Merge pull request #2468 from stackhpc/2026.1-config-purge-rl9

2026.1: remove references to RL9 from etc/kayobe/

Author: Alex-Welsh

etc/kayobe/ansible/fixes/fix-grub-rl9.yml

@@ -12,7 +12,7 @@
         that:
           - ssh_key_type != 'ed25519'
         fail_msg: FIPS policy does not currently support ed25519 SSH keys on RHEL family systems
-      when: ansible_facts.os_family == 'RedHat' and rhel9cis_crypto_policy == 'FIPS'
+      when: ansible_facts.os_family == 'RedHat' and rhel10cis_crypto_policy == 'FIPS'
 
     - name: Ensure the cron package is installed on ubuntu
       ansible.builtin.package:
@@ -47,11 +47,6 @@
   tags:
     - cis
   tasks:
-    - name: Run CIS hardening role (RHEL 9)
-      ansible.builtin.include_role:
-        name: ansible-lockdown.rhel9_cis
-      when: ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '9'
-
     - name: Run CIS hardening role (RHEL 10)
       ansible.builtin.include_role:
         name: ansible-lockdown.rhel10_cis

etc/kayobe/ansible/maintenance/cis.yml

@@ -16,9 +16,6 @@ roles:
   - name: ansible-lockdown.ubuntu24_cis
     src: https://github.com/ansible-lockdown/UBUNTU24-CIS
     version: 1.0.4
-  - name: ansible-lockdown.rhel9_cis
-    src: https://github.com/ansible-lockdown/RHEL9-CIS
-    version: v1.3.4
   - name: ansible-lockdown.rhel10_cis
     src: https://github.com/ansible-lockdown/RHEL10-CIS
     version: 1.0.2

etc/kayobe/ansible/maintenance/rocky-97-ofed-upgrade.yml

@@ -48,30 +48,9 @@ dnf_custom_repos: "{{ stackhpc_dnf_repos[os_release] | default({}) if stackhpc_r
 # This is done by default for hosts in the overcloud group via a group_vars
 # file.
 stackhpc_dnf_repos:
-  "9": "{{ dnf_custom_repos_el9 | combine(dnf_custom_repos_rocky_9) | combine(dnf_custom_repos_elrepo_9 if dnf_install_elrepo_9 | bool else {}) | combine(dnf_custom_repos_doca_rocky_9 if dnf_install_doca | bool else {}) }}"
   "10": "{{ dnf_custom_repos_el10 | combine(dnf_custom_repos_rocky_10) | combine(dnf_custom_repos_elrepo_10 if dnf_install_elrepo_10 | bool else {}) | combine(dnf_custom_repos_doca_rocky_10 if dnf_install_doca | bool else {}) }}"
 
 # DOCA repositories
-dnf_custom_repos_doca_rocky_9:
-  doca:
-    baseurl: "{{ stackhpc_repo_rhel9_doca_url }}"
-    description: "DOCA Online Repo {{ stackhpc_pulp_rocky_9_doca_version }} - RHEL $releasever"
-    enabled: "{{ dnf_enable_doca | bool | default(false) }}"
-    priority: -1
-    file: doca
-    gpgcheck: no
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-  doca-modules:
-    baseurl: "{{ stackhpc_repo_rhel9_doca_modules_url }}"
-    description: "OFED Kernel module repository for DOCA {{ stackhpc_pulp_rocky_9_doca_version }} - RHEL $releasever"
-    enabled: "{{ dnf_enable_doca_modules | bool | default(false) }}"
-    priority: -1
-    file: doca
-    gpgcheck: no
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-
 dnf_custom_repos_doca_rocky_10:
   doca:
     baseurl: "{{ stackhpc_repo_rhel10_doca_url }}"
@@ -92,27 +71,7 @@ dnf_custom_repos_doca_rocky_10:
     username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
     password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
 
