all: children: cephs: hosts: instance: null computes: hosts: instance: null controllers: hosts: instance: null zuul_unreachable: hosts: {} hosts: instance: ansible_connection: ssh ansible_host: 162.253.55.79 ansible_port: 22 ansible_python_interpreter: auto ansible_user: zuul atmosphere_image_prefix: harbor.atmosphere.dev/ ceph_conf_overrides: - option: mon allow pool size one section: global value: true - option: osd crush chooseleaf type section: global value: 0 - option: auth allow insecure global id reclaim section: mon value: false ceph_csi_rbd_helm_values: provisioner: replicaCount: 1 ceph_fsid: 4837cbf8-4f90-4300-b3f6-726c9b9f89b4 ceph_osd_devices: - /dev/ceph-{{ inventory_hostname_short }}-osd0/data - /dev/ceph-{{ inventory_hostname_short }}-osd1/data - /dev/ceph-{{ inventory_hostname_short }}-osd2/data cilium_helm_values: operator: replicas: 1 cluster_issuer_type: self-signed csi_driver: local-path-provisioner ingress_nginx_helm_values: controller: config: worker-processes: 2 keystone_helm_values: pod: replicas: api: 1 kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' molecule_install_collection_siblings: true molecule_scenario: keycloak nodepool: az: yul2 cloud: public external_id: 0e7b9ea8-fcf4-4d6c-93d0-214eab33351b host_id: 44316d8f39b723c689bef9dc3ce595e26433ea9fbabc63510418e839 interface_ip: 162.253.55.79 label: ubuntu-jammy node_properties: {} private_ipv4: 162.253.55.79 private_ipv6: null provider: yul1 public_ipv4: 162.253.55.79 public_ipv6: 2604:e100:1:0:f816:3eff:fe75:692b region: ca-ymq-1 slot: null percona_xtradb_cluster_spec: allowUnsafeConfigurations: true haproxy: size: 1 pxc: size: 1 zuul_node: az: yul2 cloud: public external_id: 0e7b9ea8-fcf4-4d6c-93d0-214eab33351b host_id: 44316d8f39b723c689bef9dc3ce595e26433ea9fbabc63510418e839 interface_ip: 162.253.55.79 label: ubuntu-jammy node_properties: {} private_ipv4: 162.253.55.79 private_ipv6: null provider: yul1 public_ipv4: 162.253.55.79 public_ipv6: 2604:e100:1:0:f816:3eff:fe75:692b region: ca-ymq-1 slot: null uuid: null vars: atmosphere_image_prefix: harbor.atmosphere.dev/ ceph_conf_overrides: - option: mon allow pool size one section: global value: true - option: osd crush chooseleaf type section: global value: 0 - option: auth allow insecure global id reclaim section: mon value: false ceph_csi_rbd_helm_values: provisioner: replicaCount: 1 ceph_fsid: 4837cbf8-4f90-4300-b3f6-726c9b9f89b4 ceph_osd_devices: - /dev/ceph-{{ inventory_hostname_short }}-osd0/data - /dev/ceph-{{ inventory_hostname_short }}-osd1/data - /dev/ceph-{{ inventory_hostname_short }}-osd2/data cilium_helm_values: operator: replicas: 1 cluster_issuer_type: self-signed csi_driver: local-path-provisioner ingress_nginx_helm_values: controller: config: worker-processes: 2 keystone_helm_values: pod: replicas: api: 1 kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' molecule_install_collection_siblings: true molecule_scenario: keycloak percona_xtradb_cluster_spec: allowUnsafeConfigurations: true haproxy: size: 1 pxc: size: 1 zuul: _inheritance_path: - '' - '' - '' - '' - '' ansible_version: '9' attempts: 1 branch: main build: a4e89847d88a420c971807d5076a29a9 build_refs: - branch: main change: '4232' change_message: 'feat(ironic): complete Kubernetes console provider support ## Summary - complete the Ironic Kubernetes VNC console provider integration - stage noVNC browser assets without modifying application JavaScript at runtime - provide the dynamic console Pod/Secret template, dedicated-namespace RBAC, and an enabled-by-default RFB NetworkPolicy when the feature is selected - install `kubectl` in conductor Pods when the Kubernetes provider is enabled - expose a distinct noVNC endpoint and role configuration through Atmosphere variables - require operator-supplied console backend overrides to be complete digest references - make dynamic Pod scheduling, image-pull, probe, resource, and scratch-volume controls configurable - fail safely when disabling the feature while provider-owned Pods or Secrets remain, and remove the role-owned noVNC Ingress when disable is safe The feature remains disabled by default. No image catalog entry or image build input is changed by this pull request. ## Why the original design is insufficient The original provider integration was functional but did not establish a safe production contract: 1. Dynamic BMC credential Secrets and console Pods could fall back to the shared Helm release namespace. The chart now requires an explicit namespace; Atmosphere creates and selects `{{ ironic_helm_release_namespace }}-ironic-vnc` by default. 