all: children: cephs: hosts: instance: null computes: hosts: instance: null controllers: hosts: instance: null zuul_unreachable: hosts: {} hosts: instance: ansible_connection: ssh ansible_host: 199.204.45.138 ansible_port: 22 ansible_python_interpreter: auto ansible_user: zuul atmosphere_image_prefix: harbor.atmosphere.dev/ ceph_conf_overrides: - option: mon allow pool size one section: global value: true - option: osd crush chooseleaf type section: global value: 0 - option: auth allow insecure global id reclaim section: mon value: false ceph_csi_rbd_helm_values: provisioner: replicaCount: 1 ceph_fsid: 4837cbf8-4f90-4300-b3f6-726c9b9f89b4 ceph_osd_devices: - /dev/ceph-{{ inventory_hostname_short }}-osd0/data - /dev/ceph-{{ inventory_hostname_short }}-osd1/data - /dev/ceph-{{ inventory_hostname_short }}-osd2/data cilium_helm_values: operator: replicas: 1 csi_driver: rbd kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' molecule_install_collection_siblings: true molecule_scenario: csi nodepool: az: nova cloud: public external_id: 8129b93e-83a5-4b91-a4dd-8a16935d04dd host_id: fe6a549c934f5f67345b1bd07db2b4711c0ee4717d98054273574436 interface_ip: 199.204.45.138 label: ubuntu-jammy node_properties: {} private_ipv4: 199.204.45.138 private_ipv6: null provider: yul1 public_ipv4: 199.204.45.138 public_ipv6: 2604:e100:1:0:f816:3eff:fe1c:663e region: ca-ymq-1 slot: null zuul_node: az: nova cloud: public external_id: 8129b93e-83a5-4b91-a4dd-8a16935d04dd host_id: fe6a549c934f5f67345b1bd07db2b4711c0ee4717d98054273574436 interface_ip: 199.204.45.138 label: ubuntu-jammy node_properties: {} private_ipv4: 199.204.45.138 private_ipv6: null provider: yul1 public_ipv4: 199.204.45.138 public_ipv6: 2604:e100:1:0:f816:3eff:fe1c:663e region: ca-ymq-1 slot: null uuid: null vars: atmosphere_image_prefix: harbor.atmosphere.dev/ ceph_conf_overrides: - option: mon allow pool size one section: global value: true - option: osd crush chooseleaf type section: global value: 0 - option: auth allow insecure global id reclaim section: mon value: false ceph_csi_rbd_helm_values: provisioner: replicaCount: 1 ceph_fsid: 4837cbf8-4f90-4300-b3f6-726c9b9f89b4 ceph_osd_devices: - /dev/ceph-{{ inventory_hostname_short }}-osd0/data - /dev/ceph-{{ inventory_hostname_short }}-osd1/data - /dev/ceph-{{ inventory_hostname_short }}-osd2/data cilium_helm_values: operator: replicas: 1 csi_driver: rbd kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' molecule_install_collection_siblings: true molecule_scenario: csi zuul: _inheritance_path: - '' - '' - '' - '' - '' - '' ansible_version: '9' attempts: 1 branch: main build: afaba6558f9341208ce3fc3cde4e7a65 build_refs: - branch: main change: '4232' change_message: 'feat(ironic): complete Kubernetes console provider support ## Summary - complete the Ironic Kubernetes VNC console provider integration - stage noVNC browser assets without modifying application JavaScript at runtime - provide the dynamic console Pod/Secret template, dedicated-namespace RBAC, and an enabled-by-default RFB NetworkPolicy when the feature is selected - install `kubectl` in conductor Pods when the Kubernetes provider is enabled - expose a distinct noVNC endpoint and role configuration through Atmosphere variables - require operator-supplied console backend overrides to be complete digest references - make dynamic Pod scheduling, image-pull, probe, resource, and scratch-volume controls configurable - fail safely when disabling the feature while provider-owned Pods or Secrets remain, and remove the role-owned noVNC Ingress when disable is safe The feature remains disabled by default. No image catalog entry or image build input is changed by this pull request. ## Why the original design is insufficient The original provider integration was functional but did not establish a safe production contract: 1. Dynamic BMC credential Secrets and console Pods could fall back to the shared Helm release namespace. The chart now requires an explicit namespace; Atmosphere creates and selects `{{ ironic_helm_release_namespace }}-ironic-vnc` by default. 2. The RFB NetworkPolicy existed but the role did not enable it, leaving TCP/5900 reachable according to the cluster''s ambient policy. It is now enabled by default whenever the Kubernetes console provider is enabled, with an explicit opt-out. 3. The noVNC hostname inherited the Ironic API hostname, allowing two Ingresses to claim the same host and path. The default is now derived as a distinct `baremetal-console` hostname and the role validates endpoint separation. 