Ansible on Rocky Linux 10 Automation Complete Guide

Rocky Linux 10 (Red Quartz) is the community rebuild of RHEL 10. It tracks RHEL 10 (kernel 6.12, Python 3.12, OpenSSH 9.9, Podman 5, image mode via bootc) and is supported through May 2035. This guide covers Rocky 10 automation and migration from Rocky 9.

Rocky Linux 10 release facts

| Item | Value | |---|---| | Code name | Red Quartz | | GA | 2025-06 | | Support end | 2035-05-31 | | Default kernel | 6.12 | | Default Python | 3.12 | | Default OpenSSH | 9.9p1 | | Container engine | Podman 5 | | Image mode | bootc |

See also: Ansible on AlmaLinux 10 Automation Complete Guide

Ansible-core compatibility

Use ansible-core 2.18 LTS or newer.

Inventory

[rocky10]
rocky10-01.example.com
rocky10-02.example.com
[rocky10:vars]
ansible_user=rocky
ansible_python_interpreter=/usr/bin/python3

See also: Ansible on RHEL 10 Automation Complete Guide

Baseline playbook

- name: Rocky Linux 10 baseline
  hosts: rocky10
  become: true
  tasks:
    - name: Update all packages
      ansible.builtin.dnf: { name: "*", state: latest, update_cache: true }
- name: Install baseline tools
      ansible.builtin.dnf:
        name:
          - vim-enhanced
          - chrony
          - firewalld
          - policycoreutils-python-utils
          - podman
          - cockpit
          - bootc
        state: present
- name: Enable services
      ansible.builtin.service:
        name: "{{ item }}"
        enabled: true
        state: started
      loop: [chronyd, firewalld, cockpit.socket]
- name: SELinux enforcing
      ansible.posix.selinux: { policy: targeted, state: enforcing }

Image mode (bootc) deployment

- name: Switch to a new bootc image
  hosts: rocky10
  become: true
  tasks:
    - name: bootc switch to staged image
      ansible.builtin.command: bootc switch quay.io/corp/rocky10-base:2026.05
      register: bs
      changed_when: "'Image' in bs.stdout"
- name: Reboot to new deployment
      ansible.builtin.reboot:
      when: bs.changed

See also: Ansible on Rocky Linux 9 Automation Complete Guide

Post-quantum SSH

- name: Enable PQ KEX
  ansible.builtin.copy:
    dest: /etc/ssh/sshd_config.d/10-pq.conf
    mode: "0644"
    content: |
      KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256
      PasswordAuthentication no
    validate: 'sshd -tf %s'
  notify: restart sshd

Migration from Rocky 9 (migrate2rocky10)

- name: In-place migrate Rocky 9 -> Rocky 10
  hosts: rocky9_to_migrate
  become: true
  tasks:
    - name: Download migration helper
      ansible.builtin.get_url:
        url: https://raw.githubusercontent.com/rocky-linux/rocky-tools/main/migrate2rocky10/migrate2rocky10.sh
        dest: /root/migrate2rocky10.sh
        mode: "0755"
- name: Run migration
      ansible.builtin.command: /root/migrate2rocky10.sh -r
      args:
        creates: /etc/rocky-release.10

Best practices

• Use bootc image mode for stateless workloads (Kubernetes nodes, edge gateways). • Validate the SSH KEX change against your jump hosts (ssh -Q kex). • For mutable workloads (databases) keep classic RPM mode. • Mirror Rocky 10 repos internally; image-mode containers can be served from your registry.

Conclusion

Rocky Linux 10 brings RHEL 10 features — image mode, post-quantum SSH, kernel 6.12, Podman 5 — to community-supported infrastructure. Ansible playbooks port cleanly from RHEL 10 with no subscription-manager.