all: children: cephs: hosts: instance: null computes: hosts: instance: null controllers: hosts: instance: null zuul_unreachable: hosts: {} hosts: instance: ansible_connection: ssh ansible_host: 162.253.55.186 ansible_port: 22 ansible_python_interpreter: auto ansible_user: zuul atmosphere_image_prefix: harbor.atmosphere.dev/ atmosphere_release_manifest: /tmp/atmosphere-release-manifest.yaml ceph_conf_overrides: - option: mon allow pool size one section: global value: true - option: osd crush chooseleaf type section: global value: 0 - option: auth allow insecure global id reclaim section: mon value: false ceph_csi_rbd_helm_values: provisioner: replicaCount: 1 ceph_fsid: 4837cbf8-4f90-4300-b3f6-726c9b9f89b4 ceph_osd_devices: - /dev/ceph-{{ inventory_hostname_short }}-osd0/data - /dev/ceph-{{ inventory_hostname_short }}-osd1/data - /dev/ceph-{{ inventory_hostname_short }}-osd2/data cilium_helm_values: operator: replicas: 1 cluster_issuer_type: self-signed csi_driver: local-path-provisioner ingress_nginx_helm_values: controller: config: worker-processes: 2 keystone_helm_values: pod: replicas: api: 1 kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' molecule_install_collection_siblings: true molecule_scenario: keycloak nodepool: az: yul2 cloud: public external_id: 0c3ef012-f44d-4468-b478-9a6543f2d8b5 host_id: 295be722de1fea3f7e3e51fa3e8841b85f43ad2d1df63019fdbc1696 interface_ip: 162.253.55.186 label: ubuntu-jammy node_properties: {} private_ipv4: 162.253.55.186 private_ipv6: null provider: yul1 public_ipv4: 162.253.55.186 public_ipv6: 2604:e100:1:0:f816:3eff:feca:3988 region: ca-ymq-1 slot: null percona_xtradb_cluster_spec: allowUnsafeConfigurations: true haproxy: size: 1 pxc: size: 1 zuul_node: az: yul2 cloud: public external_id: 0c3ef012-f44d-4468-b478-9a6543f2d8b5 host_id: 295be722de1fea3f7e3e51fa3e8841b85f43ad2d1df63019fdbc1696 interface_ip: 162.253.55.186 label: ubuntu-jammy node_properties: {} private_ipv4: 162.253.55.186 private_ipv6: null provider: yul1 public_ipv4: 162.253.55.186 public_ipv6: 2604:e100:1:0:f816:3eff:feca:3988 region: ca-ymq-1 slot: null uuid: null vars: atmosphere_image_prefix: harbor.atmosphere.dev/ atmosphere_release_manifest: /tmp/atmosphere-release-manifest.yaml ceph_conf_overrides: - option: mon allow pool size one section: global value: true - option: osd crush chooseleaf type section: global value: 0 - option: auth allow insecure global id reclaim section: mon value: false ceph_csi_rbd_helm_values: provisioner: replicaCount: 1 ceph_fsid: 4837cbf8-4f90-4300-b3f6-726c9b9f89b4 ceph_osd_devices: - /dev/ceph-{{ inventory_hostname_short }}-osd0/data - /dev/ceph-{{ inventory_hostname_short }}-osd1/data - /dev/ceph-{{ inventory_hostname_short }}-osd2/data cilium_helm_values: operator: replicas: 1 cluster_issuer_type: self-signed csi_driver: local-path-provisioner ingress_nginx_helm_values: controller: config: worker-processes: 2 keystone_helm_values: pod: replicas: api: 1 kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' molecule_install_collection_siblings: true molecule_scenario: keycloak percona_xtradb_cluster_spec: allowUnsafeConfigurations: true haproxy: size: 1 pxc: size: 1 zuul: _inheritance_path: - '' - '' - '' - '' - '' ansible_version: '9' attempts: 1 branch: main build: 2eb8f8c87f154f5eb8c15451bfa32b02 build_refs: - branch: main change: '4420' change_message: "feat: publish release manifests and deploy from them\n\nToday a release resolves image tags at release time, after CI has run: 88 of the 232 entries in `roles/defaults/vars/main.yml` are plain tags, and `cmd/pinimages` resolves them into the Galaxy collection, silently skipping any it cannot resolve (it logs 94 errors on `main` today). The digests a release ships are only recorded inside the Galaxy tarball, and mirroring for air-gapped installs goes through the `image_manifest` role, whose registry rewrite keeps only the last path component, so `rook/ceph` and `ceph/ceph` both become `/ceph`.\n\nThis PR makes a digest-pinned **release manifest** the source of truth for which images a commit or release deploys.\n\n**Publishing**\n- The `build` job already resolved every image on each push; it now publishes the result as an OCI artifact to `ghcr.io/vexxhost/atmosphere-release`, tagged with the full commit SHA and the branch (`main`, `stable-2025.2`, ...) as computed by `docker/metadata-action`.\n- `release.yaml` uses `docker/metadata-action` for the release tag and promotes the released commit's manifest to it (no tag is resolved again). GoReleaser (`.goreleaser.yaml`) attaches `atmosphere-release` archives for linux/darwin amd64/arm64, their checksums and the release manifest to the existing GitHub release without touching its notes, and the Galaxy collection is pinned from that same manifest.\n\n**Deploying**\n- `atmosphere_release_manifest` (OCI reference or file path) deploys exactly a manifest's images. Kubernetes control plane images fall back to the tag when another `atmosphere_kubernetes_version` is deployed.\n- `atmosphere_image_mirrors` redirects images per registry, namespace or repository (most specific rule wins); `atmosphere_image_prefix` still applies to everything no rule matches, so Harbor proxy projects with custom names now work too.\n- Resolution happens in the rendered references, so it works with any Kubernetes and container runtime. `atmosphere_image_overrides` are applied last, unchanged.\n\n**`atmosphere-release` command** (`cmd/atmosphere-release`, replaces `cmd/pinimages`)\n- `generate [--write-vars] [--resolve-prefix]`, `push`, `promote`, `show`, `diff`, `check`. `push` and `promote` take `repository:tag` references, so they consume `docker/metadata-action` output directly; `--resolve-prefix` resolves tags through a pull-through cache (falling back to the source registry) to avoid upstream rate limits.