all: children: cephs: hosts: instance: null computes: hosts: instance: null controllers: hosts: instance: null zuul_unreachable: hosts: {} hosts: instance: ansible_connection: ssh ansible_host: 162.253.55.203 ansible_port: 22 ansible_python_interpreter: auto ansible_user: zuul atmosphere_image_prefix: harbor.atmosphere.dev/ ceph_conf_overrides: - option: mon allow pool size one section: global value: true - option: osd crush chooseleaf type section: global value: 0 - option: auth allow insecure global id reclaim section: mon value: false ceph_csi_rbd_helm_values: provisioner: replicaCount: 1 ceph_fsid: 4837cbf8-4f90-4300-b3f6-726c9b9f89b4 ceph_osd_devices: - /dev/ceph-{{ inventory_hostname_short }}-osd0/data - /dev/ceph-{{ inventory_hostname_short }}-osd1/data - /dev/ceph-{{ inventory_hostname_short }}-osd2/data cilium_helm_values: operator: replicas: 1 csi_driver: rbd kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' molecule_install_collection_siblings: true molecule_scenario: csi nodepool: az: yul2 cloud: public external_id: f85d4fed-8517-406f-9969-87948aa57f7f host_id: 3aaffb858bb2c3ecb415b6377d81f83abeda3a6d147209e6ae2e5ccc interface_ip: 162.253.55.203 label: ubuntu-jammy node_properties: {} private_ipv4: 162.253.55.203 private_ipv6: null provider: yul1 public_ipv4: 162.253.55.203 public_ipv6: 2604:e100:1:0:f816:3eff:fe48:7a45 region: ca-ymq-1 slot: null zuul_node: az: yul2 cloud: public external_id: f85d4fed-8517-406f-9969-87948aa57f7f host_id: 3aaffb858bb2c3ecb415b6377d81f83abeda3a6d147209e6ae2e5ccc interface_ip: 162.253.55.203 label: ubuntu-jammy node_properties: {} private_ipv4: 162.253.55.203 private_ipv6: null provider: yul1 public_ipv4: 162.253.55.203 public_ipv6: 2604:e100:1:0:f816:3eff:fe48:7a45 region: ca-ymq-1 slot: null uuid: null vars: atmosphere_image_prefix: harbor.atmosphere.dev/ ceph_conf_overrides: - option: mon allow pool size one section: global value: true - option: osd crush chooseleaf type section: global value: 0 - option: auth allow insecure global id reclaim section: mon value: false ceph_csi_rbd_helm_values: provisioner: replicaCount: 1 ceph_fsid: 4837cbf8-4f90-4300-b3f6-726c9b9f89b4 ceph_osd_devices: - /dev/ceph-{{ inventory_hostname_short }}-osd0/data - /dev/ceph-{{ inventory_hostname_short }}-osd1/data - /dev/ceph-{{ inventory_hostname_short }}-osd2/data cilium_helm_values: operator: replicas: 1 csi_driver: rbd kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' molecule_install_collection_siblings: true molecule_scenario: csi zuul: _inheritance_path: - '' - '' - '' - '' - '' - '' ansible_version: '9' attempts: 1 branch: main build: ea19a83084c44f4ab785fc05ae9b29b2 build_refs: - branch: main change: '4232' change_message: 'feat(ironic): complete Kubernetes console provider support ## Summary - complete the Ironic Kubernetes VNC console provider integration - stage noVNC browser assets without modifying application JavaScript at runtime - provide the dynamic console Pod/Secret template, dedicated-namespace RBAC, and an enabled-by-default RFB NetworkPolicy when the feature is selected - install `kubectl` in conductor Pods when the Kubernetes provider is enabled - expose a distinct noVNC endpoint and role configuration through Atmosphere variables - require operator-supplied console backend overrides to be complete digest references - make dynamic Pod scheduling, image-pull, probe, resource, and scratch-volume controls configurable - fail safely when disabling the feature while provider-owned Pods or Secrets remain, and remove the role-owned noVNC Ingress when disable is safe The feature remains disabled by default. No image catalog entry or image build input is changed by this pull request. ## Why the original design is insufficient The original provider integration was functional but did not establish a safe production contract: 1. Dynamic BMC credential Secrets and console Pods could fall back to the shared Helm release namespace. The chart now requires an explicit namespace; Atmosphere creates and selects `{{ ironic_helm_release_namespace }}-ironic-vnc` by default. 2. The RFB NetworkPolicy existed but the role did not enable it, leaving TCP/5900 reachable according to the cluster''s ambient policy. It is now enabled by default whenever the Kubernetes console provider is enabled, with an explicit opt-out. 3. The noVNC hostname inherited the Ironic API hostname, allowing two Ingresses to claim the same host and path. The default is now derived as a distinct `baremetal-console` hostname and the role validates endpoint separation. 