docs: Add CIS_HARDENING parameter to README

Add documentation for the CIS_HARDENING build parameter that enables
CIS Ubuntu 22.04 LTS Benchmark security controls during image build.
Note: Should be used for Palette appliance builds only.

Co-Authored-By: Warp <[email protected]>

Author: 2 people

README.md

@@ -236,8 +236,9 @@ cp .arg.template .arg
 | HTTPS_PROXY                 | URL of the HTTPS Proxy server to be used if needed (Optional)                                                                                                                                                                                                                                                                                  | string  |                            |
 | NO_PROXY                    | URLS that should be excluded from proxying (Optional)                                                                                                                                                                                                                                                                                          | string  |                            |
 | UPDATE_KERNEL               | Determines whether to upgrade the Kernel version to the latest from the upstream OS provider                                                                                                                                                                                                                                                   | boolean | `false`                    |
-| DISABLE_SELINUX             | Disable selinux in the operating system. Some applications (like Kubevirt) do not like selinux                                                                                                                                                                                                                                                 | boolean | `true`                     |
-| CLUSTERCONFIG               | Path of the cluster config                                                                                                                                                                                                                                                                                                                     | string  |                            |
+| DISABLE_SELINUX             | Disable selinux in the operating system. Some applications (like Kubevirt) do not like selinux                                                                                                                 | boolean | `true`                     |
+| CIS_HARDENING               | Enable CIS Benchmark hardening for the image. When set to `true`, applies CIS Ubuntu 22.04 LTS Benchmark security controls during the build. Only supported for Ubuntu 22.04. **Note: Should be used for Palette appliance builds only.**  | boolean | `false`                    |
+| CLUSTERCONFIG               | Path of the cluster config                                                                                                                                                                                                                     | string  |                            |
 | IS_UKI                      | Build UKI(Trusted boot) images                                                                                                                                                                                                                                                                                                                 | boolean | `false`                    |
 | UKI_BRING_YOUR_OWN_KEYS     | Bring your own public/private key pairs if this is set to true. Otherwise, CanvOS will generate the key pair.                                                                                                                                                                                                                                  | boolean | `false`                    |
 | INCLUDE_MS_SECUREBOOT_KEYS  | Include Microsoft 3rd Party UEFI CA certificate in generated keys                                                                                                                                                                                                                                                                              | boolean | `true`                     |