Configure SSH AllowUsers on Rocky Linux 10

[priteau]

Without this setting, only the user applying CIS benchmark hardening was authorised to log in, breaking the growroot.yml playbook.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: bb144835-31d1-4c95-9669-4ee8e28d23d3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Configures Rocky Linux 10 CIS hardening to preserve SSH access for the bootstrap, kolla, and stack users, preventing growroot.yml failures. Adds a release note documenting the fix.

Walkthrough

Rocky 10 CIS hardening now allows SSH access for bootstrap_user, kolla, and stack. A release note documents the change and its resolution of growroot.yml failures after hardening.

Changes

Rocky 10 SSH allowlist

Layer / File(s)	Summary
Configure and document SSH access etc/kayobe/inventory/group_vars/cis-hardening/cis, releasenotes/notes/...	Adds the rhel10cis_sshd_allowusers allowlist and documents the associated growroot.yml hardening fix.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a70276f2-5c9b-47a5-a402-314651951fb1

📥 Commits

Reviewing files that changed from the base of the PR and between 22f010b and 86fa0ad.

📒 Files selected for processing (2)

• etc/kayobe/inventory/group_vars/cis-hardening/cis
• releasenotes/notes/rhel10cis-sshd-allowusers-60e902bfbd8b6c16.yaml

📜 Review details

⏰ Context from checks skipped due to timeout. (5)

• GitHub Check: Tox releasenotes with Python 3.12
• GitHub Check: Tox docs with Python 3.12
• GitHub Check: Ansible 2.18 lint with Python 3.12
• GitHub Check: Tox pep8 with Python 3.12
• GitHub Check: Ansible 2.17 lint with Python 3.10

🔇 Additional comments (1)

etc/kayobe/inventory/group_vars/cis-hardening/cis (1)

152-154: LGTM!

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Document the configurable bootstrap user instead of hard-coding cloud-user.

The configuration allows {{ bootstrap_user }}, not necessarily cloud-user; use “the bootstrap user” (or bootstrap_user) in this note, and remove the extra space before stack.

Suggested wording

-    ``cloud-user``, ``kolla`` and  ``stack``. This resolves issues with running
+    the bootstrap user, ``kolla`` and ``stack``. This resolves issues with running

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	Configures Rocky Linux 10 CIS benchmark hardening to allow SSH for users
	``cloud-user``, ``kolla`` and ``stack``. This resolves issues with running
	the ``growroot.yml`` playbook after applying hardening configuration.
	Configures Rocky Linux 10 CIS benchmark hardening to allow SSH for users
	the bootstrap user, ``kolla`` and ``stack``. This resolves issues with running
	the ``growroot.yml`` playbook after applying hardening configuration.