[TBExtent]

sshd DisableForwarding breaks SSH access using VSCode, which makes development inside AIOs difficult.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: stackhpc/stackhpc-kayobe-config
• Branch: stackhpc/2026.1
• File: .coderabbit.yaml
• Commit: dd45f5a
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3d1dedc1-3460-4ea0-b12f-2d9d2c515d2d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

Walkthrough

The AIO environment disables rhel10cis_rule_5_1_8, while the CI AIO environment enables it. Both configurations add comments about SSH forwarding.

Changes: AIO SSH forwarding policy

Layer / File(s)	Summary
Set forwarding policy by environment etc/kayobe/environments/aio/stackhpc.yml, etc/kayobe/environments/ci-aio/stackhpc.yml	The AIO environment sets rhel10cis_rule_5_1_8 to false and documents the VSCode SSH connectivity context. The CI AIO environment sets it to true and documents the DisableForwarding setting.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: Minimal · previous review 9f334

The change is mergeable. Newly configured non-CI AIOs avoid the forwarding restriction; previously hardened AIOs still need a manual cleanup or a separate migration.

Pre-merge checks: 3

Check name	Status	Explanation
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[coderabbitai]

Note

Follow-up findings are listed below so you can review them separately from inline comments.

Follow-up (1)

Minor (1)

Minor · Remove the stale DisableForwarding line on hosts hardened before this change. · stackhpc.yml:6

etc/kayobe/environments/aio/stackhpc.yml:6
Minor · Functional Correctness · Poor tradeoff

Remove the stale DisableForwarding line on hosts hardened before this change.

Setting rhel10cis_rule_5_1_8: false skips the 5.1.8 task. That task only writes DisableForwarding yes to the sshd configuration. It does not remove the line. Hosts hardened while the rule was enabled keep DisableForwarding yes after a rerun, so SSH forwarding for VSCode stays blocked on those hosts.

Add a cleanup step that removes the line when the rule is false, or document the manual fix for existing AIOs. A cleanup step must also restart sshd.

Review info

Run configuration

• Source mode: Auto
• Repository: stackhpc/stackhpc-kayobe-config
• Branch: stackhpc/2026.1
• File: .coderabbit.yaml
• Commit: bbc8702
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8ca0674d-89bb-461d-a898-e1a70cf44d97

Commits

Reviewing files that changed from the base of the PR and between bbc8702 and 9f3341e.

Files selected for processing: 2

• etc/kayobe/environments/aio/stackhpc.yml
• etc/kayobe/environments/ci-aio/stackhpc.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.