2. The RFB NetworkPolicy existed but the role did not enable it, leaving TCP/5900 reachable according to the cluster''s ambient policy. It is now enabled by default whenever the Kubernetes console provider is enabled, with an explicit opt-out. 3. The noVNC hostname inherited the Ironic API hostname, allowing two Ingresses to claim the same host and path. The default is now derived as a distinct `baremetal-console` hostname and the role validates endpoint separation. 4. Pod existence did not prove that the backend was listening. The generic template now provides TCP startup and readiness probes on the RFB port. 5. Private registries and topology-constrained BMC networks could not be expressed. Image pull secrets, annotations, node selection, affinity, tolerations, topology spread, priority/runtime classes, resources, and scratch volumes are now configurable. 6. Disabling the feature only skipped the noVNC Ingress task. The role now reconciles that Ingress absent and refuses disable while labelled dynamic Pods or Secrets remain. 7. Digest validation previously accepted any string containing `@sha256:`. It now requires a complete 64-character lowercase SHA-256 reference for console backend and overridden browser-assets images. 8. The checked-in chart and its consolidated vendor patch could drift. The patch is regenerated from the chart baseline and verified to reproduce `charts/ironic` byte-for-byte. The NetworkPolicy is deliberately ingress-only. It permits the Ironic noVNC proxy Pods to connect to dynamic RFB Pods; it does not define OpenStack console authorization or make a console read-only. OpenStack/Ironic authorization remains above this Kubernetes transport boundary. ## Stack and ownership - this branch incorporates and supersedes the focused Ironic noVNC foundation from #3811 on current `main` - chart implementation: https://review.opendev.org/c/openstack/openstack-helm/+/997340 - OpenStack-Helm owns the deployer-neutral `console.namespace` template contract - Atmosphere owns namespace creation/defaulting, endpoint validation, lifecycle reconciliation, and values mapping - upstream Ironic owns provider-side wait-for-listen and partial-apply cleanup; those are not implemented by this PR ## Validation - `git diff --check` - `go test ./roles/ironic/...` - `helm lint charts/ironic` - Helm 3 strict unit tests: 2 console tests, 2 priority-class tests, and 2 runtime-class tests passed - default-disabled render contains no console Pod template, console RBAC, or console NetworkPolicy - missing namespace is rejected when the Kubernetes provider is enabled - separate-namespace render verifies Secret, Pod, Role, RoleBinding, and NetworkPolicy placement and the `application=ironic,component=novncproxy` source selector - consolidated Ironic chart patch applies to its recorded baseline and reproduces the checked-in chart byte-for-byte - chart image tags, Atmosphere image catalog inputs, and image-build inputs are unchanged - `ansible-lint roles/ironic` reports no failures or warnings The repository-wide Go test was also run locally. Changed packages passed; unrelated image-manifest tests assume a Linux target and fail on Darwin/arm64, and Prometheus rule tests require `promtool`, which was not installed on the workstation. CI remains authoritative for those platform/tool-dependent suites. ' change_url: https://github.com/vexxhost/atmosphere/pull/4232 commit_id: 73ed0bc21ea0bafd1693f740ebce863c813b8993 patchset: 73ed0bc21ea0bafd1693f740ebce863c813b8993 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null buildset: 1ff507fed5724c48b19adeed6bb154fd buildset_refs: - branch: main change: '4232' change_message: 'feat(ironic): complete Kubernetes console provider support ## Summary - complete the Ironic Kubernetes VNC console provider integration - stage noVNC browser assets without modifying application JavaScript at runtime - provide the dynamic console Pod/Secret template, dedicated-namespace RBAC, and an enabled-by-default RFB NetworkPolicy when the feature is selected - install `kubectl` in conductor Pods when the Kubernetes provider is enabled - expose a distinct noVNC endpoint and role configuration through Atmosphere variables - require operator-supplied console backend overrides to be complete digest references - make dynamic Pod scheduling, image-pull, probe, resource, and scratch-volume controls configurable - fail safely when disabling the feature while provider-owned Pods or Secrets remain, and remove the role-owned noVNC Ingress when disable is safe The feature remains disabled by default. No image catalog entry or image build input is changed by this pull request. ## Why the original design is insufficient The original provider integration was functional but did not establish a safe production contract: 1. Dynamic BMC credential Secrets and console Pods could fall back to the shared Helm release namespace. The chart now requires an explicit namespace; Atmosphere creates and selects `{{ ironic_helm_release_namespace }}-ironic-vnc` by default. 