all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe25:c64d
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 06303709-b42f-4ed2-9f42-c2e258144c1b
        host_id: df70f2a3f3d0c26428f22685cfc722ebc48099d99e7332c39e017195
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe25:c64d
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.0.100
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.68
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe25:c64d
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job mypy explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#42>'
      - '<Job mypy explicit: None implied: None source: osism/python-osism/.zuul.yaml@main#143>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: bc57001f048a45aab6029138586dff68
      build_refs:
      - branch: main
        change: '2439'
        change_message: "database: detect ProxySQL DB user at connect time\n\n## Problem\n\n`osism
          status database` and `osism manage loadbalancer` open a superuser connection
          to the cluster's MariaDB, and both chose the DB user from `enable_proxysql`
          read off a raw `environments/kolla/configuration.yml` load.\n\nThat value
          is not in the operator config \u2014 it is a release-gated Jinja default
          in `osism/defaults` (`{{ 'no' if openstack_version in ['2024.1','2024.2','2025.1']
          else 'yes' }}`). A raw file read never sees it, so `config.get(\"enable_proxysql\",
          False)` always returned `False` and the commands connected as the plain
          user.\n\nOn a ProxySQL cluster (the 2025.2 default) the proxied superuser
          is the sharded name `<user>_shard_0`, so ProxySQL denies the plain user
          with a 1045 and the check fails against a perfectly healthy database:\n\n```\nERROR
          Failed to connect to MariaDB: (1045,\n  \"ProxySQL Error: Access denied
          for user 'root'@'\u2026' (using password: YES)\")\n```\n\nThe bug was latent
          before 2025.2: `enable_proxysql` defaulted to `no` on every earlier release,
          so the wrong read (`False` \u2192 plain user) happened to match reality.\n\n##
          Fix\n\nReading the value correctly would mean resolving it the way kolla-ansible
          does (Ansible templating with `openstack_version` in scope); a raw read
          \u2014 and even `ansible-inventory --host`, which returns the unrendered
          Jinja \u2014 cannot see it.\n\nInstead of resolving it, this sidesteps the
          question. New `osism/utils/mariadb.connect()` tries `<user>_shard_0` (ProxySQL)
          first and falls back to `<user>` (plain HAProxy) only on an access-denied
          error, so the connection itself selects the topology with no dependency
          on defaults resolution. Genuine connectivity failures (non-1045) surface
          immediately without a retry. Both call sites now use the helper and drop
          their duplicated `enable_proxysql`/`db_user` logic.\n\n## Tests\n\n- New
          `tests/unit/utils/test_mariadb.py`: shard-user-first success, fallback on
          1045, no retry on a non-auth error (2003), and last-error propagation when
          both users are denied.\n"
        change_url: https://github.com/osism/python-osism/pull/2439
        commit_id: 2c8038ba15452813c94a62de8747dd7cf0fad81e
        patchset: 2c8038ba15452813c94a62de8747dd7cf0fad81e
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
        src_dir: src/github.com/osism/python-osism
        topic: null
      buildset: 64dfe169e5f54ee08d8d17d649c620e9
      buildset_refs:
      - branch: main
        change: '2439'
        change_message: "database: detect ProxySQL DB user at connect time\n\n## Problem\n\n`osism
          status database` and `osism manage loadbalancer` open a superuser connection
          to the cluster's MariaDB, and both chose the DB user from `enable_proxysql`
