all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    ubuntu-noble-large:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe35:9602
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      kubernetes_version: v1.34
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: eeb5340b-da96-4eca-a85c-f37dfd943d0d
        host_id: df70f2a3f3d0c26428f22685cfc722ebc48099d99e7332c39e017195
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe35:9602
        label: ubuntu-noble-large
        node_properties: {}
        private_ipv4: 10.128.0.107
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.250
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe35:9602
        region: null
        slot: null
      upload_image: false
      variant: gardener
  vars:
    kubernetes_version: v1.34
    upload_image: false
    variant: gardener
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job abstract-k8s-capi-images-build explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/k8s-capi-images/.zuul.yaml@main#31>'
      - '<Job k8s-capi-images-build-v1.34-gardener explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/k8s-capi-images/.zuul.yaml@main#87>'
      - '<Job k8s-capi-images-build-v1.34-gardener explicit: None implied: None source:
        osism/k8s-capi-images/.zuul.yaml@main#243>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: a7dcce381f6947f6a8f9ce934e1162f6
      build_refs:
      - branch: main
        change: '339'
        change_message: "Validate built CAPI images with goss (reuse upstream image-builder
          specs)\n\nCloses #338\n\nValidate every built CAPI image against the upstream
          Image Builder goss spec \u2014 the same spec [kubernetes-sigs/image-builder](https://github.com/kubernetes-sigs/image-builder/)
          uses \u2014 by booting the image and running `goss validate` inside it,
          so an image that diverges from what upstream produces is caught before it
          can be published.\n\n## Why a booted VM rather than a chroot\n\nService-running
          and live sysctl checks need a real init system, so an offline chroot can't
          cover them. The image is therefore booted under QEMU and goss runs inside
          the guest. To keep the published artifact bit-identical, the VM boots a
          disposable copy-on-write overlay whose backing file is the built qcow2 (all
          guest writes land in the throwaway overlay); the build's checksum is re-verified
          afterwards to prove the artifact was untouched. The VM boots under QEMU
          with KVM acceleration.\n\n## Change set, in commit order\n\n1. **`6167045`
          Add QEMU boot and cloud-init seed tooling to the build host** \u2014 `playbooks/pre.yml`
          installs `qemu-system-x86` (boots the image) and `cloud-image-utils` (provides
          `cloud-localds` for the NoCloud seed ISO). `qemu-utils` already supplied
          `qemu-img` for the overlay.\n\n2. **`d8bb2b6` Add goss `--vars-inline` renderer
          from image-builder config** \u2014 `scripts/render-goss-vars.py` reproduces
          the `vars_inline` object that upstream's Packer goss provisioner feeds the
          spec, by merging `packer/config/*.json` in the same fixed order as `elements/k8s-capi/install.d/60-run-image-builder`
          and applying the per-build override last. Required keys are asserted so
          a stale config layout fails loudly instead of running a silently degraded
          validation.\n\n3. **`697d239` Validate built CAPI images with goss in a
          QEMU overlay boot** \u2014 `playbooks/validate.yml`: boots the overlay,
          seeds it with cloud-init, re-clones the goss spec from image-builder at
          the same SHA-pinned `DIB_K8S_IMAGE_BUILDER_REF` the build uses (not vendored,
          to avoid drift), runs the pinned-and-checksummed `goss` 0.3.23 inside the
          VM, and fails the build on any failed assertion. The JSON report and console
          log are saved under `zuul-output/logs/`; the overlay, seed, and clone are
          cleaned up on every exit path, and the `always:` teardown re-verifies the
          artifact checksum. Job vars that flow into file paths (`kubernetes_version`,
          `variant`) are validated against `[A-Za-z0-9._-]` up front to guard against
          speculative `.zuul.yaml` changes.\n\n4. **`ad5f8e4` Wire goss validation
          into Zuul build and publish gating** \u2014 `.zuul.yaml` appends `playbooks/validate.yml`
          to the abstract build job's `run` list, so all eight check jobs (v1.33\u2013v1.36
          and the `-gardener` variants) validate after building, and the still-commented
          publish jobs inherit it. The arming comment is updated: because the upload
          tasks currently sit at the tail of `build.yml` (which runs *before* `validate.yml`),
