Revert "CNF-21196: RAN Hardening (5.0) - Kernel Sysctl Hardening (M2)"

[sebrandon1]

Reverts #822

The flags that are set are already set and enabled for OCP 5.0 so we don't need to "own" these settings.

[openshift-ci-robot]

@sebrandon1: This pull request references CNF-21196 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Reverts #822

The flags that are set are already set and enabled for OCP 5.0 so we don't need to "own" these settings.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 5d11f7c6-7ba0-4338-9b4b-5463e97b8c23

📥 Commits

Reviewing files that changed from the base of the PR and between 393e6c1 and 2260a72.

📒 Files selected for processing (2)

• telco-ran/configuration/kube-compare-reference/informational/hardening/75-sysctl-kernel-hardening-master.yaml
• telco-ran/configuration/kube-compare-reference/informational/hardening/75-sysctl-kernel-hardening-worker.yaml

💤 Files with no reviewable changes (2)

• telco-ran/configuration/kube-compare-reference/informational/hardening/75-sysctl-kernel-hardening-master.yaml
• telco-ran/configuration/kube-compare-reference/informational/hardening/75-sysctl-kernel-hardening-worker.yaml

---

📝 Walkthrough

Walkthrough

Two MachineConfig YAML manifests under the informational hardening directory are deleted: 75-sysctl-kernel-hardening-master.yaml and 75-sysctl-kernel-hardening-worker.yaml. Both previously configured /etc/sysctl.d/75-kernel-hardening.conf via Ignition with kernel hardening sysctl values targeting master and worker roles respectively.

Changes

Cohort / File(s)	Summary
Remove kernel hardening MachineConfigs telco-ran/configuration/kube-compare-reference/informational/hardening/75-sysctl-kernel-hardening-master.yaml, ...75-sysctl-kernel-hardening-worker.yaml	Deleted both MachineConfig manifests that deployed /etc/sysctl.d/75-kernel-hardening.conf with kernel.randomize_va_space=2, kernel.unprivileged_bpf_disabled=1, net.core.bpf_jit_harden=2, and kernel.yama.ptrace_scope=1 for master and worker nodes.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly indicates a revert of the kernel sysctl hardening change, which matches the removed MachineConfig manifests.
Description check	✅ Passed	The description is directly related, explaining that the sysctl settings are already enabled in OCP 5.0 and the change reverts a prior PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[imiller0]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: imiller0, sebrandon1

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [imiller0]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment