How ansible-lockdown/rhel10-cis works
RHEL10-CIS is an Ansible role for remediating a RHEL 10 host against the CIS benchmark. The principal workflow is an operator applying the role to a host, with controls organized into seven benchmark sections; optional auditing checks enabled controls and can use Goss. Defaults configure audit and control selection, while templates and platform variables support system configuration. The tree and README establish these capabilities, but the task files were not sampled, so internal task dispatch and most implementation links are omitted. The standalone GRUB hash filter is included without an asserted connection to the role workflow.
Main entry points: main.yml Role entry · audit_only.yml Audit tasks · main Role defaults · section_1 Section 1
Components 18
Role execution
- Role entry
tasks/main.yml - Preparation
tasks/prelim.yml - Post-remediation
tasks/post.yml
CIS controls
Audit
- Role defaults
defaults/main - Audit tasks
tasks/audit_only.yml - Goss checker
System configuration
- Config templates
templates - Platform settings
vars
Role helpers
- GRUB hash filter
filter_plugins/grub_hash.py
Other components
- Ansible operator
- RHEL 10 host
Connections 11
- Ansible operator → Role entry: applies role
README.md - Role entry → RHEL 10 host: remediates host
README.md - Role defaults → Audit tasks: configures audit
README.md - Audit tasks → Goss checker: uses checker
README.md - Role entry → Section 1
- Role entry → Section 2
- Role entry → Section 3
- Role entry → Section 4
- Role entry → Section 5
- Role entry → Section 6
- Role entry → Section 7