2. The RFB NetworkPolicy existed but the role did not enable it, leaving TCP/5900 reachable according to the cluster''s ambient policy. It is now enabled by default whenever the Kubernetes console provider is enabled, with an explicit opt-out. 3. The noVNC hostname inherited the Ironic API hostname, allowing two Ingresses to claim the same host and path. The default is now derived as a distinct `baremetal-console` hostname and the role validates endpoint separation. 4. Pod existence did not prove that the backend was listening. The generic template now provides TCP startup and readiness probes on the RFB port. 5. Private registries and topology-constrained BMC networks could not be expressed. Image pull secrets, annotations, node selection, affinity, tolerations, topology spread, priority/runtime classes, resources, and scratch volumes are now configurable. 6. Disabling the feature only skipped the noVNC Ingress task. The role now reconciles that Ingress absent and refuses disable while labelled dynamic Pods or Secrets remain. 7. Digest validation previously accepted any string containing `@sha256:`. It now requires a complete 64-character lowercase SHA-256 reference for console backend and overridden browser-assets images. 8. The checked-in chart and its consolidated vendor patch could drift. The patch is regenerated from the chart baseline and verified to reproduce `charts/ironic` byte-for-byte. The NetworkPolicy is deliberately ingress-only. It permits the Ironic noVNC proxy Pods to connect to dynamic RFB Pods; it does not define OpenStack console authorization or make a console read-only. OpenStack/Ironic authorization remains above this Kubernetes transport boundary. ## Stack and ownership - this branch incorporates and supersedes the focused Ironic noVNC foundation from #3811 on current `main` - chart implementation: https://review.opendev.org/c/openstack/openstack-helm/+/997340 - OpenStack-Helm owns the deployer-neutral `console.namespace` template contract - Atmosphere owns namespace creation/defaulting, endpoint validation, lifecycle reconciliation, and values mapping - upstream Ironic owns provider-side wait-for-listen and partial-apply cleanup; those are not implemented by this PR ## Validation - `git diff --check` - `go test ./roles/ironic/...` - `helm lint charts/ironic` - Helm 3 strict unit tests: 2 console tests, 2 priority-class tests, and 2 runtime-class tests passed - default-disabled render contains no console Pod template, console RBAC, or console NetworkPolicy - missing namespace is rejected when the Kubernetes provider is enabled - separate-namespace render verifies Secret, Pod, Role, RoleBinding, and NetworkPolicy placement and the `application=ironic,component=novncproxy` source selector - consolidated Ironic chart patch applies to its recorded baseline and reproduces the checked-in chart byte-for-byte - chart image tags, Atmosphere image catalog inputs, and image-build inputs are unchanged - `ansible-lint roles/ironic` reports no failures or warnings The repository-wide Go test was also run locally. Changed packages passed; unrelated image-manifest tests assume a Linux target and fail on Darwin/arm64, and Prometheus rule tests require `promtool`, which was not installed on the workstation. CI remains authoritative for those platform/tool-dependent suites. ' change_url: https://github.com/vexxhost/atmosphere/pull/4232 commit_id: 73ed0bc21ea0bafd1693f740ebce863c813b8993 patchset: 73ed0bc21ea0bafd1693f740ebce863c813b8993 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null change: '4232' change_message: 'feat(ironic): complete Kubernetes console provider support ## Summary - complete the Ironic Kubernetes VNC console provider integration - stage noVNC browser assets without modifying application JavaScript at runtime - provide the dynamic console Pod/Secret template, dedicated-namespace RBAC, and an enabled-by-default RFB NetworkPolicy when the feature is selected - install `kubectl` in conductor Pods when the Kubernetes provider is enabled - expose a distinct noVNC endpoint and role configuration through Atmosphere variables - require operator-supplied console backend overrides to be complete digest references - make dynamic Pod scheduling, image-pull, probe, resource, and scratch-volume controls configurable - fail safely when disabling the feature while provider-owned Pods or Secrets remain, and remove the role-owned noVNC Ingress when disable is safe The feature remains disabled by default. No image catalog entry or image build input is changed by this pull request. ## Why the original design is insufficient The original provider integration was functional but did not establish a safe production contract: 1. Dynamic BMC credential Secrets and console Pods could fall back to the shared Helm release namespace. The chart now requires an explicit namespace; Atmosphere creates and selects `{{ ironic_helm_release_namespace }}-ironic-vnc` by default. 