diff --git a/ansible/inventory/group_vars/all/bifrost b/ansible/inventory/group_vars/all/bifrost
index c24ca67d3..d780cfb10 100644
--- a/ansible/inventory/group_vars/all/bifrost
+++ b/ansible/inventory/group_vars/all/bifrost
@@ -29,10 +29,10 @@ kolla_bifrost_dib_os_element: "{{ os_distribution }}"
 kolla_bifrost_dib_os_release: "{{ os_release }}"
 
 # List of default DIB elements. Default is ["disable-selinux",
-# "enable-serial-console", "vm"] when os_distribution is "centos", or
+# "enable-serial-console", "vm"] when os_distribution is "centos" or "rocky",
 # ["enable-serial-console", "vm"] otherwise.
 kolla_bifrost_dib_elements_default:
-  - "{% if os_distribution == 'centos' %}disable-selinux{% endif %}"
+  - "{% if os_distribution in ['centos', 'rocky'] %}disable-selinux{% endif %}"
   - "enable-serial-console"
   - "vm"
 
diff --git a/ansible/inventory/group_vars/all/dnf b/ansible/inventory/group_vars/all/dnf
index 64a7c249e..f8a7fade4 100644
--- a/ansible/inventory/group_vars/all/dnf
+++ b/ansible/inventory/group_vars/all/dnf
@@ -7,23 +7,23 @@ dnf_config: {}
 # Whether or not to use a local Yum mirror. Default value is 'false'.
 dnf_use_local_mirror: false
 
-# Mirror FQDN for Yum CentOS repos. Default value is 'mirror.centos.org'.
-dnf_centos_mirror_host: 'mirror.centos.org'
+# Mirror FQDN for DNF CentOS repos. Default value is 'mirror.stream.centos.org'.
+dnf_centos_mirror_host: 'mirror.stream.centos.org'
 
-# Mirror directory for Yum CentOS repos. Default value is 'centos'.
-dnf_centos_mirror_directory: 'centos'
+# Mirror directory for DNF CentOS repos. Default value is ''.
+dnf_centos_mirror_directory: ''
 
-# Mirror FQDN for Yum Rocky repos. Default value is 'dl.rockylinux.org'.
+# Mirror FQDN for DNF Rocky repos. Default value is 'dl.rockylinux.org'.
 dnf_rocky_mirror_host: 'dl.rockylinux.org'
 
-# Mirror directory for Yum Rocky repos. Default value is 'pub/rocky'.
+# Mirror directory for DNF Rocky repos. Default value is 'pub/rocky'.
 dnf_rocky_mirror_directory: 'pub/rocky'
 
-# Mirror FQDN for Yum EPEL repos. Default value is
+# Mirror FQDN for DNF EPEL repos. Default value is
 # 'download.fedoraproject.org'.
 dnf_epel_mirror_host: 'download.fedoraproject.org'
 
-# Mirror directory for Yum EPEL repos. Default value is 'pub/epel'.
+# Mirror directory for DNF EPEL repos. Default value is 'pub/epel'.
 dnf_epel_mirror_directory: 'pub/epel'
 
 # A dict of custom repositories.
diff --git a/ansible/inventory/group_vars/all/globals b/ansible/inventory/group_vars/all/globals
index f3d4cdd3f..821d7cbbc 100644
--- a/ansible/inventory/group_vars/all/globals
+++ b/ansible/inventory/group_vars/all/globals
@@ -45,15 +45,15 @@ kayobe_ansible_user: "stack"
 # OS distribution.
 
 # OS distribution name. Valid options are "centos", "rocky", "ubuntu". Default
-# is "centos".
-os_distribution: "centos"
+# is "rocky".
+os_distribution: "rocky"
 
-# OS release. Valid options are "8-stream" when os_distribution is "centos", or
-# "8" when os_distribution is "rocky", or "jammy" when os_distribution is
+# OS release. Valid options are "9-stream" when os_distribution is "centos", or
+# "9" when os_distribution is "rocky", or "jammy" when os_distribution is
 # "ubuntu".
 os_release: >-
-  {{ '8-stream' if os_distribution == 'centos'
-  else '8' if os_distribution == 'rocky'
+  {{ '9-stream' if os_distribution == 'centos'
+  else '9' if os_distribution == 'rocky'
   else 'jammy' }}
 
 ###############################################################################
diff --git a/ansible/inventory/group_vars/all/infra-vms b/ansible/inventory/group_vars/all/infra-vms
index 745347f84..600f828cd 100644
--- a/ansible/inventory/group_vars/all/infra-vms
+++ b/ansible/inventory/group_vars/all/infra-vms
@@ -43,18 +43,18 @@ infra_vm_root_format: qcow2
 # Base image for the infra VM root volume. Default is
 # "https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img"
 # when os_distribution is "ubuntu", or
-# https://dl.rockylinux.org/pub/rocky/8/images/Rocky-8-GenericCloud.latest.x86_64.qcow2
+# https://dl.rockylinux.org/pub/rocky/9/images/x86_64/Rocky-9-GenericCloud.latest.x86_64.qcow2
 # when os_distribution is "rocky",
 # or
-# "https://cloud.centos.org/centos/8-stream/x86_64/images/CentOS-Stream-GenericCloud-8-20220913.0.x86_64.qcow2"
+# "https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20221206.0.x86_64.qcow2"
 # otherwise.
 infra_vm_root_image: >-
   {%- if os_distribution == 'ubuntu' %}
   https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img
   {%- elif os_distribution == 'rocky' %}
-  https://dl.rockylinux.org/pub/rocky/8/images/Rocky-8-GenericCloud.latest.x86_64.qcow2
+  https://dl.rockylinux.org/pub/rocky/9/images/x86_64/Rocky-9-GenericCloud.latest.x86_64.qcow2
   {%- else -%}
-  https://cloud.centos.org/centos/8-stream/x86_64/images/CentOS-Stream-GenericCloud-8-20220913.0.x86_64.qcow2
+  https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20221206.0.x86_64.qcow2
   {%- endif %}
 
 # Capacity of the infra VM data volume.
@@ -74,7 +74,7 @@ infra_vm_hypervisor: "{{ groups['seed-hypervisor'] | first }}"
 infra_vm_wait_connection_ssh_extra_args: '-o StrictHostKeyChecking=no'
 
 # OS family. Needed for config drive generation.
-infra_vm_os_family: "{{ 'RedHat' if os_distribution == 'centos' else 'Debian' }}"
+infra_vm_os_family: "{{ 'RedHat' if os_distribution in ['centos', 'rocky'] else 'Debian' }}"
 
 ###############################################################################
 # Infrastructure VM node configuration.
diff --git a/ansible/inventory/group_vars/all/ipa b/ansible/inventory/group_vars/all/ipa
index 39879a5f1..050b76108 100644
--- a/ansible/inventory/group_vars/all/ipa
+++ b/ansible/inventory/group_vars/all/ipa
@@ -47,11 +47,9 @@ ipa_build_dib_elements: >
 ipa_build_dib_env_default:
   # TODO(mgoddard): Use {{ os_release }} here when we use os_distribution
   # above.
-  DIB_RELEASE: "8-stream"
+  DIB_RELEASE: "9-stream"
   DIB_REPOLOCATION_ironic_python_agent: "{{ ipa_build_source_url }}"
   DIB_REPOREF_ironic_python_agent: "{{ ipa_build_source_version }}"
-  # TODO(priteau): Revert once we use c9s.
-  DIB_REPOREF_requirements: "stable/yoga"
 
 # Dictionary of additional environment variables to provide to Diskimage
 # Builder (DIB) during IPA image build.
@@ -103,7 +101,7 @@ ipa_images_upstream_url_suffix: "-{{ openstack_branch | replace('/', '-') }}"
 ipa_images_kernel_name: "ipa.kernel"
 
 # URL of Ironic deployment kernel image to download.
-ipa_kernel_upstream_url: "https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos8{{ ipa_images_upstream_url_suffix }}.kernel"
+ipa_kernel_upstream_url: "https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{ ipa_images_upstream_url_suffix }}.kernel"
 
 # URL of checksum of Ironic deployment kernel image.
 ipa_kernel_checksum_url: "{{ ipa_kernel_upstream_url }}.{{ ipa_kernel_checksum_algorithm }}"
@@ -115,7 +113,7 @@ ipa_kernel_checksum_algorithm: "sha256"
 ipa_images_ramdisk_name: "ipa.initramfs"
 
 # URL of Ironic deployment ramdisk image to download.
-ipa_ramdisk_upstream_url: "https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos8{{ ipa_images_upstream_url_suffix }}.initramfs"
+ipa_ramdisk_upstream_url: "https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{ ipa_images_upstream_url_suffix }}.initramfs"
 
 # URL of checksum of Ironic deployment ramdisk image.
 ipa_ramdisk_checksum_url: "{{ ipa_ramdisk_upstream_url }}.{{ ipa_ramdisk_checksum_algorithm }}"
diff --git a/ansible/inventory/group_vars/all/kolla b/ansible/inventory/group_vars/all/kolla
index 8ce83f463..c1298955e 100644
--- a/ansible/inventory/group_vars/all/kolla
+++ b/ansible/inventory/group_vars/all/kolla
@@ -53,9 +53,8 @@ kolla_node_custom_config_path: "{{ kolla_config_path }}/config"
 # Kolla configuration.
 
