Merge "Drop support for CentOS Stream 10"

30 files changed, 86 insertions, 235 deletions

diff --git a/doc/source/admin/image-building.rst b/doc/source/admin/image-building.rst
index 82ea693ec..a3d9207d3 100644
--- a/doc/source/admin/image-building.rst
+++ b/doc/source/admin/image-building.rst
@@ -25,7 +25,7 @@ In general, images are built like this:
 
    kolla-build
 
-By default, the above command would build all images based on a CentOS Stream
+By default, the above command would build all images based on a Rocky Linux
 image.
 
 The operator can change the base distro with the ``-b`` option:
@@ -36,7 +36,6 @@ The operator can change the base distro with the ``-b`` option:
 
 There are following distros (bases) available for building images:
 
-- centos
 - debian
 - rocky
 - ubuntu
@@ -704,8 +703,8 @@ additional configuration. For RPM-based distros they are enabled via
 ``dnf config-manager --enable``; for Debian-based distros they are a no-op
 as the sources are already provided by the base image. Examples include
 ``crb``, ``extras``, and the base repos ``baseos`` and ``appstream`` for
-CentOS and Rocky Linux, as well as ``debian``, ``debian-security``,
-``ubuntu``, ``ubuntu-security``.
+Rocky Linux, as well as ``debian``, ``debian-security``, ``ubuntu``,
+``ubuntu-security``.
 
 Repositories without ``distro: True`` are fully templated into a new
 repository file and must provide at least one of ``baseurl``, ``metalink``,
diff --git a/doc/source/admin/kolla_api.rst b/doc/source/admin/kolla_api.rst
index a34cd819f..b4266aea0 100644
--- a/doc/source/admin/kolla_api.rst
+++ b/doc/source/admin/kolla_api.rst
@@ -188,5 +188,5 @@ Variables available in the containers
 The following variables available in all images and can be evaluated in
 scripts:
 
-* **KOLLA_BASE_DISTRO**: ``base_distro`` used to build the image (e.g. centos,
+* **KOLLA_BASE_DISTRO**: ``base_distro`` used to build the image (e.g. rocky,
   ubuntu)
diff --git a/doc/source/admin/template-override/ovs-dpdk.rst b/doc/source/admin/template-override/ovs-dpdk.rst
index 73851a993..766caf9bc 100644
--- a/doc/source/admin/template-override/ovs-dpdk.rst
+++ b/doc/source/admin/template-override/ovs-dpdk.rst
@@ -1,7 +1,7 @@
 OVS-DPDK Source build
 =====================
 
-CentOS currently does not provide packages for ovs with dpdk.
+Rocky currently does not provide packages for ovs with dpdk.
 The Ubuntu packages do not support UIO based drivers.
 To use the uio_pci_generic driver on Ubuntu a source build is required.
 
diff --git a/doc/source/contributor/adding-a-new-image.rst b/doc/source/contributor/adding-a-new-image.rst
index 995bf13c7..072d3f294 100644
--- a/doc/source/contributor/adding-a-new-image.rst
+++ b/doc/source/contributor/adding-a-new-image.rst
@@ -75,7 +75,7 @@ cannot be built for some distribution/architecture/build-type combinations.
            "bifrost-base",    # someone need to get upstream working first
        },
 
-       'centos': {
+       'rocky': {
            "hacluster-pcs",   # Missing crmsh package
        },
 
diff --git a/doc/source/contributor/versions.rst b/doc/source/contributor/versions.rst
index af5d02f10..f553e18ed 100644
--- a/doc/source/contributor/versions.rst
+++ b/doc/source/contributor/versions.rst
@@ -9,9 +9,6 @@ information about those which come from 3rdparty sources.
 For each component used we list version used at branch release and provide
 information about package sources.
 
-.. note::
-    When table mentions 'CentOS' it means both CentOS Stream 10 and Rocky Linux 10.
-
 ==============  ================  =============================================
  Name           Version           Package source information
 ==============  ================  =============================================
@@ -20,13 +17,13 @@ information about package sources.
  Galera         26.4 (LTS)         `MariaDB Community downloads`_
  OpenSearch     3.x                `OpenSearch install guide`_
  ProxySQL       3.0.x              `ProxySQL repository`_
- RabbitMQ       4.3.x              - CentOS/Rocky:
+ RabbitMQ       4.3.x              - Rocky:
                                      `Team RabbitMQ 'Cloudsmith' repo (RPM)`_
                                    - Debian/Ubuntu:
                                      `Team RabbitMQ 'Cloudsmith' repo (Deb)`_
- Erlang         27.x               - CentOS/Rocky aarch64:
+ Erlang         27.x               - Rocky aarch64:
                                      `openstack-kolla COPR`_
-                                   - CentOS/Rocky x86-64:
+                                   - Rocky x86-64:
                                      `Team RabbitMQ 'Cloudsmith' repo (RPM)`_
                                    - Debian/Ubuntu:
                                      `Team RabbitMQ 'Modern Erlang' PPA`_
diff --git a/doc/source/support_matrix.rst b/doc/source/support_matrix.rst
index c14c71954..5e3b06b76 100644
--- a/doc/source/support_matrix.rst
+++ b/doc/source/support_matrix.rst
@@ -17,7 +17,6 @@ The following base container images are supported:
 ================== =============================== ================
 Distribution       Default base                    Default base tag
 ================== =============================== ================
-Centos             quay.io/centos/centos           stream10
 Debian Trixie      debian                          trixie
 Rocky Linux        quay.io/rockylinux/rockylinux   10
 Ubuntu Noble       ubuntu                          24.04
diff --git a/kolla/common/config.py b/kolla/common/config.py
index 1915f5c48..e1c0cb456 100644
--- a/kolla/common/config.py
+++ b/kolla/common/config.py
@@ -21,18 +21,16 @@ from kolla.common.users import USERS
 from kolla.version import version_info as version
 
