diff --git a/ansible/roles/prechecks/vars/main.yml b/ansible/roles/prechecks/vars/main.yml
index e3b5ac7edd..dc732a08e8 100644
--- a/ansible/roles/prechecks/vars/main.yml
+++ b/ansible/roles/prechecks/vars/main.yml
@@ -1,8 +1,8 @@
 ---
 docker_version_min: '18.09'
 docker_py_version_min: '3.4.1'
-ansible_version_min: '2.15'
-ansible_version_max: '2.16'
+ansible_version_min: '2.16'
+ansible_version_max: '2.17'
 
 # Top level keys should match ansible_facts.distribution.
 # These map to lists of supported releases (ansible_facts.distribution_release) or
diff --git a/doc/source/conf.py b/doc/source/conf.py
index dc5627d89b..375c477b1c 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -130,10 +130,10 @@ else:
     TESTED_RUNTIMES_GOVERNANCE_URL =\
         'https://governance.openstack.org/tc/reference/runtimes/{}.html'.format(KOLLA_OPENSTACK_RELEASE)
 
-ANSIBLE_CORE_VERSION_MIN = '2.15'
-ANSIBLE_CORE_VERSION_MAX = '2.16'
-ANSIBLE_VERSION_MIN = '8'
-ANSIBLE_VERSION_MAX = '9'
+ANSIBLE_CORE_VERSION_MIN = '2.16'
+ANSIBLE_CORE_VERSION_MAX = '2.17'
+ANSIBLE_VERSION_MIN = '9'
+ANSIBLE_VERSION_MAX = '10'
 
 GLOBAL_VARIABLE_MAP = {
     '|ANSIBLE_CORE_VERSION_MIN|': ANSIBLE_CORE_VERSION_MIN,
diff --git a/tests/run-hashi-vault.yml b/tests/run-hashi-vault.yml
index 84b8f226b7..2f25f1aa75 100644
--- a/tests/run-hashi-vault.yml
+++ b/tests/run-hashi-vault.yml
@@ -6,6 +6,7 @@
     - name: Set facts for commonly used variables
       set_fact:
         kolla_ansible_src_dir: "{{ ansible_env.PWD }}/src/{{ zuul.project.canonical_hostname }}/openstack/kolla-ansible"
+        kolla_ansible_venv_path: "{{ ansible_env.HOME }}/kolla-ansible-venv"
         upper_constraints_file: "{{ ansible_env.HOME }}/src/opendev.org/openstack/requirements/upper-constraints.txt"
         pip_user_path_env:
           PATH: "{{ ansible_env.HOME + '/.local/bin:' + ansible_env.PATH }}"
@@ -21,27 +22,40 @@
         mode: 0777
       become: true
 
-    - name: Ensure python3-pip exists
-      package:
-        name: python3-pip
+    - name: Install Python3.12 on RHEL derivatives
+      dnf:
+        name:
+          - python3.12
+          - python3.12-devel
+        state: latest
+      when: ansible_facts.os_family == 'RedHat'
       become: true
 
-    # NOTE(mgoddard): We need a recent pip to install the latest cryptography
-    # library. See https://github.com/pyca/cryptography/issues/5753
-    - name: Install pip 19.1.1+
+    - name: Create Kolla Ansible venv
+      command:
+        cmd: "{{ 'python3.12' if ansible_facts.os_family == 'RedHat' else 'python3' }} -m venv {{ kolla_ansible_venv_path }}"
+        creates: "{{ kolla_ansible_venv_path }}"
+
+    - name: Ensure the latest tested pip
       pip:
-        name: "pip>=19.1.1"
-        executable: "pip3"
-        extra_args: "--user"
+        name: "pip==23.*"
+        state: latest
+        virtualenv: "{{ kolla_ansible_venv_path }}"
+
+    - name: Ensure the latest tested setuptools
+      pip:
+        name: "setuptools==67.2.0"
+        state: latest
+        virtualenv: "{{ kolla_ansible_venv_path }}"
 
     - name: Install kolla-ansible and dependencies
       pip:
-        executable: "pip3"
-        extra_args: "-c {{ upper_constraints_file }} --user"
+        extra_args: "-c {{ upper_constraints_file }}"
         name:
           - "{{ kolla_ansible_src_dir }}"
           - "ansible-core{{ ansible_core_version_constraint }}"
-          - "ansible{{ ansible_version_constraint }}"
+          - "ara[server]<1.7"
+        virtualenv: "{{ kolla_ansible_venv_path }}"
 