\n- `mirror` to a registry, or `--to-dir` / `--from-dir` for disconnected sites, in `nested`, `flat` (`quay.io--ceph--ceph`) or `single-repo` layouts. Images are copied with every platform so digests never change, each digest is verified, kubeadm's images stay under one prefix with their original names, the manifest artifact itself is copied with its digest intact, and the `atmosphere_release_manifest` / `atmosphere_image_mirrors` vars are written out.\n\nThe `image_manifest` role keeps working but now warns that it is deprecated.\n\n### Compatibility\n\nDeployments that set none of the new variables get byte-identical `atmosphere_images`: I rendered the `defaults` role through `ansible-playbook` before and after this change with no prefix, with a Harbor prefix, and with prefix + overrides, on `main` (231 images) and on `stable/zed` (216 images); all outputs are identical. `write-vars` produces the same vars file as `pinimages` except that Ceph is now pinned too (`pinimages` could not resolve its `{{ ceph_version }}` template).\n\n### Testing\n\n- Go: `internal/releasemanifest` tests cover generation, `write-vars`, push/fetch/promote, every mirror layout with multi-arch images in in-memory registries, directory export/import, digest-mismatch detection, registries with ports and retry on rate limits.\n- Python: the `resolve_images` filter and the Go resolver run the same cases from `internal/releasemanifest/testdata/resolve.yaml`; the lookup is tested against a local HTTP registry with token auth and blob redirects (credentials must not reach storage) and tampered content. A new `python-test` CI job runs these (the existing `tests/unit` suite is not run in CI and has a stale magnum expectation, so the job only runs the new tests).\n- End to end against a local CNCF Distribution registry with real images from `registry.k8s.io`, `ghcr.io` and Docker Hub: `generate`, `push`, `promote`, `show`, nested mirror, export \u2192 flat import, `check`, `diff`, plus deploying the mirrored manifest through the lookup.\n- `generate` against the real registries resolves all 231 images on `main` and `stable/2025.2`.\n\n### Backports\n\n`go.mod` and `go.sum` are untouched; every dependency is already present at the same version on all stable branches.\n\n- `stable/2025.2` cherry-picks cleanly and passes everything above.\n- `stable/2025.1` back to `stable/zed` conflict in one hunk of `roles/defaults/vars/main.yml`: the conflict context includes `main`'s `_atmosphere_storage` block, which those branches don't have. Resolve it by keeping the new `atmosphere_images` block and dropping the `_atmosphere_storage` lines. I did this on `stable/zed` and the Go tests, Python tests and the old/new rendering comparison all pass.\n\n### CI deploys the manifest\n\nvexxhost/atmosphere-zuul-jobs#7 makes the molecule jobs generate this change's release manifest (through the `harbor.atmosphere.dev/` cache) and deploy from it with `atmosphere_release_manifest`, so the AIO, CSI and Keycloak jobs exercise the manifest path and deploy exactly the images that would be published.\n\n### Before merging / follow-ups\n\n- After the first push publishes `ghcr.io/vexxhost/atmosphere-release`, make the package public and set retention (keep release tags; commit tags can be pruned).\n- Docker Hub's anonymous rate limit can still fail `generate` after its retries; previously this silently produced unpinned images.\n- `harbor.atmosphere.dev` has no proxy project for `packages.vexxhost.com` (used by `prometheus_smartctl_exporter`).\n- The docs build with `-W` already fails on `main` because of existing warnings in `admin/monitoring.rst` and `arch/images.rst`; the new page adds none.\n\nDepends-On: https://github.com/vexxhost/atmosphere-zuul-jobs/pull/7\n" change_url: https://github.com/vexxhost/atmosphere/pull/4420 commit_id: f214a51208af4f64ef3bf55f2bd13cce5102c26e patchset: f214a51208af4f64ef3bf55f2bd13cce5102c26e project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null buildset: 64dd5a5765664524a5cf17ac9ac1ecbd buildset_refs: - branch: main change: '4420' change_message: "feat: publish release manifests and deploy from them\n\nToday a release resolves image tags at release time, after CI has run: 88 of the 232 entries in `roles/defaults/vars/main.yml` are plain tags, and `cmd/pinimages` resolves them into the Galaxy collection, silently skipping any it cannot resolve (it logs 94 errors on `main` today). The digests a release ships are only recorded inside the Galaxy tarball, and mirroring for air-gapped installs goes through the `image_manifest` role, whose registry rewrite keeps only the last path component, so `rook/ceph` and `ceph/ceph` both become `/ceph`.\n\nThis PR makes a digest-pinned **release manifest** the source of truth for which images a commit or release deploys.\n\n**Publishing**\n- The `build` job already resolved every image on each push; it now publishes the result as an OCI artifact to `ghcr.io/vexxhost/atmosphere-release`, tagged with the full commit SHA and the branch (`main`, `stable-2025.2`, ...) as computed by `docker/metadata-action`.\n- `release.yaml` uses `docker/metadata-action` for the release tag and promotes the released commit's manifest to it (no tag is resolved again). GoReleaser (`.goreleaser.yaml`) attaches `atmosphere-release` archives for linux/darwin amd64/arm64, their checksums and the release manifest to the existing GitHub release without touching its notes, and the Galaxy collection is pinned from that same manifest.\n\n**Deploying**\n- `atmosphere_release_manifest` (OCI reference or file path) deploys exactly a manifest's images. Kubernetes control plane images fall back to the tag when another `atmosphere_kubernetes_version` is deployed.\n- `atmosphere_image_mirrors` redirects images per registry, namespace or repository (most specific rule wins); `atmosphere_image_prefix` still applies to everything no rule matches, so Harbor proxy projects with custom names now work too.\n- Resolution happens in the rendered references, so it works with any Kubernetes and container runtime. `atmosphere_image_overrides` are applied last, unchanged.\n\n**`atmosphere-release` command** (`cmd/atmosphere-release`, replaces `cmd/pinimages`)\n- `generate [--write-vars] [--resolve-prefix]`, `push`, `promote`, `show`, `diff`, `check`. `push` and `promote` take `repository:tag` references, so they consume `docker/metadata-action` output directly; `--resolve-prefix` resolves tags through a pull-through cache (falling back to the source registry) to avoid upstream rate limits.\n- `mirror` to a registry, or `--to-dir` / `--from-dir` for disconnected sites, in `nested`, `flat` (`quay.io--ceph--ceph`) or `single-repo` layouts. Images are copied with every platform so digests never change, each digest is verified, kubeadm's images stay under one prefix with their original names, the manifest artifact itself is copied with its digest intact, and the `atmosphere_release_manifest` / `atmosphere_image_mirrors` vars are written out.\n\nThe `image_manifest` role keeps working but now warns that it is deprecated.\n\n### Compatibility\n\nDeployments that set none of the new variables get byte-identical `atmosphere_images`: I rendered the `defaults` role through `ansible-playbook` before and after this change with no prefix, with a Harbor prefix, and with prefix + overrides, on `main` (231 images) and on `stable/zed` (216 images); all outputs are identical. `write-vars` produces the same vars file as `pinimages` except that Ceph is now pinned too (`pinimages` could not resolve its `{{ ceph_version }}` template).\n\n### Testing\n\n- Go: `internal/releasemanifest` tests cover generation, `write-vars`, push/fetch/promote, every mirror layout with multi-arch images in in-memory registries, directory export/import, digest-mismatch detection, registries with ports and retry on rate limits.\n- Python: the `resolve_images` filter and the Go resolver run the same cases from `internal/releasemanifest/testdata/resolve.yaml`; the lookup is tested against a local HTTP registry with token auth and blob redirects (credentials must not reach storage) and tampered content. A new `python-test` CI job runs these (the existing `tests/unit` suite is not run in CI and has a stale magnum expectation, so the job only runs the new tests).\n- End to end against a local CNCF Distribution registry with real images from `registry.k8s.io`, `ghcr.io` and Docker Hub: `generate`, `push`, `promote`, `show`, nested mirror, export \u2192 flat import, `check`, `diff`, plus deploying the mirrored manifest through the lookup.\n- `generate` against the real registries resolves all 231 images on `main` and `stable/2025.2`.\n\n### Backports\n\n`go.mod` and `go.sum` are untouched; every dependency is already present at the same version on all stable branches.\n\n- `stable/2025.2` cherry-picks cleanly and passes everything above.\n- `stable/2025.1` back to `stable/zed` conflict in one hunk of `roles/defaults/vars/main.yml`: the conflict context includes `main`'s `_atmosphere_storage` block, which those branches don't have. Resolve it by keeping the new `atmosphere_images` block and dropping the `_atmosphere_storage` lines. I did this on `stable/zed` and the Go tests, Python tests and the old/new rendering comparison all pass.\n\n### CI deploys the manifest\n\nvexxhost/atmosphere-zuul-jobs#7 makes the molecule jobs generate this change's release manifest (through the `harbor.atmosphere.dev/` cache) and deploy from it with `atmosphere_release_manifest`, so the AIO, CSI and Keycloak jobs exercise the manifest path and deploy exactly the images that would be published.\n\n### Before merging / follow-ups\n\n- After the first push publishes `ghcr.io/vexxhost/atmosphere-release`, make the package public and set retention (keep release tags; commit tags can be pruned).\n- Docker Hub's anonymous rate limit can still fail `generate` after its retries; previously this silently produced unpinned images.\n- `harbor.atmosphere.dev` has no proxy project for `packages.vexxhost.com` (used by `prometheus_smartctl_exporter`).\n- The docs build with `-W` already fails on `main` because of existing warnings in `admin/monitoring.rst` and `arch/images.rst`; the new page adds none.\n\nDepends-On: https://github.com/vexxhost/atmosphere-zuul-jobs/pull/7\n" change_url: https://github.com/vexxhost/atmosphere/pull/4420 commit_id: f214a51208af4f64ef3bf55f2bd13cce5102c26e patchset: f214a51208af4f64ef3bf55f2bd13cce5102c26e project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null change: '4420' change_message: "feat: publish release manifests and deploy from them\n\nToday a release resolves image tags at release time, after CI has run: 88 of the 232 entries in `roles/defaults/vars/main.yml` are plain tags, and `cmd/pinimages` resolves them into the Galaxy collection, silently skipping any it cannot resolve (it logs 94 errors on `main` today). The digests a release ships are only recorded inside the Galaxy tarball, and mirroring for air-gapped installs goes through the `image_manifest` role, whose registry rewrite keeps only the last path component, so `rook/ceph` and `ceph/ceph` both become `/ceph`.\n\nThis PR makes a digest-pinned **release manifest** the source of truth for which images a commit or release deploys.\n\n**Publishing**\n- The `build` job already resolved every image on each push; it now publishes the result as an OCI artifact to `ghcr.io/vexxhost/atmosphere-release`, tagged with the full commit SHA and the branch (`main`, `stable-2025.2`, ...) as computed by `docker/metadata-action`.\n- `release.yaml` uses `docker/metadata-action` for the release tag and promotes the released commit's manifest to it (no tag is resolved again). GoReleaser (`.goreleaser.yaml`) attaches `atmosphere-release` archives for linux/darwin amd64/arm64, their checksums and the release manifest to the existing GitHub release without touching its notes, and the Galaxy collection is pinned from that same manifest.\n\n**Deploying**\n- `atmosphere_release_manifest` (OCI reference or file path) deploys exactly a manifest's images. Kubernetes control plane images fall back to the tag when another `atmosphere_kubernetes_version` is deployed.