all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fead:ec4e
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 4888c18e-683b-47bc-ac0a-fbf7bbe227ba
        host_id: d2c528664e1bd332192bb574345deb0c6c7158061222e4a6c036b5ef
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fead:ec4e
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.239
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.105
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fead:ec4e
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job ansible-lint explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#7>'
      - '<Job ansible-lint explicit: None implied: None source: osism/osism-kubernetes/.zuul.yaml@main#104>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 261c9b38e3034f2582d6545d00232982
      build_refs:
      - branch: main
        change: '301'
        change_message: "build: pin helm to 3.20.2 to avoid Helm 4\n\n## Problem\n\n`osism-kubernetes-push`
          (nightly image build) started failing on\n2026-06-09. The image installs
          helm **unpinned** from the buildkite apt\nrepo, so apt picks the highest
          available version. **Helm 4.2.0 landed in\nthat repo on 2026-06-08/09**
          and became the default \u2014 the 2026-06-08 build\ngot helm 3.x and passed;
          the 2026-06-09 build got `helm 4.2.0-1` and failed.\nNo code in this repo
          changed.\n\nHelm 4's WebAssembly plugin overhaul makes `helm plugin install`
          **verify\nplugin provenance by default** (HIP-0026:\nhttps://helm.sh/community/hips/hip-0026/).
          `databus23/helm-diff` ships no\n`.prov` provenance artifact, so the build
          aborts at the helm-diff plugin\ninstall step:\n\n```\nError: plugin source
          does not support verification. Use --verify=false to skip verification\nERROR:
          failed to build: failed to solve: ... exit code: 1\n```\n\nThis is deterministic
          \u2014 a recheck will not clear it.\n\n## Fix\n\nPin to `helm=3.20.2-1`
          (the latest 3.x served by the buildkite repo).\nThis restores the build
          with the known-good major version. Helm is core to\nthis image's runtime
          \u2014 ~15 roles deploy charts via `kubernetes.core.helm`\n(cert_manager,
          rook, cloudnative_pg, mariadb_operator, monitoring, \u2026) \u2014 so\nthe
          major bump should not be absorbed untested as a side effect of a CI fix.\n\nThe
          underlying defect is the unpinned install, which let a major version\narrive
          by accident; pinning also stops future silent drift.\n\n## Follow-up (not
          in this PR)\n\nMigrate to Helm 4 **deliberately and tested** before Helm
          3 end of life.\nPer the official Helm 4 release announcement\n(https://helm.sh/blog/helm-4-released/):
          **bug fixes until 2026-07-08,\nsecurity fixes until 2026-11-11.** The migration
          will need\n`helm plugin install --verify=false` (or helm-diff shipping provenance)\nplus
          validation of the deployment roles against Helm 4.\n\n## Test notes\n\nNot
          built locally (the image build only runs in CI). Verified that\n`helm 3.20.2-1`
          is present in the buildkite apt index and that Helm 3 does\nnot verify plugins.
          CI on this PR is the real check.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/osism-kubernetes/pull/301
        commit_id: 1c31ef2d316e77de788c1e13700675681fdb33dc
        patchset: 1c31ef2d316e77de788c1e13700675681fdb33dc
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/osism-kubernetes
          name: osism/osism-kubernetes
          short_name: osism-kubernetes
        src_dir: src/github.com/osism/osism-kubernetes
        topic: null
      buildset: db709d64207e42dbb6358b1f7fb2b537
      buildset_refs:
      - branch: main
        change: '301'
        change_message: "build: pin helm to 3.20.2 to avoid Helm 4\n\n## Problem\n\n`osism-kubernetes-push`
          (nightly image build) started failing on\n2026-06-09. The image installs
          helm **unpinned** from the buildkite apt\nrepo, so apt picks the highest
          available version. **Helm 4.2.0 landed in\nthat repo on 2026-06-08/09**
          and became the default \u2014 the 2026-06-08 build\ngot helm 3.x and passed;