          arming publish must relocate them into a new `playbooks/publish.yml` appended
          *after* `validate.yml`, so a failed validation gates upload.\n\n5. **`204652a`
          Document the goss image-validation step** \u2014 adds a \"Validating images\"
          section to `README.md` (overlay boot, bit-identical artifact + checksum
          re-verification, SHA-pinned spec reuse, failed-assertion-fails-build) and
          cross-references it from `elements/k8s-capi/README.rst`, which notes the
          element deliberately drops image-builder's Packer-only goss plumbing.\n\n##
          Notes for the reviewer\n\n- Validation lives in the shared abstract job,
          so it is inherited by the publish jobs even though they remain commented
          out; publishing is not armed by this PR.\n- The goss spec is re-cloned (not
          vendored) to honor the existing supply-chain model; both the spec ref and
          the goss binary are pinned the same way the build already pins its inputs.\n-
          No divergence from the issue was observed in the commits: the work reuses
          the upstream image-builder goss specs as #338 asks, with the booted-VM overlay
          approach chosen specifically so service/sysctl checks pass while the published
          image stays untouched.\n\n---\n\n_Implemented by [planwerk-agent](https://github.com/planwerk/planwerk-agent)
          84299e2 with Claude:claude-opus-4-8_\n"
        change_url: https://github.com/osism/k8s-capi-images/pull/339
        commit_id: 204652a39f3978e821389ba25d0b91d7524959d6
        patchset: 204652a39f3978e821389ba25d0b91d7524959d6
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/k8s-capi-images
          name: osism/k8s-capi-images
          short_name: k8s-capi-images
        src_dir: src/github.com/osism/k8s-capi-images
        topic: null
      buildset: aa0fa1c4f1db4bc7818a8427e2bd00a4
      buildset_refs:
      - branch: main
        change: '339'
        change_message: "Validate built CAPI images with goss (reuse upstream image-builder
          specs)\n\nCloses #338\n\nValidate every built CAPI image against the upstream
          Image Builder goss spec \u2014 the same spec [kubernetes-sigs/image-builder](https://github.com/kubernetes-sigs/image-builder/)
          uses \u2014 by booting the image and running `goss validate` inside it,
          so an image that diverges from what upstream produces is caught before it
          can be published.\n\n## Why a booted VM rather than a chroot\n\nService-running
          and live sysctl checks need a real init system, so an offline chroot can't
          cover them. The image is therefore booted under QEMU and goss runs inside
          the guest. To keep the published artifact bit-identical, the VM boots a
          disposable copy-on-write overlay whose backing file is the built qcow2 (all
          guest writes land in the throwaway overlay); the build's checksum is re-verified
          afterwards to prove the artifact was untouched. The VM boots under QEMU
          with KVM acceleration.\n\n## Change set, in commit order\n\n1. **`6167045`
          Add QEMU boot and cloud-init seed tooling to the build host** \u2014 `playbooks/pre.yml`
          installs `qemu-system-x86` (boots the image) and `cloud-image-utils` (provides
          `cloud-localds` for the NoCloud seed ISO). `qemu-utils` already supplied
          `qemu-img` for the overlay.\n\n2. **`d8bb2b6` Add goss `--vars-inline` renderer
          from image-builder config** \u2014 `scripts/render-goss-vars.py` reproduces
          the `vars_inline` object that upstream's Packer goss provisioner feeds the
          spec, by merging `packer/config/*.json` in the same fixed order as `elements/k8s-capi/install.d/60-run-image-builder`
          and applying the per-build override last. Required keys are asserted so
          a stale config layout fails loudly instead of running a silently degraded
          validation.\n\n3. **`697d239` Validate built CAPI images with goss in a
          QEMU overlay boot** \u2014 `playbooks/validate.yml`: boots the overlay,
          seeds it with cloud-init, re-clones the goss spec from image-builder at
          the same SHA-pinned `DIB_K8S_IMAGE_BUILDER_REF` the build uses (not vendored,
          to avoid drift), runs the pinned-and-checksummed `goss` 0.3.23 inside the
          VM, and fails the build on any failed assertion. The JSON report and console
          log are saved under `zuul-output/logs/`; the overlay, seed, and clone are
          cleaned up on every exit path, and the `always:` teardown re-verifies the
          artifact checksum. Job vars that flow into file paths (`kubernetes_version`,
          `variant`) are validated against `[A-Za-z0-9._-]` up front to guard against