 # Kolla base container image distribution. Options are "centos", "debian",
-# "rocky", "ubuntu". Default is
-# {{ 'centos' if os_distribution == 'rocky' else os_distribution }}.
-kolla_base_distro: "{{ 'centos' if os_distribution == 'rocky' else os_distribution }}"
+# "rocky", "ubuntu". Default is {{ os_distribution }}.
+kolla_base_distro: "{{ os_distribution }}"
 
 # Kolla base container image distribution version default map.
 # Defines default versions for each distribution.
diff --git a/ansible/inventory/group_vars/all/seed-vm b/ansible/inventory/group_vars/all/seed-vm
index 0752ce1fe..8f63d0e83 100644
--- a/ansible/inventory/group_vars/all/seed-vm
+++ b/ansible/inventory/group_vars/all/seed-vm
@@ -43,18 +43,18 @@ seed_vm_root_format: qcow2
 # Base image for the seed VM root volume. Default is
 # "https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img"
 # when os_distribution is "ubuntu",
-# https://dl.rockylinux.org/pub/rocky/8/images/Rocky-8-GenericCloud.latest.x86_64.qcow2
+# https://dl.rockylinux.org/pub/rocky/9/images/x86_64/Rocky-9-GenericCloud.latest.x86_64.qcow2
 # when os_distribution is "rocky",
 # or
-# "https://cloud.centos.org/centos/8-stream/x86_64/images/CentOS-Stream-GenericCloud-8-20220913.0.x86_64.qcow2"
+# "https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20221206.0.x86_64.qcow2"
 # otherwise.
 seed_vm_root_image: >-
   {%- if os_distribution == 'ubuntu' %}
   https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img
   {%- elif os_distribution == 'rocky' %}
-  https://dl.rockylinux.org/pub/rocky/8/images/Rocky-8-GenericCloud.latest.x86_64.qcow2
+  https://dl.rockylinux.org/pub/rocky/9/images/x86_64/Rocky-9-GenericCloud.latest.x86_64.qcow2
   {%- else -%}
-  https://cloud.centos.org/centos/8-stream/x86_64/images/CentOS-Stream-GenericCloud-8-20220913.0.x86_64.qcow2
+  https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20221206.0.x86_64.qcow2
   {%- endif %}
 
 # Capacity of the seed VM data volume.
diff --git a/ansible/kayobe-target-venv.yml b/ansible/kayobe-target-venv.yml
index 14a8b8761..a3282f787 100644
--- a/ansible/kayobe-target-venv.yml
+++ b/ansible/kayobe-target-venv.yml
@@ -24,13 +24,14 @@
           when: not ansible_facts
           register: gather_facts
 
-        - name: Ensure the Python virtualenv package is installed
+        - name: Ensure the Python venv package is installed on Debian family systems
           package:
-            name: python3-virtualenv
+            name: python3-venv
             state: present
-            cache_valid_time: "{{ apt_cache_valid_time if ansible_facts.os_family == 'Debian' else omit }}"
-            update_cache: "{{ True if ansible_facts.os_family == 'Debian' else omit }}"
+            cache_valid_time: "{{ apt_cache_valid_time }}"
+            update_cache: "True"
           become: True
+          when: ansible_facts.os_family == 'Debian'
 
         - name: Ensure global virtualenv directory exists
           file:
@@ -61,7 +62,7 @@
             # Site packages are required for using the dnf module, which is not
             # available via PyPI.
             virtualenv_site_packages: True
-            virtualenv_python: "python3.{{ ansible_facts.python.version.minor }}"
+            virtualenv_command: "python3.{{ ansible_facts.python.version.minor }} -m venv"
 
         - name: Ensure kayobe virtualenv has SELinux bindings installed
           pip:
diff --git a/ansible/kolla-target-venv.yml b/ansible/kolla-target-venv.yml
index 7fd9e3dc6..37305d3aa 100644
--- a/ansible/kolla-target-venv.yml
+++ b/ansible/kolla-target-venv.yml
@@ -25,13 +25,14 @@
             gather_subset: "{{ kayobe_ansible_setup_gather_subset }}"
           when: not ansible_facts
 
-        - name: Ensure the Python virtualenv package is installed
+        - name: Ensure the Python venv package is installed on Debian family systems
           package:
-            name: python3-virtualenv
+            name: python3-venv
             state: present
-            cache_valid_time: "{{ apt_cache_valid_time if ansible_facts.os_family == 'Debian' else omit }}"
-            update_cache: "{{ True if ansible_facts.os_family == 'Debian' else omit }}"
+            cache_valid_time: "{{ apt_cache_valid_time }}"
+            update_cache: "True"
           become: True
+          when: ansible_facts.os_family == 'Debian'
 
         - name: Ensure kolla-ansible virtualenv has the latest version of pip installed
           pip:
@@ -41,7 +42,7 @@
             # Site packages are required for using the dnf python module, which
             # is not available via PyPI.
             virtualenv_site_packages: True
-            virtualenv_python: "python3.{{ ansible_facts.python.version.minor }}"
+            virtualenv_command: "python3.{{ ansible_facts.python.version.minor }} -m venv"
           become: True
 
         - name: Ensure kolla-ansible virtualenv has docker SDK for python installed
diff --git a/ansible/roles/dnf/defaults/main.yml b/ansible/roles/dnf/defaults/main.yml
index 99c075d31..24bc4acf1 100644
--- a/ansible/roles/dnf/defaults/main.yml
+++ b/ansible/roles/dnf/defaults/main.yml
@@ -7,11 +7,17 @@ dnf_config: {}
 # Whether or not to use a local DNF mirror.
 dnf_use_local_mirror: false
 
-# Mirror FQDN for DNF repos.
-dnf_centos_mirror_host: 'mirror.centos.org'
+# Mirror FQDN for DNF CentOS repos. Default value is 'mirror.stream.centos.org'.
+dnf_centos_mirror_host: 'mirror.stream.centos.org'
 
-# Mirror directory for DNF CentOS repos.
-dnf_centos_mirror_directory: 'centos'
+# Mirror directory for DNF CentOS repos. Default value is ''.
+dnf_centos_mirror_directory: ''
+
+# Mirror FQDN for DNF Rocky repos. Default value is 'dl.rockylinux.org'.
+dnf_rocky_mirror_host: 'dl.rockylinux.org'
+
+# Mirror directory for DNF Rocky repos. Default value is 'pub/rocky'.
+dnf_rocky_mirror_directory: 'pub/rocky'
 
 # Mirror FQDN for DNF EPEL repos.
 dnf_epel_mirror_host: 'download.fedoraproject.org'
diff --git a/ansible/roles/dnf/tasks/local-mirror.yml b/ansible/roles/dnf/tasks/local-mirror.yml
index 7dc7b6899..98241efa3 100644
--- a/ansible/roles/dnf/tasks/local-mirror.yml
+++ b/ansible/roles/dnf/tasks/local-mirror.yml
@@ -1,7 +1,7 @@
 ---
 - name: Copy CentOS repo templates
   vars:
-    repo_file_prefix: "{{ 'CentOS-Stream' if ansible_facts.distribution == 'CentOS' else 'Rocky' }}"
+    repo_file_prefix: "{{ ansible_facts.distribution }}{% if ansible_facts.distribution == 'CentOS'%}-Stream{% endif %}"
   template:
     src: "{{ item }}.j2"
     dest: /etc/yum.repos.d/{{ item }}
@@ -14,17 +14,6 @@
     - "{{ repo_file_prefix }}-BaseOS.repo"
     - "{{ repo_file_prefix }}-Extras.repo"
 
-- name: Remove old (pre CentOS 8.3) repo files
-  file:
-    path: /etc/yum.repos.d/{{ item }}
-    state: absent
-  become: True
-  loop:
-    - CentOS-AppStream.repo
-    - CentOS-Base.repo
-    - CentOS-Extras.repo
-  when: ansible_facts.distribution == 'CentOS'
-
 - name: Update cache
   dnf:
     name: []
@@ -50,7 +39,6 @@
   become: True
   loop:
     - epel.repo
-    - epel-modular.repo
   when: dnf_install_epel | bool
 
 - name: Update cache
diff --git a/ansible/roles/dnf/templates/CentOS-Stream-Extras.repo.j2 b/ansible/roles/dnf/templates/CentOS-Stream-Extras.repo.j2
index d6b711c17..399bf2028 100644
--- a/ansible/roles/dnf/templates/CentOS-Stream-Extras.repo.j2
+++ b/ansible/roles/dnf/templates/CentOS-Stream-Extras.repo.j2
@@ -10,7 +10,7 @@
 
