From b5a0e8339391bb6b283ad977a6a80f955aac502b Mon Sep 17 00:00:00 2001
From: Alex Welsh <alex@stackhpc.com>
Date: Mon, 27 Jul 2026 16:42:33 +0100
Subject: [PATCH 01/11] Remove RL9 config from ansible dir

---
 etc/kayobe/ansible/fixes/fix-grub-rl9.yml     |  22 ----
 etc/kayobe/ansible/maintenance/cis.yml        |   7 +-
 .../maintenance/rocky-97-ofed-upgrade.yml     | 107 ------------------
 etc/kayobe/ansible/requirements.yml           |   3 -
 .../post.d/10-fix-grub-rl9.yml                |   1 -
 5 files changed, 1 insertion(+), 139 deletions(-)
 delete mode 100644 etc/kayobe/ansible/fixes/fix-grub-rl9.yml
 delete mode 100644 etc/kayobe/ansible/maintenance/rocky-97-ofed-upgrade.yml
 delete mode 120000 etc/kayobe/hooks/overcloud-host-package-update/post.d/10-fix-grub-rl9.yml

diff --git a/etc/kayobe/ansible/fixes/fix-grub-rl9.yml b/etc/kayobe/ansible/fixes/fix-grub-rl9.yml
deleted file mode 100644
index 6d81f137d4..0000000000
--- a/etc/kayobe/ansible/fixes/fix-grub-rl9.yml
+++ /dev/null
@@ -1,22 +0,0 @@
----
-- name: Remove "--root-dev-only" from grub.cfg if OS is Rocky Linux 9
-  hosts: overcloud
-  become: true
-  gather_facts: true
-  tasks:
-    - name: Remove "--root-dev-only" from grub.cfg if OS is Rocky Linux 9
-      when:
-        - ansible_facts['distribution'] == 'Rocky'
-        - ansible_facts['distribution_major_version'] == '9'
-      block:
-        - name: Check that /boot/efi/EFI/rocky/grub.cfg exists
-          ansible.builtin.stat:
-            path: /boot/efi/EFI/rocky/grub.cfg
-          register: stat_result
-
-        - name: Remove "--root-dev-only" from /boot/efi/EFI/rocky/grub.cfg
-          ansible.builtin.replace:
-            path: /boot/efi/EFI/rocky/grub.cfg
-            regexp: --root-dev-only\s?
-            replace: ""
-          when: stat_result.stat.exists
diff --git a/etc/kayobe/ansible/maintenance/cis.yml b/etc/kayobe/ansible/maintenance/cis.yml
index c14f0c1185..02e667841a 100644
--- a/etc/kayobe/ansible/maintenance/cis.yml
+++ b/etc/kayobe/ansible/maintenance/cis.yml
@@ -12,7 +12,7 @@
         that:
           - ssh_key_type != 'ed25519'
         fail_msg: FIPS policy does not currently support ed25519 SSH keys on RHEL family systems
-      when: ansible_facts.os_family == 'RedHat' and rhel9cis_crypto_policy == 'FIPS'
+      when: ansible_facts.os_family == 'RedHat' and rhel10cis_crypto_policy == 'FIPS'
 
     - name: Ensure the cron package is installed on ubuntu
       ansible.builtin.package:
@@ -47,11 +47,6 @@
   tags:
     - cis
   tasks:
-    - name: Run CIS hardening role (RHEL 9)
-      ansible.builtin.include_role:
-        name: ansible-lockdown.rhel9_cis
-      when: ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '9'
-
     - name: Run CIS hardening role (RHEL 10)
       ansible.builtin.include_role:
         name: ansible-lockdown.rhel10_cis
diff --git a/etc/kayobe/ansible/maintenance/rocky-97-ofed-upgrade.yml b/etc/kayobe/ansible/maintenance/rocky-97-ofed-upgrade.yml
deleted file mode 100644
index 259ab8f29c..0000000000
--- a/etc/kayobe/ansible/maintenance/rocky-97-ofed-upgrade.yml
+++ /dev/null
@@ -1,107 +0,0 @@
----
-# This playbook performs the system upgrade from RockyLinux 9.6 to 9.7 on hosts
-# using doca ofed kernel modules and utilities.
-# It prevents the install of the dkms toolchain and dkms modules that would be
-# used instead or our precompiled modules if a direct `dnf upgrade` was run.
-#
-# It must be run after new package snapshots have been merged and
-# `pulp-repo-sync.yml` and `pulp-repo-publish.yml` have been run.
-# Also `kayobe overcloud host configure -t dnf` must have been run for the new
-# `doca.repo` to be present (the doca version is in the url) on the mlnx hosts.
-
-- name: Prepare upgrade from Rocky Linux 9.6 to 9.7
-  hosts: mlnx
-  serial: "{{ lookup('env', 'ANSIBLE_SERIAL') | default(1, true) }}"
-  gather_facts: true
-  tags: pre
-  vars:
-    # we don't build kernel modules for each version, eg 5.14.0-611.13.1 has been built,
-    # but not 5.14.0-611.20.1.
-    doca_kernel_arch: "{{ 'x86.64' if ansible_facts.architecture == 'x86_64' else ansible_facts.architecture }}"
-    doca_kernel_version: "{{ stackhpc_doca_kernel_version_matrix['9.7'] }}.{{ doca_kernel_arch }}"
-  tasks:
-    - name: Assert that hosts are running Rocky Linux 9.6
-      ansible.builtin.assert:
-        that:
-          - ansible_facts.distribution == 'Rocky'
-          - ansible_facts.distribution_version == '9.6'
-          - os_distribution == 'rocky'
-        fail_msg: >-
-          This playbook is only designed for Rocky Linux 9.6 hosts. Ensure
-          that you are limiting it to only run on Rocky Linux 9.6 hosts and
-          os_distribution is set to rocky. This can be bypassed by setting the
-          skip_rocky_96_version_check variable to true.
-      when: not skip_rocky_96_version_check | default(false) | bool
-
-    - name: Ensure doca kernel repo is up to date
-      ansible.builtin.dnf:
-        name: doca-kernel-repo
-        state: latest
-        update_cache: true
-      become: true
-
-    # This is required by mlnx-ofa_kernel, and comes from the doca repository.
-    # It is already present when doca-ofed is installed, but will be upgraded.
-    - name: Ensure mlnx-tools is installed
-      ansible.builtin.dnf:
-        name: mlnx-tools
-        state: latest
-        update_cache: true
-      become: true
-
-    - name: Ensure appropriate doca-kernel is installed
-      ansible.builtin.dnf:
-        name: "doca-kernel-{{ doca_kernel_version }}"
-        state: latest
-        disablerepo: doca
-      become: true
-
-    # doca-ofed 3.2 starts to depend on the dkms modules. It was not the case
-    # in doca-ofed 2.9.3.
-    - name: Ensure doca-ofed is not present (upgrading it brings dkms)
-      ansible.builtin.dnf:
-        name: doca-ofed
-        state: absent
-        autoremove: false
-      become: true
-
-    - name: Ensure latest doca-ofed-userspace instead of doca-ofed
-      ansible.builtin.dnf:
-        name: doca-ofed-userspace
-        state: latest
-      become: true
-
-    - name: Update all packages (this can take a long time)
-      ansible.builtin.dnf:
-        name: "*"
-        state: latest
-      become: true
-
-- name: Fix potential grub config preventing new kernel from being used
-  ansible.builtin.import_playbook: reset-bls-entries.yml
-  vars:
-    reset_bls_hosts: mlnx
-
-- name: Reboot to apply updates
-  ansible.builtin.import_playbook: reboot.yml
-  vars:
-    reboot_hosts: mlnx
-
-- name: Confirm the host is upgraded to Rocky Linux 9.7
-  hosts: mlnx
-  tags: post
-  tasks:
-    - name: Update distribution facts
-      ansible.builtin.setup:
-        filter: "{{ kayobe_ansible_setup_filter }}"
-        gather_subset: "{{ kayobe_ansible_setup_gather_subset }}"
-
-    # Can fail (eg in multinode) when there are bad entries in grub config
-    # Fixed by `kayobe playbook run ansible/maintenance/reset-bls-entries.yml`
-    # and manual reboot
-    - name: Assert that hosts are now using Rocky Linux 9.7
-      ansible.builtin.assert:
-        that:
-          - ansible_facts.distribution == 'Rocky'
-          - ansible_facts.distribution_version == '9.7'
-          - os_distribution == 'rocky'
diff --git a/etc/kayobe/ansible/requirements.yml b/etc/kayobe/ansible/requirements.yml
index 478987d135..c07fd36e9c 100644
--- a/etc/kayobe/ansible/requirements.yml
+++ b/etc/kayobe/ansible/requirements.yml
@@ -16,9 +16,6 @@ roles:
   - name: ansible-lockdown.ubuntu24_cis
     src: https://github.com/ansible-lockdown/UBUNTU24-CIS
     version: 1.0.4
-  - name: ansible-lockdown.rhel9_cis
-    src: https://github.com/ansible-lockdown/RHEL9-CIS
-    version: v1.3.4
   - name: ansible-lockdown.rhel10_cis
     src: https://github.com/ansible-lockdown/RHEL10-CIS
     version: 1.0.2
diff --git a/etc/kayobe/hooks/overcloud-host-package-update/post.d/10-fix-grub-rl9.yml b/etc/kayobe/hooks/overcloud-host-package-update/post.d/10-fix-grub-rl9.yml
deleted file mode 120000
index 7a1ed099d5..0000000000
--- a/etc/kayobe/hooks/overcloud-host-package-update/post.d/10-fix-grub-rl9.yml
+++ /dev/null
@@ -1 +0,0 @@
-../../../ansible/fixes/fix-grub-rl9.yml
\ No newline at end of file