          the 2026-06-09 build got `helm 4.2.0-1` and failed.\nNo code in this repo
          changed.\n\nHelm 4's WebAssembly plugin overhaul makes `helm plugin install`
          **verify\nplugin provenance by default** (HIP-0026:\nhttps://helm.sh/community/hips/hip-0026/).
          `databus23/helm-diff` ships no\n`.prov` provenance artifact, so the build
          aborts at the helm-diff plugin\ninstall step:\n\n```\nError: plugin source
          does not support verification. Use --verify=false to skip verification\nERROR:
          failed to build: failed to solve: ... exit code: 1\n```\n\nThis is deterministic
          \u2014 a recheck will not clear it.\n\n## Fix\n\nPin to `helm=3.20.2-1`
          (the latest 3.x served by the buildkite repo).\nThis restores the build
          with the known-good major version. Helm is core to\nthis image's runtime
          \u2014 ~15 roles deploy charts via `kubernetes.core.helm`\n(cert_manager,
          rook, cloudnative_pg, mariadb_operator, monitoring, \u2026) \u2014 so\nthe
          major bump should not be absorbed untested as a side effect of a CI fix.\n\nThe
          underlying defect is the unpinned install, which let a major version\narrive
          by accident; pinning also stops future silent drift.\n\n## Follow-up (not
          in this PR)\n\nMigrate to Helm 4 **deliberately and tested** before Helm
          3 end of life.\nPer the official Helm 4 release announcement\n(https://helm.sh/blog/helm-4-released/):
          **bug fixes until 2026-07-08,\nsecurity fixes until 2026-11-11.** The migration
          will need\n`helm plugin install --verify=false` (or helm-diff shipping provenance)\nplus
          validation of the deployment roles against Helm 4.\n\n## Test notes\n\nNot
          built locally (the image build only runs in CI). Verified that\n`helm 3.20.2-1`
          is present in the buildkite apt index and that Helm 3 does\nnot verify plugins.
          CI on this PR is the real check.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/osism-kubernetes/pull/301
        commit_id: 1c31ef2d316e77de788c1e13700675681fdb33dc
        patchset: 1c31ef2d316e77de788c1e13700675681fdb33dc
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/osism-kubernetes
          name: osism/osism-kubernetes
          short_name: osism-kubernetes
        src_dir: src/github.com/osism/osism-kubernetes
        topic: null
      change: '301'
      change_message: "build: pin helm to 3.20.2 to avoid Helm 4\n\n## Problem\n\n`osism-kubernetes-push`
        (nightly image build) started failing on\n2026-06-09. The image installs helm
        **unpinned** from the buildkite apt\nrepo, so apt picks the highest available
        version. **Helm 4.2.0 landed in\nthat repo on 2026-06-08/09** and became the
        default \u2014 the 2026-06-08 build\ngot helm 3.x and passed; the 2026-06-09
        build got `helm 4.2.0-1` and failed.\nNo code in this repo changed.\n\nHelm
        4's WebAssembly plugin overhaul makes `helm plugin install` **verify\nplugin
        provenance by default** (HIP-0026:\nhttps://helm.sh/community/hips/hip-0026/).
        `databus23/helm-diff` ships no\n`.prov` provenance artifact, so the build
        aborts at the helm-diff plugin\ninstall step:\n\n```\nError: plugin source
        does not support verification. Use --verify=false to skip verification\nERROR:
        failed to build: failed to solve: ... exit code: 1\n```\n\nThis is deterministic
        \u2014 a recheck will not clear it.\n\n## Fix\n\nPin to `helm=3.20.2-1` (the
        latest 3.x served by the buildkite repo).\nThis restores the build with the
        known-good major version. Helm is core to\nthis image's runtime \u2014 ~15
        roles deploy charts via `kubernetes.core.helm`\n(cert_manager, rook, cloudnative_pg,
        mariadb_operator, monitoring, \u2026) \u2014 so\nthe major bump should not
        be absorbed untested as a side effect of a CI fix.\n\nThe underlying defect
        is the unpinned install, which let a major version\narrive by accident; pinning
        also stops future silent drift.\n\n## Follow-up (not in this PR)\n\nMigrate
        to Helm 4 **deliberately and tested** before Helm 3 end of life.\nPer the
        official Helm 4 release announcement\n(https://helm.sh/blog/helm-4-released/):
        **bug fixes until 2026-07-08,\nsecurity fixes until 2026-11-11.** The migration
        will need\n`helm plugin install --verify=false` (or helm-diff shipping provenance)\nplus
        validation of the deployment roles against Helm 4.\n\n## Test notes\n\nNot
        built locally (the image build only runs in CI). Verified that\n`helm 3.20.2-1`
        is present in the buildkite apt index and that Helm 3 does\nnot verify plugins.
