Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use upstream konstruktoid/ansible-role-hardening (initial refactor for issue 96) #106

Open
wants to merge 12 commits into
base: develop
Choose a base branch
from

Conversation

konstruktoid
Copy link

@konstruktoid konstruktoid commented May 6, 2024

🗣 Description

This PR is a try to use upstream https://github.com/konstruktoid/ansible-role-hardening in order to close #96, it also incorporates as many changes as possible from https://github.com/cisagov/ansible-role-hardening-2/pulls?q=is%3Apr

💭 Motivation and context

See discussions at cisagov/ansible-role-hardening-2#1 (comment) and #96

🧪 Testing

Due to the AWS and other dependencies, no testing except standard role tests has been done.

✅ Pre-approval checklist

  • This PR has an informative and human-readable title.
  • Changes are limited to a single goal - eschew scope creep!
  • All future TODOs are captured in issues, which are referenced
    in code comments.
  • All relevant type-of-change labels have been added.
  • I have read the CONTRIBUTING document.
  • These code changes follow cisagov code standards.
  • All relevant repo and/or project documentation has been updated
    to reflect the changes in this PR.
  • Tests have been added and/or modified to cover the changes in this PR.
  • All new and existing tests pass.

✅ Pre-merge checklist

  • Revert dependencies to default branches.
  • Finalize version.

✅ Post-merge checklist

  • Create a release.

@mcdonnnj mcdonnnj added improvement This issue or pull request will add or improve functionality, maintainability, or ease of use ansible Pull requests that update Ansible code labels May 7, 2024
@jsf9k jsf9k changed the title use upstream konstruktoid/ansible-role-hardening (initial refactor for issue 96) Use upstream konstruktoid/ansible-role-hardening (initial refactor for issue 96) May 29, 2024
@jsf9k jsf9k added the version bump This issue or pull request increments the version number label May 29, 2024
Copy link
Member

@jsf9k jsf9k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Quick, initial review...

src/requirements.yml Outdated Show resolved Hide resolved
src/packer.pkr.hcl Outdated Show resolved Hide resolved
src/upgrade.yml Outdated Show resolved Hide resolved
src/harden.yml Outdated Show resolved Hide resolved
src/harden.yml Outdated Show resolved Hide resolved
src/harden.yml Outdated Show resolved Hide resolved
Copy link
Member

@jsf9k jsf9k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding some comments to explain why we override certain role variables.

src/harden.yml Show resolved Hide resolved
src/harden.yml Show resolved Hide resolved
src/harden.yml Show resolved Hide resolved
issue_template: /tmp/issue
journald_storage: persistent
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
journald_storage: persistent
# Persist journald across reboots
journald_storage: persistent

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We persist journald across reboots for of our AMIs, even those that are not hardened. To remain consistent, perhaps we should continue to use our cisagov/ansible-role-persist-journald even when using the konstruktoid/ansible-role-hardening role.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using the cisagov/ansible-role-persist-journald after the hardening role would ensure consistency but also add the journald_compress and journald_compress variables if needed.

src/harden.yml Outdated Show resolved Hide resolved
src/harden.yml Show resolved Hide resolved
src/harden.yml Show resolved Hide resolved
konstruktoid and others added 11 commits May 29, 2024 23:32
Co-authored-by: Shane Frasier <[email protected]>
Co-authored-by: Shane Frasier <[email protected]>
Co-authored-by: Shane Frasier <[email protected]>
Co-authored-by: Shane Frasier <[email protected]>
Co-authored-by: Shane Frasier <[email protected]>
Co-authored-by: Shane Frasier <[email protected]>
Co-authored-by: Shane Frasier <[email protected]>
Co-authored-by: Shane Frasier <[email protected]>
Signed-off-by: Thomas Sjögren <[email protected]>
Signed-off-by: Thomas Sjögren <[email protected]>
Signed-off-by: Thomas Sjögren <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ansible Pull requests that update Ansible code improvement This issue or pull request will add or improve functionality, maintainability, or ease of use version bump This issue or pull request increments the version number
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Use konstruktoid/ansible-role-hardening?
3 participants