2. The RFB NetworkPolicy existed but the role did not enable it, leaving TCP/5900 reachable according to the cluster''s ambient policy. It is now enabled by default whenever the Kubernetes console provider is enabled, with an explicit opt-out. 3. The noVNC hostname inherited the Ironic API hostname, allowing two Ingresses to claim the same host and path. The default is now derived as a distinct `baremetal-console` hostname and the role validates endpoint separation. 4. Pod existence did not prove that the backend was listening. The generic template now provides TCP startup and readiness probes on the RFB port. 5. Private registries and topology-constrained BMC networks could not be expressed. Image pull secrets, annotations, node selection, affinity, tolerations, topology spread, priority/runtime classes, resources, and scratch volumes are now configurable. 6. Disabling the feature only skipped the noVNC Ingress task. The role now reconciles that Ingress absent and refuses disable while labelled dynamic Pods or Secrets remain. 7. Digest validation previously accepted any string containing `@sha256:`. It now requires a complete 64-character lowercase SHA-256 reference for console backend and overridden browser-assets images. 8. The checked-in chart and its consolidated vendor patch could drift. The patch is regenerated from the chart baseline and verified to reproduce `charts/ironic` byte-for-byte. The NetworkPolicy is deliberately ingress-only. It permits the Ironic noVNC proxy Pods to connect to dynamic RFB Pods; it does not define OpenStack console authorization or make a console read-only. OpenStack/Ironic authorization remains above this Kubernetes transport boundary. ## Stack and ownership - this branch incorporates and supersedes the focused Ironic noVNC foundation from #3811 on current `main` - chart implementation: https://review.opendev.org/c/openstack/openstack-helm/+/997340 - OpenStack-Helm owns the deployer-neutral `console.namespace` template contract - Atmosphere owns namespace creation/defaulting, endpoint validation, lifecycle reconciliation, and values mapping - upstream Ironic owns provider-side wait-for-listen and partial-apply cleanup; those are not implemented by this PR ## Validation - `git diff --check` - `go test ./roles/ironic/...` - `helm lint charts/ironic` - Helm 3 strict unit tests: 2 console tests, 2 priority-class tests, and 2 runtime-class tests passed - default-disabled render contains no console Pod template, console RBAC, or console NetworkPolicy - missing namespace is rejected when the Kubernetes provider is enabled - separate-namespace render verifies Secret, Pod, Role, RoleBinding, and NetworkPolicy placement and the `application=ironic,component=novncproxy` source selector - consolidated Ironic chart patch applies to its recorded baseline and reproduces the checked-in chart byte-for-byte - chart image tags, Atmosphere image catalog inputs, and image-build inputs are unchanged - `ansible-lint roles/ironic` reports no failures or warnings The repository-wide Go test was also run locally. Changed packages passed; unrelated image-manifest tests assume a Linux target and fail on Darwin/arm64, and Prometheus rule tests require `promtool`, which was not installed on the workstation. CI remains authoritative for those platform/tool-dependent suites. ' change_url: https://github.com/vexxhost/atmosphere/pull/4232 child_jobs: [] commit_id: 73ed0bc21ea0bafd1693f740ebce863c813b8993 event_id: 7c8d9670-a5ba-11f1-8bff-b5a0446c3838 executor: hostname: 2d72f0692154 inventory_file: /var/lib/zuul/builds/a4e89847d88a420c971807d5076a29a9/ansible/inventory.yaml log_root: /var/lib/zuul/builds/a4e89847d88a420c971807d5076a29a9/work/logs result_data_file: /var/lib/zuul/builds/a4e89847d88a420c971807d5076a29a9/work/results.json src_root: /var/lib/zuul/builds/a4e89847d88a420c971807d5076a29a9/work/src work_root: /var/lib/zuul/builds/a4e89847d88a420c971807d5076a29a9/work include_vars: [] items: - branch: main change: '4232' change_message: 'feat(ironic): complete Kubernetes console provider support ## Summary - complete the Ironic Kubernetes VNC console provider integration - stage