all: children: controllers: hosts: controller: null zuul_unreachable: hosts: {} hosts: controller: ansible_connection: ssh ansible_host: 162.253.55.222 ansible_port: 22 ansible_python_interpreter: auto ansible_user: zuul ci: true cilium_helm_values: operator: replicas: 1 cilium_ipv4_cidr: 172.24.0.0/16 kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' kubernetes_version: 1.34.0 molecule_install_collection_siblings: true molecule_scenario: download-binaries nodepool: az: yul2 cloud: public external_id: 95a0dee2-7760-43d5-aa66-482f5db14004 host_id: 9c7fbe48649bc903922c42a38c50519602ff6769d9b91335dd9e8968 interface_ip: 162.253.55.222 label: debian-trixie node_properties: {} private_ipv4: 162.253.55.222 private_ipv6: null provider: yul1 public_ipv4: 162.253.55.222 public_ipv6: 2604:e100:1:0:f816:3eff:fe3d:805b region: ca-ymq-1 slot: null zuul_node: az: yul2 cloud: public external_id: 95a0dee2-7760-43d5-aa66-482f5db14004 host_id: 9c7fbe48649bc903922c42a38c50519602ff6769d9b91335dd9e8968 interface_ip: 162.253.55.222 label: debian-trixie node_properties: {} private_ipv4: 162.253.55.222 private_ipv6: null provider: yul1 public_ipv4: 162.253.55.222 public_ipv6: 2604:e100:1:0:f816:3eff:fe3d:805b region: ca-ymq-1 slot: null uuid: null vars: ci: true cilium_helm_values: operator: replicas: 1 kubernetes_version: 1.34.0 molecule_install_collection_siblings: true molecule_scenario: download-binaries zuul: _inheritance_path: - '' - '' - '' - '' - '' ansible_version: '9' attempts: 1 branch: main build: f1a86b830d2d490089cbcc79859c5b2f build_refs: - branch: main change: '306' change_message: "fix(kubernetes): stop disabling pod QoS cgroups\n\nBuilds on #307 and includes its commit until that merges.\n\n**Why the flags go**\n\nThe role started every kubelet with `--cgroups-per-qos=false` and `--enforce-node-allocatable=\"\"`, since Atmosphere's first commit. They come from a workaround in kubernetes/kubernetes#91023 ([comment](https://github.com/kubernetes/kubernetes/issues/91023#issuecomment-639072823)). On cgroup v1, pods with `Bidirectional` host-path mounts (CSI node plugins such as Ceph RBD) leaked cgroup mounts into the host. kubelet picked one of them as its cgroup root, and after a restart it crash looped with `failed to initialize top level QOS containers: root container [kubepods] doesn't exist`. Turning off QoS cgroups avoided needing that root.\n\nThat workaround isn't needed any more:\n\n- kubelet fixed the bug in 1.21 (kubernetes/kubernetes@de60340e5, for #95488: use the shortest mount point per subsystem), and this role only renders 1.22+ kubeadm configuration;\n- the bug is specific to cgroup v1, which kubelet refuses by default from 1.35 (`failCgroupV1: true`);\n- openstack-helm, whose libvirt chart Atmosphere uses, never set these flags. Its libvirt moves VMs into its own `osh-libvirt` cgroup outside the pod hierarchy.\n\nThe workaround now causes problems of its own. Without pod cgroups the kubelet uses a no-op pod cgroup manager, which in-place pod resize doesn't expect. After an upgrade to 1.33 the kubelet panics in `doPodResizeAction` (`Missing actuated resource record`); we hit this upgrading an Atmosphere deployment from 1.32 to 1.33. From 1.35 the resize feature can't be turned off.\n\n**This PR**\n\n- Drops both flags, so new nodes run with the kubelet defaults (QoS cgroups on, allocatable enforced on pods). kubeadm keeps each node's `kubeadm-flags.env` on upgrades (`WriteKubeletConfigFiles` only moves `container-runtime-endpoint` out of it), so existing nodes keep their flags and cgroup layout until they rejoin. Nothing changes under running pods.\n- Keeps `InPlacePodVerticalScaling: false` for 1.33 and 1.34 (`kubernetes_kubelet_managed_feature_gates`), since the kubelet configuration is shared with those existing nodes. From 1.35 the gate is GA and locked, so the override is dropped.