all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe5e:7833
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 7e119b2d-dd98-4e46-b48a-80b75ed675fa
        host_id: 4ba4344415ca7057d9956ea5de826bbc0b830981e82c0e0f191fa07b
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe5e:7833
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.27
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.103
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe5e:7833
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job ansible-collection-ensure-readme explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#2>'
      - '<Job ansible-collection-ensure-readme explicit: None implied: None source:
        osism/ansible-collection-validations/.zuul.yaml@main#150>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: bd28457f5fe5496cb1cd396c63c1b1ee
      build_refs:
      - branch: main
        change: '269'
        change_message: "tempest: scope tempest_roles to enabled services\n\n## Problem\n\n`tempest_roles`
          defaulted to `[creator, load-balancer_member, member]` and is rendered into
          `tempest.conf` as `tempest_roles = ...`. Tempest's dynamic credential provider
          assigns every listed role to each test account, so each role must already
          exist in keystone.\n\nBut `creator` and `load-balancer_member` are not base
          roles: `creator` is created by the **barbican** service deploy (kolla-ansible
          `barbican_creator_role`, in `barbican_ks_roles`) and `load-balancer_member`
          by **octavia** \u2014 both off by default. These roles exist only where
          those services are deployed (the OSISM testbed and many production environments),
          but not in a deployment that runs neither. On such a deployment `osism apply
          tempest` fails every test in `setUpClass -> setup_credentials`:\n\n```\ntempest.lib.exceptions.NotFound:
          Object not found\nDetails: No \"creator\" role found\n```\n\n## Fix\n\nDerive
          `tempest_roles` from the existing `tempest_enable_*` service knobs instead
          of hardcoding the full set: always include `member`, add `creator` only
          when `tempest_enable_barbican`, and `load-balancer_member` only when `tempest_enable_octavia`.\n\nWhen
          both are enabled (the current default and the testbed's configuration) the
          role set is unchanged, so this does not regress existing runs; a deployment
          that disables barbican/octavia no longer requests roles keystone does not
          have.\n\n## Notes\n\n- Wiring the `tempest_enable_*` knobs to a deployment's
          real `enable_<service>` state remains an integration-layer concern (the
          play runs only `osism.validations.tempest` on the manager and does not see
          kolla's `enable_*` vars) \u2014 out of scope here.\n- Companion fix for
          the same `osism apply tempest`-on-a-real-cloud failure mode:\n  - osism/ansible-collection-validations#268\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-validations/pull/269
        commit_id: 3c8e0085a42c15e40ab2a9c963050ed694557dcd
        patchset: 3c8e0085a42c15e40ab2a9c963050ed694557dcd
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-validations
          name: osism/ansible-collection-validations
          short_name: ansible-collection-validations
        src_dir: src/github.com/osism/ansible-collection-validations
        topic: null
      buildset: a470ad16b2814644be6b9c020c4fc1b7
      buildset_refs:
      - branch: main
        change: '269'
        change_message: "tempest: scope tempest_roles to enabled services\n\n## Problem\n\n`tempest_roles`
          defaulted to `[creator, load-balancer_member, member]` and is rendered into