From c1a677b4c7d510d5081416f233c3e4e8def6cf84 Mon Sep 17 00:00:00 2001
From: Alex Welsh <alex@stackhpc.com>
Date: Mon, 27 Jul 2026 17:05:01 +0100
Subject: [PATCH 02/11] Remove RL9 from inventory

---
 .../inventory/group_vars/cis-hardening/cis    | 72 -------------------
 .../inventory/group_vars/controllers/cis      |  4 --
 .../group_vars/wazuh-manager/wazuh-manager    |  4 +-
 3 files changed, 1 insertion(+), 79 deletions(-)
 delete mode 100644 etc/kayobe/inventory/group_vars/controllers/cis

diff --git a/etc/kayobe/inventory/group_vars/cis-hardening/cis b/etc/kayobe/inventory/group_vars/cis-hardening/cis
index 248795e3dc..2cc59a1632 100644
--- a/etc/kayobe/inventory/group_vars/cis-hardening/cis
+++ b/etc/kayobe/inventory/group_vars/cis-hardening/cis
@@ -5,78 +5,6 @@
 # Enable collecting auditd logs
 update_audit_template: true
 
-##############################################################################
-# Rocky 9 CIS Hardening Configuration
-
-# Allow IP forwarding
-rhel9cis_is_router: true
-
-# Skip enabling gpgcheck on all yum repos.
-# This conflicts with our configured doca repos, which need gpgcheck disabled.
-rhel9cis_rule_1_2_2: false
-
-# Skip configuration of chrony
-rhel9cis_rule_2_1_1: false
-rhel9cis_rule_2_1_2: false
-
-# Skip configuration of the firewall
-rhel9cis_firewall: None
-rhel9cis_rule_3_4_1_2: false
-
-# Don't configure selinux
-rhel9cis_selinux_disable: true
-
-# NOTE: FUTURE breaks wazuh agent repo metadata download
-rhel9cis_crypto_policy: FIPS
-
-# Skip package updates
-rhel9cis_rule_1_9: false
-
-# Disable requirement for password when using sudo
-rhel9cis_rule_5_3_4: false
-
-# Disable check for root password being set, we should be locking root passwords instead.
-# Please double-check yourself with: sudo passwd -S root
-rhel9cis_rule_5_6_6: false
-
-# Stop the CIS benchmark scanning all files on every filesystem since this
-# takes a long time. Related to the changing permissions block below. This
-# would normally warn you about violations, but we can use Wazuh to continually
-# monitor this.
-rhel9cis_rule_6_1_9: false
-rhel9cis_rule_6_1_10: false
-rhel9cis_rule_6_1_11: false
-rhel9cis_rule_6_1_12: false
-rhel9cis_rule_6_1_13: false
-rhel9cis_rule_6_1_14: false
-rhel9cis_rule_6_1_15: false
-
-# The following rules change permissions on all files on every mounted
-# filesystem.  We do not want to change /var/lib/docker permissions.
-rhel9cis_no_world_write_adjust: false
-
-# Prevent hardening from recursivley changing permissions on log files
-rhel9cis_rule_4_2_3: false
-
-# Configure log rotation to prevent audit logs from filling the disk
-rhel9cis_auditd:
-  space_left_action: syslog
-  action_mail_acct: root
-  admin_space_left_action: syslog
-  max_log_file: 10
-  max_log_file_action: rotate
-
-# Max size of audit logs (MB)
-rhel9cis_max_log_file_size: 1024
-
-# Disable setting of boatloader password. This requires setting the variable
-# `rhel9cis_bootloader_password_hash`
-rhel9cis_set_boot_pass: false
-
-# NOTICE: rule disabled otherwise rule will prevent access to accounts
-# as it will expire passwords older than one year.
-rhel9cis_rule_5_6_1_1: false
-
 ##############################################################################
 # Rocky 10 CIS Hardening Configuration
 
diff --git a/etc/kayobe/inventory/group_vars/controllers/cis b/etc/kayobe/inventory/group_vars/controllers/cis
deleted file mode 100644
index 354a5353f1..0000000000
--- a/etc/kayobe/inventory/group_vars/controllers/cis
+++ /dev/null
@@ -1,4 +0,0 @@
----
-
-rhel8cis_is_router: true
-
diff --git a/etc/kayobe/inventory/group_vars/wazuh-manager/wazuh-manager b/etc/kayobe/inventory/group_vars/wazuh-manager/wazuh-manager
index 5d95f6d3b7..ec4eeb8a54 100644
--- a/etc/kayobe/inventory/group_vars/wazuh-manager/wazuh-manager
+++ b/etc/kayobe/inventory/group_vars/wazuh-manager/wazuh-manager
@@ -130,14 +130,12 @@ wazuh_manager_vulnerability_detector:
   providers:
     - enabled: 'yes'
       os:
-        - 'jammy'
         - 'noble'
       update_interval: '1h'
       name: '"canonical"'
     - enabled: 'yes'
       os:
-        - '8'
-        - '9'
+        - '10'
       update_interval: '1h'
       name: '"redhat"'
     - enabled: 'yes'

From 0183bc68ea90475d332fc04e5c6871702a31dce3 Mon Sep 17 00:00:00 2001
From: Alex Welsh <alex@stackhpc.com>
Date: Mon, 27 Jul 2026 17:06:32 +0100
Subject: [PATCH 03/11] Remove RL9 from dnf.yml

---
 etc/kayobe/dnf.yml | 119 ++-------------------------------------------
 1 file changed, 4 insertions(+), 115 deletions(-)

diff --git a/etc/kayobe/dnf.yml b/etc/kayobe/dnf.yml
index 789ba3cc44..bcb19c8c77 100644
--- a/etc/kayobe/dnf.yml
+++ b/etc/kayobe/dnf.yml
@@ -48,30 +48,9 @@ dnf_custom_repos: "{{ stackhpc_dnf_repos[os_release] | default({}) if stackhpc_r
 # This is done by default for hosts in the overcloud group via a group_vars
 # file.
 stackhpc_dnf_repos:
-  "9": "{{ dnf_custom_repos_el9 | combine(dnf_custom_repos_rocky_9) | combine(dnf_custom_repos_elrepo_9 if dnf_install_elrepo_9 | bool else {}) | combine(dnf_custom_repos_doca_rocky_9 if dnf_install_doca | bool else {}) }}"
   "10": "{{ dnf_custom_repos_el10 | combine(dnf_custom_repos_rocky_10) | combine(dnf_custom_repos_elrepo_10 if dnf_install_elrepo_10 | bool else {}) | combine(dnf_custom_repos_doca_rocky_10 if dnf_install_doca | bool else {}) }}"
 
 # DOCA repositories
-dnf_custom_repos_doca_rocky_9:
-  doca:
-    baseurl: "{{ stackhpc_repo_rhel9_doca_url }}"
-    description: "DOCA Online Repo {{ stackhpc_pulp_rocky_9_doca_version }} - RHEL $releasever"
-    enabled: "{{ dnf_enable_doca | bool | default(false) }}"
-    priority: -1
-    file: doca
-    gpgcheck: no
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-  doca-modules:
-    baseurl: "{{ stackhpc_repo_rhel9_doca_modules_url }}"
-    description: "OFED Kernel module repository for DOCA {{ stackhpc_pulp_rocky_9_doca_version }} - RHEL $releasever"
-    enabled: "{{ dnf_enable_doca_modules | bool | default(false) }}"
-    priority: -1
-    file: doca
-    gpgcheck: no
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-
 dnf_custom_repos_doca_rocky_10:
   doca:
     baseurl: "{{ stackhpc_repo_rhel10_doca_url }}"
@@ -92,27 +71,7 @@ dnf_custom_repos_doca_rocky_10:
     username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
     password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
 
-# Custom repositories shared between all RHEL 9/10 derivatives.
-dnf_custom_repos_el9:
-  epel:
-    baseurl: "{{ stackhpc_repo_epel_9_url }}"
-    description: "Extra Packages for Enterprise Linux $releasever - $basearch"
-    enabled: "{{ dnf_enable_epel | bool }}"
-    file: epel
-    gpgkey: "{{ dnf_epel_9_gpg_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-  docker:
-    baseurl: "{{ stackhpc_repo_centos_stream_9_docker_url }}"
-    description: "Package repository for installing docker"
-    enabled: "{{ dnf_enable_docker | bool }}"
-    file: docker
-    gpgkey: "{{ dnf_docker_gpg_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-
+# Custom repositories shared between all RHEL 10 derivatives.
 dnf_custom_repos_el10:
   epel:
     baseurl: "{{ stackhpc_repo_epel_10_url }}"
@@ -133,20 +92,7 @@ dnf_custom_repos_el10:
     username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
     password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
 