\n- Adds `kubernetes_kubeadm_extra_args`, with `kubelet`, `etcd`, `apiServer`, `controllerManager` and `scheduler` keys merged on top of the role's arguments. The `kubeadm_args` filter leaves out arguments set to `null`, so an override can also remove one the role sets. Anyone who wants the old behaviour can set:\n\n ```yaml\n kubernetes_kubeadm_extra_args:\n \ kubelet:\n cgroups-per-qos: \"false\"\n enforce-node-allocatable: \"\"\n ```\n\n- Adds `kubernetes_kubelet_feature_gates` for kubelet feature gates, merged on top of the managed ones.\n- Runs `kubeadm init phase upload-config kubelet` before `kubeadm upgrade apply`. kubeadm writes each node's `/var/lib/kubelet/config.yaml` from the `kubelet-config` ConfigMap during upgrades, so the gate has to be there before the 1.33 kubelets start, and has to go again when moving to 1.35.\n\n**Validation**\n\n- Unit tests render the template with the role's defaults and vars: no QoS flags by default on 1.28 to 1.36, the gate on 1.33 and 1.34 only, overrides that add, change and remove arguments, overrides for some components only, and the filter's `null` handling.\n- Rendered through the Ansible `template` module and ran `kubeadm config validate` on the init and join documents: 1.36.2 with defaults, and 1.31.14 with the old kubelet flags restored through overrides and an API server argument removed. Both pass.\n- The `cluster-upgrade` Zuul job (1.33.4 \u2192 1.34.0) exercises the upload step.\n\nSplit out of the in-place upgrade work.\n" change_url: https://github.com/vexxhost/ansible-collection-kubernetes/pull/306 commit_id: ca5cb8bcea714f9de11b5b34ec7ae2730d816046 patchset: ca5cb8bcea714f9de11b5b34ec7ae2730d816046 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes name: vexxhost/ansible-collection-kubernetes short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes topic: null buildset: 0b8c8727d579426f9bd89c1e4f3a71c1 buildset_refs: - branch: main change: '306' change_message: "fix(kubernetes): stop disabling pod QoS cgroups\n\nBuilds on #307 and includes its commit until that merges.\n\n**Why the flags go**\n\nThe role started every kubelet with `--cgroups-per-qos=false` and `--enforce-node-allocatable=\"\"`, since Atmosphere's first commit. They come from a workaround in kubernetes/kubernetes#91023 ([comment](https://github.com/kubernetes/kubernetes/issues/91023#issuecomment-639072823)). On cgroup v1, pods with `Bidirectional` host-path mounts (CSI node plugins such as Ceph RBD) leaked cgroup mounts into the host. kubelet picked one of them as its cgroup root, and after a restart it crash looped with `failed to initialize top level QOS containers: root container [kubepods] doesn't exist`. Turning off QoS cgroups avoided needing that root.\n\nThat workaround isn't needed any more:\n\n- kubelet fixed the bug in 1.21 (kubernetes/kubernetes@de60340e5, for #95488: use the shortest mount point per subsystem), and this role only renders 1.22+ kubeadm configuration;\n- the bug is specific to cgroup v1, which kubelet refuses by default from 1.35 (`failCgroupV1: true`);\n- openstack-helm, whose libvirt chart Atmosphere uses, never set these flags. Its libvirt moves VMs into its own `osh-libvirt` cgroup outside the pod hierarchy.\n\nThe workaround now causes problems of its own. Without pod cgroups the kubelet uses a no-op pod cgroup manager, which in-place pod resize doesn't expect. After an upgrade to 1.33 the kubelet panics in `doPodResizeAction` (`Missing actuated resource record`); we hit this upgrading an Atmosphere deployment from 1.32 to 1.33. From 1.35 the resize feature can't be turned off.