diff --git a/docs/user/README.md b/docs/user/README.md
index fb004b73ef..6ac76eacab 100644
--- a/docs/user/README.md
+++ b/docs/user/README.md
@@ -10,6 +10,7 @@ List of the documents in alphabetical file name order.
 - [AMQ Broker on MicroShift](./howto_amq_broker.md)
 - [Cluster-to-Cluster Connectivity (C2CC)](./howto_c2cc.md)
 - [Encrypting C2CC Traffic with IPsec](./howto_c2cc_ipsec.md)
+- [CIS Level 2 Hardening for MicroShift](./howto_cis_hardening.md)
 - [MicroShift Configuration](./howto_config.md)
 - [Firewall Configuration](./howto_firewall.md)
 - [Gateway API](./howto_gateway_api.md)
diff --git a/docs/user/howto_cis_hardening.md b/docs/user/howto_cis_hardening.md
new file mode 100644
index 0000000000..36be22be50
--- /dev/null
+++ b/docs/user/howto_cis_hardening.md
@@ -0,0 +1,107 @@
+# CIS Level 2 Hardening for MicroShift
+
+This guide describes how to run MicroShift on a CIS Level 2 hardened RHEL system. It covers which CIS rules MicroShift affects, the required hardening playbook overrides, and how to verify compliance.
+
+## MicroShift's CIS Impact
+
+MicroShift introduces changes to a hardened system in three categories. These rules will fail on any system running Kubernetes containers and cannot be avoided without disabling core functionality.
+
+### IP Forwarding
+
+OVN-Kubernetes requires IP forwarding for pod networking. MicroShift enables `net.ipv4.ip_forward` and `net.ipv6.conf.all.forwarding` at startup.
+
+| Rule ID | RHEL 9 | RHEL 10 |
+|:--------|:------:|:-------:|
+| `sysctl_net_ipv4_ip_forward` | x | x |
+| `sysctl_net_ipv6_conf_all_forwarding` | x | x |
+| `sysctl_net_ipv4_conf_all_forwarding` | | x |
+| `sysctl_net_ipv4_conf_default_forwarding` | | x |
+| `sysctl_net_ipv6_conf_default_forwarding` | | x |
+
+### Container File Ownership
+
+Container images contain files owned by UIDs and GIDs that do not exist in the host's `/etc/passwd` and `/etc/group`. These are stored in `/var/lib/containers/storage/overlay/` and are an inherent characteristic of any container runtime.
+
+| Rule ID | RHEL 9 | RHEL 10 |
+|:--------|:------:|:-------:|
+| `file_permissions_ungroupowned` | x | |
+| `no_files_unowned_by_user` | x | |
+| `no_files_or_dirs_ungroupowned` | | x |
+| `no_files_or_dirs_unowned_by_user` | | x |
+
+### Kubelet Volume Permissions
+
+Kubelet creates 0777 directories for ConfigMap and EmptyDir volumes so that pods running as any UID can access their projected configuration. It also creates 0666 container termination log files.
+
+| Rule ID | RHEL 9 | RHEL 10 |
+|:--------|:------:|:-------:|
+| `dir_perms_world_writable_sticky_bits` | x | x |
+| `file_permissions_unauthorized_world_writable` | x | x |
+
+### Audit Rules
+
+CIS requires audit rules for all setuid/setgid binaries. If MicroShift is installed after running the CIS hardening role, the audit rules will not cover binaries added by MicroShift RPMs.
+
+| Rule ID | RHEL 9 | RHEL 10 |
+|:--------|:------:|:-------:|
+| `audit_rules_privileged_commands` | x | x |
+
+This rule can be resolved by regenerating audit rules after installing MicroShift:
+
+```bash
+sudo find / -xdev \( -perm -4000 -o -perm -2000 \) -type f 2>/dev/null | \
+  awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>=1000 -F auid!=unset -k privileged"}' | \
+  sudo tee /etc/audit/rules.d/99-privileged-post-install.rules > /dev/null
+sudo augenrules --load
+```
+
+## Hardening Playbook Overrides
+
+When using the RedHatOfficial CIS ansible roles, the hardening playbook must override the IP forwarding variables to prevent the role from disabling forwarding before MicroShift starts.
