From 14e033eaf268d3dc0f37bd86cb527916226ad473 Mon Sep 17 00:00:00 2001
From: Shimon Shtein <sshtein@redhat.com>
Date: Thu, 18 Jun 2026 16:22:20 +0300
Subject: [PATCH] Switch to postgres 16 image

---
 .../playbooks/remote-database/remote-database.yaml   |  1 +
 src/roles/postgresql/tasks/main.yml                  | 12 ------------
 src/roles/pre_install/tasks/main.yaml                | 11 +++++++++++
 src/vars/images.yml                                  |  2 +-
 4 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/development/playbooks/remote-database/remote-database.yaml b/development/playbooks/remote-database/remote-database.yaml
index ab0cce1d9..8ce9b7ffd 100644
--- a/development/playbooks/remote-database/remote-database.yaml
+++ b/development/playbooks/remote-database/remote-database.yaml
@@ -7,6 +7,7 @@
     - "../../../src/vars/defaults.yml"
     - "../../../src/vars/flavors/{{ flavor }}.yml"
     - "../../../src/vars/database.yml"
+    - "../../../src/vars/images.yml"
   vars:
     certificates_hostnames:
       - "{{ ansible_facts['fqdn'] }}"
diff --git a/src/roles/postgresql/tasks/main.yml b/src/roles/postgresql/tasks/main.yml
index 755e13190..24a95fc38 100644
--- a/src/roles/postgresql/tasks/main.yml
+++ b/src/roles/postgresql/tasks/main.yml
@@ -107,18 +107,6 @@
     name: "{{ postgresql_container_name }}"
     state: started
 
-# SCRAM-SHA-256 is default for PostgreSQL 14+,
-# after the upgrade, we can drop this task.
-- name: Use scram-sha-256 for password encryption
-  community.postgresql.postgresql_set:
-    login_user: postgres
-    login_password: "{{ postgresql_admin_password }}"
-    login_host: localhost
-    name: password_encryption
-    value: "scram-sha-256"
-  notify:
-    - Restart postgresql
-
 - name: Create PostgreSQL users
   community.postgresql.postgresql_user:
     name: "{{ item.name }}"
diff --git a/src/roles/pre_install/tasks/main.yaml b/src/roles/pre_install/tasks/main.yaml
index e4b576768..cfde05e68 100644
--- a/src/roles/pre_install/tasks/main.yaml
+++ b/src/roles/pre_install/tasks/main.yaml
@@ -3,6 +3,17 @@
   ansible.builtin.include_role:
     name: debug_tools
 
+- name: 'Enable postgresql:16 module'
+  ansible.builtin.command: dnf module enable -y postgresql:16
+  # can't use the `dnf` module for modules without a default stream
+  # https://github.com/ansible/ansible/issues/56504
+  # https://github.com/ansible/ansible/issues/64852
+  args:
+    creates: /etc/dnf/modules.d/postgresql.module
+  when:
+    - ansible_facts['os_family'] == 'RedHat'
+    - ansible_facts['distribution_major_version'] == '9'
+
 - name: Install podman
   ansible.builtin.package:
     name:
diff --git a/src/vars/images.yml b/src/vars/images.yml
index 53694f45b..b7b6fe0a0 100644
--- a/src/vars/images.yml
+++ b/src/vars/images.yml
@@ -9,7 +9,7 @@ foreman_container_tag: "{{ container_tag_stream }}"
 foreman_proxy_container_image: "quay.io/foreman/foreman-proxy"
 foreman_proxy_container_tag: "{{ container_tag_stream }}"
 
-postgresql_container_image: quay.io/sclorg/postgresql-13-c9s
+postgresql_container_image: quay.io/sclorg/postgresql-16-c10s
 postgresql_container_tag: "latest"
 pulp_container_image: quay.io/foreman/pulp
 pulp_container_tag: "foreman-{{ container_tag_stream }}"