\n- `atmosphere_image_mirrors` redirects images per registry, namespace or repository (most specific rule wins); `atmosphere_image_prefix` still applies to everything no rule matches, so Harbor proxy projects with custom names now work too.\n- Resolution happens in the rendered references, so it works with any Kubernetes and container runtime. `atmosphere_image_overrides` are applied last, unchanged.\n\n**`atmosphere-release` command** (`cmd/atmosphere-release`, replaces `cmd/pinimages`)\n- `generate [--write-vars] [--resolve-prefix]`, `push`, `promote`, `show`, `diff`, `check`. `push` and `promote` take `repository:tag` references, so they consume `docker/metadata-action` output directly; `--resolve-prefix` resolves tags through a pull-through cache (falling back to the source registry) to avoid upstream rate limits.\n- `mirror` to a registry, or `--to-dir` / `--from-dir` for disconnected sites, in `nested`, `flat` (`quay.io--ceph--ceph`) or `single-repo` layouts. Images are copied with every platform so digests never change, each digest is verified, kubeadm's images stay under one prefix with their original names, the manifest artifact itself is copied with its digest intact, and the `atmosphere_release_manifest` / `atmosphere_image_mirrors` vars are written out.\n\nThe `image_manifest` role keeps working but now warns that it is deprecated.\n\n### Compatibility\n\nDeployments that set none of the new variables get byte-identical `atmosphere_images`: I rendered the `defaults` role through `ansible-playbook` before and after this change with no prefix, with a Harbor prefix, and with prefix + overrides, on `main` (231 images) and on `stable/zed` (216 images); all outputs are identical. `write-vars` produces the same vars file as `pinimages` except that Ceph is now pinned too (`pinimages` could not resolve its `{{ ceph_version }}` template).\n\n### Testing\n\n- Go: `internal/releasemanifest` tests cover generation, `write-vars`, push/fetch/promote, every mirror layout with multi-arch images in in-memory registries, directory export/import, digest-mismatch detection, registries with ports and retry on rate limits.\n- Python: the `resolve_images` filter and the Go resolver run the same cases from `internal/releasemanifest/testdata/resolve.yaml`; the lookup is tested against a local HTTP registry with token auth and blob redirects (credentials must not reach storage) and tampered content. A new `python-test` CI job runs these (the existing `tests/unit` suite is not run in CI and has a stale magnum expectation, so the job only runs the new tests).\n- End to end against a local CNCF Distribution registry with real images from `registry.k8s.io`, `ghcr.io` and Docker Hub: `generate`, `push`, `promote`, `show`, nested mirror, export \u2192 flat import, `check`, `diff`, plus deploying the mirrored manifest through the lookup.\n- `generate` against the real registries resolves all 231 images on `main` and `stable/2025.2`.\n\n### Backports\n\n`go.mod` and `go.sum` are untouched; every dependency is already present at the same version on all stable branches.\n\n- `stable/2025.2` cherry-picks cleanly and passes everything above.\n- `stable/2025.1` back to `stable/zed` conflict in one hunk of `roles/defaults/vars/main.yml`: the conflict context includes `main`'s `_atmosphere_storage` block, which those branches don't have. Resolve it by keeping the new `atmosphere_images` block and dropping the `_atmosphere_storage` lines. I did this on `stable/zed` and the Go tests, Python tests and the old/new rendering comparison all pass.\n\n### CI deploys the manifest\n\nvexxhost/atmosphere-zuul-jobs#7 makes the molecule jobs generate this change's release manifest (through the `harbor.atmosphere.dev/` cache) and deploy from it with `atmosphere_release_manifest`, so the AIO, CSI and Keycloak jobs exercise the manifest path and deploy exactly the images that would be published.\n\n### Before merging / follow-ups\n\n- After the first push publishes `ghcr.io/vexxhost/atmosphere-release`, make the package public and set retention (keep release tags; commit tags can be pruned).\n- Docker Hub's anonymous rate limit can still fail `generate` after its retries; previously this silently produced unpinned images.\n- `harbor.atmosphere.dev` has no proxy project for `packages.vexxhost.com` (used by `prometheus_smartctl_exporter`).\n- The docs build with `-W` already fails on `main` because of existing warnings in `admin/monitoring.rst` and `arch/images.rst`; the new page adds none.\n\nDepends-On: https://github.com/vexxhost/atmosphere-zuul-jobs/pull/7\n" change_url: https://github.com/vexxhost/atmosphere/pull/4420 child_jobs: [] commit_id: f214a51208af4f64ef3bf55f2bd13cce5102c26e event_id: f73f5bc0-c94f-11f1-82db-61912e46e669 executor: hostname: 2d72f0692154 inventory_file: /var/lib/zuul/builds/2eb8f8c87f154f5eb8c15451bfa32b02/ansible/inventory.yaml log_root: /var/lib/zuul/builds/2eb8f8c87f154f5eb8c15451bfa32b02/work/logs result_data_file: /var/lib/zuul/builds/2eb8f8c87f154f5eb8c15451bfa32b02/work/results.json src_root: /var/lib/zuul/builds/2eb8f8c87f154f5eb8c15451bfa32b02/work/src work_root: /var/lib/zuul/builds/2eb8f8c87f154f5eb8c15451bfa32b02/work include_vars: [] items: - branch: main change: '7' change_message: 'feat(molecule): deploy from a generated release manifest The molecule jobs deploy whatever image tags `roles/defaults/vars/main.yml` points at when the job runs, while releases ship digest-pinned images. With vexxhost/atmosphere#4420, Atmosphere publishes a digest-pinned release manifest for every commit, and this makes CI deploy exactly that manifest for the change under test. - The pre-run playbook checks for `cmd/atmosphere-release` in the change under test. When it exists, it installs Go (`ensure-go`, 1.24.4), runs `atmosphere-release generate --resolve-prefix harbor.atmosphere.dev/`, which resolves tags through the image cache to avoid Docker Hub rate limits while recording the original references, and saves the manifest with the job