Enable CIS benchmark hardening in AIO and Multinode

doc/source/configuration/security-hardening.rst

@@ -40,3 +40,19 @@ whether or not workloads or API requests are affected by any configuration chang
 
     kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/cis.yml
 
+Enabling the host configure hook
+--------------------------------
+
+A hook is pre-installed but its execution is guarded by the
+``stackhpc_enable_cis_benchmark_hardening`` configuration option.
+If you want the hardening playbooks to run automatically, as part of
+host configure, simply set this flag to ``true``:
+
+.. code-block:: yaml
+  :caption: $KAYOBE_CONFIG_PATH/stackhpc.yml
+
+    stackhpc_enable_cis_benchmark_hardening: true
+
+Alternatively, this can be toggled on a per-environment basis by
+setting it in an environment specific config file, or even on
+targeted hosts by using group or host vars.

etc/kayobe/ansible/cis.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Security hardening
-  hosts: overcloud
+  hosts: cis-hardening
   become: true
   tasks:
     # TODO: Remove this when Red Hat FIPS policy has been updated to allow ed25519 keys.

etc/kayobe/environments/ci-aio/stackhpc.yml

@@ -0,0 +1,3 @@
+---
+
+stackhpc_enable_cis_benchmark_hardening: true

etc/kayobe/environments/ci-multinode/stackhpc.yml

@@ -0,0 +1,3 @@
+---
+
+stackhpc_enable_cis_benchmark_hardening: true

etc/kayobe/hooks/overcloud-host-configure/post.d/99-cis.yml

@@ -0,0 +1,4 @@
+---
+
+- import_playbook: ../../../ansible/cis.yml
+  when: stackhpc_enable_cis_benchmark_hardening | bool

etc/kayobe/inventory/group_vars/all/stackhpc

@@ -0,0 +1,6 @@
+---
+###############################################################################
+# Feature flags
+
+# Whether or not to run CIS benchmark hardening playbooks. Default is false.
+stackhpc_enable_cis_benchmark_hardening: false

etc/kayobe/inventory/groups

@@ -125,3 +125,9 @@ rgws
 [mgrs]
 [osds]
 [rgws]
+
+###############################################################################
+# Feature control groups
+
+[cis-hardening:children]
+overcloud

etc/kayobe/stackhpc.yml

@@ -148,3 +148,9 @@ stackhpc_docker_registry: "{{ pulp_url | regex_replace('^https?://', '') }}"
 # Username and password of container registry.
 stackhpc_docker_registry_username: "{{ pulp_username }}"
 stackhpc_docker_registry_password: "{{ pulp_password }}"
+
+###############################################################################
+# Feature flags
+
+# Whether or not to run CIS benchmark hardening playbooks. Default is false.
+#stackhpc_enable_cis_benchmark_hardening:

releasenotes/notes/adds-cis-hook-8cec8d42103d075e.yaml

@@ -0,0 +1,7 @@
+---
+features:
+  - |
+    Adds a hook to automatically run the CIS benchmark hardening playbooks as
+    part of host configure. This is guarded by the
+    ``stackhpc_enable_cis_benchmark_hardening`` configuration option and is
+    disabled by default.