4. Pod existence did not prove that the backend was listening. The generic template now provides TCP startup and readiness probes on the RFB port. 5. Private registries and topology-constrained BMC networks could not be expressed. Image pull secrets, annotations, node selection, affinity, tolerations, topology spread, priority/runtime classes, resources, and scratch volumes are now configurable. 6. Disabling the feature only skipped the noVNC Ingress task. The role now reconciles that Ingress absent and refuses disable while labelled dynamic Pods or Secrets remain. 7. Digest validation previously accepted any string containing `@sha256:`. It now requires a complete 64-character lowercase SHA-256 reference for console backend and overridden browser-assets images. 8. The checked-in chart and its consolidated vendor patch could drift. The patch is regenerated from the chart baseline and verified to reproduce `charts/ironic` byte-for-byte. The NetworkPolicy is deliberately ingress-only. It permits the Ironic noVNC proxy Pods to connect to dynamic RFB Pods; it does not define OpenStack console authorization or make a console read-only. OpenStack/Ironic authorization remains above this Kubernetes transport boundary. ## Stack and ownership - this branch incorporates and supersedes the focused Ironic noVNC foundation from #3811 on current `main` - chart implementation: https://review.opendev.org/c/openstack/openstack-helm/+/997340 - OpenStack-Helm owns the deployer-neutral `console.namespace` template contract - Atmosphere owns namespace creation/defaulting, endpoint validation, lifecycle reconciliation, and values mapping - upstream Ironic owns provider-side wait-for-listen and partial-apply cleanup; those are not implemented by this PR ## Validation - `git diff --check` - `go test ./roles/ironic/...` - `helm lint charts/ironic` - Helm 3 strict unit tests: 2 console tests, 2 priority-class tests, and 2 runtime-class tests passed - default-disabled render contains no console Pod template, console RBAC, or console NetworkPolicy - missing namespace is rejected when the Kubernetes provider is enabled - separate-namespace render verifies Secret, Pod, Role, RoleBinding, and NetworkPolicy placement and the `application=ironic,component=novncproxy` source selector - consolidated Ironic chart patch applies to its recorded baseline and reproduces the checked-in chart byte-for-byte - chart image tags, Atmosphere image catalog inputs, and image-build inputs are unchanged - `ansible-lint roles/ironic` reports no failures or warnings The repository-wide Go test was also run locally. Changed packages passed; unrelated image-manifest tests assume a Linux target and fail on Darwin/arm64, and Prometheus rule tests require `promtool`, which was not installed on the workstation. CI remains authoritative for those platform/tool-dependent suites. ' change_url: https://github.com/vexxhost/atmosphere/pull/4232 commit_id: cffe65e19d794abeeecfcb45d7084bca350520f3 patchset: cffe65e19d794abeeecfcb45d7084bca350520f3 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null buildset: b10a9daaa451405fb0c20144004a9c76 buildset_refs: - branch: main change: '4232' change_message: 'feat(ironic): complete Kubernetes console provider support ## Summary - complete the Ironic Kubernetes VNC console provider integration - stage noVNC browser assets without modifying application JavaScript at runtime - provide the dynamic console Pod/Secret template, dedicated-namespace RBAC, and an enabled-by-default RFB NetworkPolicy when the feature is selected - install `kubectl` in conductor Pods when the Kubernetes provider is enabled - expose a distinct noVNC endpoint and role configuration through Atmosphere variables - require operator-supplied console backend overrides to be complete digest references - make dynamic Pod scheduling, image-pull, probe, resource, and scratch-volume controls configurable - fail safely when disabling the feature while provider-owned Pods or Secrets remain, and remove the role-owned noVNC Ingress when disable is safe The feature remains disabled by default. No image catalog entry or image build input is changed by this pull request. ## Why the original design is insufficient The original provider integration was functional but did not establish a safe production contract: 1. Dynamic BMC credential Secrets and console Pods could fall back to the shared Helm release namespace. The chart now requires an explicit namespace; Atmosphere creates and selects `{{ ironic_helm_release_namespace }}-ironic-vnc` by default. 