logs. - `atmosphere_release_manifest` points the deployment at that file. Combined with the existing `atmosphere_image_prefix`, every image is pulled as `harbor.atmosphere.dev/@`. - Branches without release manifest support (all stable branches until the backports land) skip the generation, and their `defaults` role does not know the new variable, so nothing changes for them. This is tested through `Depends-On` from vexxhost/atmosphere#4420. ' change_url: https://github.com/vexxhost/atmosphere-zuul-jobs/pull/7 commit_id: a7dd6c92a21aa01d1650c252214c63e38b86c497 patchset: a7dd6c92a21aa01d1650c252214c63e38b86c497 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere-zuul-jobs name: vexxhost/atmosphere-zuul-jobs short_name: atmosphere-zuul-jobs src_dir: src/github.com/vexxhost/atmosphere-zuul-jobs topic: null - branch: main change: '4420' change_message: "feat: publish release manifests and deploy from them\n\nToday a release resolves image tags at release time, after CI has run: 88 of the 232 entries in `roles/defaults/vars/main.yml` are plain tags, and `cmd/pinimages` resolves them into the Galaxy collection, silently skipping any it cannot resolve (it logs 94 errors on `main` today). The digests a release ships are only recorded inside the Galaxy tarball, and mirroring for air-gapped installs goes through the `image_manifest` role, whose registry rewrite keeps only the last path component, so `rook/ceph` and `ceph/ceph` both become `/ceph`.\n\nThis PR makes a digest-pinned **release manifest** the source of truth for which images a commit or release deploys.\n\n**Publishing**\n- The `build` job already resolved every image on each push; it now publishes the result as an OCI artifact to `ghcr.io/vexxhost/atmosphere-release`, tagged with the full commit SHA and the branch (`main`, `stable-2025.2`, ...) as computed by `docker/metadata-action`.\n- `release.yaml` uses `docker/metadata-action` for the release tag and promotes the released commit's manifest to it (no tag is resolved again). GoReleaser (`.goreleaser.yaml`) attaches `atmosphere-release` archives for linux/darwin amd64/arm64, their checksums and the release manifest to the existing GitHub release without touching its notes, and the Galaxy collection is pinned from that same manifest.\n\n**Deploying**\n- `atmosphere_release_manifest` (OCI reference or file path) deploys exactly a manifest's images. Kubernetes control plane images fall back to the tag when another `atmosphere_kubernetes_version` is deployed.\n- `atmosphere_image_mirrors` redirects images per registry, namespace or repository (most specific rule wins); `atmosphere_image_prefix` still applies to everything no rule matches, so Harbor proxy projects with custom names now work too.\n- Resolution happens in the rendered references, so it works with any Kubernetes and container runtime. `atmosphere_image_overrides` are applied last, unchanged.\n\n**`atmosphere-release` command** (`cmd/atmosphere-release`, replaces `cmd/pinimages`)\n- `generate [--write-vars] [--resolve-prefix]`, `push`, `promote`, `show`, `diff`, `check`. `push` and `promote` take `repository:tag` references, so they consume `docker/metadata-action` output directly; `--resolve-prefix` resolves tags through a pull-through cache (falling back to the source registry) to avoid upstream rate limits.\n- `mirror` to a registry, or `--to-dir` / `--from-dir` for disconnected sites, in `nested`, `flat` (`quay.io--ceph--ceph`) or `single-repo` layouts. Images are copied with every platform so digests never change, each digest is verified, kubeadm's images stay under one prefix with their original names, the manifest artifact itself is copied with its digest intact, and the `atmosphere_release_manifest` / `atmosphere_image_mirrors` vars are written out.\n\nThe `image_manifest` role keeps working but now warns that it is deprecated.\n\n### Compatibility\n\nDeployments that set none of the new variables get byte-identical `atmosphere_images`: I rendered the `defaults` role through `ansible-playbook` before and after this change with no prefix, with a Harbor prefix, and with prefix + overrides, on `main` (231 images) and on `stable/zed` (216 images); all outputs are identical. `write-vars` produces the same vars file as `pinimages` except that Ceph is now pinned too (`pinimages` could not resolve its `{{ ceph_version }}` template).\n\n### Testing\n\n- Go: `internal/releasemanifest` tests cover generation, `write-vars`, push/fetch/promote, every mirror layout with multi-arch images in in-memory registries, directory export/import, digest-mismatch detection, registries with ports and retry on rate limits.\n- Python: the `resolve_images` filter and the Go resolver run the same cases from `internal/releasemanifest/testdata/resolve.yaml`; the lookup is tested against a local HTTP registry with token auth and blob redirects (credentials must not reach storage) and tampered content. A new `python-test` CI job runs these (the existing `tests/unit` suite is not run in CI and has a stale magnum expectation, so the job only runs the new tests).\n- End to end against a local CNCF Distribution registry with real images from `registry.k8s.io`, `ghcr.io` and Docker Hub: `generate`, `push`, `promote`, `show`, nested mirror, export \u2192 flat import, `check`, `diff`, plus deploying the mirrored manifest through the lookup.\n- `generate` against the real registries resolves all 231 images on `main` and `stable/2025.2`.\n\n### Backports\n\n`go.mod` and `go.sum` are untouched; every dependency is already present at the same version on all stable branches.\n\n- `stable/2025.2` cherry-picks cleanly and passes everything above.\n- `stable/2025.1` back to `stable/zed` conflict in one hunk of `roles/defaults/vars/main.yml`: the conflict context includes `main`'s `_atmosphere_storage` block, which those branches don't have. Resolve it by keeping the new `atmosphere_images` block and dropping the `_atmosphere_storage` lines. I did this on `stable/zed` and the Go tests, Python tests and the old/new rendering comparison all pass.