+
+For RHEL 9:
+
+```yaml
+---
+- name: Apply CIS Level 2 hardening
+  hosts: localhost
+  connection: local
+  become: true
+  roles:
+    - role: ansible-role-rhel9-cis
+      vars:
+        sysctl_net_ipv4_ip_forward: false
+        sysctl_net_ipv6_conf_all_forwarding: false
+```
+
+For RHEL 10, the CIS benchmark adds per-interface forwarding checks:
+
+```yaml
+---
+- name: Apply CIS Level 2 hardening
+  hosts: localhost
+  connection: local
+  become: true
+  roles:
+    - role: ansible-role-rhel10-cis
+      vars:
+        sysctl_net_ipv4_ip_forward: false
+        sysctl_net_ipv4_conf_all_forwarding: false
+        sysctl_net_ipv4_conf_default_forwarding: false
+        sysctl_net_ipv6_conf_all_forwarding: false
+        sysctl_net_ipv6_conf_default_forwarding: false
+```
+
+> Each variable is set to `false` to tell the role **not** to disable forwarding. This does not enable forwarding — MicroShift does that at startup.
+
+## Firewall Configuration
+
+CIS hardening enables `firewalld` and locks down all traffic. MicroShift requires several ports and trusted network sources to be opened as described in [Firewall Configuration](howto_firewall.md).
+
+## References
+
+- [RedHatOfficial ansible-role-rhel9-cis](https://github.com/RedHatOfficial/ansible-role-rhel9-cis)
+- [RedHatOfficial ansible-role-rhel10-cis](https://github.com/RedHatOfficial/ansible-role-rhel10-cis)
+- [OpenSCAP Project](https://www.open-scap.org/)
+- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
+- [Firewall Configuration](howto_firewall.md)
diff --git a/test/assets/cis/cis-harden-el10.yml b/test/assets/cis/cis-harden-el10.yml
new file mode 100644
index 0000000000..b70502fbf1
--- /dev/null
+++ b/test/assets/cis/cis-harden-el10.yml
@@ -0,0 +1,16 @@
+---
+- name: Apply CIS Level 2 hardening
+  hosts: localhost
+  connection: local
+  become: true
+  roles:
+    - role: ansible-role-rhel10-cis
+      vars:
+        # MicroShift OVN networking requires IP forwarding
+        sysctl_net_ipv4_ip_forward: false
+        sysctl_net_ipv4_conf_all_forwarding: false
+        sysctl_net_ipv4_conf_default_forwarding: false
+        sysctl_net_ipv6_conf_all_forwarding: false
+        sysctl_net_ipv6_conf_default_forwarding: false
+        # CI requires passwordless sudo
+        sudo_remove_nopasswd: false
diff --git a/test/assets/cis/cis-harden-el9.yml b/test/assets/cis/cis-harden-el9.yml
new file mode 100644
index 0000000000..7c6f050b1e
--- /dev/null
+++ b/test/assets/cis/cis-harden-el9.yml
@@ -0,0 +1,13 @@
+---
+- name: Apply CIS Level 2 hardening
+  hosts: localhost
+  connection: local
+  become: true
+  roles:
+    - role: ansible-role-rhel9-cis
+      vars:
+        # MicroShift OVN networking requires IP forwarding
+        sysctl_net_ipv4_ip_forward: false
+        sysctl_net_ipv6_conf_all_forwarding: false
+        # CI requires passwordless sudo
+        sudo_remove_nopasswd: false
diff --git a/test/assets/cis/cis-requirements-el10.yml b/test/assets/cis/cis-requirements-el10.yml
new file mode 100644
index 0000000000..fd2088ff6c
--- /dev/null
+++ b/test/assets/cis/cis-requirements-el10.yml
@@ -0,0 +1,7 @@
+roles:
+  - name: ansible-role-rhel10-cis
+    src: https://github.com/RedHatOfficial/ansible-role-rhel10-cis
+    version: "0.1.80"
+collections:
+  - community.general
+  - ansible.posix
diff --git a/test/assets/cis/cis-requirements-el9.yml b/test/assets/cis/cis-requirements-el9.yml
new file mode 100644
index 0000000000..d7930ad2e0
--- /dev/null
+++ b/test/assets/cis/cis-requirements-el9.yml
@@ -0,0 +1,7 @@
+roles:
+  - name: ansible-role-rhel9-cis
+    src: https://github.com/RedHatOfficial/ansible-role-rhel9-cis
+    version: "0.1.80"
+collections:
+  - community.general
+  - ansible.posix
diff --git a/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh b/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh
new file mode 100644
index 0000000000..835e59f2dc
--- /dev/null
+++ b/test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh
@@ -0,0 +1,154 @@
+#!/bin/bash
+
+# Sourced from scenario.sh and uses functions defined there.
