distribution == 'Debian'
+  - ansible_distribution_major_version == '11'
 
 - name: Install packages for client base image
   block:
-  - name: Install SSSD and its dependencies
+  - name: Install IPA client
+    apt:
+      state: present
+      cache_valid_time: 3600
+      name: freeipa-client
+  - name: Install SSSD
     apt:
       state: present
-      update_cache: yes
+      cache_valid_time: 3600
       name:
-      - adcli
-      - freeipa-client
-      - nfs-common
-      - nslcd
-      - packagekit
-      - realmd
-      - slapd
       - sssd
       - sssd-*
   - name: Install test dependencies on client
     apt:
       state: present
-      update_cache: yes
+      cache_valid_time: 3600
       name:
+      - adcli
       - augeas-tools
-  when: "'base_client' in group_names or 'client' in group_names"
+      - nfs-common
+      - nslcd
+      - packagekit
+      - realmd
+      - slapd
+  when: "'base_client' in group_names"
 
 - name: Install packages for NFS base image
   block:
   - name: Install NFS
     apt:
       state: present
-      update_cache: yes
+      cache_valid_time: 3600
       name:
       - nfs-kernel-server
-  when: "'base_nfs' in group_names or 'nfs' in group_names"
+  when: "'base_nfs' in group_names"
 
 - name: Install packages for KDC base image
   block:
   - name: Install KDC
     apt:
       state: present
-      update_cache: yes
+      cache_valid_time: 3600
       name:
       - krb5-admin-server
       - krb5-config
       - krb5-kdc
-  when: "'base_kdc' in group_names or 'kdc' in group_names"
+  when: "'base_kdc' in group_names"
 
 - name: Install packages for Keycloak base image
   block:
   - name: Install ca-certificates-java first to avoid dep issues
     apt:
       state: present
-      update_cache: yes
+      cache_valid_time: 3600
       name:
       - ca-certificates-java
   - name: Install Keycloak dependencies
     apt:
       state: present
-      update_cache: yes
+      cache_valid_time: 3600
       name:
       - openssl
       - unzip
@@ -117,10 +119,10 @@
 
 - name: Install additional packages for client development image
   block:
-  - name: Install SSSD build and integration tests dependencies
+  - name: Install packages required for integration tests
     apt:
       state: present
-      update_cache: yes
+      cache_valid_time: 3600
       name:
       - adcli
       - autoconf
@@ -175,7 +177,6 @@
       - libsemanage-dev
       - libsmbclient-dev
       - libssl-dev
-      - libssl-dev
       - libsystemd-dev
       - libtalloc-dev
       - libtdb-dev
@@ -206,7 +207,7 @@
   - name: Install additional python packages
     apt:
       state: present
-      update_cache: yes
+      cache_valid_time: 3600
       name:
       - python3-flaky
   when: "'client_devel' in group_names"