2. The RFB NetworkPolicy existed but the role did not enable it, leaving TCP/5900 reachable according to the cluster''s ambient policy. It is now enabled by default whenever the Kubernetes console provider is enabled, with an explicit opt-out. 3. The noVNC hostname inherited the Ironic API hostname, allowing two Ingresses to claim the same host and path. The default is now derived as a distinct `baremetal-console` hostname and the role validates endpoint separation. 4. Pod existence did not prove that the backend was listening. The generic template now provides TCP startup and readiness probes on the RFB port. 5. Private registries and topology-constrained BMC networks could not be expressed. Image pull secrets, annotations, node selection, affinity, tolerations, topology spread, priority/runtime classes, resources, and scratch volumes are now configurable. 6. Disabling the feature only skipped the noVNC Ingress task. The role now reconciles that Ingress absent and refuses disable while labelled dynamic Pods or Secrets remain. 7. Digest validation previously accepted any string containing `@sha256:`. It now requires a complete 64-character lowercase SHA-256 reference for console backend and overridden browser-assets images. 8. The checked-in chart and its consolidated vendor patch could drift. The patch is regenerated from the chart baseline and verified to reproduce `charts/ironic` byte-for-byte. The NetworkPolicy is deliberately ingress-only. It permits the Ironic noVNC proxy Pods to connect to dynamic RFB Pods; it does not define OpenStack console authorization or make a console read-only. OpenStack/Ironic authorization remains above this Kubernetes transport boundary. ## Stack and ownership - this branch incorporates and supersedes the focused Ironic noVNC foundation from #3811 on current `main` - chart implementation: https://review.opendev.org/c/openstack/openstack-helm/+/997340 - OpenStack-Helm owns the deployer-neutral `console.namespace` template contract - Atmosphere owns namespace creation/defaulting, endpoint validation, lifecycle reconciliation, and values mapping - upstream Ironic owns provider-side wait-for-listen and partial-apply cleanup; those are not implemented by this PR ## Validation - `git diff --check` - `go test ./roles/ironic/...` - `helm lint charts/ironic` - Helm 3 strict unit tests: 2 console tests, 2 priority-class tests, and 2 runtime-class tests passed - default-disabled render contains no console Pod template, console RBAC, or console NetworkPolicy - missing namespace is rejected when the Kubernetes provider is enabled - separate-namespace render verifies Secret, Pod, Role, RoleBinding, and NetworkPolicy placement and the `application=ironic,component=novncproxy` source selector - consolidated Ironic chart patch applies to its recorded baseline and reproduces the checked-in chart byte-for-byte - chart image tags, Atmosphere image catalog inputs, and image-build inputs are unchanged - `ansible-lint roles/ironic` reports no failures or warnings The repository-wide Go test was also run locally. Changed packages passed; unrelated image-manifest tests assume a Linux target and fail on Darwin/arm64, and Prometheus rule tests require `promtool`, which was not installed on the workstation. CI remains authoritative for those platform/tool-dependent suites. ' change_url: https://github.com/vexxhost/atmosphere/pull/4232 commit_id: cffe65e19d794abeeecfcb45d7084bca350520f3 patchset: cffe65e19d794abeeecfcb45d7084bca350520f3 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null change: '4232' change_message: 'feat(ironic): complete Kubernetes console provider support ## Summary - complete the Ironic Kubernetes VNC console provider integration - stage noVNC browser assets without modifying application JavaScript at runtime - provide the dynamic console Pod/Secret template, dedicated-namespace RBAC, and an enabled-by-default RFB NetworkPolicy when the feature is selected - install `kubectl` in conductor Pods when the Kubernetes provider is enabled - expose a distinct noVNC endpoint and role configuration through Atmosphere variables - require operator-supplied console backend overrides to be complete digest references - make dynamic Pod scheduling, image-pull, probe, resource, and scratch-volume controls configurable - fail safely when disabling the feature while provider-owned Pods or Secrets remain, and remove the role-owned noVNC Ingress when disable is safe The feature remains disabled by default. No image catalog entry or image build input is changed by this pull request. ## Why the original design is insufficient The original provider integration was functional but did not establish a safe production contract: 1. Dynamic BMC credential Secrets and console Pods could fall back to the shared Helm release namespace. The chart now requires an explicit namespace; Atmosphere creates and selects `{{ ironic_helm_release_namespace }}-ironic-vnc` by default. 