Ansible on RHEL 10 — Migration Guide

# ansible-core from AppStream
sudo dnf install ansible-core

# Full Ansible with collections
sudo dnf install ansible

# Verify
ansible --version
# ansible [core 2.17.x]
# python version = 3.12.x

# Verify Python is available
python3 --version
# Python 3.12.x

# Install minimal dependencies for Ansible
sudo dnf install python3 python3-libselinux python3-dnf

[rhel10]
rhel10-web01 ansible_host=10.0.0.11
rhel10-web02 ansible_host=10.0.0.12

[rhel10:vars]
ansible_python_interpreter=/usr/bin/python3

# ansible.cfg or inventory — usually auto-detected, but be explicit
[defaults]
interpreter_python = auto_silent

# Or per host
# ansible_python_interpreter = /usr/bin/python3

# ❌ Python 2 syntax — fails on RHEL 10
print "hello"
except Exception, e:

# ✅ Python 3 syntax
print("hello")
except Exception as e:

- name: Create Python virtual environment on RHEL 10
  ansible.builtin.pip:
    name:
      - flask
      - gunicorn
    virtualenv: /opt/myapp/venv
    virtualenv_command: python3 -m venv

# ❌ May not work on RHEL 10
- ansible.builtin.dnf:
    name: python3-pip
    state: present

# ✅ Works on both RHEL 9 and 10
- ansible.builtin.package:
    name: python3-pip
    state: present

# Works across RHEL 8, 9, and 10
- name: Install common packages
  ansible.builtin.package:
    name:
      - vim-enhanced
      - tmux
      - curl
      - git
      - python3-pip
    state: present

- name: Install RHEL 10 specific packages
  ansible.builtin.dnf:
    name:
      - python3.12-pip
      - container-tools
      - nmstate
    state: present
  when: ansible_distribution_major_version == '10'

# Works on both versions
- name: Allow HTTPS
  ansible.posix.firewalld:
    service: https
    permanent: true
    state: enabled
    immediate: true

# RHEL 10 — new policy objects
- name: Configure firewall policy
  ansible.posix.firewalld:
    policy: allow-web-traffic
    rich_rule: 'rule family="ipv4" source address="10.0.0.0/8" service name="https" accept'
    permanent: true
    state: enabled
  when: ansible_distribution_major_version == '10'

# Credentials directory (new in systemd 256)
- name: Deploy service with credentials
  ansible.builtin.copy:
    dest: /etc/systemd/system/myapp.service
    content: |
      [Unit]
      Description=My Application
      After=network.target

      [Service]
      Type=notify
      ExecStart=/opt/myapp/bin/server
      # New: systemd credentials
      LoadCredential=db-password:/etc/myapp/db-password
      # New: resource control improvements
      MemoryMax=2G
      CPUWeight=100

      [Install]
      WantedBy=multi-user.target

- name: Reload and start
  ansible.builtin.systemd_service:
    name: myapp
    state: started
    enabled: true
    daemon_reload: true

# Check current policy
- name: Get crypto policy
  ansible.builtin.command: update-crypto-policies --show
  register: crypto_policy
  changed_when: false

# Set policy if needed (e.g., for legacy compatibility)
- name: Set crypto policy
  ansible.builtin.command: update-crypto-policies --set DEFAULT:SHA1
  when: crypto_policy.stdout != 'DEFAULT:SHA1'
  notify: reboot

---
- name: Prepare for RHEL 10 upgrade
  hosts: rhel9_servers
  become: true
  tasks:
    - name: Verify current RHEL version
      ansible.builtin.assert:
        that:
          - ansible_distribution == 'RedHat'
          - ansible_distribution_major_version == '9'

    - name: Update all RHEL 9 packages
      ansible.builtin.dnf:
        name: '*'
        state: latest
        update_cache: true

    - name: Install leapp upgrade tool
      ansible.builtin.dnf:
        name:
          - leapp-upgrade
        state: present

    - name: Run leapp preupgrade check
      ansible.builtin.command: leapp preupgrade
      register: preupgrade
      failed_when: false
      changed_when: false

    - name: Display preupgrade report
      ansible.builtin.debug:
        var: preupgrade.stdout_lines

    - name: Check for inhibitors
      ansible.builtin.assert:
        that: "'inhibitor' not in preupgrade.stdout"
        fail_msg: "Upgrade inhibitors found — review /var/log/leapp/leapp-report.txt"

---
- name: Configure web server (RHEL 9 + 10)
  hosts: webservers
  become: true
  tasks:
    - name: Install packages
      ansible.builtin.dnf:
        name:
          - nginx
          - python3-pip
          - firewalld
        state: present

    - name: Configure firewall
      ansible.posix.firewalld:
        service: "{{ item }}"
        permanent: true
        state: enabled
        immediate: true
      loop:
        - http
        - https

    - name: RHEL 10 specific — configure nmstate
      ansible.builtin.dnf:
        name: nmstate
        state: present
      when: ansible_distribution_major_version == '10'

    - name: Start services
      ansible.builtin.service:
        name: "{{ item }}"
        state: started
        enabled: true
      loop:
        - nginx
        - firewalld

# molecule/default/molecule.yml
---
driver:
  name: podman
platforms:
  - name: rhel9
    image: registry.access.redhat.com/ubi9/ubi:latest
    command: /usr/sbin/init
    privileged: true
  - name: rhel10
    image: registry.access.redhat.com/ubi10/ubi:latest
    command: /usr/sbin/init
    privileged: true

# RHEL 10 uses dnf5 — ensure python3-dnf is installed
- name: Bootstrap dnf Python bindings
  ansible.builtin.raw: dnf install -y python3-dnf
  when: ansible_distribution_major_version == '10'

# Ensure SELinux Python bindings are installed
- name: Install SELinux bindings
  ansible.builtin.dnf:
    name: python3-libselinux
    state: present

# Use ed25519 keys (recommended)
- name: Deploy SSH key
  ansible.posix.authorized_key:
    user: ansible
    key: "{{ lookup('file', '~/.ssh/id_ed25519.pub') }}"