diff --git a/etc/kayobe/ansible/cis.yml b/etc/kayobe/ansible/cis.yml index e71e17ff3e..48022278e7 100644 --- a/etc/kayobe/ansible/cis.yml +++ b/etc/kayobe/ansible/cis.yml @@ -21,6 +21,17 @@ state: present when: ansible_facts.distribution == 'Ubuntu' + - name: Ensure service accounts have no expiry options set + # This is to workaround an issue where we set the expiry to 365 days on kayobe + # service accounts in a previous iteration of the CIS benchmark hardening + # defaults. This should restore the defaults and can eventually be removed. + command: chage -m 0 -M 99999 -W 7 -I -1 {{ item }} + become: true + changed_when: false + with_items: + - "{{ kayobe_ansible_user }}" + - "{{ kolla_ansible_user }}" + - include_role: name: ansible-lockdown.rhel9_cis when: ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '9' diff --git a/etc/kayobe/ansible/ubuntu-upgrade.yml b/etc/kayobe/ansible/ubuntu-upgrade.yml index 928e1c52d0..66ed496436 100644 --- a/etc/kayobe/ansible/ubuntu-upgrade.yml +++ b/etc/kayobe/ansible/ubuntu-upgrade.yml @@ -5,6 +5,7 @@ hosts: overcloud:infra-vms:seed:seed-hypervisor vars: ansible_python_interpreter: /usr/bin/python3 + reboot_timeout_s: "{{ 20 * 60 }}" tasks: - name: Assert that hosts are running Ubuntu Focal assert: @@ -37,7 +38,7 @@ - name: Reboot to apply updates reboot: - reboot_timeout: 1200 + reboot_timeout: "{{ reboot_timeout_s }}" connect_timeout: 600 become: true when: file_status.stat.exists @@ -81,6 +82,7 @@ hosts: overcloud:infra-vms:seed:seed-hypervisor vars: ansible_python_interpreter: /usr/bin/python3 + reboot_timeout_s: "{{ 20 * 60 }}" tasks: - name: Ensure Jammy repo definitions do not exist in sources.list blockinfile: @@ -88,9 +90,16 @@ state: absent become: true + - name: Ensure Kolla Ansible Docker repo definition does not exist + file: + path: /etc/apt/sources.list.d/docker.list + state: absent + become: true + when: apt_repositories | selectattr('url', 'match', '.*docker-ce.*') | list | length > 0 + - name: Reboot and wait reboot: - reboot_timeout: 1200 + reboot_timeout: "{{ reboot_timeout_s }}" connect_timeout: 600 become: true diff --git a/etc/kayobe/apt.yml b/etc/kayobe/apt.yml index c6f3206967..51cd154c9c 100644 --- a/etc/kayobe/apt.yml +++ b/etc/kayobe/apt.yml @@ -52,25 +52,29 @@ stackhpc_apt_repositories: suites: "{{ ansible_facts.distribution_release }} {{ ansible_facts.distribution_release }}-updates {{ ansible_facts.distribution_release }}-backports" components: main restricted universe multiverse architecture: amd64 + required: true - url: "{{ stackhpc_repo_ubuntu_jammy_security_url }}" suites: "{{ ansible_facts.distribution_release }}-security" components: main restricted universe multiverse architecture: amd64 + required: true - url: "{{ stackhpc_repo_ubuntu_jammy_cve_2024_6387_url }}" suites: "pulp" components: upload architecture: amd64 trusted: yes - - url: "{{ stackhpc_repo_docker_ce_ubuntu_url }}" - suites: "{{ ansible_facts.distribution_release }}" + required: true + - url: "{{ stackhpc_repo_docker_ce_ubuntu_jammy_url }}" + suites: "{{ ansible_facts.distribution_release }}" components: stable signed_by: docker.asc