2. The RFB NetworkPolicy existed but the role did not enable it, leaving TCP/5900 reachable according to the cluster''s ambient policy. It is now enabled by default whenever the Kubernetes console provider is enabled, with an explicit opt-out. 3. The noVNC hostname inherited the Ironic API hostname, allowing two Ingresses to claim the same host and path. The default is now derived as a distinct `baremetal-console` hostname and the role validates endpoint separation. 4. Pod existence did not prove that the backend was listening. The generic template now provides TCP startup and readiness probes on the RFB port. 5. Private registries and topology-constrained BMC networks could not be expressed. Image pull secrets, annotations, node selection, affinity, tolerations, topology spread, priority/runtime classes, resources, and scratch volumes are now configurable. 6. Disabling the feature only skipped the noVNC Ingress task. The role now reconciles that Ingress absent and refuses disable while labelled dynamic Pods or Secrets remain. 7. Digest validation previously accepted any string containing `@sha256:`. It now requires a complete 64-character lowercase SHA-256 reference for console backend and overridden browser-assets images. 8. The checked-in chart and its consolidated vendor patch could drift. The patch is regenerated from the chart baseline and verified to reproduce `charts/ironic` byte-for-byte. The NetworkPolicy is deliberately ingress-only. It permits the Ironic noVNC proxy Pods to connect to dynamic RFB Pods; it does not define OpenStack console authorization or make a console read-only. OpenStack/Ironic authorization remains above this Kubernetes transport boundary. ## Stack and ownership - this branch incorporates and supersedes the focused Ironic noVNC foundation from #3811 on current `main` - chart implementation: https://review.opendev.org/c/openstack/openstack-helm/+/997340 - OpenStack-Helm owns the deployer-neutral `console.namespace` template contract - Atmosphere owns namespace creation/defaulting, endpoint validation, lifecycle reconciliation, and values mapping - upstream Ironic owns provider-side wait-for-listen and partial-apply cleanup; those are not implemented by this PR ## Validation - `git diff --check` - `go test ./roles/ironic/...` - `helm lint charts/ironic` - Helm 3 strict unit tests: 2 console tests, 2 priority-class tests, and 2 runtime-class tests passed - default-disabled render contains no console Pod template, console RBAC, or console NetworkPolicy - missing namespace is rejected when the Kubernetes provider is enabled - separate-namespace render verifies Secret, Pod, Role, RoleBinding, and NetworkPolicy placement and the `application=ironic,component=novncproxy` source selector - consolidated Ironic chart patch applies to its recorded baseline and reproduces the checked-in chart byte-for-byte - chart image tags, Atmosphere image catalog inputs, and image-build inputs are unchanged - `ansible-lint roles/ironic` reports no failures or warnings The repository-wide Go test was also run locally. Changed packages passed; unrelated image-manifest tests assume a Linux target and fail on Darwin/arm64, and Prometheus rule tests require `promtool`, which was not installed on the workstation. CI remains authoritative for those platform/tool-dependent suites. ' change_url: https://github.com/vexxhost/atmosphere/pull/4232 child_jobs: [] commit_id: cffe65e19d794abeeecfcb45d7084bca350520f3 event_id: bd15f490-9795-11f1-985e-490b41bdd75e executor: hostname: 2d72f0692154 inventory_file: /var/lib/zuul/builds/afaba6558f9341208ce3fc3cde4e7a65/ansible/inventory.yaml log_root: /var/lib/zuul/builds/afaba6558f9341208ce3fc3cde4e7a65/work/logs result_data_file: /var/lib/zuul/builds/afaba6558f9341208ce3fc3cde4e7a65/work/results.json src_root: /var/lib/zuul/builds/afaba6558f9341208ce3fc3cde4e7a65/work/src work_root: /var/lib/zuul/builds/afaba6558f9341208ce3fc3cde4e7a65/work include_vars: [] items: - branch: main change: '4232' change_message: 'feat(ironic): complete Kubernetes console provider support ## Summary - complete the Ironic Kubernetes VNC console provider integration - stage noVNC browser assets without modifying application JavaScript at runtime - provide the dynamic console Pod/Secret template, dedicated-namespace RBAC, and an enabled-by-default RFB NetworkPolicy when the feature is selected - install `kubectl` in conductor