          `tempest.conf` as `tempest_roles = ...`. Tempest's dynamic credential provider
          assigns every listed role to each test account, so each role must already
          exist in keystone.\n\nBut `creator` and `load-balancer_member` are not base
          roles: `creator` is created by the **barbican** service deploy (kolla-ansible
          `barbican_creator_role`, in `barbican_ks_roles`) and `load-balancer_member`
          by **octavia** \u2014 both off by default. These roles exist only where
          those services are deployed (the OSISM testbed and many production environments),
          but not in a deployment that runs neither. On such a deployment `osism apply
          tempest` fails every test in `setUpClass -> setup_credentials`:\n\n```\ntempest.lib.exceptions.NotFound:
          Object not found\nDetails: No \"creator\" role found\n```\n\n## Fix\n\nDerive
          `tempest_roles` from the existing `tempest_enable_*` service knobs instead
          of hardcoding the full set: always include `member`, add `creator` only
          when `tempest_enable_barbican`, and `load-balancer_member` only when `tempest_enable_octavia`.\n\nWhen
          both are enabled (the current default and the testbed's configuration) the
          role set is unchanged, so this does not regress existing runs; a deployment
          that disables barbican/octavia no longer requests roles keystone does not
          have.\n\n## Notes\n\n- Wiring the `tempest_enable_*` knobs to a deployment's
          real `enable_<service>` state remains an integration-layer concern (the
          play runs only `osism.validations.tempest` on the manager and does not see
          kolla's `enable_*` vars) \u2014 out of scope here.\n- Companion fix for
          the same `osism apply tempest`-on-a-real-cloud failure mode:\n  - osism/ansible-collection-validations#268\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-validations/pull/269
        commit_id: 3c8e0085a42c15e40ab2a9c963050ed694557dcd
        patchset: 3c8e0085a42c15e40ab2a9c963050ed694557dcd
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-validations
          name: osism/ansible-collection-validations
          short_name: ansible-collection-validations
        src_dir: src/github.com/osism/ansible-collection-validations
        topic: null
      change: '269'
      change_message: "tempest: scope tempest_roles to enabled services\n\n## Problem\n\n`tempest_roles`
        defaulted to `[creator, load-balancer_member, member]` and is rendered into
        `tempest.conf` as `tempest_roles = ...`. Tempest's dynamic credential provider
        assigns every listed role to each test account, so each role must already
        exist in keystone.\n\nBut `creator` and `load-balancer_member` are not base
        roles: `creator` is created by the **barbican** service deploy (kolla-ansible
        `barbican_creator_role`, in `barbican_ks_roles`) and `load-balancer_member`
        by **octavia** \u2014 both off by default. These roles exist only where those
        services are deployed (the OSISM testbed and many production environments),
        but not in a deployment that runs neither. On such a deployment `osism apply
        tempest` fails every test in `setUpClass -> setup_credentials`:\n\n```\ntempest.lib.exceptions.NotFound:
        Object not found\nDetails: No \"creator\" role found\n```\n\n## Fix\n\nDerive
        `tempest_roles` from the existing `tempest_enable_*` service knobs instead
        of hardcoding the full set: always include `member`, add `creator` only when
        `tempest_enable_barbican`, and `load-balancer_member` only when `tempest_enable_octavia`.\n\nWhen
        both are enabled (the current default and the testbed's configuration) the
