From caaa231144df94084fe5bcd1bb4d945b08395409 Mon Sep 17 00:00:00 2001 From: Jed Preist Date: Thu, 5 Nov 2026 13:49:44 +0000 Subject: [PATCH 1/2] Don't set sshd DisableForwarding in non-CI AIOs sshd DisableForwarding breaks SSH access using VSCode, which makes development inside AIOs difficult. --- .../aio/inventory/group_vars/cis-hardening/cis | 3 +++ .../ci-aio/inventory/group_vars/cis-hardening/cis | 9 +++++++++ 2 files changed, 12 insertions(+) create mode 100644 etc/kayobe/environments/ci-aio/inventory/group_vars/cis-hardening/cis diff --git a/etc/kayobe/environments/aio/inventory/group_vars/cis-hardening/cis b/etc/kayobe/environments/aio/inventory/group_vars/cis-hardening/cis index c4a2b5433e..79f7f7e5ed 100644 --- a/etc/kayobe/environments/aio/inventory/group_vars/cis-hardening/cis +++ b/etc/kayobe/environments/aio/inventory/group_vars/cis-hardening/cis @@ -6,6 +6,9 @@ # FUTURE breaks wazuh agent repo metadata download. rhel10cis_crypto_policy: DEFAULT +# Don't set sshd DisableForwarding, as it breaks VSCode SSH connectivity +rhel10cis_rule_5_1_8: false + # Disable shell timeout for inactivity which can be disruptive to # development work. rhel10cis_rule_5_4_3_2: false diff --git a/etc/kayobe/environments/ci-aio/inventory/group_vars/cis-hardening/cis b/etc/kayobe/environments/ci-aio/inventory/group_vars/cis-hardening/cis new file mode 100644 index 0000000000..98a6d2000a --- /dev/null +++ b/etc/kayobe/environments/ci-aio/inventory/group_vars/cis-hardening/cis @@ -0,0 +1,9 @@ +--- +############################################################################## +# Rocky 10 CIS Hardening Configuration + +# sshd DisableForwarding can be set back to true in CI AIOs, as users are not +# expected to connect to them. +rhel10cis_rule_5_1_8: true + +############################################################################## From be5d58b43350bb328711b347187663615d324f2a Mon Sep 17 00:00:00 2001 From: Jed Preist Date: Thu, 5 Nov 2026 15:32:57 +0000 Subject: [PATCH 2/2] Fix ci-aio ansible inventory parsing --- etc/kayobe/environments/ci-aio/inventory/groups | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 etc/kayobe/environments/ci-aio/inventory/groups diff --git a/etc/kayobe/environments/ci-aio/inventory/groups b/etc/kayobe/environments/ci-aio/inventory/groups new file mode 100644 index 0000000000..c0a77e5336 --- /dev/null +++ b/etc/kayobe/environments/ci-aio/inventory/groups @@ -0,0 +1,7 @@ +# Empty group to fix ansible inventory parsing +# host_group_vars is a plugin on top of the ansible inventory system, not a +# core part of it. This means that an inventory with no groups or hosts +# specified is invalid, so a group has to be defined even though we only care +# about the contents of group_vars. +# See: https://docs.ansible.com/projects/ansible/latest/plugins/vars.html +[inventory-parse-fix]