4. Pod existence did not prove that the backend was listening. The generic template now provides TCP startup and readiness probes on the RFB port. 5. Private registries and topology-constrained BMC networks could not be expressed. Image pull secrets, annotations, node selection, affinity, tolerations, topology spread, priority/runtime classes, resources, and scratch volumes are now configurable. 6. Disabling the feature only skipped the noVNC Ingress task. The role now reconciles that Ingress absent and refuses disable while labelled dynamic Pods or Secrets remain. 7. Digest validation previously accepted any string containing `@sha256:`. It now requires a complete 64-character lowercase SHA-256 reference for console backend and overridden browser-assets images. 8. The checked-in chart and its consolidated vendor patch could drift. The patch is regenerated from the chart baseline and verified to reproduce `charts/ironic` byte-for-byte. The NetworkPolicy is deliberately ingress-only. It permits the Ironic noVNC proxy Pods to connect to dynamic RFB Pods; it does not define OpenStack console authorization or make a console read-only. OpenStack/Ironic authorization remains above this Kubernetes transport boundary. ## Stack and ownership - this branch incorporates and supersedes the focused Ironic noVNC foundation from #3811 on current `main` - chart implementation: https://review.opendev.org/c/openstack/openstack-helm/+/997340 - OpenStack-Helm owns the deployer-neutral `console.namespace` template contract - Atmosphere owns namespace creation/defaulting, endpoint validation, lifecycle reconciliation, and values mapping - upstream Ironic owns provider-side wait-for-listen and partial-apply cleanup; those are not implemented by this PR ## Validation - `git diff --check` - `go test ./roles/ironic/...` - `helm lint charts/ironic` - Helm 3 strict unit tests: 2 console tests, 2 priority-class tests, and 2 runtime-class tests passed - default-disabled render contains no console Pod template, console RBAC, or console NetworkPolicy - missing namespace is rejected when the Kubernetes provider is enabled - separate-namespace render verifies Secret, Pod, Role, RoleBinding, and NetworkPolicy placement and the `application=ironic,component=novncproxy` source selector - consolidated Ironic chart patch applies to its recorded baseline and reproduces the checked-in chart byte-for-byte - chart image tags, Atmosphere image catalog inputs, and image-build inputs are unchanged - `ansible-lint roles/ironic` reports no failures or warnings The repository-wide Go test was also run locally. Changed packages passed; unrelated image-manifest tests assume a Linux target and fail on Darwin/arm64, and Prometheus rule tests require `promtool`, which was not installed on the workstation. CI remains authoritative for those platform/tool-dependent suites. ' change_url: https://github.com/vexxhost/atmosphere/pull/4232 commit_id: 656520fd009d448cbee486405728263237f3afff patchset: 656520fd009d448cbee486405728263237f3afff project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null buildset: 3963d40c86b24c84a55a79bace02d866 buildset_refs: - branch: main change: '4232' change_message: 'feat(ironic): complete Kubernetes console provider support ## Summary - complete the Ironic Kubernetes VNC console provider integration - stage noVNC browser assets without modifying application JavaScript at runtime - provide the dynamic console Pod/Secret template, dedicated-namespace RBAC, and an enabled-by-default RFB NetworkPolicy when the feature is selected - install `kubectl` in conductor Pods when the Kubernetes provider is enabled - expose a distinct noVNC endpoint and role configuration through Atmosphere variables - require operator-supplied console backend overrides to be complete digest references - make dynamic Pod scheduling, image-pull, probe, resource, and scratch-volume controls configurable - fail safely when disabling the feature while provider-owned Pods or Secrets remain, and remove the role-owned noVNC Ingress when disable is safe The feature remains disabled by default. No image catalog entry or image build input is changed by this pull request. ## Why the original design is insufficient The original provider integration was functional but did not establish a safe production contract: 1. Dynamic BMC credential Secrets and console Pods could fall back to the shared Helm release namespace. The chart now requires an explicit namespace; Atmosphere creates and selects `{{ ironic_helm_release_namespace }}-ironic-vnc` by default. 