File tree Expand file tree Collapse file tree 7 files changed +22
-8
lines changed
hooks/overcloud-host-configure/post.d Expand file tree Collapse file tree 7 files changed +22
-8
lines changed Original file line number Diff line number Diff line change @@ -40,18 +40,32 @@ whether or not workloads or API requests are affected by any configuration chang
40
40
41
41
kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/cis.yml
42
42
43
+ Targetting additional hosts
44
+ ---------------------------
45
+
46
+ The ``cis.yml `` playbook targets hosts in the ``cis-hardening `` group. By
47
+ default this includes the ``overcloud `` group. You can adjust this group
48
+ to suit your needs, e.g to add the seed VM:
49
+
50
+ .. code-block :: yaml
51
+ :caption : $KAYOBE_CONFIG_PATH/inventory/groups
52
+
53
+ [cis-hardening:children]
54
+ overcloud
55
+ seed
56
+
43
57
Enabling the host configure hook
44
58
--------------------------------
45
59
46
60
A hook is pre-installed but its execution is guarded by the
47
- ``stackhpc_enable_cis_benchmark_hardening `` configuration option.
61
+ ``stackhpc_enable_cis_benchmark_hardening_hook `` configuration option.
48
62
If you want the hardening playbooks to run automatically, as part of
49
63
host configure, simply set this flag to ``true ``:
50
64
51
65
.. code-block :: yaml
52
66
:caption : $KAYOBE_CONFIG_PATH/stackhpc.yml
53
67
54
- stackhpc_enable_cis_benchmark_hardening : true
68
+ stackhpc_enable_cis_benchmark_hardening_hook : true
55
69
56
70
Alternatively, this can be toggled on a per-environment basis by
57
71
setting it in an environment specific config file, or even on
Original file line number Diff line number Diff line change 1
1
---
2
2
3
- stackhpc_enable_cis_benchmark_hardening : true
3
+ stackhpc_enable_cis_benchmark_hardening_hook : true
Original file line number Diff line number Diff line change 1
1
---
2
2
3
- stackhpc_enable_cis_benchmark_hardening : true
3
+ stackhpc_enable_cis_benchmark_hardening_hook : true
Original file line number Diff line number Diff line change 1
1
---
2
2
3
3
- import_playbook : ../../../ansible/cis.yml
4
- when : stackhpc_enable_cis_benchmark_hardening | bool
4
+ when : stackhpc_enable_cis_benchmark_hardening_hook | bool
Original file line number Diff line number Diff line change 3
3
# Feature flags
4
4
5
5
# Whether or not to run CIS benchmark hardening playbooks. Default is false.
6
- stackhpc_enable_cis_benchmark_hardening : false
6
+ stackhpc_enable_cis_benchmark_hardening_hook : false
Original file line number Diff line number Diff line change @@ -157,4 +157,4 @@ stackhpc_docker_registry_password: "{{ pulp_password }}"
157
157
# Feature flags
158
158
159
159
# Whether or not to run CIS benchmark hardening playbooks. Default is false.
160
- # stackhpc_enable_cis_benchmark_hardening :
160
+ # stackhpc_enable_cis_benchmark_hardening_hook :
Original file line number Diff line number Diff line change @@ -3,5 +3,5 @@ features:
3
3
- |
4
4
Adds a hook to automatically run the CIS benchmark hardening playbooks as
5
5
part of host configure. This is guarded by the
6
- ``stackhpc_enable_cis_benchmark_hardening `` configuration option and is
6
+ ``stackhpc_enable_cis_benchmark_hardening_hook `` configuration option and is
7
7
disabled by default.
You can’t perform that action at this time.
0 commit comments