Use ansible-core over ansible and upgrade to v2.16

.github/workflows/extra.yml

@@ -18,7 +18,7 @@ permissions:
 jobs:
   doca:
     name: extra-build
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false # allow other matrix jobs to continue even if one fails
       matrix: # build RL8, RL9

.github/workflows/fatimage.yml

@@ -29,7 +29,7 @@ jobs:
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.build.image_name }} # to branch/PR + OS
       cancel-in-progress: true
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false # allow other matrix jobs to continue even if one fails
       matrix: # build RL8, RL9

.github/workflows/lint.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   lint:
     name: Lint
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       packages: read

.github/workflows/main.yml

@@ -38,7 +38,7 @@ jobs:
   files_changed:
     name: Determine files changed
     needs: lint
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # Map a step output to a job output, this allows other jobs to be gated on the filter results
     outputs:
         # The 'stackhpc' output will be 'true' if either of the two stackhpc filters below matched

.github/workflows/nightly-cleanup.yml

@@ -21,7 +21,7 @@ jobs:
           - LEAFCLOUD
           - SMS
           - ARCUS
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     env:
       OS_CLOUD: openstack
       CI_CLOUD: ${{ matrix.cloud }}

.github/workflows/nightlybuild.yml

@@ -26,7 +26,7 @@ jobs:
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.build.image_name }} # to branch/PR + OS
       cancel-in-progress: true
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false # allow other matrix jobs to continue even if one fails
       matrix: # build RL8, RL9
@@ -131,7 +131,7 @@ jobs:
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.build.image_name }}-${{ matrix.target_cloud }}
       cancel-in-progress: true
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:

.github/workflows/release-image.yml

@@ -16,7 +16,7 @@ permissions:
 jobs:
   ci-image-release:
     name: ci-image-release
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     concurrency: ${{ github.workflow }}-${{ github.ref }}
     strategy:
       fail-fast: false

.github/workflows/s3-image-sync.yml

@@ -19,7 +19,7 @@ permissions:
 
 jobs:
   s3_cleanup:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     concurrency: ${{ github.workflow }}-${{ github.ref }}
     strategy:
       fail-fast: false
@@ -41,7 +41,7 @@ jobs:
           s3cmd rm s3://${{ env.S3_BUCKET }} --recursive --force
 
   image_upload:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs: s3_cleanup
     concurrency: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.build }}
     strategy:
@@ -118,7 +118,7 @@ jobs:
 
   image_sync:
     needs: image_upload
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     concurrency: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.cloud }}-${{ matrix.build }}
     strategy:
       fail-fast: false

.github/workflows/stackhpc.yml

@@ -18,7 +18,7 @@ permissions:
 jobs:
   openstack:
     name: openstack-ci
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false # allow other matrix jobs to continue even if one fails
       matrix:
@@ -75,8 +75,14 @@ jobs:
         run: cat environments/.stackhpc/bastion_fingerprints >> ~/.ssh/known_hosts
         shell: bash
 
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.10'
+
       - name: Install ansible, pip and galaxy requirements
         run: dev/setup-env.sh
+        env:
+           PYTHON_VERSION: python3 # overrides os-release discovery logic
 
       - name: Install OpenTofu
         uses: opentofu/setup-opentofu@v1.0.5
@@ -146,8 +152,14 @@ jobs:
       - name: Checkout current branch
         run: git checkout ${{ github.head_ref || github.ref_name }}
 
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+
       - name: Update ansible, pip and galaxy requirements
         run: dev/setup-env.sh
+        env:
+          PYTHON_VERSION: python3 # overrides os-release discovery logic
 
       - name: Reimage login and control nodes to image in current branch
         id: reimage_non_compute

.github/workflows/trivyscan.yml

@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   scan:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:

.github/workflows/upgrade-check.yml.sample

@@ -37,7 +37,7 @@ permissions:
 
 jobs:
   check_for_update:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout the config repo