          read off a raw `environments/kolla/configuration.yml` load.\n\nThat value
          is not in the operator config \u2014 it is a release-gated Jinja default
          in `osism/defaults` (`{{ 'no' if openstack_version in ['2024.1','2024.2','2025.1']
          else 'yes' }}`). A raw file read never sees it, so `config.get(\"enable_proxysql\",
          False)` always returned `False` and the commands connected as the plain
          user.\n\nOn a ProxySQL cluster (the 2025.2 default) the proxied superuser
          is the sharded name `<user>_shard_0`, so ProxySQL denies the plain user
          with a 1045 and the check fails against a perfectly healthy database:\n\n```\nERROR
          Failed to connect to MariaDB: (1045,\n  \"ProxySQL Error: Access denied
          for user 'root'@'\u2026' (using password: YES)\")\n```\n\nThe bug was latent
          before 2025.2: `enable_proxysql` defaulted to `no` on every earlier release,
          so the wrong read (`False` \u2192 plain user) happened to match reality.\n\n##
          Fix\n\nReading the value correctly would mean resolving it the way kolla-ansible
          does (Ansible templating with `openstack_version` in scope); a raw read
          \u2014 and even `ansible-inventory --host`, which returns the unrendered
          Jinja \u2014 cannot see it.\n\nInstead of resolving it, this sidesteps the
          question. New `osism/utils/mariadb.connect()` tries `<user>_shard_0` (ProxySQL)
          first and falls back to `<user>` (plain HAProxy) only on an access-denied
          error, so the connection itself selects the topology with no dependency
          on defaults resolution. Genuine connectivity failures (non-1045) surface
          immediately without a retry. Both call sites now use the helper and drop
          their duplicated `enable_proxysql`/`db_user` logic.\n\n## Tests\n\n- New
          `tests/unit/utils/test_mariadb.py`: shard-user-first success, fallback on
          1045, no retry on a non-auth error (2003), and last-error propagation when
          both users are denied.\n"
        change_url: https://github.com/osism/python-osism/pull/2439
        commit_id: 2c8038ba15452813c94a62de8747dd7cf0fad81e
        patchset: 2c8038ba15452813c94a62de8747dd7cf0fad81e
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
        src_dir: src/github.com/osism/python-osism
        topic: null
      change: '2439'
      change_message: "database: detect ProxySQL DB user at connect time\n\n## Problem\n\n`osism
        status database` and `osism manage loadbalancer` open a superuser connection
        to the cluster's MariaDB, and both chose the DB user from `enable_proxysql`
        read off a raw `environments/kolla/configuration.yml` load.\n\nThat value
        is not in the operator config \u2014 it is a release-gated Jinja default in
        `osism/defaults` (`{{ 'no' if openstack_version in ['2024.1','2024.2','2025.1']
        else 'yes' }}`). A raw file read never sees it, so `config.get(\"enable_proxysql\",
        False)` always returned `False` and the commands connected as the plain user.\n\nOn
        a ProxySQL cluster (the 2025.2 default) the proxied superuser is the sharded
        name `<user>_shard_0`, so ProxySQL denies the plain user with a 1045 and the
        check fails against a perfectly healthy database:\n\n```\nERROR Failed to
        connect to MariaDB: (1045,\n  \"ProxySQL Error: Access denied for user 'root'@'\u2026'
        (using password: YES)\")\n```\n\nThe bug was latent before 2025.2: `enable_proxysql`
        defaulted to `no` on every earlier release, so the wrong read (`False` \u2192
        plain user) happened to match reality.\n\n## Fix\n\nReading the value correctly
        would mean resolving it the way kolla-ansible does (Ansible templating with
        `openstack_version` in scope); a raw read \u2014 and even `ansible-inventory
        --host`, which returns the unrendered Jinja \u2014 cannot see it.\n\nInstead
        of resolving it, this sidesteps the question. New `osism/utils/mariadb.connect()`
        tries `<user>_shard_0` (ProxySQL) first and falls back to `<user>` (plain
        HAProxy) only on an access-denied error, so the connection itself selects
        the topology with no dependency on defaults resolution. Genuine connectivity
        failures (non-1045) surface immediately without a retry. Both call sites now
        use the helper and drop their duplicated `enable_proxysql`/`db_user` logic.\n\n##
        Tests\n\n- New `tests/unit/utils/test_mariadb.py`: shard-user-first success,
        fallback on 1045, no retry on a non-auth error (2003), and last-error propagation
        when both users are denied.\n"
      change_url: https://github.com/osism/python-osism/pull/2439
      child_jobs: []
      commit_id: 2c8038ba15452813c94a62de8747dd7cf0fad81e
      event_id: 71cb7480-7911-11f1-8040-b3fadd783223
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/bc57001f048a45aab6029138586dff68/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/bc57001f048a45aab6029138586dff68/work/logs
        result_data_file: /var/lib/zuul/builds/bc57001f048a45aab6029138586dff68/work/results.json
        src_root: /var/lib/zuul/builds/bc57001f048a45aab6029138586dff68/work/src
        work_root: /var/lib/zuul/builds/bc57001f048a45aab6029138586dff68/work
      include_vars: []
      items:
      - branch: main
        change: '2439'
        change_message: "database: detect ProxySQL DB user at connect time\n\n## Problem\n\n`osism
          status database` and `osism manage loadbalancer` open a superuser connection
          to the cluster's MariaDB, and both chose the DB user from `enable_proxysql`
          read off a raw `environments/kolla/configuration.yml` load.\n\nThat value
          is not in the operator config \u2014 it is a release-gated Jinja default
          in `osism/defaults` (`{{ 'no' if openstack_version in ['2024.1','2024.2','2025.1']
          else 'yes' }}`). A raw file read never sees it, so `config.get(\"enable_proxysql\",
          False)` always returned `False` and the commands connected as the plain
          user.\n\nOn a ProxySQL cluster (the 2025.2 default) the proxied superuser
          is the sharded name `<user>_shard_0`, so ProxySQL denies the plain user
          with a 1045 and the check fails against a perfectly healthy database:\n\n```\nERROR
          Failed to connect to MariaDB: (1045,\n  \"ProxySQL Error: Access denied
          for user 'root'@'\u2026' (using password: YES)\")\n```\n\nThe bug was latent
          before 2025.2: `enable_proxysql` defaulted to `no` on every earlier release,
          so the wrong read (`False` \u2192 plain user) happened to match reality.\n\n##
          Fix\n\nReading the value correctly would mean resolving it the way kolla-ansible
          does (Ansible templating with `openstack_version` in scope); a raw read
          \u2014 and even `ansible-inventory --host`, which returns the unrendered
          Jinja \u2014 cannot see it.\n\nInstead of resolving it, this sidesteps the
          question. New `osism/utils/mariadb.connect()` tries `<user>_shard_0` (ProxySQL)
          first and falls back to `<user>` (plain HAProxy) only on an access-denied
          error, so the connection itself selects the topology with no dependency
          on defaults resolution. Genuine connectivity failures (non-1045) surface
          immediately without a retry. Both call sites now use the helper and drop
          their duplicated `enable_proxysql`/`db_user` logic.\n\n## Tests\n\n- New
          `tests/unit/utils/test_mariadb.py`: shard-user-first success, fallback on
          1045, no retry on a non-auth error (2003), and last-error propagation when
          both users are denied.\n"
        change_url: https://github.com/osism/python-osism/pull/2439
