Update RockyLinux 8.10 inc. OpenHPC v2.10, disable act_pedit

[elelaysh]

• Update system packages on RockyLinux 8.10 including to kernel-core-4.18.0-553.136.1.el8_10 to fix CVE-2026-46331 (pedit-COW). Note system packages for RockyLinux 9.8 are not updated as kernel-core-5.14.0-687.17.1.el9_8 breaks DOCA-OFED.
• Disable kernel module act_pedit (on both OSes) to mitigate this CVE for RockyLinux 9.8.
• Update to OpenHPC v2.10 on RockyLinux 8.10, including Slurm major upgrade from v23.11.10 -> v25.05.8.
• Update stackhpc.openhpc role to v1.6.0, mostly moving appliance defaults into the role. However it fixes slurmdbd upgrade logic and does change defaults for the following slurm.conf parameters:
  • RebootProgram: unset -> /sbin/reboot: Allows scontrol reboot to be used to reboot nodes. If slurm controlled rebuild is configured this is overriden.
  • StateSaveLocation: /var/spool/slurm -> /var/spool/slurmctld: Slurmd state is lost on rebuild anyway so this is backwards-compatible.

[elelaysh]

⚠️ the RL 9.8 kernel revision breaks nvidia DOCA 3.2.2

This line in Rocky changelog for 5.14.0-687.16.1.el9_8:

• dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]

introducing this commit in upstream linux

[elelaysh]

RH errata referenced from Rocky Linux changelog: https://access.redhat.com/errata/RHSA-2026:27789

[sjpb]

Image build: https://github.com/stackhpc/ansible-slurm-appliance/actions/runs/28871145182

Needed b/c #997 should have updated the image but didn't; took the opportunity to bump the RL8 timestamps too.

[sjpb]

Slurm db backup failed for RL8 with
/bin/sh: 1: /usr/bin/python3.9: not found
The weird thing is this is delegated to localhost, no become, so that should be the runner's python 3.12 venv.
Debugging via last commit ...

[sjpb]

Ok so here's what's happening:

1. On the remote host, we use python3.9 (i.e. not default system python) to install pymysql so we get a recent version:

   ansible-slurm-appliance/ansible/roles/mysql/tasks/install.yml

   Line 12 in 91e9294

   ansible_python_interpreter: /usr/bin/python3.9

2. So when we want to use community.mysql.mysql_query during the upgrade, we need to use the same interpreter: https://github.com/stackhpc/ansible-role-openhpc/blob/c2aff51213e0b913f5fa905f09a7c113a0e44ffa/tasks/upgrade.yml#L6
3. So we set the interpreter at the play level, to avoid having to modify the role (which TBH has moved on now anyway):

   ansible-slurm-appliance/ansible/slurm.yml

   Line 90 in 91e9294

   ansible_python_interpreter: /usr/bin/python3.9

4. But the actual backup task runs delegated to localhost, and should use the venv's python there so we get openstack CLI:

   ansible-slurm-appliance/environments/common/inventory/group_vars/all/openhpc.yml

   Line 105 in 91e9294

   # configure slurm database pre-upgrade backups:

What I'm not clear on is why this apparently worked ok for the RL9 / ohpc 3.x upgrade.

[sjpb]

So RL9 / openhpc 3.x upgrade was here.

The final RL9 run actually failed but unrelated, not sure why we merged TBH: https://github.com/stackhpc/ansible-slurm-appliance/actions/runs/27609175731/job/81629755985

The previous run was here: https://github.com/stackhpc/ansible-slurm-appliance/actions/runs/27609175731/job/81640923243 but skips the backup!

TASK [stackhpc.openhpc : Check if slurm database requires an upgrade] **********
...
Slurm Database already at the highest version '16'. No conversion needed.

Edit: OpenHPC confirmed they just added the warning re. db upgrade as a precaution. And the SchedMD upgrade docs don't actually mention anything about using slurmdbd -u. So, I am going to assume that actually there just was no DB upgrade needed between these versions, and hence we just didn't notice that our upgrade logic was broken.

[sjpb]

RL8 slurm db upgrade failed because pexpect was not installed. Fixing via openhpc role.

Image build: https://github.com/stackhpc/ansible-slurm-appliance/actions/runs/29013896303

[wtripp180901]

LGTM