This message was deleted.

put selinux in its own profile class, make mode a class variable, set default for every node (like enforcing or permissive). now you can include this in your roles/hosts and then overwrite the class default in hiera with something like

profile::selinux::mode: disabled

.