          speculative `.zuul.yaml` changes.\n\n4. **`ad5f8e4` Wire goss validation
          into Zuul build and publish gating** \u2014 `.zuul.yaml` appends `playbooks/validate.yml`
          to the abstract build job's `run` list, so all eight check jobs (v1.33\u2013v1.36
          and the `-gardener` variants) validate after building, and the still-commented
          publish jobs inherit it. The arming comment is updated: because the upload
          tasks currently sit at the tail of `build.yml` (which runs *before* `validate.yml`),
          arming publish must relocate them into a new `playbooks/publish.yml` appended
          *after* `validate.yml`, so a failed validation gates upload.\n\n5. **`204652a`
          Document the goss image-validation step** \u2014 adds a \"Validating images\"
          section to `README.md` (overlay boot, bit-identical artifact + checksum
          re-verification, SHA-pinned spec reuse, failed-assertion-fails-build) and
          cross-references it from `elements/k8s-capi/README.rst`, which notes the
          element deliberately drops image-builder's Packer-only goss plumbing.\n\n##
          Notes for the reviewer\n\n- Validation lives in the shared abstract job,
          so it is inherited by the publish jobs even though they remain commented
          out; publishing is not armed by this PR.\n- The goss spec is re-cloned (not
          vendored) to honor the existing supply-chain model; both the spec ref and
          the goss binary are pinned the same way the build already pins its inputs.\n-
          No divergence from the issue was observed in the commits: the work reuses
          the upstream image-builder goss specs as #338 asks, with the booted-VM overlay
          approach chosen specifically so service/sysctl checks pass while the published
          image stays untouched.\n\n---\n\n_Implemented by [planwerk-agent](https://github.com/planwerk/planwerk-agent)
          84299e2 with Claude:claude-opus-4-8_\n"
        change_url: https://github.com/osism/k8s-capi-images/pull/339
        commit_id: 204652a39f3978e821389ba25d0b91d7524959d6
        patchset: 204652a39f3978e821389ba25d0b91d7524959d6
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/k8s-capi-images
          name: osism/k8s-capi-images
          short_name: k8s-capi-images
        src_dir: src/github.com/osism/k8s-capi-images
        topic: null
      change: '339'
      change_message: "Validate built CAPI images with goss (reuse upstream image-builder
        specs)\n\nCloses #338\n\nValidate every built CAPI image against the upstream
        Image Builder goss spec \u2014 the same spec [kubernetes-sigs/image-builder](https://github.com/kubernetes-sigs/image-builder/)
        uses \u2014 by booting the image and running `goss validate` inside it, so
        an image that diverges from what upstream produces is caught before it can
        be published.\n\n## Why a booted VM rather than a chroot\n\nService-running
        and live sysctl checks need a real init system, so an offline chroot can't
        cover them. The image is therefore booted under QEMU and goss runs inside
        the guest. To keep the published artifact bit-identical, the VM boots a disposable
        copy-on-write overlay whose backing file is the built qcow2 (all guest writes
        land in the throwaway overlay); the build's checksum is re-verified afterwards
        to prove the artifact was untouched. The VM boots under QEMU with KVM acceleration.\n\n##
        Change set, in commit order\n\n1. **`6167045` Add QEMU boot and cloud-init
        seed tooling to the build host** \u2014 `playbooks/pre.yml` installs `qemu-system-x86`
        (boots the image) and `cloud-image-utils` (provides `cloud-localds` for the
        NoCloud seed ISO). `qemu-utils` already supplied `qemu-img` for the overlay.\n\n2.
        **`d8bb2b6` Add goss `--vars-inline` renderer from image-builder config**
        \u2014 `scripts/render-goss-vars.py` reproduces the `vars_inline` object that
        upstream's Packer goss provisioner feeds the spec, by merging `packer/config/*.json`
        in the same fixed order as `elements/k8s-capi/install.d/60-run-image-builder`
        and applying the per-build override last. Required keys are asserted so a
        stale config layout fails loudly instead of running a silently degraded validation.\n\n3.
        **`697d239` Validate built CAPI images with goss in a QEMU overlay boot**
        \u2014 `playbooks/validate.yml`: boots the overlay, seeds it with cloud-init,
        re-clones the goss spec from image-builder at the same SHA-pinned `DIB_K8S_IMAGE_BUILDER_REF`
        the build uses (not vendored, to avoid drift), runs the pinned-and-checksummed
        `goss` 0.3.23 inside the VM, and fails the build on any failed assertion.
