all: children: cephs: hosts: instance: null computes: hosts: instance: null controllers: hosts: instance: null zuul_unreachable: hosts: {} hosts: instance: ansible_connection: ssh ansible_host: 199.204.45.99 ansible_port: 22 ansible_python_interpreter: auto ansible_user: zuul atmosphere_image_mirrors: - mirror: atmosphere-ci-registry:5443 source: atmosphere-ci-registry:5443 atmosphere_image_prefix: harbor.atmosphere.dev/ atmosphere_release_manifest: atmosphere-ci-registry:5443/vexxhost/atmosphere-release:ci atmosphere_release_manifest_ca_file: /usr/local/share/ca-certificates/atmosphere-ci-registry.crt atmosphere_release_manifest_digest: sha256:953876d704ac54924afed776d9644481b43660550eff6c57f1af5bb324f8007b ceph_conf_overrides: - option: mon allow pool size one section: global value: true - option: osd crush chooseleaf type section: global value: 0 - option: auth allow insecure global id reclaim section: mon value: false ceph_csi_rbd_helm_values: provisioner: replicaCount: 1 ceph_fsid: 4837cbf8-4f90-4300-b3f6-726c9b9f89b4 ceph_osd_devices: - /dev/ceph-{{ inventory_hostname_short }}-osd0/data - /dev/ceph-{{ inventory_hostname_short }}-osd1/data - /dev/ceph-{{ inventory_hostname_short }}-osd2/data cilium_helm_values: operator: replicas: 1 csi_driver: rbd kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' molecule_install_collection_siblings: true molecule_scenario: csi nodepool: az: yul2 cloud: public external_id: b204cbc1-7ecd-459b-95fa-6d9fa7100d57 host_id: 1338700d28abaf70516697563709cb5989e78902918a96f23cebed44 interface_ip: 199.204.45.99 label: ubuntu-jammy node_properties: {} private_ipv4: 199.204.45.99 private_ipv6: null provider: yul1 public_ipv4: 199.204.45.99 public_ipv6: 2604:e100:1:0:f816:3eff:feb5:31d3 region: ca-ymq-1 slot: null zuul_node: az: yul2 cloud: public external_id: b204cbc1-7ecd-459b-95fa-6d9fa7100d57 host_id: 1338700d28abaf70516697563709cb5989e78902918a96f23cebed44 interface_ip: 199.204.45.99 label: ubuntu-jammy node_properties: {} private_ipv4: 199.204.45.99 private_ipv6: null provider: yul1 public_ipv4: 199.204.45.99 public_ipv6: 2604:e100:1:0:f816:3eff:feb5:31d3 region: ca-ymq-1 slot: null uuid: null vars: atmosphere_image_mirrors: - mirror: atmosphere-ci-registry:5443 source: atmosphere-ci-registry:5443 atmosphere_image_prefix: harbor.atmosphere.dev/ atmosphere_release_manifest: atmosphere-ci-registry:5443/vexxhost/atmosphere-release:ci atmosphere_release_manifest_ca_file: /usr/local/share/ca-certificates/atmosphere-ci-registry.crt atmosphere_release_manifest_digest: sha256:953876d704ac54924afed776d9644481b43660550eff6c57f1af5bb324f8007b ceph_conf_overrides: - option: mon allow pool size one section: global value: true - option: osd crush chooseleaf type section: global value: 0 - option: auth allow insecure global id reclaim section: mon value: false ceph_csi_rbd_helm_values: provisioner: replicaCount: 1 ceph_fsid: 4837cbf8-4f90-4300-b3f6-726c9b9f89b4 ceph_osd_devices: - /dev/ceph-{{ inventory_hostname_short }}-osd0/data - /dev/ceph-{{ inventory_hostname_short }}-osd1/data - /dev/ceph-{{ inventory_hostname_short }}-osd2/data cilium_helm_values: operator: replicas: 1 csi_driver: rbd kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' molecule_install_collection_siblings: true molecule_scenario: csi zuul: _inheritance_path: - '' - '' - '' - '' - '' - '' ansible_version: '9' artifacts: - branch: main change: '4439' job: atmosphere-release-manifest metadata: type: zuul_manifest name: Zuul Manifest patchset: a440cf28490d8c9316e4ab05d36a19e75fa0c0f2 project: vexxhost/atmosphere url: https://logs.oss.vexxhost.dev/065/oss/0654bfc7054d4064b0f323fb220debf0/zuul-manifest.json - branch: main change: '4439' job: atmosphere-release-manifest metadata: digest: sha256:953876d704ac54924afed776d9644481b43660550eff6c57f1af5bb324f8007b name: Release manifest patchset: a440cf28490d8c9316e4ab05d36a19e75fa0c0f2 project: vexxhost/atmosphere url: https://logs.oss.vexxhost.dev/065/oss/0654bfc7054d4064b0f323fb220debf0/release-manifest.yaml - branch: main change: '4439' job: atmosphere-release-manifest name: atmosphere-release patchset: a440cf28490d8c9316e4ab05d36a19e75fa0c0f2 project: vexxhost/atmosphere url: https://logs.oss.vexxhost.dev/065/oss/0654bfc7054d4064b0f323fb220debf0/atmosphere-release attempts: 1 branch: main build: 094644bc9c4e424298e61b2f09c49fbe build_refs: - branch: main change: '4439' change_message: 'feat(neutron): run policy server checks in-process and add quarantine The Neutron policy server ran as a sidecar next to `neutron-server`, and Neutron called it over HTTP (`http://neutron-server:9697/...`) on every port update and delete it covered. Each pod carried an extra container with its own uWSGI workers and database pool, and a sidecar outage turned member port updates into errors. [vexxhost/neutron-policy-server#15](https://github.com/vexxhost/neutron-policy-server/pull/15) added the same checks as `oslo.policy` rule checks, loaded through the `oslo.policy.rule_checks` entry point. The Neutron image already installs the package, so they run inside `neutron-server`. This switches Atmosphere over and removes the sidecar: | Rule | Before | After | |---|---|---| | `delete_port` | `http://neutron-server:9697/port-delete` | `port_delete:strict=1` | | `update_port:mac_address`, `update_port:fixed_ips` | `http://neutron-server:9697/port-update` | `port_update:strict=1` | | `update_port:allowed_address_pairs` | `http://neutron-server:9697/address-pair` | `address_pair:strict=1` | | `update_port` | Neutron default | Neutron default plus `quarantine:security_group=quarantine` | The new quarantine check stops project members from changing security groups, allowed address pairs or port security on a port that carries a security group named `quarantine` owned by another project. Only an administrator can attach such a group, so the check needs no Nova lookup. The `update_port` override is otherwise identical to Neutron''s default (`(rule:admin_only) or (rule:service_api) or role:member and project_id:%(project_id)s`). Changes: - Neutron chart: the sidecar container, service port, uWSGI config, script and image are removed. Patch `0002` also carried an unrelated switch of the API server''s uWSGI to the `neutron.wsgi.api:application` module, so it''s kept as `0002-use-neutron-wsgi-module.patch`. Patch `0003` gets refreshed context. - `roles/neutron`: the policy rules use the in-process checks, and the sidecar is no longer enabled. If `neutron_helm_values` still overrides policy rules with `:9697` checks, the role now stops before deploying and lists the affected rules. Otherwise those rules would fail at runtime once the sidecar is gone. - Images: the `neutron:main` pins move to the build that includes neutron-policy-server#15 (verified: its `entry_points.txt` registers all four checks), and the `neutron_policy_server` image is dropped. - Docs explain the checks and how to quarantine an instance. A release note covers the feature and the upgrade requirement. Testing: `ansible-lint` passes on the changed role files, and `chart-vendor` reproduces `charts/neutron` from upstream plus patches. I ran the guard task against empty overrides, unrelated overrides, and a `:9697` override; only the last one fails, and it names the rule. The checks themselves are covered in neutron-policy-server, including requests through Neutron''s API stack. The AIO jobs exercise them end to end here. ' change_url: https://github.com/vexxhost/atmosphere/pull/4439 commit_id: a440cf28490d8c9316e4ab05d36a19e75fa0c0f2 patchset: a440cf28490d8c9316e4ab05d36a19e75fa0c0f2 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null buildset: 8c52bf5981f743f980bd54b7de8f7780 buildset_refs: - branch: main change: '4439' change_message: 'feat(neutron): run policy server checks in-process and add quarantine The Neutron policy server ran as a sidecar next to `neutron-server`, and Neutron called it over HTTP (`http://neutron-server:9697/...