-# ELRepo 9/10
-dnf_custom_repos_elrepo_9:
-  elrepo:
-    baseurl: "{{ stackhpc_repo_elrepo_9_url }}"
-    description: "ELRepo.org Community Enterprise Linux Repository - el9"
-    enabled: "{{ dnf_enable_elrepo_9 | bool }}"
-    file: elrepo
-    gpgkey:
-      - "{{ dnf_elrepo_gpg_key_url }}"
-      - "{{ dnf_elrepo_gpg_v2_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-
+# ELRepo 10
 dnf_custom_repos_elrepo_10:
   elrepo:
     baseurl: "{{ stackhpc_repo_elrepo_10_url }}"
@@ -158,59 +104,7 @@ dnf_custom_repos_elrepo_10:
     username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
     password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
 
-# Rocky 9/10 specific repositories
-dnf_custom_repos_rocky_9:
-  appstream:
-    baseurl: "{{ stackhpc_repo_rocky_9_appstream_url }}"
-    description: "Rocky Linux $releasever - AppStream"
-    file: rocky
-    gpgkey: "{{ dnf_rocky_9_gpg_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-  baseos:
-    baseurl: "{{ stackhpc_repo_rocky_9_baseos_url }}"
-    description: "Rocky Linux $releasever - BaseOS"
-    file: rocky
-    gpgkey: "{{ dnf_rocky_9_gpg_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-  crb:
-    baseurl: "{{ stackhpc_repo_rocky_9_crb_url }}"
-    description: "Rocky Linux $releasever - CRB"
-    file: rocky
-    gpgkey: "{{ dnf_rocky_9_gpg_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-  extras:
-    baseurl: "{{ stackhpc_repo_rocky_9_extras_url }}"
-    description: "Rocky Linux $releasever - Extras"
-    file: rocky-extras
-    gpgkey: "{{ dnf_rocky_9_gpg_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-  security:
-    baseurl: "{{ stackhpc_repo_rocky_9_security_url }}"
-    description: "Rocky Linux $releasever - Security"
-    enabled: "{{ dnf_enable_rocky_security | bool }}"
-    file: rocky-security
-    gpgkey: "{{ dnf_rocky_9_gpg_key_url }}"
-    gpgcheck: yes
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-  security-common:
-    baseurl: "{{ stackhpc_repo_rocky_9_sig_security_common_url }}"
-    description: "Rocky Linux $releasever - SIG Security Common"
-    file: Rocky-SIG-Security-Common
-    gpgkey: "{{ dnf_rocky_9_sig_security_gpg_key_url }}"
-    gpgcheck: yes
-    includepkgs: "openssh*"
-    username: "{{ stackhpc_repo_mirror_username | default(omit, true) }}"
-    password: "{{ stackhpc_repo_mirror_password | default(omit, true) }}"
-
+# Rocky 10 specific repositories
 dnf_custom_repos_rocky_10:
   appstream:
     baseurl: "{{ stackhpc_repo_rocky_10_appstream_url }}"
@@ -259,16 +153,12 @@ dnf_docker_gpg_key_url: "https://download.docker.com/linux/centos/gpg"
 dnf_elrepo_gpg_key_url: "https://www.elrepo.org/RPM-GPG-KEY-elrepo.org"
 dnf_elrepo_gpg_v2_key_url: "https://www.elrepo.org/RPM-GPG-KEY-v2-elrepo.org"
 dnf_epel_10_gpg_key_url: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10"
-dnf_epel_9_gpg_key_url: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9"
 dnf_rocky_10_gpg_key_url: "https://dl.rockylinux.org/pub/rocky/RPM-GPG-KEY-Rocky-10"
-dnf_rocky_9_gpg_key_url: "https://dl.rockylinux.org/pub/rocky/RPM-GPG-KEY-Rocky-9"
-dnf_rocky_9_sig_security_gpg_key_url: "https://dl.rockylinux.org/pub/sig/9/security/x86_64/security-common/RPM-GPG-KEY-Rocky-SIG-Security"
 
 # Whether to enable EPEL repositories. This affects RedHat-based systems only.
 dnf_enable_epel: "{{ dnf_install_epel | bool }}"
 
-# Whether to enable the ELRepo repository. This affects RedHat-based, 9.x release systems only.
-dnf_enable_elrepo_9: "{{ dnf_install_elrepo_9 | bool }}"
+# Whether to enable the ELRepo repository.
 dnf_enable_elrepo_10: "{{ dnf_install_elrepo_10 | bool }}"
 
 # Whether to enable DOCA repositories. This affects RedHat-based systems only.
@@ -283,7 +173,6 @@ dnf_enable_doca_modules: "{{ dnf_install_doca | bool }}"
 
 # Whether to create a repo file for ELRepo. This affects RedHat-based
 # systems only.
-dnf_install_elrepo_9: false
 dnf_install_elrepo_10: false
 
 # Whether to enable docker dnf repo in stackhpc_dnf_repos

From a830c5f79412c39d0ae0c406a19444fc218a5510 Mon Sep 17 00:00:00 2001
From: Alex Welsh <alex@stackhpc.com>
Date: Tue, 28 Jul 2026 15:13:40 +0100
Subject: [PATCH 04/11] Remove RL9 config from kolla.yml

---
 etc/kayobe/kolla.yml | 104 -------------------------------------------
 1 file changed, 104 deletions(-)

diff --git a/etc/kayobe/kolla.yml b/etc/kayobe/kolla.yml
index 26ab48090b..af87103ade 100644
--- a/etc/kayobe/kolla.yml
+++ b/etc/kayobe/kolla.yml
@@ -173,110 +173,6 @@ kolla_sources:
 ###############################################################################
 # Kolla image build configuration.
 
-# Repositories for Rocky Linux 10
-stackhpc_rocky_10_repos:
-  - url: "{{ stackhpc_repo_rocky_10_baseos_url }}"
-    file: "rocky.repo"
-    tag: "baseos"
-  - url: "{{ stackhpc_repo_rocky_10_appstream_url }}"
-    file: "rocky.repo"
-    tag: "appstream"
-  - url: "{{ stackhpc_repo_rocky_10_extras_url }}"
-    file: "rocky-extras.repo"
-    tag: "extras"
-
-# NOTE(owenjones): Whether to feed in the .repo file needed for previous LTS
-# versions of OVN/OVS - for now always include this in Rocky 10,
-# when we switch over to newer LTS versions this might need some more conditions
-stackhpc_enable_ovn_lts_repo: "{{ kolla_base_distro_and_version == 'rocky-10' }}"
-
-# Additional repositories for Rocky Linux 10
-stackhpc_rocky_10_additional_repos:
-  - url: "{{ stackhpc_repo_centos_stream_10_nfv_openvswitch_url }}"
-    file: "CentOS-NFV-OpenvSwitch.repo"
-    tag: "centos-nfv-openvswitch"
-  - url: "{{ stackhpc_repo_rocky_10_crb_url }}"
-    file: "rocky.repo"
-    tag: "crb"
-  - url: "{{ stackhpc_repo_rocky_10_highavailability_url }}"
-    file: "rocky-addons.repo"
-    tag: "highavailability"
-
-# List of third-party repositories for Rocky Linux 10
-stackhpc_rocky_10_third_party_repos:
-  - url: "{{ stackhpc_repo_grafana_url }}"
-    file: "grafana.repo"
-    tag: "grafana"
-  - url: "{{ stackhpc_repo_rhel_10_fluent_6_url }}"
-    file: "td.repo"
-    tag: "treasuredata"
-  - url: "{{ stackhpc_repo_rhel_10_mariadb_10_11_url }}"
-    file: "mariadb.repo"
-    tag: "mariadb"
-  - url: "{{ stackhpc_repo_rhel_9_influxdb_url }}"
-    file: "influxdb.repo"
-    tag: "influxdb"
-  - url: "{{ stackhpc_repo_centos_stream_10_storage_ceph_squid_url }}"
-    file: "CentOS-Ceph-Squid.repo"
-    tag: "centos-ceph-squid"
-  - url: "{{ stackhpc_repo_rhel9_rabbitmq_erlang_url }}"
-    file: "rabbitmq_rabbitmq-erlang.repo"
-    tag: "rabbitmq_rabbitmq-erlang"
-  - url: "{{ stackhpc_repo_rhel9_rabbitmq_erlang_27_url }}"
-    file: "copr-rabbitmq-erlang-27.repo"
-    tag: "copr-rabbitmq-erlang-27"
-  - url: "{{ stackhpc_repo_rhel9_rabbitmq_server_url }}"
-    file: "rabbitmq_rabbitmq-server.repo"
-    tag: "rabbitmq_rabbitmq-server"
-  - url: "{{ stackhpc_repo_opensearch_3_x_yum_url }}"
-    file: "opensearch.repo"
-    tag: "opensearch-3.x"
-  - url: "{{ stackhpc_repo_opensearch_dashboards_3_x_yum_url }}"
-    file: "opensearch.repo"
-    tag: "opensearch-dashboards-3.x"
-  - url: "{{ stackhpc_repo_almalinux_10_proxysql_3_0_url }}"
-    file: "proxysql.repo"
-    tag: "proxysql"
-
-# List of EPEL 10
-stackhpc_epel_10_repos:
-  - url: "{{ stackhpc_repo_epel_10_url }}"
-    file: "epel.repo"
-    tag: "epel"
-
-base_centos_repo_overrides_post_yum_list: >-
-  {% if kolla_base_distro_and_version == 'rocky-9' -%}
-    {{ stackhpc_rocky_9_repos + stackhpc_epel_9_repos + stackhpc_rocky_9_additional_repos + stackhpc_rocky_9_third_party_repos }}
-  {%- elif kolla_base_distro_and_version == 'rocky-10' -%}
-    {{ stackhpc_rocky_10_repos + stackhpc_epel_10_repos + stackhpc_rocky_10_additional_repos + stackhpc_rocky_10_third_party_repos }}
-  {%- else -%}
-    []
-  {%- endif %}
-
-stackhpc_yum_repos: "{{ stackhpc_rocky_9_repos if kolla_base_distro_and_version == 'rocky-9' else stackhpc_rocky_10_repos if kolla_base_distro_and_version == 'rocky-10' else [] }}"
-
-# Apt sources.list entry prefix.
-# If using an authenticating Pulp proxy we need to trust the repository because
-# the certificate provided by the upstream repo will not match the proxy's IP.
-stackhpc_ubuntu_repo_prefix: "deb {% if stackhpc_repo_mirror_auth_proxy_enabled | bool %}[trusted=yes] {% endif %}"
-
-# List of base repositories for Ubuntu Noble.
-stackhpc_ubuntu_noble_base_repos:
-  - "{{ stackhpc_ubuntu_repo_prefix }}{{ stackhpc_repo_ubuntu_noble_url }} noble main universe"
-  - "{{ stackhpc_ubuntu_repo_prefix }}{{ stackhpc_repo_ubuntu_noble_url }} noble-updates main universe"
-  - "{{ stackhpc_ubuntu_repo_prefix }}{{ stackhpc_repo_ubuntu_noble_url }} noble-backports main universe"
-  - "{{ stackhpc_ubuntu_repo_prefix }}{{ stackhpc_repo_ubuntu_noble_security_url }} noble-security main universe"
-
-# List of UCA repositories for Ubuntu Noble.
-stackhpc_ubuntu_noble_uca_repos:
-  - "{{ stackhpc_ubuntu_repo_prefix }}{{ stackhpc_repo_ubuntu_cloud_archive_url }} noble-updates/{{ openstack_release_codename }} main"
-
-# List of repositories for Ubuntu Noble.
-stackhpc_ubuntu_noble_repos: "{{ stackhpc_ubuntu_noble_base_repos + stackhpc_ubuntu_noble_uca_repos }}"
-
-# Whether to revert to the upstream mirrors in built Kolla container images.
-stackhpc_kolla_clean_up_repo_mirrors: true
-
 # Dict mapping Jinja2 block names in kolla's Docker images to their contents.
 kolla_build_blocks:
   # TODO(mnasiadka): Rework to use in ubuntu base_header

