all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    ubuntu-noble:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe19:5c8d
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      docker_namespace: kolla
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 9538cea8-442c-4fd3-9fa0-2c294f74549f
        host_id: 25afcdcd4b24cc9d1766f11f81549380a3029030a455889bb61ec093
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe19:5c8d
        label: ubuntu-noble
        node_properties: {}
        private_ipv4: 10.128.7.171
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.44
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe19:5c8d
        region: null
        slot: null
      push_images: false
      version_openstack: '2024.1'
  vars:
    docker_namespace: kolla
    push_images: false
    version_openstack: '2024.1'
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job container-images-kolla-patch explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/container-images-kolla/.zuul.yaml@main#76>'
      - '<Job container-images-kolla-patch-2024.1 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/container-images-kolla/.zuul.yaml@main#94>'
      - '<Job container-images-kolla-patch-2024.1 explicit: None implied: None source:
        osism/container-images-kolla/.zuul.yaml@main#213>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 833089f9fd9e4c95b9f550825d14be81
      build_refs:
      - branch: main
        change: '736'
        change_message: "keystone: Drop 2025.2 CVE patches merged upstream\n\n## What\n\nRemove
          three keystone CVE backport patches from `patches/2025.2/keystone/`\nthat
          have landed upstream on `stable/2025.2`:\n\n- `0001-Enforce-delegation-project-boundary-for-delegated-to.patch`\n-
          `0002-Fix-user-impersonation-through-application-credentia.patch`\n- `0003-Forbid-trust-operations-using-application-credential.patch`\n\n##
          Why\n\nThe `container-images-kolla-patch-2025.2` job (e.g. on #735) fails
          because\n`0001` no longer applies: against the `keystone-stable-2025.2`
          tarball its\ndry-run reports a mix of *\"Reversed (or previously applied)\"*
          and *\"Hunk\nFAILED\"*, which aborts the whole patch step (`rc 1`).\n\nThe
          CVE backports added in #731 have since merged upstream, and the nightly\ntarball
          is built from the branch tip, so it already carries them:\n\n| patch | upstream
          change |\n|---|---|\n| 0001 Enforce delegation project boundary | https://review.opendev.org/q/Iaaa0ec713a0a5e062acc3209d6010982899d8f6f
          |\n| 0002 Fix user impersonation (CVE-2026-42998) | https://review.opendev.org/q/I2fe6089886eebf3775930451b87771e40b5e179e
          |\n| 0003 Forbid trust ops via app creds (CVE-2026-43000) | https://review.opendev.org/q/I750156df18a1d6293ce99c42eb524575fcf16ea3
          |\n\nDropping them only changes where the fix lives (upstream tarball vs.
          local\npatch); CVE coverage is preserved.\n\n## Scope\n\nPatches `0004`
          and `0005` are **not** yet upstream and still apply cleanly\n(forward, no
          fuzz) in sorted order \u2014 verified against the actual\n`keystone-stable-2025.2`
          tarball. They keep their `0004`/`0005` numbering\nrather than being resequenced,
          matching the convention used when an\nupstreamed patch is dropped from a
          numbered series (e.g. b769eb1 / #648,\nwhich removed `netapp-01` and left
          `netapp-02`/`03` in place).\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/container-images-kolla/pull/736
        commit_id: 388d903d605be6af2390a85499ffeac73d6a0497
        patchset: 388d903d605be6af2390a85499ffeac73d6a0497
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
        topic: null
      buildset: 87b67ff72ebf4ed8b131986221af76f2
      buildset_refs:
      - branch: main
        change: '736'
        change_message: "keystone: Drop 2025.2 CVE patches merged upstream\n\n## What\n\nRemove
          three keystone CVE backport patches from `patches/2025.2/keystone/`\nthat
          have landed upstream on `stable/2025.2`:\n\n- `0001-Enforce-delegation-project-boundary-for-delegated-to.patch`\n-
          `0002-Fix-user-impersonation-through-application-credentia.patch`\n- `0003-Forbid-trust-operations-using-application-credential.patch`\n\n##
          Why\n\nThe `container-images-kolla-patch-2025.2` job (e.g. on #735) fails
          because\n`0001` no longer applies: against the `keystone-stable-2025.2`
          tarball its\ndry-run reports a mix of *\"Reversed (or previously applied)\"*
          and *\"Hunk\nFAILED\"*, which aborts the whole patch step (`rc 1`).\n\nThe
          CVE backports added in #731 have since merged upstream, and the nightly\ntarball
          is built from the branch tip, so it already carries them:\n\n| patch | upstream
          change |\n|---|---|\n| 0001 Enforce delegation project boundary | https://review.opendev.org/q/Iaaa0ec713a0a5e062acc3209d6010982899d8f6f
          |\n| 0002 Fix user impersonation (CVE-2026-42998) | https://review.opendev.org/q/I2fe6089886eebf3775930451b87771e40b5e179e
          |\n| 0003 Forbid trust ops via app creds (CVE-2026-43000) | https://review.opendev.org/q/I750156df18a1d6293ce99c42eb524575fcf16ea3
          |\n\nDropping them only changes where the fix lives (upstream tarball vs.
