Role wazuh-ansible-agent not idempotent when installing from repository about wazuh-ansible HOT 4 OPEN

Hello.

Yes, the behavior you comment is the expected behavior. We add and remove the Wazuh APT/RPM repository to avoid upgrading a Wazuh component accidentally.

If the repository is kept in the source list and if you run the apt-get upgrade or the yum upgrade command, you could upgrade a Wazuh component (indexer, manager, dashboard, or agent in your specific case) accidentally, and this could lead to a non-desirable environment or configuration. We prefer that the user manually upgrades a Wazuh component when it is actually the desired action.

from wazuh-ansible.

Hey, thank you for the clarification.

I understand that accidently upgrading Wazuh components is a risk, but removing the repository source to prevent that does not seem to be a great solution to me.

What do you think about locking the package version in the package manager (Something like apt-mark hold or yum version-lock)?

You would need some additional tasks that do the unlock/lock operations when you actually upgrade the version via Ansible, but this should solve the idempotency issue and keep hosts safe from getting their Wazuh components unintentionally upgraded.

from wazuh-ansible.

Hello.

From the team, we do not have plans to change the way this is performed. I kindly suggest you open a Pull Request to perform the necessary changes and the team will review it and merge it if applicable. https://github.com/wazuh/wazuh-ansible/pulls

from wazuh-ansible.