all: children: tempest: hosts: controller: null zuul_unreachable: hosts: {} hosts: controller: ansible_connection: ssh ansible_host: 162.253.55.140 ansible_port: 22 ansible_python_interpreter: auto ansible_user: zuul configure_swap_size: 8192 devstack_local_conf: post-config: $NEUTRON_CONF: DEFAULT: global_physnet_mtu: '{{ external_bridge_mtu }}' /etc/magnum/magnum.conf: cluster_template: kubernetes_allowed_network_drivers: calico,cilium kubernetes_default_network_driver: calico nova_client: api_version: 2.15 /etc/manila/manila.conf: generic: connect_share_server_to_tenant_network: true driver_handles_share_servers: true devstack_localrc: ADMIN_PASSWORD: secretadmin DATABASE_PASSWORD: secretdatabase DEBUG_LIBVIRT_COREDUMPS: true DISABLE_AMP_IMAGE_BUILD: true ENABLE_SYSCTL_MEM_TUNING: true ENABLE_SYSCTL_NET_TUNING: true ENABLE_ZSWAP: true ERROR_ON_CLONE: true FIXED_RANGE: 10.1.0.0/20 FLOATING_RANGE: 172.24.5.0/24 GIT_BASE: https://github.com HOST_IP: '{{ hostvars[''controller''][''nodepool''][''private_ipv4''] }}' IPV4_ADDRS_SAFE_TO_USE: 10.1.0.0/20 LIBVIRT_TYPE: '{{ devstack_libvirt_type | default("qemu") }}' LOGFILE: /opt/stack/logs/devstacklog.txt LOG_COLOR: false MAGNUM_GUEST_IMAGE_URL: '{{ image_url }}' MANILA_DEFAULT_SHARE_TYPE_EXTRA_SPECS: snapshot_support=True create_share_from_snapshot_support=True MANILA_ENABLED_BACKENDS: generic MANILA_USE_SERVICE_INSTANCE_PASSWORD: true NETWORK_GATEWAY: 10.1.0.1 NOVA_LIBVIRT_TB_CACHE_SIZE: 128 NOVA_VNC_ENABLED: true OCTAVIA_NODE: api OVN_DBS_LOG_LEVEL: dbg PUBLIC_BRIDGE_MTU: '{{ external_bridge_mtu }}' PUBLIC_NETWORK_GATEWAY: 172.24.5.1 RABBIT_PASSWORD: secretrabbit SERVICE_HOST: '{{ hostvars[''controller''][''nodepool''][''private_ipv4''] }}' SERVICE_PASSWORD: secretservice SWIFT_HASH: 1234123412341234 SWIFT_REPLICAS: 1 SWIFT_START_ALL_SERVICES: false VERBOSE: true VERBOSE_NO_TIMESTAMP: true devstack_plugins: barbican: https://github.com/openstack/barbican magnum: https://review.opendev.org/openstack/magnum magnum-cluster-api: https://github.com/vexxhost/magnum-cluster-api manila: https://github.com/openstack/manila octavia: https://github.com/openstack/octavia ovn-octavia-provider: https://github.com/openstack/ovn-octavia-provider devstack_services: base: false c-api: true c-bak: true c-sch: true c-vol: true dstat: false etcd3: true file_tracker: true g-api: true horizon: false key: true memory_tracker: true mysql: true n-api: true n-api-meta: true n-cond: true n-cpu: true n-novnc: true n-sch: true o-api: true o-da: true o-hk: true octavia: true openstack-cli-server: true ovn-controller: true ovn-northd: true ovs-vswitchd: true ovsdb-server: true placement-api: true q-ovn-agent: true q-svc: true rabbit: true s-account: false s-container: false s-object: false s-proxy: false tempest: false tls-proxy: true extensions_to_txt: auto: true conf: true localrc: true log: true stackenv: true image_prefix: ubuntu-24.04 image_release: 2026.05-7 image_url: https://github.com/vexxhost/capo-image-elements/releases/download/{{ image_release }}/{{ image_prefix }}-{{ kube_tag }}.qcow2 kube_tag: v1.34.8 network_driver: cilium nodepool: az: yul2 cloud: public external_id: 1abd0fba-2025-490b-88d0-54cc57592337 host_id: 65f8c90492a5672f89680a2135b1905d383e33fab8e6951dbcfb19c4 interface_ip: 162.253.55.140 label: ubuntu-noble-16 node_properties: {} private_ipv4: 162.253.55.140 private_ipv6: null provider: yul1 public_ipv4: 162.253.55.140 public_ipv6: 2604:e100:1:0:f816:3eff:fed9:9274 region: ca-ymq-1 slot: null zuul_copy_output: /etc/ceph: logs /etc/glusterfs/glusterd.vol: logs /etc/libvirt: logs /etc/lvm: logs /etc/resolv.conf: logs /etc/sudoers: logs /etc/sudoers.d: logs /var/log/ceph: logs /var/log/glusterfs: logs /var/log/libvirt: logs /var/log/mysql: logs /var/log/openvswitch: logs /var/log/postgresql: logs /var/log/rabbitmq: logs /var/log/unbound.log: logs '{{ devstack_conf_dir }}/.localrc.auto': logs '{{ devstack_conf_dir }}/.stackenv': logs '{{ devstack_conf_dir }}/local.conf': logs '{{ devstack_conf_dir }}/localrc': logs '{{ devstack_full_log}}': logs '{{ devstack_log_dir }}/atop': logs '{{ devstack_log_dir }}/devstacklog.txt': logs '{{ devstack_log_dir }}/devstacklog.txt.summary': logs '{{ devstack_log_dir }}/dstat-csv.log': logs '{{ devstack_log_dir }}/qemu.coredump': logs '{{ devstack_log_dir }}/tcpdump.pcap': logs '{{ devstack_log_dir }}/worlddump-latest.txt': logs '{{ stage_dir }}/apache': logs '{{ stage_dir }}/apache_config': logs '{{ stage_dir }}/audit.log': logs '{{ stage_dir }}/core': logs '{{ stage_dir }}/deprecations.log': logs '{{ stage_dir }}/df.txt': logs '{{ stage_dir }}/dpkg-l.txt': logs '{{ stage_dir }}/etc': logs '{{ stage_dir }}/iptables.txt': logs '{{ stage_dir }}/listen53.txt': logs '{{ stage_dir }}/mount.txt': logs '{{ stage_dir }}/performance.json': logs '{{ stage_dir }}/pip2-freeze.txt': logs '{{ stage_dir }}/pip3-freeze.txt': logs '{{ stage_dir }}/rpm-qa.txt': logs '{{ stage_dir }}/services.txt': logs '{{ stage_dir }}/verify_tempest_conf.log': logs zuul_node: az: yul2 cloud: public external_id: 1abd0fba-2025-490b-88d0-54cc57592337 host_id: 65f8c90492a5672f89680a2135b1905d383e33fab8e6951dbcfb19c4 interface_ip: 162.253.55.140 label: ubuntu-noble-16 node_properties: {} private_ipv4: 162.253.55.140 private_ipv6: null provider: yul1 public_ipv4: 162.253.55.140 public_ipv6: 2604:e100:1:0:f816:3eff:fed9:9274 region: ca-ymq-1 slot: null uuid: null vars: configure_swap_size: 8192 devstack_local_conf: post-config: $NEUTRON_CONF: DEFAULT: global_physnet_mtu: '{{ external_bridge_mtu }}' /etc/magnum/magnum.conf: cluster_template: kubernetes_allowed_network_drivers: calico,cilium kubernetes_default_network_driver: calico nova_client: api_version: 2.15 /etc/manila/manila.conf: generic: connect_share_server_to_tenant_network: true driver_handles_share_servers: true devstack_localrc: ADMIN_PASSWORD: secretadmin DATABASE_PASSWORD: secretdatabase DEBUG_LIBVIRT_COREDUMPS: true DISABLE_AMP_IMAGE_BUILD: true ENABLE_SYSCTL_MEM_TUNING: true ENABLE_SYSCTL_NET_TUNING: true ENABLE_ZSWAP: true ERROR_ON_CLONE: true FIXED_RANGE: 10.1.0.0/20 FLOATING_RANGE: 172.24.5.0/24 GIT_BASE: https://github.com HOST_IP: '{{ hostvars[''controller''][''nodepool''][''private_ipv4''] }}' IPV4_ADDRS_SAFE_TO_USE: 10.1.0.0/20 LIBVIRT_TYPE: '{{ devstack_libvirt_type | default("qemu") }}' LOGFILE: /opt/stack/logs/devstacklog.txt LOG_COLOR: false MAGNUM_GUEST_IMAGE_URL: '{{ image_url }}' MANILA_DEFAULT_SHARE_TYPE_EXTRA_SPECS: snapshot_support=True create_share_from_snapshot_support=True MANILA_ENABLED_BACKENDS: generic MANILA_USE_SERVICE_INSTANCE_PASSWORD: true NETWORK_GATEWAY: 10.1.0.1 NOVA_LIBVIRT_TB_CACHE_SIZE: 128 NOVA_VNC_ENABLED: true OCTAVIA_NODE: api OVN_DBS_LOG_LEVEL: dbg PUBLIC_BRIDGE_MTU: '{{ external_bridge_mtu }}' PUBLIC_NETWORK_GATEWAY: 172.24.5.1 RABBIT_PASSWORD: secretrabbit SERVICE_HOST: '{{ hostvars[''controller''][''nodepool''][''private_ipv4''] }}' SERVICE_PASSWORD: secretservice SWIFT_HASH: 1234123412341234 SWIFT_REPLICAS: 1 SWIFT_START_ALL_SERVICES: false VERBOSE: true VERBOSE_NO_TIMESTAMP: true devstack_plugins: barbican: https://github.com/openstack/barbican magnum: https://review.opendev.org/openstack/magnum magnum-cluster-api: https://github.com/vexxhost/magnum-cluster-api manila: https://github.com/openstack/manila octavia: https://github.com/openstack/octavia ovn-octavia-provider: https://github.com/openstack/ovn-octavia-provider devstack_services: base: false c-api: true c-bak: true c-sch: true c-vol: true dstat: false etcd3: true file_tracker: true g-api: true horizon: false key: true memory_tracker: true mysql: true n-api: true n-api-meta: true n-cond: true n-cpu: true n-novnc: true n-sch: true o-api: true o-da: true o-hk: true octavia: true openstack-cli-server: true ovn-controller: true ovn-northd: true ovs-vswitchd: true ovsdb-server: true placement-api: true q-ovn-agent: true q-svc: true rabbit: true s-account: false s-container: false s-object: false s-proxy: false tempest: false tls-proxy: true extensions_to_txt: auto: true conf: true localrc: true log: true stackenv: true image_prefix: ubuntu-24.04 image_release: 2026.05-7 image_url: https://github.com/vexxhost/capo-image-elements/releases/download/{{ image_release }}/{{ image_prefix }}-{{ kube_tag }}.qcow2 kube_tag: v1.34.8 network_driver: cilium zuul: _inheritance_path: - '' - '' - '' - '' - '' - '' - '' - '' - '' - '' ansible_version: '9' attempts: 1 branch: main build: 90c91a1b598442a9b82c91f07f34dfc5 build_refs: - branch: main change: '1018' change_message: "fix(keystone_auth): emit Node,RBAC,Webhook authorization-mode and wait for healthz\n\n## Summary\n\nFixes `enable_keystone_auth=true` on CAPI-driven Magnum clusters. Without this PR, clusters that opt in to Keystone webhook authorization either silently bypass the webhook (so Keystone tokens never authorize) or fail to bootstrap entirely because the kube-apiserver static pod crash-loops at startup.\n\nThe change is a single commit touching `src/features/keystone_auth.rs`:\n\n* Set `--authorization-mode=Node,RBAC,Webhook` via a JSON-Patch op against the kustomize input.\n* Strip the kubeadm-default `--authorization-mode=Node,RBAC` line from the kustomize output before writing the manifest back, so kubelet only ever sees a single `--authorization-mode` line.\n* Wait for the `k8s-keystone-auth` Pod to become Ready before declaring post-kubeadm complete.\n\n## Background and analysis\n\n### 1. Authorization mode never reached the apiserver\n\nThe pre-existing `keystone_auth` feature kustomized `/etc/kubernetes/manifests/kube-apiserver.yaml` to add the keystone webhook authorizer, but did not adjust `--authorization-mode`. The running apiserver therefore had only the kubeadm-default `Node,RBAC` modes, never consulted the webhook, and every Keystone-token authenticated request failed with `RBAC: forbidden`.\n\n### 2. Duplicate `--authorization-mode` line crashed the apiserver\n\nkubeadm always writes `--authorization-mode=Node,RBAC` into its apiserver static-pod manifest. The feature's kustomization runs **after** kubeadm, so simply appending `--authorization-mode=Node,RBAC,Webhook` would leave the manifest carrying both lines:\n\n```yaml\n- --authorization-mode=Node,RBAC \ # written by kubeadm\n- --authorization-mode=Node,RBAC,Webhook \ # appended by us\n```\n\n`--authorization-mode` is a `pflag.StringSliceVar` which **appends** repeated flag values rather than last-occurrence-wins. The apiserver process therefore receives `[\"Node\",\"RBAC\",\"Node\",\"RBAC\",\"Webhook\"]` and bails at startup with:\n\n```\nauthorization-mode [\"Node\" \"RBAC\" \"Node\" \"RBAC\" \"Webhook\"]\n has mode specified more than once\n```\n\n`kube-apiserver` enters CrashLoopBackOff, KCP never reaches `APIServerAvailable=true`, the cluster fails NodeStartupTimeout. **This is the failure mode every `enable_keystone_auth=true` cluster hits without this PR.**\n\nThe fix here pipes the kustomize output through `sed '/^[[:space:]]*- --authorization-mode=Node,RBAC$/d'` before writing the manifest, so the kubeadm-default line is removed and only the `Node,RBAC,Webhook` line remains.\n\n### 3. Cluster bootstrap raced ahead of the keystone webhook deployment\n\nThe post-kubeadm command sequence proceeded as soon as the apiserver TCP port was open, but the `k8s-keystone-auth` Deployment was still rolling out. Webhook calls during that window returned `connection refused`, which the apiserver caches negatively and surfaces as authentication failures for several seconds after the webhook is actually up.\n\nFix: append `kubectl wait --for=condition=Ready` against the `k8s-keystone-auth` Pod to the post-kubeadm commands so the cluster does not register Ready until the webhook actually serves requests.\n\n## Validation\n\nEnd-to-end on a CAPI baremetal cluster created with `enable_keystone_auth=true`:\n\n```\n$ kubectl -n kube-system get pod -l component=kube-apiserver\nNAME READY \ STATUS RESTARTS AGE\nkube-apiserver- 1/1 Running \ 0 8m44s\n\n$ ssh master 'grep authorization-mode /etc/kubernetes/manifests/kube-apiserver.yaml'\n \ - --authorization-mode=Node,RBAC,Webhook # exactly one occurrence\n\n$ kubectl -n kube-system get pod -l app=k8s-keystone-auth\nNAME READY \ STATUS RESTARTS AGE\nk8s-keystone-auth-XXXXX 1/1 Running 0 \ 7m59s\n```\n\n* KubeadmControlPlane reports `APIServerAvailable=true`.