-# Custom repositories shared between all RHEL 9/10 derivatives.
-dnf_custom_repos_el9:
-  epel:
-    baseurl: "{{ stackhpc_repo_epel_9_url }}"
-    description: "Extra Packages for Enterprise Linux $releasever - $basearch"
-    enabled: "{{ dnf_enable_epel | bool }}"
-    file: epel
-    gpgkey: "{{ dnf_epel_9_gpg_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-  docker:
-    baseurl: "{{ stackhpc_repo_centos_stream_9_docker_url }}"
-    description: "Package repository for installing docker"
-    enabled: "{{ dnf_enable_docker | bool }}"
-    file: docker
-    gpgkey: "{{ dnf_docker_gpg_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-
+# Custom repositories shared between all RHEL 10 derivatives.
 dnf_custom_repos_el10:
   epel:
     baseurl: "{{ stackhpc_repo_epel_10_url }}"
@@ -133,20 +92,7 @@ dnf_custom_repos_el10:
     username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
     password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
 
-# ELRepo 9/10
-dnf_custom_repos_elrepo_9:
-  elrepo:
-    baseurl: "{{ stackhpc_repo_elrepo_9_url }}"
-    description: "ELRepo.org Community Enterprise Linux Repository - el9"
-    enabled: "{{ dnf_enable_elrepo_9 | bool }}"
-    file: elrepo
-    gpgkey:
-      - "{{ dnf_elrepo_gpg_key_url }}"
-      - "{{ dnf_elrepo_gpg_v2_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-
+# ELRepo 10
 dnf_custom_repos_elrepo_10:
   elrepo:
     baseurl: "{{ stackhpc_repo_elrepo_10_url }}"
@@ -158,59 +104,7 @@ dnf_custom_repos_elrepo_10:
     username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
     password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
 
-# Rocky 9/10 specific repositories
-dnf_custom_repos_rocky_9:
-  appstream:
-    baseurl: "{{ stackhpc_repo_rocky_9_appstream_url }}"
-    description: "Rocky Linux $releasever - AppStream"
-    file: rocky
-    gpgkey: "{{ dnf_rocky_9_gpg_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-  baseos:
-    baseurl: "{{ stackhpc_repo_rocky_9_baseos_url }}"
-    description: "Rocky Linux $releasever - BaseOS"
-    file: rocky
-    gpgkey: "{{ dnf_rocky_9_gpg_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-  crb:
-    baseurl: "{{ stackhpc_repo_rocky_9_crb_url }}"
-    description: "Rocky Linux $releasever - CRB"
-    file: rocky
-    gpgkey: "{{ dnf_rocky_9_gpg_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-  extras:
-    baseurl: "{{ stackhpc_repo_rocky_9_extras_url }}"
-    description: "Rocky Linux $releasever - Extras"
-    file: rocky-extras
-    gpgkey: "{{ dnf_rocky_9_gpg_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-  security:
-    baseurl: "{{ stackhpc_repo_rocky_9_security_url }}"
-    description: "Rocky Linux $releasever - Security"
-    enabled: "{{ dnf_enable_rocky_security | bool }}"
-    file: rocky-security
-    gpgkey: "{{ dnf_rocky_9_gpg_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-  security-common:
-    baseurl: "{{ stackhpc_repo_rocky_9_sig_security_common_url }}"
-    description: "Rocky Linux $releasever - SIG Security Common"
-    file: Rocky-SIG-Security-Common
-    gpgkey: "{{ dnf_rocky_9_sig_security_gpg_key_url }}"
-    gpgcheck: yes
-    includepkgs: "openssh*"
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-
+# Rocky 10 specific repositories
 dnf_custom_repos_rocky_10:
   appstream:
     baseurl: "{{ stackhpc_repo_rocky_10_appstream_url }}"
@@ -259,16 +153,12 @@ dnf_docker_gpg_key_url: "https://download.docker.com/linux/centos/gpg"
 dnf_elrepo_gpg_key_url: "https://www.elrepo.org/RPM-GPG-KEY-elrepo.org"
 dnf_elrepo_gpg_v2_key_url: "https://www.elrepo.org/RPM-GPG-KEY-v2-elrepo.org"
 dnf_epel_10_gpg_key_url: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10"
-dnf_epel_9_gpg_key_url: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9"
 dnf_rocky_10_gpg_key_url: "https://dl.rockylinux.org/pub/rocky/RPM-GPG-KEY-Rocky-10"
-dnf_rocky_9_gpg_key_url: "https://dl.rockylinux.org/pub/rocky/RPM-GPG-KEY-Rocky-9"
-dnf_rocky_9_sig_security_gpg_key_url: "https://dl.rockylinux.org/pub/sig/9/security/x86_64/security-common/RPM-GPG-KEY-Rocky-SIG-Security"
 