 
-BASE_OS_DISTRO = ['centos', 'debian', 'rocky', 'ubuntu']
+BASE_OS_DISTRO = ['debian', 'rocky', 'ubuntu']
 BASE_ARCH = ['x86_64', 'aarch64']
 DEBIAN_ARCH = ['amd64', 'arm64']
 DEFAULT_BASE_TAGS = {
-    'centos': {'name': 'quay.io/centos/centos', 'tag': 'stream10'},
     'debian': {'name': 'debian', 'tag': 'trixie'},
     'rocky': {'name': 'quay.io/rockylinux/rockylinux', 'tag': '10'},
     'ubuntu': {'name': 'ubuntu', 'tag': '24.04'},
 }
 # NOTE(hrw): has to match PRETTY_NAME in /etc/os-release
 DISTRO_PRETTY_NAME = {
-    'centos': 'CentOS Stream 10',
     'debian': 'Debian GNU/Linux 13 (trixie)',
     'rocky': 'Rocky Linux 10.* (Red Quartz)',
     'ubuntu': 'Ubuntu 24.04.* LTS',
diff --git a/kolla/docker/base/Dockerfile.j2 b/kolla/docker/base/Dockerfile.j2
index 60419f41d..c1f07ade6 100644
--- a/kolla/docker/base/Dockerfile.j2
+++ b/kolla/docker/base/Dockerfile.j2
@@ -58,12 +58,12 @@ COPY dnf.conf /etc/dnf/dnf.conf
 {% set base_yum_repo_keys = [
 ] %}
 
-{% block base_centos_repo_overrides_post_copy %}{% endblock %}
+{% block base_rocky_repo_overrides_post_copy %}{% endblock %}
 
 # Install what is needed for en_US.UTF-8
-{% block base_centos_distro_sync_and_languages %}
+{% block base_rocky_distro_sync_and_languages %}
 
-{% set base_centos_language_packages = [
+{% set base_rocky_language_packages = [
     'langpacks-en',
     'glibc-all-langpacks'
 ] %}
@@ -71,7 +71,7 @@ COPY dnf.conf /etc/dnf/dnf.conf
 # NOTE(hrw): this macro file drops all languages other than C.UTF-8 so horizon fails
 # https://bugzilla.redhat.com/show_bug.cgi?id=1729770
 RUN rm -f /etc/rpm/macros.image-language-conf \
-    && {{ macros.install_packages(base_centos_language_packages | customizable("centos_language_packages"), chain=True, clean=False) }} \
+    && {{ macros.install_packages(base_rocky_language_packages | customizable("rocky_language_packages"), chain=True, clean=False) }} \
     && {{ macros.rpm_security_update(clean_package_cache) }}
 
 {% endblock %}
@@ -88,29 +88,29 @@ RUN rm -f /etc/rpm/macros.image-language-conf \
 {{ cmd }}
 {% endfor %}
 
-{% block base_centos_repo_overrides_post_rpm %}{% endblock %}
+{% block base_rocky_repo_overrides_post_rpm %}{% endblock %}
 
-{% block base_centos_gpg_key_import %}
+{% block base_rocky_gpg_key_import %}
 {% endblock %}
 
-{% set base_centos_yum_repo_keys = [
+{% set base_rocky_yum_repo_keys = [
 ] %}
 
-{% set base_centos_yum_repo_packages = [
+{% set base_rocky_yum_repo_packages = [
     'centos-release-ceph-squid',
     'centos-release-nfv-openvswitch',
     'epel-release',
 ] %}
 
 # We need 'dnf-plugins-core' for 'dnf config-manager'
-{% set base_centos_yum_repo_packages = base_centos_yum_repo_packages + [
+{% set base_rocky_yum_repo_packages = base_rocky_yum_repo_packages + [
     'dnf-plugins-core'
 ] %}
 
-RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("centos_yum_repo_packages"), chain=True, clean=False) }}
+RUN {{ macros.install_packages(base_rocky_yum_repo_packages | customizable("rocky_yum_repo_packages"), chain=True, clean=False) }}
 
-{%- for key in base_centos_yum_repo_keys | customizable('centos_yum_repo_keys') %} && rpm --import {{ key }} {% endfor %} \
-{% block base_centos_repo_overrides_post_yum %}{% endblock -%}
+{%- for key in base_rocky_yum_repo_keys | customizable('rocky_yum_repo_keys') %} && rpm --import {{ key }} {% endfor %} \
+{% block base_rocky_repo_overrides_post_yum %}{% endblock -%}
     && {{ macros.rpm_security_update(clean_package_cache) }}
 