.github/workflows/upload-release-image.yml.sample

@@ -37,7 +37,7 @@ permissions:
 
 jobs:
   image_upload:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     concurrency: ${{ github.ref }}
     env: 
       OS_CLOUD: openstack

.github/workflows/workflow-cleanup.yml

@@ -26,7 +26,7 @@ permissions:
 jobs:
   ci_cluster_cleanup:
     name: ci-cluster-cleanup
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     env:
       OS_CLOUD: openstack
       CI_CLOUD: ${{ github.event.inputs.ci_cloud }}

ansible/roles/compute_init/tasks/install.yml

@@ -22,8 +22,6 @@
     rsync_opts:
       - "-p"
       - "--chmod=D770,F644"
-      - "--owner=root"
-      - "--group=root"
     recursive: true
     use_ssh_args: true
   become: true
@@ -57,6 +55,14 @@
     - src: ../../eessi
       dest: roles/
 
+- name: Ensure ownership is root after sync
+  ansible.builtin.file:
+    path: "/etc/ansible-init/playbooks/"
+    owner: root
+    group: root
+    recurse: true
+  become: true
+
 - name: Add filter_plugins to ansible.cfg
   ansible.builtin.lineinfile:
     path: /etc/ansible-init/ansible.cfg

dev/setup-env.sh

@@ -16,21 +16,22 @@ if [[ "$PYTHON_VERSION" == "" ]]; then
 
   MAJOR_VERSION=$(echo "$OS_VERSION" | cut -d. -f1)
 
-  if [[ "$OS" == "ubuntu" && "$MAJOR_VERSION" == "22" ]]; then
-    PYTHON_VERSION="/usr/bin/python3.10"
+  if [[ "$OS" == "ubuntu" && "$MAJOR_VERSION" == "24" ]]; then
+    PYTHON_VERSION="/usr/bin/python3.12"
   elif [[ "$OS" == "rocky" && "$MAJOR_VERSION" == "8" ]]; then
-    # python3.9+ doesn't have selinux bindings
-    PYTHON_VERSION="/usr/bin/python3.8" # use `sudo yum install python38` on Rocky Linux 8 to install this
+    PYTHON_VERSION="/usr/bin/python3.12" # use `sudo yum install python3.12` on Rocky Linux 8 to install this
   elif [[ "$OS" == "rocky" && "$MAJOR_VERSION" == "9" ]]; then
-    PYTHON_VERSION="/usr/bin/python3.9"
+    PYTHON_VERSION="/usr/bin/python3.12"
   else
     echo "Unsupported OS version: $OS $MAJOR_VERSION"
     exit 1
   fi
 fi
 
-if [[ ! -d "venv" ]]; then
-  $PYTHON_VERSION -m venv venv
+if [[ ! -x venv/bin/python ]] || \
+  [[ "$($PYTHON_VERSION -V 2>&1)" != "$(venv/bin/python -V 2>&1)" ]]; then
+    rm -rf venv
+    $PYTHON_VERSION -m venv venv
 fi
 
 # shellcheck disable=SC1091

environments/.stackhpc/tofu/cluster_image.auto.tfvars.json

@@ -1,6 +1,6 @@
 {
   "cluster_image": {
-    "RL8": "openhpc-RL8-251119-1833-cb477455",
-    "RL9": "openhpc-RL9-251119-1834-cb477455"
+    "RL8": "openhpc-RL8-251125-1415-9c15a95f",
+    "RL9": "openhpc-RL9-251125-1416-9c15a95f"
   }
 }