2. The RFB NetworkPolicy existed but the role did not enable it, leaving TCP/5900 reachable according to the cluster''s ambient policy. It is now enabled by default whenever the Kubernetes console provider is enabled, with an explicit opt-out. 3. The noVNC hostname inherited the Ironic API hostname, allowing two Ingresses to claim the same host and path. The default is now derived as a distinct `baremetal-console` hostname and the role validates endpoint separation. 4. Pod existence did not prove that the backend was listening. The generic template now provides TCP startup and readiness probes on the RFB port. 5. Private registries and topology-constrained BMC networks could not be expressed. Image pull secrets, annotations, node selection, affinity, tolerations, topology spread, priority/runtime classes, resources, and scratch volumes are now configurable. 6. Disabling the feature only skipped the noVNC Ingress task. The role now reconciles that Ingress absent and refuses disable while labelled dynamic Pods or Secrets remain. 7. Digest validation previously accepted any string containing `@sha256:`. It now requires a complete 64-character lowercase SHA-256 reference for console backend and overridden browser-assets images. 8. The checked-in chart and its consolidated vendor patch could drift. The patch is regenerated from the chart baseline and verified to reproduce `charts/ironic` byte-for-byte. The NetworkPolicy is deliberately ingress-only. It permits the Ironic noVNC proxy Pods to connect to dynamic RFB Pods; it does not define OpenStack console authorization or make a console read-only. OpenStack/Ironic authorization remains above this Kubernetes transport boundary. ## Stack and ownership - this branch incorporates and supersedes the focused Ironic noVNC foundation from #3811 on current `main` - chart implementation: https://review.opendev.org/c/openstack/openstack-helm/+/997340 - OpenStack-Helm owns the deployer-neutral `console.namespace` template contract - Atmosphere owns namespace creation/defaulting, endpoint validation, lifecycle reconciliation, and values mapping - upstream Ironic owns provider-side wait-for-listen and partial-apply cleanup; those are not implemented by this PR ## Validation - `git diff --check` - `go test ./roles/ironic/...` - `helm lint charts/ironic` - Helm 3 strict unit tests: 2 console tests, 2 priority-class tests, and 2 runtime-class tests passed - default-disabled render contains no console Pod template, console RBAC, or console NetworkPolicy - missing namespace is rejected when the Kubernetes provider is enabled - separate-namespace render verifies Secret, Pod, Role, RoleBinding, and NetworkPolicy placement and the `application=ironic,component=novncproxy` source selector - consolidated Ironic chart patch applies to its recorded baseline and reproduces the checked-in chart byte-for-byte - chart image tags, Atmosphere image catalog inputs, and image-build inputs are unchanged - `ansible-lint roles/ironic` reports no failures or warnings The repository-wide Go test was also run locally. Changed packages passed; unrelated image-manifest tests assume a Linux target and fail on Darwin/arm64, and Prometheus rule tests require `promtool`, which was not installed on the workstation. CI remains authoritative for those platform/tool-dependent suites. ' change_url: https://github.com/vexxhost/atmosphere/pull/4232 commit_id: 656520fd009d448cbee486405728263237f3afff patchset: 656520fd009d448cbee486405728263237f3afff project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null change: '4232' change_message: 'feat(ironic): complete Kubernetes console provider support ## Summary - complete the Ironic Kubernetes VNC console provider integration - stage noVNC browser assets without modifying application JavaScript at runtime - provide the dynamic console Pod/Secret template, dedicated-namespace RBAC, and an enabled-by-default RFB NetworkPolicy when the feature is selected - install `kubectl` in conductor Pods when the Kubernetes provider is enabled - expose a distinct noVNC endpoint and role configuration through Atmosphere variables - require operator-supplied console backend overrides to be complete digest references - make dynamic Pod scheduling, image-pull, probe, resource, and scratch-volume controls configurable - fail safely when disabling the feature while provider-owned Pods or Secrets remain, and remove the role-owned noVNC Ingress when disable is safe The feature remains disabled by default. No image catalog entry or image build input is changed by this pull request. ## Why the original design is insufficient The original provider integration was functional but did not establish a safe production contract: 1. Dynamic BMC credential Secrets and console Pods could fall back to the shared Helm release namespace. The chart now requires an explicit namespace; Atmosphere creates and selects `{{ ironic_helm_release_namespace }}-ironic-vnc` by default. 