all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe96:f255
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: db68c136-2e6b-480f-ba99-b0e705527462
        host_id: 5afd8fc909abddfe2ce3a956a91bbe56629648b7209fd0acfa541862
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe96:f255
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.127
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.22
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe96:f255
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job flake8 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#32>'
      - '<Job flake8 explicit: None implied: None source: osism/container-images/.zuul.yaml@main#2>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 16fee6453fbe4877b126872806eab2ec
      build_refs:
      - branch: main
        change: '941'
        change_message: "seed: bake ansible.cfg disabling host key checking\n\n##
          Problem\n\nThe `osism/seed` image ships no `ansible.cfg`, so Ansible inside
          it falls back to its built-in default `host_key_checking = True`.\n\nThe
          new `osism update manager` seed-container path (wired in `ansible-collection-services`
          `f1e7869f`) runs `osism.manager.manager` from this image via `ansible-playbook
          -i hosts`, with the working directory at `/opt/configuration/environments/manager`.
          Host-key trust there depends entirely on an `ansible.cfg` in that directory.\n\nOn
          a seed-deployed manager whose configuration repository ships no `environments/manager/ansible.cfg`
          (e.g. the testbed), nothing turns host-key checking off. So `Apply role
          manager`'s first SSH to the manager runs strict checking against an empty
          `known_hosts` and aborts with `Host key verification failed`, breaking `testbed-update`
          at the final re-apply:\n\n```\nfatal: [testbed-manager]: UNREACHABLE! =>
          {\"changed\": false,\n  \"msg\": \"Failed to connect to the host via ssh:
          Host key\n  verification failed.\", \"unreachable\": true}\n```\n\nDeploy-time
          manager apply does not hit this because it runs from the `osism-ansible`
          image, which already bakes `host_key_checking = false`.\n\n## Fix\n\nBake
          a minimal `ansible.cfg` into the seed image at `/etc/ansible/ansible.cfg`,
          reaching parity with the `osism-ansible` image (`host_key_checking = false`,
          `pipelining = true`).\n\n`/etc/ansible` is the lowest-precedence config
          location, so a per-config `environments/manager/ansible.cfg` in the working
          directory still overrides it.\n\n## Notes\n\n- Takes effect once `osism/seed:latest`
          is rebuilt/released.\n- Root-cause analysis filed in the internal CI issue
          tracker (`ci/testbed-update-manager-host-key-verification.md`); first observed
          in periodic-midnight build `b842f678` on 2026-06-28.\n\n\U0001F916 Generated
          with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/container-images/pull/941
        commit_id: c4b69649039fdeb9f594b6dff44d74976519e6db
        patchset: c4b69649039fdeb9f594b6dff44d74976519e6db
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
        src_dir: src/github.com/osism/container-images
        topic: null
      buildset: 133ca4eb18814ac1a736c4490735a0e0
      buildset_refs:
      - branch: main
        change: '941'
        change_message: "seed: bake ansible.cfg disabling host key checking\n\n##
          Problem\n\nThe `osism/seed` image ships no `ansible.cfg`, so Ansible inside
          it falls back to its built-in default `host_key_checking = True`.\n\nThe
          new `osism update manager` seed-container path (wired in `ansible-collection-services`
          `f1e7869f`) runs `osism.manager.manager` from this image via `ansible-playbook
          -i hosts`, with the working directory at `/opt/configuration/environments/manager`.