 #### END REPO ENABLEMENT
@@ -120,8 +120,7 @@ RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("cen
 
 {% block base_redhat_binary_versionlock %}{% endblock %}
 
-{# NOTE(hrw): CentOS Stream 9 has curl-minimal, Rocky Linux 9 has curl so we do not install any #}
-{% set base_centos_packages = [
+{% set base_rocky_packages = [
         'ca-certificates',
         'crypto-policies-scripts',
         'dumb-init',
@@ -148,7 +147,7 @@ RUN {{ macros.install_packages(base_centos_yum_repo_packages | customizable("cen
 
 # Install base packages
 {{ macros.enable_extra_repos(['epel']) }}
-{{ macros.install_packages(base_centos_packages | customizable("centos_packages") | customizable("centos_binary_packages") | customizable("centos_source_packages")) }}
+{{ macros.install_packages(base_rocky_packages | customizable("rocky_packages")) }}
 
 {# endif for base_package_type rpm #}
 {% elif base_package_type == 'deb' %}
@@ -302,11 +301,6 @@ RUN apt-get --error-on=any update \
         {%- if not loop.last %} \{% endif -%}
 {%- endfor %}
 
-{% if base_distro == 'centos' %}
-RUN sed -ri '/-session(\s+)optional(\s+)pam_systemd.so/d' /etc/pam.d/system-auth \
-    && sed -ri '/^[^#]/ s/systemd//g' /etc/nsswitch.conf
-{% endif %}
-
 COPY set_configs.py /usr/local/bin/kolla_set_configs
 COPY start.sh /usr/local/bin/kolla_start
 COPY copy_cacerts.sh /usr/local/bin/kolla_copy_cacerts
diff --git a/kolla/docker/base/ci-centos.repo b/kolla/docker/base/ci-centos.repo
deleted file mode 100644
index 4c08f1fea..000000000
--- a/kolla/docker/base/ci-centos.repo
+++ /dev/null
@@ -1,75 +0,0 @@
-[baseos]
-name=(OpenDev mirror) CentOS Stream $releasever - BaseOS
-baseurl=http://MIRROR/centos-stream/$stream/BaseOS/$basearch/os/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
-gpgcheck=1
-repo_gpgcheck=0
-enabled=1
-
-[appstream]
-name=(OpenDev mirror) CentOS Stream $releasever - AppStream
-baseurl=http://MIRROR/centos-stream/$stream/AppStream/$basearch/os/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
-gpgcheck=1
-repo_gpgcheck=0
-enabled=1
-
-[extras-common]
-name=(OpenDev mirror) CentOS Stream $releasever - Extras packages
-baseurl=http://MIRROR/centos-stream/SIGs/$stream/extras/$basearch/extras-common/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Extras-SHA512
-gpgcheck=1
-repo_gpgcheck=0
-enabled=1
-
-[crb]
-name=(OpenDev mirror) CentOS Stream $releasever - CRB
-baseurl=http://MIRROR/centos-stream/$stream/CRB/$basearch/os/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
-gpgcheck=1
-repo_gpgcheck=0
-enabled=0
-
-[highavailability]
-name=(OpenDev mirror) CentOS Stream $releasever - HighAvailability
-baseurl=http://MIRROR/centos-stream/$stream/HighAvailability/$basearch/os/
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
-gpgcheck=1
-repo_gpgcheck=0
-enabled=0
-
-[centos-ceph-reef]
-name=(OpenDev mirror) CentOS-$stream - Ceph Reef
-baseurl=http://MIRROR/centos-stream/SIGs/$stream/storage/$basearch/ceph-reef/
-gpgcheck=1
-enabled=0
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Storage
-
-[centos-nfv-openvswitch]
-name=(OpenDev mirror) CentOS Stream $releasever - NFV OpenvSwitch
-baseurl=http://MIRROR/centos-stream/SIGs/$stream/nfv/$basearch/openvswitch-2/
-gpgcheck=1
-enabled=0
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-NFV
-module_hotfixes=1
-
-[centos-opstools]
-name=(OpenDev mirror) CentOS Stream $releasever - OpsTools - collectd
-baseurl=http://MIRROR/centos-stream/SIGs/$stream/opstools/$basearch/collectd-5/
-gpgcheck=1
-enabled=0
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-OpsTools
-
-[centos-rabbitmq-38]
-name=(OpenDev mirror) CentOS-9 - RabbitMQ 38
-baseurl=http://MIRROR/centos-stream/SIGs/$stream/messaging/$basearch/rabbitmq-38
-gpgcheck=1
-enabled=0
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-SIG-Messaging
-
-[epel]
-name=(OpenDev mirror) Extra Packages for Enterprise Linux $releasever - $basearch
-baseurl=http://MIRROR/epel/$releasever/Everything/$basearch/
-enabled=0
-gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$releasever
diff --git a/kolla/docker/httpd/httpd_setup.sh b/kolla/docker/httpd/httpd_setup.sh
index 35f7b5b1e..5188c5518 100644
--- a/kolla/docker/httpd/httpd_setup.sh
+++ b/kolla/docker/httpd/httpd_setup.sh
@@ -17,7 +17,7 @@ if [[ "$(whoami)" == 'root' ]]; then
         rm -rf /var/run/apache2/*
     else
         rm -rf /var/run/httpd/* /run/httpd/* /tmp/httpd*
-        # NOTE(mmalchuk): This added to make Rocky/Centos similar to Ubuntu/Debian
+        # NOTE(mmalchuk): This added to make Rocky similar to Ubuntu/Debian
         # to provide /server-status handler for local monitoring of the Apache.
         # The module already loaded in the /etc/httpd/conf.modules.d/00-base.conf.
         cat << EOF >/etc/httpd/conf.modules.d/99-server-status.conf
@@ -28,13 +28,13 @@ if [[ "$(whoami)" == 'root' ]]; then
 EOF
     fi
 