\n\n**This PR**\n\n- Drops both flags, so new nodes run with the kubelet defaults (QoS cgroups on, allocatable enforced on pods). kubeadm keeps each node's `kubeadm-flags.env` on upgrades (`WriteKubeletConfigFiles` only moves `container-runtime-endpoint` out of it), so existing nodes keep their flags and cgroup layout until they rejoin. Nothing changes under running pods.\n- Keeps `InPlacePodVerticalScaling: false` for 1.33 and 1.34 (`kubernetes_kubelet_managed_feature_gates`), since the kubelet configuration is shared with those existing nodes. From 1.35 the gate is GA and locked, so the override is dropped.\n- Adds `kubernetes_kubeadm_extra_args`, with `kubelet`, `etcd`, `apiServer`, `controllerManager` and `scheduler` keys merged on top of the role's arguments. The `kubeadm_args` filter leaves out arguments set to `null`, so an override can also remove one the role sets. Anyone who wants the old behaviour can set:\n\n ```yaml\n kubernetes_kubeadm_extra_args:\n \ kubelet:\n cgroups-per-qos: \"false\"\n enforce-node-allocatable: \"\"\n ```\n\n- Adds `kubernetes_kubelet_feature_gates` for kubelet feature gates, merged on top of the managed ones.\n- Runs `kubeadm init phase upload-config kubelet` before `kubeadm upgrade apply`. kubeadm writes each node's `/var/lib/kubelet/config.yaml` from the `kubelet-config` ConfigMap during upgrades, so the gate has to be there before the 1.33 kubelets start, and has to go again when moving to 1.35.\n\n**Validation**\n\n- Unit tests render the template with the role's defaults and vars: no QoS flags by default on 1.28 to 1.36, the gate on 1.33 and 1.34 only, overrides that add, change and remove arguments, overrides for some components only, and the filter's `null` handling.\n- Rendered through the Ansible `template` module and ran `kubeadm config validate` on the init and join documents: 1.36.2 with defaults, and 1.31.14 with the old kubelet flags restored through overrides and an API server argument removed. Both pass.\n- The `cluster-upgrade` Zuul job (1.33.4 \u2192 1.34.0) exercises the upload step.\n\nSplit out of the in-place upgrade work.\n" change_url: https://github.com/vexxhost/ansible-collection-kubernetes/pull/306 commit_id: ca5cb8bcea714f9de11b5b34ec7ae2730d816046 patchset: ca5cb8bcea714f9de11b5b34ec7ae2730d816046 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes name: vexxhost/ansible-collection-kubernetes short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes topic: null change: '306' change_message: "fix(kubernetes): stop disabling pod QoS cgroups\n\nBuilds on #307 and includes its commit until that merges.\n\n**Why the flags go**\n\nThe role started every kubelet with `--cgroups-per-qos=false` and `--enforce-node-allocatable=\"\"`, since Atmosphere's first commit. They come from a workaround in kubernetes/kubernetes#91023 ([comment](https://github.com/kubernetes/kubernetes/issues/91023#issuecomment-639072823)). On cgroup v1, pods with `Bidirectional` host-path mounts (CSI node plugins such as Ceph RBD) leaked cgroup mounts into the host. kubelet picked one of them as its cgroup root, and after a restart it crash looped with `failed to initialize top level QOS containers: root container [kubepods] doesn't exist`. Turning off QoS cgroups avoided needing that root.\n\nThat workaround isn't needed any more:\n\n- kubelet fixed the bug in 1.21 (kubernetes/kubernetes@de60340e5, for #95488: use the shortest mount point per subsystem), and this role only renders 1.22+ kubeadm configuration;\n- the bug is specific to cgroup v1, which kubelet refuses by default from 1.35 (`failCgroupV1: true`);\n- openstack-helm, whose libvirt chart Atmosphere uses, never set these flags. Its libvirt moves VMs into its own `osh-libvirt` cgroup outside the pod hierarchy.