2. The RFB NetworkPolicy existed but the role did not enable it, leaving TCP/5900 reachable according to the cluster''s ambient policy. It is now enabled by default whenever the Kubernetes console provider is enabled, with an explicit opt-out. 3. The noVNC hostname inherited the Ironic API hostname, allowing two Ingresses to claim the same host and path. The default is now derived as a distinct `baremetal-console` hostname and the role validates endpoint separation. 4. Pod existence did not prove that the backend was listening. The generic template now provides TCP startup and readiness probes on the RFB port. 5. Private registries and topology-constrained BMC networks could not be expressed. Image pull secrets, annotations, node selection, affinity, tolerations, topology spread, priority/runtime classes, resources, and scratch volumes are now configurable. 6. Disabling the feature only skipped the noVNC Ingress task. The role now reconciles that Ingress absent and refuses disable while labelled dynamic Pods or Secrets remain. 7. Digest validation previously accepted any string containing `@sha256:`. It now requires a complete 64-character lowercase SHA-256 reference for console backend and overridden browser-assets images. 8. The checked-in chart and its consolidated vendor patch could drift. The patch is regenerated from the chart baseline and verified to reproduce `charts/ironic` byte-for-byte. The NetworkPolicy is deliberately ingress-only. It permits the Ironic noVNC proxy Pods to connect to dynamic RFB Pods; it does not define OpenStack console authorization or make a console read-only. OpenStack/Ironic authorization remains above this Kubernetes transport boundary. ## Stack and ownership - this branch incorporates and supersedes the focused Ironic noVNC foundation from #3811 on current `main` - chart implementation: https://review.opendev.org/c/openstack/openstack-helm/+/997340 - OpenStack-Helm owns the deployer-neutral `console.namespace` template contract - Atmosphere owns namespace creation/defaulting, endpoint validation, lifecycle reconciliation, and values mapping - upstream Ironic owns provider-side wait-for-listen and partial-apply cleanup; those are not implemented by this PR ## Validation - `git diff --check` - `go test ./roles/ironic/...` - `helm lint charts/ironic` - Helm 3 strict unit tests: 2 console tests, 2 priority-class tests, and 2 runtime-class tests passed - default-disabled render contains no console Pod template, console RBAC, or console NetworkPolicy - missing namespace is rejected when the Kubernetes provider is enabled - separate-namespace render verifies Secret, Pod, Role, RoleBinding, and NetworkPolicy placement and the `application=ironic,component=novncproxy` source selector - consolidated Ironic chart patch applies to its recorded baseline and reproduces the checked-in chart byte-for-byte - chart image tags, Atmosphere image catalog inputs, and image-build inputs are unchanged - `ansible-lint roles/ironic` reports no failures or warnings The repository-wide Go test was also run locally. Changed packages passed; unrelated image-manifest tests assume a Linux target and fail on Darwin/arm64, and Prometheus rule tests require `promtool`, which was not installed on the workstation. CI remains authoritative for those platform/tool-dependent suites. ' change_url: https://github.com/vexxhost/atmosphere/pull/4232 child_jobs: [] commit_id: 656520fd009d448cbee486405728263237f3afff event_id: a2620de0-b0aa-11f1-8d40-98aa680c1fbb executor: hostname: 2d72f0692154 inventory_file: /var/lib/zuul/builds/ea19a83084c44f4ab785fc05ae9b29b2/ansible/inventory.yaml log_root: /var/lib/zuul/builds/ea19a83084c44f4ab785fc05ae9b29b2/work/logs result_data_file: /var/lib/zuul/builds/ea19a83084c44f4ab785fc05ae9b29b2/work/results.json src_root: /var/lib/zuul/builds/ea19a83084c44f4ab785fc05ae9b29b2/work/src work_root: /var/lib/zuul/builds/ea19a83084c44f4ab785fc05ae9b29b2/work include_vars: [] items: - branch: main change: '4232' change_message: 'feat(ironic): complete Kubernetes console provider support ## Summary - complete the Ironic Kubernetes VNC console provider integration - stage noVNC browser assets without modifying application JavaScript at runtime - provide the dynamic console Pod/Secret template, dedicated-namespace RBAC, and an enabled-by-default RFB NetworkPolicy when the feature is selected - install `kubectl` in conductor Pods when the Kubernetes provider is enabled - expose a distinct noVNC endpoint and role configuration through Atmosphere variables - require operator-supplied console backend overrides to be complete digest references - make dynamic Pod scheduling, image-pull, probe, resource, and scratch-volume controls configurable - fail safely when disabling the feature while provider-owned Pods or Secrets remain, and remove the role-owned noVNC Ingress when disable is safe The feature remains disabled by default. No image catalog entry or image build input is changed by this pull request. ## Why the original design is insufficient The original provider integration was functional but did not establish a safe production contract: 1. Dynamic BMC credential Secrets and console Pods could fall back to the shared Helm release namespace. The chart now requires an explicit namespace; Atmosphere creates and selects `{{ ironic_helm_release_namespace }}-ironic-vnc` by default. 2. The RFB NetworkPolicy existed but the role did not enable it, leaving TCP/5900 reachable according to the cluster''s ambient policy. It is now enabled by default whenever the Kubernetes console provider is enabled, with an explicit opt-out. 3. The noVNC hostname inherited the Ironic API hostname, allowing two Ingresses to claim the same host and path. The default is now derived as a distinct `baremetal-console` hostname and the role validates endpoint separation. 4. Pod existence did not prove that the backend was listening. The generic template now provides TCP startup and readiness probes on the RFB port. 5. Private registries and topology-constrained BMC networks could not be expressed. Image pull secrets, annotations, node selection, affinity, tolerations, topology spread, priority/runtime classes, resources, and scratch volumes are now configurable. 6. Disabling the feature only skipped the noVNC Ingress task. The role now reconciles that Ingress absent and refuses disable while labelled dynamic Pods or Secrets remain. 7. Digest validation previously accepted any string containing `@sha256:`. It now requires a complete 64-character lowercase SHA-256 reference for console backend and overridden browser-assets images. 8. The checked-in chart and its consolidated vendor patch could drift. The patch is regenerated from the chart baseline and verified to reproduce `charts/ironic` byte-for-byte. The NetworkPolicy is deliberately ingress-only. It permits the Ironic noVNC proxy Pods to connect to dynamic RFB Pods; it does not define OpenStack console authorization or make a console read-only. OpenStack/Ironic authorization remains above this Kubernetes transport boundary. ## Stack and ownership - this branch incorporates and supersedes the focused Ironic noVNC foundation from #3811 on current `main` - chart implementation: https://review.opendev.org/c/openstack/openstack-helm/+/997340 - OpenStack-Helm owns the deployer-neutral `console.namespace` template contract - Atmosphere owns namespace creation/defaulting, endpoint validation, lifecycle reconciliation, and values mapping - upstream Ironic owns provider-side wait-for-listen and partial-apply cleanup; those are not implemented by this PR ## Validation - `git diff --check` - `go test ./roles/ironic/...` - `helm lint charts/ironic` - Helm 3 strict unit tests: 2 console tests, 2 priority-class tests, and 2 runtime-class tests passed - default-disabled render contains no console Pod template, console RBAC, or console NetworkPolicy - missing namespace is rejected when the Kubernetes provider is enabled - separate-namespace render verifies Secret, Pod, Role, RoleBinding, and NetworkPolicy placement and the `application=ironic,component=novncproxy` source selector - consolidated Ironic chart patch applies to its recorded baseline and reproduces the checked-in chart byte-for-byte - chart image tags, Atmosphere image catalog inputs, and image-build inputs are unchanged - `ansible-lint roles/ironic` reports no failures or warnings The repository-wide Go test was also run locally. Changed packages passed; unrelated image-manifest tests assume a Linux target and fail on Darwin/arm64, and Prometheus rule tests require `promtool`, which was not installed on the workstation. CI remains authoritative for those platform/tool-dependent suites. ' change_url: https://github.com/vexxhost/atmosphere/pull/4232 commit_id: 656520fd009d448cbee486405728263237f3afff patchset: 656520fd009d448cbee486405728263237f3afff project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere topic: null job: atmosphere-molecule-csi-rbd jobtags: [] max_attempts: 3 message: ZmVhdChpcm9uaWMpOiBjb21wbGV0ZSBLdWJlcm5ldGVzIGNvbnNvbGUgcHJvdmlkZXIgc3VwcG9ydAoKIyMgU3VtbWFyeQoKLSBjb21wbGV0ZSB0aGUgSXJvbmljIEt1YmVybmV0ZXMgVk5DIGNvbnNvbGUgcHJvdmlkZXIgaW50ZWdyYXRpb24KLSBzdGFnZSBub1ZOQyBicm93c2VyIGFzc2V0cyB3aXRob3V0IG1vZGlmeWluZyBhcHBsaWNhdGlvbiBKYXZhU2NyaXB0IGF0IHJ1bnRpbWUKLSBwcm92aWRlIHRoZSBkeW5hbWljIGNvbnNvbGUgUG9kL1NlY3JldCB0ZW1wbGF0ZSwgZGVkaWNhdGVkLW5hbWVzcGFjZSBSQkFDLCBhbmQgYW4gZW5hYmxlZC1ieS1kZWZhdWx0IFJGQiBOZXR3b3JrUG9saWN5IHdoZW4gdGhlIGZlYXR1cmUgaXMgc2VsZWN0ZWQKLSBpbnN0YWxsIGBrdWJlY3RsYCBpbiBjb25kdWN0b3IgUG9kcyB3aGVuIHRoZSBLdWJlcm5ldGVzIHByb3ZpZGVyIGlzIGVuYWJsZWQKLSBleHBvc2UgYSBkaXN0aW5jdCBub1ZOQyBlbmRwb2ludCBhbmQgcm9sZSBjb25maWd1cmF0aW9uIHRocm91Z2ggQXRtb3NwaGVyZSB2YXJpYWJsZXMKLSByZXF1aXJlIG9wZXJhdG9yLXN1cHBsaWVkIGNvbnNvbGUgYmFja2VuZCBvdmVycmlkZXMgdG8gYmUgY29tcGxldGUgZGlnZXN0IHJlZmVyZW5jZXMKLSBtYWtlIGR5bmFtaWMgUG9kIHNjaGVkdWxpbmcsIGltYWdlLXB1bGwsIHByb2JlLCByZXNvdXJjZSwgYW5kIHNjcmF0Y2gtdm9sdW1lIGNvbnRyb2xzIGNvbmZpZ3VyYWJsZQotIGZhaWwgc2FmZWx5IHdoZW4gZGlzYWJsaW5nIHRoZSBmZWF0dXJlIHdoaWxlIHByb3ZpZGVyLW93bmVkIFBvZHMgb3IgU2VjcmV0cyByZW1haW4sIGFuZCByZW1vdmUgdGhlIHJvbGUtb3duZWQgbm9WTkMgSW5ncmVzcyB3aGVuIGRpc2FibGUgaXMgc2FmZQoKVGhlIGZlYXR1cmUgcmVtYWlucyBkaXNhYmxlZCBieSBkZWZhdWx0LiBObyBpbWFnZSBjYXRhbG9nIGVudHJ5IG9yIGltYWdlIGJ1aWxkIGlucHV0IGlzIGNoYW5nZWQgYnkgdGhpcyBwdWxsIHJlcXVlc3QuCgojIyBXaHkgdGhlIG9yaWdpbmFsIGRlc2lnbiBpcyBpbnN1ZmZpY2llbnQKClRoZSBvcmlnaW5hbCBwcm92aWRlciBpbnRlZ3JhdGlvbiB3YXMgZnVuY3Rpb25hbCBidXQgZGlkIG5vdCBlc3RhYmxpc2ggYSBzYWZlIHByb2R1Y3Rpb24gY29udHJhY3Q6CgoxLiBEeW5hbWljIEJNQyBjcmVkZW50aWFsIFNlY3JldHMgYW5kIGNvbnNvbGUgUG9kcyBjb3VsZCBmYWxsIGJhY2sgdG8gdGhlIHNoYXJlZCBIZWxtIHJlbGVhc2UgbmFtZXNwYWNlLiBUaGUgY2hhcnQgbm93IHJlcXVpcmVzIGFuIGV4cGxpY2l0IG5hbWVzcGFjZTsgQXRtb3NwaGVyZSBjcmVhdGVzIGFuZCBzZWxlY3RzIGB7eyBpcm9uaWNfaGVsbV9yZWxlYXNlX25hbWVzcGFjZSB9fS1pcm9uaWMtdm5jYCBieSBkZWZhdWx0LgoyLiBUaGUgUkZCIE5ldHdvcmtQb2xpY3kgZXhpc3RlZCBidXQgdGhlIHJvbGUgZGlkIG5vdCBlbmFibGUgaXQsIGxlYXZpbmcgVENQLzU5MDAgcmVhY2hhYmxlIGFjY29yZGluZyB0byB0aGUgY2x1c3RlcidzIGFtYmllbnQgcG9saWN5LiBJdCBpcyBub3cgZW5hYmxlZCBieSBkZWZhdWx0IHdoZW5ldmVyIHRoZSBLdWJlcm5ldGVzIGNvbnNvbGUgcHJvdmlkZXIgaXMgZW5hYmxlZCwgd2l0aCBhbiBleHBsaWNpdCBvcHQtb3V0LgozLiBUaGUgbm9WTkMgaG9zdG5hbWUgaW5oZXJpdGVkIHRoZSBJcm9uaWMgQVBJIGhvc3RuYW1lLCBhbGxvd2luZyB0d28gSW5ncmVzc2VzIHRvIGNsYWltIHRoZSBzYW1lIGhvc3QgYW5kIHBhdGguIFRoZSBkZWZhdWx0IGlzIG5vdyBkZXJpdmVkIGFzIGEgZGlzdGluY3QgYGJhcmVtZXRhbC1jb25zb2xlYCBob3N0bmFtZSBhbmQgdGhlIHJvbGUgdmFsaWRhdGVzIGVuZHBvaW50IHNlcGFyYXRpb24uCjQuIFBvZCBleGlzdGVuY2UgZGlkIG5vdCBwcm92ZSB0aGF0IHRoZSBiYWNrZW5kIHdhcyBsaXN0ZW5pbmcuIFRoZSBnZW5lcmljIHRlbXBsYXRlIG5vdyBwcm92aWRlcyBUQ1Agc3RhcnR1cCBhbmQgcmVhZGluZXNzIHByb2JlcyBvbiB0aGUgUkZCIHBvcnQuCjUuIFByaXZhdGUgcmVnaXN0cmllcyBhbmQgdG9wb2xvZ3ktY29uc3RyYWluZWQgQk1DIG5ldHdvcmtzIGNvdWxkIG5vdCBiZSBleHByZXNzZWQuIEltYWdlIHB1bGwgc2VjcmV0cywgYW5ub3RhdGlvbnMsIG5vZGUgc2VsZWN0aW9uLCBhZmZpbml0eSwgdG9sZXJhdGlvbnMsIHRvcG9sb2d5IHNwcmVhZCwgcHJpb3JpdHkvcnVudGltZSBjbGFzc2VzLCByZXNvdXJjZXMsIGFuZCBzY3JhdGNoIHZvbHVtZXMgYXJlIG5vdyBjb25maWd1cmFibGUuCjYuIERpc2FibGluZyB0aGUgZmVhdHVyZSBvbmx5IHNraXBwZWQgdGhlIG5vVk5DIEluZ3Jlc3MgdGFzay4gVGhlIHJvbGUgbm93IHJlY29uY2lsZXMgdGhhdCBJbmdyZXNzIGFic2VudCBhbmQgcmVmdXNlcyBkaXNhYmxlIHdoaWxlIGxhYmVsbGVkIGR5bmFtaWMgUG9kcyBvciBTZWNyZXRzIHJlbWFpbi4KNy4gRGlnZXN0IHZhbGlkYXRpb24gcHJldmlvdXNseSBhY2NlcHRlZCBhbnkgc3RyaW5nIGNvbnRhaW5pbmcgYEBzaGEyNTY6YC4gSXQgbm93IHJlcXVpcmVzIGEgY29tcGxldGUgNjQtY2hhcmFjdGVyIGxvd2VyY2FzZSBTSEEtMjU2IHJlZmVyZW5jZSBmb3IgY29uc29sZSBiYWNrZW5kIGFuZCBvdmVycmlkZGVuIGJyb3dzZXItYXNzZXRzIGltYWdlcy4KOC4gVGhlIGNoZWNrZWQtaW4gY2hhcnQgYW5kIGl0cyBjb25zb2xpZGF0ZWQgdmVuZG9yIHBhdGNoIGNvdWxkIGRyaWZ0LiBUaGUgcGF0Y2ggaXMgcmVnZW5lcmF0ZWQgZnJvbSB0aGUgY2hhcnQgYmFzZWxpbmUgYW5kIHZlcmlmaWVkIHRvIHJlcHJvZHVjZSBgY2hhcnRzL2lyb25pY2AgYnl0ZS1mb3ItYnl0ZS4KClRoZSBOZXR3b3JrUG9saWN5IGlzIGRlbGliZXJhdGVseSBpbmdyZXNzLW9ubHkuIEl0IHBlcm1pdHMgdGhlIElyb25pYyBub1ZOQyBwcm94eSBQb2RzIHRvIGNvbm5lY3QgdG8gZHluYW1pYyBSRkIgUG9kczsgaXQgZG9lcyBub3QgZGVmaW5lIE9wZW5TdGFjayBjb25zb2xlIGF1dGhvcml6YXRpb24gb3IgbWFrZSBhIGNvbnNvbGUgcmVhZC1vbmx5LiBPcGVuU3RhY2svSXJvbmljIGF1dGhvcml6YXRpb24gcmVtYWlucyBhYm92ZSB0aGlzIEt1YmVybmV0ZXMgdHJhbnNwb3J0IGJvdW5kYXJ5LgoKIyMgU3RhY2sgYW5kIG93bmVyc2hpcAoKLSB0aGlzIGJyYW5jaCBpbmNvcnBvcmF0ZXMgYW5kIHN1cGVyc2VkZXMgdGhlIGZvY3VzZWQgSXJvbmljIG5vVk5DIGZvdW5kYXRpb24gZnJvbSAjMzgxMSBvbiBjdXJyZW50IGBtYWluYAotIGNoYXJ0IGltcGxlbWVudGF0aW9uOiBodHRwczovL3Jldmlldy5vcGVuZGV2Lm9yZy9jL29wZW5zdGFjay9vcGVuc3RhY2staGVsbS8rLzk5NzM0MAotIE9wZW5TdGFjay1IZWxtIG93bnMgdGhlIGRlcGxveWVyLW5ldXRyYWwgYGNvbnNvbGUubmFtZXNwYWNlYCB0ZW1wbGF0ZSBjb250cmFjdAotIEF0bW9zcGhlcmUgb3ducyBuYW1lc3BhY2UgY3JlYXRpb24vZGVmYXVsdGluZywgZW5kcG9pbnQgdmFsaWRhdGlvbiwgbGlmZWN5Y2xlIHJlY29uY2lsaWF0aW9uLCBhbmQgdmFsdWVzIG1hcHBpbmcKLSB1cHN0cmVhbSBJcm9uaWMgb3ducyBwcm92aWRlci1zaWRlIHdhaXQtZm9yLWxpc3RlbiBhbmQgcGFydGlhbC1hcHBseSBjbGVhbnVwOyB0aG9zZSBhcmUgbm90IGltcGxlbWVudGVkIGJ5IHRoaXMgUFIKCiMjIFZhbGlkYXRpb24KCi0gYGdpdCBkaWZmIC0tY2hlY2tgCi0gYGdvIHRlc3QgLi9yb2xlcy9pcm9uaWMvLi4uYAotIGBoZWxtIGxpbnQgY2hhcnRzL2lyb25pY2AKLSBIZWxtIDMgc3RyaWN0IHVuaXQgdGVzdHM6IDIgY29uc29sZSB0ZXN0cywgMiBwcmlvcml0eS1jbGFzcyB0ZXN0cywgYW5kIDIgcnVudGltZS1jbGFzcyB0ZXN0cyBwYXNzZWQKLSBkZWZhdWx0LWRpc2FibGVkIHJlbmRlciBjb250YWlucyBubyBjb25zb2xlIFBvZCB0ZW1wbGF0ZSwgY29uc29sZSBSQkFDLCBvciBjb25zb2xlIE5ldHdvcmtQb2xpY3kKLSBtaXNzaW5nIG5hbWVzcGFjZSBpcyByZWplY3RlZCB3aGVuIHRoZSBLdWJlcm5ldGVzIHByb3ZpZGVyIGlzIGVuYWJsZWQKLSBzZXBhcmF0ZS1uYW1lc3BhY2UgcmVuZGVyIHZlcmlmaWVzIFNlY3JldCwgUG9kLCBSb2xlLCBSb2xlQmluZGluZywgYW5kIE5ldHdvcmtQb2xpY3kgcGxhY2VtZW50IGFuZCB0aGUgYGFwcGxpY2F0aW9uPWlyb25pYyxjb21wb25lbnQ9bm92bmNwcm94eWAgc291cmNlIHNlbGVjdG9yCi0gY29uc29saWRhdGVkIElyb25pYyBjaGFydCBwYXRjaCBhcHBsaWVzIHRvIGl0cyByZWNvcmRlZCBiYXNlbGluZSBhbmQgcmVwcm9kdWNlcyB0aGUgY2hlY2tlZC1pbiBjaGFydCBieXRlLWZvci1ieXRlCi0gY2hhcnQgaW1hZ2UgdGFncywgQXRtb3NwaGVyZSBpbWFnZSBjYXRhbG9nIGlucHV0cywgYW5kIGltYWdlLWJ1aWxkIGlucHV0cyBhcmUgdW5jaGFuZ2VkCi0gYGFuc2libGUtbGludCByb2xlcy9pcm9uaWNgIHJlcG9ydHMgbm8gZmFpbHVyZXMgb3Igd2FybmluZ3MKClRoZSByZXBvc2l0b3J5LXdpZGUgR28gdGVzdCB3YXMgYWxzbyBydW4gbG9jYWxseS4gQ2hhbmdlZCBwYWNrYWdlcyBwYXNzZWQ7IHVucmVsYXRlZCBpbWFnZS1tYW5pZmVzdCB0ZXN0cyBhc3N1bWUgYSBMaW51eCB0YXJnZXQgYW5kIGZhaWwgb24gRGFyd2luL2FybTY0LCBhbmQgUHJvbWV0aGV1cyBydWxlIHRlc3RzIHJlcXVpcmUgYHByb210b29sYCwgd2hpY2ggd2FzIG5vdCBpbnN0YWxsZWQgb24gdGhlIHdvcmtzdGF0aW9uLiBDSSByZW1haW5zIGF1dGhvcml0YXRpdmUgZm9yIHRob3NlIHBsYXRmb3JtL3Rvb2wtZGVwZW5kZW50IHN1aXRlcy4KCg== patchset: 656520fd009d448cbee486405728263237f3afff pipeline: check playbook_context: playbook_projects: trusted/project_0/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 trusted/project_1/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: 84e38666fab1ba8fda552ad6faff9404811352ca trusted/project_2/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: c286bf94224b5660b8e49e9a058289e61062a9a0 untrusted/project_0/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: c286bf94224b5660b8e49e9a058289e61062a9a0 untrusted/project_1/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 untrusted/project_2/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: 84e38666fab1ba8fda552ad6faff9404811352ca untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs: canonical_name: github.com/vexxhost/atmosphere-zuul-jobs checkout: main commit: acb8e36a801f3b93fdd30dec43a15b6f8d809c2f untrusted/project_4/opendev.org/openstack/openstack-helm: canonical_name: opendev.org/openstack/openstack-helm checkout: master commit: 66da70d45d8d96cb8afe79d34d6a70025b09add2 playbooks: - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/run.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/playbook_0/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/playbook_0/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/playbook_0/role_2/zuul-jobs/roles post_playbooks: - path: untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs/playbooks/molecule/post.yml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/post_playbook_0/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_0/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_0/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_0/role_4/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_1/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_1/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_1/role_2/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post-logs.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_2/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_2/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_2/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_2/role_2/zuul-jobs/roles pre_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_0/role_2/zuul-jobs/roles - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_1/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_1/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_1/role_2/zuul-jobs/roles - path: untrusted/project_3/github.com/vexxhost/atmosphere-zuul-jobs/playbooks/molecule/pre.yml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/pre_playbook_2/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_2/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_2/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_2/role_4/zuul-jobs/roles post_review: false post_timeout: null pre_timeout: null project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere name: vexxhost/atmosphere short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere projects: github.com/ansible-collections/ansible.netcommon: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.netcommon checkout: main checkout_description: zuul branch