`) on every port update and delete it covered. Each pod carried an extra container with its own uWSGI workers and database pool, and a sidecar outage turned member port updates into errors. [vexxhost/neutron-policy-server#15](https://github.com/vexxhost/neutron-policy-server/pull/15) added the same checks as `oslo.policy` rule checks, loaded through the `oslo.policy.rule_checks` entry point. The Neutron image already installs the package, so they run inside `neutron-server`. This switches Atmosphere over and removes the sidecar: | Rule | Before | After | |---|---|---| | `delete_port` | `http://neutron-server:9697/port-delete` | `port_delete:strict=1` | | `update_port:mac_address`, `update_port:fixed_ips` | `http://neutron-server:9697/port-update` | `port_update:strict=1` | | `update_port:allowed_address_pairs` | `http://neutron-server:9697/address-pair` | `address_pair:strict=1` | | `update_port` | Neutron default | Neutron default plus `quarantine:security_group=quarantine` | The new quarantine check stops project members from changing security groups, allowed address pairs or port security on a port that carries a security group named `quarantine` owned by another project. Only an administrator can attach such a group, so the check needs no Nova lookup. The `update_port` override is otherwise identical to Neutron''s default (`(rule:admin_only) or (rule:service_api) or role:member and project_id:%(project_id)s`). Changes: - Neutron chart: the sidecar container, service port, uWSGI config, script and image are removed. Patch `0002` also carried an unrelated switch of the API server''s uWSGI to the `neutron.wsgi.api:application` module, so it''s kept as `0002-use-neutron-wsgi-module.patch`. Patch `0003` gets refreshed context. - `roles/neutron`: the policy rules use the in-process checks, and the sidecar is no longer enabled. If `neutron_helm_values` still overrides policy rules with `:9697` checks, the role now stops before deploying and lists the affected rules. Otherwise those rules would fail at runtime once the sidecar is gone. - Images: the `neutron:main` pins move to the build that includes neutron-policy-server#15 (verified: its `entry_points.txt` registers all four checks), and the `neutron_policy_server` image is dropped. - Docs explain the checks and how to quarantine an instance. A release note covers the feature and the upgrade requirement. Testing: `ansible-lint` passes on the changed role files, and `chart-vendor` reproduces `charts/neutron` from upstream plus patches. I ran the guard task against empty overrides, unrelated overrides, and a `:9697` override; only the last one fails, and it names the rule. The checks themselves are covered in neutron-policy-server, including requests through Neutron''s API stack. The AIO jobs exercise them end to end here. ' change_url: https://github.com/vexxhost/atmosphere/pull/4439 commit_id: a440cf28490d8c9316e4ab05d36a19e75fa0c0f2 patchset: a440cf28490d8c9316e4ab05d36a19e75fa0c0f2 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null change: '4439' change_message: 'feat(neutron): run policy server checks in-process and add quarantine The Neutron policy server ran as a sidecar next to `neutron-server`, and Neutron called it over HTTP (`http://neutron-server:9697/...