From d3a50894272c87fb2ff457953610dd8584f5f9bd Mon Sep 17 00:00:00 2001
From: Mike DePaulo <mikedep333@redhat.com>
Date: Tue, 8 Oct 2019 11:15:24 -0400
Subject: [PATCH] Install epel-release from the internet

after trying epel-release already in the yum repos.

Also provide users with a way of disabling installing epel.

Fixes: #5558
Add ansible-pulp logic to grab epel-release from the internet
https://pulp.plan.io/issues/5558
---
 roles/pulp/README.md         | 11 ++++++++++-
 roles/pulp/defaults/main.yml |  3 +++
 roles/pulp/meta/main.yml     |  2 +-
 roles/pulp/tasks/install.yml | 25 ++++++++++++++++++++++---
 4 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/roles/pulp/README.md b/roles/pulp/README.md
index daa45e306..c4ae8b752 100644
--- a/roles/pulp/README.md
+++ b/roles/pulp/README.md
@@ -7,7 +7,6 @@ The default administrative user for the Pulp application is: 'admin'
 
 Role Variables:
 ---------------
-
 * `pulp_cache_dir`: Location of Pulp cache. Defaults to "/var/lib/pulp/tmp".
 * `pulp_config_dir`: Directory which will contain Pulp configuration files.
   Defaults to "/etc/pulp".
@@ -46,6 +45,16 @@ Role Variables:
     docs](https://docs.pulpproject.org/en/3.0/nightly/installation/configuration.html#id2) for
     documentation on the possible values.
   * `pulp_settings.secret_key`: **Required**. Pulp's Django application `SECRET_KEY`.
+* `epel_release_packages`: List of strings (package names, URLs) to pass to
+  `yum install` to ensure that "epel-release" is installed.
+  Once the 1st string is found to be installed by yum, no further strings are
+  attempted.
+  Defaults to (on el7 for example): ["epel-release", "https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm"]
+  Set to an empty list `[]` if you wish to disable trying to install
+  epel-release, such as if you manually add the EPEL repo via your own
+  configuration or subscription-manager/katello.
+  Also accepts a single string or empty string.
+  Only affects CentOS/RHEL.
 * `rhel7_optional_repo`: List of possible names for the rhel7 optional repo
   to enable. Once the 1st name is enabled (or found to already be enabled),
   no further names are attempted.
diff --git a/roles/pulp/defaults/main.yml b/roles/pulp/defaults/main.yml
index 3907f5907..03533c23f 100644
--- a/roles/pulp/defaults/main.yml
+++ b/roles/pulp/defaults/main.yml
@@ -19,3 +19,6 @@ rhel7_optional_repo:
   - rhui-rhel-7-server-rhui-optional-rpms
   - rhel-7-server-optional-rpms
   - rhel-7-workstation-optional-rpms
+epel_release_packages:
+  - epel-release
+  - "https://dl.fedoraproject.org/pub/epel/epel-release-latest-{{ ansible_distribution_major_version }}.noarch.rpm"
diff --git a/roles/pulp/meta/main.yml b/roles/pulp/meta/main.yml
index 351ba8e14..16bdd401c 100644
--- a/roles/pulp/meta/main.yml
+++ b/roles/pulp/meta/main.yml
@@ -5,7 +5,7 @@ galaxy_info:
   issue_tracker_url: https://pulp.plan.io/projects/external/issues/new
   license: GPLv2
   company: Red Hat
-  min_ansible_version: 2.2
+  min_ansible_version: 2.8
   platforms:
     - name: Debian
       versions:
diff --git a/roles/pulp/tasks/install.yml b/roles/pulp/tasks/install.yml
index e9fd0b287..1d418e4a4 100644
--- a/roles/pulp/tasks/install.yml
+++ b/roles/pulp/tasks/install.yml
@@ -8,11 +8,30 @@
       # This is a lie, but necessary for Idempotence test
       changed_when: False
 
+    # Break the loop once the first package name/URL in the list is found to be installed.
+    # The yum module (which wraps the yum command) uses rc=126 for package not
+    # found, or 0 for changed / already installed.
     - name: Install EPEL Release
-      package:
-        name: epel-release
+      yum:
+        name: "{{ item }}"
         state: present
-      when: ansible_distribution == 'CentOS'
+        # dnf/yum4 registered results not implemented yet
+        use_backend: yum
+      register: epel
+      when:
+        - (ansible_distribution == 'CentOS') or (ansible_distribution == 'RedHat')
+        # Works for both strings and lists to make sure not empty
+        - epel_release_packages is defined
+        - epel_release_packages is not none
+        - epel_release_packages | length > 0
+        - ( ansible_loop.first ) or (epel.rc == 126)
+      failed_when:
+        - epel.rc not in [0,126]
+        - ( ansible_loop.last ) and (epel.rc == 126)
+      # Cast a single string as a list.
+      loop: "{{ lookup('vars', 'epel_release_packages', wantlist=True) }}"
+      loop_control:
+        extended: True
 
     - name: Install prerequisites
       package: