2026.1: remove references to RL9 from etc/kayobe/

[Alex-Welsh]

Removing RL9 references from the etc/kayobe/ directory
This should be everything except the ipa image config, which we're waiting on some fixes for right now. It'll be forward-ported from Epoxy once it merges there

Summary by CodeRabbit

• New Features

  • Added support for Rocky Linux 10-based deployments, images, repositories, and OFED configurations.
  • Updated default automation and deployment settings for the 2026.1 release.
  • Enabled Valkey and updated CI configurations to use OpenSearch 3.

• Configuration Updates

  • CIS hardening now targets Rocky Linux 10, RHEL 10, and Ubuntu 24.
  • Improved audit-template handling for hardening workflows.
  • Updated ARM compute settings for Rocky Linux 10.

• Removed

  • Retired Rocky Linux 9 repositories, hardening settings, images, and upgrade workflows.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4d46faab-1842-4cd6-96a5-6184bd62d631

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The configuration removes Rocky Linux 9-specific playbooks, repositories, hardening settings, image versions, and release variables, while updating automation, runtime, vulnerability detection, and package configuration for Rocky Linux 10 and the 2026.1 release.

Changes

Rocky Linux 10 transition

Layer / File(s)	Summary
Repository and package configuration etc/kayobe/dnf.yml, etc/kayobe/ofed.yml, etc/kayobe/kolla.yml, etc/kayobe/stackhpc.yml, etc/kayobe/environments/...	Repository, DOCA, Kolla, and Pulp version settings were narrowed to newer streams and Rocky Linux 10; Rocky Linux 9 repository variables were removed.
Host image and provisioning targets etc/kayobe/ansible/fixes/fix-grub-rl9.yml, etc/kayobe/ansible/maintenance/rocky-97-ofed-upgrade.yml, etc/kayobe/stackhpc-overcloud-dib.yml, etc/kayobe/pulp-host-image-versions.yml, etc/kayobe/environments/aio/automated-setup.sh	Rocky Linux 9 GRUB and upgrade workflows were removed, while image builds and DIB options now target Rocky Linux 10.
CIS hardening configuration etc/kayobe/ansible/maintenance/cis.yml, etc/kayobe/ansible/requirements.yml, etc/kayobe/**/cis-hardening/cis	RHEL 9 CIS role dependencies, execution paths, and variables were removed; RHEL 10 handling and audit template updates were configured.
Environment and runtime integration etc/kayobe/environments/ci-tenks/automated-deployment.sh, etc/kayobe/environments/aio/kolla/config/nova/nova-compute.conf, etc/kayobe/environments/ci-builder/stackhpc-ci.yml, etc/kayobe/inventory/group_vars/wazuh-manager/wazuh-manager	Defaults moved to release 2026.1, Valkey replaced Redis, libvirt settings target Rocky Linux 10, and vulnerability detector OS lists were updated.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• stackhpc/stackhpc-kayobe-config#2452: Updates related CIS hardening logic and RHEL 10 crypto-policy handling.
• stackhpc/stackhpc-kayobe-config#2457: Touches related Rocky Linux 9 image and DOCA versioning paths.
• stackhpc/stackhpc-kayobe-config#2466: Modifies the same Rocky Linux 10 DOCA kernel matrix entry.

Suggested reviewers: bbezak

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: removing Rocky Linux 9 references from etc/kayobe/ for the 2026.1 branch.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Fix failing CI checks

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 2026.1-config-purge-rl9

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@etc/kayobe/environments/ci-tenks/automated-deployment.sh`:
- Around line 13-14: Update the existing checkout handling in
automated-deployment.sh so reruns synchronize $HOME/src/kayobe-config with
KAYOBE_CONFIG_REF and $HOME/src/kayobe with KAYOBE_BRANCH, rather than skipping
fetch/checkout when directories already exist. Fetch the requested refs and
check them out, or fail fast if the existing clones cannot match the requested
refs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 628a279a-1512-4476-9795-d344321c4930

📥 Commits

Reviewing files that changed from the base of the PR and between b9da43f and e957ac9.

📒 Files selected for processing (23)

• etc/kayobe/ansible/fixes/fix-grub-rl9.yml
• etc/kayobe/ansible/maintenance/cis.yml
• etc/kayobe/ansible/maintenance/rocky-97-ofed-upgrade.yml
• etc/kayobe/ansible/requirements.yml
• etc/kayobe/dnf.yml
• etc/kayobe/environments/aio/automated-setup.sh
• etc/kayobe/environments/aio/globals.yml
• etc/kayobe/environments/aio/inventory/group_vars/cis-hardening/cis
• etc/kayobe/environments/aio/kolla/config/nova/nova-compute.conf
• etc/kayobe/environments/aio/release-train.yml
• etc/kayobe/environments/ci-builder/stackhpc-ci.yml
• etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis
• etc/kayobe/environments/ci-multinode/stackhpc-ci.yml
• etc/kayobe/environments/ci-tenks/automated-deployment.sh
• etc/kayobe/inventory/group_vars/cis-hardening/cis
• etc/kayobe/inventory/group_vars/controllers/cis
• etc/kayobe/inventory/group_vars/wazuh-manager/wazuh-manager
• etc/kayobe/kolla.yml
• etc/kayobe/ofed.yml
• etc/kayobe/pulp-host-image-versions.yml
• etc/kayobe/pulp-ipa-image-versions.yml
• etc/kayobe/stackhpc-overcloud-dib.yml
• etc/kayobe/stackhpc.yml

💤 Files with no reviewable changes (13)

• etc/kayobe/ansible/fixes/fix-grub-rl9.yml
• etc/kayobe/inventory/group_vars/controllers/cis
• etc/kayobe/ansible/maintenance/rocky-97-ofed-upgrade.yml
• etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis
• etc/kayobe/stackhpc.yml
• etc/kayobe/ansible/requirements.yml
• etc/kayobe/kolla.yml
• etc/kayobe/pulp-host-image-versions.yml
• etc/kayobe/environments/aio/inventory/group_vars/cis-hardening/cis
• etc/kayobe/ofed.yml
• etc/kayobe/inventory/group_vars/cis-hardening/cis
• etc/kayobe/environments/ci-builder/stackhpc-ci.yml
• etc/kayobe/environments/aio/release-train.yml

[priteau]

Aren't we going to have lots of merge conflicts once we merge this? Should we wait until we stop making so many changes to stackhpc/2025.1?

[Alex-Welsh]

Aren't we going to have lots of merge conflicts once we merge this? Should we wait until we stop making so many changes to stackhpc/2025.1?

I'd say we should make 2026.1 the new main branch and start pushing features to it rather than 2025.1 now

[dougszumski]

Do we not need these then?

Looks like they came via:
8df7484

[Alex-Welsh]

I believe these definitions were only for kolla image builds, and in Gazpacho we can do that centrally in repos.yaml