 [extras]
 name=CentOS Stream $releasever - Extras
-baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/$stream/extras/$basearch/os/
+baseurl=http://{{ dnf_centos_mirror_host }}/{{ dnf_centos_mirror_directory }}/SIGs/$stream/extras/$basearch/extras-common/
 gpgcheck=1
 enabled=1
 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
diff --git a/ansible/roles/dnf/templates/epel-modular.repo.j2 b/ansible/roles/dnf/templates/epel-modular.repo.j2
deleted file mode 100644
index d48af36b1..000000000
--- a/ansible/roles/dnf/templates/epel-modular.repo.j2
+++ /dev/null
@@ -1,23 +0,0 @@
-[epel-modular]
-name=Extra Packages for Enterprise Linux Modular $releasever - $basearch
-baseurl=http://{{ dnf_epel_mirror_host }}/{{ dnf_epel_mirror_directory }}/$releasever/Modular/$basearch
-enabled=1
-gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-8
-fastestmirror=0
-
-[epel-modular-debuginfo]
-name=Extra Packages for Enterprise Linux Modular $releasever - $basearch - Debug
-baseurl=http://{{ dnf_epel_mirror_host }}/{{ dnf_epel_mirror_directory }}/$releasever/Modular/$basearch/debug
-enabled=0
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-8
-gpgcheck=1
-fastestmirror=0
-
-[epel-modular-source]
-name=Extra Packages for Enterprise Linux Modular $releasever - $basearch - Source
-baseurl=http://{{ dnf_epel_mirror_host }}/{{ dnf_epel_mirror_directory }}/$releasever/Modular/SRPMS
-enabled=0
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-8
-gpgcheck=1
-fastestmirror=0
diff --git a/ansible/roles/kolla-ansible/tasks/install.yml b/ansible/roles/kolla-ansible/tasks/install.yml
index 7d93a4ba1..e6917404b 100644
--- a/ansible/roles/kolla-ansible/tasks/install.yml
+++ b/ansible/roles/kolla-ansible/tasks/install.yml
@@ -50,7 +50,7 @@
     name: "{{ item.name }}"
     state: latest
     virtualenv: "{{ kolla_ansible_venv }}"
-    virtualenv_python: "{{ kolla_ansible_venv_python }}"
+    virtualenv_command: "{{ kolla_ansible_venv_python }} -m venv"
   with_items:
     - { name: pip }
 
diff --git a/ansible/roles/kolla-ansible/vars/Debian.yml b/ansible/roles/kolla-ansible/vars/Debian.yml
index d2ae5c23d..b9b871a4d 100644
--- a/ansible/roles/kolla-ansible/vars/Debian.yml
+++ b/ansible/roles/kolla-ansible/vars/Debian.yml
@@ -6,4 +6,4 @@ kolla_ansible_package_dependencies:
   - libssl-dev
   - python3-dev
   - python3-pip
-  - python3-virtualenv
+  - python3-venv
diff --git a/ansible/roles/kolla/tasks/install.yml b/ansible/roles/kolla/tasks/install.yml
index c28433bea..a6a03bf56 100644
--- a/ansible/roles/kolla/tasks/install.yml
+++ b/ansible/roles/kolla/tasks/install.yml
@@ -49,7 +49,7 @@
     name: "{{ item.name }}"
     state: latest
     virtualenv: "{{ kolla_venv }}"
-    virtualenv_python: "python3.{{ ansible_facts.python.version.minor }}"
+    virtualenv_command: "python3.{{ ansible_facts.python.version.minor }} -m venv"
   with_items:
     - { name: pip }
 
diff --git a/ansible/roles/kolla/vars/Debian.yml b/ansible/roles/kolla/vars/Debian.yml
index 6a2428ae2..3d7bff90c 100644
--- a/ansible/roles/kolla/vars/Debian.yml
+++ b/ansible/roles/kolla/vars/Debian.yml
@@ -6,3 +6,4 @@ kolla_package_dependencies:
   - libssl-dev
   - python3-dev
   - python3-pip
+  - python3-venv
diff --git a/ansible/roles/network-redhat/tasks/main.yml b/ansible/roles/network-redhat/tasks/main.yml
index 2ff5b5c8f..fe5af1fcf 100644
--- a/ansible/roles/network-redhat/tasks/main.yml
+++ b/ansible/roles/network-redhat/tasks/main.yml
@@ -1,16 +1,4 @@
 ---
-- name: Ensure NetworkManager is disabled
-  service:
-    name: NetworkManager
-    state: stopped
-    enabled: no
-  become: True
-  register: nm_result
-  failed_when:
-    - nm_result is failed
-    # Ugh, Ansible's service module doesn't handle uninstalled services.
-    - "'Could not find the requested service' not in nm_result.msg"
-
 - import_role:
     name: ahuffman.resolv
   when: resolv_is_managed | bool
diff --git a/ansible/roles/veth/tasks/RedHat.yml b/ansible/roles/veth/tasks/RedHat.yml
index e8a5972ec..8315c8269 100644
--- a/ansible/roles/veth/tasks/RedHat.yml
+++ b/ansible/roles/veth/tasks/RedHat.yml
@@ -1,43 +1,6 @@
 ---
-- name: Ensure veth sysconfig network control scripts exist
-  copy:
-    src: "{{ item }}"
-    dest: "{{ network_scripts_dir }}/{{ item }}"
-    owner: root
-    group: root
-    mode: 0755
-  with_items:
-    - "ifup-veth"
-    - "ifdown-veth"
-  become: True
-  register: ctl_result
+- include_tasks: network-scripts.yml
+  when: ansible_facts.distribution_major_version | int < 9
 
-- name: Ensure veth sysconfig network interface files exist
-  template:
-    src: ifcfg-veth.j2
-    dest: "{{ network_scripts_dir }}/ifcfg-{{ item.device }}"
-    owner: root
-    group: root
-    mode: 0644
-  with_items: "{{ veth_interfaces }}"
-  become: True
-  register: veth_result
-
-- name: Ensure veth peer sysconfig network interface files exist
-  template:
-    src: ifcfg-peer.j2
-    dest: "{{ network_scripts_dir }}/ifcfg-{{ item.peer_device }}"
-    owner: root
-    group: root
-    mode: 0644
-  with_items: "{{ veth_interfaces }}"
-  become: True
-  register: peer_result
-
-- name: Bounce veth interfaces
-  shell: ifdown {{ item[0].item.device }} ; ifup {{ item[0].item.device }}
-  with_together:
-    - "{{ veth_result.results }}"
-    - "{{ peer_result.results }}"
-  when: ctl_result is changed or item[0] is changed or item[1] is changed
-  become: True
+- include_tasks: network-manager.yml
+  when: ansible_facts.distribution_major_version | int >= 9
diff --git a/ansible/roles/veth/tasks/network-manager.yml b/ansible/roles/veth/tasks/network-manager.yml
new file mode 100644
index 000000000..8612e0ae6
--- /dev/null
+++ b/ansible/roles/veth/tasks/network-manager.yml
@@ -0,0 +1,45 @@
+- name: Ensure veth network manager connections file exists
+  template:
+    src: veth-nmconnection.j2
+    dest: "/etc/NetworkManager/system-connections/{{ item.device }}.nmconnection"
+    owner: root
+    group: root
+    mode: 0600
+  with_items: "{{ veth_interfaces }}"
+  become: True
+  register: veth_result
+
+- name: Ensure veth peer network manager connections file exists
+  template:
+    src: peer-nmconnection.j2
+    dest: "/etc/NetworkManager/system-connections/{{ item.peer_device }}.nmconnection"
+    owner: root
+    group: root
+    mode: 0600
+  with_items: "{{ veth_interfaces }}"
+  become: True
+  register: peer_result
+
+# NOTE(bbezak) For some reason adding veth pair via loading files to nmcli needs
+# peer device to be loaded first. If not, can't start interface.
+# "Error: Connection activation failed: p-br0-ovs failed to create resources:
+# Failed to create veth interface 'p-br0-ovs' for 'p-br0-ovs': exists"
+- name: Add veth interfaces to network manager
+  shell: |
+    nmcli connection load /etc/NetworkManager/system-connections/{{ item[0].item.peer_device }}.nmconnection &&
+    nmcli connection load /etc/NetworkManager/system-connections/{{ item[0].item.device }}.nmconnection
+  with_together:
+    - "{{ veth_result.results }}"
+    - "{{ peer_result.results }}"
+  when: item[0] is changed or item[1] is changed
+  become: True
+
+- name: Start veth interfaces with network manager
+  shell: |
+    nmcli connection up {{ item[0].item.device }} &&
+    nmcli connection up {{ item[0].item.peer_device }}
+  with_together:
+    - "{{ veth_result.results }}"
+    - "{{ peer_result.results }}"
+  when: item[0] is changed or item[1] is changed
+  become: True
diff --git a/ansible/roles/veth/tasks/network-scripts.yml b/ansible/roles/veth/tasks/network-scripts.yml
new file mode 100644
index 000000000..e8a5972ec
--- /dev/null
+++ b/ansible/roles/veth/tasks/network-scripts.yml
@@ -0,0 +1,43 @@
+---
+- name: Ensure veth sysconfig network control scripts exist
+  copy:
+    src: "{{ item }}"
+    dest: "{{ network_scripts_dir }}/{{ item }}"
+    owner: root
+    group: root
+    mode: 0755
+  with_items:
+    - "ifup-veth"
+    - "ifdown-veth"
+  become: True
+  register: ctl_result
+
+- name: Ensure veth sysconfig network interface files exist
+  template:
+    src: ifcfg-veth.j2
+    dest: "{{ network_scripts_dir }}/ifcfg-{{ item.device }}"
+    owner: root
+    group: root
+    mode: 0644
+  with_items: "{{ veth_interfaces }}"
+  become: True
+  register: veth_result
+
+- name: Ensure veth peer sysconfig network interface files exist
+  template:
+    src: ifcfg-peer.j2
+    dest: "{{ network_scripts_dir }}/ifcfg-{{ item.peer_device }}"
+    owner: root
+    group: root
+    mode: 0644
+  with_items: "{{ veth_interfaces }}"
+  become: True
+  register: peer_result
+
+- name: Bounce veth interfaces
+  shell: ifdown {{ item[0].item.device }} ; ifup {{ item[0].item.device }}
+  with_together:
+    - "{{ veth_result.results }}"
+    - "{{ peer_result.results }}"
+  when: ctl_result is changed or item[0] is changed or item[1] is changed
+  become: True
diff --git a/ansible/roles/veth/templates/peer-nmconnection.j2 b/ansible/roles/veth/templates/peer-nmconnection.j2
new file mode 100644
index 000000000..46e54f1a0
--- /dev/null
+++ b/ansible/roles/veth/templates/peer-nmconnection.j2
@@ -0,0 +1,21 @@
+[connection]
+id={{ item.peer_device }}
+type=veth
+interface-name={{ item.peer_device }}
+
+{% if item.peer_mtu is defined and item.peer_mtu %}
+[ethernet]
+mtu={{ item.peer_mtu }}
+{% endif %}
+
+[veth]
+peer={{ item.device }}
+
+[ipv4]
+method=disabled
+
+[ipv6]
+addr-gen-mode=stable-privacy
+method=disabled
+
+[proxy]
diff --git a/ansible/roles/veth/templates/veth-nmconnection.j2 b/ansible/roles/veth/templates/veth-nmconnection.j2
new file mode 100644
index 000000000..04e6104d8
--- /dev/null
+++ b/ansible/roles/veth/templates/veth-nmconnection.j2
@@ -0,0 +1,16 @@
+[connection]
+id={{ item.device }}
+type=veth
+interface-name={{ item.device }}
+master={{ item.bridge }}
+slave-type=bridge
+
+{% if item.mtu is defined and item.mtu %}
+[ethernet]
+mtu={{ item.mtu }}
+{% endif %}
+
+[veth]
+peer={{ item.peer_device }}
+
+[bridge-port]
diff --git a/dev/functions b/dev/functions
index 1055481a6..17c650b4d 100644
--- a/dev/functions
+++ b/dev/functions
@@ -145,13 +145,13 @@ function is_yum {
 function install_dependencies {
     echo "Installing package dependencies for kayobe"
     if is_dnf; then
-        sudo dnf -y install gcc git vim python3-pyyaml python3-virtualenv libffi-devel
+        sudo dnf -y install gcc git vim python3-pyyaml libffi-devel
     elif is_yum; then
         echo "CentOS 7 is no longer supported"
         exit 1
     else
         sudo apt update
-        sudo apt install -y python-is-python3 python3-dev python3-virtualenv gcc git libffi-dev
+        sudo apt install -y python-is-python3 python3-dev python3-venv gcc git libffi-dev
     fi
 }
 