     - name: Copy passwords.yml file
       copy:
@@ -51,7 +65,7 @@
         remote_src: true
 
     - name: Generate passwords
-      command: kolla-genpwd
+      command: "{{ kolla_ansible_venv_path }}/bin/kolla-genpwd"
 
     # At this point we have generated all necessary configuration, and are
     # ready to test Hashicorp Vault.
@@ -62,6 +76,7 @@
         chdir: "{{ kolla_ansible_src_dir }}"
       environment:
         BASE_DISTRO: "{{ base_distro }}"
+        KOLLA_ANSIBLE_VENV_PATH: "{{ kolla_ansible_venv_path }}"
 
     - name: Read template file
       slurp:
diff --git a/tests/run.yml b/tests/run.yml
index 275907e14c..a32cec0c4b 100644
--- a/tests/run.yml
+++ b/tests/run.yml
@@ -243,9 +243,18 @@
         state: directory
       become: true
 
+    - name: Install Python3.12 on RHEL derivatives
+      dnf:
+        name:
+          - python3.12
+          - python3.12-devel
+        state: latest
+      when: ansible_facts.os_family == 'RedHat'
+      become: true
+
     - name: Create Kolla Ansible venv
       command:
-        cmd: "python3 -m venv {{ kolla_ansible_venv_path }}"
+        cmd: "{{ 'python3.12' if ansible_facts.os_family == 'RedHat' else 'python3' }} -m venv {{ kolla_ansible_venv_path }}"
         creates: "{{ kolla_ansible_venv_path }}"
 
     - name: Ensure the latest tested pip
diff --git a/tests/test-hashicorp-vault-passwords.sh b/tests/test-hashicorp-vault-passwords.sh
index e4c79c5950..caa9ba6a4c 100755
--- a/tests/test-hashicorp-vault-passwords.sh
+++ b/tests/test-hashicorp-vault-passwords.sh
@@ -54,6 +54,7 @@ function teardown {
 
 function test_hashicorp_vault_passwords {
     echo "Setting up development Vault server..."
+    source $KOLLA_ANSIBLE_VENV_PATH/bin/activate
     install_vault
     start_vault
     test_vault
diff --git a/tools/kolla-ansible b/tools/kolla-ansible
index f2daa7f4eb..314da4a351 100755
--- a/tools/kolla-ansible
+++ b/tools/kolla-ansible
@@ -7,8 +7,8 @@ set -o errexit
 # do not use _PYTHON_BIN directly, use $(get_python_bin) instead
 _PYTHON_BIN=""
 
-ANSIBLE_VERSION_MIN=2.15
-ANSIBLE_VERSION_MAX=2.16
+ANSIBLE_VERSION_MIN=2.16
+ANSIBLE_VERSION_MAX=2.17
 
 function get_python_bin {
     if [ -n "$_PYTHON_BIN" ]; then
diff --git a/zuul.d/base.yaml b/zuul.d/base.yaml
index a852f05e39..a439e7dada 100644
--- a/zuul.d/base.yaml
+++ b/zuul.d/base.yaml
@@ -7,17 +7,17 @@
       # Use SLURP version (two releases back) on SLURP upgrades.
       ansible_core_version_constraint: >-
         {{ ansible_core_version_slurp if is_slurp else ansible_core_version_min if is_upgrade or ansible_facts.distribution != "Ubuntu" else ansible_core_version_max }}
-      ansible_core_version_slurp: "==2.14.*"
-      ansible_core_version_max: "==2.16.*"
-      ansible_core_version_min: "==2.15.*"
+      ansible_core_version_slurp: "==2.16.*"
+      ansible_core_version_max: "==2.17.*"
+      ansible_core_version_min: "==2.16.*"
       # Test latest ansible-core version on Ubuntu, minimum supported on others.
       # Use SLURP version (two releases back) on SLURP upgrades.
       # TODO(mnasiadka): Remove in D.
       ansible_version_constraint: >-
           {{ ansible_version_slurp if is_slurp else ansible_version_min if is_upgrade or ansible_facts.distribution != "Ubuntu" else ansible_version_max }}
-      ansible_version_slurp: "==7.*"
-      ansible_version_min: "==8.*"
-      ansible_version_max: "==9.*"
+      ansible_version_slurp: "==9.*"
+      ansible_version_min: "==9.*"
+      ansible_version_max: "==10.*"
       # NOTE(mgoddard): Test the use of interface names with dashes.
       api_interface_name: "vxlan-0"
       api_network_prefix: "192.0.2."