intel
diff --git a/‎Makefile
+7-3 b/‎Makefile
+7-3
diff --git a/‎Pipfile
+6-5 b/‎Pipfile
+6-5
diff --git a/‎README.md
+58-20 b/‎README.md
+58-20
diff --git a/‎SECURITY.md
+5 b/‎SECURITY.md
+5
diff --git a/‎action_plugins/cpupin.py
+2-2 b/‎action_plugins/cpupin.py
+2-2
diff --git a/‎action_plugins/validate_cpusets.py
+1-1 b/‎action_plugins/validate_cpusets.py
+1-1
diff --git a/‎action_plugins/validate_isolcpus.py
+1-1 b/‎action_plugins/validate_isolcpus.py
+1-1
diff --git a/‎ansible.cfg
+3 b/‎ansible.cfg
+3
@@ -1,6 +1,7 @@
 CEK_DIRECTORIES_WITH_SHELL_FILES ?= roles/ examples/ playbooks/infra/ playbooks/intel/
 ARCH ?= 'icx'
 NIC ?= 'cvl'
+MIRRORS ?= false
 PLAYBOOKS_DIRS = playbooks playbooks/infra playbooks/intel
 PLAYBOOK_NAMES = access basic full_nfv on_prem regional_dc remote_fp storage build_your_own
 
@@ -40,7 +41,8 @@ k8s-profile: clean-playbooks
 	--mode k8s \
 	-p $(PROFILE) \
 	-a $(ARCH) \
-	-n ${NIC}
+	-n ${NIC} \
+	-m ${MIRRORS}
 
 vm-profile: clean-playbooks
 	python3 generate/render.py \
@@ -53,7 +55,8 @@ vm-profile: clean-playbooks
 	--mode vm \
 	-p $(PROFILE) \
 	-a $(ARCH) \
-	-n ${NIC}
+	-n ${NIC} \
+	-m ${MIRRORS}
 
 cloud-profile: clean-playbooks
 	python3 generate/render.py \
@@ -65,7 +68,8 @@ cloud-profile: clean-playbooks
 	--mode cloud \
 	-p $(PROFILE) \
 	-a $(ARCH) \
-	-n ${NIC}
+	-n ${NIC} \
+	-m ${MIRRORS}
 
 clean: clean-playbooks clean-project-root-dir
 
 
@@ -6,19 +6,20 @@ name = "pypi"
 [packages]
 ansible = "~=5.7.1"
 "ansible-core" = "~=2.12"
-cryptography = "~=3.3"
-jinja2 = "~=2.11"
+cryptography = "~=39.0"
+jinja2 = "~=3.1"
 netaddr = "~=0.7.19"
 pbr = "~=5.4"
 jmespath = "~=0.9.5"
-"ruamel.yaml" = "~=0.16.10"
+"ruamel.yaml" = "~=0.17.21"
 "ruamel.yaml.clib" = "~=0.2.6"
-MarkupSafe = "~=1.1"
+MarkupSafe = "~=2.1"
 ipaddr = "*"
 
 [dev-packages]
-ansible-lint = "~=5.4.0"
+ansible-lint = "~=6.12.1"
 pylint = "~=2.15.4"
+bandit = "~=1.7.4"
 
 [requires]
 python_version = "3"
@@ -6,6 +6,8 @@ The software provided here is for reference only and not intended for production
 
 ## Quickstart guide
 
+**_NOTE:_** Instruction provided bellow are prepared for deployment done under root user by default. If you want to do deployment under non-root user then read [this](docs/rootless_deployment.md) file first and then continue with following steps under that non-root user.
+
 1. Initialize git submodules to download Kubespray code.
 
     ```bash
@@ -32,7 +34,7 @@ The software provided here is for reference only and not intended for production
         export PROFILE=regional_dc
         ```
 
-    - For **Kubernetes Remote Forwarding Platform Infrastructure** deployment:
+    - For **Kubernetes Remote Central Office-Forwarding Configuration** deployment:
 
         ```bash
         export PROFILE=remote_fp
@@ -44,27 +46,15 @@ The software provided here is for reference only and not intended for production
         export PROFILE=on_prem
         ```
 
-    - For **Kubernetes Full NFV Infrastructure** deployment:
-
-        ```bash
-        export PROFILE=full_nfv
-        ```
-
-    - For **Kubernetes Storage Infrastructure** deployment:
-
-        ```bash
-        export PROFILE=storage
-        ```
-
     - For **Kubernetes Build-Your-Own Infrastructure** deployment:
 
         ```bash
         export PROFILE=build_your_own
         ```
 
-3. Install dependencies using a) or b)
+3. Install dependencies using one of the following methods
 
-    a) Non-invasive virtual environment method
+    a) Non-invasive virtual environment using pipenv
 
     ```bash
     pip3 install pipenv
@@ -73,11 +63,21 @@ The software provided here is for reference only and not intended for production
     pipenv shell
     ```
 
-    b) System wide installation method
+    b) Non-invasive virtual environment using venv
 
-   ```bash
-   pip3 install -r requirements.txt
-   ```
+    ```bash
+    python3 -m venv venv
+    # Then to activate new virtual environment
+    source venv/bin/activate
+    # Install dependencies in venv
+    pip3 install -r requirements.txt
+    ```
+
+    c) System wide environment (not recommended)
+
+    ```bash
+    pip3 install -r requirements.txt
+    ```
 
