[TBExtent]

sshd DisableForwarding breaks SSH access using VSCode, which makes development inside AIOs difficult.

[coderabbitai]

Summary

The AIO inventory disables rhel10cis_rule_5_1_8 to preserve VSCode SSH connectivity. The CI AIO inventory enables the rule and adds an empty group to fix Ansible inventory parsing.

The AIO configuration disables Rocky 10 CIS rule 5_1_8, while the CI AIO configuration enables it. The CI AIO inventory also adds an empty group for inventory parsing.

Changes: CIS rule configuration

Layer / File(s)	Summary
Environment-specific CIS rule settings etc/kayobe/environments/aio/inventory/group_vars/cis-hardening/cis, etc/kayobe/environments/ci-aio/inventory/group_vars/cis-hardening/cis	The AIO configuration sets rhel10cis_rule_5_1_8 to false. The CI AIO configuration sets it to true. Comments describe the SSH forwarding context for each environment.

Inventory parsing configuration

Layer / File(s)	Summary
Empty inventory group etc/kayobe/environments/ci-aio/inventory/groups	The inventory adds an empty [inventory-parse-fix] group and comments that Ansible requires a group or host for inventory parsing.

Estimated code review effort: 2 (Simple) | ~5 minutes

Severity of issue fixed: Low

Possibly related PRs

• stackhpc/stackhpc-kayobe-config#2762: Both PRs set rhel10cis_rule_5_1_8 differently for CI AIO and non-CI AIO environments in response to the stated VSCode SSH connectivity issue.

Merge Risk: Minimal · up to 6eef5

The change is mergeable after normal checks. Previously hardened non-CI AIOs still require SSH configuration cleanup to restore VS Code connectivity; this change does not retroactively remove that existing restriction.

Pre-merge checks: 3

Check name	Status	Explanation
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[coderabbitai]

Actionable comments posted: 1

Review info

Run configuration

• Source mode: Auto
• Repository: stackhpc/stackhpc-kayobe-config
• Branch: stackhpc/2025.1
• File: .coderabbit.yaml
• Commit: 9669712
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: abad7bc3-c3b7-4dc5-912a-d0bfb346619c

Commits

Reviewing files that changed from the base of the PR and between 9669712 and 6eef550.

Files selected for processing: 3

• etc/kayobe/environments/aio/inventory/group_vars/cis-hardening/cis
• etc/kayobe/environments/ci-aio/inventory/group_vars/cis-hardening/cis
• etc/kayobe/environments/ci-aio/inventory/groups

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Review details

Context from checks skipped due to timeout: 4

• GitHub Check: CodeRabbit
• GitHub Check: stackhpc/check
• GitHub Check: Ansible 2.17 lint with Python 3.10
• GitHub Check: Ansible 2.18 lint with Python 3.12