From 91c7fa6b6f8d8937e1e8baa2b9f2d9e12ce972a9 Mon Sep 17 00:00:00 2001
From: Alex Welsh <alex@stackhpc.com>
Date: Tue, 28 Jul 2026 15:44:27 +0100
Subject: [PATCH 05/11] Remove RL9 ofed definitions

---
 etc/kayobe/ofed.yml | 23 +----------------------
 1 file changed, 1 insertion(+), 22 deletions(-)

diff --git a/etc/kayobe/ofed.yml b/etc/kayobe/ofed.yml
index 057c4797d8..99489ec762 100644
--- a/etc/kayobe/ofed.yml
+++ b/etc/kayobe/ofed.yml
@@ -4,23 +4,15 @@
 ###############################################################################
 # DOCA host version
 stackhpc_pulp_doca_version_matrix:
-    "9.6": '2.9.3'
-    "9.7": '3.2.2'
-    "9.8": '3.2.3'
     "10.2": '3.2.3'
 
-doca_rocky_9_release: 9.{{ stackhpc_pulp_repo_rocky_9_minor_version | string }}
 doca_rocky_10_release: 10.{{stackhpc_pulp_repo_rocky_10_minor_version | string }}
 
-stackhpc_pulp_rocky_9_doca_version: "{{ stackhpc_pulp_doca_version_matrix[doca_rocky_9_release] | default('2.9.3') }}"
 stackhpc_pulp_rocky_10_doca_version: "{{ stackhpc_pulp_doca_version_matrix[doca_rocky_10_release] | default('3.2.2') }}"
 
 # Available and tested versions of the pre-compiled doca-ofed kernel modules
 stackhpc_doca_kernel_version_matrix:
-    "9.6": 5.14.0.570.21.1.el9.6
-    "9.7": 5.14.0.611.55.1.el9.7
-    "9.8": 5.14.0.687.30.1.el9.8
-    "10.2": 6.12.0.211.39.1.el10.2
+    "10.2": 6.12.0.211.33.1.el10.2
 
 ###############################################################################
 # Pulp configuration for DOCA OFED
@@ -28,14 +20,6 @@ stackhpc_doca_kernel_version_matrix:
 # Whether to sync OFED repositories into the local Pulp service
 stackhpc_pulp_sync_ofed: "{{ groups['mlnx'] | length > 0 }}"
 
-# DOCA Snapshot lookup vars
-doca_rocky_9_minor_dot: "{% if stackhpc_pulp_rocky_9_doca_version is version('3.2.0', '>=') %}9{% else %}{{ doca_rocky_9_release }}{% endif %}"
-# eg stackhpc_pulp_repo_doca_2_9_3_rhel9_6_version or stackhpc_pulp_repo_doca_3_2_2_rhel9_version
-doca_rocky_9_version_lookup_var: "stackhpc_pulp_repo_doca_{{ stackhpc_pulp_rocky_9_doca_version | replace('.', '_') }}_rhel{{ doca_rocky_9_minor_dot | replace('.', '_') }}_version"
-doca_rocky_9_aarch64_version_lookup_var: "stackhpc_pulp_repo_doca_{{ stackhpc_pulp_rocky_9_doca_version | replace('.', '_') }}_rhel{{ doca_rocky_9_minor_dot | replace('.', '_') }}_aarch64_version"
-doca_rocky_9_modules_version_lookup_var: "stackhpc_pulp_repo_doca_{{ stackhpc_pulp_rocky_9_doca_version | replace('.', '_') }}_rhel9_{{ stackhpc_pulp_repo_rocky_9_minor_version }}_modules_version"
-doca_rocky_9_modules_aarch64_version_lookup_var: "stackhpc_pulp_repo_doca_{{ stackhpc_pulp_rocky_9_doca_version | replace('.', '_') }}_rhel9_{{ stackhpc_pulp_repo_rocky_9_minor_version }}_modules_aarch64_version"
-
 doca_rocky_10_version_lookup_var: "stackhpc_pulp_repo_doca_{{ stackhpc_pulp_rocky_10_doca_version | replace('.', '_') }}_rhel10_x86_64_version"
 doca_rocky_10_aarch64_version_lookup_var: "stackhpc_pulp_repo_doca_{{ stackhpc_pulp_rocky_10_doca_version | replace('.', '_') }}_rhel10_aarch64_version"
 doca_rocky_10_modules_version_lookup_var: "stackhpc_pulp_repo_doca_{{ stackhpc_pulp_rocky_10_doca_version | replace('.', '_') }}_rhel10_{{ stackhpc_pulp_repo_rocky_10_minor_version }}_modules_version"
@@ -43,11 +27,6 @@ doca_rocky_10_modules_aarch64_version_lookup_var: "stackhpc_pulp_repo_doca_{{ st
 
 # DOCA Snapshot versions. The defaults use the appropriate version from
 # pulp-repo-versions.yml
-stackhpc_pulp_repo_rhel9_doca_version: "{{ lookup('vars', doca_rocky_9_version_lookup_var) }}"
-stackhpc_pulp_repo_rhel9_doca_aarch64_version: "{{ lookup('vars', doca_rocky_9_aarch64_version_lookup_var, default=stackhpc_pulp_repo_rhel9_doca_version) }}"
-stackhpc_pulp_repo_rhel9_doca_modules_version: "{{ lookup('vars', doca_rocky_9_modules_version_lookup_var) }}"
-stackhpc_pulp_repo_rhel9_doca_modules_aarch64_version: "{{ lookup('vars', doca_rocky_9_modules_aarch64_version_lookup_var) }}"
-
 stackhpc_pulp_repo_rhel10_doca_version: "{{ lookup('vars', doca_rocky_10_version_lookup_var) }}"
 stackhpc_pulp_repo_rhel10_doca_aarch64_version: "{{ lookup('vars', doca_rocky_10_aarch64_version_lookup_var, default=stackhpc_pulp_repo_rhel10_doca_version) }}"
 stackhpc_pulp_repo_rhel10_doca_modules_version: "{{ lookup('vars', doca_rocky_10_modules_version_lookup_var) }}"

From 52bb78758981372a02737d8481c84268139ee5e2 Mon Sep 17 00:00:00 2001
From: Alex Welsh <alex@stackhpc.com>
Date: Tue, 28 Jul 2026 16:13:02 +0100
Subject: [PATCH 06/11] Remove ipa/host image related RL9 content