          Host-key trust there depends entirely on an `ansible.cfg` in that directory.\n\nOn
          a seed-deployed manager whose configuration repository ships no `environments/manager/ansible.cfg`
          (e.g. the testbed), nothing turns host-key checking off. So `Apply role
          manager`'s first SSH to the manager runs strict checking against an empty
          `known_hosts` and aborts with `Host key verification failed`, breaking `testbed-update`
          at the final re-apply:\n\n```\nfatal: [testbed-manager]: UNREACHABLE! =>
          {\"changed\": false,\n  \"msg\": \"Failed to connect to the host via ssh:
          Host key\n  verification failed.\", \"unreachable\": true}\n```\n\nDeploy-time
          manager apply does not hit this because it runs from the `osism-ansible`
          image, which already bakes `host_key_checking = false`.\n\n## Fix\n\nBake
          a minimal `ansible.cfg` into the seed image at `/etc/ansible/ansible.cfg`,
          reaching parity with the `osism-ansible` image (`host_key_checking = false`,
          `pipelining = true`).\n\n`/etc/ansible` is the lowest-precedence config
          location, so a per-config `environments/manager/ansible.cfg` in the working
          directory still overrides it.\n\n## Notes\n\n- Takes effect once `osism/seed:latest`
          is rebuilt/released.\n- Root-cause analysis filed in the internal CI issue
          tracker (`ci/testbed-update-manager-host-key-verification.md`); first observed
          in periodic-midnight build `b842f678` on 2026-06-28.\n\n\U0001F916 Generated
          with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/container-images/pull/941
        commit_id: c4b69649039fdeb9f594b6dff44d74976519e6db
        patchset: c4b69649039fdeb9f594b6dff44d74976519e6db
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
        src_dir: src/github.com/osism/container-images
        topic: null
      change: '941'
      change_message: "seed: bake ansible.cfg disabling host key checking\n\n## Problem\n\nThe
        `osism/seed` image ships no `ansible.cfg`, so Ansible inside it falls back
        to its built-in default `host_key_checking = True`.\n\nThe new `osism update
        manager` seed-container path (wired in `ansible-collection-services` `f1e7869f`)
        runs `osism.manager.manager` from this image via `ansible-playbook -i hosts`,
        with the working directory at `/opt/configuration/environments/manager`. Host-key
        trust there depends entirely on an `ansible.cfg` in that directory.\n\nOn
        a seed-deployed manager whose configuration repository ships no `environments/manager/ansible.cfg`
        (e.g. the testbed), nothing turns host-key checking off. So `Apply role manager`'s
        first SSH to the manager runs strict checking against an empty `known_hosts`
        and aborts with `Host key verification failed`, breaking `testbed-update`
        at the final re-apply:\n\n```\nfatal: [testbed-manager]: UNREACHABLE! => {\"changed\":
        false,\n  \"msg\": \"Failed to connect to the host via ssh: Host key\n  verification
        failed.\", \"unreachable\": true}\n```\n\nDeploy-time manager apply does not
        hit this because it runs from the `osism-ansible` image, which already bakes
        `host_key_checking = false`.\n\n## Fix\n\nBake a minimal `ansible.cfg` into
        the seed image at `/etc/ansible/ansible.cfg`, reaching parity with the `osism-ansible`
        image (`host_key_checking = false`, `pipelining = true`).\n\n`/etc/ansible`
        is the lowest-precedence config location, so a per-config `environments/manager/ansible.cfg`
        in the working directory still overrides it.\n\n## Notes\n\n- Takes effect
        once `osism/seed:latest` is rebuilt/released.\n- Root-cause analysis filed
        in the internal CI issue tracker (`ci/testbed-update-manager-host-key-verification.md`);
        first observed in periodic-midnight build `b842f678` on 2026-06-28.\n\n\U0001F916
        Generated with [Claude Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/container-images/pull/941
      child_jobs: []
      commit_id: c4b69649039fdeb9f594b6dff44d74976519e6db
      event_id: 4c903a30-72df-11f1-91e1-4d5aa7135363
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/16fee6453fbe4877b126872806eab2ec/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/16fee6453fbe4877b126872806eab2ec/work/logs
        result_data_file: /var/lib/zuul/builds/16fee6453fbe4877b126872806eab2ec/work/results.json
        src_root: /var/lib/zuul/builds/16fee6453fbe4877b126872806eab2ec/work/src
        work_root: /var/lib/zuul/builds/16fee6453fbe4877b126872806eab2ec/work
      include_vars: []
      items:
      - branch: main
        change: '941'
        change_message: "seed: bake ansible.cfg disabling host key checking\n\n##
          Problem\n\nThe `osism/seed` image ships no `ansible.cfg`, so Ansible inside
          it falls back to its built-in default `host_key_checking = True`.\n\nThe
          new `osism update manager` seed-container path (wired in `ansible-collection-services`
          `f1e7869f`) runs `osism.manager.manager` from this image via `ansible-playbook
          -i hosts`, with the working directory at `/opt/configuration/environments/manager`.
