htunnthuthu/ansible-inspec

By htunnthuthu

•Updated 7 months ago

A compliance and infrastructure testing tool

Image

4.0K

Overview Tags

htunnthuthu/ansible-inspec repository overview

⁠ansible-inspec

Bridge Infrastructure Automation and Compliance Testing

A powerful compliance and infrastructure testing tool that combines Ansible's automation capabilities with InSpec's compliance framework.

⁠🚀 Quick Start

# Pull the image
docker pull htunnthuthu/ansible-inspec:latest

# Run compliance check
docker run --rm \
  -v $(pwd):/workspace \
  -v ~/.ssh:/home/ansibleinspec/.ssh:ro \
  htunnthuthu/ansible-inspec:latest \
  exec /workspace/profile/ -i /workspace/inventory.yml

⁠✨ Features

✅ Chef Supermarket Integration - Access 100+ pre-built compliance profiles (CIS benchmarks, DevSec baselines, DISA STIGs)
📊 Multi-Format Reporting - Generate JSON, HTML, JUnit reports for audits and CI/CD
🔄 Profile Conversion - Convert InSpec profiles to Ansible collections (InSpec-free mode)
⚡ Parallel Execution - Test hundreds of hosts simultaneously using Ansible inventory
🔒 Comprehensive Coverage - CIS Benchmarks, PCI-DSS, GDPR, custom compliance policies
🐳 Multi-Platform - Pre-built for linux/amd64 and linux/arm64

⁠📦 Available Tags

latest - Latest stable release from main branch
0.1.0, 0.1, 0 - Semantic version tags
main - Latest development build

⁠🎯 Common Use Cases

⁠Run Chef Supermarket Profile

docker run --rm \
  -v $(pwd)/reports:/workspace/.compliance-reports \
  htunnthuthu/ansible-inspec:latest \
  exec dev-sec/linux-baseline --supermarket \
  --target ssh://user@hostname \
  --reporter html --output /workspace/.compliance-reports/report.html

⁠Use Ansible Inventory

# Create inventory.yml
cat > inventory.yml <<EOF
all:
  hosts:
    webserver:
      ansible_host: 192.168.1.10
      ansible_user: admin
EOF

# Run compliance test
docker run --rm \
  -v $(pwd):/workspace \
  -v ~/.ssh:/home/ansibleinspec/.ssh:ro \
  htunnthuthu/ansible-inspec:latest \
  exec dev-sec/ssh-baseline --supermarket \
  -i /workspace/inventory.yml \
  --reporter json --output /workspace/compliance-report.json

⁠Convert InSpec Profile to Ansible Collection

docker run --rm \
  -v $(pwd):/workspace \
  htunnthuthu/ansible-inspec:latest \
  convert /workspace/my-profile \
  --namespace myorg \
  --collection-name compliance_baseline

⁠📋 Volume Mounts

Mount	Purpose	Example
`/workspace`	Working directory for profiles and reports	`-v $(pwd):/workspace`
`/home/ansibleinspec/.ssh`	SSH keys for remote connections	`-v ~/.ssh:/home/ansibleinspec/.ssh:ro`
`/etc/ansible`	Ansible configuration files	`-v ./ansible.cfg:/etc/ansible/ansible.cfg:ro`

⁠🔐 SSH Configuration

For SSH-based testing, mount your SSH keys:

docker run --rm \
  -v ~/.ssh:/home/ansibleinspec/.ssh:ro \
  -v $(pwd):/workspace \
  htunnthuthu/ansible-inspec:latest \
  exec profile/ --target ssh://user@host

⁠📊 Generate Compliance Reports

# JSON report (InSpec schema-compatible)
docker run --rm \
  -v $(pwd):/workspace \
  htunnthuthu/ansible-inspec:latest \
  exec dev-sec/linux-baseline --supermarket \
  -i /workspace/inventory.yml \
  --reporter json --output /workspace/compliance.json

# HTML dashboard
docker run --rm \
  -v $(pwd):/workspace \
  htunnthuthu/ansible-inspec:latest \
  exec dev-sec/linux-baseline --supermarket \
  -i /workspace/inventory.yml \
  --reporter html --output /workspace/compliance.html

# Multiple formats
docker run --rm \
  -v $(pwd):/workspace \
  htunnthuthu/ansible-inspec:latest \
  exec profile/ -i /workspace/inventory.yml \
  --reporter "json:/workspace/report.json html:/workspace/report.html"

⁠🔧 Environment Variables

Variable	Description	Default
`ANSIBLE_CONFIG`	Path to ansible.cfg	`/etc/ansible/ansible.cfg`
`ANSIBLE_INVENTORY`	Default inventory path	-
`INSPEC_BACKEND_CACHE`	Enable InSpec caching	`true`

⁠💡 Pro Tips

⁠CI/CD Integration

GitLab CI:

compliance_check:
  stage: test
  image: htunnthuthu/ansible-inspec:latest
  script:
    - ansible-inspec exec security-baseline/ -i inventory.yml --reporter junit -o compliance.xml
  artifacts:
    reports:
      junit: compliance.xml

GitHub Actions:

- name: Run Compliance Tests
  uses: docker://htunnthuthu/ansible-inspec:latest
  with:
    args: exec dev-sec/linux-baseline --supermarket -i inventory.yml --reporter json -o report.json

⁠Local Development

Create an alias for easier use:

alias ansible-inspec='docker run --rm -v $(pwd):/workspace -v ~/.ssh:/home/ansibleinspec/.ssh:ro htunnthuthu/ansible-inspec:latest'

# Then use it like a local command
ansible-inspec exec profile/ -i inventory.yml
ansible-inspec --help

⁠📚 Documentation

⁠🌟 Popular Compliance Profiles

Access these profiles directly from Chef Supermarket:

dev-sec/linux-baseline - OS hardening (56 controls)
dev-sec/ssh-baseline - SSH security (28 controls)
cis-docker-benchmark - CIS Docker compliance
dev-sec/nginx-baseline - Nginx hardening
dev-sec/apache-baseline - Apache security
dev-sec/mysql-baseline - MySQL/MariaDB security
dev-sec/postgres-baseline - PostgreSQL security

⁠📝 License

GPL-3.0 License - See LICENSE⁠

⁠🤝 Contributing

Contributions welcome! See CONTRIBUTING.md⁠

⁠💬 Support

Issues: GitHub Issues⁠
Discussions: GitHub Discussions⁠

Note: This project integrates Ansible⁠ (GPL-3.0) and InSpec⁠ (Apache-2.0). Not officially endorsed by Red Hat or Progress Software.

Tag summary

Recent tags

Content type

Image

Digest

sha256:2e3866b06…

Size

240.7 MB

Last updated

7 months ago

docker pull htunnthuthu/ansible-inspec