`) on every port update and delete it covered. Each pod carried an extra container with its own uWSGI workers and database pool, and a sidecar outage turned member port updates into errors. [vexxhost/neutron-policy-server#15](https://github.com/vexxhost/neutron-policy-server/pull/15) added the same checks as `oslo.policy` rule checks, loaded through the `oslo.policy.rule_checks` entry point. The Neutron image already installs the package, so they run inside `neutron-server`. This switches Atmosphere over and removes the sidecar: | Rule | Before | After | |---|---|---| | `delete_port` | `http://neutron-server:9697/port-delete` | `port_delete:strict=1` | | `update_port:mac_address`, `update_port:fixed_ips` | `http://neutron-server:9697/port-update` | `port_update:strict=1` | | `update_port:allowed_address_pairs` | `http://neutron-server:9697/address-pair` | `address_pair:strict=1` | | `update_port` | Neutron default | Neutron default plus `quarantine:security_group=quarantine` | The new quarantine check stops project members from changing security groups, allowed address pairs or port security on a port that carries a security group named `quarantine` owned by another project. Only an administrator can attach such a group, so the check needs no Nova lookup. The `update_port` override is otherwise identical to Neutron''s default (`(rule:admin_only) or (rule:service_api) or role:member and project_id:%(project_id)s`). Changes: - Neutron chart: the sidecar container, service port, uWSGI config, script and image are removed. Patch `0002` also carried an unrelated switch of the API server''s uWSGI to the `neutron.wsgi.api:application` module, so it''s kept as `0002-use-neutron-wsgi-module.patch`. Patch `0003` gets refreshed context. - `roles/neutron`: the policy rules use the in-process checks, and the sidecar is no longer enabled. If `neutron_helm_values` still overrides policy rules with `:9697` checks, the role now stops before deploying and lists the affected rules. Otherwise those rules would fail at runtime once the sidecar is gone. - Images: the `neutron:main` pins move to the build that includes neutron-policy-server#15 (verified: its `entry_points.txt` registers all four checks), and the `neutron_policy_server` image is dropped. - Docs explain the checks and how to quarantine an instance. A release note covers the feature and the upgrade requirement. Testing: `ansible-lint` passes on the changed role files, and `chart-vendor` reproduces `charts/neutron` from upstream plus patches. I ran the guard task against empty overrides, unrelated overrides, and a `:9697` override; only the last one fails, and it names the rule. The checks themselves are covered in neutron-policy-server, including requests through Neutron''s API stack. The AIO jobs exercise them end to end here. ' change_url: https://github.com/vexxhost/atmosphere/pull/4439 child_jobs: [] commit_id: a440cf28490d8c9316e4ab05d36a19e75fa0c0f2 event_id: efea7c20-d204-11f1-8264-7a5618a2fec4 executor: hostname: 2d72f0692154 inventory_file: /var/lib/zuul/builds/094644bc9c4e424298e61b2f09c49fbe/ansible/inventory.yaml log_root: /var/lib/zuul/builds/094644bc9c4e424298e61b2f09c49fbe/work/logs result_data_file: /var/lib/zuul/builds/094644bc9c4e424298e61b2f09c49fbe/work/results.json src_root: /var/lib/zuul/builds/094644bc9c4e424298e61b2f09c49fbe/work/src work_root: /var/lib/zuul/builds/094644bc9c4e424298e61b2f09c49fbe/work include_vars: [] items: - branch: main change: '4439' change_message: 'feat(neutron): run policy server checks in-process and add quarantine The Neutron policy server ran as a sidecar next to `neutron-server`, and Neutron called it over HTTP (`http://neutron-server:9697/...