Merge "Add ansible-hardening repository"

gerrit/projects.yaml

@@ -844,6 +844,13 @@
 - project: openstack/anchor
   description: An Ephemeral PKI system that can act as a trust anchor for OpenStack
     PKI operations
+- project: openstack/ansible-hardening
+  description: Ansible role for security hardening
+  groups:
+    - openstack-ansible
+  docimpact-group: openstack-ansible
+  acl-config: /home/gerrit2/acls/openstack/openstack-ansible.config
+  upstream: https://github.com/openstack/openstack-ansible-security
 - project: openstack/ansible-role-ara
   use-storyboard: true
   description: Ansible role to install and set up ARA

gerritbot/channels.yaml

@@ -260,6 +260,7 @@ openstack-ansible:
     - change-merged
     - x-vrif-minus-2
   projects:
+    - openstack/ansible-hardening
     - openstack/monitorstack
     - openstack/openstack-ansible
     - openstack/openstack-ansible-apt_package_pinning

jenkins/jobs/projects.yaml

@@ -35,6 +35,22 @@
       - openstack-publish-jobs
       - pypi-jobs
 
+# NOTE(mhayden): The 'ansible-hardening' repo will replace
+# 'openstack-ansible-security' in the future.
+- project:
+    name: ansible-hardening
+
+    jobs:
+      - ansible-role-jobs
+      - gate-{name}-requirements
+      - openstack-publish-jobs
+      - openstack-releasenotes-jobs
+      - '{pipeline}-{name}-ansible-{scenario}-{ostype}{suffix}':
+          suffix: ''
+          ostype: ubuntu-trusty
+          pipeline: gate
+          scenario: func_rhel6
+
 - project:
     name: ansible-role-bindep
 
@@ -9485,7 +9501,6 @@
           pipeline: gate
           scenario: func_rhel6
 
-
 - project:
     name: openstack-ansible-specs
 

zuul/layout.yaml

@@ -3433,15 +3433,16 @@ jobs:
   - name: ^gate-openstack-ansible-openstack-ansible-aio-ubuntu-xenial-nv$
     branch: ^stable/newton$
 
-  # Run the openstack-ansible-security functional test on centos-7
-  # for any branch after stable/mitaka.
-  - name: ^gate-openstack-ansible-security-ansible-func-centos-7.*$
+  # Restrictions for openstack-ansible-security/ansible-hardening
+  #   - Run centos-7 job on Newton or later
+  #   - Run debian-jessie job on Pike or later
+  #   - Run RHEL 6 content against ubuntu-trusty on Ocata or later
+  - name: ^gate-(openstack-ansible-security|ansible-hardening)-ansible-func-centos-7.*$
     branch: ^(?!stable/mitaka).*$
-
-  # Run the openstack-ansible-security functional test on debian-jessie
-  # for any branch after stable/ocata.
-  - name: ^gate-openstack-ansible-security-ansible-func-debian-jessie.*$
+  - name: ^gate-(openstack-ansible-security|ansible-hardening)-ansible-func-debian-jessie.*$
     branch: ^(?!stable/(mitaka|newton|ocata)).*$
+  - name: ^gate-(openstack-ansible-security|ansible-hardening)-ansible-func_rhel6.*$
+    branch: ^(?!stable/(mitaka|newton)).*$
 
   # Skip the OpenStack-Ansible voting aio scenario job on xenial for the
   # openstack-ansible repository if the branch is anything before ocata.
@@ -3458,11 +3459,6 @@ jobs:
   - name: ^gate-openstack-ansible-openstack-ansible-aio-centos-7.*$
     branch: ^(?!stable/(mitaka|newton)).*$
 
-  # Skip the functional tests against the RHEL 6 STIG content on Newton branch
-  # and earlier branches.
-  - name: ^gate-openstack-ansible-security-ansible-func_rhel6.*$
-    branch: ^(?!stable/(mitaka|newton)).*$
-
   # Skip the os_ceilometer functional tests against gnocchi on Newton
   # and earlier branches.
   - name: ^gate-openstack-ansible-os_ceilometer-ansible-gnocchi.*$
@@ -5531,6 +5527,25 @@ projects:
       - name: check-requirements
       - name: publish-to-pypi
 
+  # NOTE(mhayden): This repository will replace openstack-ansible-security in
+  # the future.
+  - name: openstack/ansible-hardening
+    template:
+      - name: merge-check
+      - name: ansible-role-jobs
+      - name: check-requirements
+      - name: openstack-server-publish-jobs
+      - name: release-notes-jobs
+      - name: ansible-role-functional-jobs-centos7
+      - name: ansible-role-functional-jobs-xenial
+    check:
+      - gate-ansible-hardening-ansible-func_rhel6-ubuntu-trusty
+      - gate-ansible-hardening-ansible-func-debian-jessie-nv
+    gate:
+      - gate-ansible-hardening-ansible-func_rhel6-ubuntu-trusty
+    release:
+      - ansible-hardening-announce-release
+
   - name: openstack/ansible-role-ara
     template:
       - name: noop-jobs