-    # CentOS/Rocky have an issue with mod_ssl which produces an invalid Apache
+    # Rocky have an issue with mod_ssl which produces an invalid Apache
     # configuration in /etc/httpd/conf.d/ssl.conf. This causes the following error
     # on startup:
     #   SSLCertificateFile: file '/etc/pki/tls/certs/localhost.crt' does not exist or is empty
     # Work around this by generating certificates manually.
     # NOTE(mnasiadka): in EL9 upgrade jobs gencerts is failing on wrong permissions to dhparams.pem
-    if [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]] && [[ ! -e /etc/pki/tls/certs/localhost.crt ]]; then
+    if [[ "${KOLLA_BASE_DISTRO}" =~ rocky ]] && [[ ! -e /etc/pki/tls/certs/localhost.crt ]]; then
         rm -f /tmp/dhparams.pem
         /usr/libexec/httpd-ssl-gencerts
     fi
diff --git a/kolla/docker/ironic/ironic-pxe/extend_start.sh b/kolla/docker/ironic/ironic-pxe/extend_start.sh
index 8e4d63307..e6100247d 100644
--- a/kolla/docker/ironic/ironic-pxe/extend_start.sh
+++ b/kolla/docker/ironic/ironic-pxe/extend_start.sh
@@ -7,7 +7,7 @@ function prepare_pxe_pxelinux {
         cp /usr/lib/PXELINUX/pxelinux.0 \
            /usr/lib/syslinux/modules/bios/{chain.c32,ldlinux.c32} \
            ${TFTPBOOT_PATH}/
-    elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then
+    elif [[ "${KOLLA_BASE_DISTRO}" =~ rocky ]]; then
         if [[ "${TFTPBOOT_PATH}" != /tftpboot ]]; then
             cp /tftpboot/{pxelinux.0,chain.c32,ldlinux.c32} \
                ${TFTPBOOT_PATH}/
@@ -20,7 +20,7 @@ function prepare_pxe_grub {
     if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu  ]]; then
         shim_src_file="/usr/lib/shim/shim*64.efi.signed"
         grub_src_file="/usr/lib/grub/*-efi-signed/grubnet*64.efi.signed"
-    elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then
+    elif [[ "${KOLLA_BASE_DISTRO}" =~ rocky ]]; then
         shim_src_file="/boot/efi/EFI/${KOLLA_BASE_DISTRO}/shim*64.efi"
         grub_src_file="/boot/efi/EFI/${KOLLA_BASE_DISTRO}/grub*64.efi"
     fi
@@ -49,7 +49,7 @@ function prepare_ipxe {
             ln -sf /boot/ipxe-arm64.efi /usr/lib/ipxe/
         fi
         cp /usr/lib/ipxe/{undionly.kpxe,ipxe*.efi,snponly.efi} ${TFTPBOOT_PATH}/
-    elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then
+    elif [[ "${KOLLA_BASE_DISTRO}" =~ rocky ]]; then
         cp /usr/share/ipxe/{undionly.kpxe,ipxe-snponly-x86_64.efi} ${TFTPBOOT_PATH}/
         cp /usr/share/ipxe/arm64-efi/snponly.efi ${TFTPBOOT_PATH}/ipxe-snponly-aarch64.efi
         ln -sf ${TFTPBOOT_PATH}/ipxe-snponly-${KOLLA_BASE_ARCH}.efi ${TFTPBOOT_PATH}/snponly.efi
@@ -63,7 +63,7 @@ function prepare_esp_image {
     if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then
         shim_src_file="/usr/lib/shim/shim*64.efi.signed"
         grub_src_file="/usr/lib/grub/*-efi-signed/grubnet*64.efi.signed"
-    elif [[ "${KOLLA_BASE_DISTRO}" =~ centos|rocky ]]; then
+    elif [[ "${KOLLA_BASE_DISTRO}" =~ rocky ]]; then
         shim_src_file="/boot/efi/EFI/${KOLLA_BASE_DISTRO}/shim*64.efi"
         grub_src_file="/boot/efi/EFI/${KOLLA_BASE_DISTRO}/grub*64.efi"
     fi
diff --git a/kolla/docker/iscsid/Dockerfile.j2 b/kolla/docker/iscsid/Dockerfile.j2
index 49c8fb9fe..d4f41463c 100644
--- a/kolla/docker/iscsid/Dockerfile.j2
+++ b/kolla/docker/iscsid/Dockerfile.j2
@@ -28,7 +28,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
 {{ macros.install_packages(iscsid_packages | customizable("packages"))  }}
 