architecture: amd64 + required: true # Do not replace apt configuration for non-overcloud hosts. This can result in # errors if apt reconfiguration is performed before local repository mirrors # are deployed. -apt_repositories: "{{ stackhpc_apt_repositories if 'overcloud' in group_names else [] }}" +apt_repositories: "{{ stackhpc_apt_repositories | selectattr('required') | list if 'overcloud' in group_names else [] }}" # Whether to disable repositories in /etc/apt/sources.list. This may be used # when replacing the distribution repositories via apt_repositories. diff --git a/etc/kayobe/environments/ci-aio/stackhpc-ci.yml b/etc/kayobe/environments/ci-aio/stackhpc-ci.yml index e7fb3122de..eee5c0f3fa 100644 --- a/etc/kayobe/environments/ci-aio/stackhpc-ci.yml +++ b/etc/kayobe/environments/ci-aio/stackhpc-ci.yml @@ -32,7 +32,7 @@ stackhpc_repo_ubuntu_jammy_version: "{{ stackhpc_pulp_repo_ubuntu_jammy_version stackhpc_repo_ubuntu_jammy_security_version: "{{ stackhpc_pulp_repo_ubuntu_jammy_security_version }}" stackhpc_repo_ubuntu_jammy_cve_2024_6387_version: "" stackhpc_repo_ubuntu_cloud_archive_version: "{{ stackhpc_pulp_repo_ubuntu_cloud_archive_version }}" -stackhpc_repo_docker_ce_ubuntu_version: "{{ stackhpc_pulp_repo_docker_ce_ubuntu_version }}" +stackhpc_repo_docker_ce_ubuntu_jammy_version: "{{ stackhpc_pulp_repo_docker_ce_ubuntu_jammy_version }}" stackhpc_repo_centos_stream_9_nfv_openvswitch_version: "{{ stackhpc_pulp_repo_centos_stream_9_nfv_openvswitch_version }}" stackhpc_repo_centos_stream_9_openstack_antelope_version: "{{ stackhpc_pulp_repo_centos_stream_9_openstack_antelope_version }}" stackhpc_repo_centos_stream_9_opstools_version: "{{ stackhpc_pulp_repo_centos_stream_9_opstools_version }}" diff --git a/etc/kayobe/environments/ci-builder/stackhpc-ci.yml b/etc/kayobe/environments/ci-builder/stackhpc-ci.yml index 641d197ff4..ae77f5d902 100644 --- a/etc/kayobe/environments/ci-builder/stackhpc-ci.yml +++ b/etc/kayobe/environments/ci-builder/stackhpc-ci.yml @@ -52,7 +52,7 @@ stackhpc_repo_ubuntu_jammy_version: "{{ stackhpc_pulp_repo_ubuntu_jammy_version stackhpc_repo_ubuntu_jammy_security_version: "{{ stackhpc_pulp_repo_ubuntu_jammy_security_version }}" stackhpc_repo_ubuntu_jammy_cve_2024_6387_version: "" stackhpc_repo_ubuntu_cloud_archive_version: "{{ stackhpc_pulp_repo_ubuntu_cloud_archive_version }}" -stackhpc_repo_docker_ce_ubuntu_version: "{{ stackhpc_pulp_repo_docker_ce_ubuntu_version }}" +stackhpc_repo_docker_ce_ubuntu_jammy_version: "{{ stackhpc_pulp_repo_docker_ce_ubuntu_jammy_version }}" stackhpc_repo_centos_stream_9_nfv_openvswitch_version: "{{ stackhpc_pulp_repo_centos_stream_9_nfv_openvswitch_version }}" stackhpc_repo_centos_stream_9_openstack_antelope_version: "{{ stackhpc_pulp_repo_centos_stream_9_openstack_antelope_version }}" stackhpc_repo_centos_stream_9_opstools_version: "{{ stackhpc_pulp_repo_centos_stream_9_opstools_version }}" diff --git a/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml b/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml index 2c81a9d81c..ebc9915a22 100644 --- a/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml +++ b/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml @@ -29,7 +29,7 @@ stackhpc_repo_ubuntu_jammy_version: "{{ stackhpc_pulp_repo_ubuntu_jammy_version stackhpc_repo_ubuntu_jammy_security_version: "{{ stackhpc_pulp_repo_ubuntu_jammy_security_version }}" stackhpc_repo_ubuntu_jammy_cve_2024_6387_version: "" stackhpc_repo_ubuntu_cloud_archive_version: "{{ stackhpc_pulp_repo_ubuntu_cloud_archive_version }}" -stackhpc_repo_docker_ce_ubuntu_version: "{{ stackhpc_pulp_repo_docker_ce_ubuntu_version }}" +stackhpc_repo_docker_ce_ubuntu_jammy_version: "{{ stackhpc_pulp_repo_docker_ce_ubuntu_jammy_version }}" stackhpc_repo_centos_stream_9_nfv_openvswitch_version: "{{ stackhpc_pulp_repo_centos_stream_9_nfv_openvswitch_version }}" stackhpc_repo_centos_stream_9_openstack_antelope_version: "{{ stackhpc_pulp_repo_centos_stream_9_openstack_antelope_version }}" stackhpc_repo_centos_stream_9_opstools_version: "{{ stackhpc_pulp_repo_centos_stream_9_opstools_version }}" diff --git a/etc/kayobe/inventory/group_vars/cis-hardening/cis b/etc/kayobe/inventory/group_vars/cis-hardening/cis index 3fb3da19c8..1ec8c3dccd 100644 --- a/etc/kayobe/inventory/group_vars/cis-hardening/cis +++ b/etc/kayobe/inventory/group_vars/cis-hardening/cis @@ -65,6 +65,10 @@ rhel9cis_max_log_file_size: 1024 # `rhel9cis_bootloader_password_hash` rhel9cis_set_boot_pass: false +# NOTICE: rule disabled otherwise rule will prevent access to accounts +# as it will expire passwords older than one year. +rhel9cis_rule_5_6_1_1: false + ############################################################################## # Ubuntu Jammy CIS Hardening Configuration @@ -163,6 +167,18 @@ ubtu22cis_max_log_file_size: 1024 ubtu22cis_rule_1_4_1: false ubtu22cis_rule_1_4_3: false +# Disable: Ensure minimum days between password changes is configured +ubtu22cis_rule_5_5_1_1: false + +# Disable: Ensure password expiration is 365 days or less +ubtu22cis_rule_5_5_1_2: false + +# Disable: Ensure inactive password lock is 30 days or less +ubtu22cis_rule_5_5_1_4: false + +# Disable: Ensure all users last password change date is in the past +ubtu22cis_rule_5_5_1_5: false + # The way this is disabled currently breaks kolla's IPV6 check, see: # https://bugs.launchpad.net/kolla-ansible/+bug/2071443 # Also matches RHEL hardening behavior. diff --git a/etc/kayobe/pulp-repo-versions.yml b/etc/kayobe/pulp-repo-versions.yml index 5d9f8325f4..5cd869b7d9 100644 --- a/etc/kayobe/pulp-repo-versions.yml +++ b/etc/kayobe/pulp-repo-versions.yml @@ -5,7 +5,7 @@ stackhpc_pulp_repo_centos_stream_9_nfv_openvswitch_version: 20240406T233848 stackhpc_pulp_repo_centos_stream_9_openstack_antelope_version: 20240417T235558 stackhpc_pulp_repo_centos_stream_9_opstools_version: 20231213T031318 stackhpc_pulp_repo_centos_stream_9_storage_ceph_quincy_version: 20231104T015751 -stackhpc_pulp_repo_docker_ce_ubuntu_version: 20231020T014922 +stackhpc_pulp_repo_docker_ce_ubuntu_jammy_version: 20240122T172142 stackhpc_pulp_repo_elrepo_9_version: 20240214T143520 stackhpc_pulp_repo_epel_9_version: 20240417T235558 stackhpc_pulp_repo_grafana_version: 20240417T235558 diff --git a/etc/kayobe/pulp.yml b/etc/kayobe/pulp.yml