Pods when the Kubernetes provider is enabled - expose a distinct noVNC endpoint and role configuration through Atmosphere variables - require operator-supplied console backend overrides to be complete digest references - make dynamic Pod scheduling, image-pull, probe, resource, and scratch-volume controls configurable - fail safely when disabling the feature while provider-owned Pods or Secrets remain, and remove the role-owned noVNC Ingress when disable is safe The feature remains disabled by default. No image catalog entry or image build input is changed by this pull request. ## Why the original design is insufficient The original provider integration was functional but did not establish a safe production contract: 1. Dynamic BMC credential Secrets and console Pods could fall back to the shared Helm release namespace. The chart now requires an explicit namespace; Atmosphere creates and selects `{{ ironic_helm_release_namespace }}-ironic-vnc` by default. 2. The RFB NetworkPolicy existed but the role did not enable it, leaving TCP/5900 reachable according to the cluster''s ambient policy. It is now enabled by default whenever the Kubernetes console provider is enabled, with an explicit opt-out. 3. The noVNC hostname inherited the Ironic API hostname, allowing two Ingresses to claim the same host and path. The default is now derived as a distinct `baremetal-console` hostname and the role validates endpoint separation. 4. Pod existence did not prove that the backend was listening. The generic template now provides TCP startup and readiness probes on the RFB port. 5. Private registries and topology-constrained BMC networks could not be expressed. Image pull secrets, annotations, node selection, affinity, tolerations, topology spread, priority/runtime classes, resources, and scratch volumes are now configurable. 6. Disabling the feature only skipped the noVNC Ingress task. The role now reconciles that Ingress absent and refuses disable while labelled dynamic Pods or Secrets remain. 7. Digest validation previously accepted any string containing `@sha256:`. It now requires a complete 64-character lowercase SHA-256 reference for console backend and overridden browser-assets images. 8. The checked-in chart and its consolidated vendor patch could drift. The patch is regenerated from the chart baseline and verified to reproduce `charts/ironic` byte-for-byte. The NetworkPolicy is deliberately ingress-only. It permits the Ironic noVNC proxy Pods to connect to dynamic RFB Pods; it does not define OpenStack console authorization or make a console read-only. OpenStack/Ironic authorization remains above this Kubernetes transport boundary. ## Stack and ownership - this branch incorporates and supersedes the focused Ironic noVNC foundation from #3811 on current `main` - chart implementation: https://review.opendev.org/c/openstack/openstack-helm/+/997340 - OpenStack-Helm owns the deployer-neutral `console.namespace` template contract - Atmosphere owns namespace creation/defaulting, endpoint validation, lifecycle reconciliation, and values mapping - upstream Ironic owns provider-side wait-for-listen and partial-apply cleanup; those are not implemented by this PR ## Validation - `git diff --check` - `go test ./roles/ironic/...` - `helm lint charts/ironic` - Helm 3 strict unit tests: 2 console tests, 2 priority-class tests, and 2 runtime-class tests passed - default-disabled render contains no console Pod template, console RBAC, or console NetworkPolicy - missing namespace is rejected when the Kubernetes provider is enabled - separate-namespace render verifies Secret, Pod, Role, RoleBinding, and NetworkPolicy placement and the `application=ironic,component=novncproxy` source selector - consolidated Ironic chart patch applies to its recorded baseline and reproduces the checked-in chart byte-for-byte - chart image tags, Atmosphere image catalog inputs, and image-build inputs are unchanged - `ansible-lint roles/ironic` reports no failures or warnings The repository-wide Go test was also run locally. Changed packages passed; unrelated image-manifest tests assume a Linux target and fail on Darwin/arm64, and Prometheus rule tests require `promtool`, which was not installed on the workstation. CI remains authoritative for those platform/tool-dependent suites. ' change_url: https://github.com/vexxhost/atmosphere/pull/4232 commit_id: cffe65e19d794abeeecfcb45d7084bca350520f3 patchset: cffe65e19d794abeeecfcb45d7084bca350520f3 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null job: atmosphere-molecule-csi-rbd jobtags: [] max_attempts: 3 message: ZmVhdChpcm9uaWMpOiBjb21wbGV0ZSBLdWJlcm5ldGVzIGNvbnNvbGUgcHJvdmlkZXIgc3VwcG9ydAoKIyMgU3VtbWFyeQoKLSBjb21wbGV0ZSB0aGUgSXJvbmljIEt1YmVybmV0ZXMgVk5DIGNvbnNvbGUgcHJvdmlkZXIgaW50ZWdyYXRpb24KLSBzdGFnZSBub1ZOQyBicm93c2VyIGFzc2V0cyB3aXRob3V0IG1vZGlmeWluZyBhcHBsaWNhdGlvbiBKYXZhU2NyaXB0IGF0IHJ1bnRpbWUKLSBwcm92aWRlIHRoZSBkeW5hbWljIGNvbnNvbGUgUG9kL1NlY3JldCB0ZW1wbGF0ZSwgZGVkaWNhdGVkLW5hbWVzcGFjZSBSQkFDLCBhbmQgYW4gZW5hYmxlZC1ieS1kZWZhdWx0IFJGQiBOZXR3b3JrUG9saWN5IHdoZW4gdGhlIGZlYXR1cmUgaXMgc2VsZWN0ZWQKLSBpbnN0YWxsIGBrdWJlY3RsYCBpbiBjb25kdWN0b3IgUG9kcyB3aGVuIHRoZSBLdWJlcm5ldGVzIHByb3ZpZGVyIGlzIGVuYWJsZWQKLSBleHBvc2UgYSBkaXN0aW5jdCBub1ZOQyBlbmRwb2ludCBhbmQgcm9sZSBjb25maWd1cmF0aW9uIHRocm91Z2ggQXRtb3NwaGVyZSB2YXJpYWJsZXMKLSByZXF1aXJlIG9wZXJhdG9yLXN1cHBsaWVkIGNvbnNvbGUgYmFja2VuZCBvdmVycmlkZXMgdG8gYmUgY29tcGxldGUgZGlnZXN0IHJlZmVyZW5jZXMKLSBtYWtlIGR5bmFtaWMgUG9kIHNjaGVkdWxpbmcsIGltYWdlLXB1bGwsIHByb2JlLCByZXNvdXJjZSwgYW5kIHNjcmF0Y2gtdm9sdW1lIGNvbnRyb2xzIGNvbmZpZ3VyYWJsZQotIGZhaWwgc2FmZWx5IHdoZW4gZGlzYWJsaW5nIHRoZSBmZWF0dXJlIHdoaWxlIHByb3ZpZGVyLW93bmVkIFBvZHMgb3IgU2VjcmV0cyByZW1haW4sIGFuZCByZW1vdmUgdGhlIHJvbGUtb3duZWQgbm9WTkMgSW5ncmVzcyB3aGVuIGRpc2FibGUgaXMgc2FmZQoKVGhlIGZlYXR1cmUgcmVtYWlucyBkaXNhYmxlZCBieSBkZWZhdWx0LiBObyBpbWFnZSBjYXRhbG9nIGVudHJ5IG9yIGltYWdlIGJ1aWxkIGlucHV0IGlzIGNoYW5nZWQgYnkgdGhpcyBwdWxsIHJlcXVlc3QuCgojIyBXaHkgdGhlIG9yaWdpbmFsIGRlc2lnbiBpcyBpbnN1ZmZpY2llbnQKClRoZSBvcmlnaW5hbCBwcm92aWRlciBpbnRlZ3JhdGlvbiB3YXMgZnVuY3Rpb25hbCBidXQgZGlkIG5vdCBlc3RhYmxpc2ggYSBzYWZlIHByb2R1Y3Rpb24gY29udHJhY3Q6CgoxLiBEeW5hbWljIEJNQyBjcmVkZW50aWFsIFNlY3JldHMgYW5kIGNvbnNvbGUgUG9kcyBjb3VsZCBmYWxsIGJhY2sgdG8gdGhlIHNoYXJlZCBIZWxtIHJlbGVhc2UgbmFtZXNwYWNlLiBUaGUgY2hhcnQgbm93IHJlcXVpcmVzIGFuIGV4cGxpY2l0IG5hbWVzcGFjZTsgQXRtb3NwaGVyZSBjcmVhdGVzIGFuZCBzZWxlY3RzIGB7eyBpcm9uaWNfaGVsbV9yZWxlYXNlX25hbWVzcGFjZSB9fS1pcm9uaWMtdm5jYCBieSBkZWZhdWx0LgoyLiBUaGUgUkZCIE5ldHdvcmtQb2xpY3kgZXhpc3RlZCBidXQgdGhlIHJvbGUgZGlkIG5vdCBlbmFibGUgaXQsIGxlYXZpbmcgVENQLzU5MDAgcmVhY2hhYmxlIGFjY29yZGluZyB0byB0aGUgY2x1c3RlcidzIGFtYmllbnQgcG9saWN5LiBJdCBpcyBub3cgZW5hYmxlZCBieSBkZWZhdWx0IHdoZW5ldmVyIHRoZSBLdWJlcm5ldGVzIGNvbnNvbGUgcHJvdmlkZXIgaXMgZW5hYmxlZCwgd2l0aCBhbiBleHBsaWNpdCBvcHQtb3V0LgozLiBUaGUgbm9WTkMgaG9zdG5hbWUgaW5oZXJpdGVkIHRoZSBJcm9uaWMgQVBJIGhvc3RuYW1lLCBhbGxvd2luZyB0d28gSW5ncmVzc2VzIHRvIGNsYWltIHRoZSBzYW1lIGhvc3QgYW5kIHBhdGguIFRoZSBkZWZhdWx0IGlzIG5vdyBkZXJpdmVkIGFzIGEgZGlzdGluY3QgYGJhcmVtZXRhbC1jb25zb2xlYCBob3N0bmFtZSBhbmQgdGhlIHJvbGUgdmFsaWRhdGVzIGVuZHBvaW50IHNlcGFyYXRpb24uCjQuIFBvZCBleGlzdGVuY2UgZGlkIG5vdCBwcm92ZSB0aGF0IHRoZSBiYWNrZW5kIHdhcyBsaXN0ZW5pbmcuIFRoZSBnZW5lcmljIHRlbXBsYXRlIG5vdyBwcm92aWRlcyBUQ1Agc3RhcnR1cCBhbmQgcmVhZGluZXNzIHByb2JlcyBvbiB0aGUgUkZCIHBvcnQuCjUuIFByaXZhdGUgcmVnaXN0cmllcyBhbmQgdG9wb2xvZ3ktY29uc3RyYWluZWQgQk1DIG5ldHdvcmtzIGNvdWxkIG5vdCBiZSBleHByZXNzZWQuIEltYWdlIHB1bGwgc2VjcmV0cywgYW5ub3RhdGlvbnMsIG5vZGUgc2VsZWN0aW9uLCBhZmZpbml0eSwgdG9sZXJhdGlvbnMsIHRvcG9sb2d5IHNwcmVhZCwgcHJpb3JpdHkvcnVudGltZSBjbGFzc2VzLCByZXNvdXJjZXMsIGFuZCBzY3JhdGNoIHZvbHVtZXMgYXJlIG5vdyBjb25maWd1cmFibGUuCjYuIERpc2FibGluZyB0aGUgZmVhdHVyZSBvbmx5IHNraXBwZWQgdGhlIG5vVk5DIEluZ3Jlc3MgdGFzay4gVGhlIHJvbGUgbm93IHJlY29uY2lsZXMgdGhhdCBJbmdyZXNzIGFic2VudCBhbmQgcmVmdXNlcyBkaXNhYmxlIHdoaWxlIGxhYmVsbGVkIGR5bmFtaWMgUG9kcyBvciBTZWNyZXRzIHJlbWFpbi4KNy4gRGlnZXN0IHZhbGlkYXRpb24gcHJldmlvdXNseSBhY2NlcHRlZCBhbnkgc3RyaW5nIGNvbnRhaW5pbmcgYEBzaGEyNTY6YC4gSXQgbm93IHJlcXVpcmVzIGEgY29tcGxldGUgNjQtY2hhcmFjdGVyIGxvd2VyY2FzZSBTSEEtMjU2IHJlZmVyZW5jZSBmb3IgY29uc29sZSBiYWNrZW5kIGFuZCBvdmVycmlkZGVuIGJyb3dzZXItYXNzZXRzIGltYWdlcy4KOC4gVGhlIGNoZWNrZWQtaW4gY2hhcnQgYW5kIGl0cyBjb25zb2xpZGF0ZWQgdmVuZG9yIHBhdGNoIGNvdWxkIGRyaWZ0LiBUaGUgcGF0Y2ggaXMgcmVnZW5lcmF0ZWQgZnJvbSB0aGUgY2hhcnQgYmFzZWxpbmUgYW5kIHZlcmlmaWVkIHRvIHJlcHJvZHVjZSBgY2hhcnRzL2lyb25pY2AgYnl0ZS1mb3ItYnl0ZS4KClRoZSBOZXR3b3JrUG9saWN5IGlzIGRlbGliZXJhdGVseSBpbmdyZXNzLW9ubHkuIEl0IHBlcm1pdHMgdGhlIElyb25pYyBub1ZOQyBwcm94eSBQb2RzIHRvIGNvbm5lY3QgdG8gZHluYW1pYyBSRkIgUG9kczsgaXQgZG9lcyBub3QgZGVmaW5lIE9wZW5TdGFjayBjb25zb2xlIGF1dGhvcml6YXRpb24gb3IgbWFrZSBhIGNvbnNvbGUgcmVhZC1vbmx5LiBPcGVuU3RhY2svSXJvbmljIGF1dGhvcml6YXRpb24gcmVtYWlucyBhYm92ZSB0aGlzIEt1YmVybmV0ZXMgdHJhbnNwb3J0IGJvdW5kYXJ5LgoKIyMgU3RhY2sgYW5kIG93bmVyc2hpcAoKLSB0aGlzIGJyYW5jaCBpbmNvcnBvcmF0ZXMgYW5kIHN1cGVyc2VkZXMgdGhlIGZvY3VzZWQgSXJvbmljIG5vVk5DIGZvdW5kYXRpb24gZnJvbSAjMzgxMSBvbiBjdXJyZW50IGBtYWluYAotIGNoYXJ0IGltcGxlbWVudGF0aW9uOiBodHRwczovL3Jldmlldy5vcGVuZGV2Lm9yZy9jL29wZW5zdGFjay9vcGVuc3RhY2staGVsbS8rLzk5NzM0MAotIE9wZW5TdGFjay1IZWxtIG93bnMgdGhlIGRlcGxveWVyLW5ldXRyYWwgYGNvbnNvbGUubmFtZXNwYWNlYCB0ZW1wbGF0ZSBjb250cmFjdAotIEF0bW9zcGhlcmUgb3ducyBuYW1lc3BhY2UgY3JlYXRpb24vZGVmYXVsdGluZywgZW5kcG9pbnQgdmFsaWRhdGlvbiwgbGlmZWN5Y2xlIHJlY29uY2lsaWF0aW9uLCBhbmQgdmFsdWVzIG