 4. Generate example host_vars, group_vars and inventory files for Intel Container Experience Kits profiles.
 
@@ -139,7 +139,9 @@ The software provided here is for reference only and not intended for production
     - update details relevant for vm_host (e.g.: datalane_interfaces, ...)
     - update VMs definition in host_vars/host-for-vms-1.yml - use that template for the first vm_host
     - update VMs definition in host_vars/host-for-vms-2.yml - use that template for the second and all other vm_hosts
-    - update/create host_vars for all defined VMs (e.g.: host_vars/vm-ctrl-1.yml and host_vars/vm-work-1.yml)
+    - update/create host_vars for all defined VMs (e.g.: host_vars/vm-ctrl-1.cluster1.local.yml and host_vars/vm-work-1.cluster1.local.yml)
+      In case that vm_cluster_name is not defined or is empty, short host_vars file names should be used for VMs
+      (e.g.: host_vars/vm-ctrl-1.yml and host_vars/vm-work-1.yml)
       Needed details are at least dataplane_interfaces
       For more details see [VM case configuration guide](docs/vm_config_guide.md)
 
@@ -175,6 +177,7 @@ Refer to the documentation linked below to see configuration details for selecte
 - [VM case configuration guide](docs/vm_config_guide.md)
 - [VM multinode setup guide](docs/vm_multinode_setup_guide.md)
 - [VM cluster expansion guide](docs/vm_cluster_expansion_guide.md)
+- [Non-root deployment guide](docs/rootless_deployment.md)
 ## Prerequisites and Requirements
 
 - Required packages on the target servers: **Python3**.
@@ -200,3 +203,38 @@ Contributors, beside basic set of packages, should also install developer packag
 ```bash
 pipenv install --dev
 ```
+
+or
+
+```bash
+pip install -r ci-requirements.txt
+```
+
+### Run lint checks locally
+
+Several lint checks are configured for the repository. All of them can be run on local environment using prepared bash scripts or by leveraging pre-commit hooks.
+
+Prerequisite packages:
+
+- developer python packages (ci-requirements.txt/Pipfile)
+- shellcheck
+- pre-commit python package
+
+Required checks in CI:
+
+- ansible-lint
+- bandit
+- pylint
+- shellcheck
+
+Check can be run by following command:
+
+```bash
+./scrits/run_<linter_name>.sh
+```
+
+or alternatively:
+
+```bash
+pre-commit run <linter_name> --all-files
+```
@@ -0,0 +1,5 @@
+# Security Policy
+Intel is committed to rapidly addressing security vulnerabilities affecting our customers and providing clear guidance on the solution, impact, severity and mitigation. 
+
+## Reporting a Vulnerability
+Please report any security vulnerabilities in this project [utilizing the guidelines here](https://www.intel.com/content/www/us/en/security-center/vulnerability-handling-guidelines.html).
@@ -1,6 +1,6 @@
 #!/usr/bin/python
 #
-#   Copyright (c) 2020-2022 Intel Corporation.
+#   Copyright (c) 2020-2023 Intel Corporation.
 #
 #   Licensed under the Apache License, Version 2.0 (the "License");
 #   you may not use this file except in compliance with the License.
@@ -485,7 +485,7 @@ def _allocate_cpus(self, task_vars):
 
         # Select random NUMA
         if not self.numa:
-            self.numa = random.choice(self.numa_nodes)
+            self.numa = random.choice(self.numa_nodes) # nosec B311 # pseudo random is not used for security purposes
 
         if not self.cpus:
             self.cpu_list = self._select_cpus(task_vars['numa_nodes_cpus'], self.number, self.numa)
 
@@ -1,5 +1,5 @@
 #
-#   Copyright (c) 2020-2022 Intel Corporation.
+#   Copyright (c) 2020-2023 Intel Corporation.
 #
 #   Licensed under the Apache License, Version 2.0 (the "License");
 #   you may not use this file except in compliance with the License.
 
@@ -1,5 +1,5 @@
 #
-#   Copyright (c) 2020-2022 Intel Corporation.
+#   Copyright (c) 2020-2023 Intel Corporation.
 #
 #   Licensed under the Apache License, Version 2.0 (the "License");
 #   you may not use this file except in compliance with the License.
 
@@ -16,3 +16,6 @@ fact_caching_timeout = 7200
 
 action_plugins = ./action_plugins:~/.ansible/plugins/action:/usr/share/ansible/plugins/action
 library = ./library
+
+log_path = ./.ansible_last_run.log
+display_args_to_stdout = False
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`#!/usr/bin/python`
`2`	`2`	`#`
`3`		`-# Copyright (c) 2020-2022 Intel Corporation.`
	`3`	`+# Copyright (c) 2020-2023 Intel Corporation.`
`4`	`4`	`#`
`5`	`5`	`# Licensed under the Apache License, Version 2.0 (the "License");`
`6`	`6`	`# you may not use this file except in compliance with the License.`
`@@ -485,7 +485,7 @@ def _allocate_cpus(self, task_vars):`
`485`	`485`
`486`	`486`	`# Select random NUMA`
`487`	`487`	`if not self.numa:`
`488`		`- self.numa = random.choice(self.numa_nodes)`
	`488`	`+ self.numa = random.choice(self.numa_nodes) # nosec B311 # pseudo random is not used for security purposes`
`489`	`489`
`490`	`490`	`if not self.cpus:`
`491`	`491`	`self.cpu_list = self._select_cpus(task_vars['numa_nodes_cpus'], self.number, self.numa)`
Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,5 @@`
`1`	`1`	`#`
`2`		`-# Copyright (c) 2020-2022 Intel Corporation.`
	`2`	`+# Copyright (c) 2020-2023 Intel Corporation.`
`3`	`3`	`#`
`4`	`4`	`# Licensed under the Apache License, Version 2.0 (the "License");`
`5`	`5`	`# you may not use this file except in compliance with the License.`