        CI on this PR is the real check.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)"
      change_url: https://github.com/osism/osism-kubernetes/pull/301
      child_jobs: []
      commit_id: 1c31ef2d316e77de788c1e13700675681fdb33dc
      event_id: a328d9d0-640a-11f1-833e-9adbd25dfb6e
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/261c9b38e3034f2582d6545d00232982/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/261c9b38e3034f2582d6545d00232982/work/logs
        result_data_file: /var/lib/zuul/builds/261c9b38e3034f2582d6545d00232982/work/results.json
        src_root: /var/lib/zuul/builds/261c9b38e3034f2582d6545d00232982/work/src
        work_root: /var/lib/zuul/builds/261c9b38e3034f2582d6545d00232982/work
      include_vars: []
      items:
      - branch: main
        change: '301'
        change_message: "build: pin helm to 3.20.2 to avoid Helm 4\n\n## Problem\n\n`osism-kubernetes-push`
          (nightly image build) started failing on\n2026-06-09. The image installs
          helm **unpinned** from the buildkite apt\nrepo, so apt picks the highest
          available version. **Helm 4.2.0 landed in\nthat repo on 2026-06-08/09**
          and became the default \u2014 the 2026-06-08 build\ngot helm 3.x and passed;
          the 2026-06-09 build got `helm 4.2.0-1` and failed.\nNo code in this repo
          changed.\n\nHelm 4's WebAssembly plugin overhaul makes `helm plugin install`
          **verify\nplugin provenance by default** (HIP-0026:\nhttps://helm.sh/community/hips/hip-0026/).
          `databus23/helm-diff` ships no\n`.prov` provenance artifact, so the build
          aborts at the helm-diff plugin\ninstall step:\n\n```\nError: plugin source
          does not support verification. Use --verify=false to skip verification\nERROR:
          failed to build: failed to solve: ... exit code: 1\n```\n\nThis is deterministic
          \u2014 a recheck will not clear it.\n\n## Fix\n\nPin to `helm=3.20.2-1`
          (the latest 3.x served by the buildkite repo).\nThis restores the build
          with the known-good major version. Helm is core to\nthis image's runtime
          \u2014 ~15 roles deploy charts via `kubernetes.core.helm`\n(cert_manager,
          rook, cloudnative_pg, mariadb_operator, monitoring, \u2026) \u2014 so\nthe
          major bump should not be absorbed untested as a side effect of a CI fix.\n\nThe
          underlying defect is the unpinned install, which let a major version\narrive
          by accident; pinning also stops future silent drift.\n\n## Follow-up (not
          in this PR)\n\nMigrate to Helm 4 **deliberately and tested** before Helm
          3 end of life.\nPer the official Helm 4 release announcement\n(https://helm.sh/blog/helm-4-released/):
          **bug fixes until 2026-07-08,\nsecurity fixes until 2026-11-11.** The migration
          will need\n`helm plugin install --verify=false` (or helm-diff shipping provenance)\nplus
          validation of the deployment roles against Helm 4.\n\n## Test notes\n\nNot
          built locally (the image build only runs in CI). Verified that\n`helm 3.20.2-1`
          is present in the buildkite apt index and that Helm 3 does\nnot verify plugins.