@@ -167,7 +167,33 @@ function install_venv {
     fi
     if [[ ! -f "${venv_path}/bin/activate" ]]; then
         echo "Creating virtual environment in ${venv_path}"
-        virtualenv -p python3 "${venv_path}"
+        python3 -m venv "${venv_path}"
+        # NOTE: Virtualenv's activate and deactivate scripts reference an
+        # unbound variable.
+        set +u
+        source "${venv_path}/bin/activate"
+        pip install -U pip
+        pip install $pip_paths
+        deactivate
+        set -u
+    else
+        echo "Using existing virtual environment in ${venv_path}"
+    fi
+}
+
+function install_venv_system_site_packages {
+    # Install a virtualenv at $1. The rest of the arguments are passed
+    # directly to pip.
+    venv_path="$1"
+    shift
+    pip_paths="$@"
+    local venv_parent="$(dirname ${venv_path})"
+    if [[ ! -d "$venv_parent" ]]; then
+        mkdir -p "$venv_parent"
+    fi
+    if [[ ! -f "${venv_path}/bin/activate" ]]; then
+        echo "Creating virtual environment in ${venv_path}"
+        python3 -m venv --system-site-packages "${venv_path}"
         # NOTE: Virtualenv's activate and deactivate scripts reference an
         # unbound variable.
         set +u
@@ -193,7 +219,7 @@ function install_kayobe_dev_venv {
 
 function upgrade_kayobe_venv {
     echo "Upgrading kayobe virtual environment in ${KAYOBE_VENV_PATH}"
-    virtualenv -p python3 "${KAYOBE_VENV_PATH}"
+    python3 -m venv "${KAYOBE_VENV_PATH}"
     # NOTE: Virtualenv's activate and deactivate scripts reference an
     # unbound variable.
     set +u
@@ -704,7 +730,7 @@ function tenks_deploy {
     deactivate
 
     # Install the Tenks venv.
-    install_venv "${TENKS_VENV_PATH}" "$tenks_path" -c "$UPPER_CONSTRAINTS_FILE"
+    install_venv_system_site_packages "${TENKS_VENV_PATH}" "$tenks_path" -c "$UPPER_CONSTRAINTS_FILE"
     source ${TENKS_VENV_PATH:-$HOME/tenks-test-venv}/bin/activate
 
     ${KAYOBE_SOURCE_PATH}/tools/ansible-galaxy-retried.sh install \
diff --git a/doc/source/configuration/reference/bifrost.rst b/doc/source/configuration/reference/bifrost.rst
index bf92a889d..8e37bf18e 100644
--- a/doc/source/configuration/reference/bifrost.rst
+++ b/doc/source/configuration/reference/bifrost.rst
@@ -50,11 +50,11 @@ configure how this image is built.  Consult the
 :diskimage-builder-doc:`Diskimage-builder documentation <>` for further
 information on building disk images.
 
-The default configuration builds a CentOS 8 whole disk (partitioned) image with
-SELinux disabled and a serial console enabled. `Cloud-init
-<https://cloudinit.readthedocs.io/en/latest/>`__ is used to process the
-configuration drive built by Bifrost, rather than the Bifrost default of
-:diskimage-builder-doc:`simple-init <elements/simple-init/README>`.
+The default configuration builds a whole disk (partitioned) image using the
+selected :ref:`OS distribution <os-distribution>` with serial console enabled,
+and SELinux disabled if CentOS Stream is used. Rocky Linux 9 users should use
+the default method of building images with
+:ref:`Diskimage builder directly <overcloud-dib>`.
 
 ``kolla_bifrost_dib_os_element``
     DIB base OS element. Default is ``{{ os_distribution }}``.
@@ -65,9 +65,9 @@ configuration drive built by Bifrost, rather than the Bifrost default of
     releases.*
 
     List of default DIB elements. Default is ``["disable-selinux",
-    "enable-serial-console", "vm"]`` when ``os_distribution`` is ``centos``, or
-    ``["enable-serial-console", "vm"]`` otherwise. The ``vm`` element is
-    poorly named, and causes DIB to build a whole disk image rather than a
+    "enable-serial-console", "vm"]`` when ``os_distribution`` is ``centos`` or
+    ``rocky``, ``["enable-serial-console", "vm"]`` otherwise. The ``vm`` element
+    is poorly named, and causes DIB to build a whole disk image rather than a
     single partition.
 ``kolla_bifrost_dib_elements_extra``
     *Added in the Train release. Use kolla_bifrost_dib_elements in earlier
diff --git a/doc/source/configuration/reference/ironic-python-agent.rst b/doc/source/configuration/reference/ironic-python-agent.rst
index fb8f7aaa0..d1dbbab1b 100644
--- a/doc/source/configuration/reference/ironic-python-agent.rst
+++ b/doc/source/configuration/reference/ironic-python-agent.rst
@@ -25,8 +25,8 @@ The following options cover building of IPA images via Diskimage-builder (DIB).
 Consult the :diskimage-builder-doc:`Diskimage-builder documentation <>` for
 full details.
 
-The default configuration builds a CentOS 8 ramdisk image which includes the
-upstream IPA source code, and has a serial console enabled.
+The default configuration builds a CentOS Stream 9 ramdisk image which includes
+the upstream IPA source code, and has a serial console enabled.
 