+
+# CIS hardening runs inside the Robot suite and takes ~20 minutes
+# shellcheck disable=SC2034  # used elsewhere
+TEST_EXECUTION_TIMEOUT=60m
+
+# The RPM-based image used to create the VM for this test does not
+# include MicroShift or greenboot, so tell the framework not to wait
+# for greenboot to finish when creating the VM.
+export SKIP_GREENBOOT=true
+
+configure_microshift_mirror() {
+    local -r repo=$1
+
+    if [[ -z "${repo}" ]] ; then
+        return
+    fi
+
+    if [[ ! "${repo}" =~ ^http ]]; then
+        return
+    fi
+
+    local -r tmp_file=$(mktemp)
+    tee "${tmp_file}" >/dev/null <<EOF
+[microshift-mirror-rpms]
+name=MicroShift Mirror
+baseurl=${repo}
+enabled=1
+gpgcheck=0
+skip_if_unavailable=0
+EOF
+    copy_file_to_vm host1 "${tmp_file}" "${tmp_file}"
+    run_command_on_vm host1 "sudo cp ${tmp_file} /etc/yum.repos.d/microshift-mirror-rpms.repo"
+    rm -f "${tmp_file}"
+}
+
+# On RHEL 10, rhocp and fast-datapath repos are not available via
+# subscription-manager. Create repo files pointing to the RHEL 9 CDN
+# using entitlement certificates as a workaround.
+configure_cdn_repo() {
+    local -r repo_id=$1
+    local -r repo_name=$2
+    local -r baseurl=$3
+
+    local -r cert=$(run_command_on_vm host1 "ls /etc/pki/entitlement/[0-9]*.pem | grep -v '\-key.pem' | head -n1")
+    local -r key=$(run_command_on_vm host1 "ls /etc/pki/entitlement/[0-9]*-key.pem | head -n1")
+    local -r tmp_file=$(mktemp)
+
+    tee "${tmp_file}" >/dev/null <<EOF
+[${repo_id}]
+name=${repo_name}
+baseurl=${baseurl}
+enabled=1
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+sslverify=1
+sslcacert=/etc/rhsm/ca/redhat-uep.pem
+sslclientcert=${cert}
+sslclientkey=${key}
+EOF
+    copy_file_to_vm host1 "${tmp_file}" "${tmp_file}"
+    run_command_on_vm host1 "sudo cp ${tmp_file} /etc/yum.repos.d/${repo_id}.repo"
+    rm -f "${tmp_file}"
+}
+
+configure_rhocp_repo() {
+    local -r rhocp=$1
+    local -r major=$2
+    local -r minor=$3
+    local -r arch=${4:-$(uname -m)}
+
+    if [[ -z "${rhocp}" ]] ; then
+        return
+    fi
+
+    if [[ "${rhocp}" =~ ^[0-9]{1,2}$ ]]; then
+        configure_cdn_repo \
+            "rhocp-${major}.${rhocp}" \
+            "Red Hat OpenShift ${major}.${rhocp} for RHEL 9" \
+            "https://cdn.redhat.com/content/dist/layered/rhel9/${arch}/rhocp/${major}.${rhocp}/os"
+    elif [[ "${rhocp}" =~ ^http ]]; then
+        local -r ocp_repo_name="rhocp-${major}.${minor}-for-rhel-9-mirrorbeta-rpms"
+        local -r tmp_file=$(mktemp)
+
+        tee "${tmp_file}" >/dev/null <<EOF
+[${ocp_repo_name}]
+name=Beta rhocp RPMs for RHEL 9
+baseurl=${rhocp}
+enabled=1
+gpgcheck=0
+skip_if_unavailable=0
+EOF
+        copy_file_to_vm host1 "${tmp_file}" "${tmp_file}"
+        run_command_on_vm host1 "sudo cp ${tmp_file} /etc/yum.repos.d/${ocp_repo_name}.repo"
+        rm -f "${tmp_file}"
+    fi
+}
+
+scenario_create_vms() {
+    prepare_kickstart host1 kickstart-liveimg.ks.template ""
+    launch_vm rhel102-installer
+
+    configure_vm_firewall host1
+    subscription_manager_register host1
+
+    # Configure repositories for MicroShift and its dependencies.