1hcHBpbmcKLSB1cHN0cmVhbSBJcm9uaWMgb3ducyBwcm92aWRlci1zaWRlIHdhaXQtZm9yLWxpc3RlbiBhbmQgcGFydGlhbC1hcHBseSBjbGVhbnVwOyB0aG9zZSBhcmUgbm90IGltcGxlbWVudGVkIGJ5IHRoaXMgUFIKCiMjIFZhbGlkYXRpb24KCi0gYGdpdCBkaWZmIC0tY2hlY2tgCi0gYGdvIHRlc3QgLi9yb2xlcy9pcm9uaWMvLi4uYAotIGBoZWxtIGxpbnQgY2hhcnRzL2lyb25pY2AKLSBIZWxtIDMgc3RyaWN0IHVuaXQgdGVzdHM6IDIgY29uc29sZSB0ZXN0cywgMiBwcmlvcml0eS1jbGFzcyB0ZXN0cywgYW5kIDIgcnVudGltZS1jbGFzcyB0ZXN0cyBwYXNzZWQKLSBkZWZhdWx0LWRpc2FibGVkIHJlbmRlciBjb250YWlucyBubyBjb25zb2xlIFBvZCB0ZW1wbGF0ZSwgY29uc29sZSBSQkFDLCBvciBjb25zb2xlIE5ldHdvcmtQb2xpY3kKLSBtaXNzaW5nIG5hbWVzcGFjZSBpcyByZWplY3RlZCB3aGVuIHRoZSBLdWJlcm5ldGVzIHByb3ZpZGVyIGlzIGVuYWJsZWQKLSBzZXBhcmF0ZS1uYW1lc3BhY2UgcmVuZGVyIHZlcmlmaWVzIFNlY3JldCwgUG9kLCBSb2xlLCBSb2xlQmluZGluZywgYW5kIE5ldHdvcmtQb2xpY3kgcGxhY2VtZW50IGFuZCB0aGUgYGFwcGxpY2F0aW9uPWlyb25pYyxjb21wb25lbnQ9bm92bmNwcm94eWAgc291cmNlIHNlbGVjdG9yCi0gY29uc29saWRhdGVkIElyb25pYyBjaGFydCBwYXRjaCBhcHBsaWVzIHRvIGl0cyByZWNvcmRlZCBiYXNlbGluZSBhbmQgcmVwcm9kdWNlcyB0aGUgY2hlY2tlZC1pbiBjaGFydCBieXRlLWZvci1ieXRlCi0gY2hhcnQgaW1hZ2UgdGFncywgQXRtb3NwaGVyZSBpbWFnZSBjYXRhbG9nIGlucHV0cywgYW5kIGltYWdlLWJ1aWxkIGlucHV0cyBhcmUgdW5jaGFuZ2VkCi0gYGFuc2libGUtbGludCByb2xlcy9pcm9uaWNgIHJlcG9ydHMgbm8gZmFpbHVyZXMgb3Igd2FybmluZ3MKClRoZSByZXBvc2l0b3J5LXdpZGUgR28gdGVzdCB3YXMgYWxzbyBydW4gbG9jYWxseS4gQ2hhbmdlZCBwYWNrYWdlcyBwYXNzZWQ7IHVucmVsYXRlZCBpbWFnZS1tYW5pZmVzdCB0ZXN0cyBhc3N1bWUgYSBMaW51eCB0YXJnZXQgYW5kIGZhaWwgb24gRGFyd2luL2FybTY0LCBhbmQgUHJvbWV0aGV1cyBydWxlIHRlc3RzIHJlcXVpcmUgYHByb210b29sYCwgd2hpY2ggd2FzIG5vdCBpbnN0YWxsZWQgb24gdGhlIHdvcmtzdGF0aW9uLiBDSSByZW1haW5zIGF1dGhvcml0YXRpdmUgZm9yIHRob3NlIHBsYXRmb3JtL3Rvb2wtZGVwZW5kZW50IHN1aXRlcy4KCg== patchset: cffe65e19d794abeeecfcb45d7084bca350520f3 pipeline: check playbook_context: playbook_projects: trusted/project_0/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 trusted/project_1/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: 1a6ce7475e62704e5dde6282210bb88276736841 trusted/project_2/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: c286bf94224b5660b8e49e9a058289e61062a9a0 untrusted/project_0/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: c286bf94224b5660b8e49e9a058289e61062a9a0 untrusted/project_1/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 untrusted/project_2/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: 1a6ce7475e62704e5dde6282210bb88276736841 untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs: canonical_name: github.com/vexxhost/atmosphere-zuul-jobs checkout: main commit: acb8e36a801f3b93fdd30dec43a15b6f8d809c2f untrusted/project_4/opendev.org/openstack/openstack-helm: canonical_name: opendev.org/openstack/openstack-helm checkout: master commit: 716a34de3df7f582dd9d7c985437be0d01a6b6bb playbooks: - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/run.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/playbook_0/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/playbook_0/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/playbook_0/role_2/zuul-jobs/roles post_playbooks: - path: untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs/playbooks/molecule/post.yml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/post_playbook_0/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_0/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_0/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_0/role_4/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_1/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_1/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_1/role_2/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post-logs.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_2/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_2/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_2/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_2/role_2/zuul-jobs/roles pre_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_0/role_2/zuul-jobs/roles - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_1/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_1/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_1/role_2/zuul-jobs/roles - path: untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs/playbooks/molecule/pre.yml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/pre_playbook_2/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_2/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_2/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_2/role_4/zuul-jobs/roles post_review: false post_timeout: null pre_timeout: null project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere projects: github.com/ansible-collections/ansible.netcommon: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.netcommon checkout: main checkout_description: zuul branch commit: 5575d804a11905f24f894aa1febf52ed1d460129 name: ansible-collections/ansible.netcommon required: true short_name: ansible.netcommon src_dir: src/github.com/ansible-collections/ansible.netcommon github.com/ansible-collections/ansible.posix: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.posix checkout: main checkout_description: zuul branch commit: ffdf9ef998bf7472cfab39c5950c5aea6c7ce67e name: ansible-collections/ansible.posix required: true short_name: ansible.posix src_dir: src/github.com/ansible-collections/ansible.posix github.com/ansible-collections/ansible.utils: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.utils checkout: main checkout_description: zuul branch commit: eb828fcea5d1edeba76cd8efee4f35520b7b8fb5 name: ansible-collections/ansible.utils required: true short_name: ansible.utils src_dir: src/github.com/ansible-collections/ansible.utils github.com/ansible-collections/community.crypto: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.crypto checkout: main checkout_description: zuul branch commit: 498036fcf0cd3f68ba1e3aea105549bfb7bba2bb name: ansible-collections/community.crypto required: true short_name: community.crypto src_dir: src/github.com/ansible-collections/community.crypto github.com/ansible-collections/community.general: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.general checkout: main checkout_description: zuul branch commit: b6b2ac718921982098a419f6079c5b9e7561ed38 name: ansible-collections/community.general required: true short_name: community.general src_dir: src/github.com/ansible-collections/community.general github.com/ansible-collections/community.mysql: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.mysql checkout: main checkout_description: zuul branch commit: 4cf7a3176fbd07be43459f1366e8066381df6d97 name: ansible-collections/community.mysql required: true short_name: community.mysql src_dir: src/github.com/ansible-collections/community.mysql github.com/ansible-collections/kubernetes.core: canonical_hostname: github.com canonical_name: github.com/ansible-collections/kubernetes.core checkout: main checkout_description: zuul branch commit: e475d0640342124b3704e6aa5328a0a52dbba9dc name: ansible-collections/kubernetes.core required: true short_name: kubernetes.core src_dir: src/github.com/ansible-collections/kubernetes.core github.com/vexxhost/ansible-collection-ceph: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-ceph checkout: main checkout_description: zuul branch commit: 8d8ff831249612545feaf9227dd87a7a8a825b01 name: vexxhost/ansible-collection-ceph required: true short_name: ansible-collection-ceph src_dir: src/github.com/vexxhost/ansible-collection-ceph github.com/vexxhost/ansible-collection-containers: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-containers checkout: main checkout_description: zuul branch commit: 76963d69387a491959dc44a985a5f25cc885a4f5 name: vexxhost/ansible-collection-containers required: true short_name: ansible-collection-containers src_dir: src/github.com/vexxhost/ansible-collection-containers github.com/vexxhost/ansible-collection-kubernetes: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes checkout: main checkout_description: zuul branch commit: 9610e7bf1e80f6a473e0c4833eedb97826945f11 name: vexxhost/ansible-collection-kubernetes required: true short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes github.com/vexxhost/atmosphere: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere checkout: main checkout_description: zuul branch commit: cffe65e19d794abeeecfcb45d7084bca350520f3 name: vexxhost/atmosphere required: false short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere github.com/vexxhost/atmosphere.common: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common checkout: main checkout_description: zuul branch commit: d00ec7f88fdc7ca2ce504a7e19c4049986cdac86 name: vexxhost/atmosphere.common required: true short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common opendev.org/openstack/ansible-collections-openstack: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/ansible-collections-openstack checkout: master checkout_description: project default branch commit: ee88cc15b87221ecabb474c7c3d0feaf6e01a7fa name: openstack/ansible-collections-openstack required: true short_name: ansible-collections-openstack src_dir: src/opendev.org/openstack/ansible-collections-openstack ref: refs/pull/4232/head resources: {} tenant: oss timeout: 1800 topic: null voting: true