          CI on this PR is the real check.\n\n\U0001F916 Generated with [Claude Code](https://claude.com/claude-code)"
        change_url: https://github.com/osism/osism-kubernetes/pull/301
        commit_id: 1c31ef2d316e77de788c1e13700675681fdb33dc
        patchset: 1c31ef2d316e77de788c1e13700675681fdb33dc
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/osism-kubernetes
          name: osism/osism-kubernetes
          short_name: osism-kubernetes
          src_dir: src/github.com/osism/osism-kubernetes
        topic: null
      job: ansible-lint
      jobtags: []
      max_attempts: 3
      message: YnVpbGQ6IHBpbiBoZWxtIHRvIDMuMjAuMiB0byBhdm9pZCBIZWxtIDQKCiMjIFByb2JsZW0KCmBvc2lzbS1rdWJlcm5ldGVzLXB1c2hgIChuaWdodGx5IGltYWdlIGJ1aWxkKSBzdGFydGVkIGZhaWxpbmcgb24KMjAyNi0wNi0wOS4gVGhlIGltYWdlIGluc3RhbGxzIGhlbG0gKip1bnBpbm5lZCoqIGZyb20gdGhlIGJ1aWxka2l0ZSBhcHQKcmVwbywgc28gYXB0IHBpY2tzIHRoZSBoaWdoZXN0IGF2YWlsYWJsZSB2ZXJzaW9uLiAqKkhlbG0gNC4yLjAgbGFuZGVkIGluCnRoYXQgcmVwbyBvbiAyMDI2LTA2LTA4LzA5KiogYW5kIGJlY2FtZSB0aGUgZGVmYXVsdCDigJQgdGhlIDIwMjYtMDYtMDggYnVpbGQKZ290IGhlbG0gMy54IGFuZCBwYXNzZWQ7IHRoZSAyMDI2LTA2LTA5IGJ1aWxkIGdvdCBgaGVsbSA0LjIuMC0xYCBhbmQgZmFpbGVkLgpObyBjb2RlIGluIHRoaXMgcmVwbyBjaGFuZ2VkLgoKSGVsbSA0J3MgV2ViQXNzZW1ibHkgcGx1Z2luIG92ZXJoYXVsIG1ha2VzIGBoZWxtIHBsdWdpbiBpbnN0YWxsYCAqKnZlcmlmeQpwbHVnaW4gcHJvdmVuYW5jZSBieSBkZWZhdWx0KiogKEhJUC0wMDI2OgpodHRwczovL2hlbG0uc2gvY29tbXVuaXR5L2hpcHMvaGlwLTAwMjYvKS4gYGRhdGFidXMyMy9oZWxtLWRpZmZgIHNoaXBzIG5vCmAucHJvdmAgcHJvdmVuYW5jZSBhcnRpZmFjdCwgc28gdGhlIGJ1aWxkIGFib3J0cyBhdCB0aGUgaGVsbS1kaWZmIHBsdWdpbgppbnN0YWxsIHN0ZXA6CgpgYGAKRXJyb3I6IHBsdWdpbiBzb3VyY2UgZG9lcyBub3Qgc3VwcG9ydCB2ZXJpZmljYXRpb24uIFVzZSAtLXZlcmlmeT1mYWxzZSB0byBza2lwIHZlcmlmaWNhdGlvbgpFUlJPUjogZmFpbGVkIHRvIGJ1aWxkOiBmYWlsZWQgdG8gc29sdmU6IC4uLiBleGl0IGNvZGU6IDEKYGBgCgpUaGlzIGlzIGRldGVybWluaXN0aWMg4oCUIGEgcmVjaGVjayB3aWxsIG5vdCBjbGVhciBpdC4KCiMjIEZpeAoKUGluIHRvIGBoZWxtPTMuMjAuMi0xYCAodGhlIGxhdGVzdCAzLnggc2VydmVkIGJ5IHRoZSBidWlsZGtpdGUgcmVwbykuClRoaXMgcmVzdG9yZXMgdGhlIGJ1aWxkIHdpdGggdGhlIGtub3duLWdvb2QgbWFqb3IgdmVyc2lvbi4gSGVsbSBpcyBjb3JlIHRvCnRoaXMgaW1hZ2UncyBydW50aW1lIOKAlCB+MTUgcm9sZXMgZGVwbG95IGNoYXJ0cyB2aWEgYGt1YmVybmV0ZXMuY29yZS5oZWxtYAooY2VydF9tYW5hZ2VyLCByb29rLCBjbG91ZG5hdGl2ZV9wZywgbWFyaWFkYl9vcGVyYXRvciwgbW9uaXRvcmluZywg4oCmKSDigJQgc28KdGhlIG1ham9yIGJ1bXAgc2hvdWxkIG5vdCBiZSBhYnNvcmJlZCB1bnRlc3RlZCBhcyBhIHNpZGUgZWZmZWN0IG9mIGEgQ0kgZml4LgoKVGhlIHVuZGVybHlpbmcgZGVmZWN0IGlzIHRoZSB1bnBpbm5lZCBpbnN0YWxsLCB3aGljaCBsZXQgYSBtYWpvciB2ZXJzaW9uCmFycml2ZSBieSBhY2NpZGVudDsgcGlubmluZyBhbHNvIHN0b3BzIGZ1dHVyZSBzaWxlbnQgZHJpZnQuCgojIyBGb2xsb3ctdXAgKG5vdCBpbiB0aGlzIFBSKQoKTWlncmF0ZSB0byBIZWxtIDQgKipkZWxpYmVyYXRlbHkgYW5kIHRlc3RlZCoqIGJlZm9yZSBIZWxtIDMgZW5kIG9mIGxpZmUuClBlciB0aGUgb2ZmaWNpYWwgSGVsbSA0IHJlbGVhc2UgYW5ub3VuY2VtZW50CihodHRwczovL2hlbG0uc2gvYmxvZy9oZWxtLTQtcmVsZWFzZWQvKTogKipidWcgZml4ZXMgdW50aWwgMjAyNi0wNy0wOCwKc2VjdXJpdHkgZml4ZXMgdW50aWwgMjAyNi0xMS0xMS4qKiBUaGUgbWlncmF0aW9uIHdpbGwgbmVlZApgaGVsbSBwbHVnaW4gaW5zdGFsbCAtLXZlcmlmeT1mYWxzZWAgKG9yIGhlbG0tZGlmZiBzaGlwcGluZyBwcm92ZW5hbmNlKQpwbHVzIHZhbGlkYXRpb24gb2YgdGhlIGRlcGxveW1lbnQgcm9sZXMgYWdhaW5zdCBIZWxtIDQuCgojIyBUZXN0IG5vdGVzCgpOb3QgYnVpbHQgbG9jYWxseSAodGhlIGltYWdlIGJ1aWxkIG9ubHkgcnVucyBpbiBDSSkuIFZlcmlmaWVkIHRoYXQKYGhlbG0gMy4yMC4yLTFgIGlzIHByZXNlbnQgaW4gdGhlIGJ1aWxka2l0ZSBhcHQgaW5kZXggYW5kIHRoYXQgSGVsbSAzIGRvZXMKbm90IHZlcmlmeSBwbHVnaW5zLiBDSSBvbiB0aGlzIFBSIGlzIHRoZSByZWFsIGNoZWNrLgoK8J+kliBHZW5lcmF0ZWQgd2l0aCBbQ2xhdWRlIENvZGVdKGh0dHBzOi8vY2xhdWRlLmNvbS9jbGF1ZGUtY29kZSk=
      patchset: 1c31ef2d316e77de788c1e13700675681fdb33dc
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: e4efac6d32ebdf95a7ab23807bfea0186d1464f6
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: e4efac6d32ebdf95a7ab23807bfea0186d1464f6
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/ansible-lint/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/osism-kubernetes
        name: osism/osism-kubernetes
        short_name: osism-kubernetes
        src_dir: src/github.com/osism/osism-kubernetes
      projects:
        github.com/osism/osism-kubernetes:
          canonical_hostname: github.com
          canonical_name: github.com/osism/osism-kubernetes
          checkout: main
          checkout_description: zuul branch
          commit: f1382c42be64a20d6ddfee568ef5968c2df447f8
          name: osism/osism-kubernetes
          required: false
          short_name: osism-kubernetes
          src_dir: src/github.com/osism/osism-kubernetes
      ref: refs/pull/301/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
