all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fed0:8d96
      ansible_molecule_ansible_version: 11.12.0
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_role: manager
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 60174c90-d063-45e2-bd1f-3decb48c0855
        host_id: 0d3d02185f810c959252bd1d303ec55040bf5bb0b401cceef814c3a7
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fed0:8d96
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.7.40
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.193.22
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fed0:8d96
        region: null
        slot: null
    ubuntu-noble:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:febf:efdd
      ansible_molecule_ansible_version: 11.12.0
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_role: manager
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: c2f2b543-f791-4ea9-8e91-1ec452542503
        host_id: ec4f54fa666de9bc553bc59c41683f12345b665d0b1af00d715e7318
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:febf:efdd
        label: ubuntu-noble
        node_properties: {}
        private_ipv4: 10.128.7.236
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.124
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:febf:efdd
        region: null
        slot: null
  vars:
    ansible_molecule_ansible_version: 11.12.0
    ansible_role: manager
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job ansible-molecule explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#12>'
      - '<Job abstract-ansible-collection-services-molecule explicit: None implied:
        {MatchAny:{ImpliedBranchMatcher:main}} source: osism/ansible-collection-services/.zuul.yaml@main#79>'
      - '<Job ansible-collection-services-molecule-manager explicit: None implied:
        {MatchAny:{ImpliedBranchMatcher:main}} source: osism/ansible-collection-services/.zuul.yaml@main#267>'
      - '<Job ansible-collection-services-molecule-manager explicit: None implied:
        None source: osism/ansible-collection-services/.zuul.yaml@main#498>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: e77ffb895e744e23a918fd7ec117f7ac
      build_refs:
      - branch: main
        change: '2106'
        change_message: "manager: recreate containers after pulling new images\n\n##
          Problem\n\n`osism update manager` on a host using a rolling tag (e.g. `latest`)
          fails in:\n\n```\nTASK [osism.services.manager : Execute service manager
          version check]\n```\n\nThe freshly pulled images are never applied to the
          running containers, so the version check reports a MISMATCH and exits 1.
          Recovery currently requires a manual `sudo systemctl restart manager.service`
          \u2014 and per the issue it can recur on subsequent runs.\n\n## Root cause\n\nThe
          `Pull container images` task in `roles/manager/tasks/service.yml` pulls
          new images but has no `notify`/`register`. A recreate (`docker compose up
          -d`, via the `Restart manager service` handler chain) is only triggered
          when the rendered `docker-compose.yml` changes or the systemd unit changes.\n\nOn
          a `latest` \u2192 `latest` update neither trigger fires:\n\n1. `Copy docker-compose.yml`
          \u2192 identical text \u2192 no notify.\n2. `Pull container images` \u2192
          pulls the new `latest`; the old image (still backing the running containers)
          loses its `:latest` tag.\n3. `systemd_service: state: started` \u2192 already
          running \u2192 `changed=false`.\n4. `flush_handlers` \u2192 nothing to flush
          \u2192 no recreate.\n5. `verify-versions` compares the running image (now
          a bare digest) against the expected `...:latest` \u2192 MISMATCH \u2192
          `exit 1`.\n\n## Fix\n\nNotify the existing `Restart manager service` handler
          from the pull task. The notify only fires when the pull actually reports
          `changed`; handlers flush at the end of `service.yml` (before `verify-versions`),
          so the containers are recreated *before* the check runs. Duplicate notifies
          (compose file + pull) still collapse into a single restart, and the handler
          keeps respecting `manager_service_allow_restart`.\n\n## Note\n\nThe same
          \"bare pull without notify\" pattern exists in the `netbox` and `stepca`
          roles; tracked separately (one issue per service) since they have no version-check
          task that surfaces it today.\n\nCloses #2105"
        change_url: https://github.com/osism/ansible-collection-services/pull/2106
        commit_id: da6489c422d48aa6d11227eae904a23df63962f4
        patchset: da6489c422d48aa6d11227eae904a23df63962f4
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      buildset: b0b7e005a54546c8bc659ed1c7eec7e1
      buildset_refs:
      - branch: main
        change: '2106'
        change_message: "manager: recreate containers after pulling new images\n\n##
          Problem\n\n`osism update manager` on a host using a rolling tag (e.g. `latest`)
          fails in:\n\n```\nTASK [osism.services.manager : Execute service manager
          version check]\n```\n\nThe freshly pulled images are never applied to the
          running containers, so the version check reports a MISMATCH and exits 1.
