You've already forked ansible-linux-infra
101 lines
3.4 KiB
YAML
101 lines
3.4 KiB
YAML
---
|
|
- name: Include OS-family-specific variables
|
|
ansible.builtin.include_vars: "{{ item }}"
|
|
with_first_found:
|
|
- "{{ ansible_facts['os_family'] }}.yml"
|
|
- "default.yml"
|
|
tags: [falcon_onboarding, always]
|
|
|
|
- name: Verify a sensor package source is defined
|
|
ansible.builtin.assert:
|
|
that:
|
|
- falcon_onboarding_sensor_package_url | length > 0 or falcon_onboarding_sensor_package_src | length > 0
|
|
fail_msg: >-
|
|
Neither falcon_onboarding_sensor_package_url nor
|
|
falcon_onboarding_sensor_package_src is set. Provide the sensor
|
|
package matching this host's OS (see roles/falcon_onboarding/defaults/main.yml).
|
|
tags: [falcon_onboarding]
|
|
|
|
- name: Download sensor package from internal URL
|
|
ansible.builtin.get_url:
|
|
url: "{{ falcon_onboarding_sensor_package_url }}"
|
|
dest: "/tmp/falcon-sensor.{{ falcon_onboarding_package_ext }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: falcon_onboarding_sensor_package_url | length > 0
|
|
tags: [falcon_onboarding]
|
|
|
|
- name: Copy sensor package from the Ansible control node
|
|
ansible.builtin.copy:
|
|
src: "{{ falcon_onboarding_sensor_package_src }}"
|
|
dest: "/tmp/falcon-sensor.{{ falcon_onboarding_package_ext }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: falcon_onboarding_sensor_package_url | length == 0 and falcon_onboarding_sensor_package_src | length > 0
|
|
tags: [falcon_onboarding]
|
|
|
|
- name: Install Falcon sensor (RedHat family)
|
|
ansible.builtin.dnf:
|
|
name: "/tmp/falcon-sensor.rpm"
|
|
state: present
|
|
disable_gpg_check: false
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
register: falcon_onboarding_install_result
|
|
tags: [falcon_onboarding]
|
|
|
|
- name: Install Falcon sensor (Debian family)
|
|
ansible.builtin.apt:
|
|
deb: "/tmp/falcon-sensor.deb"
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
register: falcon_onboarding_install_result
|
|
tags: [falcon_onboarding]
|
|
|
|
- name: Remove downloaded/copied sensor package
|
|
ansible.builtin.file:
|
|
path: "/tmp/falcon-sensor.{{ falcon_onboarding_package_ext }}"
|
|
state: absent
|
|
tags: [falcon_onboarding]
|
|
|
|
- name: Configure Customer ID (CID)
|
|
ansible.builtin.command: "/opt/CrowdStrike/falconctl -s --cid={{ falcon_cid }}"
|
|
changed_when: true
|
|
no_log: true
|
|
notify: restart falcon-sensor
|
|
tags: [falcon_onboarding]
|
|
|
|
- name: Configure provisioning token if required
|
|
ansible.builtin.command: "/opt/CrowdStrike/falconctl -s --provisioning-token={{ falcon_onboarding_provisioning_token }}"
|
|
changed_when: true
|
|
no_log: true
|
|
when: falcon_onboarding_provisioning_token | length > 0
|
|
notify: restart falcon-sensor
|
|
tags: [falcon_onboarding]
|
|
|
|
- name: Enable and start the Falcon sensor service
|
|
ansible.builtin.systemd:
|
|
name: falcon-sensor
|
|
enabled: true
|
|
state: started
|
|
tags: [falcon_onboarding]
|
|
|
|
- name: Check reduced-functionality mode (RFM)
|
|
ansible.builtin.command: /opt/CrowdStrike/falconctl -g --rfm-state
|
|
register: falcon_onboarding_rfm_state
|
|
changed_when: false
|
|
failed_when: false
|
|
tags: [falcon_onboarding]
|
|
|
|
- name: Query agent ID (AID) for verification
|
|
ansible.builtin.command: /opt/CrowdStrike/falconctl -g --aid
|
|
register: falcon_onboarding_aid
|
|
changed_when: false
|
|
failed_when: false
|
|
tags: [falcon_onboarding]
|
|
|
|
- name: Report Falcon onboarding status
|
|
ansible.builtin.debug:
|
|
msg: "CrowdStrike Falcon on {{ inventory_hostname }} - {{ falcon_onboarding_rfm_state.stdout }} | {{ falcon_onboarding_aid.stdout }}"
|
|
tags: [falcon_onboarding]
|