 The images are built for Bifrost via ``kayobe seed deployment image build``,
 and for Ironic in the overcloud (if enabled) via ``kayobe overcloud deployment
@@ -61,7 +61,7 @@ image build``.
 ``ipa_build_dib_env_default``
     Dictionary of default environment variables to provide to Diskimage Builder
     (DIB) during IPA image build. Default is
-    ``{"DIB_RELEASE": "8-stream", "DIB_REPOLOCATION_ironic_python_agent": "{{
+    ``{"DIB_RELEASE": "9-stream", "DIB_REPOLOCATION_ironic_python_agent": "{{
     ipa_build_source_url }}", "DIB_REPOREF_ironic_python_agent": "{{
     ipa_build_source_version }}", "DIB_REPOREF_requirements": "{{
     openstack_branch }}"}``.
@@ -217,7 +217,7 @@ Agent documentation <>` for full details.
     ``ipa.kernel``.
 ``ipa_kernel_upstream_url``
     URL of Ironic deployment kernel image to download. Default is
-    ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos8{{
+    ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{
     ipa_images_upstream_url_suffix }}.kernel``.
 ``ipa_kernel_checksum_url``
     URL of checksum of Ironic deployment kernel image. Default is ``{{
@@ -230,7 +230,7 @@ Agent documentation <>` for full details.
     ``ipa.initramfs``.
 ``ipa_ramdisk_upstream_url``
     URL of Ironic deployment ramdisk image to download. Default is
-    ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos8{{
+    ``https://tarballs.openstack.org/ironic-python-agent/dib/files/ipa-centos9{{
     ipa_images_upstream_url_suffix }}.initramfs``.
 ``ipa_ramdisk_checksum_url``
     URL of checksum of Ironic deployment ramdisk image. Default is ``{{
diff --git a/doc/source/configuration/reference/kolla-ansible.rst b/doc/source/configuration/reference/kolla-ansible.rst
index dc926c48f..52405072e 100644
--- a/doc/source/configuration/reference/kolla-ansible.rst
+++ b/doc/source/configuration/reference/kolla-ansible.rst
@@ -113,7 +113,7 @@ The following variables affect which Kolla images are used, and how they are
 accessed.
 
 ``kolla_base_distro``
-    Kolla base container image distribution. Default is ``centos``.
+    Kolla base container image distribution. Default is ``rocky``.
 ``kolla_base_distro_version``
     Kolla base container image distribution version. Default is dependent on
     ``kolla_base_distro``.
@@ -138,14 +138,14 @@ accessed.
     (e.g. ``rocky``) on stable branches and tagged releases, or ``master`` on
     the Kayobe ``master`` branch.
 
-For example, to deploy Kolla ``centos`` images with a namespace of
+For example, to deploy Kolla ``rocky`` images with a namespace of
 ``example``, and a private Docker registry at ``registry.example.com:4000``,
 and the ``zed`` release.
 
 .. code-block:: yaml
    :caption: ``$KAYOBE_CONFIG_PATH/kolla.yml``
 
-   kolla_base_distro: centos
+   kolla_base_distro: rocky
    kolla_docker_namespace: example
    kolla_docker_registry: registry.example.com:4000
    kolla_openstack_release: zed
@@ -154,7 +154,7 @@ The deployed ``ironic-api`` image would be referenced as follows:
 
 .. code-block:: console
 
-   registry.example.com:4000/example/ironic-api:zed-centos-stream9
+   registry.example.com:4000/example/ironic-api:zed-rocky-9
 
 Ansible
 -------
diff --git a/doc/source/configuration/reference/kolla.rst b/doc/source/configuration/reference/kolla.rst
index f50daafc0..651407f6d 100644
--- a/doc/source/configuration/reference/kolla.rst
+++ b/doc/source/configuration/reference/kolla.rst
@@ -74,7 +74,7 @@ affect :ref:`Kolla Ansible configuration <configuration-kolla-ansible-global>`.
 
 ``kolla_base_distro``
     Kolla base container image distribution. Options are ``centos``,
-    ``debian``, ``rocky``, or ``ubuntu``. Default is ``{{ os_distribution }}``.
+    ``debian``, ``rocky`` or ``ubuntu``. Default is ``{{ os_distribution }}``.
 ``kolla_base_distro_version``
     Kolla base container image distribution version. Default is dependent on
     ``kolla_base_distro``.
@@ -97,14 +97,14 @@ affect :ref:`Kolla Ansible configuration <configuration-kolla-ansible-global>`.
     Kolla container image tag. This is the tag that will be applied to built
     container images. Default is ``kolla_openstack_release``.
 
-For example, to build the Kolla ``centos`` images with a namespace
+For example, to build the Kolla ``rocky`` images with a namespace
 of ``example``, and a private Docker registry at ``registry.example.com:4000``,
 using the ``zed`` release:
 
 .. code-block:: yaml
    :caption: ``kolla.yml``
 
-   kolla_base_distro: centos
+   kolla_base_distro: rocky
    kolla_docker_namespace: example
    kolla_docker_registry: registry.example.com:4000
    kolla_openstack_release: zed
@@ -114,7 +114,7 @@ follows:
 
 .. code-block:: console
 
-   registry.example.com:4000/example/ironic-api:zed-centos-stream9
+   registry.example.com:4000/example/ironic-api:zed-rocky-9
 
 Further customisation of the Kolla configuration file can be performed by
 writing a file at ``${KAYOBE_CONFIG_PATH/kolla/kolla-build.conf``. For example,
diff --git a/doc/source/configuration/reference/os-distribution.rst b/doc/source/configuration/reference/os-distribution.rst
index a64fd23c2..b1e8fdb3a 100644
--- a/doc/source/configuration/reference/os-distribution.rst
+++ b/doc/source/configuration/reference/os-distribution.rst
@@ -11,13 +11,13 @@ used throughout the system.
 
 The ``os_distribution`` variable in ``etc/kayobe/globals.yml`` can be used to
 set the OS distribution to use.  It may be set to either ``centos`` or
-or ``rocky`` or ``ubuntu``, and defaults to ``centos``.
+or ``rocky`` or ``ubuntu``, and defaults to ``rocky``.
 
 The ``os_release`` variable in ``etc/kayobe/globals.yml`` can be used to set
 the release of the OS. When ``os_distribution`` is set to ``centos`` it may be
-set to ``8-stream``, and this is its default value. When ``os_distribution`` is
+set to ``9-stream``, and this is its default value. When ``os_distribution`` is
 set to ``ubuntu`` it may be set to ``jammy``, and this is its default value.
-When ``os_distribution`` is set to ``rocky`` it may be set to ``8``, and this
+When ``os_distribution`` is set to ``rocky`` it may be set to ``9``, and this
 is its default value.
 
 These variables are used to set various defaults, including:
diff --git a/doc/source/configuration/reference/overcloud-dib.rst b/doc/source/configuration/reference/overcloud-dib.rst
index 033c8156f..fdf2c1fff 100644
--- a/doc/source/configuration/reference/overcloud-dib.rst
+++ b/doc/source/configuration/reference/overcloud-dib.rst
@@ -34,7 +34,7 @@ how these images are built. Consult the
 information on building disk images.
 
 The default configuration builds a whole disk (partitioned) image using the
-selected :ref:`OS distribution <os-distribution>` (CentOS Stream 8 by default)
+selected :ref:`OS distribution <os-distribution>` (Rocky Linux 9 by default)
 with serial console enabled, and SELinux disabled if CentOS Stream or Rocky
 Linux is used.
 `Cloud-init <https://cloudinit.readthedocs.io/en/latest/>`__ is used to process
diff --git a/doc/source/contributor/testing.rst b/doc/source/contributor/testing.rst
index 03d7d0454..adb7a64fa 100644
--- a/doc/source/contributor/testing.rst
+++ b/doc/source/contributor/testing.rst
@@ -18,7 +18,7 @@ running kayobe's tests.
 
       sudo apt-get install build-essential python3-dev libssl-dev python3-pip git
 
-* Fedora or CentOS/Rocky 8/RHEL 8::
+* Fedora or CentOS Stream 9/Rocky 9/RHEL 9::
 
       sudo dnf install python3-devel openssl-devel python3-pip git gcc
 
diff --git a/doc/source/installation.rst b/doc/source/installation.rst
index 0d0ebeea8..78ee731ea 100644
--- a/doc/source/installation.rst
+++ b/doc/source/installation.rst
@@ -15,8 +15,8 @@ Prerequisites
 Currently Kayobe supports the following Operating Systems on the Ansible
 control host:
 
-- CentOS Stream 8 (since Wallaby 10.0.0 release)
-- Rocky Linux 8 (since Yoga 12.0.0 release)
+- CentOS Stream 9 (since Zed 13.0.0 release)
+- Rocky Linux 9 (since Zed 13.0.0 release)
 - Ubuntu Jammy 22.04 (since Zed 13.0.0 release)
 
 See the :doc:`support matrix <support-matrix>` for details of supported
@@ -30,11 +30,11 @@ some of kayobe's python dependencies.
 