requirements.txt

@@ -1,14 +1,89 @@
-ansible==6.7.0 # cloudalchemy.prometheus uses ansible.builtin.include, removed in ansible-core==2.16 => ansible==9
-openstacksdk
-python-openstackclient==8.0.0
-python-manilaclient
-python-ironicclient
-jmespath
+ansible-core==2.16.0
+arrow==1.4.0
+attrs==25.4.0
+autopage==0.5.2
 bcrypt==4.3.0
-passlib[bcrypt]==1.7.4
-cookiecutter
-selinux # this is a shim to avoid having to use --system-site-packages, you still need sudo yum install libselinux-python3
-netaddr
-matplotlib
-pulp-cli==0.23.2
 beautifulsoup4==4.13.3
+binaryornot==0.4.4
+certifi==2025.11.12
+cffi==2.0.0
+chardet==5.2.0
+charset-normalizer==3.4.4
+click==8.3.1
+cliff==4.12.0
+cmd2==2.7.0
+contourpy==1.3.3
+cookiecutter==2.6.0
+cryptography==46.0.3
+cycler==0.12.1
+debtcollector==3.0.0
+decorator==5.2.1
+dogpile.cache==1.5.0
+fonttools==4.60.1
+idna==3.11
+iso8601==2.1.0
+Jinja2==3.1.6
+jmespath==1.0.1
+jsonpatch==1.33
+jsonpointer==3.0.0
+jsonschema==4.25.1
+jsonschema-specifications==2025.9.1
+keystoneauth1==5.12.0
+kiwisolver==1.4.9
+markdown-it-py==4.0.0
+MarkupSafe==3.0.3
+matplotlib==3.10.7
+mdurl==0.1.2
+msgpack==1.1.2
+netaddr==1.3.0
+numpy==2.3.5
+openstacksdk==4.8.0
+os-service-types==1.8.2
+osc-lib==4.2.0
+oslo.config==10.1.0
+oslo.context==6.2.0
+oslo.i18n==6.7.1
+oslo.log==7.2.1
+oslo.serialization==5.8.0
+oslo.utils==9.2.0
+packaging==23.2
+passlib==1.7.4
+pbr==7.0.3
+pillow==12.0.0
+platformdirs==4.5.0
+prettytable==3.17.0
+psutil==7.1.3
+pulp-cli==0.23.2
+pulp-glue==0.23.2
+pycparser==2.23
+Pygments==2.19.2
+pyparsing==3.2.5
+pyperclip==1.11.0
+python-cinderclient==9.8.0
+python-dateutil==2.9.0.post0
+python-ironicclient==5.14.0
+python-keystoneclient==5.7.0
+python-manilaclient==5.7.0
+python-openstackclient==8.0.0
+python-slugify==8.0.4
+PyYAML==6.0.3
+referencing==0.37.0
+requests==2.31.0
+requestsexceptions==1.4.0
+resolvelib==1.0.1
+rfc3986==2.0.0
+rich==14.2.0
+rich-argparse==1.7.2
+rpds-py==0.29.0
+schema==0.7.8
+setuptools==80.9.0
+six==1.17.0
+soupsieve==2.8
+stevedore==5.6.0
+text-unidecode==1.3
+toml==0.10.2
+typing_extensions==4.15.0
+tzdata==2025.2
+urllib3==2.5.0
+wcwidth==0.2.14
+wrapt==2.0.1

requirements.yml

@@ -9,12 +9,12 @@ roles:
   - src: https://github.com/stackhpc/ansible-node-exporter.git
     version: stackhpc
     name: cloudalchemy.node_exporter
-  - src: https://github.com/cloudalchemy/ansible-prometheus.git
-    version: 4d2c8d742de39e50387e0aa6d5510b21c7451343 # need fix in preceeding commit for rocky
+  - src: https://github.com/stackhpc/ansible-prometheus.git
+    version: master
     name: cloudalchemy.prometheus
   - src: https://github.com/stackhpc/ansible-grafana.git
     name: cloudalchemy.grafana
-    version: stackhpc-0.19.0 # fix grafana install
+    version: 0f516ea925b63868719475a8eb77bccc0db11be3
   - src: https://github.com/OSC/ood-ansible.git
     name: osc.ood
     version: v4.0.1