CI: Set RL9 crypto policy to DEFAULT (Caracal) #2086
Conversation
This should resolve SSH issues with some modern key types such as ed25519. (cherry picked from commit f4b85ef)
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the RHEL 9 crypto policy to DEFAULT for CI environments to resolve issues with ed25519 SSH keys. The changes involve modifying an Ansible playbook to conditionally assert key types based on the crypto policy and updating CI environment variables to set the new policy. The changes are logical and well-explained. I have one suggestion to improve the robustness of the conditional check in the Ansible playbook by making it more specific to RHEL 9.
| - ssh_key_type != 'ed25519' | ||
| fail_msg: FIPS policy does not currently support ed25519 SSH keys on RHEL family systems | ||
| when: ansible_facts.os_family == 'RedHat' | ||
| when: ansible_facts.os_family == 'RedHat' and rhel9cis_crypto_policy == 'FIPS' |
There was a problem hiding this comment.
The variable rhel9cis_crypto_policy is specific to RHEL 9, but this when condition could apply to other RedHat family OS versions. To avoid potential issues and make the condition more explicit, it would be better to also check for the distribution major version.
when: ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '9' and rhel9cis_crypto_policy == 'FIPS'
priteau
changed the title
This should resolve SSH issues with some modern key types such as ed25519.
(cherry picked from commit f4b85ef)