noVNC browser assets without modifying application JavaScript at runtime - provide the dynamic console Pod/Secret template, dedicated-namespace RBAC, and an enabled-by-default RFB NetworkPolicy when the feature is selected - install `kubectl` in conductor Pods when the Kubernetes provider is enabled - expose a distinct noVNC endpoint and role configuration through Atmosphere variables - require operator-supplied console backend overrides to be complete digest references - make dynamic Pod scheduling, image-pull, probe, resource, and scratch-volume controls configurable - fail safely when disabling the feature while provider-owned Pods or Secrets remain, and remove the role-owned noVNC Ingress when disable is safe The feature remains disabled by default. No image catalog entry or image build input is changed by this pull request. ## Why the original design is insufficient The original provider integration was functional but did not establish a safe production contract: 1. Dynamic BMC credential Secrets and console Pods could fall back to the shared Helm release namespace. The chart now requires an explicit namespace; Atmosphere creates and selects `{{ ironic_helm_release_namespace }}-ironic-vnc` by default. 2. The RFB NetworkPolicy existed but the role did not enable it, leaving TCP/5900 reachable according to the cluster''s ambient policy. It is now enabled by default whenever the Kubernetes console provider is enabled, with an explicit opt-out. 3. The noVNC hostname inherited the Ironic API hostname, allowing two Ingresses to claim the same host and path. The default is now derived as a distinct `baremetal-console` hostname and the role validates endpoint separation. 4. Pod existence did not prove that the backend was listening. The generic template now provides TCP startup and readiness probes on the RFB port. 5. Private registries and topology-constrained BMC networks could not be expressed. Image pull secrets, annotations, node selection, affinity, tolerations, topology spread, priority/runtime classes, resources, and scratch volumes are now configurable. 6. Disabling the feature only skipped the noVNC Ingress task. The role now reconciles that Ingress absent and refuses disable while labelled dynamic Pods or Secrets remain. 7. Digest validation previously accepted any string containing `@sha256:`. It now requires a complete 64-character lowercase SHA-256 reference for console backend and overridden browser-assets images. 8. The checked-in chart and its consolidated vendor patch could drift. The patch is regenerated from the chart baseline and verified to reproduce `charts/ironic` byte-for-byte. The NetworkPolicy is deliberately ingress-only. It permits the Ironic noVNC proxy Pods to connect to dynamic RFB Pods; it does not define OpenStack console authorization or make a console read-only. OpenStack/Ironic authorization remains above this Kubernetes transport boundary. ## Stack and ownership - this branch incorporates and supersedes the focused Ironic noVNC foundation from #3811 on current `main` - chart implementation: https://review.opendev.org/c/openstack/openstack-helm/+/997340 - OpenStack-Helm owns the deployer-neutral `console.namespace` template contract - Atmosphere owns namespace creation/defaulting, endpoint validation, lifecycle reconciliation, and values mapping - upstream Ironic owns provider-side wait-for-listen and partial-apply cleanup; those are not implemented by this PR ## Validation - `git diff --check` - `go test ./roles/ironic/...` - `helm lint charts/ironic` - Helm 3 strict unit tests: 2 console tests, 2 priority-class tests, and 2 runtime-class tests passed - default-disabled render contains no console Pod template, console RBAC, or console NetworkPolicy - missing namespace is rejected when the Kubernetes provider is enabled - separate-namespace render verifies Secret, Pod, Role, RoleBinding, and NetworkPolicy placement and the `application=ironic,component=novncproxy` source selector - consolidated Ironic chart patch applies to its recorded baseline and reproduces the checked-in chart byte-for-byte - chart image tags, Atmosphere image catalog inputs, and image-build inputs are unchanged - `ansible-lint roles/ironic` reports no failures or warnings The repository-wide Go test was also run locally. Changed packages passed; unrelated image-manifest tests assume a Linux target and fail on Darwin/arm64, and Prometheus rule tests require `promtool`, which was not installed on the workstation. CI remains authoritative for those platform/tool-dependent suites. ' change_url: https://github.com/vexxhost/atmosphere/pull/4232 commit_id: 73ed0bc21ea0bafd1693f740ebce863c813b8993 patchset: 