        commit_id: 2c8038ba15452813c94a62de8747dd7cf0fad81e
        patchset: 2c8038ba15452813c94a62de8747dd7cf0fad81e
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          name: osism/python-osism
          short_name: python-osism
          src_dir: src/github.com/osism/python-osism
        topic: null
      job: mypy
      jobtags: []
      max_attempts: 3
      message: ZGF0YWJhc2U6IGRldGVjdCBQcm94eVNRTCBEQiB1c2VyIGF0IGNvbm5lY3QgdGltZQoKIyMgUHJvYmxlbQoKYG9zaXNtIHN0YXR1cyBkYXRhYmFzZWAgYW5kIGBvc2lzbSBtYW5hZ2UgbG9hZGJhbGFuY2VyYCBvcGVuIGEgc3VwZXJ1c2VyIGNvbm5lY3Rpb24gdG8gdGhlIGNsdXN0ZXIncyBNYXJpYURCLCBhbmQgYm90aCBjaG9zZSB0aGUgREIgdXNlciBmcm9tIGBlbmFibGVfcHJveHlzcWxgIHJlYWQgb2ZmIGEgcmF3IGBlbnZpcm9ubWVudHMva29sbGEvY29uZmlndXJhdGlvbi55bWxgIGxvYWQuCgpUaGF0IHZhbHVlIGlzIG5vdCBpbiB0aGUgb3BlcmF0b3IgY29uZmlnIOKAlCBpdCBpcyBhIHJlbGVhc2UtZ2F0ZWQgSmluamEgZGVmYXVsdCBpbiBgb3Npc20vZGVmYXVsdHNgIChge3sgJ25vJyBpZiBvcGVuc3RhY2tfdmVyc2lvbiBpbiBbJzIwMjQuMScsJzIwMjQuMicsJzIwMjUuMSddIGVsc2UgJ3llcycgfX1gKS4gQSByYXcgZmlsZSByZWFkIG5ldmVyIHNlZXMgaXQsIHNvIGBjb25maWcuZ2V0KCJlbmFibGVfcHJveHlzcWwiLCBGYWxzZSlgIGFsd2F5cyByZXR1cm5lZCBgRmFsc2VgIGFuZCB0aGUgY29tbWFuZHMgY29ubmVjdGVkIGFzIHRoZSBwbGFpbiB1c2VyLgoKT24gYSBQcm94eVNRTCBjbHVzdGVyICh0aGUgMjAyNS4yIGRlZmF1bHQpIHRoZSBwcm94aWVkIHN1cGVydXNlciBpcyB0aGUgc2hhcmRlZCBuYW1lIGA8dXNlcj5fc2hhcmRfMGAsIHNvIFByb3h5U1FMIGRlbmllcyB0aGUgcGxhaW4gdXNlciB3aXRoIGEgMTA0NSBhbmQgdGhlIGNoZWNrIGZhaWxzIGFnYWluc3QgYSBwZXJmZWN0bHkgaGVhbHRoeSBkYXRhYmFzZToKCmBgYApFUlJPUiBGYWlsZWQgdG8gY29ubmVjdCB0byBNYXJpYURCOiAoMTA0NSwKICAiUHJveHlTUUwgRXJyb3I6IEFjY2VzcyBkZW5pZWQgZm9yIHVzZXIgJ3Jvb3QnQCfigKYnICh1c2luZyBwYXNzd29yZDogWUVTKSIpCmBgYAoKVGhlIGJ1ZyB3YXMgbGF0ZW50IGJlZm9yZSAyMDI1LjI6IGBlbmFibGVfcHJveHlzcWxgIGRlZmF1bHRlZCB0byBgbm9gIG9uIGV2ZXJ5IGVhcmxpZXIgcmVsZWFzZSwgc28gdGhlIHdyb25nIHJlYWQgKGBGYWxzZWAg4oaSIHBsYWluIHVzZXIpIGhhcHBlbmVkIHRvIG1hdGNoIHJlYWxpdHkuCgojIyBGaXgKClJlYWRpbmcgdGhlIHZhbHVlIGNvcnJlY3RseSB3b3VsZCBtZWFuIHJlc29sdmluZyBpdCB0aGUgd2F5IGtvbGxhLWFuc2libGUgZG9lcyAoQW5zaWJsZSB0ZW1wbGF0aW5nIHdpdGggYG9wZW5zdGFja192ZXJzaW9uYCBpbiBzY29wZSk7IGEgcmF3IHJlYWQg4oCUIGFuZCBldmVuIGBhbnNpYmxlLWludmVudG9yeSAtLWhvc3RgLCB3aGljaCByZXR1cm5zIHRoZSB1bnJlbmRlcmVkIEppbmphIOKAlCBjYW5ub3Qgc2VlIGl0LgoKSW5zdGVhZCBvZiByZXNvbHZpbmcgaXQsIHRoaXMgc2lkZXN0ZXBzIHRoZSBxdWVzdGlvbi4gTmV3IGBvc2lzbS91dGlscy9tYXJpYWRiLmNvbm5lY3QoKWAgdHJpZXMgYDx1c2VyPl9zaGFyZF8wYCAoUHJveHlTUUwpIGZpcnN0IGFuZCBmYWxscyBiYWNrIHRvIGA8dXNlcj5gIChwbGFpbiBIQVByb3h5KSBvbmx5IG9uIGFuIGFjY2Vzcy1kZW5pZWQgZXJyb3IsIHNvIHRoZSBjb25uZWN0aW9uIGl0c2VsZiBzZWxlY3RzIHRoZSB0b3BvbG9neSB3aXRoIG5vIGRlcGVuZGVuY3kgb24gZGVmYXVsdHMgcmVzb2x1dGlvbi4gR2VudWluZSBjb25uZWN0aXZpdHkgZmFpbHVyZXMgKG5vbi0xMDQ1KSBzdXJmYWNlIGltbWVkaWF0ZWx5IHdpdGhvdXQgYSByZXRyeS4gQm90aCBjYWxsIHNpdGVzIG5vdyB1c2UgdGhlIGhlbHBlciBhbmQgZHJvcCB0aGVpciBkdXBsaWNhdGVkIGBlbmFibGVfcHJveHlzcWxgL2BkYl91c2VyYCBsb2dpYy4KCiMjIFRlc3RzCgotIE5ldyBgdGVzdHMvdW5pdC91dGlscy90ZXN0X21hcmlhZGIucHlgOiBzaGFyZC11c2VyLWZpcnN0IHN1Y2Nlc3MsIGZhbGxiYWNrIG9uIDEwNDUsIG5vIHJldHJ5IG9uIGEgbm9uLWF1dGggZXJyb3IgKDIwMDMpLCBhbmQgbGFzdC1lcnJvciBwcm9wYWdhdGlvbiB3aGVuIGJvdGggdXNlcnMgYXJlIGRlbmllZC4K
      patchset: 2c8038ba15452813c94a62de8747dd7cf0fad81e
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/mypy/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/python-osism
        name: osism/python-osism
        short_name: python-osism
        src_dir: src/github.com/osism/python-osism
      projects:
        github.com/osism/python-osism:
          canonical_hostname: github.com
          canonical_name: github.com/osism/python-osism
          checkout: main
          checkout_description: zuul branch
          commit: a6db296b6043e862763dfd8afc256ad74f6d5132
          name: osism/python-osism
          required: false
          short_name: python-osism
          src_dir: src/github.com/osism/python-osism
      ref: refs/pull/2439/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