 COPY extend_start.sh /usr/local/bin/kolla_extend_start
-# NOTE(hrw): CentOS Stream 9 lacks initiatorname.iscsi file
+# NOTE(hrw): Rocky Linux lacks initiatorname.iscsi file
 RUN chmod 644 /usr/local/bin/kolla_extend_start \
     && rm -f /etc/iscsi/initiatorname.iscsi
 
diff --git a/kolla/docker/keystone/keystone-ssh/extend_start.sh b/kolla/docker/keystone/keystone-ssh/extend_start.sh
index 559cd65a9..a6418b4d9 100644
--- a/kolla/docker/keystone/keystone-ssh/extend_start.sh
+++ b/kolla/docker/keystone/keystone-ssh/extend_start.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# NOTE(mnasiadka): CentOS 10 does not support dsa
+# NOTE(mnasiadka): Rocky 10 does not support dsa
 SSH_HOST_KEY_TYPES=( "rsa" "ecdsa" "ed25519" )
 
 for key_type in ${SSH_HOST_KEY_TYPES[@]}; do
diff --git a/kolla/docker/neutron/neutron-base/extend_start.sh b/kolla/docker/neutron/neutron-base/extend_start.sh
index e2a2dfca4..6e6288ffb 100644
--- a/kolla/docker/neutron/neutron-base/extend_start.sh
+++ b/kolla/docker/neutron/neutron-base/extend_start.sh
@@ -14,7 +14,7 @@ fi
 # so no need to even use u-a on RHEL 9 family as there is one provider
 # (and there is no u-a for ip6tables so script fails)
 
-if [[ ! ${KOLLA_BASE_DISTRO} =~ centos|rocky ]]; then
+if [[ ! ${KOLLA_BASE_DISTRO} =~ rocky ]]; then
     if /usr/bin/update-alternatives --display iptables; then
         # NOTE(yoctozepto): Kolla-Ansible does not always set KOLLA_LEGACY_IPTABLES;
         # the workaround below ensures it gets set to `false` in such cases to fix
diff --git a/kolla/docker/neutron/neutron-l3-agent/extend_start.sh b/kolla/docker/neutron/neutron-l3-agent/extend_start.sh
index f95c1eda2..4c7cd345f 100644
--- a/kolla/docker/neutron/neutron-l3-agent/extend_start.sh
+++ b/kolla/docker/neutron/neutron-l3-agent/extend_start.sh
@@ -12,7 +12,7 @@ fi
 #  nftables framework."
 # so no need to even use u-a on RHEL 9 family as there is one provider
 # (and there is no u-a for ip6tables so script fails)
-if [[ ! ${KOLLA_BASE_DISTRO} =~ centos|rocky ]]; then
+if [[ ! ${KOLLA_BASE_DISTRO} =~ rocky ]]; then
     if /usr/bin/update-alternatives --display iptables; then
         # NOTE(yoctozepto): Kolla-Ansible does not always set KOLLA_LEGACY_IPTABLES;
         # the workaround below ensures it gets set to `false` in such cases to fix
diff --git a/kolla/docker/nova/nova-compute/Dockerfile.j2 b/kolla/docker/nova/nova-compute/Dockerfile.j2
index de8d8062d..864222f11 100644
--- a/kolla/docker/nova/nova-compute/Dockerfile.j2
+++ b/kolla/docker/nova/nova-compute/Dockerfile.j2
@@ -38,7 +38,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
         'xfsprogs'
     ] %}
 
-    # NOTE(hrw): daxio is part of pmdk which is x86-64 only in CentOS 8
+    # NOTE(hrw): daxio is part of pmdk which is x86-64 only in Rocky
     {% if base_arch == 'x86_64' %}
         {% set nova_compute_packages = nova_compute_packages + [
             'daxio'
diff --git a/kolla/docker/ovsdpdk/ovsdpdk/Dockerfile.j2 b/kolla/docker/ovsdpdk/ovsdpdk/Dockerfile.j2
index 0eaf85cf1..fc0b55646 100644
--- a/kolla/docker/ovsdpdk/ovsdpdk/Dockerfile.j2
+++ b/kolla/docker/ovsdpdk/ovsdpdk/Dockerfile.j2
@@ -13,7 +13,7 @@ LABEL maintainer="{{ maintainer }}" name="{{ image_name }}"
 {% if base_package_type == 'rpm' %}
 
 #TODO(sean-k-mooney) create repo via open suse build system to package
-# for centos distro.
+# for rocky distro.
 
 RUN echo 'image not yet available for {{ base_distro }}' \
     && /bin/false
diff --git a/kolla/image/kolla_worker.py b/kolla/image/kolla_worker.py
index acaa08ed0..92908a6c1 100644
--- a/kolla/image/kolla_worker.py
+++ b/kolla/image/kolla_worker.py
@@ -120,7 +120,7 @@ class KollaWorker(object):
                              conf.rpm_setup_config if repo_file is not None])
         self.rpm_setup = self.build_rpm_setup(rpm_setup_config)
 
-        if self.base in ['centos', 'rocky']:
+        if self.base == 'rocky':
             self.distro_package_manager = 'dnf'
             self.base_package_type = 'rpm'
         elif self.base in ['debian']:
diff --git a/kolla/image/unbuildable.py b/kolla/image/unbuildable.py
index 5dbc72094..6d7f4eb5c 100644
--- a/kolla/image/unbuildable.py
+++ b/kolla/image/unbuildable.py
@@ -19,16 +19,6 @@ UNBUILDABLE_IMAGES = {
         "bifrost-base",        # someone need to get upstream working first
     },
 
-    # Issues for SHA1 keys:
-    # https://github.com/grafana/grafana/issues/41036
-    'centos': {
-        "collectd",              # CS10 no opstools repo
-        "hacluster-pcs",         # Missing crmsh package
-        "nova-spicehtml5proxy",  # Missing spicehtml5 package
-        "ovsdpdk",               # Not supported on CentOS
-        "tgtd",                  # Not supported on CentOS
-    },
-
     'debian': {
     },
 
@@ -36,8 +26,8 @@ UNBUILDABLE_IMAGES = {
         "collectd",              # Missing libpqos.so.4()(64bit)
         "hacluster-pcs",         # Missing crmsh package
         "nova-spicehtml5proxy",  # Missing spicehtml5 package
-        "ovsdpdk",               # Not supported on CentOS
-        "tgtd",                  # Not supported on CentOS
+        "ovsdpdk",               # Not supported on Rocky
+        "tgtd",                  # Not supported on Rocky
     },
 
     'ubuntu': {
@@ -45,7 +35,4 @@ UNBUILDABLE_IMAGES = {
 
     'ubuntu+aarch64': {
     },
-
-    'centos+aarch64': {
-    },
 }
diff --git a/kolla/template/methods.py b/kolla/template/methods.py
index fcef7ae11..461003fa0 100644
--- a/kolla/template/methods.py
+++ b/kolla/template/methods.py
@@ -161,11 +161,11 @@ def handle_repos(context, reponames, mode):
 
     Repo names are distro/arch-agnostic aliases that map to the real repo
     name and URL for the target platform.  So 'ceph' becomes
-    'centos-ceph-squid' on CentOS, uses UCA on Ubuntu, and so on.
+    'centos-ceph-squid' on Rocky, uses UCA on Ubuntu, and so on.
     Distro/arch sections are not required to have all entries - missing ones
     are silently ignored.
 
-    NOTE(hrw): we need to handle CentOS, Debian and Ubuntu with one macro.
+    NOTE(hrw): we need to handle Debian, Rocky and Ubuntu with one macro.
     """
 
     if not isinstance(reponames, list):
diff --git a/kolla/template/repos.yaml b/kolla/template/repos.yaml
index 42e0185c4..1ae76d137 100644
--- a/kolla/template/repos.yaml
+++ b/kolla/template/repos.yaml
@@ -195,24 +195,6 @@ rpm:
       https://github.com/rabbitmq/signing-keys/releases/download/3.0/rabbitmq-release-signing-key.asc
     name: "rabbitmq_rabbitmq-server"
 
-centos:
-  appstream:
-    distro: True
-    file_group: "centos.repo"
-    name: "appstream"
-  baseos:
-    distro: True
-    file_group: "centos.repo"
-    name: "baseos"
-  crb:
-    file_group: "centos.repo"
-
-centos-aarch64:
-  erlang:
-    baseurl: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/rabbitmq-erlang-27/rhel-$releasever-aarch64/"
-    gpgkey: "https://download.copr.fedorainfracloud.org/results/@openstack-kolla/rabbitmq-erlang-27/pubkey.gpg"
-    name: "copr-rabbitmq-erlang"
-
 rocky:
   appstream:
     distro: True
diff --git a/kolla/tests/test_build.py b/kolla/tests/test_build.py
index 21f7fc59c..0ada46eb6 100644
--- a/kolla/tests/test_build.py
+++ b/kolla/tests/test_build.py
@@ -820,7 +820,7 @@ class KollaWorkerTest(base.TestCase):
         self.mock_client = patcher.start()
 
     def test_supported_base_distro(self):
-        build_base = ['centos', 'debian', 'ubuntu']
+        build_base = ['debian', 'rocky', 'ubuntu']
 
         for base_distro in build_base:
             self.conf.set_override('base', base_distro)
diff --git a/kolla/tests/test_methods.py b/kolla/tests/test_methods.py
index 1e30f1f9b..9b5dd212a 100644
--- a/kolla/tests/test_methods.py
+++ b/kolla/tests/test_methods.py
@@ -27,10 +27,10 @@ class MethodsTest(base.TestCase):
         expectCmd = 'apt-get -y install --no-install-recommends package2.deb'
         self.assertEqual(expectCmd, result.split("&&")[1].strip())
 
-    def test_enable_repos_centos_baseurl(self):
+    def test_enable_repos_rocky_baseurl(self):
         template_vars = {
             'base_arch': 'x86_64',
-            'base_distro': 'centos',
+            'base_distro': 'rocky',
             'base_package_type': 'rpm',
         }
 
@@ -49,10 +49,10 @@ class MethodsTest(base.TestCase):
         expectCmd += ">>/etc/yum.repos.d/grafana.repo"
         self.assertEqual(expectCmd, result)
 
-    def test_enable_repos_centos_ceph_distro(self):
+    def test_enable_repos_rocky_ceph_distro(self):
         template_vars = {
             'base_arch': 'x86_64',
-            'base_distro': 'centos',
+            'base_distro': 'rocky',
             'base_package_type': 'rpm',
         }
 
@@ -60,10 +60,10 @@ class MethodsTest(base.TestCase):
         expectCmd = "RUN dnf config-manager --enable centos-ceph-squid || true"
         self.assertEqual(expectCmd, result)
 
-    def test_enable_repos_centos_arch(self):
+    def test_enable_repos_rocky_arch(self):
         template_vars = {
             "base_arch": "aarch64",
-            "base_distro": "centos",
+            "base_distro": "rocky",
             "base_package_type": "rpm",
         }
 
@@ -82,10 +82,10 @@ class MethodsTest(base.TestCase):
         expectCmd += ">>/etc/yum.repos.d/grafana.repo"
         self.assertEqual(expectCmd, result)
 
-    def test_enable_repos_centos_multiple(self):
+    def test_enable_repos_rocky_multiple(self):
         template_vars = {
             "base_arch": "x86_64",
-            "base_distro": "centos",
+            "base_distro": "rocky",
             "base_package_type": "rpm",
         }
 
@@ -122,10 +122,10 @@ class MethodsTest(base.TestCase):
         expectCmd += ">>/etc/yum.repos.d/rabbitmq.repo"
         self.assertEqual(expectCmd, result)
 
-    def test_enable_repos_centos_distro_enable(self):
+    def test_enable_repos_rocky_distro_enable(self):
         template_vars = {
             "base_arch": "x86_64",
-            "base_distro": "centos",
+            "base_distro": "rocky",
             "base_package_type": "rpm",
         }
 
@@ -134,10 +134,10 @@ class MethodsTest(base.TestCase):
         expectCmd = "RUN dnf config-manager --enable crb || true"
         self.assertEqual(expectCmd, result)
 
-    def test_enable_repos_centos_distro_disable(self):
+    def test_enable_repos_rocky_distro_disable(self):
         template_vars = {
             "base_arch": "x86_64",
-            "base_distro": "centos",
+            "base_distro": "rocky",
             "base_package_type": "rpm",
         }
 
@@ -145,10 +145,10 @@ class MethodsTest(base.TestCase):
         expectCmd = "RUN dnf config-manager --disable crb || true"
         self.assertEqual(expectCmd, result)
 
-    def test_enable_repos_centos_distro_enable_multiple(self):
+    def test_enable_repos_rocky_distro_enable_multiple(self):
         template_vars = {
             "base_arch": "x86_64",
-            "base_distro": "centos",
+            "base_distro": "rocky",
             "base_package_type": "rpm",
         }
 
@@ -316,17 +316,28 @@ class MethodsTest(base.TestCase):
                 'Signed-By: /usr/share/keyrings/test.gpg', result)
 
     def test_repos_yaml_merge_keeps_default_repos(self):
-        repos = {'rocky': {'baseos': {
-            'name': 'baseos',
-            'baseurl': 'http://mirror.example.com/rocky/10/BaseOS/$basearch/',
-            'gpgkey': 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10',
-        }}}
+        mirror_url = ("http://mirror.example.com/rocky/10/{component}/"
+                      "$basearch/")
+        repos = {'rocky': {
+            'appstream': {
+                'name': 'appstream',
+                'baseurl': mirror_url.format(component='AppStream'),
+                'gpgkey': 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10'},
+            'baseos': {
+                'name': 'baseos',
+                'baseurl': mirror_url.format(component='BaseOS'),
+                'gpgkey': 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10'},
+            'crb': {
+                'name': 'crb',
+                'baseurl': mirror_url.format(component='CRB'),
+                'gpgkey': 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-10'},
+        }}
         with tempfile.NamedTemporaryFile(mode='w', suffix='.yaml') as f:
             yaml.dump(repos, f)
             f.flush()
             template_vars = {
                 'base_arch': 'x86_64',
-                'base_distro': 'centos',
+                'base_distro': 'rocky',
                 'base_package_type': 'rpm',
                 'repos_yaml': f.name,
             }
@@ -375,7 +386,7 @@ class MethodsTest(base.TestCase):
             f.flush()
             template_vars = {
                 'base_arch': 'x86_64',
-                'base_distro': 'centos',
+                'base_distro': 'rocky',
                 'base_package_type': 'rpm',
                 'repos_yaml': f.name,
             }
@@ -392,7 +403,7 @@ class MethodsTest(base.TestCase):
             f.flush()
             template_vars = {
                 'base_arch': 'x86_64',
-                'base_distro': 'centos',
+                'base_distro': 'rocky',
                 'base_package_type': 'rpm',
                 'repos_yaml': f.name,
             }
@@ -778,7 +789,7 @@ class MethodsTest(base.TestCase):
         The more-specific distro section must not merge distro:True back
         on top of a URL-bearing override from the generic 'rpm' section.
         """
-        base = 'http://mirror.example.com/centos/10'
+        base = 'http://mirror.example.com/rocky/10'
         gpgkey = 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial'
         repos = {'rpm': {
             'baseos': {
@@ -802,7 +813,7 @@ class MethodsTest(base.TestCase):
             f.flush()
             template_vars = {
                 'base_arch': 'x86_64',
-                'base_distro': 'centos',
+                'base_distro': 'rocky',
                 'base_package_type': 'rpm',
                 'repos_yaml': f.name,
             }
diff --git a/releasenotes/notes/drop-centos10-c53c4eee6f8253d0.yaml b/releasenotes/notes/drop-centos10-c53c4eee6f8253d0.yaml
new file mode 100644
index 000000000..69cd340e1
--- /dev/null
+++ b/releasenotes/notes/drop-centos10-c53c4eee6f8253d0.yaml
@@ -0,0 +1,6 @@
+---
+upgrade:
+  - |
+    Support for ``CentOS Stream 10`` has been dropped. Users using
+    ``base_centos_*`` override blocks should adapt them to
+    ``base_rocky_*``.
diff --git a/tests/files/process_build_logs.py b/tests/files/process_build_logs.py
index 0db5228d9..248acf954 100755
--- a/tests/files/process_build_logs.py
+++ b/tests/files/process_build_logs.py
@@ -30,7 +30,7 @@ parser.add_argument('-b', '--base',
                     required=True)
 args = vars(parser.parse_args())
 