---
 etc/kayobe/pulp-host-image-versions.yml |  2 --
 etc/kayobe/pulp-ipa-image-versions.yml  |  1 +
 etc/kayobe/stackhpc-overcloud-dib.yml   | 10 +++-------
 3 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/etc/kayobe/pulp-host-image-versions.yml b/etc/kayobe/pulp-host-image-versions.yml
index 624fbea894..728cd82c8d 100644
--- a/etc/kayobe/pulp-host-image-versions.yml
+++ b/etc/kayobe/pulp-host-image-versions.yml
@@ -1,8 +1,6 @@
 ---
 # Overcloud host image versioning tags
 # These images must be in SMS, since they are used by our AIO CI runners
-stackhpc_rocky_9_overcloud_host_image_version: 2025.1-20260720T114136
-stackhpc_rocky_9_overcloud_host_image_version_aarch64: 2025.1-20260720T114136
 stackhpc_rocky_10_overcloud_host_image_version: 2025.1-20260715T072311
 stackhpc_rocky_10_overcloud_host_image_version_aarch64: 2025.1-20260715T072311
 stackhpc_ubuntu_noble_overcloud_host_image_version: 2025.1-20260706T191822
diff --git a/etc/kayobe/pulp-ipa-image-versions.yml b/etc/kayobe/pulp-ipa-image-versions.yml
index fe36c987fd..71ae143984 100644
--- a/etc/kayobe/pulp-ipa-image-versions.yml
+++ b/etc/kayobe/pulp-ipa-image-versions.yml
@@ -1,5 +1,6 @@
 ---
 # IPA image versioning tags
+#TODO: Switch once RL10 images are available
 stackhpc_rocky_9_ipa_image_version: "2025.1-20260420T095100"
 stackhpc_rocky_9_ipa_image_version_aarch64: "2025.1-20260420T095100"
 stackhpc_rocky_10_ipa_image_version: "2025.1-20260805T091024"
diff --git a/etc/kayobe/stackhpc-overcloud-dib.yml b/etc/kayobe/stackhpc-overcloud-dib.yml
index 6b13900ee7..b53223389c 100644
--- a/etc/kayobe/stackhpc-overcloud-dib.yml
+++ b/etc/kayobe/stackhpc-overcloud-dib.yml
@@ -37,11 +37,9 @@ stackhpc_overcloud_dib_elements:
 # StackHPC overcloud DIB image environment variables.
 stackhpc_overcloud_dib_env_vars: "{{ stackhpc_overcloud_dib_env_vars_default | combine(stackhpc_overcloud_dib_env_vars_ark if stackhpc_build_overcloud_image_from_pulp_package_mirrors | bool else {}) }}"
 
-# By default the :9/:10 tag is used as base image. Here we want a specific minor version.
+# By default the :10 tag is used as base image. Here we want a specific minor version.
 stackhpc_overcloud_dib_container_opts_default: >-
-    {% if os_distribution == 'rocky' and os_release == '9' %}
-      --build-arg=ROCKY_VERSION=9.{{ stackhpc_pulp_repo_rocky_9_minor_version }}
-    {% elif os_distribution == 'rocky' and os_release == '10' %}
+    {% if os_distribution == 'rocky' and os_release == '10' %}
       --build-arg=ROCKY_VERSION=10.{{ stackhpc_pulp_repo_rocky_10_minor_version }}
     {% endif %}
 
@@ -71,9 +69,7 @@ stackhpc_overcloud_dib_env_vars_default:
 stackhpc_overcloud_dib_env_vars_ark:
   DIB_CONTAINERFILE_BUILDOPTS: >-
     --build-arg=ROCKY_USE_CUSTOM_DNF_MIRRORS=true
-    {% if os_distribution == 'rocky' and os_release == '9' %}
-      --build-arg=ROCKY_CUSTOM_DNF_MIRROR_URLS={{ [stackhpc_repo_rocky_9_baseos_url, stackhpc_repo_rocky_9_appstream_url] | join(',') }}
-    {% elif os_distribution == 'rocky' and os_release == '10' %}
+    {% if os_distribution == 'rocky' and os_release == '10' %}
       --build-arg=ROCKY_CUSTOM_DNF_MIRROR_URLS={{ [stackhpc_repo_rocky_10_baseos_url, stackhpc_repo_rocky_10_appstream_url] | join(',') }}
     {% endif %}
     {{ stackhpc_overcloud_dib_container_opts_default }}

From 30a726e9b12cfad3614f454a2f15b338b76b4ea4 Mon Sep 17 00:00:00 2001
From: Alex Welsh <alex@stackhpc.com>
Date: Tue, 28 Jul 2026 16:13:43 +0100
Subject: [PATCH 07/11] Remove RL9 config from stackhpc.yml

---
 etc/kayobe/stackhpc.yml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/etc/kayobe/stackhpc.yml b/etc/kayobe/stackhpc.yml
index 5d0ed23d4e..f45ba6f6cc 100644
--- a/etc/kayobe/stackhpc.yml
+++ b/etc/kayobe/stackhpc.yml
@@ -84,14 +84,6 @@ stackhpc_repo_ubuntu_noble_rabbitmq_server_version: "{{ stackhpc_repo_distributi
 ###############################################################################
 # RPMs
 
-# DOCA
-stackhpc_repo_rhel9_doca_url: "{{ stackhpc_repo_mirror_url }}/pulp/content/doca/{{ stackhpc_pulp_rocky_9_doca_version }}/rhel{{ doca_rocky_9_minor_dot }}/$basearch/{{ stackhpc_repo_rhel9_doca_version }}"
-stackhpc_repo_rhel9_doca_version: "{{ stackhpc_repo_distribution }}"
-
-# DOCA Modules
-stackhpc_repo_rhel9_doca_modules_url: "{{ stackhpc_repo_mirror_url }}/pulp/content/doca-modules/{{ stackhpc_pulp_rocky_9_doca_version }}/rhel9.{{ stackhpc_pulp_repo_rocky_9_minor_version }}/$basearch/{{ stackhpc_repo_rhel9_doca_modules_version }}"
-stackhpc_repo_rhel9_doca_modules_version: "{{ stackhpc_repo_distribution }}"
-
 # Grafana for RL10
 stackhpc_repo_grafana_url: "{{ stackhpc_repo_mirror_url }}/pulp/content/grafana/oss/rpm/{{ stackhpc_repo_grafana_version }}"
 stackhpc_repo_grafana_version: "{{ stackhpc_repo_distribution }}"
@@ -108,10 +100,6 @@ stackhpc_repo_rhel9_rabbitmq_erlang_27_version: "{{ stackhpc_repo_distribution }
 stackhpc_repo_rhel9_rabbitmq_server_url: "{{ stackhpc_repo_mirror_url }}/pulp/content/rabbitmq/rabbitmq-server/el/9/noarch/{{ stackhpc_repo_rhel9_rabbitmq_server_version }}"
 stackhpc_repo_rhel9_rabbitmq_server_version: "{{ stackhpc_repo_distribution }}"
 
-# CentOS Stream 9 - NFV OpenvSwitch
-stackhpc_repo_centos_stream_9_nfv_openvswitch_url: "{{ stackhpc_repo_mirror_url }}/pulp/content/centos/9-stream/nfv/$basearch/openvswitch-2/{{ stackhpc_repo_centos_stream_9_nfv_openvswitch_version }}"
-stackhpc_repo_centos_stream_9_nfv_openvswitch_version: "{{ stackhpc_repo_distribution }}"
-
 # Rocky 10 AppStream
 stackhpc_repo_rocky_10_appstream_url: "{{ stackhpc_repo_mirror_url }}/pulp/content/rocky/{{ stackhpc_rocky_10_url_version }}/AppStream/$basearch/os/{{ stackhpc_repo_rocky_10_appstream_version }}"
 stackhpc_repo_rocky_10_appstream_version: "{{ stackhpc_repo_distribution }}"

From 5c799c8f9dc63676359d637702944b5c314f930a Mon Sep 17 00:00:00 2001
From: Alex Welsh <alex@stackhpc.com>
Date: Wed, 29 Jul 2026 12:58:56 +0100
Subject: [PATCH 08/11] Remove RL9 config from AIO env

---
 .../environments/aio/automated-setup.sh       |  2 +-
 etc/kayobe/environments/aio/globals.yml       |  2 +-
 .../inventory/group_vars/cis-hardening/cis    | 11 ----------
 .../aio/kolla/config/nova/nova-compute.conf   |  6 +----
 etc/kayobe/environments/aio/release-train.yml | 22 -------------------
 5 files changed, 3 insertions(+), 40 deletions(-)

diff --git a/etc/kayobe/environments/aio/automated-setup.sh b/etc/kayobe/environments/aio/automated-setup.sh
index 38894fd273..4349d65ecf 100755
--- a/etc/kayobe/environments/aio/automated-setup.sh
+++ b/etc/kayobe/environments/aio/automated-setup.sh
@@ -217,7 +217,7 @@ run_tempest() {
     if ! sudo docker image inspect kayobe:latest > /dev/null 2>&1; then
         echo "Building Kayobe Automation image"
         sudo DOCKER_BUILDKIT=1 docker build \
-        --build-arg BASE_IMAGE=rockylinux/rockylinux:9 \
+        --build-arg BASE_IMAGE=rockylinux/rockylinux:10 \
         --build-arg USE_PYTHON_312=true \
         --file .automation/docker/kayobe/Dockerfile \
         --tag kayobe:latest \
diff --git a/etc/kayobe/environments/aio/globals.yml b/etc/kayobe/environments/aio/globals.yml
index 1fe92cfea7..25d3229ebc 100644
--- a/etc/kayobe/environments/aio/globals.yml
+++ b/etc/kayobe/environments/aio/globals.yml
@@ -49,7 +49,7 @@
 # "rocky".
 os_distribution: "{{ lookup('pipe', '. /etc/os-release && echo $ID') | trim }}"
 