        The JSON report and console log are saved under `zuul-output/logs/`; the overlay,
        seed, and clone are cleaned up on every exit path, and the `always:` teardown
        re-verifies the artifact checksum. Job vars that flow into file paths (`kubernetes_version`,
        `variant`) are validated against `[A-Za-z0-9._-]` up front to guard against
        speculative `.zuul.yaml` changes.\n\n4. **`ad5f8e4` Wire goss validation into
        Zuul build and publish gating** \u2014 `.zuul.yaml` appends `playbooks/validate.yml`
        to the abstract build job's `run` list, so all eight check jobs (v1.33\u2013v1.36
        and the `-gardener` variants) validate after building, and the still-commented
        publish jobs inherit it. The arming comment is updated: because the upload
        tasks currently sit at the tail of `build.yml` (which runs *before* `validate.yml`),
        arming publish must relocate them into a new `playbooks/publish.yml` appended
        *after* `validate.yml`, so a failed validation gates upload.\n\n5. **`204652a`
        Document the goss image-validation step** \u2014 adds a \"Validating images\"
        section to `README.md` (overlay boot, bit-identical artifact + checksum re-verification,
        SHA-pinned spec reuse, failed-assertion-fails-build) and cross-references
        it from `elements/k8s-capi/README.rst`, which notes the element deliberately
        drops image-builder's Packer-only goss plumbing.\n\n## Notes for the reviewer\n\n-
        Validation lives in the shared abstract job, so it is inherited by the publish
        jobs even though they remain commented out; publishing is not armed by this
        PR.\n- The goss spec is re-cloned (not vendored) to honor the existing supply-chain
        model; both the spec ref and the goss binary are pinned the same way the build
        already pins its inputs.\n- No divergence from the issue was observed in the
        commits: the work reuses the upstream image-builder goss specs as #338 asks,
        with the booted-VM overlay approach chosen specifically so service/sysctl
        checks pass while the published image stays untouched.\n\n---\n\n_Implemented
        by [planwerk-agent](https://github.com/planwerk/planwerk-agent) 84299e2 with
        Claude:claude-opus-4-8_\n"
      change_url: https://github.com/osism/k8s-capi-images/pull/339
      child_jobs: []
      commit_id: 204652a39f3978e821389ba25d0b91d7524959d6
      event_id: 7844a9c0-7444-11f1-823c-189610b80211
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/a7dcce381f6947f6a8f9ce934e1162f6/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/a7dcce381f6947f6a8f9ce934e1162f6/work/logs
        result_data_file: /var/lib/zuul/builds/a7dcce381f6947f6a8f9ce934e1162f6/work/results.json
        src_root: /var/lib/zuul/builds/a7dcce381f6947f6a8f9ce934e1162f6/work/src
        work_root: /var/lib/zuul/builds/a7dcce381f6947f6a8f9ce934e1162f6/work
      include_vars: []
      items:
      - branch: main
        change: '339'
        change_message: "Validate built CAPI images with goss (reuse upstream image-builder
          specs)\n\nCloses #338\n\nValidate every built CAPI image against the upstream
