Bump repositories and rebuild OFED

[priteau]

No description provided.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f85a7887-2031-43a4-b4cc-739d20d023bd

📥 Commits

Reviewing files that changed from the base of the PR and between 7e08ed0 and 707d1ec.

📒 Files selected for processing (3)

• etc/kayobe/ofed.yml
• etc/kayobe/pulp-repo-versions.yml
• releasenotes/notes/repo-bump-20260728-6cba5f6d572ebbfb.yaml

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: stackhpc/check
• GitHub Check: Ansible 2.18 lint with Python 3.12

🔇 Additional comments (7)

etc/kayobe/ofed.yml (1)

22-23: LGTM!

etc/kayobe/pulp-repo-versions.yml (1)

5-6: LGTM!

Also applies to: 13-16, 23-24, 35-36, 39-40, 43-43, 45-45, 47-52, 55-58, 62-62, 85-93, 97-99, 161-169, 173-175, 182-184

releasenotes/notes/repo-bump-20260728-6cba5f6d572ebbfb.yaml (5)

1-3: LGTM!

---

6-7: LGTM!

---

8-11: 🔒 Security & Privacy

Verify the CVE-to-kernel attribution before publishing.

Red Hat’s current data still lists CVE-2026-63807 as affecting RHEL 9, while the data associated with kernel 5.14.0-687.30.1.el9_8 identifies CVE-2025-40026 but not CVE-2026-63807. Please confirm the Rocky erratum or package changelog contains this backport; otherwise remove that CVE from the release note. (access.redhat.com)

Source: MCP tools

---

12-15: LGTM!

---

4-5: 🎯 Functional Correctness

Keep the current dotted version strings. This note follows the existing Rocky release-note format, so the RPM-style 5.14.0-687.30.1.el9_8 / 6.12.0-211.39.1.el10_2 spelling is not needed here.

			> Likely an incorrect or invalid review comment.

---

📝 Walkthrough

Updated Pulp repository snapshots across Rocky, CentOS, RHEL and Ubuntu repositories, including Docker, Ceph, RabbitMQ and Grafana. Rebuilt OFED kernel modules for Rocky Linux 9.8 and 10.2, and added release notes covering kernel security fixes and Docker Engine 29.6.2 vulnerability updates.

Walkthrough

This change updates DOCA kernel module mappings, refreshes Pulp repository version timestamps across several distributions and services, and adds release notes for updated OFED modules, Rocky Linux kernel availability, and Docker Engine security fixes.

Changes

Repository version refresh

Layer / File(s)	Summary
OFED and DOCA module pins etc/kayobe/ofed.yml, etc/kayobe/pulp-repo-versions.yml, releasenotes/notes/repo-bump-*.yaml	DOCA kernel mappings for Rocky Linux 9.8 and 10.2 and corresponding RHEL module repository timestamps are updated; release notes record the rebuilt modules.
Distribution repository snapshots etc/kayobe/pulp-repo-versions.yml, releasenotes/notes/repo-bump-*.yaml	CentOS, Rocky Linux, Ubuntu, Docker, RabbitMQ, InfluxDB, Grafana, ELRepo, EPEL, and Cloud Archive repository timestamps are refreshed; security release notes are added.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• stackhpc/stackhpc-kayobe-config#2457: Updates the same OFED and Pulp repository version-pin sources.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[Alex-Welsh]

I have just thought that really, we should rebuild all our kolla containers if we're bumping all package repos as well so they stay in sync. We've skipped that step in the past though, it's not the end of the world

[priteau]

I have just thought that really, we should rebuild all our kolla containers if we're bumping all package repos as well so they stay in sync. We've skipped that step in the past though, it's not the end of the world

I think we can do the container image rebuild a bit less regularly, since it is more likely to introduce bugs. I will propose one for the next sync.