\n\nThe workaround now causes problems of its own. Without pod cgroups the kubelet uses a no-op pod cgroup manager, which in-place pod resize doesn't expect. After an upgrade to 1.33 the kubelet panics in `doPodResizeAction` (`Missing actuated resource record`); we hit this upgrading an Atmosphere deployment from 1.32 to 1.33. From 1.35 the resize feature can't be turned off.\n\n**This PR**\n\n- Drops both flags, so new nodes run with the kubelet defaults (QoS cgroups on, allocatable enforced on pods). kubeadm keeps each node's `kubeadm-flags.env` on upgrades (`WriteKubeletConfigFiles` only moves `container-runtime-endpoint` out of it), so existing nodes keep their flags and cgroup layout until they rejoin. Nothing changes under running pods.\n- Keeps `InPlacePodVerticalScaling: false` for 1.33 and 1.34 (`kubernetes_kubelet_managed_feature_gates`), since the kubelet configuration is shared with those existing nodes. From 1.35 the gate is GA and locked, so the override is dropped.\n- Adds `kubernetes_kubeadm_extra_args`, with `kubelet`, `etcd`, `apiServer`, `controllerManager` and `scheduler` keys merged on top of the role's arguments. The `kubeadm_args` filter leaves out arguments set to `null`, so an override can also remove one the role sets. Anyone who wants the old behaviour can set:\n\n ```yaml\n kubernetes_kubeadm_extra_args:\n \ kubelet:\n cgroups-per-qos: \"false\"\n enforce-node-allocatable: \"\"\n ```\n\n- Adds `kubernetes_kubelet_feature_gates` for kubelet feature gates, merged on top of the managed ones.\n- Runs `kubeadm init phase upload-config kubelet` before `kubeadm upgrade apply`. kubeadm writes each node's `/var/lib/kubelet/config.yaml` from the `kubelet-config` ConfigMap during upgrades, so the gate has to be there before the 1.33 kubelets start, and has to go again when moving to 1.35.\n\n**Validation**\n\n- Unit tests render the template with the role's defaults and vars: no QoS flags by default on 1.28 to 1.36, the gate on 1.33 and 1.34 only, overrides that add, change and remove arguments, overrides for some components only, and the filter's `null` handling.\n- Rendered through the Ansible `template` module and ran `kubeadm config validate` on the init and join documents: 1.36.2 with defaults, and 1.31.14 with the old kubelet flags restored through overrides and an API server argument removed. Both pass.\n- The `cluster-upgrade` Zuul job (1.33.4 \u2192 1.34.0) exercises the upload step.\n\nSplit out of the in-place upgrade work.\n" change_url: https://github.com/vexxhost/ansible-collection-kubernetes/pull/306 child_jobs: [] commit_id: ca5cb8bcea714f9de11b5b34ec7ae2730d816046 event_id: 7b9bf3f0-d22f-11f1-8ed4-e765f0f006c0 executor: hostname: 2d72f0692154 inventory_file: /var/lib/zuul/builds/f1a86b830d2d490089cbcc79859c5b2f/ansible/inventory.yaml log_root: /var/lib/zuul/builds/f1a86b830d2d490089cbcc79859c5b2f/work/logs result_data_file: /var/lib/zuul/builds/f1a86b830d2d490089cbcc79859c5b2f/work/results.json src_root: /var/lib/zuul/builds/f1a86b830d2d490089cbcc79859c5b2f/work/src work_root: /var/lib/zuul/builds/f1a86b830d2d490089cbcc79859c5b2f/work include_vars: [] items: - branch: main change: '306' change_message: "fix(kubernetes): stop disabling pod QoS cgroups\n\nBuilds on #307 and includes its commit until that merges.\n\n**Why the flags go**\n\nThe role started every kubelet with `--cgroups-per-qos=false` and `--enforce-node-allocatable=\"\"`, since Atmosphere's first commit. They come from a workaround in kubernetes/kubernetes#91023 ([comment](https://github.com/kubernetes/kubernetes/issues/91023#issuecomment-639072823)). On cgroup v1, pods with `Bidirectional` host-path mounts (CSI node plugins such as Ceph RBD) leaked cgroup mounts into the host. kubelet picked one of them as its cgroup root, and after a restart it crash looped with `failed to initialize top level QOS containers: root container [kubepods] doesn't exist`. Turning off QoS cgroups avoided needing that root.