`) on every port update and delete it covered. Each pod carried an extra container with its own uWSGI workers and database pool, and a sidecar outage turned member port updates into errors. [vexxhost/neutron-policy-server#15](https://github.com/vexxhost/neutron-policy-server/pull/15) added the same checks as `oslo.policy` rule checks, loaded through the `oslo.policy.rule_checks` entry point. The Neutron image already installs the package, so they run inside `neutron-server`. This switches Atmosphere over and removes the sidecar: | Rule | Before | After | |---|---|---| | `delete_port` | `http://neutron-server:9697/port-delete` | `port_delete:strict=1` | | `update_port:mac_address`, `update_port:fixed_ips` | `http://neutron-server:9697/port-update` | `port_update:strict=1` | | `update_port:allowed_address_pairs` | `http://neutron-server:9697/address-pair` | `address_pair:strict=1` | | `update_port` | Neutron default | Neutron default plus `quarantine:security_group=quarantine` | The new quarantine check stops project members from changing security groups, allowed address pairs or port security on a port that carries a security group named `quarantine` owned by another project. Only an administrator can attach such a group, so the check needs no Nova lookup. The `update_port` override is otherwise identical to Neutron''s default (`(rule:admin_only) or (rule:service_api) or role:member and project_id:%(project_id)s`). Changes: - Neutron chart: the sidecar container, service port, uWSGI config, script and image are removed. Patch `0002` also carried an unrelated switch of the API server''s uWSGI to the `neutron.wsgi.api:application` module, so it''s kept as `0002-use-neutron-wsgi-module.patch`. Patch `0003` gets refreshed context. - `roles/neutron`: the policy rules use the in-process checks, and the sidecar is no longer enabled. If `neutron_helm_values` still overrides policy rules with `:9697` checks, the role now stops before deploying and lists the affected rules. Otherwise those rules would fail at runtime once the sidecar is gone. - Images: the `neutron:main` pins move to the build that includes neutron-policy-server#15 (verified: its `entry_points.txt` registers all four checks), and the `neutron_policy_server` image is dropped. - Docs explain the checks and how to quarantine an instance. A release note covers the feature and the upgrade requirement. Testing: `ansible-lint` passes on the changed role files, and `chart-vendor` reproduces `charts/neutron` from upstream plus patches. I ran the guard task against empty overrides, unrelated overrides, and a `:9697` override; only the last one fails, and it names the rule. The checks themselves are covered in neutron-policy-server, including requests through Neutron''s API stack. The AIO jobs exercise them end to end here. ' change_url: https://github.com/vexxhost/atmosphere/pull/4439 commit_id: a440cf28490d8c9316e4ab05d36a19e75fa0c0f2 patchset: a440cf28490d8c9316e4ab05d36a19e75fa0c0f2 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null job: atmosphere-molecule-csi-rbd jobtags: [] max_attempts: 3 message: ZmVhdChuZXV0cm9uKTogcnVuIHBvbGljeSBzZXJ2ZXIgY2hlY2tzIGluLXByb2Nlc3MgYW5kIGFkZCBxdWFyYW50aW5lCgpUaGUgTmV1dHJvbiBwb2xpY3kgc2VydmVyIHJhbiBhcyBhIHNpZGVjYXIgbmV4dCB0byBgbmV1dHJvbi1zZXJ2ZXJgLCBhbmQgTmV1dHJvbiBjYWxsZWQgaXQgb3ZlciBIVFRQIChgaHR0cDovL25ldXRyb24tc2VydmVyOjk2OTcvLi4uYCkgb24gZXZlcnkgcG9ydCB1cGRhdGUgYW5kIGRlbGV0ZSBpdCBjb3ZlcmVkLiBFYWNoIHBvZCBjYXJyaWVkIGFuIGV4dHJhIGNvbnRhaW5lciB3aXRoIGl0cyBvd24gdVdTR0kgd29ya2VycyBhbmQgZGF0YWJhc2UgcG9vbCwgYW5kIGEgc2lkZWNhciBvdXRhZ2UgdHVybmVkIG1lbWJlciBwb3J0IHVwZGF0ZXMgaW50byBlcnJvcnMuCgpbdmV4eGhvc3QvbmV1dHJvbi1wb2xpY3ktc2VydmVyIzE1XShodHRwczovL2dpdGh1Yi5jb20vdmV4eGhvc3QvbmV1dHJvbi1wb2xpY3ktc2VydmVyL3B1bGwvMTUpIGFkZGVkIHRoZSBzYW1lIGNoZWNrcyBhcyBgb3Nsby5wb2xpY3lgIHJ1bGUgY2hlY2tzLCBsb2FkZWQgdGhyb3VnaCB0aGUgYG9zbG8ucG9saWN5LnJ1bGVfY2hlY2tzYCBlbnRyeSBwb2ludC4gVGhlIE5ldXRyb