          Recovery currently requires a manual `sudo systemctl restart manager.service`
          \u2014 and per the issue it can recur on subsequent runs.\n\n## Root cause\n\nThe
          `Pull container images` task in `roles/manager/tasks/service.yml` pulls
          new images but has no `notify`/`register`. A recreate (`docker compose up
          -d`, via the `Restart manager service` handler chain) is only triggered
          when the rendered `docker-compose.yml` changes or the systemd unit changes.\n\nOn
          a `latest` \u2192 `latest` update neither trigger fires:\n\n1. `Copy docker-compose.yml`
          \u2192 identical text \u2192 no notify.\n2. `Pull container images` \u2192
          pulls the new `latest`; the old image (still backing the running containers)
          loses its `:latest` tag.\n3. `systemd_service: state: started` \u2192 already
          running \u2192 `changed=false`.\n4. `flush_handlers` \u2192 nothing to flush
          \u2192 no recreate.\n5. `verify-versions` compares the running image (now
          a bare digest) against the expected `...:latest` \u2192 MISMATCH \u2192
          `exit 1`.\n\n## Fix\n\nNotify the existing `Restart manager service` handler
          from the pull task. The notify only fires when the pull actually reports
          `changed`; handlers flush at the end of `service.yml` (before `verify-versions`),
          so the containers are recreated *before* the check runs. Duplicate notifies
          (compose file + pull) still collapse into a single restart, and the handler
          keeps respecting `manager_service_allow_restart`.\n\n## Note\n\nThe same
          \"bare pull without notify\" pattern exists in the `netbox` and `stepca`
          roles; tracked separately (one issue per service) since they have no version-check
          task that surfaces it today.\n\nCloses #2105"
        change_url: https://github.com/osism/ansible-collection-services/pull/2106
        commit_id: da6489c422d48aa6d11227eae904a23df63962f4
        patchset: da6489c422d48aa6d11227eae904a23df63962f4
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      change: '2106'
      change_message: "manager: recreate containers after pulling new images\n\n##
        Problem\n\n`osism update manager` on a host using a rolling tag (e.g. `latest`)
        fails in:\n\n```\nTASK [osism.services.manager : Execute service manager version
        check]\n```\n\nThe freshly pulled images are never applied to the running
        containers, so the version check reports a MISMATCH and exits 1. Recovery
        currently requires a manual `sudo systemctl restart manager.service` \u2014
        and per the issue it can recur on subsequent runs.\n\n## Root cause\n\nThe
        `Pull container images` task in `roles/manager/tasks/service.yml` pulls new
        images but has no `notify`/`register`. A recreate (`docker compose up -d`,
        via the `Restart manager service` handler chain) is only triggered when the
        rendered `docker-compose.yml` changes or the systemd unit changes.\n\nOn a
        `latest` \u2192 `latest` update neither trigger fires:\n\n1. `Copy docker-compose.yml`
        \u2192 identical text \u2192 no notify.\n2. `Pull container images` \u2192
        pulls the new `latest`; the old image (still backing the running containers)
        loses its `:latest` tag.\n3. `systemd_service: state: started` \u2192 already
        running \u2192 `changed=false`.\n4. `flush_handlers` \u2192 nothing to flush
        \u2192 no recreate.\n5. `verify-versions` compares the running image (now
        a bare digest) against the expected `...:latest` \u2192 MISMATCH \u2192 `exit
        1`.\n\n## Fix\n\nNotify the existing `Restart manager service` handler from
        the pull task. The notify only fires when the pull actually reports `changed`;
        handlers flush at the end of `service.yml` (before `verify-versions`), so
        the containers are recreated *before* the check runs. Duplicate notifies (compose
        file + pull) still collapse into a single restart, and the handler keeps respecting
        `manager_service_allow_restart`.\n\n## Note\n\nThe same \"bare pull without
        notify\" pattern exists in the `netbox` and `stepca` roles; tracked separately
        (one issue per service) since they have no version-check task that surfaces
        it today.\n\nCloses #2105"
      change_url: https://github.com/osism/ansible-collection-services/pull/2106
      child_jobs: []
      commit_id: da6489c422d48aa6d11227eae904a23df63962f4
      event_id: 1c63e900-6a25-11f1-80de-64e5736da373
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/e77ffb895e744e23a918fd7ec117f7ac/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/e77ffb895e744e23a918fd7ec117f7ac/work/logs
        result_data_file: /var/lib/zuul/builds/e77ffb895e744e23a918fd7ec117f7ac/work/results.json
        src_root: /var/lib/zuul/builds/e77ffb895e744e23a918fd7ec117f7ac/work/src
        work_root: /var/lib/zuul/builds/e77ffb895e744e23a918fd7ec117f7ac/work
      include_vars: []
      items:
      - branch: main
        change: '2106'
        change_message: "manager: recreate containers after pulling new images\n\n##
          Problem\n\n`osism update manager` on a host using a rolling tag (e.g. `latest`)
          fails in:\n\n```\nTASK [osism.services.manager : Execute service manager
          version check]\n```\n\nThe freshly pulled images are never applied to the
          running containers, so the version check reports a MISMATCH and exits 1.