-# OS release. Valid options are "9" when os_distribution is "rocky", or
+# OS release. Valid options are "10" when os_distribution is "rocky", or
 # "noble" when os_distribution is "ubuntu".
 os_release: >-
           {{ (lookup('pipe', '. /etc/os-release && echo $VERSION_CODENAME') | trim) if os_distribution == 'ubuntu' else
diff --git a/etc/kayobe/environments/aio/inventory/group_vars/cis-hardening/cis b/etc/kayobe/environments/aio/inventory/group_vars/cis-hardening/cis
index 943fcf6550..c4a2b5433e 100644
--- a/etc/kayobe/environments/aio/inventory/group_vars/cis-hardening/cis
+++ b/etc/kayobe/environments/aio/inventory/group_vars/cis-hardening/cis
@@ -1,15 +1,4 @@
 ---
-##############################################################################
-# Rocky 9 CIS Hardening Configuration
-
-# NOTE: Using DEFAULT crypto policy in CI. FIPS breaks ed25519 SSH keys, and
-# FUTURE breaks wazuh agent repo metadata download.
-rhel9cis_crypto_policy: DEFAULT
-
-# Disable shell timeout for inactivity which can be disruptive to
-# development work.
-rhel9cis_rule_5_4_3_2: false
-
 ##############################################################################
 # Rocky 10 CIS Hardening Configuration
 
diff --git a/etc/kayobe/environments/aio/kolla/config/nova/nova-compute.conf b/etc/kayobe/environments/aio/kolla/config/nova/nova-compute.conf
index 30c9e867db..7c3a3570b5 100644
--- a/etc/kayobe/environments/aio/kolla/config/nova/nova-compute.conf
+++ b/etc/kayobe/environments/aio/kolla/config/nova/nova-compute.conf
@@ -1,9 +1,5 @@
 {% if kolla_base_arch == 'aarch64' %}
-{% if kolla_base_distro_and_version == 'rocky-9' %}
-[libvirt]
-cpu_mode = custom
-cpu_model = max
-{% elif kolla_base_distro_and_version == 'rocky-10' %}
+{% if kolla_base_distro_and_version == 'rocky-10' %}
 [libvirt]
 cpu_mode = none
 {% endif %}
diff --git a/etc/kayobe/environments/aio/release-train.yml b/etc/kayobe/environments/aio/release-train.yml
index f301dabeed..84519ca457 100644
--- a/etc/kayobe/environments/aio/release-train.yml
+++ b/etc/kayobe/environments/aio/release-train.yml
@@ -26,31 +26,16 @@ stackhpc_repo_mirror_password: "{{ stackhpc_release_pulp_password }}"
 # Use Pulp repository versions from release pulp.
 # Minor versions for stackhpc_repo_rocky_X_* repos are derived from
 # stackhpc_pulp_repo_rocky_X_minor_version in etc/kayobe/pulp.yml
-stackhpc_repo_almalinux_9_proxysql_2_7_version: "{{ stackhpc_pulp_repo_almalinux_9_proxysql_2_7_version }}"
 stackhpc_repo_centos_stream_10_docker_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_10_docker_version }}"
 stackhpc_repo_centos_stream_10_nfv_openvswitch_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_10_nfv_openvswitch_version }}"
 stackhpc_repo_centos_stream_10_ovn_lts_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_10_ovn_lts_version }}"
 stackhpc_repo_centos_stream_10_storage_ceph_squid_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_10_storage_ceph_squid_version }}"
-stackhpc_repo_centos_stream_9_docker_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_docker_version }}"
-stackhpc_repo_centos_stream_9_nfv_openvswitch_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_nfv_openvswitch_version }}"
-stackhpc_repo_centos_stream_9_openstack_epoxy_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_openstack_epoxy_version }}"
-stackhpc_repo_centos_stream_9_opstools_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_opstools_version }}"
-stackhpc_repo_centos_stream_9_storage_ceph_squid_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_storage_ceph_squid_version }}"
 stackhpc_repo_docker_ce_ubuntu_noble_version: "{{ stackhpc_pulp_repo_docker_ce_ubuntu_noble_version }}"
 stackhpc_repo_epel_10_version: "{{ stackhpc_pulp_repo_multiarch_epel_10_version }}"
-stackhpc_repo_epel_9_version: "{{ stackhpc_pulp_repo_multiarch_epel_9_version }}"
 stackhpc_repo_grafana_version: "{{ stackhpc_pulp_repo_grafana_version }}"
-stackhpc_repo_opensearch_2_x_version: "{{ stackhpc_pulp_repo_opensearch_2_x_version }}"
-stackhpc_repo_opensearch_dashboards_2_x_version: "{{ stackhpc_pulp_repo_opensearch_dashboards_2_x_version }}"
 stackhpc_repo_rhel_10_mariadb_10_11_version: "{{ stackhpc_pulp_repo_multiarch_rhel_10_mariadb_10_11_version }}"
-stackhpc_repo_rhel_9_influxdb_version: "{{ stackhpc_pulp_repo_multiarch_rhel_9_influxdb_version }}"
-stackhpc_repo_rhel_9_mariadb_10_11_version: "{{ stackhpc_pulp_repo_multiarch_rhel_9_mariadb_10_11_version }}"
-stackhpc_repo_rhel_9_treasuredata_5_version: "{{ stackhpc_pulp_repo_multiarch_rhel_9_treasuredata_5_version }}"
 stackhpc_repo_rhel10_doca_modules_version: "{{ stackhpc_pulp_repo_rhel10_doca_modules_version }}"
 stackhpc_repo_rhel10_doca_version: "{{ stackhpc_pulp_repo_rhel10_doca_version }}"
-stackhpc_repo_rhel9_doca_modules_version: "{{ stackhpc_pulp_repo_rhel9_doca_modules_version }}"
-stackhpc_repo_rhel9_doca_version: "{{ stackhpc_pulp_repo_rhel9_doca_version }}"
-stackhpc_repo_rhel9_rabbitmq_erlang_26_version: "{{ stackhpc_pulp_repo_multiarch_rhel9_rabbitmq_erlang_26_version }}"
 stackhpc_repo_rhel9_rabbitmq_erlang_27_version: "{{ stackhpc_pulp_repo_multiarch_rhel9_rabbitmq_erlang_27_version }}"
 stackhpc_repo_rhel9_rabbitmq_erlang_version: "{{ stackhpc_pulp_repo_multiarch_rhel9_rabbitmq_erlang_version }}"
 stackhpc_repo_rhel9_rabbitmq_server_version: "{{ stackhpc_pulp_repo_rhel9_rabbitmq_server_version }}"
@@ -60,13 +45,6 @@ stackhpc_repo_rocky_10_crb_version: "{{ stackhpc_pulp_repo_rocky_10_crb_version
 stackhpc_repo_rocky_10_extras_version: "{{ stackhpc_pulp_repo_rocky_10_extras_version }}"
 stackhpc_repo_rocky_10_highavailability_version: "{{ stackhpc_pulp_repo_rocky_10_highavailability_version }}"
 stackhpc_repo_rocky_10_security_version: "{{ stackhpc_pulp_repo_rocky_10_security_version }}"
-stackhpc_repo_rocky_9_appstream_version: "{{ stackhpc_pulp_repo_rocky_9_appstream_version }}"
-stackhpc_repo_rocky_9_baseos_version: "{{ stackhpc_pulp_repo_rocky_9_baseos_version }}"
-stackhpc_repo_rocky_9_crb_version: "{{ stackhpc_pulp_repo_rocky_9_crb_version }}"
-stackhpc_repo_rocky_9_extras_version: "{{ stackhpc_pulp_repo_rocky_9_extras_version }}"
-stackhpc_repo_rocky_9_highavailability_version: "{{ stackhpc_pulp_repo_rocky_9_highavailability_version }}"
-stackhpc_repo_rocky_9_security_version: "{{ stackhpc_pulp_repo_rocky_9_security_version }}"
-stackhpc_repo_rocky_9_sig_security_common_version: "{{ stackhpc_pulp_repo_multiarch_rocky_9_sig_security_common_version }}"
 stackhpc_repo_ubuntu_cloud_archive_version: "{{ stackhpc_pulp_repo_ubuntu_cloud_archive_version }}"
 stackhpc_repo_ubuntu_noble_security_version: "{{ stackhpc_pulp_repo_ubuntu_noble_security_version }}"
 stackhpc_repo_ubuntu_noble_version: "{{ stackhpc_pulp_repo_ubuntu_noble_version }}"