+    # MicroShift is NOT installed here — the Robot suite installs it
+    # after CIS hardening so the scan reveals what MicroShift changes.
+    local -r source_reponame=$(basename "${LOCAL_REPO}")
+    local -r source_repo_url="${WEB_SERVER_URL}/rpm-repos/${source_reponame}"
+    local -r arch=$(run_command_on_vm host1 "uname -m")
+
+    configure_rhocp_repo "${RHOCP_MINOR_Y}"       "${MAJOR_VERSION}" "${MINOR_VERSION}" "${arch}"
+    configure_rhocp_repo "${RHOCP_MINOR_Y_BETA}"  "${MAJOR_VERSION}" "${MINOR_VERSION}" "${arch}"
+    configure_rhocp_repo "${RHOCP_MINOR_Y1}"      "${PREVIOUS_MAJOR_VERSION}" "${PREVIOUS_MINOR_VERSION}" "${arch}"
+    configure_rhocp_repo "${RHOCP_MINOR_Y1_BETA}" "${PREVIOUS_MAJOR_VERSION}" "${PREVIOUS_MINOR_VERSION}" "${arch}"
+    configure_microshift_mirror "${PREVIOUS_RELEASE_REPO}"
+    run_command_on_vm host1 "sudo subscription-manager release --set 10.2"
+    configure_cdn_repo \
+        "fast-datapath" \
+        "Red Hat Fast Datapath for RHEL 9" \
+        "https://cdn.redhat.com/content/dist/layered/rhel9/${arch}/fast-datapath/os"
+
+    # Add the source RPM repo for locally-built MicroShift packages.
+    local -r tmp_file=$(mktemp)
+    tee "${tmp_file}" >/dev/null <<EOF
+[microshift-local]
+name=MicroShift Local
+baseurl=${source_repo_url}
+enabled=1
+gpgcheck=0
+skip_if_unavailable=0
+EOF
+    copy_file_to_vm host1 "${tmp_file}" "${tmp_file}"
+    run_command_on_vm host1 "sudo cp ${tmp_file} /etc/yum.repos.d/microshift-local.repo"
+    rm -f "${tmp_file}"
+
+}
+
+scenario_remove_vms() {
+    remove_vm host1
+}
+
+scenario_run_tests() {
+    # shellcheck disable=SC2034  # used elsewhere
+    TEST_RANDOMIZATION=none
+    run_tests host1 \
+        --variable "SCAP_DS_FILE:/usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml" \
+        --variable "CIS_REQUIREMENTS_FILE:cis-requirements-el10.yml" \
+        --variable "CIS_HARDEN_FILE:cis-harden-el10.yml" \
+        suites/cis/
+}
diff --git a/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh b/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh
new file mode 100644
index 0000000000..3d78f03843
--- /dev/null
+++ b/test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh
@@ -0,0 +1,112 @@
+#!/bin/bash
+
+# Sourced from scenario.sh and uses functions defined there.
+
+# CIS hardening runs inside the Robot suite and takes ~20 minutes
+# shellcheck disable=SC2034  # used elsewhere
+TEST_EXECUTION_TIMEOUT=60m
+
+# The RPM-based image used to create the VM for this test does not
+# include MicroShift or greenboot, so tell the framework not to wait
+# for greenboot to finish when creating the VM.