        role set is unchanged, so this does not regress existing runs; a deployment
        that disables barbican/octavia no longer requests roles keystone does not
        have.\n\n## Notes\n\n- Wiring the `tempest_enable_*` knobs to a deployment's
        real `enable_<service>` state remains an integration-layer concern (the play
        runs only `osism.validations.tempest` on the manager and does not see kolla's
        `enable_*` vars) \u2014 out of scope here.\n- Companion fix for the same `osism
        apply tempest`-on-a-real-cloud failure mode:\n  - osism/ansible-collection-validations#268\n\n\U0001F916
        Generated with [Claude Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/ansible-collection-validations/pull/269
      child_jobs: []
      commit_id: 3c8e0085a42c15e40ab2a9c963050ed694557dcd
      event_id: c314da00-7abc-11f1-971d-01df466169c2
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/bd28457f5fe5496cb1cd396c63c1b1ee/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/bd28457f5fe5496cb1cd396c63c1b1ee/work/logs
        result_data_file: /var/lib/zuul/builds/bd28457f5fe5496cb1cd396c63c1b1ee/work/results.json
        src_root: /var/lib/zuul/builds/bd28457f5fe5496cb1cd396c63c1b1ee/work/src
        work_root: /var/lib/zuul/builds/bd28457f5fe5496cb1cd396c63c1b1ee/work
      include_vars: []
      items:
      - branch: main
        change: '269'
        change_message: "tempest: scope tempest_roles to enabled services\n\n## Problem\n\n`tempest_roles`
          defaulted to `[creator, load-balancer_member, member]` and is rendered into
          `tempest.conf` as `tempest_roles = ...`. Tempest's dynamic credential provider
          assigns every listed role to each test account, so each role must already
          exist in keystone.\n\nBut `creator` and `load-balancer_member` are not base
          roles: `creator` is created by the **barbican** service deploy (kolla-ansible
          `barbican_creator_role`, in `barbican_ks_roles`) and `load-balancer_member`
          by **octavia** \u2014 both off by default. These roles exist only where
          those services are deployed (the OSISM testbed and many production environments),
          but not in a deployment that runs neither. On such a deployment `osism apply
          tempest` fails every test in `setUpClass -> setup_credentials`:\n\n```\ntempest.lib.exceptions.NotFound:
          Object not found\nDetails: No \"creator\" role found\n```\n\n## Fix\n\nDerive
          `tempest_roles` from the existing `tempest_enable_*` service knobs instead
          of hardcoding the full set: always include `member`, add `creator` only
          when `tempest_enable_barbican`, and `load-balancer_member` only when `tempest_enable_octavia`.\n\nWhen
          both are enabled (the current default and the testbed's configuration) the
          role set is unchanged, so this does not regress existing runs; a deployment
          that disables barbican/octavia no longer requests roles keystone does not
          have.\n\n## Notes\n\n- Wiring the `tempest_enable_*` knobs to a deployment's
          real `enable_<service>` state remains an integration-layer concern (the
          play runs only `osism.validations.tempest` on the manager and does not see
          kolla's `enable_*` vars) \u2014 out of scope here.\n- Companion fix for
          the same `osism apply tempest`-on-a-real-cloud failure mode:\n  - osism/ansible-collection-validations#268\n\n\U0001F916
          Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/ansible-collection-validations/pull/269
        commit_id: 3c8e0085a42c15e40ab2a9c963050ed694557dcd
        patchset: 3c8e0085a42c15e40ab2a9c963050ed694557dcd
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-validations
          name: osism/ansible-collection-validations
