You need to install "jmespath" prior to running json_query filter. about rhel8-cis HOT 8 CLOSED

json_query is a plugin that runs on the ansible controller, so jmespath should only be installed there. But given the many ways Python packages are changed this can be a challenge.

from rhel8-cis.

Up until the release of AlmaLinux 8.8 that script for 8.7 worked because pip3 was installed as a weak dependency of ansible-core 2.13.3:

from rhel8-cis.

To keep us busy the upstream decided to drop that behaviour while introducing ansible-core 2.14 with a transitive dependency on python 3.11. (no pip in the 3.11 update for Alma8.7)

from rhel8-cis.

Hence no pip, no jmespath. And json_query has been moved to community.general anyway...

So not a bug in ansible-core they might say.

from rhel8-cis.

Here it states that pip is no longer bundled.

https://www.redhat.com/sysadmin/install-python-pip-linux

from rhel8-cis.

And now since 8.8 python3.11-pip is bundled again!
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_basic_system_settings/assembly_introduction-to-python_configuring-basic-system-settings

from rhel8-cis.

hi @bbaassssiiee

Thank you for raising this issue and the through investigation into why and how. These details really help.

Think the best thing here to do while the distributors get some consistency is to add this to the FAQs and suggest that the system is patched and jmespath is confirmed prior to running the benchmark remediation.
I have looked at running with JQ that is another product that may not be present on a system but it also comes with a risk if query not closed correctly may affect a system which we would rather not introduce anything at this time that may cause other issues.
Issue raised on RTD to get updated

Thanks as always

uk-bolly

from rhel8-cis.

Using the local provisioner in Packer I can use this playbook:

- name: Play to harden AlmaLinux
  hosts: all:!localhost
  gather_facts: false
  become: true

  pre_tasks:
    - name: Install pip3.11
      ansible.builtin.package:
        name: python3.11-pip
        state: present

    - name: Install jmespath
      ansible.builtin.pip:
       name: jmespath
       state: present
       executable: /usr/bin/pip3.11

  roles:
    - role: rhel8cis
```

from rhel8-cis.