-if args['base'] not in ['rocky', 'centos']:
+if args['base'] != 'rocky':
     print("Non rpm-based distros are not yet supported.")
     sys.exit()
 
diff --git a/tests/vars/zuul.yml b/tests/vars/zuul.yml
index dbcc01d19..b2962b85b 100644
--- a/tests/vars/zuul.yml
+++ b/tests/vars/zuul.yml
@@ -3,7 +3,6 @@ nodepool_rdo_proxy: "http://{{ zuul_site_mirror_fqdn }}:8080/rdo"
 nodepool_pypi_mirror: "http://{{ zuul_site_mirror_fqdn }}:8080/pypi/simple"
 nodepool_mirror_host: "{{ zuul_site_mirror_fqdn }}"
 nodepool_npmjs_proxy: "http://{{ zuul_site_mirror_fqdn }}:8080/registry.npmjs/"
-nodepool_cbs_centos_proxy: "http://{{ zuul_site_mirror_fqdn }}:8080/cbs.centos"
 nodepool_docker_proxy: "http://{{ zuul_site_mirror_fqdn }}:8080/docker"
 
 # NOTE(hrw): wheel cache goes over 80/443 not on 8080
diff --git a/zuul.d/centos.yaml b/zuul.d/centos.yaml
deleted file mode 100644
index 3c48f9e0c..000000000
--- a/zuul.d/centos.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
----
-- job:
-    name: kolla-build-centos-10s
-    parent: kolla-base
-    nodeset: kolla-centos-10s-8GB
-    voting: false
-
-- job:
-    name: kolla-build-centos-10s-arm64
-    parent: kolla-build-centos-10s
-    nodeset: kolla-centos-10s-arm64-8GB
-    voting: false
-
-- job:
-    name: kolla-build-centos-10s-no-infra-wheels
-    parent: kolla-build-no-infra-wheels-base
-    nodeset: kolla-centos-10s-8GB
-
-- project-template:
-    name: kolla-build-centos
-    description: |
-      Runs Kolla CentOS build jobs.
-    check:
-      jobs:
-        - kolla-build-centos-10s
-    check-arm64:
-      jobs:
-        - kolla-build-centos-10s-arm64
-    experimental:
-      jobs:
-        - kolla-build-centos-10s-no-infra-wheels
diff --git a/zuul.d/nodesets.yaml b/zuul.d/nodesets.yaml
index 1c85b45fb..ccb3513f0 100644
--- a/zuul.d/nodesets.yaml
+++ b/zuul.d/nodesets.yaml
@@ -1,17 +1,5 @@
 ---
 - nodeset:
-    name: kolla-centos-10s-8GB
-    nodes:
-      - name: primary
-        label: centos-10-stream-8GB
-
-- nodeset:
-    name: kolla-centos-10s-arm64-8GB
-    nodes:
-      - name: primary
-        label: centos-10-stream-arm64-8GB
-
-- nodeset:
     name: kolla-debian-bookworm-8GB
     nodes:
       - name: primary
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
index 62cd45f1b..3f6590f90 100644
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@@ -5,7 +5,6 @@
 - project:
     templates:
       - check-requirements
-      - kolla-build-centos
       - kolla-build-debian
       - kolla-build-rocky
       - kolla-build-ubuntu
diff --git a/zuul.d/scenarios/aio.yaml b/zuul.d/scenarios/aio.yaml
index f5acd08c2..0d2258848 100644
--- a/zuul.d/scenarios/aio.yaml
+++ b/zuul.d/scenarios/aio.yaml
@@ -5,11 +5,10 @@
       Runs Kolla-Ansible AIO jobs on all Kolla changes.
     check:
       jobs:
-        - kolla-ansible-centos-10s: &files
+        - kolla-ansible-debian-trixie: &files
             files:
               - ^kolla/common/sources.yaml
               - ^kolla/docker/
-        - kolla-ansible-debian-trixie: *files
         - kolla-ansible-debian-trixie-upgrade: *files
         - kolla-ansible-rocky-10: *files
         - kolla-ansible-rocky-10-upgrade: *files
@@ -17,7 +16,6 @@
         - kolla-ansible-ubuntu-noble-upgrade: *files
     check-arm64:
       jobs:
-        - kolla-ansible-centos-10s-aarch64: *files
         - kolla-ansible-debian-trixie-aarch64: *files
     gate:
       jobs: