Ansible hardening role for RHEL 10 (CIS Benchmark). Suitable for playbooks, Packer/Ansible provisioners, and golden-image pipelines. Search keywords: ansible, ansible-role, cis, cis-benchmark, cis-hardening, compliance, devsecops, hardening, infrastructure, openscap, redhat, rhel, rhel10, security.
StigForge-exported Ansible role rhel10_cis · release 0.2.4.
Matrix cell status: green.
This repository root is the Ansible role (Galaxy-style layout). OpenSCAP evidence
lives under compliance/ and is not loaded when the role runs.
From Ansible Galaxy (after import; namespace stigready):
ansible-galaxy role install stigready.rhel10_cis,0.2.4From GitHub (public):
# requirements.yml
roles:
- src: https://github.com/stigready/rhel10-cis
scm: git
version: v0.2.4 # or an immutable commit SHA
name: rhel10_cisansible-galaxy role install -r requirements.yml -p ./roles
ansible-playbook -i inventory site.yml # role: rhel10_cisEvidence was produced by docker verify + OpenSCAP on the factory CI run cited below.
| Profile | Score | Floor | Gate | Ansible | Evidence tested (UTC) |
|---|---|---|---|---|---|
cis-l1 |
97.53% ✓ | 90.0% | PASS ✓ | rc 0 | 20260729T224030Z |
cis-l2 |
96.47% ✓ | 90.0% | PASS ✓ | rc 0 | 20260729T224308Z |
Full artifacts per profile: compliance/releases/0.2.4/<profile>/ (score.json, results.xml, report.html, evidence.json, evidence-report.html, poam.md).
- REVIEW.md — linked evidence index for product owner review
- reports/index.html — HTML report index
- CHANGELOG.md — release notes and verify summary
Re-run OpenSCAP in Docker and compare to this release's evidence:
make prove RELEASE=0.2.4Or score your own results.xml: see compliance/README.md.
- LICENSE (MIT) — StigForge export packaging
- NOTICE — ComplianceAsCode / BSD-3-Clause task body attribution
- Monorepo: stigready/stigforge @
7f7cafc85a392bf2a7eb04f1b979185dbcdf5530 - CI run: https://github.com/stigready/stigforge/actions/runs/30496236357
- Catalog: https://stigready.com/#stigforge