From 20662256bfe036ea7c204bb0c11db8dbd714a6a2 Mon Sep 17 00:00:00 2001
From: Alex Welsh <alex@stackhpc.com>
Date: Wed, 29 Jul 2026 12:59:19 +0100
Subject: [PATCH 09/11] Remove RL9 config from multinode env

---
 .../inventory/group_vars/cis-hardening/cis    | 11 ----------
 .../environments/ci-multinode/stackhpc-ci.yml | 22 ++-----------------
 2 files changed, 2 insertions(+), 31 deletions(-)

diff --git a/etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis b/etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis
index 943fcf6550..c4a2b5433e 100644
--- a/etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis
+++ b/etc/kayobe/environments/ci-multinode/inventory/group_vars/cis-hardening/cis
@@ -1,15 +1,4 @@
 ---
-##############################################################################
-# Rocky 9 CIS Hardening Configuration
-
-# NOTE: Using DEFAULT crypto policy in CI. FIPS breaks ed25519 SSH keys, and
-# FUTURE breaks wazuh agent repo metadata download.
-rhel9cis_crypto_policy: DEFAULT
-
-# Disable shell timeout for inactivity which can be disruptive to
-# development work.
-rhel9cis_rule_5_4_3_2: false
-
 ##############################################################################
 # Rocky 10 CIS Hardening Configuration
 
diff --git a/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml b/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml
index 9a00f46fea..6e7e1dc004 100644
--- a/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml
+++ b/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml
@@ -24,29 +24,18 @@ stackhpc_repo_mirror_password: !vault |
 # Build and deploy released Pulp repository versions.
 # Minor versions for stackhpc_repo_rocky_X_* repos are derived from
 # stackhpc_pulp_repo_rocky_X_minor_version in etc/kayobe/pulp.yml
-stackhpc_repo_almalinux_9_proxysql_2_7_version: "{{ stackhpc_pulp_repo_almalinux_9_proxysql_2_7_version }}"
 stackhpc_repo_centos_stream_10_docker_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_10_docker_version }}"
 stackhpc_repo_centos_stream_10_nfv_openvswitch_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_10_nfv_openvswitch_version }}"
 stackhpc_repo_centos_stream_10_ovn_lts_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_10_ovn_lts_version }}"
 stackhpc_repo_centos_stream_10_storage_ceph_squid_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_10_storage_ceph_squid_version }}"
-stackhpc_repo_centos_stream_9_docker_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_docker_version }}"
-stackhpc_repo_centos_stream_9_nfv_openvswitch_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_nfv_openvswitch_version }}"
-stackhpc_repo_centos_stream_9_openstack_epoxy_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_openstack_epoxy_version }}"
-stackhpc_repo_centos_stream_9_opstools_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_opstools_version }}"
-stackhpc_repo_centos_stream_9_storage_ceph_squid_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_storage_ceph_squid_version }}"
 stackhpc_repo_docker_ce_ubuntu_noble_version: "{{ stackhpc_pulp_repo_docker_ce_ubuntu_noble_version }}"
 stackhpc_repo_epel_10_version: "{{ stackhpc_pulp_repo_multiarch_epel_10_version }}"
-stackhpc_repo_epel_9_version: "{{ stackhpc_pulp_repo_multiarch_epel_9_version }}"
 stackhpc_repo_grafana_version: "{{ stackhpc_pulp_repo_grafana_version }}"
-stackhpc_repo_opensearch_2_x_version: "{{ stackhpc_pulp_repo_opensearch_2_x_version }}"
-stackhpc_repo_opensearch_dashboards_2_x_version: "{{ stackhpc_pulp_repo_opensearch_dashboards_2_x_version }}"
+stackhpc_repo_opensearch_3_x_version: "{{ stackhpc_pulp_repo_opensearch_3_x_version }}"
+stackhpc_repo_opensearch_dashboards_3_x_version: "{{ stackhpc_pulp_repo_opensearch_dashboards_3_x_version }}"
 stackhpc_repo_rhel_10_mariadb_10_11_version: "{{ stackhpc_pulp_repo_multiarch_rhel_10_mariadb_10_11_version }}"
-stackhpc_repo_rhel_9_influxdb_version: "{{ stackhpc_pulp_repo_multiarch_rhel_9_influxdb_version }}"
-stackhpc_repo_rhel_9_mariadb_10_11_version: "{{ stackhpc_pulp_repo_multiarch_rhel_9_mariadb_10_11_version }}"
-stackhpc_repo_rhel_9_treasuredata_5_version: "{{ stackhpc_pulp_repo_multiarch_rhel_9_treasuredata_5_version }}"
 stackhpc_repo_rhel10_doca_version: "{{ stackhpc_pulp_repo_rhel10_doca_version }}"
 stackhpc_repo_rhel9_doca_version: "{{ stackhpc_pulp_repo_rhel9_doca_version }}"
-stackhpc_repo_rhel9_rabbitmq_erlang_26_version: "{{ stackhpc_pulp_repo_multiarch_rhel9_rabbitmq_erlang_26_version }}"
 stackhpc_repo_rhel9_rabbitmq_erlang_27_version: "{{ stackhpc_pulp_repo_multiarch_rhel9_rabbitmq_erlang_27_version }}"
 stackhpc_repo_rhel9_rabbitmq_erlang_version: "{{ stackhpc_pulp_repo_multiarch_rhel9_rabbitmq_erlang_version }}"
 stackhpc_repo_rhel9_rabbitmq_server_version: "{{ stackhpc_pulp_repo_rhel9_rabbitmq_server_version }}"
@@ -56,13 +45,6 @@ stackhpc_repo_rocky_10_crb_version: "{{ stackhpc_pulp_repo_rocky_10_crb_version
 stackhpc_repo_rocky_10_extras_version: "{{ stackhpc_pulp_repo_rocky_10_extras_version }}"
 stackhpc_repo_rocky_10_highavailability_version: "{{ stackhpc_pulp_repo_rocky_10_highavailability_version }}"
 stackhpc_repo_rocky_10_security_version: "{{ stackhpc_pulp_repo_rocky_10_security_version }}"
-stackhpc_repo_rocky_9_appstream_version: "{{ stackhpc_pulp_repo_rocky_9_appstream_version }}"
-stackhpc_repo_rocky_9_baseos_version: "{{ stackhpc_pulp_repo_rocky_9_baseos_version }}"
-stackhpc_repo_rocky_9_crb_version: "{{ stackhpc_pulp_repo_rocky_9_crb_version }}"
-stackhpc_repo_rocky_9_extras_version: "{{ stackhpc_pulp_repo_rocky_9_extras_version }}"
-stackhpc_repo_rocky_9_highavailability_version: "{{ stackhpc_pulp_repo_rocky_9_highavailability_version }}"
-stackhpc_repo_rocky_9_security_version: "{{ stackhpc_pulp_repo_rocky_9_security_version }}"
-stackhpc_repo_rocky_9_sig_security_common_version: "{{ stackhpc_pulp_repo_multiarch_rocky_9_sig_security_common_version }}"
 stackhpc_repo_ubuntu_cloud_archive_version: "{{ stackhpc_pulp_repo_ubuntu_cloud_archive_version }}"
 stackhpc_repo_ubuntu_noble_security_version: "{{ stackhpc_pulp_repo_ubuntu_noble_security_version }}"
 stackhpc_repo_ubuntu_noble_version: "{{ stackhpc_pulp_repo_ubuntu_noble_version }}"

From 78a09c4cd18b7fd7889f93af11eaf34ff1e322f7 Mon Sep 17 00:00:00 2001
From: Alex Welsh <alex@stackhpc.com>
Date: Wed, 29 Jul 2026 12:59:26 +0100
Subject: [PATCH 10/11] Remove RL9 config from builder env

---
 .../environments/ci-builder/stackhpc-ci.yml      | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/etc/kayobe/environments/ci-builder/stackhpc-ci.yml b/etc/kayobe/environments/ci-builder/stackhpc-ci.yml
index 1a33909241..508fed7271 100644
--- a/etc/kayobe/environments/ci-builder/stackhpc-ci.yml
+++ b/etc/kayobe/environments/ci-builder/stackhpc-ci.yml
@@ -29,7 +29,6 @@ kolla_enable_neutron_sriov: true
 kolla_enable_octavia: true
 kolla_enable_opensearch: true
 kolla_enable_prometheus: true
-kolla_enable_redis: "{{ kolla_base_distro_and_version in ['ubuntu-noble', 'rocky-9'] }}"
 kolla_enable_valkey: true
 kolla_build_neutron_ovs: true
 