\n* Cluster reaches `CREATE_COMPLETE` cleanly.\n* Keystone-token authenticated `kubectl` requests succeed.\n\nTwo unit tests in `src/features/keystone_auth.rs` cover the patch emission and the post-kubeadm command pipeline; both pass with `cargo test`.\n\n## Notes\n\n* The `sed` filter is anchored on whole-line, leading-whitespace tolerant, and only matches the literal `--authorization-mode=Node,RBAC` value \u2014 it cannot accidentally remove a future `Node,RBAC,Foo` value or any line that merely contains the substring.\n* No new label, no new operator-facing knob; the feature is a behaviour fix gated by the existing `enable_keystone_auth=true` label.\n" change_url: https://github.com/vexxhost/magnum-cluster-api/pull/1018 commit_id: 36dbffcd10f4b315bfa59e55019feb266d465721 patchset: 36dbffcd10f4b315bfa59e55019feb266d465721 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/magnum-cluster-api name: vexxhost/magnum-cluster-api short_name: magnum-cluster-api src_dir: src/github.com/vexxhost/magnum-cluster-api src_dir: src/github.com/vexxhost/magnum-cluster-api topic: null buildset: 9aa4456c4f914d3ebb169b8be9b0f895 buildset_refs: - branch: main change: '1018' change_message: "fix(keystone_auth): emit Node,RBAC,Webhook authorization-mode and wait for healthz\n\n## Summary\n\nFixes `enable_keystone_auth=true` on CAPI-driven Magnum clusters. Without this PR, clusters that opt in to Keystone webhook authorization either silently bypass the webhook (so Keystone tokens never authorize) or fail to bootstrap entirely because the kube-apiserver static pod crash-loops at startup.\n\nThe change is a single commit touching `src/features/keystone_auth.rs`:\n\n* Set `--authorization-mode=Node,RBAC,Webhook` via a JSON-Patch op against the kustomize input.\n* Strip the kubeadm-default `--authorization-mode=Node,RBAC` line from the kustomize output before writing the manifest back, so kubelet only ever sees a single `--authorization-mode` line.\n* Wait for the `k8s-keystone-auth` Pod to become Ready before declaring post-kubeadm complete.\n\n## Background and analysis\n\n### 1. Authorization mode never reached the apiserver\n\nThe pre-existing `keystone_auth` feature kustomized `/etc/kubernetes/manifests/kube-apiserver.yaml` to add the keystone webhook authorizer, but did not adjust `--authorization-mode`. The running apiserver therefore had only the kubeadm-default `Node,RBAC` modes, never consulted the webhook, and every Keystone-token authenticated request failed with `RBAC: forbidden`.\n\n### 2. Duplicate `--authorization-mode` line crashed the apiserver\n\nkubeadm always writes `--authorization-mode=Node,RBAC` into its apiserver static-pod manifest. The feature's kustomization runs **after** kubeadm, so simply appending `--authorization-mode=Node,RBAC,Webhook` would leave the manifest carrying both lines:\n\n```yaml\n- --authorization-mode=Node,RBAC \ # written by kubeadm\n- --authorization-mode=Node,RBAC,Webhook \ # appended by us\n```\n\n`--authorization-mode` is a `pflag.StringSliceVar` which **appends** repeated flag values rather than last-occurrence-wins. The apiserver process therefore receives `[\"Node\",\"RBAC\",\"Node\",\"RBAC\",\"Webhook\"]` and bails at startup with:\n\n```\nauthorization-mode [\"Node\" \"RBAC\" \"Node\" \"RBAC\" \"Webhook\"]\n has mode specified more than once\n```\n\n`kube-apiserver` enters CrashLoopBackOff, KCP never reaches `APIServerAvailable=true`, the cluster fails NodeStartupTimeout. **This is the failure mode every `enable_keystone_auth=true` cluster hits without this PR.**\n\nThe fix here pipes the kustomize output through `sed '/^[[:space:]]*- --authorization-mode=Node,RBAC$/d'` before writing the manifest, so the kubeadm-default line is removed and only the `Node,RBAC,Webhook` line remains.\n\n### 3. Cluster bootstrap raced ahead of the keystone webhook deployment\n\nThe post-kubeadm command sequence proceeded as soon as the apiserver TCP port was open, but the `k8s-keystone-auth` Deployment was still rolling out. Webhook calls during that window returned `connection refused`, which the apiserver caches negatively and surfaces as authentication failures for several seconds after the webhook is actually up.\n\nFix: append `kubectl wait --for=condition=Ready` against the `k8s-keystone-auth` Pod to the post-kubeadm commands so the cluster does not register Ready until the webhook actually serves requests.\n\n## Validation\n\nEnd-to-end on a CAPI baremetal cluster created with `enable_keystone_auth=true`:\n\n```\n$ kubectl -n kube-system get pod -l component=kube-apiserver\nNAME READY \ STATUS RESTARTS AGE\nkube-apiserver- 1/1 Running \ 0 8m44s\n\n$ ssh master 'grep authorization-mode /etc/kubernetes/manifests/kube-apiserver.yaml'\n \ - --authorization-mode=Node,RBAC,Webhook # exactly one occurrence\n\n$ kubectl -n kube-system get pod -l app=k8s-keystone-auth\nNAME READY \ STATUS RESTARTS AGE\nk8s-keystone-auth-XXXXX 1/1 Running 0 \ 7m59s\n```\n\n* KubeadmControlPlane reports `APIServerAvailable=true`.\n* Cluster reaches `CREATE_COMPLETE` cleanly.\n* Keystone-token authenticated `kubectl` requests succeed.\n\nTwo unit tests in `src/features/keystone_auth.rs` cover the patch emission and the post-kubeadm command pipeline; both pass with `cargo test`.\n\n## Notes\n\n* The `sed` filter is anchored on whole-line, leading-whitespace tolerant, and only matches the literal `--authorization-mode=Node,RBAC` value \u2014 it cannot accidentally remove a future `Node,RBAC,Foo` value or any line that merely contains the substring.\n* No new label, no new operator-facing knob; the feature is a behaviour fix gated by the existing `enable_keystone_auth=true` label.