          Host-key trust there depends entirely on an `ansible.cfg` in that directory.\n\nOn
          a seed-deployed manager whose configuration repository ships no `environments/manager/ansible.cfg`
          (e.g. the testbed), nothing turns host-key checking off. So `Apply role
          manager`'s first SSH to the manager runs strict checking against an empty
          `known_hosts` and aborts with `Host key verification failed`, breaking `testbed-update`
          at the final re-apply:\n\n```\nfatal: [testbed-manager]: UNREACHABLE! =>
          {\"changed\": false,\n  \"msg\": \"Failed to connect to the host via ssh:
          Host key\n  verification failed.\", \"unreachable\": true}\n```\n\nDeploy-time
          manager apply does not hit this because it runs from the `osism-ansible`
          image, which already bakes `host_key_checking = false`.\n\n## Fix\n\nBake
          a minimal `ansible.cfg` into the seed image at `/etc/ansible/ansible.cfg`,
          reaching parity with the `osism-ansible` image (`host_key_checking = false`,
          `pipelining = true`).\n\n`/etc/ansible` is the lowest-precedence config
          location, so a per-config `environments/manager/ansible.cfg` in the working
          directory still overrides it.\n\n## Notes\n\n- Takes effect once `osism/seed:latest`
          is rebuilt/released.\n- Root-cause analysis filed in the internal CI issue
          tracker (`ci/testbed-update-manager-host-key-verification.md`); first observed
          in periodic-midnight build `b842f678` on 2026-06-28.\n\n\U0001F916 Generated
          with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/container-images/pull/941
        commit_id: c4b69649039fdeb9f594b6dff44d74976519e6db
        patchset: c4b69649039fdeb9f594b6dff44d74976519e6db
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          name: osism/container-images
          short_name: container-images
          src_dir: src/github.com/osism/container-images
        topic: null
      job: flake8
      jobtags: []
      max_attempts: 3
      message: c2VlZDogYmFrZSBhbnNpYmxlLmNmZyBkaXNhYmxpbmcgaG9zdCBrZXkgY2hlY2tpbmcKCiMjIFByb2JsZW0KClRoZSBgb3Npc20vc2VlZGAgaW1hZ2Ugc2hpcHMgbm8gYGFuc2libGUuY2ZnYCwgc28gQW5zaWJsZSBpbnNpZGUgaXQgZmFsbHMgYmFjayB0byBpdHMgYnVpbHQtaW4gZGVmYXVsdCBgaG9zdF9rZXlfY2hlY2tpbmcgPSBUcnVlYC4KClRoZSBuZXcgYG9zaXNtIHVwZGF0ZSBtYW5hZ2VyYCBzZWVkLWNvbnRhaW5lciBwYXRoICh3aXJlZCBpbiBgYW5zaWJsZS1jb2xsZWN0aW9uLXNlcnZpY2VzYCBgZjFlNzg2OWZgKSBydW5zIGBvc2lzbS5tYW5hZ2VyLm1hbmFnZXJgIGZyb20gdGhpcyBpbWFnZSB2aWEgYGFuc2libGUtcGxheWJvb2sgLWkgaG9zdHNgLCB3aXRoIHRoZSB3b3JraW5nIGRpcmVjdG9yeSBhdCBgL29wdC9jb25maWd1cmF0aW9uL2Vudmlyb25tZW50cy9tYW5hZ2VyYC4gSG9zdC1rZXkgdHJ1c3QgdGhlcmUgZGVwZW5kcyBlbnRpcmVseSBvbiBhbiBgYW5zaWJsZS5jZmdgIGluIHRoYXQgZGlyZWN0b3J5LgoKT24gYSBzZWVkLWRlcGxveWVkIG1hbmFnZXIgd2hvc2UgY29uZmlndXJhdGlvbiByZXBvc2l0b3J5IHNoaXBzIG5vIGBlbnZpcm9ubWVudHMvbWFuYWdlci9hbnNpYmxlLmNmZ2AgKGUuZy4gdGhlIHRlc3RiZWQpLCBub3RoaW5nIHR1cm5zIGhvc3Qta2V5IGNoZWNraW5nIG9mZi4gU28gYEFwcGx5IHJvbGUgbWFuYWdlcmAncyBmaXJzdCBTU0ggdG8gdGhlIG1hbmFnZXIgcnVucyBzdHJpY3QgY2hlY2tpbmcgYWdhaW5zdCBhbiBlbXB0eSBga25vd25faG9zdHNgIGFuZCBhYm9ydHMgd2l0aCBgSG9zdCBrZXkgdmVyaWZpY2F0aW9uIGZhaWxlZGAsIGJyZWFraW5nIGB0ZXN0YmVkLXVwZGF0ZWAgYXQgdGhlIGZpbmFsIHJlLWFwcGx5OgoKYGBgCmZhdGFsOiBbdGVzdGJlZC1tYW5hZ2VyXTogVU5SRUFDSEFCTEUhID0+IHsiY2hhbmdlZCI6IGZhbHNlLAogICJtc2ciOiAiRmFpbGVkIHRvIGNvbm5lY3QgdG8gdGhlIGhvc3QgdmlhIHNzaDogSG9zdCBrZXkKICB2ZXJpZmljYXRpb24gZmFpbGVkLiIsICJ1bnJlYWNoYWJsZSI6IHRydWV9CmBgYAoKRGVwbG95LXRpbWUgbWFuYWdlciBhcHBseSBkb2VzIG5vdCBoaXQgdGhpcyBiZWNhdXNlIGl0IHJ1bnMgZnJvbSB0aGUgYG9zaXNtLWFuc2libGVgIGltYWdlLCB3aGljaCBhbHJlYWR5IGJha2VzIGBob3N0X2tleV9jaGVja2luZyA9IGZhbHNlYC4KCiMjIEZpeAoKQmFrZSBhIG1pbmltYWwgYGFuc2libGUuY2ZnYCBpbnRvIHRoZSBzZWVkIGltYWdlIGF0IGAvZXRjL2Fuc2libGUvYW5zaWJsZS5jZmdgLCByZWFjaGluZyBwYXJpdHkgd2l0aCB0aGUgYG9zaXNtLWFuc2libGVgIGltYWdlIChgaG9zdF9rZXlfY2hlY2tpbmcgPSBmYWxzZWAsIGBwaXBlbGluaW5nID0gdHJ1ZWApLgoKYC9ldGMvYW5zaWJsZWAgaXMgdGhlIGxvd2VzdC1wcmVjZWRlbmNlIGNvbmZpZyBsb2NhdGlvbiwgc28gYSBwZXItY29uZmlnIGBlbnZpcm9ubWVudHMvbWFuYWdlci9hbnNpYmxlLmNmZ2AgaW4gdGhlIHdvcmtpbmcgZGlyZWN0b3J5IHN0aWxsIG92ZXJyaWRlcyBpdC4KCiMjIE5vdGVzCgotIFRha2VzIGVmZmVjdCBvbmNlIGBvc2lzbS9zZWVkOmxhdGVzdGAgaXMgcmVidWlsdC9yZWxlYXNlZC4KLSBSb290LWNhdXNlIGFuYWx5c2lzIGZpbGVkIGluIHRoZSBpbnRlcm5hbCBDSSBpc3N1ZSB0cmFja2VyIChgY2kvdGVzdGJlZC11cGRhdGUtbWFuYWdlci1ob3N0LWtleS12ZXJpZmljYXRpb24ubWRgKTsgZmlyc3Qgb2JzZXJ2ZWQgaW4gcGVyaW9kaWMtbWlkbmlnaHQgYnVpbGQgYGI4NDJmNjc4YCBvbiAyMDI2LTA2LTI4LgoK8J+kliBHZW5lcmF0ZWQgd2l0aCBbQ2xhdWRlIENvZGVdKGh0dHBzOi8vY2xhdWRlLmNvbS9jbGF1ZGUtY29kZSk=
      patchset: c4b69649039fdeb9f594b6dff44d74976519e6db
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/flake8/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/container-images
        name: osism/container-images
        short_name: container-images
        src_dir: src/github.com/osism/container-images
      projects:
        github.com/osism/container-images:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images
          checkout: main
          checkout_description: zuul branch
          commit: 284b146dd0ac8ef4975915b87fdfbcbf3ac5e0e6
          name: osism/container-images
          required: false
          short_name: container-images
          src_dir: src/github.com/osism/container-images
      ref: refs/pull/941/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