73ed0bc21ea0bafd1693f740ebce863c813b8993 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null job: atmosphere-molecule-keycloak jobtags: [] max_attempts: 3 message: ZmVhdChpcm9uaWMpOiBjb21wbGV0ZSBLdWJlcm5ldGVzIGNvbnNvbGUgcHJvdmlkZXIgc3VwcG9ydAoKIyMgU3VtbWFyeQoKLSBjb21wbGV0ZSB0aGUgSXJvbmljIEt1YmVybmV0ZXMgVk5DIGNvbnNvbGUgcHJvdmlkZXIgaW50ZWdyYXRpb24KLSBzdGFnZSBub1ZOQyBicm93c2VyIGFzc2V0cyB3aXRob3V0IG1vZGlmeWluZyBhcHBsaWNhdGlvbiBKYXZhU2NyaXB0IGF0IHJ1bnRpbWUKLSBwcm92aWRlIHRoZSBkeW5hbWljIGNvbnNvbGUgUG9kL1NlY3JldCB0ZW1wbGF0ZSwgZGVkaWNhdGVkLW5hbWVzcGFjZSBSQkFDLCBhbmQgYW4gZW5hYmxlZC1ieS1kZWZhdWx0IFJGQiBOZXR3b3JrUG9saWN5IHdoZW4gdGhlIGZlYXR1cmUgaXMgc2VsZWN0ZWQKLSBpbnN0YWxsIGBrdWJlY3RsYCBpbiBjb25kdWN0b3IgUG9kcyB3aGVuIHRoZSBLdWJlcm5ldGVzIHByb3ZpZGVyIGlzIGVuYWJsZWQKLSBleHBvc2UgYSBkaXN0aW5jdCBub1ZOQyBlbmRwb2ludCBhbmQgcm9sZSBjb25maWd1cmF0aW9uIHRocm91Z2ggQXRtb3NwaGVyZSB2YXJpYWJsZXMKLSByZXF1aXJlIG9wZXJhdG9yLXN1cHBsaWVkIGNvbnNvbGUgYmFja2VuZCBvdmVycmlkZXMgdG8gYmUgY29tcGxldGUgZGlnZXN0IHJlZmVyZW5jZXMKLSBtYWtlIGR5bmFtaWMgUG9kIHNjaGVkdWxpbmcsIGltYWdlLXB1bGwsIHByb2JlLCByZXNvdXJjZSwgYW5kIHNjcmF0Y2gtdm9sdW1lIGNvbnRyb2xzIGNvbmZpZ3VyYWJsZQotIGZhaWwgc2FmZWx5IHdoZW4gZGlzYWJsaW5nIHRoZSBmZWF0dXJlIHdoaWxlIHByb3ZpZGVyLW93bmVkIFBvZHMgb3IgU2VjcmV0cyByZW1haW4sIGFuZCByZW1vdmUgdGhlIHJvbGUtb3duZWQgbm9WTkMgSW5ncmVzcyB3aGVuIGRpc2FibGUgaXMgc2FmZQoKVGhlIGZlYXR1cmUgcmVtYWlucyBkaXNhYmxlZCBieSBkZWZhdWx0LiBObyBpbWFnZSBjYXRhbG9nIGVudHJ5IG9yIGltYWdlIGJ1aWxkIGlucHV0IGlzIGNoYW5nZWQgYnkgdGhpcyBwdWxsIHJlcXVlc3QuCgojIyBXaHkgdGhlIG9yaWdpbmFsIGRlc2lnbiBpcyBpbnN1ZmZpY2llbnQKClRoZSBvcmlnaW5hbCBwcm92aWRlciBpbnRlZ3JhdGlvbiB3YXMgZnVuY3Rpb25hbCBidXQgZGlkIG5vdCBlc3RhYmxpc2ggYSBzYWZlIHByb2R1Y3Rpb24gY29udHJhY3Q6CgoxLiBEeW5hbWljIEJNQyBjcmVkZW50aWFsIFNlY3JldHMgYW5kIGNvbnNvbGUgUG9kcyBjb3VsZCBmYWxsIGJhY2sgdG8gdGhlIHNoYXJlZCBIZWxtIHJlbGVhc2UgbmFtZXNwYWNlLiBUaGUgY2hhcnQgbm93IHJlcXVpcmVzIGFuIGV4cGxpY2l0IG5hbWVzcGFjZTsgQXRtb3NwaGVyZSBjcmVhdGVzIGFuZCBzZWxlY3RzIGB7eyBpcm9uaWNfaGVsbV9yZWxlYXNlX25hbWVzcGFjZSB9fS1pcm9uaWMtdm5jYCBieSBkZWZhdWx0LgoyLiBUaGUgUkZCIE5ldHdvcmtQb2xpY3kgZXhpc3RlZCBidXQgdGhlIHJvbGUgZGlkIG5vdCBlbmFibGUgaXQsIGxlYXZpbmcgVENQLzU5MDAgcmVhY2hhYmxlIGFjY29yZGluZyB0byB0aGUgY2x1c3RlcidzIGFtYmllbnQgcG9saWN5LiBJdCBpcyBub3cgZW5hYmxlZCBieSBkZWZhdWx0IHdoZW5ldmVyIHRoZSBLdWJlcm5ldGVzIGNvbnNvbGUgcHJvdmlkZXIgaXMgZW5hYmxlZCwgd2l0aCBhbiBleHBsaWNpdCBvcHQtb3V0LgozLiBUaGUgbm9WTkMgaG9zdG5hbWUgaW5oZXJpdGVkIHRoZSBJcm9uaWMgQVBJIGhvc3RuYW1lLCBhbGxvd2luZyB0d28gSW5ncmVzc2VzIHRvIGNsYWltIHRoZSBzYW1lIGhvc3QgYW5kIHBhdGguIFRoZSBkZWZhdWx0IGlzIG5vdyBkZXJpdmVkIGFzIGEgZGlzdGluY3QgYGJhcmVtZXRhbC1jb25zb2xlYCBob3N0bmFtZSBhbmQgdGhlIHJvbGUgdmFsaWRhdGVzIGVuZHBvaW50IHNlcGFyYXRpb24uCjQuIFBvZCBleGlzdGVuY2UgZGlkIG5vdCBwcm92ZSB0aGF0IHRoZSBiYWNrZW5kIHdhcyBsaXN0ZW5pbmcuIFRoZSBnZW5lcmljIHRlbXBsYXRlIG5vdyBwcm92aWRlcyBUQ1Agc3RhcnR1cCBhbmQgcmVhZGluZXNzIHByb2JlcyBvbiB0aGUgUkZCIHBvcnQuCjUuIFByaXZhdGUgcmVnaXN0cmllcyBhbmQgdG9wb2xvZ3ktY29uc3RyYWluZWQgQk1DIG5ldHdvcmtzIGNvdWxkIG5vdCBiZSBleHByZXNzZWQuIEltYWdlIHB1bGwgc2VjcmV0cywgYW5ub3RhdGlvbnMsIG5vZGUgc2VsZWN0aW9uLCBhZmZpbml0eSwgdG9sZXJhdGlvbnMsIHRvcG9sb2d5IHNwcmVhZCwgcHJpb3JpdHkvcnVudGltZSBjbGFzc2VzLCByZXNvdXJjZXMsIGFuZCBzY3JhdGNoIHZvbHVtZXMgYXJlIG5vdyBjb25maWd1cmFibGUuCjYuIERpc2FibGluZyB0aGUgZmVhdHVyZSBvbmx5IHNraXBwZWQgdGhlIG5vVk5DIEluZ3Jlc3MgdGFzay4gVGhlIHJvbGUgbm93IHJlY29uY2lsZXMgdGhhdCBJbmdyZXNzIGFic2VudCBhbmQgcmVmdXNlcyBkaXNhYmxlIHdoaWxlIGxhYmVsbGVkIGR5bmFtaWMgUG9kcyBvciBTZWNyZXRzIHJlbWFpbi4KNy4gRGlnZXN0IHZhbGlkYXRpb24gcHJldmlvdXNseSBhY2NlcHRlZCBhbnkgc3RyaW5nIGNvbnRhaW5pbmcgYEBzaGEyNTY6YC4gSXQgbm93IHJlcXVpcmVzIGEgY29tcGxldGUgNjQtY2hhcmFjdGVyIGxvd2VyY2FzZSBTSEEtMjU2IHJlZmVyZW5jZSBmb3IgY29uc29sZSBiYWNrZW5kIGFuZCBvdmVycmlkZGVuIGJyb3dzZXItYXNzZXRzIGltYWdlcy4KOC4gVGhlIGNoZWNrZWQtaW4gY2hhcnQgYW5kIGl0cyBjb25zb2xpZGF0ZWQgdmVuZG9yIHBhdGNoIGNvdWxkIGRyaWZ0LiBUaGUgcGF0Y2ggaXMgcmVnZW5lcmF0ZWQgZnJvbSB0aGUgY2hhcnQgYmFzZWxpbmUgYW5kIHZlcmlmaWVkIHRvIHJlcHJvZHVjZSBgY2hhcnRzL2lyb25pY2AgYnl0ZS1mb3ItYnl0ZS4KClRoZSBOZXR3b3JrUG9saWN5IGlzIGRlbGliZXJhdGVseSBpbmdyZXNzLW9ubHkuIEl0IHBlcm1pdHMgdGhlIElyb25pYyBub1ZOQyBwcm94eSBQb2RzIHRvIGNvbm5lY3QgdG8gZHluYW1pYyBSRkIgUG9kczsgaXQgZG9lcyBub3QgZGVmaW5lIE9wZW5TdGFjayBjb25zb2xlIGF1dGhvcml6YXRpb24gb3IgbWFrZSBhIGNvbnNvbGUgcmVhZC1vbmx5LiBPcGVuU3RhY2svSXJvbmljIGF1dGhvcml6YXRpb24gcmVtYWlucyBhYm92ZSB0aGlzIEt1YmVybmV0ZXMgdHJhbnNwb3J0IGJvdW5kYXJ5LgoKIyMgU3RhY2sgYW5kIG93bmVyc2hpcAoKLSB0aGlzIGJyYW5jaCBpbmNvcnBvcmF0ZXMgYW5kIHN1cGVyc2VkZXMgdGhlIGZvY3VzZWQgSXJvbmljIG5vVk5DIGZvdW5kYXRpb24gZnJvbSAjMzgxMSBvbiBjdXJyZW50IGBtYWluYAotIGNoYXJ0IGltcGxlbWVudGF0aW9uOiBodHRwczovL3Jldmlldy5vcGVuZGV2Lm9yZy9jL29wZW5zdGFjay9vcGVuc3RhY2staGVsbS8rLzk5NzM0MAotIE9wZW5TdGFjay1IZWxtIG93bnMgdGhlIGRlcGxveWVyLW5ldXRyYWwgYGNvbnNvbGUubmFtZXNwYWNlYCB0ZW1wbGF0ZSBjb250cmFjdAotIEF0bW9zcGhlcmUgb3ducyBuYW1lc3BhY2UgY3JlYXRpb24vZGVmYXVsdGluZywgZW5kcG9pbnQgdmFsaWRhdGlvbiwgbGlmZWN5Y2xlIHJlY29uY2lsaWF0aW9uLCBhbmQgdmFsdWVzIG1hcHBpbmcKLSB1cHN0cmVhbSBJcm9uaWMgb3ducyBwcm92aWRlci1zaWRlIHdhaXQtZm9yLWxpc3RlbiBhbmQgcGFydGlhbC1hcHBseSBjbGVhbnVwOyB0aG9zZSBhcmUgbm90IGltcGxlbWVudGVkIGJ5IHRoaXMgUFIKCiMjIFZhbGlkYXRpb24KCi0gYGdpdCBkaWZmIC0tY2hlY2tgCi0gYGdvIHRlc3QgLi9yb2xlcy9pcm9uaWMvLi4uYAotIGBoZWxtIGxpbnQgY2hhcnRzL2lyb25pY2AKLSBIZWxtIDMgc3RyaWN0IHVuaXQgdGVzdHM6IDIgY29uc29sZSB0ZXN0cywgMiBwcmlvcml0eS1jbGFzcyB0ZXN0cywgYW5kIDIgcnVudGltZS1jbGFzcyB0ZXN0cyBwYXNzZWQKLSBkZWZhdWx0LWRpc2FibGVkIHJlbmRlciBjb250YWlucyBubyBjb25zb2xlIFBvZCB0ZW1wbGF0ZSwgY29uc29sZSBSQkFDLCBvciBjb25zb2xlIE5ldHdvcmtQb2xpY3kKLSBtaXNzaW5nIG5hbWVzcGFjZSBpcyByZWplY3RlZCB3aGVuIHRoZSBLdWJlcm5ldGVzIHByb3ZpZGVyIGlzIGVuYWJsZWQKLSBzZXBhcmF0ZS1uYW1lc3BhY2UgcmVuZGVyIHZlcmlmaWVzIFNlY3JldCwgUG9kLCBSb2xlLCBSb2xlQmluZGluZywgYW5kIE5ldHdvcmtQb2xpY3kgcGxhY2VtZW50IGFuZCB0aGUgYGFwcGxpY2F0aW9uPWlyb25pYyxjb21wb25lbnQ9bm92bmNwcm94eWAgc291cmNlIHNlbGVjdG9yCi0gY29uc29saWRhdGVkIElyb25pYyBjaGFydCBwYXRjaCBhcHBsaWVzIHRvIGl0cyByZWNvcmRlZCBiYXNlbGluZSBhbmQgcmVwcm9kdWNlcyB0aGUgY2hlY2tlZC1pbiBjaGFydCBieXRlLWZvci1ieXRlCi0gY2hhcnQgaW1hZ2UgdGFncywgQXRtb3NwaGVyZSBpbWFnZSBjYXRhbG9nIGlucHV0cywgYW5kIGltYWdlLWJ1aWxkIGlucHV0cyBhcmUgdW5jaGFuZ2VkCi0gYGFuc2libGUtbGludCByb2xlcy9pcm9uaWNgIHJlcG9ydHMgbm8gZmFpbHVyZXMgb3Igd2FybmluZ3MKClRoZSByZXBvc2l0b3J5LXdpZGUgR28gdGVzdCB3YXMgYWxzbyBydW4gbG9jYWxseS4gQ2hhbmdlZCBwYWNrYWdlcyBwYXNzZWQ7IHVucmVsYXRlZCBpbWFnZS1tYW5pZmVzdCB0ZXN0cyBhc3N1bWUgYSBMaW51eCB0YXJnZXQgYW5kIGZhaWwgb24gRGFyd2luL2FybTY0LCBhbmQgUHJvbWV0aGV1cyBydWxlIHRlc3RzIHJlcXVpcmUgYHByb210b29sYCwgd2hpY2ggd2FzIG5vdCBpbnN0YWxsZWQgb24gdGhlIHdvcmtzdGF0aW9uLiBDSSByZW1haW5zIGF1dGhvcml0YXRpdmUgZm9yIHRob3NlIHBsYXRmb3JtL3Rvb2wtZGVwZW5kZW50IHN1aXRlcy4KCg== patchset: 73ed0bc21ea0bafd1693f740ebce863c813b8993 pipeline: check playbook_context: playbook_projects: trusted/project_0/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 trusted/project_1/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: 9b835d0194f05a1b60885a2bbc740d1361c5a672 trusted/project_2/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: c286bf94224b5660b8e49e9a058289e61062a9a0 untrusted/project_0/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: c286bf94224b5660b8e49e9a058289e61062a9a0 untrusted/project_1/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 untrusted/project_2/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: 9b835d0194f05a1b60885a2bbc740d1361c5a672 untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs: canonical_name: github.com/vexxhost/atmosphere-zuul-jobs checkout: main commit: acb8e36a801f3b93fdd30dec43a15b6f8d809c2f untrusted/project_4/opendev.org/openstack/openstack-helm: canonical_name: opendev.org/openstack/openstack-helm checkout: master commit: 6697f8df7f6b0dcc80625b8f8cf2c7c2fa7dd09c playbooks: - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/run.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/playbook_0/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/playbook_0/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/playbook_0/role_2/zuul-jobs/roles post_playbooks: - path: untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs/playbooks/molecule/post.yml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/post_playbook_0/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_0/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_0/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_0/role_4/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_1/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_1/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_1/role_2/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post-logs.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_2/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_2/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_2/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_2/role_2/zuul-jobs/roles pre_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_0/role_2/zuul-jobs/roles - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_1/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_1/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_1/role_2/zuul-jobs/roles - path: untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs/playbooks/molecule/pre.yml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/pre_playbook_2/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_2/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_2/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_2/role_4/zuul-jobs/roles post_review: false post_timeout: null pre_timeout: null project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere projects: github.com/ansible-collections/ansible.netcommon: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.netcommon checkout: main checkout_description: zuul branch commit: 3c1482f295d0746033db268aad986bc1648d20f8 name: ansible-collections/ansible.netcommon required: true short_name: ansible.netcommon src_dir: src/github.com/ansible-collections/ansible.netcommon github.com/ansible-collections/ansible.posix: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.posix checkout: main checkout_description: zuul branch commit: 20699d7184e21cec7be80212c96a6cbe373f718d name: ansible-collections/ansible.posix required: true short_name: ansible.posix src_dir: src/github.com/ansible-collections/ansible.posix github.com/ansible-collections/ansible.utils: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.utils checkout: main checkout_description: zuul branch commit: eb828fcea5d1edeba76cd8efee4f35520b7b8fb5 name: ansible-collections/ansible.utils required: true short_name: ansible.utils src_dir: src/github.com/ansible-collections/ansible.utils github.com/ansible-collections/community.crypto: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.crypto checkout: main checkout_description: zuul branch commit: f443c1b56eb61ae4672ec5af8e15dbf6d9060c06 name: ansible-collections/community.crypto required: true short_name: community.crypto src_dir: src/github.com/ansible-collections/community.crypto github.com/ansible-collections/community.general: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.general checkout: main checkout_description: zuul branch commit: 60972bc7422ba42060695353ecb54a7c5a99eef0 name: ansible-collections/community.general required: true short_name: community.general src_dir: src/github.com/ansible-collections/community.general github.com/ansible-collections/community.mysql: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.mysql checkout: main checkout_description: zuul branch commit: 4cf7a3176fbd07be43459f1366e8066381df6d97 name: ansible-collections/community.mysql required: true short_name: community.mysql src_dir: src/github.com/ansible-collections/community.mysql github.com/ansible-collections/kubernetes.core: canonical_hostname: github.com canonical_name: github.com/ansible-collections/kubernetes.core checkout: main checkout_description: zuul branch commit: d9e0218dbae23a183aef829847dfeccf0e4e7535 name: ansible-collections/kubernetes.core required: true short_name: kubernetes.core src_dir: src/github.com/ansible-collections/kubernetes.core github.com/vexxhost/ansible-collection-ceph: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-ceph checkout: main checkout_description: zuul branch commit: 44a694a80e3179c28d75180baa1a56426f987257 name: vexxhost/ansible-collection-ceph required: true short_name: ansible-collection-ceph src_dir: src/github.com/vexxhost/ansible-collection-ceph github.com/vexxhost/ansible-collection-containers: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-containers checkout: main checkout_description: zuul branch commit: d22923ebd40c0fd5a345318c1db90d125fb5140f name: vexxhost/ansible-collection-containers required: true short_name: ansible-collection-containers src_dir: src/github.com/vexxhost/ansible-collection-containers github.com/vexxhost/ansible-collection-kubernetes: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes checkout: main checkout_description: zuul branch commit: 7ce96efcd4d44cbf184588dd146d08ce952b57bb name: vexxhost/ansible-collection-kubernetes required: true short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes github.com/vexxhost/atmosphere: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere checkout: main checkout_description: zuul branch commit: 73ed0bc21ea0bafd1693f740ebce863c813b8993 name: vexxhost/atmosphere required: false short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere github.com/vexxhost/atmosphere.common: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common checkout: main checkout_description: zuul branch commit: d00ec7f88fdc7ca2ce504a7e19c4049986cdac86 name: vexxhost/atmosphere.common required: true short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common opendev.org/openstack/ansible-collections-openstack: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/ansible-collections-openstack checkout: master checkout_description: project default branch commit: ee88cc15b87221ecabb474c7c3d0feaf6e01a7fa name: openstack/ansible-collections-openstack required: true short_name: ansible-collections-openstack src_dir: src/opendev.org/openstack/ansible-collections-openstack ref: refs/pull/4232/head resources: {} tenant: oss timeout: 1800 topic: null voting: true