+export SKIP_GREENBOOT=true
+
+configure_microshift_mirror() {
+    local -r repo=$1
+
+    if [[ -z "${repo}" ]] ; then
+        return
+    fi
+
+    if [[ ! "${repo}" =~ ^http ]]; then
+        return
+    fi
+
+    local -r tmp_file=$(mktemp)
+    tee "${tmp_file}" >/dev/null <<EOF
+[microshift-mirror-rpms]
+name=MicroShift Mirror
+baseurl=${repo}
+enabled=1
+gpgcheck=0
+skip_if_unavailable=0
+EOF
+    copy_file_to_vm host1 "${tmp_file}" "${tmp_file}"
+    run_command_on_vm host1 "sudo cp ${tmp_file} /etc/yum.repos.d/microshift-mirror-rpms.repo"
+    rm -f "${tmp_file}"
+}
+
+configure_rhocp_repo() {
+    local -r rhocp=$1
+    local -r major=$2
+    local -r minor=$3
+
+    if [[ -z "${rhocp}" ]] ; then
+        return
+    fi
+
+    if [[ "${rhocp}" =~ ^[0-9]{1,2}$ ]]; then
+        run_command_on_vm host1 "sudo subscription-manager repos --enable rhocp-${major}.${rhocp}-for-rhel-9-\$(uname -m)-rpms"
+    elif [[ "${rhocp}" =~ ^http ]]; then
+        local -r ocp_repo_name="rhocp-${major}.${minor}-for-rhel-9-mirrorbeta-rpms"
+        local -r tmp_file=$(mktemp)
+
+        tee "${tmp_file}" >/dev/null <<EOF
+[${ocp_repo_name}]
+name=Beta rhocp RPMs for RHEL 9
+baseurl=${rhocp}
+enabled=1
+gpgcheck=0
+skip_if_unavailable=0
+EOF
+        copy_file_to_vm host1 "${tmp_file}" "${tmp_file}"
+        run_command_on_vm host1 "sudo cp ${tmp_file} /etc/yum.repos.d/${ocp_repo_name}.repo"
+        rm -f "${tmp_file}"
+    fi
+}
+
+scenario_create_vms() {
+    prepare_kickstart host1 kickstart-liveimg.ks.template ""
+    launch_vm rhel98-installer
+
+    configure_vm_firewall host1
+    subscription_manager_register host1
+
+    # Configure repositories for MicroShift and its dependencies.
+    # MicroShift is NOT installed here — the Robot suite installs it
+    # after CIS hardening so the scan reveals what MicroShift changes.
+    local -r source_reponame=$(basename "${LOCAL_REPO}")
+    local -r source_repo_url="${WEB_SERVER_URL}/rpm-repos/${source_reponame}"
+
+    configure_rhocp_repo "${RHOCP_MINOR_Y}"       "${MAJOR_VERSION}" "${MINOR_VERSION}"
+    configure_rhocp_repo "${RHOCP_MINOR_Y_BETA}"  "${MAJOR_VERSION}" "${MINOR_VERSION}"
+    configure_rhocp_repo "${RHOCP_MINOR_Y1}"      "${PREVIOUS_MAJOR_VERSION}" "${PREVIOUS_MINOR_VERSION}"
+    configure_rhocp_repo "${RHOCP_MINOR_Y1_BETA}" "${PREVIOUS_MAJOR_VERSION}" "${PREVIOUS_MINOR_VERSION}"
+    configure_microshift_mirror "${PREVIOUS_RELEASE_REPO}"
+    run_command_on_vm host1 "sudo subscription-manager release --set 9.8"
+    run_command_on_vm host1 "sudo subscription-manager repos --enable fast-datapath-for-rhel-9-\$(uname -m)-rpms"
+
+    local -r tmp_file=$(mktemp)
+    tee "${tmp_file}" >/dev/null <<EOF
+[microshift-local]
+name=MicroShift Local
+baseurl=${source_repo_url}
+enabled=1
+gpgcheck=0
+skip_if_unavailable=0
+EOF
+    copy_file_to_vm host1 "${tmp_file}" "${tmp_file}"
+    run_command_on_vm host1 "sudo cp ${tmp_file} /etc/yum.repos.d/microshift-local.repo"
+    rm -f "${tmp_file}"
+}
+
+scenario_remove_vms() {
+    remove_vm host1
+}
+
+scenario_run_tests() {
+    # shellcheck disable=SC2034  # used elsewhere
+    TEST_RANDOMIZATION=none
+    run_tests host1 \
+        suites/cis/
+}
diff --git a/test/suites/cis/validate-cis-lvl2.robot b/test/suites/cis/validate-cis-lvl2.robot
new file mode 100644
index 0000000000..5d1c294a74
--- /dev/null
+++ b/test/suites/cis/validate-cis-lvl2.robot
@@ -0,0 +1,223 @@
+*** Settings ***
+Documentation       Verify that MicroShift only introduces expected CIS Level 2
+...                 changes on a hardened RHEL system. Runs an OpenSCAP scan
+...                 before and after installing MicroShift and asserts that
+...                 every new failure belongs to a known set of rules inherent
+...                 to Kubernetes container networking.