          Image Builder goss spec \u2014 the same spec [kubernetes-sigs/image-builder](https://github.com/kubernetes-sigs/image-builder/)
          uses \u2014 by booting the image and running `goss validate` inside it,
          so an image that diverges from what upstream produces is caught before it
          can be published.\n\n## Why a booted VM rather than a chroot\n\nService-running
          and live sysctl checks need a real init system, so an offline chroot can't
          cover them. The image is therefore booted under QEMU and goss runs inside
          the guest. To keep the published artifact bit-identical, the VM boots a
          disposable copy-on-write overlay whose backing file is the built qcow2 (all
          guest writes land in the throwaway overlay); the build's checksum is re-verified
          afterwards to prove the artifact was untouched. The VM boots under QEMU
          with KVM acceleration.\n\n## Change set, in commit order\n\n1. **`6167045`
          Add QEMU boot and cloud-init seed tooling to the build host** \u2014 `playbooks/pre.yml`
          installs `qemu-system-x86` (boots the image) and `cloud-image-utils` (provides
          `cloud-localds` for the NoCloud seed ISO). `qemu-utils` already supplied
          `qemu-img` for the overlay.\n\n2. **`d8bb2b6` Add goss `--vars-inline` renderer
          from image-builder config** \u2014 `scripts/render-goss-vars.py` reproduces
          the `vars_inline` object that upstream's Packer goss provisioner feeds the
          spec, by merging `packer/config/*.json` in the same fixed order as `elements/k8s-capi/install.d/60-run-image-builder`
          and applying the per-build override last. Required keys are asserted so
          a stale config layout fails loudly instead of running a silently degraded
          validation.\n\n3. **`697d239` Validate built CAPI images with goss in a
          QEMU overlay boot** \u2014 `playbooks/validate.yml`: boots the overlay,
          seeds it with cloud-init, re-clones the goss spec from image-builder at
          the same SHA-pinned `DIB_K8S_IMAGE_BUILDER_REF` the build uses (not vendored,
          to avoid drift), runs the pinned-and-checksummed `goss` 0.3.23 inside the
          VM, and fails the build on any failed assertion. The JSON report and console
          log are saved under `zuul-output/logs/`; the overlay, seed, and clone are
          cleaned up on every exit path, and the `always:` teardown re-verifies the
          artifact checksum. Job vars that flow into file paths (`kubernetes_version`,
          `variant`) are validated against `[A-Za-z0-9._-]` up front to guard against
          speculative `.zuul.yaml` changes.\n\n4. **`ad5f8e4` Wire goss validation
          into Zuul build and publish gating** \u2014 `.zuul.yaml` appends `playbooks/validate.yml`
          to the abstract build job's `run` list, so all eight check jobs (v1.33\u2013v1.36
          and the `-gardener` variants) validate after building, and the still-commented
          publish jobs inherit it. The arming comment is updated: because the upload
          tasks currently sit at the tail of `build.yml` (which runs *before* `validate.yml`),