commit: 501006602620d01c2daf8c19187fbce336b2e7e9 name: ansible-collections/ansible.netcommon required: true short_name: ansible.netcommon src_dir: src/github.com/ansible-collections/ansible.netcommon github.com/ansible-collections/ansible.posix: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.posix checkout: main checkout_description: zuul branch commit: 2f2a8e9b969e63c42c97896d34664c34b44feb44 name: ansible-collections/ansible.posix required: true short_name: ansible.posix src_dir: src/github.com/ansible-collections/ansible.posix github.com/ansible-collections/ansible.utils: canonical_hostname: github.com canonical_name: github.com/ansible-collections/ansible.utils checkout: main checkout_description: zuul branch commit: 2f1541d83ea0a9d6900466744690ea231041bbf5 name: ansible-collections/ansible.utils required: true short_name: ansible.utils src_dir: src/github.com/ansible-collections/ansible.utils github.com/ansible-collections/community.crypto: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.crypto checkout: main checkout_description: zuul branch commit: 7194df2b69bd1e6afe4ea36d1b2ae1f404eed756 name: ansible-collections/community.crypto required: true short_name: community.crypto src_dir: src/github.com/ansible-collections/community.crypto github.com/ansible-collections/community.general: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.general checkout: main checkout_description: zuul branch commit: 39d0e728e260ef2abcbc780a40c2cb8b7b91463f name: ansible-collections/community.general required: true short_name: community.general src_dir: src/github.com/ansible-collections/community.general github.com/ansible-collections/community.mysql: canonical_hostname: github.com canonical_name: github.com/ansible-collections/community.mysql checkout: main checkout_description: zuul branch commit: 4cf7a3176fbd07be43459f1366e8066381df6d97 name: ansible-collections/community.mysql required: true short_name: community.mysql src_dir: src/github.com/ansible-collections/community.mysql github.com/ansible-collections/kubernetes.core: canonical_hostname: github.com canonical_name: github.com/ansible-collections/kubernetes.core checkout: main checkout_description: zuul branch commit: 031bc475fadd0fcf8152d3c9083e22a77e3d870d name: ansible-collections/kubernetes.core required: true short_name: kubernetes.core src_dir: src/github.com/ansible-collections/kubernetes.core github.com/vexxhost/ansible-collection-ceph: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-ceph checkout: main checkout_description: zuul branch commit: 44a694a80e3179c28d75180baa1a56426f987257 name: vexxhost/ansible-collection-ceph required: true short_name: ansible-collection-ceph src_dir: src/github.com/vexxhost/ansible-collection-ceph github.com/vexxhost/ansible-collection-containers: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-containers checkout: main checkout_description: zuul branch commit: d22923ebd40c0fd5a345318c1db90d125fb5140f name: vexxhost/ansible-collection-containers required: true short_name: ansible-collection-containers src_dir: src/github.com/vexxhost/ansible-collection-containers github.com/vexxhost/ansible-collection-kubernetes: canonical_hostname: github.com canonical_name: github.com/vexxhost/ansible-collection-kubernetes checkout: main checkout_description: zuul branch commit: bb3fd0fde58a5b158605523e708645eb2a763886 name: vexxhost/ansible-collection-kubernetes required: true short_name: ansible-collection-kubernetes src_dir: src/github.com/vexxhost/ansible-collection-kubernetes github.com/vexxhost/atmosphere: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere checkout: main checkout_description: zuul branch commit: 656520fd009d448cbee486405728263237f3afff name: vexxhost/atmosphere required: false short_name: atmosphere src_dir: src/github.com/vexxhost/atmosphere github.com/vexxhost/atmosphere.common: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common checkout: main checkout_description: zuul branch commit: d00ec7f88fdc7ca2ce504a7e19c4049986cdac86 name: vexxhost/atmosphere.common required: true short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common opendev.org/openstack/ansible-collections-openstack: canonical_hostname: opendev.org canonical_name: opendev.org/openstack/ansible-collections-openstack checkout: master checkout_description: project default branch commit: 19a8bc6e05d628668d9cce34ee5c3730e595859b name: openstack/ansible-collections-openstack required: true short_name: ansible-collections-openstack src_dir: src/opendev.org/openstack/ansible-collections-openstack ref: refs/pull/4232/head resources: {} tenant: oss timeout: 1800 topic: null voting: true