 On CentOS/Rocky::
 
-    $ dnf install -y python3-devel python3-virtualenv gcc libffi-devel
+    $ dnf install -y python3-devel gcc libffi-devel
 
 On Ubuntu::
 
-    $ apt install -y python3-dev python3-virtualenv gcc libffi-dev
+    $ apt install -y python3-dev gcc libffi-dev python3-venv
 
 If installing Kayobe from source, then Git is required for cloning and working
 with the source code repository.
@@ -95,7 +95,7 @@ code repositories and python virtual environments::
 
 Create a virtualenv for Kayobe::
 
-    $ virtualenv <base_path>/venvs/kayobe
+    $ python3 -m venv <base_path>/venvs/kayobe
 
 Activate the virtualenv and update pip::
 
@@ -136,7 +136,7 @@ Next, obtain the Kayobe source code. For example:
 
 Create a virtualenv for Kayobe::
 
-    $ virtualenv <base_path>/venvs/kayobe
+    $ python3 -m venv <base_path>/venvs/kayobe
 
 Activate the virtualenv and update pip::
 
diff --git a/doc/source/resources.rst b/doc/source/resources.rst
index bb41396ea..90f3b2b1a 100644
--- a/doc/source/resources.rst
+++ b/doc/source/resources.rst
@@ -22,7 +22,7 @@ OpenStack using Kolla, Ansible and Kayobe. The guide makes use of
 baremetal environment running on a single hypervisor.
 
 To complete the walkthrough you will require a baremetal or VM hypervisor
-running CentOS 8 or Ubuntu Jammy 22.04 (since Zed 13.0.0) with at least
+running CentOS Stream 9, Rocky Linux 9 or Ubuntu Jammy 22.04 (since Zed 13.0.0) with at least
 32GB RAM & 80GB disk space.  Preparing the deployment can take some time -
 where possible it is beneficial to snapshot the hypervisor. We advise making a
 snapshot after creating the initial 'seed' VM as this will make additional
diff --git a/doc/source/support-matrix.rst b/doc/source/support-matrix.rst
index 35ec7765c..3d9debdc3 100644
--- a/doc/source/support-matrix.rst
+++ b/doc/source/support-matrix.rst
@@ -9,8 +9,8 @@ Supported Operating Systems
 
 Kayobe supports the following host Operating Systems (OS):
 
-* CentOS Stream 8 (since Wallaby 10.0.0 release)
-* Rocky Linux 8 (since Yoga 12.0.0 release)
+* CentOS Stream 9 (since Zed 13.0.0 release)
+* Rocky Linux 9 (since Zed 13.0.0 release)
 * Ubuntu Jammy 22.04 (since Zed 13.0.0 release)
 
 .. note::
diff --git a/etc/kayobe/globals.yml b/etc/kayobe/globals.yml
index 85f668d1d..3956dca36 100644
--- a/etc/kayobe/globals.yml
+++ b/etc/kayobe/globals.yml
@@ -46,11 +46,11 @@
 # OS distribution.
 
 # OS distribution name. Valid options are "centos", "rocky", "ubuntu". Default
-# is "centos".
+# is "rocky".
 #os_distribution:
 
-# OS release. Valid options are "8-stream" when os_distribution is "centos", or
-# "8" when os_distribution is "rocky", or "jammy" when os_distribution is
+# OS release. Valid options are "9-stream" when os_distribution is "centos", or
+# "9" when os_distribution is "rocky", or "jammy" when os_distribution is
 # "ubuntu".
 #os_release:
 
diff --git a/etc/kayobe/infra-vms.yml b/etc/kayobe/infra-vms.yml
index 904bd3e08..c8050d050 100644
--- a/etc/kayobe/infra-vms.yml
+++ b/etc/kayobe/infra-vms.yml
@@ -32,10 +32,10 @@
 # Base image for the infra VM root volume. Default is
 # "https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img"
 # when os_distribution is "ubuntu", or
-# https://dl.rockylinux.org/pub/rocky/8/images/Rocky-8-GenericCloud.latest.x86_64.qcow2
+# https://dl.rockylinux.org/pub/rocky/9/images/x86_64/Rocky-9-GenericCloud.latest.x86_64.qcow2
 # when os_distribution is "rocky",
 # or
-# "https://cloud.centos.org/centos/8-stream/x86_64/images/CentOS-Stream-GenericCloud-8-20220913.0.x86_64.qcow2"
+# "https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20221206.0.x86_64.qcow2"
 # otherwise.
 #infra_vm_root_image:
 
diff --git a/etc/kayobe/kolla.yml b/etc/kayobe/kolla.yml
index a1e54ad7c..9c55a6f3a 100644
--- a/etc/kayobe/kolla.yml
+++ b/etc/kayobe/kolla.yml
@@ -67,8 +67,7 @@
 # Kolla configuration.
 
 # Kolla base container image distribution. Options are "centos", "debian",
-# "rocky", "ubuntu". Default is
-# {{ 'centos' if os_distribution == 'rocky' else os_distribution }}.
+# "rocky", "ubuntu". Default is {{ os_distribution }}.
 #kolla_base_distro:
 
 # Kolla base container image distribution version default map.
diff --git a/etc/kayobe/seed-vm.yml b/etc/kayobe/seed-vm.yml
index 98c7b3b9c..f10fbaa19 100644
--- a/etc/kayobe/seed-vm.yml
+++ b/etc/kayobe/seed-vm.yml
@@ -32,10 +32,10 @@
 # Base image for the seed VM root volume. Default is
 # "https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img"
 # when os_distribution is "ubuntu",
-# https://dl.rockylinux.org/pub/rocky/8/images/Rocky-8-GenericCloud.latest.x86_64.qcow2
+# https://dl.rockylinux.org/pub/rocky/9/images/x86_64/Rocky-9-GenericCloud.latest.x86_64.qcow2
 # when os_distribution is "rocky",
 # or
-# "https://cloud.centos.org/centos/8-stream/x86_64/images/CentOS-Stream-GenericCloud-8-20220913.0.x86_64.qcow2"
+# "https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-9-20221206.0.x86_64.qcow2"
 # otherwise.
 #seed_vm_root_image:
 
diff --git a/playbooks/kayobe-overcloud-base/overrides.yml.j2 b/playbooks/kayobe-overcloud-base/overrides.yml.j2
index 2f488c04e..599f39d1a 100644
--- a/playbooks/kayobe-overcloud-base/overrides.yml.j2
+++ b/playbooks/kayobe-overcloud-base/overrides.yml.j2
@@ -48,3 +48,7 @@ kolla_ironic_pxe_append_params_extra:
 kolla_enable_heat: false
 kolla_enable_horizon: false
 {% endif %}
+
+# NOTE(bbezak): Kolla does not build CentOS Stream 9 container images.
+# Using Rocky Linux 9 images on CentOS Stream 9 in CI.
+kolla_base_distro: "{% raw %}{{ 'rocky' if os_distribution == 'centos' else os_distribution }}{% endraw %}"
diff --git a/playbooks/kayobe-overcloud-host-configure-base/overrides.yml.j2 b/playbooks/kayobe-overcloud-host-configure-base/overrides.yml.j2
index dbc9ce064..cbd409f9c 100644
--- a/playbooks/kayobe-overcloud-host-configure-base/overrides.yml.j2
+++ b/playbooks/kayobe-overcloud-host-configure-base/overrides.yml.j2
@@ -41,7 +41,7 @@ test_net_eth_vlan_routes:
     gateway: 192.168.35.254
     table: kayobe-test-route-table
 test_net_eth_vlan_rules:
-{% if ansible_os_family in ['RedHat', 'Rocky'] %}
+{% if ansible_facts.os_family == 'RedHat' %}
   - from 192.168.35.0/24 table kayobe-test-route-table
 {% else %}
   - from: 192.168.35.0/24
@@ -114,7 +114,7 @@ docker_storage_driver: devicemapper
 # Set Honolulu time.
 timezone: Pacific/Honolulu
 
-{% if ansible_os_family == "Debian" %}
+{% if ansible_facts.os_family == "Debian" %}
 apt_config:
   - content: |
       Acquire::Retries 1;
@@ -137,14 +137,14 @@ apt_repositories:
 apt_disable_sources_list: true
 {% endif %}
 
-{% if ansible_os_family in ['RedHat', 'Rocky'] %}
+{% if ansible_facts.os_family == 'RedHat' %}
 # Use a local DNF mirror.
 dnf_use_local_mirror: true
-{% if ansible_distribution == 'CentOS' %}
+{% if ansible_facts.distribution == 'CentOS' %}
 # Mirror FQDN for DNF repos.
 dnf_centos_mirror_host: "{{ zuul_site_mirror_fqdn }}"
 # Mirror directory for DNF CentOS repos.
-dnf_centos_mirror_directory: 'centos'
+dnf_centos_mirror_directory: 'centos-stream'
 {% endif %}
 # Mirror FQDN for DNF EPEL repos.
 dnf_epel_mirror_host: "{{ zuul_site_mirror_fqdn }}"
diff --git a/playbooks/kayobe-overcloud-host-configure-base/pre.yml b/playbooks/kayobe-overcloud-host-configure-base/pre.yml
index 727e23d8d..0c521e90a 100644
--- a/playbooks/kayobe-overcloud-host-configure-base/pre.yml
+++ b/playbooks/kayobe-overcloud-host-configure-base/pre.yml
@@ -15,7 +15,7 @@
           - pytest-testinfra
           - pytest-html
         virtualenv: "{{ testinfra_venv }}"
-        virtualenv_python: python3
+        virtualenv_command: python3 -m venv
 