24gaW1hZ2UgYWxyZWFkeSBpbnN0YWxscyB0aGUgcGFja2FnZSwgc28gdGhleSBydW4gaW5zaWRlIGBuZXV0cm9uLXNlcnZlcmAuIFRoaXMgc3dpdGNoZXMgQXRtb3NwaGVyZSBvdmVyIGFuZCByZW1vdmVzIHRoZSBzaWRlY2FyOgoKfCBSdWxlIHwgQmVmb3JlIHwgQWZ0ZXIgfAp8LS0tfC0tLXwtLS18CnwgYGRlbGV0ZV9wb3J0YCB8IGBodHRwOi8vbmV1dHJvbi1zZXJ2ZXI6OTY5Ny9wb3J0LWRlbGV0ZWAgfCBgcG9ydF9kZWxldGU6c3RyaWN0PTFgIHwKfCBgdXBkYXRlX3BvcnQ6bWFjX2FkZHJlc3NgLCBgdXBkYXRlX3BvcnQ6Zml4ZWRfaXBzYCB8IGBodHRwOi8vbmV1dHJvbi1zZXJ2ZXI6OTY5Ny9wb3J0LXVwZGF0ZWAgfCBgcG9ydF91cGRhdGU6c3RyaWN0PTFgIHwKfCBgdXBkYXRlX3BvcnQ6YWxsb3dlZF9hZGRyZXNzX3BhaXJzYCB8IGBodHRwOi8vbmV1dHJvbi1zZXJ2ZXI6OTY5Ny9hZGRyZXNzLXBhaXJgIHwgYGFkZHJlc3NfcGFpcjpzdHJpY3Q9MWAgfAp8IGB1cGRhdGVfcG9ydGAgfCBOZXV0cm9uIGRlZmF1bHQgfCBOZXV0cm9uIGRlZmF1bHQgcGx1cyBgcXVhcmFudGluZTpzZWN1cml0eV9ncm91cD1xdWFyYW50aW5lYCB8CgpUaGUgbmV3IHF1YXJhbnRpbmUgY2hlY2sgc3RvcHMgcHJvamVjdCBtZW1iZXJzIGZyb20gY2hhbmdpbmcgc2VjdXJpdHkgZ3JvdXBzLCBhbGxvd2VkIGFkZHJlc3MgcGFpcnMgb3IgcG9ydCBzZWN1cml0eSBvbiBhIHBvcnQgdGhhdCBjYXJyaWVzIGEgc2VjdXJpdHkgZ3JvdXAgbmFtZWQgYHF1YXJhbnRpbmVgIG93bmVkIGJ5IGFub3RoZXIgcHJvamVjdC4gT25seSBhbiBhZG1pbmlzdHJhdG9yIGNhbiBhdHRhY2ggc3VjaCBhIGdyb3VwLCBzbyB0aGUgY2hlY2sgbmVlZHMgbm8gTm92YSBsb29rdXAuIFRoZSBgdXBkYXRlX3BvcnRgIG92ZXJyaWRlIGlzIG90aGVyd2lzZSBpZGVudGljYWwgdG8gTmV1dHJvbidzIGRlZmF1bHQgKGAocnVsZTphZG1pbl9vbmx5KSBvciAocnVsZTpzZXJ2aWNlX2FwaSkgb3Igcm9sZTptZW1iZXIgYW5kIHByb2plY3RfaWQ6JShwcm9qZWN0X2lkKXNgKS4KCkNoYW5nZXM6CgotIE5ldXRyb24gY2hhcnQ6IHRoZSBzaWRlY2FyIGNvbnRhaW5lciwgc2VydmljZSBwb3J0LCB1V1NHSSBjb25maWcsIHNjcmlwdCBhbmQgaW1hZ2UgYXJlIHJlbW92ZWQuIFBhdGNoIGAwMDAyYCBhbHNvIGNhcnJpZWQgYW4gdW5yZWxhdGVkIHN3aXRjaCBvZiB0aGUgQVBJIHNlcnZlcidzIHVXU0dJIHRvIHRoZSBgbmV1dHJvbi53c2dpLmFwaTphcHBsaWNhdGlvbmAgbW9kdWxlLCBzbyBpdCdzIGtlcHQgYXMgYDAwMDItdXNlLW5ldXRyb24td3NnaS1tb2R1bGUucGF0Y2hgLiBQYXRjaCBgMDAwM2AgZ2V0cyByZWZyZXNoZWQgY29udGV4dC4KLSBgcm9sZXMvbmV1dHJvbmA6IHRoZSBwb2xpY3kgcnVsZXMgdXNlIHRoZSBpbi1wcm9jZXNzIGNoZWNrcywgYW5kIHRoZSBzaWRlY2FyIGlzIG5vIGxvbmdlciBlbmFibGVkLiBJZiBgbmV1dHJvbl9oZWxtX3ZhbHVlc2Agc3RpbGwgb3ZlcnJpZGVzIHBvbGljeSBydWxlcyB3aXRoIGA6OTY5N2AgY2hlY2tzLCB0aGUgcm9sZSBub3cgc3RvcHMgYmVmb3JlIGRlcGxveWluZyBhbmQgbGlzdHMgdGhlIGFmZmVjdGVkIHJ1bGVzLiBPdGhlcndpc2UgdGhvc2UgcnVsZXMgd291bGQgZmFpbCBhdCBydW50aW1lIG9uY2UgdGhlIHNpZGVjYXIgaXMgZ29uZS4KLSBJbWFnZXM6IHRoZSBgbmV1dHJvbjptYWluYCBwaW5zIG1vdmUgdG8gdGhlIGJ1aWxkIHRoYXQgaW5jbHVkZXMgbmV1dHJvbi1wb2xpY3ktc2VydmVyIzE1ICh2ZXJpZmllZDogaXRzIGBlbnRyeV9wb2ludHMudHh0YCByZWdpc3RlcnMgYWxsIGZvdXIgY2hlY2tzKSwgYW5kIHRoZSBgbmV1dHJvbl9wb2xpY3lfc2VydmVyYCBpbWFnZSBpcyBkcm9wcGVkLgotIERvY3MgZXhwbGFpbiB0aGUgY2hlY2tzIGFuZCBob3cgdG8gcXVhcmFudGluZSBhbiBpbnN0YW5jZS4gQSByZWxlYXNlIG5vdGUgY292ZXJzIHRoZSBmZWF0dXJlIGFuZCB0aGUgdXBncmFkZSByZXF1aXJlbWVudC4KClRlc3Rpbmc6IGBhbnNpYmxlLWxpbnRgIHBhc3NlcyBvbiB0aGUgY2hhbmdlZCByb2xlIGZpbGVzLCBhbmQgYGNoYXJ0LXZlbmRvcmAgcmVwcm9kdWNlcyBgY2hhcnRzL25ldXRyb25gIGZyb20gdXBzdHJlYW0gcGx1cyBwYXRjaGVzLiBJIHJhbiB0aGUgZ3VhcmQgdGFzayBhZ2FpbnN0IGVtcHR5IG92ZXJyaWRlcywgdW5yZWxhdGVkIG92ZXJyaWRlcywgYW5kIGEgYDo5Njk3YCBvdmVycmlkZTsgb25seSB0aGUgbGFzdCBvbmUgZmFpbHMsIGFuZCBpdCBuYW1lcyB0aGUgcnVsZS4gVGhlIGNoZWNrcyB0aGVtc2VsdmVzIGFyZSBjb3ZlcmVkIGluIG5ldXRyb24tcG9saWN5LXNlcnZlciwgaW5jbHVkaW5nIHJlcXVlc3RzIHRocm91Z2ggTmV1dHJvbidzIEFQSSBzdGFjay4gVGhlIEFJTyBqb2JzIGV4ZXJjaXNlIHRoZW0gZW5kIHRvIGVuZCBoZXJlLgo= patchset: a440cf28490d8c9316e4ab05d36a19e75fa0c0f2 pipeline: check playbook_context: playbook_projects: trusted/project_0/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 trusted/project_1/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: be52461cd48abccbf95b13a58b2551ac673d8ad7 trusted/project_2/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: 4fd48825891421af0774bdd500fee36e111d80a6 untrusted/project_0/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: 4fd48825891421af0774bdd500fee36e111d80a6 