\n\nThat workaround isn't needed any more:\n\n- kubelet fixed the bug in 1.21 (kubernetes/kubernetes@de60340e5, for #95488: use the shortest mount point per subsystem), and this role only renders 1.22+ kubeadm configuration;\n- the bug is specific to cgroup v1, which kubelet refuses by default from 1.35 (`failCgroupV1: true`);\n- openstack-helm, whose libvirt chart Atmosphere uses, never set these flags. Its libvirt moves VMs into its own `osh-libvirt` cgroup outside the pod hierarchy.\n\nThe workaround now causes problems of its own. Without pod cgroups the kubelet uses a no-op pod cgroup manager, which in-place pod resize doesn't expect. After an upgrade to 1.33 the kubelet panics in `doPodResizeAction` (`Missing actuated resource record`); we hit this upgrading an Atmosphere deployment from 1.32 to 1.33. From 1.35 the resize feature can't be turned off.\n\n**This PR**\n\n- Drops both flags, so new nodes run with the kubelet defaults (QoS cgroups on, allocatable enforced on pods). kubeadm keeps each node's `kubeadm-flags.env` on upgrades (`WriteKubeletConfigFiles` only moves `container-runtime-endpoint` out of it), so existing nodes keep their flags and cgroup layout until they rejoin. Nothing changes under running pods.\n- Keeps `InPlacePodVerticalScaling: false` for 1.33 and 1.34 (`kubernetes_kubelet_managed_feature_gates`), since the kubelet configuration is shared with those existing nodes. From 1.35 the gate is GA and locked, so the override is dropped.\n- Adds `kubernetes_kubeadm_extra_args`, with `kubelet`, `etcd`, `apiServer`, `controllerManager` and `scheduler` keys merged on top of the role's arguments. The `kubeadm_args` filter leaves out arguments set to `null`, so an override can also remove one the role sets. Anyone who wants the old behaviour can set:\n\n ```yaml\n kubernetes_kubeadm_extra_args:\n \ kubelet:\n cgroups-per-qos: \"false\"\n enforce-node-allocatable: \"\"\n ```\n\n- Adds `kubernetes_kubelet_feature_gates` for kubelet feature gates, merged on top of the managed ones.\n- Runs `kubeadm init phase upload-config kubelet` before `kubeadm upgrade apply`. kubeadm writes each node's `/var/lib/kubelet/config.yaml` from the `kubelet-config` ConfigMap during upgrades, so the gate has to be there before the 1.33 kubelets start, and has to go again when moving to 1.35.\n\n**Validation**\n\n- Unit tests render the template with the role's defaults and vars: no QoS flags by default on 1.28 to 1.36, the gate on 1.33 and 1.34 only, overrides that add, change and remove arguments, overrides for some components only, and the filter's `null` handling.\n- Rendered through the Ansible `template` module and ran `kubeadm config validate` on the init and join documents: 1.36.2 with defaults, and 1.31.14 with the old kubelet flags restored through overrides and an API server argument removed. Both pass.\n- The `cluster-upgrade` Zuul job (1.33.4 \u2192 1.34.0) exercises the upload step.\n\nSplit out of the in-place upgrade work.