Update repositories and container images (2025.1)

[priteau]

No description provided.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2c607738-65ea-4468-8181-ea581962d58d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Updated 2025.1 Kolla, overcloud host image, OFED, and Pulp repository versions for Rocky Linux and Ubuntu. Added Grafana and OpenSearch Dashboard vulnerability allowances. Documented updated OFED modules and the Rocky Linux 9.8 security kernel.

Walkthrough

This change refreshes Kolla and Overcloud image tags, OFED kernel module versions, Pulp repository timestamps, vulnerability allowlists, and release notes for Rocky Linux and Ubuntu environments.

Changes

Configuration refresh

Layer / File(s)	Summary
Image and kernel version updates etc/kayobe/kolla-image-tags.yml, etc/kayobe/pulp-host-image-versions.yml, etc/kayobe/ofed.yml	Updated Kolla image tags, Overcloud host image versions, and Rocky Linux 9.8 and 10.2 OFED kernel module versions.
Pulp repository timestamp refresh etc/kayobe/pulp-repo-versions.yml	Refreshed repository version timestamps across CentOS Stream, DOCA, Docker CE, ELRepo, EPEL, Grafana, RabbitMQ, InfluxDB, Rocky Linux, and Ubuntu repositories.
Security exceptions and release metadata etc/kayobe/trivy/allowed-vulnerabilities.yml, releasenotes/notes/repo-bump-20260808-c75da1bda2befae7.yaml	Added two vulnerability allowlist entries and documented the OFED and Rocky Linux 9.8 security kernel updates.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• stackhpc/stackhpc-kayobe-config#2466: Updates the same OFED matrix and Pulp repository version variables.
• stackhpc/stackhpc-kayobe-config#2498: Updates the same Rocky Linux OFED kernel module versions.
• stackhpc/stackhpc-kayobe-config#2484: Updates the same Overcloud host image version tags.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 63cf436b-564a-461a-8b00-8577f5c1e96b

📥 Commits

Reviewing files that changed from the base of the PR and between 9080648 and 9a84b53.

📒 Files selected for processing (6)

• etc/kayobe/kolla-image-tags.yml
• etc/kayobe/ofed.yml
• etc/kayobe/pulp-host-image-versions.yml
• etc/kayobe/pulp-repo-versions.yml
• etc/kayobe/trivy/allowed-vulnerabilities.yml
• releasenotes/notes/repo-bump-20260808-c75da1bda2befae7.yaml

📜 Review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: stackhpc/check
• GitHub Check: Ansible 2.18 lint with Python 3.12
• GitHub Check: Ansible 2.17 lint with Python 3.10

🔇 Additional comments (4)

etc/kayobe/trivy/allowed-vulnerabilities.yml (1)

27-27: 🔒 Security & Privacy

Verify both exceptions against the deployed package versions.

These vulnerable IDs are copied by tools/scan-images.sh into .trivyignore. GHSA-r277-6w6q-xmqw covers authentication bypass in github.com/getkin/kin-openapi/openapi3filter versions before 0.144.0; CVE-2026-59873 covers node-tar versions before 7.5.19. Confirm the affected package versions are deployed and reachable before suppressing CRITICAL findings; if suppression is required, add an inline reason and a removal condition.

Also applies to: 69

etc/kayobe/pulp-host-image-versions.yml (1)

4-8: 🩺 Stability & Availability

Verify that every new host image exists in SMS.

The file states that these images must be in SMS. etc/kayobe/stackhpc-overcloud-host-images.yml builds deployment URLs directly from these values. Verify the 2025.1-20260809T214130 snapshot for Rocky 9, Rocky 10, both Rocky architectures, and Ubuntu Noble. A missing path will fail host-image deployment or AIO CI.

etc/kayobe/ofed.yml (1)

22-23: 🗄️ Data Integrity & Integration

Verify that the new kernel module builds exist in the selected Pulp snapshots.

Lines 22-23 feed doca_kernel_version in etc/kayobe/ansible/tools/install-doca.yml. The changed snapshots in etc/kayobe/pulp-repo-versions.yml Lines 35-40 must contain 5.14.0.687.36.1.el9.8 and 6.12.0.211.43.1.el10.2 for both architectures. Verify the exact package paths before merge. A missing package will fail DOCA installation.

etc/kayobe/pulp-repo-versions.yml (1)

5-8: LGTM!

Also applies to: 15-18, 43-43, 45-52, 57-57, 62-62, 85-91, 93-93, 97-102, 161-167, 169-169, 176-184