untrusted/project_1/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 untrusted/project_2/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: be52461cd48abccbf95b13a58b2551ac673d8ad7 untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs: canonical_name: github.com/vexxhost/atmosphere-zuul-jobs checkout: main commit: 4ee8667d55d1aa6230b954e7dc0574946f8c4373 untrusted/project_4/opendev.org/openstack/openstack-helm: canonical_name: opendev.org/openstack/openstack-helm checkout: master commit: 3307478d82183ff8d297f2edcd718ad0bd65c4dd playbooks: - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/run.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/playbook_0/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/playbook_0/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/playbook_0/role_2/zuul-jobs/roles post_playbooks: - path: untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs/playbooks/molecule/post.yml roles: - checkout: main checkout_description: playbook branch link_name: ansible/post_playbook_0/role_0/atmosphere-zuul-jobs link_target: untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs role_path: ansible/post_playbook_0/role_0/atmosphere-zuul-jobs/roles - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/post_playbook_0/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_0/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_0/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_0/role_4/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_1/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_1/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_1/role_2/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post-logs.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_2/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_2/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_2/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_2/role_2/zuul-jobs/roles pre_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_0/role_2/zuul-jobs/roles - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_1/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_1/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_1/role_2/zuul-jobs/roles - path: untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs/playbooks/molecule/pre.yml roles: - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_2/role_0/atmosphere-zuul-jobs link_target: untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs role_path: ansible/pre_playbook_2/role_0/atmosphere-zuul-jobs/roles - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/pre_playbook_2/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_2/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_2/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_2/role_4/zuul-jobs/roles post_review: false post_timeout: null pre_timeout: null project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere projects: github.com/ansible-collections/ansible.netcommon: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.netcommon checkout: main checkout_description: zuul branch commit: 0bc07de0f543eb6415f491d5eaefce0a89c5b390 name: ansible-collections/ansible.netcommon required: true short_name: ansible.netcommon src_dir: src/github.com/ansible-collections/ansible.netcommon github.com/ansible-collections/ansible.posix: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.posix checkout: main checkout_description: zuul branch commit: 0f4453f85ee993687a4cab860e3b55438144f920 name: ansible-collections/ansible.posix required: true short_name: ansible.posix src_dir: src/github.com/ansible-collections/ansible.posix github.com/ansible-collections/ansible.utils: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.utils checkout: main checkout_description: zuul branch commit: 