          Recovery currently requires a manual `sudo systemctl restart manager.service`
          \u2014 and per the issue it can recur on subsequent runs.\n\n## Root cause\n\nThe
          `Pull container images` task in `roles/manager/tasks/service.yml` pulls
          new images but has no `notify`/`register`. A recreate (`docker compose up
          -d`, via the `Restart manager service` handler chain) is only triggered
          when the rendered `docker-compose.yml` changes or the systemd unit changes.\n\nOn
          a `latest` \u2192 `latest` update neither trigger fires:\n\n1. `Copy docker-compose.yml`
          \u2192 identical text \u2192 no notify.\n2. `Pull container images` \u2192
          pulls the new `latest`; the old image (still backing the running containers)
          loses its `:latest` tag.\n3. `systemd_service: state: started` \u2192 already
          running \u2192 `changed=false`.\n4. `flush_handlers` \u2192 nothing to flush
          \u2192 no recreate.\n5. `verify-versions` compares the running image (now
          a bare digest) against the expected `...:latest` \u2192 MISMATCH \u2192
          `exit 1`.\n\n## Fix\n\nNotify the existing `Restart manager service` handler
          from the pull task. The notify only fires when the pull actually reports
          `changed`; handlers flush at the end of `service.yml` (before `verify-versions`),
          so the containers are recreated *before* the check runs. Duplicate notifies
          (compose file + pull) still collapse into a single restart, and the handler
          keeps respecting `manager_service_allow_restart`.\n\n## Note\n\nThe same
          \"bare pull without notify\" pattern exists in the `netbox` and `stepca`
          roles; tracked separately (one issue per service) since they have no version-check
          task that surfaces it today.\n\nCloses #2105"
        change_url: https://github.com/osism/ansible-collection-services/pull/2106
        commit_id: da6489c422d48aa6d11227eae904a23df63962f4
        patchset: da6489c422d48aa6d11227eae904a23df63962f4
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          name: osism/ansible-collection-services
          short_name: ansible-collection-services
          src_dir: src/github.com/osism/ansible-collection-services
        topic: null
      job: ansible-collection-services-molecule-manager
      jobtags: []
      max_attempts: 3
      message: bWFuYWdlcjogcmVjcmVhdGUgY29udGFpbmVycyBhZnRlciBwdWxsaW5nIG5ldyBpbWFnZXMKCiMjIFByb2JsZW0KCmBvc2lzbSB1cGRhdGUgbWFuYWdlcmAgb24gYSBob3N0IHVzaW5nIGEgcm9sbGluZyB0YWcgKGUuZy4gYGxhdGVzdGApIGZhaWxzIGluOgoKYGBgClRBU0sgW29zaXNtLnNlcnZpY2VzLm1hbmFnZXIgOiBFeGVjdXRlIHNlcnZpY2UgbWFuYWdlciB2ZXJzaW9uIGNoZWNrXQpgYGAKClRoZSBmcmVzaGx5IHB1bGxlZCBpbWFnZXMgYXJlIG5ldmVyIGFwcGxpZWQgdG8gdGhlIHJ1bm5pbmcgY29udGFpbmVycywgc28gdGhlIHZlcnNpb24gY2hlY2sgcmVwb3J0cyBhIE1JU01BVENIIGFuZCBleGl0cyAxLiBSZWNvdmVyeSBjdXJyZW50bHkgcmVxdWlyZXMgYSBtYW51YWwgYHN1ZG8gc3lzdGVtY3RsIHJlc3RhcnQgbWFuYWdlci5zZXJ2aWNlYCDigJQgYW5kIHBlciB0aGUgaXNzdWUgaXQgY2FuIHJlY3VyIG9uIHN1YnNlcXVlbnQgcnVucy4KCiMjIFJvb3QgY2F1c2UKClRoZSBgUHVsbCBjb250YWluZXIgaW1hZ2VzYCB0YXNrIGluIGByb2xlcy9tYW5hZ2VyL3Rhc2tzL3NlcnZpY2UueW1sYCBwdWxscyBuZXcgaW1hZ2VzIGJ1dCBoYXMgbm8gYG5vdGlmeWAvYHJlZ2lzdGVyYC4gQSByZWNyZWF0ZSAoYGRvY2tlciBjb21wb3NlIHVwIC1kYCwgdmlhIHRoZSBgUmVzdGFydCBtYW5hZ2VyIHNlcnZpY2VgIGhhbmRsZXIgY2hhaW4pIGlzIG9ubHkgdHJpZ2dlcmVkIHdoZW4gdGhlIHJlbmRlcmVkIGBkb2NrZXItY29tcG9zZS55bWxgIGNoYW5nZXMgb3IgdGhlIHN5c3RlbWQgdW5pdCBjaGFuZ2VzLgoKT24gYSBgbGF0ZXN0YCDihpIgYGxhdGVzdGAgdXBkYXRlIG5laXRoZXIgdHJpZ2dlciBmaXJlczoKCjEuIGBDb3B5IGRvY2tlci1jb21wb3NlLnltbGAg4oaSIGlkZW50aWNhbCB0ZXh0IOKGkiBubyBub3RpZnkuCjIuIGBQdWxsIGNvbnRhaW5lciBpbWFnZXNgIOKGkiBwdWxscyB0aGUgbmV3IGBsYXRlc3RgOyB0aGUgb2xkIGltYWdlIChzdGlsbCBiYWNraW5nIHRoZSBydW5uaW5nIGNvbnRhaW5lcnMpIGxvc2VzIGl0cyBgOmxhdGVzdGAgdGFnLgozLiBgc3lzdGVtZF9zZXJ2aWNlOiBzdGF0ZTogc3RhcnRlZGAg4oaSIGFscmVhZHkgcnVubmluZyDihpIgYGNoYW5nZWQ9ZmFsc2VgLgo0LiBgZmx1c2hfaGFuZGxlcnNgIOKGkiBub3RoaW5nIHRvIGZsdXNoIOKGkiBubyByZWNyZWF0ZS4KNS4gYHZlcmlmeS12ZXJzaW9uc2AgY29tcGFyZXMgdGhlIHJ1bm5pbmcgaW1hZ2UgKG5vdyBhIGJhcmUgZGlnZXN0KSBhZ2FpbnN0IHRoZSBleHBlY3RlZCBgLi4uOmxhdGVzdGAg4oaSIE1JU01BVENIIOKGkiBgZXhpdCAxYC4KCiMjIEZpeAoKTm90aWZ5IHRoZSBleGlzdGluZyBgUmVzdGFydCBtYW5hZ2VyIHNlcnZpY2VgIGhhbmRsZXIgZnJvbSB0aGUgcHVsbCB0YXNrLiBUaGUgbm90aWZ5IG9ubHkgZmlyZXMgd2hlbiB0aGUgcHVsbCBhY3R1YWxseSByZXBvcnRzIGBjaGFuZ2VkYDsgaGFuZGxlcnMgZmx1c2ggYXQgdGhlIGVuZCBvZiBgc2VydmljZS55bWxgIChiZWZvcmUgYHZlcmlmeS12ZXJzaW9uc2ApLCBzbyB0aGUgY29udGFpbmVycyBhcmUgcmVjcmVhdGVkICpiZWZvcmUqIHRoZSBjaGVjayBydW5zLiBEdXBsaWNhdGUgbm90aWZpZXMgKGNvbXBvc2UgZmlsZSArIHB1bGwpIHN0aWxsIGNvbGxhcHNlIGludG8gYSBzaW5nbGUgcmVzdGFydCwgYW5kIHRoZSBoYW5kbGVyIGtlZXBzIHJlc3BlY3RpbmcgYG1hbmFnZXJfc2VydmljZV9hbGxvd19yZXN0YXJ0YC4KCiMjIE5vdGUKClRoZSBzYW1lICJiYXJlIHB1bGwgd2l0aG91dCBub3RpZnkiIHBhdHRlcm4gZXhpc3RzIGluIHRoZSBgbmV0Ym94YCBhbmQgYHN0ZXBjYWAgcm9sZXM7IHRyYWNrZWQgc2VwYXJhdGVseSAob25lIGlzc3VlIHBlciBzZXJ2aWNlKSBzaW5jZSB0aGV5IGhhdmUgbm8gdmVyc2lvbi1jaGVjayB0YXNrIHRoYXQgc3VyZmFjZXMgaXQgdG9kYXkuCgpDbG9zZXMgIzIxMDU=
      patchset: da6489c422d48aa6d11227eae904a23df63962f4
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 3d5c7b5973754999f7005857a00ce9168944f0f1
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: 0c74c57cedff2b36bb37ca68a5338d1c49991496
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 3d5c7b5973754999f7005857a00ce9168944f0f1
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 038dd8b856c62af4433c8477c5cb3d0480847059
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/ansible-molecule/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/ansible-collection-services
        name: osism/ansible-collection-services
        short_name: ansible-collection-services
        src_dir: src/github.com/osism/ansible-collection-services
      projects:
        github.com/osism/ansible-collection-services:
          canonical_hostname: github.com
          canonical_name: github.com/osism/ansible-collection-services
          checkout: main
          checkout_description: zuul branch
          commit: 2b3cf380762027cc3adb9494db0f0f1d01c413a9
          name: osism/ansible-collection-services
          required: false
          short_name: ansible-collection-services
          src_dir: src/github.com/osism/ansible-collection-services
      ref: refs/pull/2106/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
