From 6245b8500fae66e2407d602aa581b8f93676b4d8 Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Wed, 14 Jan 2026 12:20:39 +0100 Subject: [PATCH] CI: Set RL9 crypto policy to DEFAULT This should resolve SSH issues with some modern key types such as ed25519. (cherry picked from commit f4b85ef6068187df0f5bd0773eec5f0c65f516da) --- etc/kayobe/ansible/cis.yml | 2 +- .../ci-aio/inventory/group_vars/cis-hardening/cis | 9 +++++++++ .../ci-multinode/inventory/group_vars/cis-hardening/cis | 9 +++++++++ 3 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 etc/kayobe/environments/ci-aio/inventory/group_vars/cis-hardening/cis create mode 100644 etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis diff --git a/etc/kayobe/ansible/cis.yml b/etc/kayobe/ansible/cis.yml index 7f41ad9fac..a574bd294e 100644 --- a/etc/kayobe/ansible/cis.yml +++ b/etc/kayobe/ansible/cis.yml @@ -13,7 +13,7 @@ that: - ssh_key_type != 'ed25519' fail_msg: FIPS policy does not currently support ed25519 SSH keys on RHEL family systems - when: ansible_facts.os_family == 'RedHat' + when: ansible_facts.os_family == 'RedHat' and rhel9cis_crypto_policy == 'FIPS' - name: Ensure the cron package is installed on ubuntu package: diff --git a/etc/kayobe/environments/ci-aio/inventory/group_vars/cis-hardening/cis b/etc/kayobe/environments/ci-aio/inventory/group_vars/cis-hardening/cis new file mode 100644 index 0000000000..fe8b080d0e --- /dev/null +++ b/etc/kayobe/environments/ci-aio/inventory/group_vars/cis-hardening/cis @@ -0,0 +1,9 @@ +--- +############################################################################## +# Rocky 9 CIS Hardening Configuration + +# NOTE: Using DEFAULT crypto policy in CI. FIPS breaks ed25519 SSH keys, and +# FUTURE breaks wazuh agent repo metadata download. +rhel9cis_crypto_policy: DEFAULT + +############################################################################## diff --git a/etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis b/etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis new file mode 100644 index 0000000000..fe8b080d0e --- /dev/null +++ b/etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis @@ -0,0 +1,9 @@ +--- +############################################################################## +# Rocky 9 CIS Hardening Configuration + +# NOTE: Using DEFAULT crypto policy in CI. FIPS breaks ed25519 SSH keys, and +# FUTURE breaks wazuh agent repo metadata download. +rhel9cis_crypto_policy: DEFAULT + +##############################################################################