\n" change_url: https://github.com/vexxhost/magnum-cluster-api/pull/1018 commit_id: 36dbffcd10f4b315bfa59e55019feb266d465721 patchset: 36dbffcd10f4b315bfa59e55019feb266d465721 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/magnum-cluster-api name: vexxhost/magnum-cluster-api short_name: magnum-cluster-api src_dir: src/github.com/vexxhost/magnum-cluster-api src_dir: src/github.com/vexxhost/magnum-cluster-api topic: null change: '1018' change_message: "fix(keystone_auth): emit Node,RBAC,Webhook authorization-mode and wait for healthz\n\n## Summary\n\nFixes `enable_keystone_auth=true` on CAPI-driven Magnum clusters. Without this PR, clusters that opt in to Keystone webhook authorization either silently bypass the webhook (so Keystone tokens never authorize) or fail to bootstrap entirely because the kube-apiserver static pod crash-loops at startup.\n\nThe change is a single commit touching `src/features/keystone_auth.rs`:\n\n* Set `--authorization-mode=Node,RBAC,Webhook` via a JSON-Patch op against the kustomize input.\n* Strip the kubeadm-default `--authorization-mode=Node,RBAC` line from the kustomize output before writing the manifest back, so kubelet only ever sees a single `--authorization-mode` line.\n* Wait for the `k8s-keystone-auth` Pod to become Ready before declaring post-kubeadm complete.\n\n## Background and analysis\n\n### 1. Authorization mode never reached the apiserver\n\nThe pre-existing `keystone_auth` feature kustomized `/etc/kubernetes/manifests/kube-apiserver.yaml` to add the keystone webhook authorizer, but did not adjust `--authorization-mode`. The running apiserver therefore had only the kubeadm-default `Node,RBAC` modes, never consulted the webhook, and every Keystone-token authenticated request failed with `RBAC: forbidden`.\n\n### 2. Duplicate `--authorization-mode` line crashed the apiserver\n\nkubeadm always writes `--authorization-mode=Node,RBAC` into its apiserver static-pod manifest. The feature's kustomization runs **after** kubeadm, so simply appending `--authorization-mode=Node,RBAC,Webhook` would leave the manifest carrying both lines:\n\n```yaml\n- --authorization-mode=Node,RBAC \ # written by kubeadm\n- --authorization-mode=Node,RBAC,Webhook # appended by us\n```\n\n`--authorization-mode` is a `pflag.StringSliceVar` which **appends** repeated flag values rather than last-occurrence-wins. The apiserver process therefore receives `[\"Node\",\"RBAC\",\"Node\",\"RBAC\",\"Webhook\"]` and bails at startup with:\n\n```\nauthorization-mode [\"Node\" \"RBAC\" \"Node\" \"RBAC\" \"Webhook\"]\n has mode specified more than once\n```\n\n`kube-apiserver` enters CrashLoopBackOff, KCP never reaches `APIServerAvailable=true`, the cluster fails NodeStartupTimeout. **This is the failure mode every `enable_keystone_auth=true` cluster hits without this PR.**\n\nThe fix here pipes the kustomize output through `sed '/^[[:space:]]*- --authorization-mode=Node,RBAC$/d'` before writing the manifest, so the kubeadm-default line is removed and only the `Node,RBAC,Webhook` line remains.\n\n### 3. Cluster bootstrap raced ahead of the keystone webhook deployment\n\nThe post-kubeadm command sequence proceeded as soon as the apiserver TCP port was open, but the `k8s-keystone-auth` Deployment was still rolling out. Webhook calls during that window returned `connection refused`, which the apiserver caches negatively and surfaces as authentication failures for several seconds after the webhook is actually up.\n\nFix: append `kubectl wait --for=condition=Ready` against the `k8s-keystone-auth` Pod to the post-kubeadm commands so the cluster does not register Ready until the webhook actually serves requests.\n\n## Validation\n\nEnd-to-end on a CAPI baremetal cluster created with `enable_keystone_auth=true`:\n\n```\n$ kubectl -n kube-system get pod -l component=kube-apiserver\nNAME READY STATUS \ RESTARTS AGE\nkube-apiserver- 1/1 Running 0 8m44s\n\n$ ssh master 'grep authorization-mode /etc/kubernetes/manifests/kube-apiserver.yaml'\n \ - --authorization-mode=Node,RBAC,Webhook # exactly one occurrence\n\n$ kubectl -n kube-system get pod -l app=k8s-keystone-auth\nNAME READY \ STATUS RESTARTS AGE\nk8s-keystone-auth-XXXXX 1/1 Running 0 \ 7m59s\n```\n\n* KubeadmControlPlane reports `APIServerAvailable=true`.\n* Cluster reaches `CREATE_COMPLETE` cleanly.\n* Keystone-token authenticated `kubectl` requests succeed.\n\nTwo unit tests in `src/features/keystone_auth.rs` cover the patch emission and the post-kubeadm command pipeline; both pass with `cargo test`.\n\n## Notes\n\n* The `sed` filter is anchored on whole-line, leading-whitespace tolerant, and only matches the literal `--authorization-mode=Node,RBAC` value \u2014 it cannot accidentally remove a future `Node,RBAC,Foo` value or any line that merely contains the substring.\n* No new label, no new operator-facing knob; the feature is a behaviour fix gated by the existing `enable_keystone_auth=true` label.\n" change_url: https://github.com/vexxhost/magnum-cluster-api/pull/1018 child_jobs: [] commit_id: 36dbffcd10f4b315bfa59e55019feb266d465721 event_id: f1847ff0-a508-11f1-9284-08ac3de17c30 executor: hostname: 2d72f0692154 inventory_file: /var/lib/zuul/builds/90c91a1b598442a9b82c91f07f34dfc5/ansible/inventory.yaml log_root: /var/lib/zuul/builds/90c91a1b598442a9b82c91f07f34dfc5/work/logs result_data_file: /var/lib/zuul/builds/90c91a1b598442a9b82c91f07f34dfc5/work/results.json src_root: /var/lib/zuul/builds/90c91a1b598442a9b82c91f07f34dfc5/work/src work_root: /var/lib/zuul/builds/90c91a1b598442a9b82c91f07f34dfc5/work include_vars: [] items: - branch: main change: '1018' change_message: "fix(keystone_auth): emit Node,RBAC,Webhook authorization-mode and wait for healthz\n\n## Summary\n\nFixes `enable_keystone_auth=true` on CAPI-driven Magnum clusters. Without this PR, clusters that opt in to Keystone webhook authorization either silently bypass the webhook (so Keystone tokens never authorize) or fail to bootstrap entirely because the kube-apiserver static pod crash-loops at startup.\n\nThe change is a single commit touching `src/features/keystone_auth.rs`:\n\n* Set `--authorization-mode=Node,RBAC,Webhook` via a JSON-Patch op against the kustomize input.\n* Strip the kubeadm-default `--authorization-mode=Node,RBAC` line from the kustomize output before writing the manifest back, so kubelet only ever sees a single `--authorization-mode` line.\n* Wait for the `k8s-keystone-auth` Pod to become Ready before declaring post-kubeadm complete.