     # NOTE(mgoddard): Use the name zzz-overrides.yml to ensure this takes
     # precedence over the standard config files and zz-overrides.yml from
@@ -40,3 +40,4 @@
       command: ip link add dummy{{ item }} type dummy
       become: true
       loop: "{{ range(2, 8) | list }}"
+      when: ansible_facts.os_family == 'Debian'
diff --git a/playbooks/kayobe-overcloud-host-configure-base/tests/test_overcloud_host_configure.py b/playbooks/kayobe-overcloud-host-configure-base/tests/test_overcloud_host_configure.py
index b47d33120..10c2659a1 100644
--- a/playbooks/kayobe-overcloud-host-configure-base/tests/test_overcloud_host_configure.py
+++ b/playbooks/kayobe-overcloud-host-configure-base/tests/test_overcloud_host_configure.py
@@ -39,13 +39,17 @@ def test_network_ethernet_vlan(host):
     assert interface.exists
     assert '192.168.35.1' in interface.addresses
     assert host.file('/sys/class/net/dummy2.42/lower_dummy2').exists
-    routes = host.check_output(
-        '/sbin/ip route show dev dummy2.42 table kayobe-test-route-table')
-    assert '192.168.40.0/24 via 192.168.35.254' in routes
-    rules = host.check_output(
-        '/sbin/ip rule show table kayobe-test-route-table')
-    expected = 'from 192.168.35.0/24 lookup kayobe-test-route-table'
-    assert expected in rules
+    # FIXME(bbezak): remove following IF after ansible-role-interfaces
+    # receive support for custom routes in NetworkManager
+    if not ('centos' in host.system_info.distribution.lower() or
+            'rocky' in host.system_info.distribution.lower()):
+       routes = host.check_output(
+           '/sbin/ip route show dev dummy2.42 table kayobe-test-route-table')
+       assert '192.168.40.0/24 via 192.168.35.254' in routes
+       rules = host.check_output(
+           '/sbin/ip rule show table kayobe-test-route-table')
+       expected = 'from 192.168.35.0/24 lookup kayobe-test-route-table'
+       assert expected in rules
 
 
 def test_network_bridge(host):
@@ -203,8 +207,7 @@ def test_apt_custom_package_repository_is_available(host):
     assert host.package("td-agent").is_installed
 
 
-@pytest.mark.parametrize('repo', ["appstream", "baseos", "extras", "epel",
-                                  "epel-modular"])
+@pytest.mark.parametrize('repo', ["appstream", "baseos", "extras", "epel"])
 @pytest.mark.skipif(not _is_dnf_mirror(), reason="DNF OpenDev mirror only for CentOS 8")
 def test_dnf_local_package_mirrors(host, repo):
     # Depends on SITE_MIRROR_FQDN environment variable.
@@ -217,14 +220,14 @@ def test_dnf_local_package_mirrors(host, repo):
     assert os.getenv('SITE_MIRROR_FQDN') in info
 
 
-@pytest.mark.skipif(not _is_dnf(), reason="DNF only supported on CentOS 8/Rocky 8")
+@pytest.mark.skipif(not _is_dnf(), reason="DNF only supported on CentOS/Rocky")
 def test_dnf_custom_package_repository_is_available(host):
     with host.sudo():
         host.check_output("dnf -y install td-agent")
     assert host.package("td-agent").is_installed
 
 
-@pytest.mark.skipif(not _is_dnf(), reason="DNF only supported on CentOS 8/Rocky 8")
+@pytest.mark.skipif(not _is_dnf(), reason="DNF only supported on CentOS/Rocky")
 def test_dnf_automatic(host):
     assert host.package("dnf-automatic").is_installed
     assert host.service("dnf-automatic.timer").is_enabled
@@ -232,7 +235,7 @@ def test_dnf_automatic(host):
 
 
 @pytest.mark.skipif(not _is_dnf(),
-                    reason="tuned profile setting only supported on CentOS 8/Rocky 8")
+                    reason="tuned profile setting only supported on CentOS/Rocky")
 def test_tuned_profile_is_active(host):
     tuned_output = host.check_output("tuned-adm active")
     assert "throughput-performance" in tuned_output
diff --git a/playbooks/kayobe-overcloud-upgrade-base/run.yml b/playbooks/kayobe-overcloud-upgrade-base/run.yml
index 9b13e5386..b0be4a5a6 100644
--- a/playbooks/kayobe-overcloud-upgrade-base/run.yml
+++ b/playbooks/kayobe-overcloud-upgrade-base/run.yml
@@ -87,7 +87,7 @@
           # ipmitool chassis bootdev pxe
           # Error setting Chassis Boot Parameter 5\nError setting Chassis Boot
           # Parameter 0\n
-          when: ansible_os_family != 'Debian'
+          when: ansible_facts.os_family != 'Debian'
 
         # Upgrade Kayobe, and use it to perform an upgrade of the control plane.
 
@@ -120,7 +120,7 @@
           # ipmitool chassis bootdev pxe
           # Error setting Chassis Boot Parameter 5\nError setting Chassis Boot
           # Parameter 0\n
-          when: ansible_os_family != 'Debian'
+          when: ansible_facts.os_family != 'Debian'
 
       environment:
         KAYOBE_CONFIG_SOURCE_PATH: "{{ kayobe_config_src_dir }}"
diff --git a/playbooks/kayobe-seed-base/overrides.yml.j2 b/playbooks/kayobe-seed-base/overrides.yml.j2
index dc1e54e5e..c317414fd 100644
--- a/playbooks/kayobe-seed-base/overrides.yml.j2
+++ b/playbooks/kayobe-seed-base/overrides.yml.j2
@@ -39,3 +39,7 @@ ipa_build_dib_elements_extra:
 overcloud_dib_build_host_images: {{ build_images }}
 overcloud_dib_elements_extra:
   - "openstack-ci-mirrors"
+
+# NOTE(bbezak): Kolla does not build CentOS Stream 9 container images.
+# Using Rocky Linux 9 images on CentOS Stream 9 in CI.
+kolla_base_distro: "{% raw %}{{ 'rocky' if os_distribution == 'centos' else os_distribution }}{% endraw %}"
diff --git a/releasenotes/notes/rocky-linux-9-adccc4bb77fda197.yaml b/releasenotes/notes/rocky-linux-9-adccc4bb77fda197.yaml
new file mode 100644
index 000000000..f30cc861a
--- /dev/null
+++ b/releasenotes/notes/rocky-linux-9-adccc4bb77fda197.yaml
@@ -0,0 +1,9 @@
+---
+features:
+  - |
+    Adds support for Rocky Linux 9 as a host Operating System and base
+    container image. CentOS Stream 8 is not supported anymore.
+upgrade:
+  - |
+    The default value of ``os_distribution`` was changed to ``rocky``.
+    CentOS Stream 8 is not supported anymore.
diff --git a/requirements.yml b/requirements.yml
index 39dbef77b..cb78d86e7 100644
--- a/requirements.yml
+++ b/requirements.yml
@@ -16,8 +16,10 @@ roles:
   - src: jriguera.configdrive
     # There are no versioned releases of this role.
     version: 29871bf3279ef95fc8f7339b9abd13f869980750
-  - src: MichaelRigart.interfaces
-    version: v1.13.1
+  - src: https://github.com/stackhpc/ansible-role-interfaces.git
+    name: MichaelRigart.interfaces
+    scm: git
+    version: networkmanager
   - src: mrlesmithjr.chrony
     version: v0.1.4
   - src: mrlesmithjr.manage-lvm
@@ -35,7 +37,7 @@ roles:
   - src: stackhpc.grafana-conf
     version: 1.1.1
   - src: stackhpc.libvirt-host
-    version: v1.11.0
+    version: v1.12.1
   - src: stackhpc.libvirt-vm
     version: v1.14.2
   - src: stackhpc.luks
@@ -49,8 +51,8 @@ roles:
   - src: stackhpc.os-networks
     version: v1.5.3
   - src: stackhpc.os-openstackclient
-    version: v1.4.1
+    version: v1.5.0
   - src: stackhpc.os_openstacksdk
-    version: v1.0.1
+    version: v1.3.0
   - src: stackhpc.timezone
     version: 1.2.1
diff --git a/roles/kayobe-ci-prep/tasks/main.yml b/roles/kayobe-ci-prep/tasks/main.yml
index d19bef331..120ab1bca 100644
--- a/roles/kayobe-ci-prep/tasks/main.yml
+++ b/roles/kayobe-ci-prep/tasks/main.yml
@@ -3,7 +3,7 @@
   apt:
     name: dbus
   when:
-    - ansible_os_family == 'Debian'
+    - ansible_facts.os_family == 'Debian'
   become: true
 