\n" change_url: https://github.com/vexxhost/ansible-collection-kubernetes/pull/306 commit_id: ca5cb8bcea714f9de11b5b34ec7ae2730d816046 patchset: ca5cb8bcea714f9de11b5b34ec7ae2730d816046 project: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes name: vexxhost/ansible-collection-kubernetes short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes topic: null job: ansible-collection-kubernetes-molecule-download-binaries jobtags: [] max_attempts: 3 message: Zml4KGt1YmVybmV0ZXMpOiBzdG9wIGRpc2FibGluZyBwb2QgUW9TIGNncm91cHMKCkJ1aWxkcyBvbiAjMzA3IGFuZCBpbmNsdWRlcyBpdHMgY29tbWl0IHVudGlsIHRoYXQgbWVyZ2VzLgoKKipXaHkgdGhlIGZsYWdzIGdvKioKClRoZSByb2xlIHN0YXJ0ZWQgZXZlcnkga3ViZWxldCB3aXRoIGAtLWNncm91cHMtcGVyLXFvcz1mYWxzZWAgYW5kIGAtLWVuZm9yY2Utbm9kZS1hbGxvY2F0YWJsZT0iImAsIHNpbmNlIEF0bW9zcGhlcmUncyBmaXJzdCBjb21taXQuIFRoZXkgY29tZSBmcm9tIGEgd29ya2Fyb3VuZCBpbiBrdWJlcm5ldGVzL2t1YmVybmV0ZXMjOTEwMjMgKFtjb21tZW50XShodHRwczovL2dpdGh1Yi5jb20va3ViZXJuZXRlcy9rdWJlcm5ldGVzL2lzc3Vlcy85MTAyMyNpc3N1ZWNvbW1lbnQtNjM5MDcyODIzKSkuIE9uIGNncm91cCB2MSwgcG9kcyB3aXRoIGBCaWRpcmVjdGlvbmFsYCBob3N0LXBhdGggbW91bnRzIChDU0kgbm9kZSBwbHVnaW5zIHN1Y2ggYXMgQ2VwaCBSQkQpIGxlYWtlZCBjZ3JvdXAgbW91bnRzIGludG8gdGhlIGhvc3QuIGt1YmVsZXQgcGlja2VkIG9uZSBvZiB0aGVtIGFzIGl0cyBjZ3JvdXAgcm9vdCwgYW5kIGFmdGVyIGEgcmVzdGFydCBpdCBjcmFzaCBsb29wZWQgd2l0aCBgZmFpbGVkIHRvIGluaXRpYWxpemUgdG9wIGxldmVsIFFPUyBjb250YWluZXJzOiByb290IGNvbnRhaW5lciBba3ViZXBvZHNdIGRvZXNuJ3QgZXhpc3RgLiBUdXJuaW5nIG9mZiBRb1MgY2dyb3VwcyBhdm9pZGVkIG5lZWRpbmcgdGhhdCByb290LgoKVGhhdCB3b3JrYXJvdW5kIGlzbid0IG5lZWRlZCBhbnkgbW9yZToKCi0ga3ViZWxldCBmaXhlZCB0aGUgYnVnIGluIDEuMjEgKGt1YmVybmV0ZXMva3ViZXJuZXRlc0BkZTYwMzQwZTUsIGZvciAjOTU0ODg6IHVzZSB0aGUgc2hvcnRlc3QgbW91bnQgcG9pbnQgcGVyIHN1YnN5c3RlbSksIGFuZCB0aGlzIHJvbGUgb25seSByZW5kZXJzIDEuMjIrIGt1YmVhZG0gY29uZmlndXJhdGlvbjsKLSB0aGUgYnVnIGlzIHNwZWNpZmljIHRvIGNncm91cCB2MSwgd2hpY2gga3ViZWxldCByZWZ1c2VzIGJ5IGRlZmF1bHQgZnJvbSAxLjM1IChgZmFpbENncm91cFYxOiB0cnVlYCk7Ci0gb3BlbnN0YWNrLWhlbG0sIHdob3NlIGxpYnZpcnQgY2hhcnQgQXRtb3NwaGVyZSB1c2VzLCBuZXZlciBzZXQgdGhlc2UgZmxhZ3MuIEl0cyBsaWJ2aXJ0IG1vdmVzIFZNcyBpbnRvIGl0cyBvd24gYG9zaC1saWJ2aXJ0YCBjZ3JvdXAgb3V0c2lkZSB0aGUgcG9kIGhpZXJhcmNoeS4KClRoZSB3b3JrYXJvdW5kIG5vdyBjYXVzZXMgcHJvYmxlbXMgb2YgaXRzIG93bi4gV2l0aG91dCBwb2QgY2dyb3VwcyB0aGUga3ViZWxldCB1c2VzIGEgbm8tb3AgcG9kIGNncm91cCBtYW5hZ2VyLCB3aGljaCBpbi1wbGFjZSBwb2QgcmVzaXplIGRvZXNuJ3QgZXhwZWN0LiBBZnRlciBhbiB1cGdyYWRlIHRvIDEuMzMgdGhlIGt1YmVsZXQgcGFuaWNzIGluIGBkb1BvZFJlc2l6ZUFjdGlvbmAgKGBNaXNzaW5nIGFjdHVhdGVkIHJlc291cmNlIHJlY29yZGApOyB3ZSBoaXQgdGhpcyB1cGdyYWRpbmcgYW4gQXRtb3NwaGVyZSBkZXBsb3ltZW50IGZyb20gMS4zMiB0byAxLjMzLiBGcm9tIDEuMzUgdGhlIHJlc2l6ZSBmZWF0dXJlIGNhbid0IGJlIHR1cm5lZCBvZmYuCgoqKlRoaXMgUFIqKgoKLSBEcm9wcyBib3RoIGZsYWdzLCBzbyBuZXcgbm9kZXMgcnVuIHdpdGggdGhlIGt1YmVsZXQgZGVmYXVsdHMgKFFvUyBjZ3JvdXBzIG9uLCBhbGxvY2F0YWJsZSBlbmZvcmNlZCBvbiBwb2RzKS4ga3ViZWFkbSBrZWVwcyBlYWNoIG5vZGUncyBga3ViZWFkbS1mbGFncy5lbnZgIG9uIHVwZ3JhZGVzIChgV3JpdGVLdWJlbGV0Q29uZmlnRmlsZXNgIG9ubHkgbW92ZXMgYGNvbnRhaW5lci1ydW50aW1lLWVuZHBvaW50YCBvdXQgb2YgaXQpLCBzbyBleGlzdGluZyBub2RlcyBrZWVwIHRoZWlyIGZsYWdzIGFuZCBjZ3JvdXAgbGF5b3V0IHVudGlsIHRoZXkgcmVqb2luLiBOb3RoaW5nIGNoYW5nZXMgdW5kZXIgcnVubmluZyBwb2RzLgotIEtlZXBzIGBJblBsYWNlUG9kVmVydGljYWxTY2FsaW5nOiBmYWxzZWAgZm9yIDEuMzMgYW5kIDEuMzQgKGBrdWJlcm5ldGVzX2t1YmVsZXRfbWFuYWdlZF9mZWF0dXJlX2dhdGVzYCksIHNpbmNlIHRoZSBrdWJlbGV0IGNvbmZpZ3VyYXRpb24gaXMgc2hhcmVkIHdpdGggdGhvc2UgZXhpc3Rpbmcgbm9kZXMuIEZyb20gMS4zNSB0aGUgZ2F0ZSBpcyBHQSBhbmQgbG9ja2VkLCBzbyB0aGUgb3ZlcnJpZGUgaXMgZHJvcHBlZC4KLSBBZGRzIGBrdWJlcm5ldGVzX2t1YmVhZG1fZXh0cmFfYXJnc2AsIHdpdGggYGt1YmVsZXRgLCBgZXRjZGAsIGBhcGlTZXJ2ZXJgLCBgY29udHJvbGxlck1hbmFnZXJgIGFuZCBgc2NoZWR1bGVyYCBrZXlzIG1lcmdlZCBvbiB0b3Agb2YgdGhlIHJvbGUncyBhcmd1bWVudHMuIFRoZSBga3ViZWFkbV9hcmdzYCBmaWx0ZXIgbGVhdmVzIG91dCBhcmd1bWVudHMgc2V0IHRvIGBudWxsYCwgc28gYW4gb3ZlcnJpZGUgY2FuIGFsc28gcmVtb3ZlIG9uZSB0aGUgcm9sZSBzZXRzLiBBbnlvbmUgd2hvIHdhbnRzIHRoZSBvbGQgYmVoYXZpb3VyIGNhbiBzZXQ6CgogIGBgYHlhbWwKICBrdWJlcm5ldGVzX2t1YmVhZG1fZXh0cmFfYXJnczoKICAgIGt1YmVsZXQ6CiAgICAgIGNncm91cHMtcGVyLXFvczogImZhbHNlIgogICAgICBlbmZvcmNlLW5vZGUtYWxsb2NhdGFibGU6ICIiCiAgYGBgCgotIEFkZHMgYGt1YmVybmV0ZXNfa3ViZWxldF9mZWF0dXJlX2dhdGVzYCBmb3Iga3ViZWxldCBmZWF0dXJlIGdhdGVzLCBtZXJnZWQgb24gdG9wIG9mIHRoZSBtYW5hZ2VkIG9uZXMuCi0gUnVucyBga3ViZWFkbSBpbml0IHBoYXNlIHVwbG9hZC1jb25maWcga3ViZWxldGAgYmVmb3JlIGBrdWJlYWRtIHVwZ3JhZGUgYXBwbHlgLiBrdWJlYWRtIHdyaXRlcyBlYWNoIG5vZGUncyBgL3Zhci9saWIva3ViZWxldC9jb25maWcueWFtbGAgZnJvbSB0aGUgYGt1YmVsZXQtY29uZmlnYCBDb25maWdNYXAgZHVyaW5nIHVwZ3JhZGVzLCBzbyB0aGUgZ2F0ZSBoYXMgdG8gYmUgdGhlcmUgYmVmb3JlIHRoZSAxLjMzIGt1YmVsZXRzIHN0YXJ0LCBhbmQgaGFzIHRvIGdvIGFnYWluIHdoZW4gbW92aW5nIHRvIDEuMzUuCgoqKlZhbGlkYXRpb24qKgoKLSBVbml0IHRlc3RzIHJlbmRlciB0aGUgdGVtcGxhdGUgd2l0aCB0aGUgcm9sZSdzIGRlZmF1bHRzIGFuZCB2YXJzOiBubyBRb1MgZmxhZ3MgYnkgZGVmYXVsdCBvbiAxLjI4IHRvIDEuMzYsIHRoZSBnYXRlIG9uIDEuMzMgYW5kIDEuMzQgb25seSwgb3ZlcnJpZGVzIHRoYXQgYWRkLCBjaGFuZ2UgYW5kIHJlbW92ZSBhcmd1bWVudHMsIG92ZXJyaWRlcyBmb3Igc29tZSBjb21wb25lbnRzIG9ubHksIGFuZCB0aGUgZmlsdGVyJ3MgYG51bGxgIGhhbmRsaW5nLgotIFJlbmRlcmVkIHRocm91Z2ggdGhlIEFuc2libGUgYHRlbXBsYXRlYCBtb2R1bGUgYW5kIHJhbiBga3ViZWFkbSBjb25maWcgdmFsaWRhdGVgIG9uIHRoZSBpbml0IGFuZCBqb2luIGRvY3VtZW50czogMS4zNi4yIHdpdGggZGVmYXVsdHMsIGFuZCAxLjMxLjE0IHdpdGggdGhlIG9sZCBrdWJlbGV0IGZsYWdzIHJlc3RvcmVkIHRocm91Z2ggb3ZlcnJpZGVzIGFuZCBhbiBBUEkgc2VydmVyIGFyZ3VtZW50IHJlbW92ZWQuIEJvdGggcGFzcy4KLSBUaGUgYGNsdXN0ZXItdXBncmFkZWAgWnV1bCBqb2IgKDEuMzMuNCDihpIgMS4zNC4wKSBleGVyY2lzZXMgdGhlIHVwbG9hZCBzdGVwLgoKU3BsaXQgb3V0IG9mIHRoZSBpbi1wbGFjZSB1cGdyYWRlIHdvcmsuCg== patchset: ca5cb8bcea714f9de11b5b34ec7ae2730d816046 pipeline: check playbook_context: playbook_projects: trusted/project_0/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 trusted/project_1/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: be52461cd48abccbf95b13a58b2551ac673d8ad7 trusted/project_2/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: 4fd48825891421af0774bdd500fee36e111d80a6 untrusted/project_0/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: 4fd48825891421af0774bdd500fee36e111d80a6 untrusted/project_1/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 untrusted/project_2/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: be52461cd48abccbf95b13a58b2551ac673d8ad7 untrusted/project_3/github.com/vexxhost/ansible-collection-kubernetes: canonical_name: github.com/vexxhost/ansible-collection-kubernetes checkout: main commit: d6e3456c2a6db0ea3c8524d72c35f445da8d8fe4 untrusted/project_4/opendev.org/openstack/openstack-helm: canonical_name: opendev.org/openstack/openstack-helm checkout: master commit: 3307478d82183ff8d297f2edcd718ad0bd65c4dd playbooks: - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/run.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/playbook_0/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/playbook_0/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/playbook_0/role_2/zuul-jobs/roles post_playbooks: - path: untrusted/project_3/github.com/vexxhost/ansible-collection-kubernetes/test-playbooks/molecule/post.yml roles: - checkout: main checkout_description: playbook branch link_name: ansible/post_playbook_0/role_0/collection-kubernetes link_target: untrusted/project_3/github.com/vexxhost/ansible-collection-kubernetes role_path: ansible/post_playbook_0/role_0/collection-kubernetes/roles - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/post_playbook_0/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_0/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_0/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_0/role_4/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_1/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_1/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_1/role_2/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post-logs.