          local\npatch); CVE coverage is preserved.\n\n## Scope\n\nPatches `0004`
          and `0005` are **not** yet upstream and still apply cleanly\n(forward, no
          fuzz) in sorted order \u2014 verified against the actual\n`keystone-stable-2025.2`
          tarball. They keep their `0004`/`0005` numbering\nrather than being resequenced,
          matching the convention used when an\nupstreamed patch is dropped from a
          numbered series (e.g. b769eb1 / #648,\nwhich removed `netapp-01` and left
          `netapp-02`/`03` in place).\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/container-images-kolla/pull/736
        commit_id: 388d903d605be6af2390a85499ffeac73d6a0497
        patchset: 388d903d605be6af2390a85499ffeac73d6a0497
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
        topic: null
      change: '736'
      change_message: "keystone: Drop 2025.2 CVE patches merged upstream\n\n## What\n\nRemove
        three keystone CVE backport patches from `patches/2025.2/keystone/`\nthat
        have landed upstream on `stable/2025.2`:\n\n- `0001-Enforce-delegation-project-boundary-for-delegated-to.patch`\n-
        `0002-Fix-user-impersonation-through-application-credentia.patch`\n- `0003-Forbid-trust-operations-using-application-credential.patch`\n\n##
        Why\n\nThe `container-images-kolla-patch-2025.2` job (e.g. on #735) fails
        because\n`0001` no longer applies: against the `keystone-stable-2025.2` tarball
        its\ndry-run reports a mix of *\"Reversed (or previously applied)\"* and *\"Hunk\nFAILED\"*,
        which aborts the whole patch step (`rc 1`).\n\nThe CVE backports added in
        #731 have since merged upstream, and the nightly\ntarball is built from the
        branch tip, so it already carries them:\n\n| patch | upstream change |\n|---|---|\n|
        0001 Enforce delegation project boundary | https://review.opendev.org/q/Iaaa0ec713a0a5e062acc3209d6010982899d8f6f
        |\n| 0002 Fix user impersonation (CVE-2026-42998) | https://review.opendev.org/q/I2fe6089886eebf3775930451b87771e40b5e179e
        |\n| 0003 Forbid trust ops via app creds (CVE-2026-43000) | https://review.opendev.org/q/I750156df18a1d6293ce99c42eb524575fcf16ea3
        |\n\nDropping them only changes where the fix lives (upstream tarball vs.
        local\npatch); CVE coverage is preserved.\n\n## Scope\n\nPatches `0004` and
        `0005` are **not** yet upstream and still apply cleanly\n(forward, no fuzz)
        in sorted order \u2014 verified against the actual\n`keystone-stable-2025.2`
        tarball. They keep their `0004`/`0005` numbering\nrather than being resequenced,
        matching the convention used when an\nupstreamed patch is dropped from a numbered
        series (e.g. b769eb1 / #648,\nwhich removed `netapp-01` and left `netapp-02`/`03`
        in place).\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/container-images-kolla/pull/736
      child_jobs: []
      commit_id: 388d903d605be6af2390a85499ffeac73d6a0497
      event_id: 8d880df0-63f4-11f1-93fc-ca75bf9f374b
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/833089f9fd9e4c95b9f550825d14be81/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/833089f9fd9e4c95b9f550825d14be81/work/logs
        result_data_file: /var/lib/zuul/builds/833089f9fd9e4c95b9f550825d14be81/work/results.json
        src_root: /var/lib/zuul/builds/833089f9fd9e4c95b9f550825d14be81/work/src
        work_root: /var/lib/zuul/builds/833089f9fd9e4c95b9f550825d14be81/work
      include_vars: []
      items:
      - branch: main
        change: '736'
        change_message: "keystone: Drop 2025.2 CVE patches merged upstream\n\n## What\n\nRemove
          three keystone CVE backport patches from `patches/2025.2/keystone/`\nthat
          have landed upstream on `stable/2025.2`:\n\n- `0001-Enforce-delegation-project-boundary-for-delegated-to.patch`\n-
          `0002-Fix-user-impersonation-through-application-credentia.patch`\n- `0003-Forbid-trust-operations-using-application-credential.patch`\n\n##
          Why\n\nThe `container-images-kolla-patch-2025.2` job (e.g. on #735) fails
          because\n`0001` no longer applies: against the `keystone-stable-2025.2`
          tarball its\ndry-run reports a mix of *\"Reversed (or previously applied)\"*
          and *\"Hunk\nFAILED\"*, which aborts the whole patch step (`rc 1`).\n\nThe
          CVE backports added in #731 have since merged upstream, and the nightly\ntarball
          is built from the branch tip, so it already carries them:\n\n| patch | upstream
          change |\n|---|---|\n| 0001 Enforce delegation project boundary | https://review.opendev.org/q/Iaaa0ec713a0a5e062acc3209d6010982899d8f6f
          |\n| 0002 Fix user impersonation (CVE-2026-42998) | https://review.opendev.org/q/I2fe6089886eebf3775930451b87771e40b5e179e
          |\n| 0003 Forbid trust ops via app creds (CVE-2026-43000) | https://review.opendev.org/q/I750156df18a1d6293ce99c42eb524575fcf16ea3
          |\n\nDropping them only changes where the fix lives (upstream tarball vs.