+
+Resource            ../../resources/common.resource
+Resource            ../../resources/oc.resource
+Resource            ../../resources/ostree-health.resource
+Resource            ../../resources/microshift-host.resource
+Resource            ../../resources/microshift-process.resource
+Resource            ../../resources/microshift-network.resource
+
+Suite Setup         Setup
+Suite Teardown      Teardown
+
+Test Tags           slow
+
+
+*** Variables ***
+${USHIFT_HOST}                  ${EMPTY}
+${USHIFT_USER}                  ${EMPTY}
+${API_PORT}                     6443
+${OSCAP_BASELINE_FILE}          /tmp/cis-baseline-results.xml
+${OSCAP_POST_FILE}              /tmp/cis-post-results.xml
+${OSCAP_REPORT_FILE}            /tmp/cis-post-report.html
+${OSCAP_PROFILE}                xccdf_org.ssgproject.content_profile_cis
+${SCAP_DS_FILE}                 /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
+${CIS_REQUIREMENTS_FILE}        cis-requirements-el9.yml
+${CIS_HARDEN_FILE}              cis-harden-el9.yml
+
+# Rules that MicroShift is known to cause. Any new failure outside this
+# set means MicroShift introduced an unexpected CIS regression.
+@{KNOWN_MICROSHIFT_RULES}
+...                             sysctl_net_ipv4_ip_forward
+...                             sysctl_net_ipv6_conf_all_forwarding
+...                             sysctl_net_ipv4_conf_all_forwarding
+...                             sysctl_net_ipv4_conf_default_forwarding
+...                             sysctl_net_ipv6_conf_default_forwarding
+...                             file_permissions_ungroupowned
+...                             no_files_unowned_by_user
+...                             no_files_or_dirs_ungroupowned
+...                             no_files_or_dirs_unowned_by_user
+...                             dir_perms_world_writable_sticky_bits
+...                             file_permissions_unauthorized_world_writable
+...                             audit_rules_privileged_commands
+
+
+*** Test Cases ***
+MicroShift Only Introduces Expected CIS Changes
+    [Documentation]    Compare pre- and post-MicroShift OpenSCAP scans.
+    ...    Every new failure must be in the known set of MicroShift-caused rules.
+    ${baseline}=    Get Failing Rule IDs    ${OSCAP_BASELINE_FILE}
+    ${post}=    Get Failing Rule IDs    ${OSCAP_POST_FILE}
+    ${delta}=    Get New Failures    ${baseline}    ${post}
+    Log    Baseline failures: ${baseline}
+    Log    Post-install failures: ${post}
+    Log    New failures introduced by MicroShift: ${delta}
+    Should Only Contain Expected Rules    ${delta}
+
+All Pods Are Running After CIS Hardening
+    [Documentation]    Verify all MicroShift pods are running on the hardened system
+    All Pods Should Be Running
+
+Smoke Test With Route
+    [Documentation]    Deploy hello-microshift and expose via route to verify networking on hardened system
+    [Setup]    Setup Smoke Test
+    Wait Until Keyword Succeeds    10x    6s
+    ...    Access Hello MicroShift Success    ${HTTP_PORT}
+    [Teardown]    Teardown Smoke Test
+
+
+*** Keywords ***
+Setup
+    [Documentation]    Harden the system, run a baseline scan, install MicroShift,
+    ...    run a post-install scan, and prepare for functional tests.
