# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(8)
  - NIST-800-53-IA-2(9)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_krb_sec_remote_filesystems
  - no_reboot_needed

- name: Get nfs and nfs4 mount points, that don't have sec=krb5:krb5i:krb5p
  ansible.builtin.command: findmnt --fstab --types nfs,nfs4 -O nosec=krb5:krb5i:krb5p
    -n -P
  register: points_register
  check_mode: false
  changed_when: false
  failed_when: false
  when: '"linux-base" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(8)
  - NIST-800-53-IA-2(9)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_krb_sec_remote_filesystems
  - no_reboot_needed

- name: Add sec=krb5:krb5i:krb5p to nfs and nfs4 mount points
  ansible.posix.mount:
    path: '{{ item | regex_search(''TARGET="([^"]+)"'',''\1'') | first }}'
    src: '{{ item | regex_search(''SOURCE="([^"]+)"'',''\1'') | first }}'
    fstype: '{{ item | regex_search(''FSTYPE="([^"]+)"'',''\1'') | first }}'
    state: present
    opts: '{{ item | regex_search(''OPTIONS="([^"]+)"'',''\1'') | first }},sec=krb5:krb5i:krb5p'
  when:
  - '"linux-base" in ansible_facts.packages'
  - (points_register.stdout | length > 0) and '\\x09' not in item
  with_items: '{{ points_register.stdout_lines }}'
  tags:
  - NIST-800-53-AC-17(a)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(a)
  - NIST-800-53-CM-7(b)
  - NIST-800-53-IA-2
  - NIST-800-53-IA-2(8)
  - NIST-800-53-IA-2(9)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - mount_option_krb_sec_remote_filesystems
  - no_reboot_needed