@@ -58,14 +57,8 @@ stackhpc_repo_centos_stream_10_docker_version: "{{ stackhpc_pulp_repo_multiarch_
 stackhpc_repo_centos_stream_10_nfv_openvswitch_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_10_nfv_openvswitch_version }}"
 stackhpc_repo_centos_stream_10_ovn_lts_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_10_ovn_lts_version }}"
 stackhpc_repo_centos_stream_10_storage_ceph_squid_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_10_storage_ceph_squid_version }}"
-stackhpc_repo_centos_stream_9_docker_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_docker_version }}"
-stackhpc_repo_centos_stream_9_nfv_openvswitch_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_nfv_openvswitch_version }}"
-stackhpc_repo_centos_stream_9_openstack_epoxy_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_openstack_epoxy_version }}"
-stackhpc_repo_centos_stream_9_opstools_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_opstools_version }}"
-stackhpc_repo_centos_stream_9_storage_ceph_squid_version: "{{ stackhpc_pulp_repo_multiarch_centos_stream_9_storage_ceph_squid_version }}"
 stackhpc_repo_docker_ce_ubuntu_noble_version: "{{ stackhpc_pulp_repo_docker_ce_ubuntu_noble_version }}"
 stackhpc_repo_epel_10_version: "{{ stackhpc_pulp_repo_multiarch_epel_10_version }}"
-stackhpc_repo_epel_9_version: "{{ stackhpc_pulp_repo_multiarch_epel_9_version }}"
 stackhpc_repo_ubuntu_noble_fluent_6_version: "{{ stackhpc_pulp_repo_ubuntu_noble_fluent_6_version }}"
 stackhpc_repo_grafana_version: "{{ stackhpc_pulp_repo_grafana_version }}"
 stackhpc_repo_grafana_apt_version: "{{ stackhpc_pulp_repo_grafana_apt_version }}"
@@ -73,8 +66,6 @@ stackhpc_repo_opensearch_3_x_yum_version: "{{ stackhpc_pulp_repo_opensearch_3_x_
 stackhpc_repo_opensearch_dashboards_3_x_yum_version: "{{ stackhpc_pulp_repo_opensearch_dashboards_3_x_yum_version }}"
 stackhpc_repo_rhel_10_mariadb_11_4_version: "{{ stackhpc_pulp_repo_multiarch_rhel_10_mariadb_11_4_version }}"
 stackhpc_repo_rhel10_doca_version: "{{ stackhpc_pulp_repo_rhel10_doca_version }}"
-stackhpc_repo_rhel9_doca_version: "{{ stackhpc_pulp_repo_rhel9_doca_version }}"
-stackhpc_repo_rhel9_rabbitmq_erlang_26_version: "{{ stackhpc_pulp_repo_multiarch_rhel9_rabbitmq_erlang_26_version }}"
 stackhpc_repo_rhel9_rabbitmq_erlang_27_version: "{{ stackhpc_pulp_repo_multiarch_rhel9_rabbitmq_erlang_27_version }}"
 stackhpc_repo_rhel9_rabbitmq_erlang_version: "{{ stackhpc_pulp_repo_multiarch_rhel9_rabbitmq_erlang_version }}"
 stackhpc_repo_rhel9_rabbitmq_server_version: "{{ stackhpc_pulp_repo_rhel9_rabbitmq_server_version }}"
@@ -85,13 +76,6 @@ stackhpc_repo_rocky_10_crb_version: "{{ stackhpc_pulp_repo_rocky_10_crb_version
 stackhpc_repo_rocky_10_extras_version: "{{ stackhpc_pulp_repo_rocky_10_extras_version }}"
 stackhpc_repo_rocky_10_highavailability_version: "{{ stackhpc_pulp_repo_rocky_10_highavailability_version }}"
 stackhpc_repo_rocky_10_security_version: "{{ stackhpc_pulp_repo_rocky_10_security_version }}"
-stackhpc_repo_rocky_9_appstream_version: "{{ stackhpc_pulp_repo_rocky_9_appstream_version }}"
-stackhpc_repo_rocky_9_baseos_version: "{{ stackhpc_pulp_repo_rocky_9_baseos_version }}"
-stackhpc_repo_rocky_9_crb_version: "{{ stackhpc_pulp_repo_rocky_9_crb_version }}"
-stackhpc_repo_rocky_9_extras_version: "{{ stackhpc_pulp_repo_rocky_9_extras_version }}"
-stackhpc_repo_rocky_9_highavailability_version: "{{ stackhpc_pulp_repo_rocky_9_highavailability_version }}"
-stackhpc_repo_rocky_9_security_version: "{{ stackhpc_pulp_repo_rocky_9_security_version }}"
-stackhpc_repo_rocky_9_sig_security_common_version: "{{ stackhpc_pulp_repo_multiarch_rocky_9_sig_security_common_version }}"
 stackhpc_repo_ubuntu_cloud_archive_version: "{{ stackhpc_pulp_repo_ubuntu_cloud_archive_version }}"
 stackhpc_repo_ubuntu_noble_security_version: "{{ stackhpc_pulp_repo_ubuntu_noble_security_version }}"
 stackhpc_repo_ubuntu_noble_version: "{{ stackhpc_pulp_repo_ubuntu_noble_version }}"

From db6ca202c6603de7d2192e1ef377ab4ffdb62cbb Mon Sep 17 00:00:00 2001
From: Alex Welsh <alex@stackhpc.com>
Date: Mon, 3 Aug 2026 09:23:28 +0100
Subject: [PATCH 11/11] Fix repo definitions from code review

---
 etc/kayobe/environments/aio/release-train.yml        | 2 +-
 etc/kayobe/environments/ci-multinode/stackhpc-ci.yml | 7 +++----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/etc/kayobe/environments/aio/release-train.yml b/etc/kayobe/environments/aio/release-train.yml
index 84519ca457..f69e9852fa 100644
--- a/etc/kayobe/environments/aio/release-train.yml
+++ b/etc/kayobe/environments/aio/release-train.yml
@@ -33,7 +33,7 @@ stackhpc_repo_centos_stream_10_storage_ceph_squid_version: "{{ stackhpc_pulp_rep
 stackhpc_repo_docker_ce_ubuntu_noble_version: "{{ stackhpc_pulp_repo_docker_ce_ubuntu_noble_version }}"
 stackhpc_repo_epel_10_version: "{{ stackhpc_pulp_repo_multiarch_epel_10_version }}"
 stackhpc_repo_grafana_version: "{{ stackhpc_pulp_repo_grafana_version }}"
-stackhpc_repo_rhel_10_mariadb_10_11_version: "{{ stackhpc_pulp_repo_multiarch_rhel_10_mariadb_10_11_version }}"
+stackhpc_repo_rhel_10_mariadb_11_4_version: "{{ stackhpc_pulp_repo_multiarch_rhel_10_mariadb_11_4_version }}"
 stackhpc_repo_rhel10_doca_modules_version: "{{ stackhpc_pulp_repo_rhel10_doca_modules_version }}"
 stackhpc_repo_rhel10_doca_version: "{{ stackhpc_pulp_repo_rhel10_doca_version }}"
 stackhpc_repo_rhel9_rabbitmq_erlang_27_version: "{{ stackhpc_pulp_repo_multiarch_rhel9_rabbitmq_erlang_27_version }}"
diff --git a/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml b/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml
index 6e7e1dc004..a82db14d20 100644
--- a/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml
+++ b/etc/kayobe/environments/ci-multinode/stackhpc-ci.yml
@@ -31,11 +31,10 @@ stackhpc_repo_centos_stream_10_storage_ceph_squid_version: "{{ stackhpc_pulp_rep
 stackhpc_repo_docker_ce_ubuntu_noble_version: "{{ stackhpc_pulp_repo_docker_ce_ubuntu_noble_version }}"
 stackhpc_repo_epel_10_version: "{{ stackhpc_pulp_repo_multiarch_epel_10_version }}"
 stackhpc_repo_grafana_version: "{{ stackhpc_pulp_repo_grafana_version }}"
-stackhpc_repo_opensearch_3_x_version: "{{ stackhpc_pulp_repo_opensearch_3_x_version }}"
-stackhpc_repo_opensearch_dashboards_3_x_version: "{{ stackhpc_pulp_repo_opensearch_dashboards_3_x_version }}"
-stackhpc_repo_rhel_10_mariadb_10_11_version: "{{ stackhpc_pulp_repo_multiarch_rhel_10_mariadb_10_11_version }}"
+stackhpc_repo_opensearch_3_x_yum_version: "{{ stackhpc_pulp_repo_opensearch_3_x_version }}"
+stackhpc_repo_opensearch_dashboards_3_x_yum_version: "{{ stackhpc_pulp_repo_opensearch_dashboards_3_x_version }}"
+stackhpc_repo_rhel_10_mariadb_11_4_version: "{{ stackhpc_pulp_repo_multiarch_rhel_10_mariadb_11_4_version }}"
 stackhpc_repo_rhel10_doca_version: "{{ stackhpc_pulp_repo_rhel10_doca_version }}"
-stackhpc_repo_rhel9_doca_version: "{{ stackhpc_pulp_repo_rhel9_doca_version }}"
 stackhpc_repo_rhel9_rabbitmq_erlang_27_version: "{{ stackhpc_pulp_repo_multiarch_rhel9_rabbitmq_erlang_27_version }}"
 stackhpc_repo_rhel9_rabbitmq_erlang_version: "{{ stackhpc_pulp_repo_multiarch_rhel9_rabbitmq_erlang_version }}"
 stackhpc_repo_rhel9_rabbitmq_server_version: "{{ stackhpc_pulp_repo_rhel9_rabbitmq_server_version }}"