\n\n### CI deploys the manifest\n\nvexxhost/atmosphere-zuul-jobs#7 makes the molecule jobs generate this change's release manifest (through the `harbor.atmosphere.dev/` cache) and deploy from it with `atmosphere_release_manifest`, so the AIO, CSI and Keycloak jobs exercise the manifest path and deploy exactly the images that would be published.\n\n### Before merging / follow-ups\n\n- After the first push publishes `ghcr.io/vexxhost/atmosphere-release`, make the package public and set retention (keep release tags; commit tags can be pruned).\n- Docker Hub's anonymous rate limit can still fail `generate` after its retries; previously this silently produced unpinned images.\n- `harbor.atmosphere.dev` has no proxy project for `packages.vexxhost.com` (used by `prometheus_smartctl_exporter`).\n- The docs build with `-W` already fails on `main` because of existing warnings in `admin/monitoring.rst` and `arch/images.rst`; the new page adds none.\n\nDepends-On: https://github.com/vexxhost/atmosphere-zuul-jobs/pull/7\n" change_url: https://github.com/vexxhost/atmosphere/pull/4420 commit_id: f214a51208af4f64ef3bf55f2bd13cce5102c26e patchset: f214a51208af4f64ef3bf55f2bd13cce5102c26e project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null job: atmosphere-molecule-keycloak jobtags: [] max_attempts: 3 message: ZmVhdDogcHVibGlzaCByZWxlYXNlIG1hbmlmZXN0cyBhbmQgZGVwbG95IGZyb20gdGhlbQoKVG9kYXkgYSByZWxlYXNlIHJlc29sdmVzIGltYWdlIHRhZ3MgYXQgcmVsZWFzZSB0aW1lLCBhZnRlciBDSSBoYXMgcnVuOiA4OCBvZiB0aGUgMjMyIGVudHJpZXMgaW4gYHJvbGVzL2RlZmF1bHRzL3ZhcnMvbWFpbi55bWxgIGFyZSBwbGFpbiB0YWdzLCBhbmQgYGNtZC9waW5pbWFnZXNgIHJlc29sdmVzIHRoZW0gaW50byB0aGUgR2FsYXh5IGNvbGxlY3Rpb24sIHNpbGVudGx5IHNraXBwaW5nIGFueSBpdCBjYW5ub3QgcmVzb2x2ZSAoaXQgbG9ncyA5NCBlcnJvcnMgb24gYG1haW5gIHRvZGF5KS4gVGhlIGRpZ2VzdHMgYSByZWxlYXNlIHNoaXBzIGFyZSBvbmx5IHJlY29yZGVkIGluc2lkZSB0aGUgR2FsYXh5IHRhcmJhbGwsIGFuZCBtaXJyb3JpbmcgZm9yIGFpci1nYXBwZWQgaW5zdGFsbHMgZ29lcyB0aHJvdWdoIHRoZSBgaW1hZ2VfbWFuaWZlc3RgIHJvbGUsIHdob3NlIHJlZ2lzdHJ5IHJld3JpdGUga2VlcHMgb25seSB0aGUgbGFzdCBwYXRoIGNvbXBvbmVudCwgc28gYHJvb2svY2VwaGAgYW5kIGBjZXBoL2NlcGhgIGJvdGggYmVjb21lIGA8cmVnaXN0cnk+L2NlcGhgLgoKVGhpcyBQUiBtYWtlcyBhIGRpZ2VzdC1waW5uZWQgKipyZWxlYXNlIG1hbmlmZXN0KiogdGhlIHNvdXJjZSBvZiB0cnV0aCBmb3Igd2hpY2ggaW1hZ2VzIGEgY29tbWl0IG9yIHJlbGVhc2UgZGVwbG95cy4KCioqUHVibGlzaGluZyoqCi0gVGhlIGBidWlsZGAgam9iIGFscmVhZHkgcmVzb2x2ZWQgZXZlcnkgaW1hZ2Ugb24gZWFjaCBwdXNoOyBpdCBub3cgcHVibGlzaGVzIHRoZSByZXN1bHQgYXMgYW4gT0NJIGFydGlmYWN0IHRvIGBnaGNyLmlvL3ZleHhob3N0L2F0bW9zcGhlcmUtcmVsZWFzZWAsIHRhZ2dlZCB3aXRoIHRoZSBmdWxsIGNvbW1pdCBTSEEgYW5kIHRoZSBicmFuY2ggKGBtYWluYCwgYHN0YWJsZS0yMDI1LjJgLCAuLi4pIGFzIGNvbXB1dGVkIGJ5IGBkb2NrZXIvbWV0YWRhdGEtYWN0aW9uYC4KLSBgcmVsZWFzZS55YW1sYCB1c2VzIGBkb2NrZXIvbWV0YWRhdGEtYWN0aW9uYCBmb3IgdGhlIHJlbGVhc2UgdGFnIGFuZCBwcm9tb3RlcyB0aGUgcmVsZWFzZWQgY29tbWl0J3MgbWFuaWZlc3QgdG8gaXQgKG5vIHRhZyBpcyByZXNvbHZlZCBhZ2FpbikuIEdvUmVsZWFzZXIgKGAuZ29yZWxlYXNlci55YW1sYCkgYXR0YWNoZXMgYGF0bW9zcGhlcmUtcmVsZWFzZWAgYXJjaGl2ZXMgZm9yIGxpbnV4L2RhcndpbiBhbWQ2NC9hcm02NCwgdGhlaXIgY2hlY2tzdW1zIGFuZCB0aGUgcmVsZWFzZSBtYW5pZmVzdCB0byB0aGUgZXhpc3RpbmcgR2l0SHViIHJlbGVhc2Ugd2l0aG91dCB0b3VjaGluZyBpdHMgbm90ZXMsIGFuZCB0aGUgR2FsYXh5IGNvbGxlY3Rpb24gaXMgcGlubmVkIGZyb20gdGhhdCBzYW1lIG1hbmlmZXN0LgoKKipEZXBsb3lpbmcqKgotIGBhdG1vc3BoZXJlX3JlbGVhc2VfbWFuaWZlc3RgIChPQ0kgcmVmZXJlbmNlIG9yIGZpbGUgcGF0aCkgZGVwbG95cyBleGFjdGx5IGEgbWFuaWZlc3QncyBpbWFnZXMuIEt1YmVybmV0ZXMgY29udHJvbCBwbGFuZSBpbWFnZXMgZmFsbCBiYWNrIHRvIHRoZSB0YWcgd2hlbiBhbm90aGVyIGBhdG1vc3BoZXJlX2t1YmVybmV0ZXNfdmVyc2lvbmAgaXMgZGVwbG95ZWQuCi0gYGF0bW9zcGhlcmVfaW1hZ2VfbWlycm9yc2AgcmVkaXJlY3RzIGltYWdlcyBwZXIgcmVnaXN0cnksIG5hbWVzcGFjZSBvciByZXBvc2l0b3J5IChtb3N0IHNwZWNpZmljIHJ1bGUgd2lucyk7IGBhdG1vc3BoZXJlX2ltYWdlX3ByZWZpeGAgc3RpbGwgYXBwbGllcyB0byBldmVyeXRoaW5nIG5vIHJ1bGUgbWF0Y2hlcywgc28gSGFyYm9yIHByb3h5IHByb2plY3RzIHdpdGggY3VzdG9tIG5hbWVzIG5vdyB3b3JrIHRvby4KLSBSZXNvbHV0aW9uIGhhcHBlbnMgaW4gdGhlIHJlbmRlcmVkIHJlZmVyZW5jZXMsIHNvIGl0IHdvcmtzIHdpdGggYW55IEt1YmVybmV0ZXMgYW5kIGNvbnRhaW5lciBydW50aW1lLiBgYXRtb3NwaGVyZV9pbWFnZV9vdmVycmlkZXNgIGFyZSBhcHBsaWVkIGxhc3QsIHVuY2hhbmdlZC4KCioqYGF0bW9zcGhlcmUtcmVsZWFzZWAgY29tbWFuZCoqIChgY21kL2F0bW9zcGhlcmUtcmVsZWFzZWAsIHJlcGxhY2VzIGBjbWQvcGluaW1hZ2VzYCkKLSBgZ2VuZXJhdGUgWy0td3JpdGUtdmFyc10gWy0tcmVzb2x2ZS1wcmVmaXhdYCwgYHB1c2hgLCBgcHJvbW90ZWAsIGBzaG93YCwgYGRpZmZgLCBgY2hlY2tgLiBgcHVzaGAgYW5kIGBwcm9tb3RlYCB0YWtlIGByZXBvc2l0b3J5OnRhZ2AgcmVmZXJlbmNlcywgc28gdGhleSBjb25zdW1lIGBkb2NrZXIvbWV0YWRhdGEtYWN0aW9uYCBvdXRwdXQgZGlyZWN0bHk7IGAtLXJlc29sdmUtcHJlZml4YCByZXNvbHZlcyB0YWdzIHRocm91Z2ggYSBwdWxsLXRocm91Z2ggY2FjaGUgKGZhbGxpbmcgYmFjayB0byB0aGUgc291cmNlIHJlZ2lzdHJ5KSB0byBhdm9pZCB1cHN0cmVhbSByYXRlIGxpbWl0cy4KLSBgbWlycm9yYCB0byBhIHJlZ2lzdHJ5LCBvciBgLS10by1kaXJgIC8gYC0tZnJvbS1kaXJgIGZvciBkaXNjb25uZWN0ZWQgc2l0ZXMsIGluIGBuZXN0ZWRgLCBgZmxhdGAgKGBxdWF5LmlvLS1jZXBoLS1jZXBoYCkgb3IgYHNpbmdsZS1yZXBvYCBsYXlvdXRzLiBJbWFnZXMgYXJlIGNvcGllZCB3aXRoIGV2ZXJ5IHBsYXRmb3JtIHNvIGRpZ2VzdHMgbmV2ZXIgY2hhbmdlLCBlYWNoIGRpZ2VzdCBpcyB2ZXJpZmllZCwga3ViZWFkbSdzIGltYWdlcyBzdGF5IHVuZGVyIG9uZSBwcmVmaXggd2l0aCB0aGVpciBvcmlnaW5hbCBuYW1lcywgdGhlIG1hbmlmZXN0IGFydGlmYWN0IGl0c2VsZiBpcyBjb3BpZWQgd2l0aCBpdHMgZGlnZXN0IGludGFjdCwgYW5kIHRoZSBgYXRtb3NwaGVyZV9yZWxlYXNlX21hbmlmZXN0YCAvIGBhdG1vc3BoZXJlX2ltYWdlX21pcnJvcnNgIHZhcnMgYXJlIHdyaXR0ZW4gb3V0LgoKVGhlIGBpbWFnZV9tYW5pZmVzdGAgcm9sZSBrZWVwcyB3b3JraW5nIGJ1dCBub3cgd2FybnMgdGhhdCBpdCBpcyBkZXByZWNhdGVkLgoKIyMjIENvbXBhdGliaWxpdHkKCkRlcGxveW1lbnRzIHRoYXQgc2V0IG5vbmUgb2YgdGhlIG5ldyB2YXJpYWJsZXMgZ2V0IGJ5dGUtaWRlbnRpY2FsIGBhdG1vc3BoZXJlX2ltYWdlc2A6IEkgcmVuZGVyZWQgdGhlIGBkZWZhdWx0c2Agcm9sZSB0aHJvdWdoIGBhbnNpYmxlLXBsYXlib29rYCBiZWZvcmUgYW5kIGFmdGVyIHRoaXMgY2hhbmdlIHdpdGggbm8gcHJlZml4LCB3aXRoIGEgSGFyYm9yIHByZWZpeCwgYW5kIHdpdGggcHJlZml4ICsgb3ZlcnJpZGVzLCBvbiBgbWFpbmAgKDIzMSBpbWFnZXMpIGFuZCBvbiBgc3RhYmxlL3plZGAgKDIxNiBpbWFnZXMpOyBhbGwgb3V0cHV0cyBhcmUgaWRlbnRpY2FsLiBgd3JpdGUtdmFyc2AgcHJvZHVjZXMgdGhlIHNhbWUgdmFycyBmaWxlIGFzIGBwaW5pbWFnZXNgIGV4Y2VwdCB0aGF0IENlcGggaXMgbm93IHBpbm5lZCB0b28gKGBwaW5pbWFnZXNgIGNvdWxkIG5vdCByZXNvbHZlIGl0cyBge3sgY2VwaF92ZXJzaW9uIH19