          short_name: ansible-collection-validations
          src_dir: src/github.com/osism/ansible-collection-validations
        topic: null
      job: ansible-collection-ensure-readme
      jobtags: []
      max_attempts: 3
      message: dGVtcGVzdDogc2NvcGUgdGVtcGVzdF9yb2xlcyB0byBlbmFibGVkIHNlcnZpY2VzCgojIyBQcm9ibGVtCgpgdGVtcGVzdF9yb2xlc2AgZGVmYXVsdGVkIHRvIGBbY3JlYXRvciwgbG9hZC1iYWxhbmNlcl9tZW1iZXIsIG1lbWJlcl1gIGFuZCBpcyByZW5kZXJlZCBpbnRvIGB0ZW1wZXN0LmNvbmZgIGFzIGB0ZW1wZXN0X3JvbGVzID0gLi4uYC4gVGVtcGVzdCdzIGR5bmFtaWMgY3JlZGVudGlhbCBwcm92aWRlciBhc3NpZ25zIGV2ZXJ5IGxpc3RlZCByb2xlIHRvIGVhY2ggdGVzdCBhY2NvdW50LCBzbyBlYWNoIHJvbGUgbXVzdCBhbHJlYWR5IGV4aXN0IGluIGtleXN0b25lLgoKQnV0IGBjcmVhdG9yYCBhbmQgYGxvYWQtYmFsYW5jZXJfbWVtYmVyYCBhcmUgbm90IGJhc2Ugcm9sZXM6IGBjcmVhdG9yYCBpcyBjcmVhdGVkIGJ5IHRoZSAqKmJhcmJpY2FuKiogc2VydmljZSBkZXBsb3kgKGtvbGxhLWFuc2libGUgYGJhcmJpY2FuX2NyZWF0b3Jfcm9sZWAsIGluIGBiYXJiaWNhbl9rc19yb2xlc2ApIGFuZCBgbG9hZC1iYWxhbmNlcl9tZW1iZXJgIGJ5ICoqb2N0YXZpYSoqIOKAlCBib3RoIG9mZiBieSBkZWZhdWx0LiBUaGVzZSByb2xlcyBleGlzdCBvbmx5IHdoZXJlIHRob3NlIHNlcnZpY2VzIGFyZSBkZXBsb3llZCAodGhlIE9TSVNNIHRlc3RiZWQgYW5kIG1hbnkgcHJvZHVjdGlvbiBlbnZpcm9ubWVudHMpLCBidXQgbm90IGluIGEgZGVwbG95bWVudCB0aGF0IHJ1bnMgbmVpdGhlci4gT24gc3VjaCBhIGRlcGxveW1lbnQgYG9zaXNtIGFwcGx5IHRlbXBlc3RgIGZhaWxzIGV2ZXJ5IHRlc3QgaW4gYHNldFVwQ2xhc3MgLT4gc2V0dXBfY3JlZGVudGlhbHNgOgoKYGBgCnRlbXBlc3QubGliLmV4Y2VwdGlvbnMuTm90Rm91bmQ6IE9iamVjdCBub3QgZm91bmQKRGV0YWlsczogTm8gImNyZWF0b3IiIHJvbGUgZm91bmQKYGBgCgojIyBGaXgKCkRlcml2ZSBgdGVtcGVzdF9yb2xlc2AgZnJvbSB0aGUgZXhpc3RpbmcgYHRlbXBlc3RfZW5hYmxlXypgIHNlcnZpY2Uga25vYnMgaW5zdGVhZCBvZiBoYXJkY29kaW5nIHRoZSBmdWxsIHNldDogYWx3YXlzIGluY2x1ZGUgYG1lbWJlcmAsIGFkZCBgY3JlYXRvcmAgb25seSB3aGVuIGB0ZW1wZXN0X2VuYWJsZV9iYXJiaWNhbmAsIGFuZCBgbG9hZC1iYWxhbmNlcl9tZW1iZXJgIG9ubHkgd2hlbiBgdGVtcGVzdF9lbmFibGVfb2N0YXZpYWAuCgpXaGVuIGJvdGggYXJlIGVuYWJsZWQgKHRoZSBjdXJyZW50IGRlZmF1bHQgYW5kIHRoZSB0ZXN0YmVkJ3MgY29uZmlndXJhdGlvbikgdGhlIHJvbGUgc2V0IGlzIHVuY2hhbmdlZCwgc28gdGhpcyBkb2VzIG5vdCByZWdyZXNzIGV4aXN0aW5nIHJ1bnM7IGEgZGVwbG95bWVudCB0aGF0IGRpc2FibGVzIGJhcmJpY2FuL29jdGF2aWEgbm8gbG9uZ2VyIHJlcXVlc3RzIHJvbGVzIGtleXN0b25lIGRvZXMgbm90IGhhdmUuCgojIyBOb3RlcwoKLSBXaXJpbmcgdGhlIGB0ZW1wZXN0X2VuYWJsZV8qYCBrbm9icyB0byBhIGRlcGxveW1lbnQncyByZWFsIGBlbmFibGVfPHNlcnZpY2U+YCBzdGF0ZSByZW1haW5zIGFuIGludGVncmF0aW9uLWxheWVyIGNvbmNlcm4gKHRoZSBwbGF5IHJ1bnMgb25seSBgb3Npc20udmFsaWRhdGlvbnMudGVtcGVzdGAgb24gdGhlIG1hbmFnZXIgYW5kIGRvZXMgbm90IHNlZSBrb2xsYSdzIGBlbmFibGVfKmAgdmFycykg4oCUIG91dCBvZiBzY29wZSBoZXJlLgotIENvbXBhbmlvbiBmaXggZm9yIHRoZSBzYW1lIGBvc2lzbSBhcHBseSB0ZW1wZXN0YC1vbi1hLXJlYWwtY2xvdWQgZmFpbHVyZSBtb2RlOgogIC0gb3Npc20vYW5zaWJsZS1jb2xsZWN0aW9uLXZhbGlkYXRpb25zIzI2OAoK8J+kliBHZW5lcmF0ZWQgd2l0aCBbQ2xhdWRlIENvZGVdKGh0dHBzOi8vY2xhdWRlLmNvbS9jbGF1ZGUtY29kZSk=
      patchset: 3c8e0085a42c15e40ab2a9c963050ed694557dcd
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 1d71e58c93442038e695a5d883d57a603182c7ae
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/ansible-collection-ensure-readme/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/ansible-collection-validations
        name: osism/ansible-collection-validations
        short_name: ansible-collection-validations
        src_dir: src/github.com/osism/ansible-collection-validations
      projects:
        github.com/osism/ansible-collection-validations:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-validations
          checkout: main
          checkout_description: zuul branch
          commit: ec91058bd57653ee9e0265ef61844c622ce29a35
          name: osism/ansible-collection-validations
          required: false
          short_name: ansible-collection-validations
          src_dir: src/github.com/osism/ansible-collection-validations
      ref: refs/pull/269/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