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_2/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_2/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_2/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_2/role_2/zuul-jobs/roles pre_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_0/role_2/zuul-jobs/roles - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_1/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_1/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_1/role_2/zuul-jobs/roles - path: untrusted/project_3/github.com/vexxhost/ansible-collection-kubernetes/test-playbooks/molecule/pre.yml roles: - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_2/role_0/collection-kubernetes link_target: untrusted/project_3/github.com/vexxhost/ansible-collection-kubernetes role_path: ansible/pre_playbook_2/role_0/collection-kubernetes/roles - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/pre_playbook_2/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_2/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_2/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_2/role_4/zuul-jobs/roles post_review: false post_timeout: null pre_timeout: null project: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes name: vexxhost/ansible-collection-kubernetes short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes projects: github.com/ansible-collections/ansible.posix: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.posix checkout: main checkout_description: zuul branch commit: 0f4453f85ee993687a4cab860e3b55438144f920 name: ansible-collections/ansible.posix required: true short_name: ansible.posix src_dir: src/github.com/ansible-collections/ansible.posix github.com/ansible-collections/community.crypto: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.crypto checkout: main checkout_description: zuul branch commit: 1bdefe5f420bb2d38cf92ea109ca39e1d4372347 name: ansible-collections/community.crypto required: true short_name: community.crypto src_dir: src/github.com/ansible-collections/community.crypto github.com/ansible-collections/community.general: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.general checkout: main checkout_description: zuul branch commit: 11d8912ad2b4da193a5f92f7131c69eeca7e9667 name: ansible-collections/community.general required: true short_name: community.general src_dir: src/github.com/ansible-collections/community.general github.com/ansible-collections/community.library_inventory_filtering: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.library_inventory_filtering checkout: stable-1 checkout_description: project default branch commit: 90cd245b3acbab4089041f36c5e83dd8081eae4e name: ansible-collections/community.library_inventory_filtering required: true short_name: community.library_inventory_filtering src_dir: src/github.com/ansible-collections/community.library_inventory_filtering github.com/ansible-collections/kubernetes.core: canonical_hostname: github.com canonical_name: github.com/ansible-collections/kubernetes.core checkout: main checkout_description: zuul branch commit: 782672d2fdb0004d593440a3ddd4b9db014d9e4b name: ansible-collections/kubernetes.core required: true short_name: kubernetes.core src_dir: src/github.com/ansible-collections/kubernetes.core github.com/vexxhost/ansible-collection-containers: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-containers checkout: main checkout_description: zuul branch commit: d22923ebd40c0fd5a345318c1db90d125fb5140f name: vexxhost/ansible-collection-containers required: true short_name: ansible-collection-containers src_dir: src/github.com/vexxhost/ansible-collection-containers github.com/vexxhost/ansible-collection-kubernetes: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes checkout: main checkout_description: zuul branch commit: d6e3456c2a6db0ea3c8524d72c35f445da8d8fe4 name: vexxhost/ansible-collection-kubernetes required: false short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes ref: refs/pull/306/head resources: {} tenant: oss timeout: 1800 topic: null voting: true