+    Check Required Env Variables
+    Login MicroShift Host
+    Harden And Scan Baseline
+    Install And Enable MicroShift
+    Reboot And Reconnect
+    Configure Firewall After Hardening
+    Wait Until Greenboot Health Check Exited
+    Run CIS Scan    ${OSCAP_POST_FILE}    oscap_report=${OSCAP_REPORT_FILE}
+    Setup Kubeconfig
+
+Teardown
+    [Documentation]    Archive scan artifacts and close SSH
+    Run Keyword And Ignore Error
+    ...    Command Should Work    chmod 644 ${OSCAP_BASELINE_FILE} ${OSCAP_POST_FILE} ${OSCAP_REPORT_FILE}
+    Run Keyword And Ignore Error
+    ...    SSHLibrary.Get File    ${OSCAP_BASELINE_FILE}    ${OUTPUTDIR}/cis-baseline-results.xml
+    Run Keyword And Ignore Error
+    ...    SSHLibrary.Get File    ${OSCAP_POST_FILE}    ${OUTPUTDIR}/cis-post-results.xml
+    Run Keyword And Ignore Error
+    ...    SSHLibrary.Get File    ${OSCAP_REPORT_FILE}    ${OUTPUTDIR}/cis-post-report.html
+    Run Keyword And Ignore Error
+    ...    Logout MicroShift Host
+
+Harden And Scan Baseline
+    [Documentation]    Apply CIS hardening, reboot, and run the baseline scan.
+    Apply CIS Hardening
+    Reboot And Reconnect
+    Run CIS Scan    ${OSCAP_BASELINE_FILE}
+
+Apply CIS Hardening
+    [Documentation]    Install prerequisites, upload assets, and run the CIS hardening playbook
+    Command Should Work    dnf install -y openscap-scanner scap-security-guide ansible-core
+    Command Should Work    ansible-galaxy collection install 'community.general:<10.0.0' ansible.posix
+    SSHLibrary.Put File    ${CURDIR}/../../assets/cis/${CIS_REQUIREMENTS_FILE}    /tmp/cis-requirements.yml
+    SSHLibrary.Put File    ${CURDIR}/../../assets/cis/${CIS_HARDEN_FILE}    /tmp/cis-harden.yml
+    Command Should Work    ansible-galaxy role install -r /tmp/cis-requirements.yml
+    Run Hardening Playbook
+
+Reboot And Reconnect
+    [Documentation]    Reboot the host and wait for SSH to come back.
+    ...    Uses boot ID change detection only, without asserting the
+    ...    exact reboot count, because CIS hardening can trigger
+    ...    additional automatic reboots (crypto-policy changes, etc).
+    ${old_bootid}=    Get Current Boot Id
+    SSHLibrary.Start Command    reboot    sudo=True
+    Wait Until Keyword Succeeds    5m    10s
+    ...    System Should Be Rebooted    ${old_bootid}
+
+Install And Enable MicroShift
+    [Documentation]    Install MicroShift after CIS hardening so the scan
+    ...    reveals what MicroShift changes to CIS compliance.
+    ...    Uses --nogpgcheck because locally-built nightly RPMs are
+    ...    unsigned and CIS hardening enforces gpgcheck=1 globally.
+    Command Should Work    dnf install -y --nogpgcheck microshift
+    Command Should Work    systemctl enable microshift
+
+Run Hardening Playbook
+    [Documentation]    Run the CIS hardening playbook in the foreground over SSH.
+    ...    The playbook runs update-crypto-policies which restarts sshd,
+    ...    but existing SSH connections survive the service restart.
+    ${stdout}    ${stderr}    ${rc}=    Execute Command
+    ...    ansible-playbook -c local /tmp/cis-harden.yml
+    ...    sudo=True    return_rc=True    return_stdout=True    return_stderr=True    timeout=1800
+    Log    ${stdout}
+    Should Be Equal As Integers    ${rc}    0    msg=Hardening playbook failed (rc=${rc}): ${stderr}
+
+Configure Firewall After Hardening
+    [Documentation]    Open firewall ports required by MicroShift and the test suite (via SSH)
+    Command Should Work    firewall-cmd --permanent --zone=public --add-port=22/tcp
+    Configure Firewall Trusted Sources
+    Command Should Work    firewall-cmd --permanent --zone=public --add-port=80/tcp
+    Command Should Work    firewall-cmd --permanent --zone=public --add-port=443/tcp
+    Command Should Work    firewall-cmd --permanent --zone=public --add-port=5353/udp
+    Command Should Work    firewall-cmd --permanent --zone=public --add-port=${API_PORT}/tcp
+    Command Should Work    firewall-cmd --permanent --zone=public --add-port=30000-32767/tcp
+    Command Should Work    firewall-cmd --permanent --zone=public --add-port=30000-32767/udp
+    Command Should Work    firewall-cmd --reload
+
+Configure Firewall Trusted Sources
+    [Documentation]    Allow pod and service network traffic through the firewall
+    Command Should Work    firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16
+    Command Should Work    firewall-cmd --permanent --zone=trusted --add-source=169.254.169.1
+    Command Should Work    firewall-cmd --permanent --zone=trusted --add-source=fd01::/48
+
+Run CIS Scan
+    [Documentation]    Execute the OpenSCAP CIS Level 2 scan and save results.