1f3e1bdfe2ba8904d397222dd6f90911d6f2402b name: ansible-collections/ansible.utils required: true short_name: ansible.utils src_dir: src/github.com/ansible-collections/ansible.utils github.com/ansible-collections/community.crypto: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.crypto checkout: main checkout_description: zuul branch commit: 1bdefe5f420bb2d38cf92ea109ca39e1d4372347 name: ansible-collections/community.crypto required: true short_name: community.crypto src_dir: src/github.com/ansible-collections/community.crypto github.com/ansible-collections/community.general: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.general checkout: main checkout_description: zuul branch commit: 11d8912ad2b4da193a5f92f7131c69eeca7e9667 name: ansible-collections/community.general required: true short_name: community.general src_dir: src/github.com/ansible-collections/community.general github.com/ansible-collections/community.mysql: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.mysql checkout: main checkout_description: zuul branch commit: 4cf7a3176fbd07be43459f1366e8066381df6d97 name: ansible-collections/community.mysql required: true short_name: community.mysql src_dir: src/github.com/ansible-collections/community.mysql github.com/ansible-collections/kubernetes.core: canonical_hostname: github.com canonical_name: github.com/ansible-collections/kubernetes.core checkout: main checkout_description: zuul branch commit: 782672d2fdb0004d593440a3ddd4b9db014d9e4b name: ansible-collections/kubernetes.core required: true short_name: kubernetes.core src_dir: src/github.com/ansible-collections/kubernetes.core github.com/vexxhost/ansible-collection-ceph: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-ceph checkout: main checkout_description: zuul branch commit: 44a694a80e3179c28d75180baa1a56426f987257 name: vexxhost/ansible-collection-ceph required: true short_name: ansible-collection-ceph src_dir: src/github.com/vexxhost/ansible-collection-ceph github.com/vexxhost/ansible-collection-containers: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-containers checkout: main checkout_description: zuul branch commit: d22923ebd40c0fd5a345318c1db90d125fb5140f name: vexxhost/ansible-collection-containers required: true short_name: ansible-collection-containers src_dir: src/github.com/vexxhost/ansible-collection-containers github.com/vexxhost/ansible-collection-kubernetes: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes checkout: main checkout_description: zuul branch commit: bb3fd0fde58a5b158605523e708645eb2a763886 name: vexxhost/ansible-collection-kubernetes required: true short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes github.com/vexxhost/atmosphere: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere checkout: main checkout_description: zuul branch commit: a440cf28490d8c9316e4ab05d36a19e75fa0c0f2 name: vexxhost/atmosphere required: false short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere github.com/vexxhost/atmosphere.common: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common checkout: main checkout_description: zuul branch commit: 0317937da7abc1979d331af8b8f7b640b80d7e75 name: vexxhost/atmosphere.common required: true short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common opendev.org/openstack/ansible-collections-openstack: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/ansible-collections-openstack checkout: master checkout_description: project default branch commit: ac8cce11c7535fcf01a8b76487db08b1958ea68b name: openstack/ansible-collections-openstack required: true short_name: ansible-collections-openstack src_dir: src/opendev.org/openstack/ansible-collections-openstack ref: refs/pull/4439/head resources: {} tenant: oss timeout: 1800 topic: null voting: true