CI: Set RL9 crypto policy to DEFAULT #2085
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request sets the RHEL 9 crypto policy to DEFAULT for CI environments to enable ed25519 SSH keys, which is a good improvement. However, a related change in etc/kayobe/ansible/maintenance/cis.yml seems to be missing. There's an assertion in that file that will likely cause CI to fail if ed25519 keys are used, even with this PR's changes. I'd recommend updating that assertion to only run when the crypto policy is FIPS, for example: when: ansible_facts.os_family == 'RedHat' and rhel9cis_crypto_policy == 'FIPS'. This would make the change fully effective. I've also added a comment about configuration duplication to improve maintainability.
| # NOTE: Using DEFAULT crypto policy in CI. FIPS breaks ed25519 SSH keys, and | ||
| # FUTURE breaks wazuh agent repo metadata download. | ||
| rhel9cis_crypto_policy: DEFAULT |
There was a problem hiding this comment.
This configuration is duplicated in etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis. To improve maintainability and avoid having to update multiple files for future changes, consider defining this in a common inventory group for all CI environments. If you have a parent group for ci-aio and ci-multinode, you could define this variable there to keep the configuration DRY (Don't Repeat Yourself).
This should resolve SSH issues with some modern key types such as ed25519.
priteau
force-pushed
the
rhel9cis-crypto-policy-ci
branch
from
6234bf1 to
f4b85ef
Compare
This should resolve SSH issues with some modern key types such as ed25519.