\n\n## Background and analysis\n\n### 1. Authorization mode never reached the apiserver\n\nThe pre-existing `keystone_auth` feature kustomized `/etc/kubernetes/manifests/kube-apiserver.yaml` to add the keystone webhook authorizer, but did not adjust `--authorization-mode`. The running apiserver therefore had only the kubeadm-default `Node,RBAC` modes, never consulted the webhook, and every Keystone-token authenticated request failed with `RBAC: forbidden`.\n\n### 2. Duplicate `--authorization-mode` line crashed the apiserver\n\nkubeadm always writes `--authorization-mode=Node,RBAC` into its apiserver static-pod manifest. The feature's kustomization runs **after** kubeadm, so simply appending `--authorization-mode=Node,RBAC,Webhook` would leave the manifest carrying both lines:\n\n```yaml\n- --authorization-mode=Node,RBAC \ # written by kubeadm\n- --authorization-mode=Node,RBAC,Webhook \ # appended by us\n```\n\n`--authorization-mode` is a `pflag.StringSliceVar` which **appends** repeated flag values rather than last-occurrence-wins. The apiserver process therefore receives `[\"Node\",\"RBAC\",\"Node\",\"RBAC\",\"Webhook\"]` and bails at startup with:\n\n```\nauthorization-mode [\"Node\" \"RBAC\" \"Node\" \"RBAC\" \"Webhook\"]\n has mode specified more than once\n```\n\n`kube-apiserver` enters CrashLoopBackOff, KCP never reaches `APIServerAvailable=true`, the cluster fails NodeStartupTimeout. **This is the failure mode every `enable_keystone_auth=true` cluster hits without this PR.**\n\nThe fix here pipes the kustomize output through `sed '/^[[:space:]]*- --authorization-mode=Node,RBAC$/d'` before writing the manifest, so the kubeadm-default line is removed and only the `Node,RBAC,Webhook` line remains.\n\n### 3. Cluster bootstrap raced ahead of the keystone webhook deployment\n\nThe post-kubeadm command sequence proceeded as soon as the apiserver TCP port was open, but the `k8s-keystone-auth` Deployment was still rolling out. Webhook calls during that window returned `connection refused`, which the apiserver caches negatively and surfaces as authentication failures for several seconds after the webhook is actually up.\n\nFix: append `kubectl wait --for=condition=Ready` against the `k8s-keystone-auth` Pod to the post-kubeadm commands so the cluster does not register Ready until the webhook actually serves requests.\n\n## Validation\n\nEnd-to-end on a CAPI baremetal cluster created with `enable_keystone_auth=true`:\n\n```\n$ kubectl -n kube-system get pod -l component=kube-apiserver\nNAME READY \ STATUS RESTARTS AGE\nkube-apiserver- 1/1 Running \ 0 8m44s\n\n$ ssh master 'grep authorization-mode /etc/kubernetes/manifests/kube-apiserver.yaml'\n \ - --authorization-mode=Node,RBAC,Webhook # exactly one occurrence\n\n$ kubectl -n kube-system get pod -l app=k8s-keystone-auth\nNAME READY \ STATUS RESTARTS AGE\nk8s-keystone-auth-XXXXX 1/1 Running 0 \ 7m59s\n```\n\n* KubeadmControlPlane reports `APIServerAvailable=true`.\n* Cluster reaches `CREATE_COMPLETE` cleanly.\n* Keystone-token authenticated `kubectl` requests succeed.\n\nTwo unit tests in `src/features/keystone_auth.rs` cover the patch emission and the post-kubeadm command pipeline; both pass with `cargo test`.\n\n## Notes\n\n* The `sed` filter is anchored on whole-line, leading-whitespace tolerant, and only matches the literal `--authorization-mode=Node,RBAC` value \u2014 it cannot accidentally remove a future `Node,RBAC,Foo` value or any line that merely contains the substring.\n* No new label, no new operator-facing knob; the feature is a behaviour fix gated by the existing `enable_keystone_auth=true` label.\n" change_url: https://github.com/vexxhost/magnum-cluster-api/pull/1018 commit_id: 36dbffcd10f4b315bfa59e55019feb266d465721 patchset: 36dbffcd10f4b315bfa59e55019feb266d465721 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/magnum-cluster-api name: vexxhost/magnum-cluster-api short_name: magnum-cluster-api src_dir: src/github.com/vexxhost/magnum-cluster-api topic: null job: magnum-cluster-api-hydrophone-v1.34.8-cilium jobtags: [] max_attempts: 3 message: Zml4KGtleXN0b25lX2F1dGgpOiBlbWl0IE5vZGUsUkJBQyxXZWJob29rIGF1dGhvcml6YXRpb24tbW9kZSBhbmQgd2FpdCBmb3IgaGVhbHRoegoKIyMgU3VtbWFyeQoKRml4ZXMgYGVuYWJsZV9rZXlzdG9uZV9hdXRoPXRydWVgIG9uIENBUEktZHJpdmVuIE1hZ251bSBjbHVzdGVycy4gV2l0aG91dCB0aGlzIFBSLCBjbHVzdGVycyB0aGF0IG9wdCBpbiB0byBLZXlzdG9uZSB3ZWJob29rIGF1dGhvcml6YXRpb24gZWl0aGVyIHNpbGVudGx5IGJ5cGFzcyB0aGUgd2ViaG9vayAoc28gS2V5c3RvbmUgdG9rZW5zIG5ldmVyIGF1dGhvcml6ZSkgb3IgZmFpbCB0byBib290c3RyYXAgZW50aXJlbHkgYmVjYXVzZSB0aGUga3ViZS1hcGlzZXJ2ZXIgc3RhdGljIHBvZCBjcmFzaC1sb29wcyBhdCBzdGFydHVwLgoKVGhlIGNoYW5nZSBpcyBhIHNpbmdsZSBjb21taXQgdG91Y2hpbmcgYHNyYy9mZWF0dXJlcy9rZXlzdG9uZV9hdXRoLnJzYDoKCiogU2V0IGAtLWF1dGhvcml6YXRpb24tbW9kZT1Ob2RlLFJCQUMsV2ViaG9va2AgdmlhIGEgSlNPTi1QYXRjaCBvcCBhZ2FpbnN0IHRoZSBrdXN0b21pemUgaW5wdXQuCiogU3RyaXAgdGhlIGt1YmVhZG0tZGVmYXVsdCBgLS1hdXRob3JpemF0aW9uLW1vZGU9Tm9kZSxSQkFDYCBsaW5lIGZyb20gdGhlIGt1c3RvbWl6ZSBvdXRwdXQgYmVmb3JlIHdyaXRpbmcgdGhlIG1hbmlmZXN0IGJhY2ssIHNvIGt1YmVsZXQgb25seSBldmVyIHNlZXMgYSBzaW5nbGUgYC0tYXV0aG9yaXphdGlvbi1tb2RlYCBsaW5lLgoqIFdhaXQgZm9yIHRoZSBgazhzLWtleXN0b25lLWF1dGhgIFBvZCB0byBiZWNvbWUgUmVhZHkgYmVmb3JlIGRlY2xhcmluZyBwb3N0LWt1YmVhZG0gY29tcGxldGUuCgojIyBCYWNrZ3JvdW5kIGFuZCBhbmFseXNpcwoKIyMjIDEuIEF1dGhvcml6YXRpb24gbW9kZSBuZXZlciByZWFjaGVkIHRoZSBhcGlzZXJ2ZXIKClRoZSBwcmUtZXhpc3RpbmcgYGtleXN0b25lX2F1dGhgIGZlYXR1cmUga3VzdG9taXplZCBgL2V0Yy9rdWJlcm5ldGVzL21hbmlmZXN0cy9rdWJlLWFwaXNlcnZlci55YW1sYCB0byBhZGQgdGhlIGtleXN0b25lIHdlYmhvb2sgYXV0aG9yaXplciwgYnV0IGRpZCBub3QgYWRqdXN0IGAtLWF1dGhvcml6YXRpb24tbW9kZWAuIFRoZSBydW5uaW5nIGFwaXNlcnZlciB0aGVyZWZvcmUgaGFkIG9ubHkgdGhlIGt1YmVhZG0tZGVmYXVsdCBgTm9kZSxSQkFDYCBtb2RlcywgbmV2ZXIgY29uc3VsdGVkIHRoZSB3ZWJob29rLCBhbmQgZXZlcnkgS2V5c3RvbmUtdG9rZW4gYXV0aGVudGljYXRlZCByZXF1ZXN0IGZhaWxlZCB3aXRoIGBSQkFDOiBmb3JiaWRkZW5gLgoKIyMjIDIuIER1cGxpY2F0ZSBgLS1hdXRob3JpemF0aW9uLW1vZGVgIGxpbmUgY3Jhc2hlZCB0aGUgYXBpc2VydmVyCgprdWJlYWRtIGFsd2F5cyB3cml0ZXMgYC0tYXV0aG9yaXphdGlvbi1tb2RlPU5vZGUsUkJBQ2AgaW50byBpdHMgYXBpc2VydmVyIHN0YXRpYy1wb2QgbWFuaWZlc3QuIFRoZSBmZWF0dXJlJ3Mga3VzdG9taXphdGlvbiBydW5zICoqYWZ0ZXIqKiBrdWJlYWRtLCBzbyBzaW1wbHkgYXBwZW5kaW5nIGAtLWF1dGhvcml6YXRpb24tbW9kZT1Ob2RlLFJCQUMsV2ViaG9va2Agd291bGQgbGVhdmUgdGhlIG1hbmlmZXN0IGNhcnJ5aW5nIGJvdGggbGluZXM6CgpgYGB5YW1sCi0gLS1hdXRob3JpemF0aW9uLW1vZGU9Tm9kZSxSQkFDICAgICAgICAgICMgd3JpdHRlbiBieSBrdWJlYWRtCi0gLS1hdXRob3JpemF0aW9uLW1vZGU9Tm9kZSxSQkFDLFdlYmhvb2sgICMgYXBwZW5kZWQgYnkgdXMKYGBgCgpgLS1hdXRob3JpemF0aW9uLW1vZGVgIGlzIGEgYHBmbGFnLlN0cmluZ1NsaWNlVmFyYCB3aGljaCAqKmFwcGVuZHMqKiByZXBlYXRlZCBmbGFnIHZhbHVlcyByYXRoZXIgdGhhbiBsYXN0LW9jY3VycmVuY2Utd2lucy4gVGhlIGFwaXNlcnZlciBwcm9jZXNzIHRoZXJlZm9yZSByZWNlaXZlcyBgWyJOb2RlIiwiUkJBQyIsIk5vZGUiLCJSQkFDIiwiV2ViaG9vayJdYCBhbmQgYmFpbHMgYXQgc3RhcnR1cCB3aXRoOgoKYGBgCmF1dGhvcml6YXRpb24tbW9kZSBbIk5vZGUiICJSQkFDIiAiTm9kZSIgIlJCQUMiICJXZWJob29rIl0KICBoYXMgbW9kZSBzcGVjaWZpZWQgbW9yZSB0aGFuIG9uY2UKYGBgCgpga3ViZS1hcGlzZXJ2ZXJgIGVudGVycyBDcmFzaExvb3BCYWNrT2ZmLCBLQ1AgbmV2ZXIgcmVhY2hlcyBgQVBJU2VydmVyQXZhaWxhYmxlPXRydWVgLCB0aGUgY2x1c3RlciBmYWlscyBOb2RlU3RhcnR1cFRpbWVvdXQuICoqVGhpcyBpcyB0aGUgZmFpbHVyZSBtb2RlIGV2ZXJ5IGBlbmFibGVfa2V5c3RvbmVfYXV0aD10cnVlYCBjbHVzdGVyIGhpdHMgd2l0aG91dCB0aGlzIFBSLioqCgpUaGUgZml4IGhlcmUgcGlwZXMgdGhlIGt1c3RvbWl6ZSBvdXRwdXQgdGhyb3VnaCBgc2VkICcvXltbOnNwYWNlOl1dKi0gLS1hdXRob3JpemF0aW9uLW1vZGU9Tm9kZSxSQkFDJC9kJ2AgYmVmb3JlIHdyaXRpbmcgdGhlIG1hbmlmZXN0LCBzbyB0aGUga3ViZWFkbS1kZWZhdWx0IGxpbmUgaXMgcmVtb3ZlZCBhbmQgb25seSB0aGUgYE5vZGUsUkJBQyxXZWJob29rYCBsaW5lIHJlbWFpbnMuCgojIyMgMy4gQ2x1c3RlciBib290c3RyYXAgcmFjZWQgYWhlYWQgb2YgdGhlIGtleXN0b25lIHdlYmhvb2sgZGVwbG95bWVudAoKVGhlIHBvc3Qta3ViZWFkbSBjb21tYW5kIHNlcXVlbmNlIHByb2NlZWRlZCBhcyBzb29uIGFzIHRoZSBhcGlzZXJ2ZXIgVENQIHBvcnQgd2FzIG9wZW4sIGJ1dCB0aGUgYGs4cy1rZXlzdG9uZS1hdXRoYCBEZXBsb3ltZW50IHdhcyBzdGlsbCByb2xsaW5nIG91dC4gV2ViaG9vayBjYWxscyBkdXJpbmcgdGhhdCB3aW5kb3cgcmV0dXJuZWQgYGNvbm5lY3Rpb24gcmVmdXNlZGAsIHdoaWNoIHRoZSBhcGlzZXJ2ZXIgY2FjaGVzIG5lZ2F0aXZlbHkgYW5kIHN1cmZhY2VzIGFzIGF1dGhlbnRpY2F0aW9uIGZhaWx1cmVzIGZvciBzZXZlcmFsIHNlY29uZHMgYWZ0ZXIgdGhlIHdlYmhvb2sgaXMgYWN0dWFsbHkgdXAuCgpGaXg6IGFwcGVuZCBga3ViZWN0bCB3YWl0IC0tZm9yPWNvbmRpdGlvbj1SZWFkeWAgYWdhaW5zdCB0aGUgYGs4cy1rZXlzdG9uZS1hdXRoYCBQb2QgdG8gdGhlIHBvc3Qta3ViZWFkbSBjb21tYW5kcyBzbyB0aGUgY2x1c3RlciBkb2VzIG5vdCByZWdpc3RlciBSZWFkeSB1bnRpbCB0aGUgd2ViaG9vayBhY3R1YWxseSBzZXJ2ZXMgcmVxdWVzdHMuCgojIyBWYWxpZGF0aW9uCgpFbmQtdG8tZW5kIG9uIGEgQ0FQSSBiYXJlbWV0YWwgY2x1c3RlciBjcmVhdGVkIHdpdGggYGVuYWJsZV9rZXlzdG9uZV9hdXRoPXRydWVgOgoKYGBgCiQga3ViZWN0bCAtbiBrdWJlLXN5c3RlbSBnZXQgcG9kIC1sIGNvbXBvbmVudD1rdWJlLWFwaXNlcnZlcgpOQU1FICAgICAgICAgICAgICAgICAgICAgICAgICBSRUFEWSAgIFNUQVRVUyAgICBSRVNUQVJUUyAgIEFHRQprdWJlLWFwaXNlcnZlci08bWFzdGVyPiAgICAgICAxLzEgICAgIFJ1bm5pbmcgICAwICAgICAgICAgIDhtNDRzCgokIHNzaCBtYXN0ZXIgJ2dyZXAgYXV0aG9yaXphdGlvbi1tb2RlIC9ldGMva3ViZXJuZXRlcy9tYW5pZmVzdHMva3ViZS1hcGlzZXJ2ZXIueWFtbCcKICAgIC0gLS1hdXRob3JpemF0aW9uLW1vZGU9Tm9kZSxSQkFDLFdlYmhvb2sgICAgICAgICMgZXhhY3RseSBvbmUgb2NjdXJyZW5jZQoKJCBrdWJlY3RsIC1uIGt1YmUtc3lzdGVtIGdldCBwb2QgLWwgYXBwPWs4cy1rZXlzdG9uZS1hdXRoCk5BTUUgICAgICAgICAgICAgICAgICAgICAgUkVBRFkgICBTVEFUVVMgICAgUkVTVEFSVFMgICBBR0UKazhzLWtleXN0b25lLWF1dGgtWFhYWFggICAxLzEgICAgIFJ1bm5pbmcgICAwICAgICAgICAgIDdtNTlzCmBgYAoKKiBLdWJlYWRtQ29udHJvbFBsYW5lIHJlcG9ydHMgYEFQSVNlcnZlckF2YWlsYWJsZT10cnVlYC4KKiBDbHVzdGVyIHJlYWNoZXMgYENSRUFURV9DT01QTEVURWAgY2xlYW5seS4KKiBLZXlzdG9uZS10b2tlbiBhdXRoZW50aWNhdGVkIGBrdWJlY3RsYCByZXF1ZXN0cyBzdWNjZWVkLgoKVHdvIHVuaXQgdGVzdHMgaW4gYHNyYy9mZWF0dXJlcy9rZXlzdG9uZV9hdXRoLnJzYCBjb3ZlciB0aGUgcGF0Y2ggZW1pc3Npb24gYW5kIHRoZSBwb3N0LWt1YmVhZG0gY29tbWFuZCBwaXBlbGluZTsgYm90aCBwYXNzIHdpdGggYGNhcmdvIHRlc3RgLgoKIyMgTm90ZXMKCiogVGhlIGBzZWRgIGZpbHRlciBpcyBhbmNob3JlZCBvbiB3aG9sZS1saW5lLCBsZWFkaW5nLXdoaXRlc3BhY2UgdG9sZXJhbnQsIGFuZCBvbmx5IG1hdGNoZXMgdGhlIGxpdGVyYWwgYC0tYXV0aG9yaXphdGlvbi1tb2RlPU5vZGUsUkJBQ2AgdmFsdWUg4oCUIGl0IGNhbm5vdCBhY2NpZGVudGFsbHkgcmVtb3ZlIGEgZnV0dXJlIGBOb2RlLFJCQUMsRm9vYCB2YWx1ZSBvciBhbnkgbGluZSB0aGF0IG1lcmVseSBjb250YWlucyB0aGUgc3Vic3RyaW5nLgoqIE5vIG5ldyBsYWJlbCwgbm8gbmV3IG9wZXJhdG9yLWZhY2luZyBrbm9iOyB0aGUgZmVhdHVyZSBpcyBhIGJlaGF2aW91ciBmaXggZ2F0ZWQgYnkgdGhlIGV4aXN0aW5nIGBlbmFibGVfa2V5c3RvbmVfYXV0aD10cnVlYCBsYWJlbC4K override_checkout: master patchset: 36dbffcd10f4b315bfa59e55019feb266d465721 pipeline: check playbook_context: playbook_projects: trusted/project_0/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 trusted/project_1/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: a05b0fb6ac6a681e93e59e18661eadc80ed996f8 trusted/project_2/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: c286bf94224b5660b8e49e9a058289e61062a9a0 untrusted/project_0/opendev.org/openstack/devstack: canonical_name: opendev.org/openstack/devstack checkout: master commit: 9b0a00865c2537338f72ed5b9b44a0d6bff16eb4 untrusted/project_1/opendev.org/openstack/openstack-zuul-jobs: canonical_name: opendev.org/openstack/openstack-zuul-jobs checkout: master commit: 7034a45c416d30a350109d93bfb2457e6fa75618 untrusted/project_2/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 untrusted/project_3/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: a05b0fb6ac6a681e93e59e18661eadc80ed996f8 untrusted/project_4/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: c286bf94224b5660b8e49e9a058289e61062a9a0 untrusted/project_5/github.com/vexxhost/magnum-cluster-api: canonical_name: github.com/vexxhost/magnum-cluster-api checkout: main commit: 36dbffcd10f4b315bfa59e55019feb266d465721 playbooks: - path: untrusted/project_5/github.com/vexxhost/magnum-cluster-api/zuul.d/playbooks/hydrophone/run.yml roles: - checkout: master checkout_description: job override ref link_name: ansible/playbook_0/role_1/devstack link_target: untrusted/project_0/opendev.org/openstack/devstack role_path: ansible/playbook_0/role_1/devstack/roles - checkout: master checkout_description: job override ref link_name: ansible/playbook_0/role_2/openstack-zuul-jobs link_target: untrusted/project_1/opendev.org/openstack/openstack-zuul-jobs role_path: ansible/playbook_0/role_2/openstack-zuul-jobs/roles - checkout: master checkout_description: job override ref link_name: ansible/playbook_0/role_4/zuul-jobs link_target: untrusted/project_3/opendev.org/zuul/zuul-jobs role_path: ansible/playbook_0/role_4/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/playbook_0/role_5/zuul-jobs link_target: untrusted/project_4/github.com/vexxhost/zuul-jobs role_path: ansible/playbook_0/role_5/zuul-jobs/roles