          local\npatch); CVE coverage is preserved.\n\n## Scope\n\nPatches `0004`
          and `0005` are **not** yet upstream and still apply cleanly\n(forward, no
          fuzz) in sorted order \u2014 verified against the actual\n`keystone-stable-2025.2`
          tarball. They keep their `0004`/`0005` numbering\nrather than being resequenced,
          matching the convention used when an\nupstreamed patch is dropped from a
          numbered series (e.g. b769eb1 / #648,\nwhich removed `netapp-01` and left
          `netapp-02`/`03` in place).\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/container-images-kolla/pull/736
        commit_id: 388d903d605be6af2390a85499ffeac73d6a0497
        patchset: 388d903d605be6af2390a85499ffeac73d6a0497
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          name: osism/container-images-kolla
          short_name: container-images-kolla
          src_dir: src/github.com/osism/container-images-kolla
        topic: null
      job: container-images-kolla-patch-2024.1
      jobtags: []
      max_attempts: 3
      message: a2V5c3RvbmU6IERyb3AgMjAyNS4yIENWRSBwYXRjaGVzIG1lcmdlZCB1cHN0cmVhbQoKIyMgV2hhdAoKUmVtb3ZlIHRocmVlIGtleXN0b25lIENWRSBiYWNrcG9ydCBwYXRjaGVzIGZyb20gYHBhdGNoZXMvMjAyNS4yL2tleXN0b25lL2AKdGhhdCBoYXZlIGxhbmRlZCB1cHN0cmVhbSBvbiBgc3RhYmxlLzIwMjUuMmA6CgotIGAwMDAxLUVuZm9yY2UtZGVsZWdhdGlvbi1wcm9qZWN0LWJvdW5kYXJ5LWZvci1kZWxlZ2F0ZWQtdG8ucGF0Y2hgCi0gYDAwMDItRml4LXVzZXItaW1wZXJzb25hdGlvbi10aHJvdWdoLWFwcGxpY2F0aW9uLWNyZWRlbnRpYS5wYXRjaGAKLSBgMDAwMy1Gb3JiaWQtdHJ1c3Qtb3BlcmF0aW9ucy11c2luZy1hcHBsaWNhdGlvbi1jcmVkZW50aWFsLnBhdGNoYAoKIyMgV2h5CgpUaGUgYGNvbnRhaW5lci1pbWFnZXMta29sbGEtcGF0Y2gtMjAyNS4yYCBqb2IgKGUuZy4gb24gIzczNSkgZmFpbHMgYmVjYXVzZQpgMDAwMWAgbm8gbG9uZ2VyIGFwcGxpZXM6IGFnYWluc3QgdGhlIGBrZXlzdG9uZS1zdGFibGUtMjAyNS4yYCB0YXJiYWxsIGl0cwpkcnktcnVuIHJlcG9ydHMgYSBtaXggb2YgKiJSZXZlcnNlZCAob3IgcHJldmlvdXNseSBhcHBsaWVkKSIqIGFuZCAqIkh1bmsKRkFJTEVEIiosIHdoaWNoIGFib3J0cyB0aGUgd2hvbGUgcGF0Y2ggc3RlcCAoYHJjIDFgKS4KClRoZSBDVkUgYmFja3BvcnRzIGFkZGVkIGluICM3MzEgaGF2ZSBzaW5jZSBtZXJnZWQgdXBzdHJlYW0sIGFuZCB0aGUgbmlnaHRseQp0YXJiYWxsIGlzIGJ1aWx0IGZyb20gdGhlIGJyYW5jaCB0aXAsIHNvIGl0IGFscmVhZHkgY2FycmllcyB0aGVtOgoKfCBwYXRjaCB8IHVwc3RyZWFtIGNoYW5nZSB8CnwtLS18LS0tfAp8IDAwMDEgRW5mb3JjZSBkZWxlZ2F0aW9uIHByb2plY3QgYm91bmRhcnkgfCBodHRwczovL3Jldmlldy5vcGVuZGV2Lm9yZy9xL0lhYWEwZWM3MTNhMGE1ZTA2MmFjYzMyMDlkNjAxMDk4Mjg5OWQ4ZjZmIHwKfCAwMDAyIEZpeCB1c2VyIGltcGVyc29uYXRpb24gKENWRS0yMDI2LTQyOTk4KSB8IGh0dHBzOi8vcmV2aWV3Lm9wZW5kZXYub3JnL3EvSTJmZTYwODk4ODZlZWJmMzc3NTkzMDQ1MWI4Nzc3MWU0MGI1ZTE3OWUgfAp8IDAwMDMgRm9yYmlkIHRydXN0IG9wcyB2aWEgYXBwIGNyZWRzIChDVkUtMjAyNi00MzAwMCkgfCBodHRwczovL3Jldmlldy5vcGVuZGV2Lm9yZy9xL0k3NTAxNTZkZjE4YTFkNjI5M2NlOTljNDJlYjUyNDU3NWZjZjE2ZWEzIHwKCkRyb3BwaW5nIHRoZW0gb25seSBjaGFuZ2VzIHdoZXJlIHRoZSBmaXggbGl2ZXMgKHVwc3RyZWFtIHRhcmJhbGwgdnMuIGxvY2FsCnBhdGNoKTsgQ1ZFIGNvdmVyYWdlIGlzIHByZXNlcnZlZC4KCiMjIFNjb3BlCgpQYXRjaGVzIGAwMDA0YCBhbmQgYDAwMDVgIGFyZSAqKm5vdCoqIHlldCB1cHN0cmVhbSBhbmQgc3RpbGwgYXBwbHkgY2xlYW5seQooZm9yd2FyZCwgbm8gZnV6eikgaW4gc29ydGVkIG9yZGVyIOKAlCB2ZXJpZmllZCBhZ2FpbnN0IHRoZSBhY3R1YWwKYGtleXN0b25lLXN0YWJsZS0yMDI1LjJgIHRhcmJhbGwuIFRoZXkga2VlcCB0aGVpciBgMDAwNGAvYDAwMDVgIG51bWJlcmluZwpyYXRoZXIgdGhhbiBiZWluZyByZXNlcXVlbmNlZCwgbWF0Y2hpbmcgdGhlIGNvbnZlbnRpb24gdXNlZCB3aGVuIGFuCnVwc3RyZWFtZWQgcGF0Y2ggaXMgZHJvcHBlZCBmcm9tIGEgbnVtYmVyZWQgc2VyaWVzIChlLmcuIGI3NjllYjEgLyAjNjQ4LAp3aGljaCByZW1vdmVkIGBuZXRhcHAtMDFgIGFuZCBsZWZ0IGBuZXRhcHAtMDJgL2AwM2AgaW4gcGxhY2UpLgoK8J+kliBHZW5lcmF0ZWQgd2l0aCBbQ2xhdWRlIENvZGVdKGh0dHBzOi8vY2xhdWRlLmNvbS9jbGF1ZGUtY29kZSk=
      patchset: 388d903d605be6af2390a85499ffeac73d6a0497
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 019f0261a526db7d8989ff1abefc2299a8c0ffbc
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_0/github.com/osism/container-images-kolla:
            canonical_name: github.com/osism/container-images-kolla
            checkout: main
            commit: 1e724ecad3fee71f25ae80f0b7ae087969cecda5
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 019f0261a526db7d8989ff1abefc2299a8c0ffbc
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          untrusted/project_3/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
        playbooks:
        - path: untrusted/project_0/github.com/osism/container-images-kolla/playbooks/patch.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_3/zuul-jobs
            link_target: untrusted/project_3/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_3/zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/container-images-kolla
        name: osism/container-images-kolla
        short_name: container-images-kolla
        src_dir: src/github.com/osism/container-images-kolla
      projects:
        github.com/osism/container-images-kolla:
          canonical_hostname: github.com
          canonical_name: github.com/osism/container-images-kolla
          checkout: main
          checkout_description: zuul branch
          commit: 1e724ecad3fee71f25ae80f0b7ae087969cecda5
          name: osism/container-images-kolla
          required: false
          short_name: container-images-kolla
          src_dir: src/github.com/osism/container-images-kolla
      ref: refs/pull/736/head
      resources: {}
      tenant: osism
      timeout: 10800
      topic: null
      voting: true
