66 lines
2.3 KiB
YAML
66 lines
2.3 KiB
YAML
---
|
|
# site.yml — IEC 62443-3-3 SL2 Compliance Validation
|
|
#
|
|
# Entry point for the compliance testing framework. This playbook:
|
|
#
|
|
# 1. Runs against all hosts in the inventory
|
|
# 2. Gathers facts first (ansible_date_time, ansible_user_id, etc.)
|
|
# 3. Executes each FR suite as a named task inside an ignore_errors block
|
|
# 4. Invokes library/report.yml to aggregate test_results[] and write JSON
|
|
#
|
|
# Usage:
|
|
# ansible-playbook -i inventory.ini playbooks/site.yml --limit <host> -K
|
|
# ./run.sh --limit <host> -K
|
|
#
|
|
# Adding a new suite:
|
|
# Copy the block below, change the name and include_tasks path:
|
|
#
|
|
# - name: "Suite: FRN — Category Name"
|
|
# block:
|
|
# - ansible.builtin.include_tasks: suites/frN_category.yml
|
|
# ignore_errors: yes
|
|
#
|
|
# Variables:
|
|
# report_dir: Where JSON reports land (default: ./reports, created locally)
|
|
|
|
- name: "IEC 62443-3-3 SL2 Compliance — All Targets"
|
|
hosts: all
|
|
gather_facts: yes
|
|
become: yes
|
|
vars:
|
|
report_dir: "./reports"
|
|
|
|
pre_tasks:
|
|
- name: "Ensure report directory exists"
|
|
ansible.builtin.file:
|
|
path: "{{ report_dir }}"
|
|
state: directory
|
|
mode: "0755"
|
|
delegate_to: localhost
|
|
run_once: true
|
|
|
|
tasks:
|
|
# ─────── FR1: Identification & Authentication ──────────────
|
|
- name: "Suite: FR1 — Identification & Authentication Control"
|
|
block:
|
|
- ansible.builtin.include_tasks: suites/fr1_auth.yml
|
|
ignore_errors: yes
|
|
|
|
# ─────── FR2: Use Control ─────────────────────────────────
|
|
- name: "Suite: FR2 — Use Control"
|
|
block:
|
|
- ansible.builtin.include_tasks: suites/fr2_use_control.yml
|
|
ignore_errors: yes
|
|
|
|
# ─────── FR5: Restricted Data Flow ────────────────────────
|
|
- name: "Suite: FR5 — Restricted Data Flow"
|
|
block:
|
|
- ansible.builtin.include_tasks: suites/fr5_data_flow.yml
|
|
ignore_errors: yes
|
|
|
|
# TODO: Add FR3, FR4, FR6, FR7 suites
|
|
|
|
# ─────── REPORT ───────────────────────────────────────────
|
|
- name: "Generate compliance report"
|
|
ansible.builtin.include_tasks: library/report.yml
|