index 83bba5e2ab..6634ac1175 100644 --- a/etc/kayobe/pulp.yml +++ b/etc/kayobe/pulp.yml @@ -114,10 +114,10 @@ stackhpc_pulp_deb_repos: required: "{{ stackhpc_pulp_sync_ubuntu_jammy | bool }}" # Third-party repositories - - name: "Docker CE for Ubuntu" - url: "{{ stackhpc_release_pulp_content_url }}/docker-ce/ubuntu/{{ stackhpc_pulp_repo_docker_ce_ubuntu_version }}" - distribution_name: "docker-ce-for-ubuntu-" - base_path: "docker-ce/ubuntu/" + - name: "Docker CE for Ubuntu Jammy" + url: "{{ stackhpc_release_pulp_content_url }}/docker-ce/ubuntu-jammy/{{ stackhpc_pulp_repo_docker_ce_ubuntu_jammy_version }}" + distribution_name: "docker-ce-for-ubuntu-jammy-" + base_path: "docker-ce/ubuntu-jammy/" distributions: "jammy" components: "stable" required: "{{ stackhpc_pulp_sync_ubuntu_jammy | bool }}" diff --git a/etc/kayobe/stackhpc.yml b/etc/kayobe/stackhpc.yml index 99c508cd3a..9606634a94 100644 --- a/etc/kayobe/stackhpc.yml +++ b/etc/kayobe/stackhpc.yml @@ -45,9 +45,9 @@ stackhpc_repo_ubuntu_jammy_cve_2024_6387_version: "{{ stackhpc_repo_distribution stackhpc_repo_ubuntu_cloud_archive_url: "{{ stackhpc_repo_mirror_url }}/pulp/content/ubuntu-cloud-archive/{{ stackhpc_repo_ubuntu_cloud_archive_version }}" stackhpc_repo_ubuntu_cloud_archive_version: "{{ stackhpc_repo_distribution }}" -# Docker CE for Ubuntu -stackhpc_repo_docker_ce_ubuntu_url: "{{ stackhpc_repo_mirror_url }}/pulp/content/docker-ce/ubuntu/{{ stackhpc_repo_docker_ce_ubuntu_version }}" -stackhpc_repo_docker_ce_ubuntu_version: "{{ stackhpc_repo_distribution }}" +# Docker CE for Ubuntu Jammy +stackhpc_repo_docker_ce_ubuntu_jammy_url: "{{ stackhpc_repo_mirror_url }}/pulp/content/docker-ce/ubuntu-jammy/{{ stackhpc_repo_docker_ce_ubuntu_jammy_version }}" +stackhpc_repo_docker_ce_ubuntu_jammy_version: "{{ stackhpc_repo_distribution }}" ############################################################################### # RPMs diff --git a/releasenotes/notes/disable-password-expiry-3c296c72d36cd9da.yaml b/releasenotes/notes/disable-password-expiry-3c296c72d36cd9da.yaml new file mode 100644 index 0000000000..3ad5e55b9c --- /dev/null +++ b/releasenotes/notes/disable-password-expiry-3c296c72d36cd9da.yaml @@ -0,0 +1,7 @@ +--- +critical: + - | + Disables password expiration and inactivity policies. This caused the kayobe + and kolla service accounts to be locked out of the system. You should re-apply + the CIS benchmark hardening playbook as soon as possible to avoid being locked + out of your system. diff --git a/releasenotes/notes/docker-bump-dc4e85668ee69a21.yaml b/releasenotes/notes/docker-bump-dc4e85668ee69a21.yaml new file mode 100644 index 0000000000..3563d6d3a1 --- /dev/null +++ b/releasenotes/notes/docker-bump-dc4e85668ee69a21.yaml @@ -0,0 +1,11 @@ +--- +features: + - | + The Docker CE package for Ubuntu has been bumped from ``5:24.0.6-1`` to + ``5:25.0.0-1`` This is a side effect of separating out the repos for Docker + CE for Ubuntu Jammy/Focal. +fixes: + - | + Separated out repos for Docker CE for Ubuntu Jammy/Focal. This fixes a Pulp + sync issue where two "identical" repository versions existed with different + checksums.