Configure SSH AllowUsers on Rocky Linux 10

[priteau]

Without this setting, only the user applying CIS benchmark hardening was authorised to log in, breaking the growroot.yml playbook.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 6098fcf3-cb32-4413-bf2d-d498fe9bbb1c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Summary

Configures Rocky Linux 10 CIS hardening to preserve SSH access for the bootstrap, kolla, and stack users, preventing growroot.yml failures. Adds a release note documenting the fix.

Walkthrough

Rocky 10 CIS hardening now allows SSH access for bootstrap_user, kolla, and stack. A release note documents the change and its resolution of growroot.yml failures after hardening.

Changes

Rocky 10 SSH allowlist

Layer / File(s)	Summary
Configure and document SSH access etc/kayobe/inventory/group_vars/cis-hardening/cis, releasenotes/notes/...	Adds the rhel10cis_sshd_allowusers allowlist and documents the associated growroot.yml hardening fix.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a70276f2-5c9b-47a5-a402-314651951fb1

📥 Commits

Reviewing files that changed from the base of the PR and between 22f010b and 86fa0ad.

📒 Files selected for processing (2)

• etc/kayobe/inventory/group_vars/cis-hardening/cis
• releasenotes/notes/rhel10cis-sshd-allowusers-60e902bfbd8b6c16.yaml

📜 Review details

⏰ Context from checks skipped due to timeout. (5)

• GitHub Check: Tox releasenotes with Python 3.12
• GitHub Check: Tox docs with Python 3.12
• GitHub Check: Ansible 2.18 lint with Python 3.12
• GitHub Check: Tox pep8 with Python 3.12
• GitHub Check: Ansible 2.17 lint with Python 3.10

🔇 Additional comments (1)

etc/kayobe/inventory/group_vars/cis-hardening/cis (1)

152-154: LGTM!

[jackhodgkiss]

Encountered this problem with the kolla user being unable to login.

[owenjones]

LGTM

[Alex-Welsh]

Should we forward-port this to 2026.1?