post_playbooks: - path: untrusted/project_5/github.com/vexxhost/magnum-cluster-api/zuul.d/playbooks/hydrophone/post.yml roles: - checkout: master checkout_description: job override ref link_name: ansible/post_playbook_0/role_1/devstack link_target: untrusted/project_0/opendev.org/openstack/devstack role_path: ansible/post_playbook_0/role_1/devstack/roles - checkout: master checkout_description: job override ref link_name: ansible/post_playbook_0/role_2/openstack-zuul-jobs link_target: untrusted/project_1/opendev.org/openstack/openstack-zuul-jobs role_path: ansible/post_playbook_0/role_2/openstack-zuul-jobs/roles - checkout: master checkout_description: job override ref link_name: ansible/post_playbook_0/role_4/zuul-jobs link_target: untrusted/project_3/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_0/role_4/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_0/role_5/zuul-jobs link_target: untrusted/project_4/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_0/role_5/zuul-jobs/roles - path: untrusted/project_0/opendev.org/openstack/devstack/playbooks/post.yaml roles: - checkout: master checkout_description: playbook branch link_name: ansible/post_playbook_1/role_0/devstack link_target: untrusted/project_0/opendev.org/openstack/devstack role_path: ansible/post_playbook_1/role_0/devstack/roles - checkout: master checkout_description: job override ref link_name: ansible/post_playbook_1/role_1/openstack-zuul-jobs link_target: untrusted/project_1/opendev.org/openstack/openstack-zuul-jobs role_path: ansible/post_playbook_1/role_1/openstack-zuul-jobs/roles - checkout: master checkout_description: job override ref link_name: ansible/post_playbook_1/role_3/zuul-jobs link_target: untrusted/project_3/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_1/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_1/role_4/zuul-jobs link_target: untrusted/project_4/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_1/role_4/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post.yaml roles: - checkout: master checkout_description: job override ref link_name: ansible/post_playbook_2/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_2/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_2/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_2/role_2/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post-logs.yaml roles: - checkout: master checkout_description: job override ref link_name: ansible/post_playbook_3/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_3/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_3/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_3/role_2/zuul-jobs/roles pre_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/pre.yaml roles: - checkout: master checkout_description: job override ref link_name: ansible/pre_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_0/role_2/zuul-jobs/roles - path: untrusted/project_0/opendev.org/openstack/devstack/playbooks/pre.yaml roles: - checkout: master checkout_description: playbook branch link_name: ansible/pre_playbook_1/role_0/devstack link_target: untrusted/project_0/opendev.org/openstack/devstack role_path: ansible/pre_playbook_1/role_0/devstack/roles - checkout: master checkout_description: job override ref link_name: ansible/pre_playbook_1/role_1/openstack-zuul-jobs link_target: untrusted/project_1/opendev.org/openstack/openstack-zuul-jobs role_path: ansible/pre_playbook_1/role_1/openstack-zuul-jobs/roles - checkout: master checkout_description: job override ref link_name: ansible/pre_playbook_1/role_3/zuul-jobs link_target: untrusted/project_3/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_1/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_1/role_4/zuul-jobs link_target: untrusted/project_4/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_1/role_4/zuul-jobs/roles - path: untrusted/project_5/github.com/vexxhost/magnum-cluster-api/zuul.d/playbooks/hydrophone/pre.yml roles: - checkout: master checkout_description: job override ref link_name: ansible/pre_playbook_2/role_1/devstack link_target: untrusted/project_0/opendev.org/openstack/devstack role_path: ansible/pre_playbook_2/role_1/devstack/roles - checkout: master checkout_description: job override ref link_name: ansible/pre_playbook_2/role_2/openstack-zuul-jobs link_target: untrusted/project_1/opendev.org/openstack/openstack-zuul-jobs role_path: ansible/pre_playbook_2/role_2/openstack-zuul-jobs/roles - checkout: master checkout_description: job override ref link_name: ansible/pre_playbook_2/role_4/zuul-jobs link_target: untrusted/project_3/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_2/role_4/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_2/role_5/zuul-jobs link_target: untrusted/project_4/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_2/role_5/zuul-jobs/roles post_review: false post_timeout: null pre_timeout: null project: canonical_hostname: github.com canonical_name: github.com/vexxhost/magnum-cluster-api name: vexxhost/magnum-cluster-api short_name: magnum-cluster-api src_dir: src/github.com/vexxhost/magnum-cluster-api projects: github.com/novnc/novnc: canonical_hostname: github.com canonical_name: github.com/novnc/novnc checkout: master checkout_description: job override ref commit: ac861f9e280b015569c4b1c3999516d9c0fa35c3 name: novnc/novnc required: true short_name: novnc src_dir: src/github.com/novnc/novnc github.com/vexxhost/magnum-cluster-api: canonical_hostname: github.com canonical_name: github.com/vexxhost/magnum-cluster-api checkout: main checkout_description: zuul branch commit: 36dbffcd10f4b315bfa59e55019feb266d465721 name: vexxhost/magnum-cluster-api required: false short_name: magnum-cluster-api src_dir: src/github.com/vexxhost/magnum-cluster-api opendev.org/openstack/barbican: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/barbican checkout: master checkout_description: job override ref commit: 1014ec1ac035564c79df179486f27b9fd57df768 name: openstack/barbican required: true short_name: barbican src_dir: src/opendev.org/openstack/barbican opendev.org/openstack/cinder: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/cinder