+    [Arguments]    ${results_file}    ${oscap_report}=${EMPTY}
+    ${report_arg}=    Set Variable If    "${oscap_report}" != "${EMPTY}"
+    ...    --report ${oscap_report}    ${EMPTY}
+    ${stdout}    ${stderr}    ${rc}=    Execute Command
+    ...    oscap xccdf eval --profile ${OSCAP_PROFILE} --results ${results_file} ${report_arg} ${SCAP_DS_FILE}
+    ...    sudo=True
+    ...    return_rc=True
+    ...    return_stdout=True
+    ...    return_stderr=True
+    Should Be True    ${rc} == 0 or ${rc} == 2
+    ...    OpenSCAP scan failed with unexpected return code ${rc}: ${stderr}
+
+Get Failing Rule IDs
+    [Documentation]    Parse an OSCAP results XML file and return the list of
+    ...    failing rule IDs (short names without the SSG prefix).
+    [Arguments]    ${results_file}
+    Verify Remote File Exists With Sudo    ${results_file}
+    ${stdout}    ${stderr}    ${rc}=    Execute Command
+    ...    python3 -c "import xml.etree.ElementTree as ET; ns={'x':'http://checklists.nist.gov/xccdf/1.2'}; tree=ET.parse('${results_file}'); rules=[rr.get('idref').replace('xccdf_org.ssgproject.content_rule_','') for rr in tree.findall('.//x:rule-result',ns) if rr.find('x:result',ns).text=='fail']; print('\\n'.join(sorted(rules)))"
+    ...    sudo=True
+    ...    return_rc=True
+    ...    return_stdout=True
+    ...    return_stderr=True
+    Should Be Equal As Integers    ${rc}    0    msg=Failed to parse results: ${stderr}
+    @{rules}=    Split String    ${stdout.strip()}    \n
+    RETURN    ${rules}
+
+Get New Failures
+    [Documentation]    Return rule IDs that failed in post but not in baseline.
+    [Arguments]    ${baseline}    ${post}
+    ${delta}=    Evaluate    sorted(set($post) - set($baseline))
+    RETURN    ${delta}
+
+Should Only Contain Expected Rules
+    [Documentation]    Assert every rule in the delta is in the known MicroShift set.
+    ...    Logs each unexpected rule and fails if any exist.
+    [Arguments]    ${delta}
+    VAR    @{unexpected}=    @{EMPTY}
+    FOR    ${rule}    IN    @{delta}
+        ${is_known}=    Evaluate    $rule in $KNOWN_MICROSHIFT_RULES
+        IF    not ${is_known}    Append To List    ${unexpected}    ${rule}
+    END
+    Log    Known MicroShift rules in delta: ${delta}
+    IF    len($unexpected) > 0
+        Fail    MicroShift introduced unexpected CIS failures: ${unexpected}
+    END
+
+Setup Smoke Test
+    [Documentation]    Create hello-microshift pod and expose via route
+    ${ns}=    Create Unique Namespace
+    VAR    ${NAMESPACE}=    ${ns}    scope=TEST
+    Create Hello MicroShift Pod
+    Expose Hello MicroShift
+    Oc Expose    svc hello-microshift --hostname hello-microshift.cluster.local -n ${NAMESPACE}
+
+Teardown Smoke Test
+    [Documentation]    Clean up smoke test resources
+    Run Keyword And Ignore Error    Oc Delete    route/hello-microshift -n ${NAMESPACE}
+    Run Keyword And Ignore Error    Delete Hello MicroShift Pod And Service
+    Run Keyword And Ignore Error    Remove Namespace    ${NAMESPACE}