YCB0ZW1wbGF0ZSkuCgojIyMgVGVzdGluZwoKLSBHbzogYGludGVybmFsL3JlbGVhc2VtYW5pZmVzdGAgdGVzdHMgY292ZXIgZ2VuZXJhdGlvbiwgYHdyaXRlLXZhcnNgLCBwdXNoL2ZldGNoL3Byb21vdGUsIGV2ZXJ5IG1pcnJvciBsYXlvdXQgd2l0aCBtdWx0aS1hcmNoIGltYWdlcyBpbiBpbi1tZW1vcnkgcmVnaXN0cmllcywgZGlyZWN0b3J5IGV4cG9ydC9pbXBvcnQsIGRpZ2VzdC1taXNtYXRjaCBkZXRlY3Rpb24sIHJlZ2lzdHJpZXMgd2l0aCBwb3J0cyBhbmQgcmV0cnkgb24gcmF0ZSBsaW1pdHMuCi0gUHl0aG9uOiB0aGUgYHJlc29sdmVfaW1hZ2VzYCBmaWx0ZXIgYW5kIHRoZSBHbyByZXNvbHZlciBydW4gdGhlIHNhbWUgY2FzZXMgZnJvbSBgaW50ZXJuYWwvcmVsZWFzZW1hbmlmZXN0L3Rlc3RkYXRhL3Jlc29sdmUueWFtbGA7IHRoZSBsb29rdXAgaXMgdGVzdGVkIGFnYWluc3QgYSBsb2NhbCBIVFRQIHJlZ2lzdHJ5IHdpdGggdG9rZW4gYXV0aCBhbmQgYmxvYiByZWRpcmVjdHMgKGNyZWRlbnRpYWxzIG11c3Qgbm90IHJlYWNoIHN0b3JhZ2UpIGFuZCB0YW1wZXJlZCBjb250ZW50LiBBIG5ldyBgcHl0aG9uLXRlc3RgIENJIGpvYiBydW5zIHRoZXNlICh0aGUgZXhpc3RpbmcgYHRlc3RzL3VuaXRgIHN1aXRlIGlzIG5vdCBydW4gaW4gQ0kgYW5kIGhhcyBhIHN0YWxlIG1hZ251bSBleHBlY3RhdGlvbiwgc28gdGhlIGpvYiBvbmx5IHJ1bnMgdGhlIG5ldyB0ZXN0cykuCi0gRW5kIHRvIGVuZCBhZ2FpbnN0IGEgbG9jYWwgQ05DRiBEaXN0cmlidXRpb24gcmVnaXN0cnkgd2l0aCByZWFsIGltYWdlcyBmcm9tIGByZWdpc3RyeS5rOHMuaW9gLCBgZ2hjci5pb2AgYW5kIERvY2tlciBIdWI6IGBnZW5lcmF0ZWAsIGBwdXNoYCwgYHByb21vdGVgLCBgc2hvd2AsIG5lc3RlZCBtaXJyb3IsIGV4cG9ydCDihpIgZmxhdCBpbXBvcnQsIGBjaGVja2AsIGBkaWZmYCwgcGx1cyBkZXBsb3lpbmcgdGhlIG1pcnJvcmVkIG1hbmlmZXN0IHRocm91Z2ggdGhlIGxvb2t1cC4KLSBgZ2VuZXJhdGVgIGFnYWluc3QgdGhlIHJlYWwgcmVnaXN0cmllcyByZXNvbHZlcyBhbGwgMjMxIGltYWdlcyBvbiBgbWFpbmAgYW5kIGBzdGFibGUvMjAyNS4yYC4KCiMjIyBCYWNrcG9ydHMKCmBnby5tb2RgIGFuZCBgZ28uc3VtYCBhcmUgdW50b3VjaGVkOyBldmVyeSBkZXBlbmRlbmN5IGlzIGFscmVhZHkgcHJlc2VudCBhdCB0aGUgc2FtZSB2ZXJzaW9uIG9uIGFsbCBzdGFibGUgYnJhbmNoZXMuCgotIGBzdGFibGUvMjAyNS4yYCBjaGVycnktcGlja3MgY2xlYW5seSBhbmQgcGFzc2VzIGV2ZXJ5dGhpbmcgYWJvdmUuCi0gYHN0YWJsZS8yMDI1LjFgIGJhY2sgdG8gYHN0YWJsZS96ZWRgIGNvbmZsaWN0IGluIG9uZSBodW5rIG9mIGByb2xlcy9kZWZhdWx0cy92YXJzL21haW4ueW1sYDogdGhlIGNvbmZsaWN0IGNvbnRleHQgaW5jbHVkZXMgYG1haW5gJ3MgYF9hdG1vc3BoZXJlX3N0b3JhZ2VgIGJsb2NrLCB3aGljaCB0aG9zZSBicmFuY2hlcyBkb24ndCBoYXZlLiBSZXNvbHZlIGl0IGJ5IGtlZXBpbmcgdGhlIG5ldyBgYXRtb3NwaGVyZV9pbWFnZXNgIGJsb2NrIGFuZCBkcm9wcGluZyB0aGUgYF9hdG1vc3BoZXJlX3N0b3JhZ2VgIGxpbmVzLiBJIGRpZCB0aGlzIG9uIGBzdGFibGUvemVkYCBhbmQgdGhlIEdvIHRlc3RzLCBQeXRob24gdGVzdHMgYW5kIHRoZSBvbGQvbmV3IHJlbmRlcmluZyBjb21wYXJpc29uIGFsbCBwYXNzLgoKIyMjIENJIGRlcGxveXMgdGhlIG1hbmlmZXN0Cgp2ZXh4aG9zdC9hdG1vc3BoZXJlLXp1dWwtam9icyM3IG1ha2VzIHRoZSBtb2xlY3VsZSBqb2JzIGdlbmVyYXRlIHRoaXMgY2hhbmdlJ3MgcmVsZWFzZSBtYW5pZmVzdCAodGhyb3VnaCB0aGUgYGhhcmJvci5hdG1vc3BoZXJlLmRldi9gIGNhY2hlKSBhbmQgZGVwbG95IGZyb20gaXQgd2l0aCBgYXRtb3NwaGVyZV9yZWxlYXNlX21hbmlmZXN0YCwgc28gdGhlIEFJTywgQ1NJIGFuZCBLZXljbG9hayBqb2JzIGV4ZXJjaXNlIHRoZSBtYW5pZmVzdCBwYXRoIGFuZCBkZXBsb3kgZXhhY3RseSB0aGUgaW1hZ2VzIHRoYXQgd291bGQgYmUgcHVibGlzaGVkLgoKIyMjIEJlZm9yZSBtZXJnaW5nIC8gZm9sbG93LXVwcwoKLSBBZnRlciB0aGUgZmlyc3QgcHVzaCBwdWJsaXNoZXMgYGdoY3IuaW8vdmV4eGhvc3QvYXRtb3NwaGVyZS1yZWxlYXNlYCwgbWFrZSB0aGUgcGFja2FnZSBwdWJsaWMgYW5kIHNldCByZXRlbnRpb24gKGtlZXAgcmVsZWFzZSB0YWdzOyBjb21taXQgdGFncyBjYW4gYmUgcHJ1bmVkKS4KLSBEb2NrZXIgSHViJ3MgYW5vbnltb3VzIHJhdGUgbGltaXQgY2FuIHN0aWxsIGZhaWwgYGdlbmVyYXRlYCBhZnRlciBpdHMgcmV0cmllczsgcHJldmlvdXNseSB0aGlzIHNpbGVudGx5IHByb2R1Y2VkIHVucGlubmVkIGltYWdlcy4KLSBgaGFyYm9yLmF0bW9zcGhlcmUuZGV2YCBoYXMgbm8gcHJveHkgcHJvamVjdCBmb3IgYHBhY2thZ2VzLnZleHhob3N0LmNvbWAgKHVzZWQgYnkgYHByb21ldGhldXNfc21hcnRjdGxfZXhwb3J0ZXJgKS4KLSBUaGUgZG9jcyBidWlsZCB3aXRoIGAtV2AgYWxyZWFkeSBmYWlscyBvbiBgbWFpbmAgYmVjYXVzZSBvZiBleGlzdGluZyB3YXJuaW5ncyBpbiBgYWRtaW4vbW9uaXRvcmluZy5yc3RgIGFuZCBgYXJjaC9pbWFnZXMucnN0YDsgdGhlIG5ldyBwYWdlIGFkZHMgbm9uZS4KCkRlcGVuZHMtT246IGh0dHBzOi8vZ2l0aHViLmNvbS92ZXh4aG9zdC9hdG1vc3BoZXJlLXp1dWwtam9icy9wdWxsLzcK patchset: f214a51208af4f64ef3bf55f2bd13cce5102c26e pipeline: check playbook_context: playbook_projects: trusted/project_0/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 trusted/project_1/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: be52461cd48abccbf95b13a58b2551ac673d8ad7 trusted/project_2/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: c286bf94224b5660b8e49e9a058289e61062a9a0 untrusted/project_0/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: c286bf94224b5660b8e49e9a058289e61062a9a0 untrusted/project_1/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 untrusted/project_2/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: be52461cd48abccbf95b13a58b2551ac673d8ad7 untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs: canonical_name: github.com/vexxhost/atmosphere-zuul-jobs checkout: main commit: a7dd6c92a21aa01d1650c252214c63e38b86c497 untrusted/project_4/opendev.org/openstack/openstack-helm: canonical_name: opendev.org/openstack/openstack-helm checkout: master commit: e91b82e29ccce9a6a2d0faead360d57aa2506f53 playbooks: - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/run.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/playbook_0/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/playbook_0/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/playbook_0/role_2/zuul-jobs/roles post_playbooks: - path: untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs/playbooks/molecule/post.yml roles: - checkout: main checkout_description: playbook branch link_name: ansible/post_playbook_0/role_0/atmosphere-zuul-jobs link_target: untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs role_path: ansible/post_playbook_0/role_0/atmosphere-zuul-jobs/roles - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/post_playbook_0/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_0/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_0/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_0/role_4/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_1/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_1/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_1/role_2/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post-logs.