Allow epel-release package name customization

This patch allows deployers to provide a custom name/URL for the
traditional epel-release package.

Related-bug: 1702167
Change-Id: Ie5e30776d2d25a8c254f88c16e17ea15aa38ef26

defaults/main.yml

@@ -33,6 +33,11 @@ security_package_state: present
 # installed by the role. This may prevent certain packages from installing,
 # such as ClamAV.
 security_epel_install_repository: yes
+#
+# Some deployers install a customized EPEL package that redirects servers to
+# their internal EPEL mirrors. Provide the name of the EPEL repository package
+# (epel-release by default on CentOS) or a URL to an EPEL release RPM file.
+security_epel_release_package: epel-release
 
 ###############################################################################
 #   ____  _   _ _____ _        __     ____ _____ ___ ____

releasenotes/notes/allow-custom-epel-release-packages-b409be1aa46ee9c3.yaml

@@ -0,0 +1,6 @@
+---
+features:
+  - |
+    Deployers can now specify a custom package name or URL for an EPEL release
+    package. CentOS systems use ``epel-release`` by default, but some deployers
+    have a customized package that redirects servers to internal mirrors.

tasks/rhel6stig/main.yml

@@ -15,7 +15,7 @@
 
   - name: Install EPEL repository
     yum:
-      name: epel-release
+      name: "{{ security_epel_release_package }}"
       state: "{{ security_package_state }}"
     when:
       - ansible_pkg_mgr == 'yum'

tasks/rhel7stig/main.yml

@@ -69,7 +69,7 @@
 # install EPEL if the deployer asked for clamav to be installed.
 - name: Install EPEL repository
   yum:
-    name: epel-release
+    name: "{{ security_epel_release_package }}"
     state: "{{ security_package_state }}"
   when:
     - ansible_pkg_mgr == 'yum'