all: children: controllers: hosts: controller: null zuul_unreachable: hosts: {} hosts: controller: ansible_connection: ssh ansible_host: 199.19.213.83 ansible_port: 22 ansible_python_interpreter: auto ansible_user: zuul cilium_helm_values: operator: replicas: 1 cilium_ipv4_cidr: 172.24.0.0/16 kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' kubernetes_version: 1.34.0 molecule_scenario: helm nodepool: az: nova cloud: public external_id: 5d435af8-2e54-4e88-aecb-8d6375515a83 host_id: 7cb77d063530dedbf6983b78a36ec607482cf1d282610499e8bd9357 interface_ip: 199.19.213.83 label: debian-trixie node_properties: {} private_ipv4: 199.19.213.83 private_ipv6: null provider: yul1 public_ipv4: 199.19.213.83 public_ipv6: 2604:e100:1:0:f816:3eff:fe10:5d98 region: ca-ymq-1 slot: null zuul_node: az: nova cloud: public external_id: 5d435af8-2e54-4e88-aecb-8d6375515a83 host_id: 7cb77d063530dedbf6983b78a36ec607482cf1d282610499e8bd9357 interface_ip: 199.19.213.83 label: debian-trixie node_properties: {} private_ipv4: 199.19.213.83 private_ipv6: null provider: yul1 public_ipv4: 199.19.213.83 public_ipv6: 2604:e100:1:0:f816:3eff:fe10:5d98 region: ca-ymq-1 slot: null uuid: null vars: cilium_helm_values: operator: replicas: 1 kubernetes_version: 1.34.0 molecule_scenario: helm zuul: _inheritance_path: - '' - '' - '' - '' - '' ansible_version: '9' attempts: 1 branch: main build: fae7593ad814455799df8a4b39fea3b9 build_refs: - branch: main change: '238' change_message: "feat: add Envoy Gateway role as ingress-nginx replacement\n\n## Summary\n\nReplace ingress-nginx (being archived March 2026) with **Envoy Gateway** as the ingress controller.\n\n### Why Envoy Gateway?\n\n- **CNCF multi-org governance** (Envoy Core, Tetrate, SAP, Ambassador Labs, Tencent) \u2014 no single-vendor risk\n- **Purpose-built for Gateway API** \u2014 native support, not bolted on\n- **DaemonSet + hostNetwork** supported for bare-metal deployments\n- **Available now** \u2014 v1.7.0, production-ready\n\n### Alternatives evaluated\n\n| Candidate | Verdict |\n|-----------|---------|\n| **Cilium** | Dual-port hostNetwork broken until unreleased 1.19.2; couples CNI + ingress blast radius |\n| **Contour** | Broadcom governance risk after VMware acquisition |\n| **Traefik** | Single-company (Traefik Labs) governance risk |\n\n### What's included\n\n- `roles/envoy_gateway/` \u2014 Full Ansible role following `cert_manager` patterns:\n - Vendored Helm chart v1.7.0 via `chart-vendor` with per-role `.charts.yml`\n - `defaults/main.yml` \u2014 Configurable images, namespace, Helm values override\n - `vars/main.yml` \u2014 Internal Helm values using `docker_image` filter\n - `meta/main.yml` \u2014 `upload_helm_chart` dependency\n - `tasks/main.yml` \u2014 Deploy via `kubernetes.core.helm`\n- `renovate.json` \u2014 Ignore vendored chart files\n- Design spec and implementation plan in `docs/superpowers/`\n\n### Migration strategy\n\nSkip legacy Ingress entirely \u2014 go straight to Gateway API resources. Downstream consumers (e.g., Atmosphere) will create `Gateway`, `HTTPRoute`, `TCPRoute`, `BackendTrafficPolicy`, and `SecurityPolicy` resources directly." change_url: https://github.com/vexxhost/ansible-collection-kubernetes/pull/238 commit_id: 2860004b6d97a8199932954793270e3bea3e215a patchset: 2860004b6d97a8199932954793270e3bea3e215a project: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes name: vexxhost/ansible-collection-kubernetes short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes topic: null buildset: d26b5c52fd314b5fadba6b6539c494a9 buildset_refs: - branch: main change: '238' change_message: "feat: add Envoy Gateway role as ingress-nginx replacement\n\n## Summary\n\nReplace ingress-nginx (being archived March 2026) with **Envoy Gateway** as the ingress controller.