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_2/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_2/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_2/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_2/role_2/zuul-jobs/roles pre_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_0/role_2/zuul-jobs/roles - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_1/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_1/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_1/role_2/zuul-jobs/roles - path: untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs/playbooks/molecule/pre.yml roles: - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_2/role_0/atmosphere-zuul-jobs link_target: untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs role_path: ansible/pre_playbook_2/role_0/atmosphere-zuul-jobs/roles - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/pre_playbook_2/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_2/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_2/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_2/role_4/zuul-jobs/roles post_review: false post_timeout: null pre_timeout: null project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere projects: github.com/ansible-collections/ansible.netcommon: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.netcommon checkout: main checkout_description: zuul branch commit: a929db70577e5630c32b36690fe58362f8c17443 name: ansible-collections/ansible.netcommon required: true short_name: ansible.netcommon src_dir: src/github.com/ansible-collections/ansible.netcommon github.com/ansible-collections/ansible.posix: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.posix checkout: main checkout_description: zuul branch commit: d5699a3fcfca765b32f94b68a592139dc58d0301 name: ansible-collections/ansible.posix required: true short_name: ansible.posix src_dir: src/github.com/ansible-collections/ansible.posix github.com/ansible-collections/ansible.utils: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.utils checkout: main checkout_description: zuul branch commit: 1f3e1bdfe2ba8904d397222dd6f90911d6f2402b name: ansible-collections/ansible.utils required: true short_name: ansible.utils src_dir: src/github.com/ansible-collections/ansible.utils github.com/ansible-collections/community.crypto: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.crypto checkout: main checkout_description: zuul branch commit: 051f8716048743eb7b9f9a875d851b97731bbf90 name: ansible-collections/community.crypto required: true short_name: community.crypto src_dir: src/github.com/ansible-collections/community.crypto github.com/ansible-collections/community.general: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.general checkout: main checkout_description: zuul branch commit: 3299b62bb02549f2ab858361caea863ff07e921a name: ansible-collections/community.general required: true short_name: community.general src_dir: src/github.com/ansible-collections/community.general github.com/ansible-collections/community.mysql: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.mysql checkout: main checkout_description: zuul branch commit: 4cf7a3176fbd07be43459f1366e8066381df6d97 name: ansible-collections/community.mysql required: true short_name: community.mysql src_dir: src/github.com/ansible-collections/community.mysql github.com/ansible-collections/kubernetes.core: canonical_hostname: github.com canonical_name: github.com/ansible-collections/kubernetes.core checkout: main checkout_description: zuul branch commit: ebb0d7f087413013eb27e275c7d638e6838e95c0 name: ansible-collections/kubernetes.core required: true short_name: kubernetes.core src_dir: src/github.com/ansible-collections/kubernetes.core github.com/vexxhost/ansible-collection-ceph: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-ceph checkout: main checkout_description: zuul branch commit: 44a694a80e3179c28d75180baa1a56426f987257 name: vexxhost/ansible-collection-ceph required: true short_name: ansible-collection-ceph src_dir: src/github.com/vexxhost/ansible-collection-ceph github.com/vexxhost/ansible-collection-containers: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-containers checkout: main checkout_description: zuul branch commit: d22923ebd40c0fd5a345318c1db90d125fb5140f name: vexxhost/ansible-collection-containers required: true short_name: ansible-collection-containers src_dir: src/github.com/vexxhost/ansible-collection-containers github.com/vexxhost/ansible-collection-kubernetes: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes checkout: main checkout_description: zuul branch commit: bb3fd0fde58a5b158605523e708645eb2a763886 name: vexxhost/ansible-collection-kubernetes required: true short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes github.com/vexxhost/atmosphere: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere checkout: main checkout_description: zuul branch commit: f214a51208af4f64ef3bf55f2bd13cce5102c26e name: vexxhost/atmosphere required: false short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere github.com/vexxhost/atmosphere-zuul-jobs: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere-zuul-jobs checkout: main checkout_description: zuul branch commit: a7dd6c92a21aa01d1650c252214c63e38b86c497 name: vexxhost/atmosphere-zuul-jobs required: false short_name: atmosphere-zuul-jobs src_dir: src/github.com/vexxhost/atmosphere-zuul-jobs github.com/vexxhost/atmosphere.common: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common checkout: main checkout_description: zuul branch commit: 0317937da7abc1979d331af8b8f7b640b80d7e75 name: vexxhost/atmosphere.common required: true short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common opendev.org/openstack/ansible-collections-openstack: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/ansible-collections-openstack checkout: master checkout_description: project default branch commit: da4a211b2d1dd147dead0e3db63a373b43b3c09e name: openstack/ansible-collections-openstack required: true short_name: ansible-collections-openstack src_dir: src/opendev.org/openstack/ansible-collections-openstack ref: refs/pull/4420/head resources: {} tenant: oss timeout: 1800 topic: null voting: true