Test verify

.ansible-lint

@@ -12,6 +12,7 @@ exclude_paths:
   - zuul.d/projects.yaml  # Generated, pyYAML is bad at indentation
   - zuul.d/molecule.yaml  # Generated, pyYAML is bad at indentation
   - ci/
+  - roles/adoption_osp_deploy/molecule/default/vars.yaml  # vars_file
   - roles/ci_gen_kustomize_values/molecule/default/files/networking-environment-definition.yml  # Generated
   - roles/ci_gen_kustomize_values/molecule/default/files/3-ocp-net-def.yml  # Generated
   - roles/ci_gen_kustomize_values/molecule/default/converge.yml  # invalid due to calls to "lookup('file')"
@@ -20,6 +21,8 @@ exclude_paths:
   - roles/kustomize_deploy/molecule/flexible_loop/files/networking-environment-definition.yml  # Generated
   - roles/kustomize_deploy/molecule/flexible_loop/prepare.yml  # import_playbook
   - roles/*/molecule/*/side_effect.yml  # syntax-check[empty-playbook] https://github.com/ansible/molecule/issues/3617
+  - roles/ci_multus/molecule/*/nads_output.yml # internal-error due to "---" characters
+  - hooks/playbooks/roles/
 strict: true
 quiet: false
 verbosity: 1
@@ -41,10 +44,10 @@ enable_list:
   - no-log-password
   - no-same-owner
   - name[play]
+  - risky-file-permissions
 skip_list:
   - jinja[spacing]  # We don't really want to get that one. Too picky
   - no-changed-when  # once we get the oc module we can re-enable it
-  - risky-file-permissions  # Seems to fail on 0644 on files ?!
   - schema[meta]  # Apparently "CentOS 9" isn't known... ?!
   - schema[vars]  # weird issue with some "vars" in playbooks
   - yaml[line-length]  # We have long lines, yes.

.config/molecule/config.yml

@@ -26,6 +26,9 @@ platforms:
 
 provisioner:
   name: ansible
+  inventory:
+    links:
+      group_vars: ../../../../group_vars/
   config_options:
     defaults:
       fact_caching: jsonfile

.config/molecule/config_edpm_ansible.yml

@@ -0,0 +1,47 @@
+---
+driver:
+  name: delegated
+  options:
+    managed: false
+    ansible_connection_options:
+      ansible_connection: local
+
+log: true
+
+platforms:
+  - name: instance
+    environment: &env
+      http_proxy: "{{ lookup('env', 'http_proxy') }}"
+      https_proxy: "{{ lookup('env', 'https_proxy') }}"
+
+provisioner:
+  name: ansible
+  # Expose configuration to all jobs by default
+  # Useful when an fix requires to provide some
+  # CIFMW parameter to many roles, such as a broken
+  # CentOS image.
+  # inventory:
+  #   group_vars:
+  #     all:
+  #       cifmw_discover_latest_image_qcow_prefix: "CentOS-Stream-GenericCloud-9-20240506"
+
+  config_options:
+    defaults:
+      fact_caching: jsonfile
+      fact_caching_connection: /tmp/molecule/facts
+      remote_tmp: /tmp
+  log: true
+  env:
+    ANSIBLE_STDOUT_CALLBACK: yaml
+    ANSIBLE_ROLES_PATH: "${ANSIBLE_ROLES_PATH}:${HOME}/zuul-jobs/roles:${HOME}/ci-framework-data/artifacts/roles:${HOME}/src/github.com/openstack-k8s-operators/ci-framework/roles"
+    ANSIBLE_LIBRARY: "${ANSIBLE_LIBRARY:-/usr/share/ansible/plugins/modules}:${HOME}/.ansible/plugins/modules:${HOME}/src/github.com/openstack-k8s-operators/ci-framework/plugins/modules"
+    ANSIBLE_ACTION_PLUGINS: "${ANSIBLE_ACTION_PLUGINS:-/usr/share/ansible/plugins/action}:${HOME}/.ansible/plugins/action:${HOME}/src/github.com/openstack-k8s-operators/ci-framework/plugins/action"
+
+scenario:
+  test_sequence:
+    - prepare
+    - converge
+    - cleanup
+
+verifier:
+  name: ansible

