From f4b85ef6068187df0f5bd0773eec5f0c65f516da Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Wed, 14 Jan 2026 12:20:39 +0100 Subject: [PATCH] CI: Set RL9 crypto policy to DEFAULT This should resolve SSH issues with some modern key types such as ed25519. --- etc/kayobe/ansible/maintenance/cis.yml | 2 +- .../ci-aio/inventory/group_vars/cis-hardening/cis | 4 ++++ .../ci-multinode/inventory/group_vars/cis-hardening/cis | 4 ++++ 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/etc/kayobe/ansible/maintenance/cis.yml b/etc/kayobe/ansible/maintenance/cis.yml index c52918f557..0491cedbe4 100644 --- a/etc/kayobe/ansible/maintenance/cis.yml +++ b/etc/kayobe/ansible/maintenance/cis.yml @@ -12,7 +12,7 @@ that: - ssh_key_type != 'ed25519' fail_msg: FIPS policy does not currently support ed25519 SSH keys on RHEL family systems - when: ansible_facts.os_family == 'RedHat' + when: ansible_facts.os_family == 'RedHat' and rhel9cis_crypto_policy == 'FIPS' - name: Ensure the cron package is installed on ubuntu ansible.builtin.package: diff --git a/etc/kayobe/environments/ci-aio/inventory/group_vars/cis-hardening/cis b/etc/kayobe/environments/ci-aio/inventory/group_vars/cis-hardening/cis index 4565c96f28..54654b00af 100644 --- a/etc/kayobe/environments/ci-aio/inventory/group_vars/cis-hardening/cis +++ b/etc/kayobe/environments/ci-aio/inventory/group_vars/cis-hardening/cis @@ -2,6 +2,10 @@ ############################################################################## # Rocky 9 CIS Hardening Configuration +# NOTE: Using DEFAULT crypto policy in CI. FIPS breaks ed25519 SSH keys, and +# FUTURE breaks wazuh agent repo metadata download. +rhel9cis_crypto_policy: DEFAULT + # Disable shell timeout for inactivity which can be disruptive to # development work. rhel9cis_rule_5_4_3_2: false diff --git a/etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis b/etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis index 4565c96f28..54654b00af 100644 --- a/etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis +++ b/etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis @@ -2,6 +2,10 @@ ############################################################################## # Rocky 9 CIS Hardening Configuration +# NOTE: Using DEFAULT crypto policy in CI. FIPS breaks ed25519 SSH keys, and +# FUTURE breaks wazuh agent repo metadata download. +rhel9cis_crypto_policy: DEFAULT + # Disable shell timeout for inactivity which can be disruptive to # development work. rhel9cis_rule_5_4_3_2: false