checkout: master checkout_description: job override ref commit: f4c563acfd95790394f2a1d2277fa0724bd8736d name: openstack/cinder required: true short_name: cinder src_dir: src/opendev.org/openstack/cinder opendev.org/openstack/devstack: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/devstack checkout: master checkout_description: job override ref commit: 9b0a00865c2537338f72ed5b9b44a0d6bff16eb4 name: openstack/devstack required: true short_name: devstack src_dir: src/opendev.org/openstack/devstack opendev.org/openstack/glance: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/glance checkout: master checkout_description: job override ref commit: 602b6d70307596290f77a8a533f8531d9cd4534a name: openstack/glance required: true short_name: glance src_dir: src/opendev.org/openstack/glance opendev.org/openstack/keystone: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/keystone checkout: master checkout_description: job override ref commit: 16afc813b7e6de727d8a91e065d7824b06e32925 name: openstack/keystone required: true short_name: keystone src_dir: src/opendev.org/openstack/keystone opendev.org/openstack/magnum: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/magnum checkout: master checkout_description: job override ref commit: 23a43e879d5ea72e80f211212567450fe60805d5 name: openstack/magnum required: true short_name: magnum src_dir: src/opendev.org/openstack/magnum opendev.org/openstack/manila: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/manila checkout: master checkout_description: job override ref commit: 560591d92d0091748a200c348a52b0af4352d569 name: openstack/manila required: true short_name: manila src_dir: src/opendev.org/openstack/manila opendev.org/openstack/neutron: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/neutron checkout: master checkout_description: job override ref commit: 2475d0380ebc75b5eb6f1495f2b9a0fcc477985b name: openstack/neutron required: true short_name: neutron src_dir: src/opendev.org/openstack/neutron opendev.org/openstack/nova: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/nova checkout: master checkout_description: job override ref commit: 445fc2db215e79810ee8ddec00939e88eb41fd03 name: openstack/nova required: true short_name: nova src_dir: src/opendev.org/openstack/nova opendev.org/openstack/octavia: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/octavia checkout: master checkout_description: job override ref commit: fbc4af60a9dfa922343e0f86f0541b4971c1b908 name: openstack/octavia required: true short_name: octavia src_dir: src/opendev.org/openstack/octavia opendev.org/openstack/os-test-images: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/os-test-images checkout: master checkout_description: job override ref commit: 5d0367e03788764f41da8effffa14e3eac513201 name: openstack/os-test-images required: true short_name: os-test-images src_dir: src/opendev.org/openstack/os-test-images opendev.org/openstack/ovn-octavia-provider: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/ovn-octavia-provider checkout: master checkout_description: job override ref commit: 91aba16490ea0de6df81528464b2705b51e41537 name: openstack/ovn-octavia-provider required: true short_name: ovn-octavia-provider src_dir: src/opendev.org/openstack/ovn-octavia-provider opendev.org/openstack/placement: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/placement checkout: master checkout_description: job override ref commit: 7d35f974d52fdbb457ff2b6b7bff3741165dd30d name: openstack/placement required: true short_name: placement src_dir: src/opendev.org/openstack/placement opendev.org/openstack/python-magnumclient: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/python-magnumclient checkout: master checkout_description: job override ref commit: 43fc0de28fc0f334a2f8b452ef1ab567e57470b4 name: openstack/python-magnumclient required: true short_name: python-magnumclient src_dir: src/opendev.org/openstack/python-magnumclient opendev.org/openstack/requirements: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/requirements checkout: master checkout_description: job override ref commit: b9e908e228b5fc554b55ede5460dcd06f1cad7c4 name: openstack/requirements required: true short_name: requirements src_dir: src/opendev.org/openstack/requirements opendev.org/openstack/swift: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/swift checkout: master checkout_description: job override ref commit: 4ff57666f016d4054a46dc2dcaa3ca2ad7ed4766 name: openstack/swift required: true short_name: swift src_dir: src/opendev.org/openstack/swift ref: refs/pull/1018/head resources: {} tenant: oss timeout: 7200 topic: null voting: true zuul_copy_output: /etc/ceph: logs /etc/glusterfs/glusterd.vol: logs /etc/libvirt: logs /etc/lvm: logs /etc/resolv.conf: logs /etc/sudoers: logs /etc/sudoers.d: logs /var/log/ceph: logs /var/log/glusterfs: logs /var/log/libvirt: logs /var/log/mysql: logs /var/log/openvswitch: logs /var/log/postgresql: logs /var/log/rabbitmq: logs /var/log/unbound.log: logs '{{ devstack_conf_dir }}/.localrc.auto': logs '{{ devstack_conf_dir }}/.stackenv': logs '{{ devstack_conf_dir }}/local.conf': logs '{{ devstack_conf_dir }}/localrc': logs '{{ devstack_full_log}}': logs '{{ devstack_log_dir }}/atop': logs '{{ devstack_log_dir }}/devstacklog.txt': logs '{{ devstack_log_dir }}/devstacklog.txt.summary': logs '{{ devstack_log_dir }}/dstat-csv.log': logs '{{ devstack_log_dir }}/qemu.coredump': logs '{{ devstack_log_dir }}/tcpdump.pcap': logs '{{ devstack_log_dir }}/worlddump-latest.txt': logs '{{ stage_dir }}/apache': logs '{{ stage_dir }}/apache_config': logs '{{ stage_dir }}/audit.log': logs '{{ stage_dir }}/core': logs '{{ stage_dir }}/deprecations.log': logs '{{ stage_dir }}/df.txt': logs '{{ stage_dir }}/dpkg-l.txt': logs '{{ stage_dir }}/etc': logs '{{ stage_dir }}/iptables.txt': logs '{{ stage_dir }}/listen53.txt': logs '{{ stage_dir }}/mount.txt': logs '{{ stage_dir }}/performance.json': logs '{{ stage_dir }}/pip2-freeze.txt': logs '{{ stage_dir }}/pip3-freeze.txt': logs '{{ stage_dir }}/rpm-qa.txt': logs '{{ stage_dir }}/services.txt': logs '{{ stage_dir }}/verify_tempest_conf.log': logs