 - block:
@@ -17,5 +17,5 @@
 
     - name: Enable the EPEL repository
       command: dnf config-manager --disable epel
-  when: ansible_os_family in ['RedHat', 'Rocky']
+  when: ansible_facts.os_family == 'RedHat'
   become: true
diff --git a/roles/kayobe-diagnostics/files/get_logs.sh b/roles/kayobe-diagnostics/files/get_logs.sh
index a98bc9a96..21846e640 100644
--- a/roles/kayobe-diagnostics/files/get_logs.sh
+++ b/roles/kayobe-diagnostics/files/get_logs.sh
@@ -40,12 +40,18 @@ copy_logs() {
         journalctl --no-pager > ${LOG_DIR}/system_logs/syslog.txt
         journalctl --no-pager -u docker.service > ${LOG_DIR}/system_logs/docker.log
         journalctl --no-pager -u vbmcd.service > ${LOG_DIR}/system_logs/vbmcd.log
+        journalctl --no-pager -u NetworkManager.service > ${LOG_DIR}/system_logs/NetworkManager.log
     else
         cp /var/log/upstart/docker.log ${LOG_DIR}/system_logs/docker.log
     fi
 
-    cp -r /etc/sudoers.d ${LOG_DIR}/system_logs/
-    cp /etc/sudoers ${LOG_DIR}/system_logs/sudoers.txt
+    if [[ -d /etc/sysconfig/network-scripts/ ]]; then
+        cp -r /etc/sysconfig/network-scripts/ ${LOG_DIR}/system_logs/
+    fi
+
+    if [[ -d /etc/NetworkManager/system-connections/ ]]; then
+        cp -r /etc/NetworkManager/system-connections/ ${LOG_DIR}/system_logs/
+    fi
 
     df -h > ${LOG_DIR}/system_logs/df.txt
     # Gather disk usage statistics for files and directories larger than 1MB
diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml
index 36e734642..ea81dccce 100644
--- a/zuul.d/jobs.yaml
+++ b/zuul.d/jobs.yaml
@@ -115,14 +115,15 @@
     timeout: 7200
 
 - job:
-    name: kayobe-overcloud-centos8s
+    name: kayobe-overcloud-centos9s
     parent: kayobe-overcloud-base
-    nodeset: kayobe-centos8s
+    nodeset: kayobe-centos9s
+    voting: false
 
 - job:
-    name: kayobe-overcloud-rocky8
+    name: kayobe-overcloud-rocky9
     parent: kayobe-overcloud-base
-    nodeset: kayobe-rocky8
+    nodeset: kayobe-rocky9
 
 - job:
     name: kayobe-overcloud-ubuntu-jammy
@@ -137,9 +138,15 @@
       ironic_boot_mode: "uefi"
 
 - job:
-    name: kayobe-overcloud-tls-centos8s
+    name: kayobe-overcloud-tls-centos9s
     parent: kayobe-overcloud-tls-base
-    nodeset: kayobe-centos8s
+    nodeset: kayobe-centos9s
+    voting: false
+
+- job:
+    name: kayobe-overcloud-tls-rocky9
+    parent: kayobe-overcloud-tls-base
+    nodeset: kayobe-rocky9
 
 - job:
     name: kayobe-overcloud-upgrade-base
@@ -177,14 +184,15 @@
       build_images: false
 
 - job:
-    name: kayobe-seed-centos8s
+    name: kayobe-seed-centos9s
     parent: kayobe-seed-base
-    nodeset: kayobe-centos8s
+    nodeset: kayobe-centos9s
+    voting: false
 
 - job:
-    name: kayobe-seed-rocky8
+    name: kayobe-seed-rocky9
     parent: kayobe-seed-base
-    nodeset: kayobe-rocky8
+    nodeset: kayobe-rocky9
 
 - job:
     name: kayobe-seed-ubuntu-jammy
@@ -203,14 +211,15 @@
       build_images: true
 
 - job:
-    name: kayobe-seed-images-centos8s
+    name: kayobe-seed-images-centos9s
     parent: kayobe-seed-images-base
-    nodeset: kayobe-centos8s
+    nodeset: kayobe-centos9s
+    voting: false
 
 - job:
-    name: kayobe-seed-images-rocky8
+    name: kayobe-seed-images-rocky9
     parent: kayobe-seed-images-base
-    nodeset: kayobe-rocky8
+    nodeset: kayobe-rocky9
 
 - job:
     name: kayobe-seed-images-ubuntu-jammy
@@ -229,14 +238,15 @@
     timeout: 7200
 
 - job:
-    name: kayobe-overcloud-host-configure-centos8s
+    name: kayobe-overcloud-host-configure-centos9s
     parent: kayobe-overcloud-host-configure-base
-    nodeset: kayobe-centos8s
+    nodeset: kayobe-centos9s
+    voting: false
 
 - job:
-    name: kayobe-overcloud-host-configure-rocky8
+    name: kayobe-overcloud-host-configure-rocky9
     parent: kayobe-overcloud-host-configure-base
-    nodeset: kayobe-rocky8
+    nodeset: kayobe-rocky9
 
 - job:
     name: kayobe-overcloud-host-configure-ubuntu-jammy
@@ -278,14 +288,15 @@
     timeout: 5400
 
 - job:
-    name: kayobe-seed-vm-centos8s
+    name: kayobe-seed-vm-centos9s
     parent: kayobe-seed-vm-base
-    nodeset: kayobe-centos8s
+    nodeset: kayobe-centos9s
+    voting: false
 
 - job:
-    name: kayobe-seed-vm-rocky8
+    name: kayobe-seed-vm-rocky9
     parent: kayobe-seed-vm-base
-    nodeset: kayobe-rocky8
+    nodeset: kayobe-rocky9
 
 - job:
     name: kayobe-seed-vm-ubuntu-jammy
@@ -305,14 +316,15 @@
     timeout: 5400
 
 - job:
-    name: kayobe-infra-vm-centos8s
+    name: kayobe-infra-vm-centos9s
     parent: kayobe-infra-vm-base
-    nodeset: kayobe-centos8s
+    nodeset: kayobe-centos9s
+    voting: false
 
 - job:
-    name: kayobe-infra-vm-rocky8
+    name: kayobe-infra-vm-rocky9
     parent: kayobe-infra-vm-base
-    nodeset: kayobe-rocky8
+    nodeset: kayobe-rocky9
 
 - job:
     name: kayobe-infra-vm-ubuntu-jammy
diff --git a/zuul.d/nodesets.yaml b/zuul.d/nodesets.yaml
index 697c6c10d..9c36b0e28 100644
--- a/zuul.d/nodesets.yaml
+++ b/zuul.d/nodesets.yaml
@@ -1,16 +1,15 @@
 ---
 - nodeset:
-    name: kayobe-centos8s
+    name: kayobe-centos9s
     nodes:
       - name: primary
-        label: centos-8-stream
-
+        label: centos-9-stream
 
 - nodeset:
-    name: kayobe-rocky8
+    name: kayobe-rocky9
     nodes:
       - name: primary
-        label: rockylinux-8
+        label: rockylinux-9
 
 - nodeset:
     name: kayobe-ubuntu-jammy
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
index 5c167a87e..58ff77077 100644
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@@ -11,25 +11,42 @@
         - kayobe-tox-ansible-syntax
         - kayobe-tox-ansible
         - kayobe-tox-molecule
+        - kayobe-overcloud-rocky9
+        - kayobe-overcloud-centos9s
         - kayobe-overcloud-ubuntu-jammy
+        - kayobe-overcloud-tls-rocky9
+        - kayobe-overcloud-host-configure-rocky9
+        - kayobe-overcloud-host-configure-centos9s
         - kayobe-overcloud-host-configure-ubuntu-jammy
         - kayobe-overcloud-upgrade-ubuntu-focal
+        - kayobe-seed-rocky9
         - kayobe-seed-ubuntu-jammy
+        - kayobe-seed-images-rocky9
         - kayobe-seed-upgrade-ubuntu-focal
+        - kayobe-seed-vm-rocky9
         - kayobe-seed-vm-ubuntu-jammy
+        - kayobe-infra-vm-rocky9
         - kayobe-infra-vm-ubuntu-jammy
+
     gate:
       jobs:
         - kayobe-tox-ansible-syntax
         - kayobe-tox-ansible
         - kayobe-tox-molecule
+        - kayobe-overcloud-rocky9
         - kayobe-overcloud-ubuntu-jammy
+        - kayobe-overcloud-tls-rocky9
+        - kayobe-overcloud-host-configure-rocky9
         - kayobe-overcloud-host-configure-ubuntu-jammy
         - kayobe-overcloud-upgrade-ubuntu-focal
+        - kayobe-seed-rocky9
         - kayobe-seed-ubuntu-jammy
         - kayobe-seed-upgrade-ubuntu-focal
+        - kayobe-seed-vm-rocky9
         - kayobe-seed-vm-ubuntu-jammy
+        - kayobe-infra-vm-rocky9
         - kayobe-infra-vm-ubuntu-jammy
+
     experimental:
       jobs:
         - kayobe-seed-images-ubuntu-jammy