 # Whether to enable EPEL repositories. This affects RedHat-based systems only.
 dnf_enable_epel: "{{ dnf_install_epel | bool }}"
 
-# Whether to enable the ELRepo repository. This affects RedHat-based, 9.x release systems only.
-dnf_enable_elrepo_9: "{{ dnf_install_elrepo_9 | bool }}"
+# Whether to enable the ELRepo repository.
 dnf_enable_elrepo_10: "{{ dnf_install_elrepo_10 | bool }}"
 
 # Whether to enable DOCA repositories. This affects RedHat-based systems only.
@@ -283,7 +173,6 @@ dnf_enable_doca_modules: "{{ dnf_install_doca | bool }}"
 
 # Whether to create a repo file for ELRepo. This affects RedHat-based
 # systems only.
-dnf_install_elrepo_9: false
 dnf_install_elrepo_10: false
 
 # Whether to enable docker dnf repo in stackhpc_dnf_repos

etc/kayobe/ansible/requirements.yml

@@ -217,7 +217,7 @@ run_tempest() {
     if ! sudo docker image inspect kayobe:latest > /dev/null 2>&1; then
         echo "Building Kayobe Automation image"
         sudo DOCKER_BUILDKIT=1 docker build \
-        --build-arg BASE_IMAGE=rockylinux/rockylinux:9 \
+        --build-arg BASE_IMAGE=rockylinux/rockylinux:10 \
         --build-arg USE_PYTHON_312=true \
         --file .automation/docker/kayobe/Dockerfile \
         --tag kayobe:latest \

etc/kayobe/dnf.yml

@@ -49,7 +49,7 @@
 # "rocky".
 os_distribution: "{{ lookup('pipe', '. /etc/os-release && echo $ID') | trim }}"
 
-# OS release. Valid options are "9" when os_distribution is "rocky", or
+# OS release. Valid options are "10" when os_distribution is "rocky", or
 # "noble" when os_distribution is "ubuntu".
 os_release: >-
           {{ (lookup('pipe', '. /etc/os-release && echo $VERSION_CODENAME') | trim) if os_distribution == 'ubuntu' else

etc/kayobe/environments/aio/automated-setup.sh

@@ -1,15 +1,4 @@
 ---
-##############################################################################
-# Rocky 9 CIS Hardening Configuration
-
-# NOTE: Using DEFAULT crypto policy in CI. FIPS breaks ed25519 SSH keys, and
-# FUTURE breaks wazuh agent repo metadata download.
-rhel9cis_crypto_policy: DEFAULT
-
-# Disable shell timeout for inactivity which can be disruptive to
-# development work.
-rhel9cis_rule_5_4_3_2: false
-
 ##############################################################################
 # Rocky 10 CIS Hardening Configuration
 

etc/kayobe/environments/aio/globals.yml

@@ -1,9 +1,5 @@
 {% if kolla_base_arch == 'aarch64' %}
-{% if kolla_base_distro_and_version == 'rocky-9' %}
-[libvirt]
-cpu_mode = custom
-cpu_model = max
-{% elif kolla_base_distro_and_version == 'rocky-10' %}
+{% if kolla_base_distro_and_version == 'rocky-10' %}
 [libvirt]
 cpu_mode = none
 {% endif %}