\n\n### Why Envoy Gateway?\n\n- **CNCF multi-org governance** (Envoy Core, Tetrate, SAP, Ambassador Labs, Tencent) \u2014 no single-vendor risk\n- **Purpose-built for Gateway API** \u2014 native support, not bolted on\n- **DaemonSet + hostNetwork** supported for bare-metal deployments\n- **Available now** \u2014 v1.7.0, production-ready\n\n### Alternatives evaluated\n\n| Candidate | Verdict |\n|-----------|---------|\n| **Cilium** | Dual-port hostNetwork broken until unreleased 1.19.2; couples CNI + ingress blast radius |\n| **Contour** | Broadcom governance risk after VMware acquisition |\n| **Traefik** | Single-company (Traefik Labs) governance risk |\n\n### What's included\n\n- `roles/envoy_gateway/` \u2014 Full Ansible role following `cert_manager` patterns:\n - Vendored Helm chart v1.7.0 via `chart-vendor` with per-role `.charts.yml`\n - `defaults/main.yml` \u2014 Configurable images, namespace, Helm values override\n - `vars/main.yml` \u2014 Internal Helm values using `docker_image` filter\n - `meta/main.yml` \u2014 `upload_helm_chart` dependency\n - `tasks/main.yml` \u2014 Deploy via `kubernetes.core.helm`\n- `renovate.json` \u2014 Ignore vendored chart files\n- Design spec and implementation plan in `docs/superpowers/`\n\n### Migration strategy\n\nSkip legacy Ingress entirely \u2014 go straight to Gateway API resources. Downstream consumers (e.g., Atmosphere) will create `Gateway`, `HTTPRoute`, `TCPRoute`, `BackendTrafficPolicy`, and `SecurityPolicy` resources directly." change_url: https://github.com/vexxhost/ansible-collection-kubernetes/pull/238 commit_id: 2860004b6d97a8199932954793270e3bea3e215a patchset: 2860004b6d97a8199932954793270e3bea3e215a project: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes name: vexxhost/ansible-collection-kubernetes short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes topic: null change: '238' change_message: "feat: add Envoy Gateway role as ingress-nginx replacement\n\n## Summary\n\nReplace ingress-nginx (being archived March 2026) with **Envoy Gateway** as the ingress controller.\n\n### Why Envoy Gateway?\n\n- **CNCF multi-org governance** (Envoy Core, Tetrate, SAP, Ambassador Labs, Tencent) \u2014 no single-vendor risk\n- **Purpose-built for Gateway API** \u2014 native support, not bolted on\n- **DaemonSet + hostNetwork** supported for bare-metal deployments\n- **Available now** \u2014 v1.7.0, production-ready\n\n### Alternatives evaluated\n\n| Candidate | Verdict |\n|-----------|---------|\n| **Cilium** | Dual-port hostNetwork broken until unreleased 1.19.2; couples CNI + ingress blast radius |\n| **Contour** | Broadcom governance risk after VMware acquisition |\n| **Traefik** | Single-company (Traefik Labs) governance risk |\n\n### What's included\n\n- `roles/envoy_gateway/` \u2014 Full Ansible role following `cert_manager` patterns:\n - Vendored Helm chart v1.7.0 via `chart-vendor` with per-role `.charts.yml`\n - `defaults/main.yml` \u2014 Configurable images, namespace, Helm values override\n - `vars/main.yml` \u2014 Internal Helm values using `docker_image` filter\n - `meta/main.yml` \u2014 `upload_helm_chart` dependency\n - `tasks/main.yml` \u2014 Deploy via `kubernetes.core.helm`\n- `renovate.json` \u2014 Ignore vendored chart files\n- Design spec and implementation plan in `docs/superpowers/`\n\n### Migration strategy\n\nSkip legacy Ingress entirely \u2014 go straight to Gateway API resources. Downstream consumers (e.g., Atmosphere) will create `Gateway`, `HTTPRoute`, `TCPRoute`, `BackendTrafficPolicy`, and `SecurityPolicy` resources directly." change_url: https://github.com/vexxhost/ansible-collection-kubernetes/pull/238 child_jobs: [] commit_id: 2860004b6d97a8199932954793270e3bea3e215a event_id: 99ded8b0-2207-11f1-8026-f2420cbb33b9 executor: hostname: 0a8996d2b663 inventory_file: /var/lib/zuul/builds/fae7593ad814455799df8a4b39fea3b9/ansible/inventory.yaml log_root: /var/lib/zuul/builds/fae7593ad814455799df8a4b39fea3b9/work/logs result_data_file: /var/lib/zuul/builds/fae7593ad814455799df8a4b39fea3b9/work/results.json src_root: /var/lib/zuul/builds/fae7593ad814455799df8a4b39fea3b9/work/src work_root: /var/lib/zuul/builds/fae7593ad814455799df8a4b39fea3b9/work include_vars: [] items: - branch: main change: '238' change_message: "feat: add Envoy Gateway role as ingress-nginx replacement\n\n## Summary\n\nReplace ingress-nginx (being archived March 2026) with **Envoy Gateway** as the ingress controller.\n\n### Why Envoy Gateway?\n\n- **CNCF multi-org governance** (Envoy Core, Tetrate, SAP, Ambassador Labs, Tencent) \u2014 no single-vendor risk\n- **Purpose-built for Gateway API** \u2014 native support, not bolted on\n- **DaemonSet + hostNetwork** supported for bare-metal deployments\n- **Available now** \u2014 v1.7.0, production-ready\n\n### Alternatives evaluated\n\n| Candidate | Verdict |\n|-----------|---------|\n| **Cilium** | Dual-port hostNetwork broken until unreleased 1.19.2; couples CNI + ingress blast radius |\n| **Contour** | Broadcom governance risk after VMware acquisition |\n| **Traefik** | Single-company (Traefik Labs) governance risk |\n\n### What's included\n\n- `roles/envoy_gateway/` \u2014 Full Ansible role following `cert_manager` patterns:\n - Vendored Helm chart v1.7.0 via `chart-vendor` with per-role `.charts.yml`\n - `defaults/main.yml` \u2014 Configurable images, namespace, Helm values override\n - `vars/main.yml` \u2014 Internal Helm values using `docker_image` filter\n - `meta/main.yml` \u2014 `upload_helm_chart` dependency\n - `tasks/main.yml` \u2014 Deploy via `kubernetes.core.helm`\n- `renovate.json` \u2014 Ignore vendored chart files\n- Design spec and implementation plan in `docs/superpowers/`\n\n### Migration strategy\n\nSkip legacy Ingress entirely \u2014 go straight to Gateway API resources. Downstream consumers (e.g., Atmosphere) will create `Gateway`, `HTTPRoute`, `TCPRoute`, `BackendTrafficPolicy`, and `SecurityPolicy` resources directly." change_url: https://github.com/vexxhost/ansible-collection-kubernetes/pull/238 commit_id: 2860004b6d97a8199932954793270e3bea3e215a patchset: 2860004b6d97a8199932954793270e3bea3e215a project: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes name: vexxhost/ansible-collection-kubernetes short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes topic: null job: ansible-collection-kubernetes-molecule-helm jobtags: [] max_attempts: 3 message: ZmVhdDogYWRkIEVudm95IEdhdGV3YXkgcm9sZSBhcyBpbmdyZXNzLW5naW54IHJlcGxhY2VtZW50CgojIyBTdW1tYXJ5CgpSZXBsYWNlIGluZ3Jlc3MtbmdpbnggKGJlaW5nIGFyY2hpdmVkIE1hcmNoIDIwMjYpIHdpdGggKipFbnZveSBHYXRld2F5KiogYXMgdGhlIGluZ3Jlc3MgY29udHJvbGxlci4KCiMjIyBXaHkgRW52b3kgR2F0ZXdheT8KCi0gKipDTkNGIG11bHRpLW9yZyBnb3Zlcm5hbmNlKiogKEVudm95IENvcmUsIFRldHJhdGUsIFNBUCwgQW1iYXNzYWRvciBMYWJzLCBUZW5jZW50KSDigJQgbm8gc2luZ2xlLXZlbmRvciByaXNrCi0gKipQdXJwb3NlLWJ1aWx0IGZvciBHYXRld2F5IEFQSSoqIOKAlCBuYXRpdmUgc3VwcG9ydCwgbm90IGJvbHRlZCBvbgotICoqRGFlbW9uU2V0ICsgaG9zdE5ldHdvcmsqKiBzdXBwb3J0ZWQgZm9yIGJhcmUtbWV0YWwgZGVwbG95bWVudHMKLSAqKkF2YWlsYWJsZSBub3cqKiDigJQgdjEuNy4wLCBwcm9kdWN0aW9uLXJlYWR5CgojIyMgQWx0ZXJuYXRpdmVzIGV2YWx1YXRlZAoKfCBDYW5kaWRhdGUgfCBWZXJkaWN0IHwKfC0tLS0tLS0tLS0tfC0tLS0tLS0tLXwKfCAqKkNpbGl1bSoqIHwgRHVhbC1wb3J0IGhvc3ROZXR3b3JrIGJyb2tlbiB1bnRpbCB1bnJlbGVhc2VkIDEuMTkuMjsgY291cGxlcyBDTkkgKyBpbmdyZXNzIGJsYXN0IHJhZGl1cyB8CnwgKipDb250b3VyKiogfCBCcm9hZGNvbSBnb3Zlcm5hbmNlIHJpc2sgYWZ0ZXIgVk13YXJlIGFjcXVpc2l0aW9uIHwKfCAqKlRyYWVmaWsqKiB8IFNpbmdsZS1jb21wYW55IChUcmFlZmlrIExhYnMpIGdvdmVybmFuY2UgcmlzayB8CgojIyMgV2hhdCdzIGluY2x1ZGVkCgotIGByb2xlcy9lbnZveV9nYXRld2F5L2Ag4oCUIEZ1bGwgQW5zaWJsZSByb2xlIGZvbGxvd2luZyBgY2VydF9tYW5hZ2VyYCBwYXR0ZXJuczoKICAtIFZlbmRvcmVkIEhlbG0gY2hhcnQgdjEuNy4wIHZpYSBgY2hhcnQtdmVuZG9yYCB3aXRoIHBlci1yb2xlIGAuY2hhcnRzLnltbGAKICAtIGBkZWZhdWx0cy9tYWluLnltbGAg4oCUIENvbmZpZ3VyYWJsZSBpbWFnZXMsIG5hbWVzcGFjZSwgSGVsbSB2YWx1ZXMgb3ZlcnJpZGUKICAtIGB2YXJzL21haW4ueW1sYCDigJQgSW50ZXJuYWwgSGVsbSB2YWx1ZXMgdXNpbmcgYGRvY2tlcl9pbWFnZWAgZmlsdGVyCiAgLSBgbWV0YS9tYWluLnltbGAg4oCUIGB1cGxvYWRfaGVsbV9jaGFydGAgZGVwZW5kZW5jeQogIC0gYHRhc2tzL21haW4ueW1sYCDigJQgRGVwbG95IHZpYSBga3ViZXJuZXRlcy5jb3JlLmhlbG1gCi0gYHJlbm92YXRlLmpzb25gIOKAlCBJZ25vcmUgdmVuZG9yZWQgY2hhcnQgZmlsZXMKLSBEZXNpZ24gc3BlYyBhbmQgaW1wbGVtZW50YXRpb24gcGxhbiBpbiBgZG9jcy9zdXBlcnBvd2Vycy9gCgojIyMgTWlncmF0aW9uIHN0cmF0ZWd5CgpTa2lwIGxlZ2FjeSBJbmdyZXNzIGVudGlyZWx5IOKAlCBnbyBzdHJhaWdodCB0byBHYXRld2F5IEFQSSByZXNvdXJjZXMuIERvd25zdHJlYW0gY29uc3VtZXJzIChlLmcuLCBBdG1vc3BoZXJlKSB3aWxsIGNyZWF0ZSBgR2F0ZXdheWAsIGBIVFRQUm91dGVgLCBgVENQUm91dGVgLCBgQmFja2VuZFRyYWZmaWNQb2xpY3lgLCBhbmQgYFNlY3VyaXR5UG9saWN5YCByZXNvdXJjZXMgZGlyZWN0bHku patchset: 2860004b6d97a8199932954793270e3bea3e215a pipeline: check playbook_context: playbook_projects: trusted/project_0/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 9052b5a7781b3346e4cffd452a54448cbff54d8b trusted/project_1/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: c75fe6ef19c05b98349573c971950c51bbf24758 trusted/project_2/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: a6e68243e02ef030ce5e75f8b67630880c475f33 untrusted/project_0/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: a6e68243e02ef030ce5e75f8b67630880c475f33 untrusted/project_1/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 9052b5a7781b3346e4cffd452a54448cbff54d8b untrusted/project_2/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: c75fe6ef19c05b98349573c971950c51bbf24758 playbooks: - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/run.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/playbook_0/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/playbook_0/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/playbook_0/role_2/zuul-jobs/roles post_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_0/role_2/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post-logs.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_1/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_1/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_1/role_2/zuul-jobs/roles pre_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_0/role_2/zuul-jobs/roles - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_1/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_1/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_1/role_2/zuul-jobs/roles post_review: false post_timeout: null pre_timeout: null project: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes name: vexxhost/ansible-collection-kubernetes short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes projects: github.com/vexxhost/ansible-collection-kubernetes: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes checkout: main checkout_description: zuul branch commit: c03c5b932ab6f21af68e958dedffda32c0f0fc1e name: vexxhost/ansible-collection-kubernetes required: false short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes ref: refs/pull/238/head resources: {} tenant: oss timeout: 1800 topic: null voting: true