          arming publish must relocate them into a new `playbooks/publish.yml` appended
          *after* `validate.yml`, so a failed validation gates upload.\n\n5. **`204652a`
          Document the goss image-validation step** \u2014 adds a \"Validating images\"
          section to `README.md` (overlay boot, bit-identical artifact + checksum
          re-verification, SHA-pinned spec reuse, failed-assertion-fails-build) and
          cross-references it from `elements/k8s-capi/README.rst`, which notes the
          element deliberately drops image-builder's Packer-only goss plumbing.\n\n##
          Notes for the reviewer\n\n- Validation lives in the shared abstract job,
          so it is inherited by the publish jobs even though they remain commented
          out; publishing is not armed by this PR.\n- The goss spec is re-cloned (not
          vendored) to honor the existing supply-chain model; both the spec ref and
          the goss binary are pinned the same way the build already pins its inputs.\n-
          No divergence from the issue was observed in the commits: the work reuses
          the upstream image-builder goss specs as #338 asks, with the booted-VM overlay
          approach chosen specifically so service/sysctl checks pass while the published
          image stays untouched.\n\n---\n\n_Implemented by [planwerk-agent](https://github.com/planwerk/planwerk-agent)
          84299e2 with Claude:claude-opus-4-8_\n"
        change_url: https://github.com/osism/k8s-capi-images/pull/339
        commit_id: 204652a39f3978e821389ba25d0b91d7524959d6
        patchset: 204652a39f3978e821389ba25d0b91d7524959d6
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/k8s-capi-images
          name: osism/k8s-capi-images
          short_name: k8s-capi-images
          src_dir: src/github.com/osism/k8s-capi-images
        topic: null
      job: k8s-capi-images-build-v1.34-gardener
      jobtags: []
      max_attempts: 3
      message: VmFsaWRhdGUgYnVpbHQgQ0FQSSBpbWFnZXMgd2l0aCBnb3NzIChyZXVzZSB1cHN0cmVhbSBpbWFnZS1idWlsZGVyIHNwZWNzKQoKQ2xvc2VzICMzMzgKClZhbGlkYXRlIGV2ZXJ5IGJ1aWx0IENBUEkgaW1hZ2UgYWdhaW5zdCB0aGUgdXBzdHJlYW0gSW1hZ2UgQnVpbGRlciBnb3NzIHNwZWMg4oCUIHRoZSBzYW1lIHNwZWMgW2t1YmVybmV0ZXMtc2lncy9pbWFnZS1idWlsZGVyXShodHRwczovL2dpdGh1Yi5jb20va3ViZXJuZXRlcy1zaWdzL2ltYWdlLWJ1aWxkZXIvKSB1c2VzIOKAlCBieSBib290aW5nIHRoZSBpbWFnZSBhbmQgcnVubmluZyBgZ29zcyB2YWxpZGF0ZWAgaW5zaWRlIGl0LCBzbyBhbiBpbWFnZSB0aGF0IGRpdmVyZ2VzIGZyb20gd2hhdCB1cHN0cmVhbSBwcm9kdWNlcyBpcyBjYXVnaHQgYmVmb3JlIGl0IGNhbiBiZSBwdWJsaXNoZWQuCgojIyBXaHkgYSBib290ZWQgVk0gcmF0aGVyIHRoYW4gYSBjaHJvb3QKClNlcnZpY2UtcnVubmluZyBhbmQgbGl2ZSBzeXNjdGwgY2hlY2tzIG5lZWQgYSByZWFsIGluaXQgc3lzdGVtLCBzbyBhbiBvZmZsaW5lIGNocm9vdCBjYW4ndCBjb3ZlciB0aGVtLiBUaGUgaW1hZ2UgaXMgdGhlcmVmb3JlIGJvb3RlZCB1bmRlciBRRU1VIGFuZCBnb3NzIHJ1bnMgaW5zaWRlIHRoZSBndWVzdC4gVG8ga2VlcCB0aGUgcHVibGlzaGVkIGFydGlmYWN0IGJpdC1pZGVudGljYWwsIHRoZSBWTSBib290cyBhIGRpc3Bvc2FibGUgY29weS1vbi13cml0ZSBvdmVybGF5IHdob3NlIGJhY2tpbmcgZmlsZSBpcyB0aGUgYnVpbHQgcWNvdzIgKGFsbCBndWVzdCB3cml0ZXMgbGFuZCBpbiB0aGUgdGhyb3dhd2F5IG92ZXJsYXkpOyB0aGUgYnVpbGQncyBjaGVja3N1bSBpcyByZS12ZXJpZmllZCBhZnRlcndhcmRzIHRvIHByb3ZlIHRoZSBhcnRpZmFjdCB3YXMgdW50b3VjaGVkLiBUaGUgVk0gYm9vdHMgdW5kZXIgUUVNVSB3aXRoIEtWTSBhY2NlbGVyYXRpb24uCgojIyBDaGFuZ2Ugc2V0LCBpbiBjb21taXQgb3JkZXIKCjEuICoqYDYxNjcwNDVgIEFkZCBRRU1VIGJvb3QgYW5kIGNsb3VkLWluaXQgc2VlZCB0b29saW5nIHRvIHRoZSBidWlsZCBob3N0Kiog4oCUIGBwbGF5Ym9va3MvcHJlLnltbGAgaW5zdGFsbHMgYHFlbXUtc3lzdGVtLXg4NmAgKGJvb3RzIHRoZSBpbWFnZSkgYW5kIGBjbG91ZC1pbWFnZS11dGlsc2AgKHByb3ZpZGVzIGBjbG91ZC1sb2NhbGRzYCBmb3IgdGhlIE5vQ2xvdWQgc2VlZCBJU08pLiBgcWVtdS11dGlsc2AgYWxyZWFkeSBzdXBwbGllZCBgcWVtdS1pbWdgIGZvciB0aGUgb3ZlcmxheS4KCjIuICoqYGQ4YmIyYjZgIEFkZCBnb3NzIGAtLXZhcnMtaW5saW5lYCByZW5kZXJlciBmcm9tIGltYWdlLWJ1aWxkZXIgY29uZmlnKiog4oCUIGBzY3JpcHRzL3JlbmRlci1nb3NzLXZhcnMucHlgIHJlcHJvZHVjZXMgdGhlIGB2YXJzX2lubGluZWAgb2JqZWN0IHRoYXQgdXBzdHJlYW0ncyBQYWNrZXIgZ29zcyBwcm92aXNpb25lciBmZWVkcyB0aGUgc3BlYywgYnkgbWVyZ2luZyBgcGFja2VyL2NvbmZpZy8qLmpzb25gIGluIHRoZSBzYW1lIGZpeGVkIG9yZGVyIGFzIGBlbGVtZW50cy9rOHMtY2FwaS9pbnN0YWxsLmQvNjAtcnVuLWltYWdlLWJ1aWxkZXJgIGFuZCBhcHBseWluZyB0aGUgcGVyLWJ1aWxkIG92ZXJyaWRlIGxhc3QuIFJlcXVpcmVkIGtleXMgYXJlIGFzc2VydGVkIHNvIGEgc3RhbGUgY29uZmlnIGxheW91dCBmYWlscyBsb3VkbHkgaW5zdGVhZCBvZiBydW5uaW5nIGEgc2lsZW50bHkgZGVncmFkZWQgdmFsaWRhdGlvbi4KCjMuICoqYDY5N2QyMzlgIFZhbGlkYXRlIGJ1aWx0IENBUEkgaW1hZ2VzIHdpdGggZ29zcyBpbiBhIFFFTVUgb3ZlcmxheSBib290Kiog4oCUIGBwbGF5Ym9va3MvdmFsaWRhdGUueW1sYDogYm9vdHMgdGhlIG92ZXJsYXksIHNlZWRzIGl0IHdpdGggY2xvdWQtaW5pdCwgcmUtY2xvbmVzIHRoZSBnb3NzIHNwZWMgZnJvbSBpbWFnZS1idWlsZGVyIGF0IHRoZSBzYW1lIFNIQS1waW5uZWQgYERJQl9LOFNfSU1BR0VfQlVJTERFUl9SRUZgIHRoZSBidWlsZCB1c2VzIChub3QgdmVuZG9yZWQsIHRvIGF2b2lkIGRyaWZ0KSwgcnVucyB0aGUgcGlubmVkLWFuZC1jaGVja3N1bW1lZCBgZ29zc2AgMC4zLjIzIGluc2lkZSB0aGUgVk0sIGFuZCBmYWlscyB0aGUgYnVpbGQgb24gYW55IGZhaWxlZCBhc3NlcnRpb24uIFRoZSBKU09OIHJlcG9ydCBhbmQgY29uc29sZSBsb2cgYXJlIHNhdmVkIHVuZGVyIGB6dXVsLW91dHB1dC9sb2dzL2A7IHRoZSBvdmVybGF5LCBzZWVkLCBhbmQgY2xvbmUgYXJlIGNsZWFuZWQgdXAgb24gZXZlcnkgZXhpdCBwYXRoLCBhbmQgdGhlIGBhbHdheXM6YCB0ZWFyZG93biByZS12ZXJpZmllcyB0aGUgYXJ0aWZhY3QgY2hlY2tzdW0uIEpvYiB2YXJzIHRoYXQgZmxvdyBpbnRvIGZpbGUgcGF0aHMgKGBrdWJlcm5ldGVzX3ZlcnNpb25gLCBgdmFyaWFudGApIGFyZSB2YWxpZGF0ZWQgYWdhaW5zdCBgW0EtWmEtejAtOS5fLV1gIHVwIGZyb250IHRvIGd1YXJkIGFnYWluc3Qgc3BlY3VsYXRpdmUgYC56dXVsLnlhbWxgIGNoYW5nZXMuCgo0LiAqKmBhZDVmOGU0YCBXaXJlIGdvc3MgdmFsaWRhdGlvbiBpbnRvIFp1dWwgYnVpbGQgYW5kIHB1Ymxpc2ggZ2F0aW5nKiog4oCUIGAuenV1bC55YW1sYCBhcHBlbmRzIGBwbGF5Ym9va3MvdmFsaWRhdGUueW1sYCB0byB0aGUgYWJzdHJhY3QgYnVpbGQgam9iJ3MgYHJ1bmAgbGlzdCwgc28gYWxsIGVpZ2h0IGNoZWNrIGpvYnMgKHYxLjMz4oCTdjEuMzYgYW5kIHRoZSBgLWdhcmRlbmVyYCB2YXJpYW50cykgdmFsaWRhdGUgYWZ0ZXIgYnVpbGRpbmcsIGFuZCB0aGUgc3RpbGwtY29tbWVudGVkIHB1Ymxpc2ggam9icyBpbmhlcml0IGl0LiBUaGUgYXJtaW5nIGNvbW1lbnQgaXMgdXBkYXRlZDogYmVjYXVzZSB0aGUgdXBsb2FkIHRhc2tzIGN1cnJlbnRseSBzaXQgYXQgdGhlIHRhaWwgb2YgYGJ1aWxkLnltbGAgKHdoaWNoIHJ1bnMgKmJlZm9yZSogYHZhbGlkYXRlLnltbGApLCBhcm1pbmcgcHVibGlzaCBtdXN0IHJlbG9jYXRlIHRoZW0gaW50byBhIG5ldyBgcGxheWJvb2tzL3B1Ymxpc2gueW1sYCBhcHBlbmRlZCAqYWZ0ZXIqIGB2YWxpZGF0ZS55bWxgLCBzbyBhIGZhaWxlZCB2YWxpZGF0aW9uIGdhdGVzIHVwbG9hZC4KCjUuICoqYDIwNDY1MmFgIERvY3VtZW50IHRoZSBnb3NzIGltYWdlLXZhbGlkYXRpb24gc3RlcCoqIOKAlCBhZGRzIGEgIlZhbGlkYXRpbmcgaW1hZ2VzIiBzZWN0aW9uIHRvIGBSRUFETUUubWRgIChvdmVybGF5IGJvb3QsIGJpdC1pZGVudGljYWwgYXJ0aWZhY3QgKyBjaGVja3N1bSByZS12ZXJpZmljYXRpb24sIFNIQS1waW5uZWQgc3BlYyByZXVzZSwgZmFpbGVkLWFzc2VydGlvbi1mYWlscy1idWlsZCkgYW5kIGNyb3NzLXJlZmVyZW5jZXMgaXQgZnJvbSBgZWxlbWVudHMvazhzLWNhcGkvUkVBRE1FLnJzdGAsIHdoaWNoIG5vdGVzIHRoZSBlbGVtZW50IGRlbGliZXJhdGVseSBkcm9wcyBpbWFnZS1idWlsZGVyJ3MgUGFja2VyLW9ubHkgZ29zcyBwbHVtYmluZy4KCiMjIE5vdGVzIGZvciB0aGUgcmV2aWV3ZXIKCi0gVmFsaWRhdGlvbiBsaXZlcyBpbiB0aGUgc2hhcmVkIGFic3RyYWN0IGpvYiwgc28gaXQgaXMgaW5oZXJpdGVkIGJ5IHRoZSBwdWJsaXNoIGpvYnMgZXZlbiB0aG91Z2ggdGhleSByZW1haW4gY29tbWVudGVkIG91dDsgcHVibGlzaGluZyBpcyBub3QgYXJtZWQgYnkgdGhpcyBQUi4KLSBUaGUgZ29zcyBzcGVjIGlzIHJlLWNsb25lZCAobm90IHZlbmRvcmVkKSB0byBob25vciB0aGUgZXhpc3Rpbmcgc3VwcGx5LWNoYWluIG1vZGVsOyBib3RoIHRoZSBzcGVjIHJlZiBhbmQgdGhlIGdvc3MgYmluYXJ5IGFyZSBwaW5uZWQgdGhlIHNhbWUgd2F5IHRoZSBidWlsZCBhbHJlYWR5IHBpbnMgaXRzIGlucHV0cy4KLSBObyBkaXZlcmdlbmNlIGZyb20gdGhlIGlzc3VlIHdhcyBvYnNlcnZlZCBpbiB0aGUgY29tbWl0czogdGhlIHdvcmsgcmV1c2VzIHRoZSB1cHN0cmVhbSBpbWFnZS1idWlsZGVyIGdvc3Mgc3BlY3MgYXMgIzMzOCBhc2tzLCB3aXRoIHRoZSBib290ZWQtVk0gb3ZlcmxheSBhcHByb2FjaCBjaG9zZW4gc3BlY2lmaWNhbGx5IHNvIHNlcnZpY2Uvc3lzY3RsIGNoZWNrcyBwYXNzIHdoaWxlIHRoZSBwdWJsaXNoZWQgaW1hZ2Ugc3RheXMgdW50b3VjaGVkLgoKLS0tCgpfSW1wbGVtZW50ZWQgYnkgW3BsYW53ZXJrLWFnZW50XShodHRwczovL2dpdGh1Yi5jb20vcGxhbndlcmsvcGxhbndlcmstYWdlbnQpIDg0Mjk5ZTIgd2l0aCBDbGF1ZGU6Y2xhdWRlLW9wdXMtNC04Xwo=
      patchset: 204652a39f3978e821389ba25d0b91d7524959d6
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/k8s-capi-images:
            canonical_name: github.com/osism/k8s-capi-images
            checkout: main
            commit: 6858cae7928b0c2f7dfa71ed94d60df30b8a5298
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          untrusted/project_3/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
        playbooks:
        - path: untrusted/project_0/github.com/osism/k8s-capi-images/playbooks/build.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_3/zuul-jobs
            link_target: untrusted/project_3/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_3/zuul-jobs/roles
        - path: untrusted/project_0/github.com/osism/k8s-capi-images/playbooks/validate.yml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_1/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_1/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_1/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_1/role_2/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_1/role_3/zuul-jobs
            link_target: untrusted/project_3/github.com/osism/zuul-jobs
            role_path: ansible/playbook_1/role_3/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/k8s-capi-images
        name: osism/k8s-capi-images
        short_name: k8s-capi-images
        src_dir: src/github.com/osism/k8s-capi-images
      projects:
        github.com/osism/k8s-capi-images:
          canonical_hostname: github.com
          canonical_name: github.com/osism/k8s-capi-images
          checkout: main
          checkout_description: zuul branch
          commit: 6858cae7928b0c2f7dfa71ed94d60df30b8a5298
          name: osism/k8s-capi-images
          required: false
          short_name: k8s-capi-images
          src_dir: src/github.com/osism/k8s-capi-images
      ref: refs/pull/339/head
      resources: {}
      tenant: osism
      timeout: 7200
      topic: null
      voting: true