.config/molecule/config_local.yml

@@ -25,6 +25,9 @@ provisioner:
   #     all:
   #       cifmw_discover_latest_image_qcow_prefix: "CentOS-Stream-GenericCloud-9-20240506"
 
+  inventory:
+    links:
+      group_vars: ../../../../group_vars/
   config_options:
     defaults:
       fact_caching: jsonfile

.config/molecule/config_podman.yml

@@ -25,6 +25,8 @@ provisioner:
         hosts:
           instance:
             ansible_python_interpreter: /usr/bin/python3
+    links:
+      group_vars: ../../../../group_vars/
   name: ansible
   log: true
   env:

.githooks/pre-push

@@ -1,4 +1,4 @@
-#!/usr/bin/sh
+#!/usr/bin/env sh
 
 set -e
 

.github/CODEOWNERS

@@ -6,10 +6,9 @@ roles/adoption_osp_deploy @openstack-k8s-operators/adoption-core-reviewers
 
 # BGP
 roles/ci_gen_kustomize_values/templates/bgp_dt01 @openstack-k8s-operators/bgp
-playbooks/bgp-l3-computes-ready.yml @openstack-k8s-operators/bgp
-
-# Compliance
-roles/compliance @openstack-k8s-operators/security
+roles/ci_gen_kustomize_values/templates/bgp-l3-xl @openstack-k8s-operators/bgp
+playbooks/bgp @openstack-k8s-operators/bgp
+scenarios/reproducers/bgp-l3-xl.yml @openstack-k8s-operators/bgp
 
 # DCN
 roles/ci_dcn_site @openstack-k8s-operators/dcn
@@ -35,9 +34,14 @@ roles/polarion @tosky @jparoly @jirimacku
 # Report portal
 roles/reportportal @jirimacku @dsariel @sdatko
 
+# Security
+roles/compliance @openstack-k8s-operators/security
+roles/federation @openstack-k8s-operators/security
+roles/ipa @openstack-k8s-operators/security
+
 # Shiftstack
-roles/shiftstack @rlobillo @eurijon
-roles/ci_gen_kustomize_values/templates/shiftstack @rlobillo @eurijon
+roles/shiftstack @imatza-rh @eurijon
+roles/ci_gen_kustomize_values/templates/shiftstack @imatza-rh @eurijon
 
 # Storage
 roles/cifmw_block_device @openstack-k8s-operators/storage
@@ -63,4 +67,4 @@ roles/ci_gen_kustomize_values/templates/uni* @openstack-k8s-operators/ciops
 roles/update @openstack-k8s-operators/updates
 
 # Validations
-roles/validations @bshephar @drosenfe
+roles/validations @drosenfe

.github/workflows/commit-message-validator.yml

@@ -0,0 +1,44 @@
+name: Check if commit message body is not too short
+
+on:
+  pull_request:
+    types: [opened, synchronize, edited, reopened]
+
+jobs:
+  verify-body-length:
+    runs-on: ubuntu-latest
+    # set as non-voting for now.
+    continue-on-error: true
+
+    permissions:
+      contents: write
+      pull-requests: write
+      repository-projects: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Dump commit message to file
+        run: |
+          git fetch origin ${{ github.event.pull_request.head.sha }}
+          git log -1 --pretty=format:"%B" ${{ github.event.pull_request.head.sha }} > commit-message-file
+
+      - name: Run commit message check
+        id: bodylength
+        run: |
+          set +e
+          ./scripts/git-check-commit-body-length.sh commit-message-file > result.log 2>&1
+          EXIT_CODE=$?
+          echo "exit_code=$EXIT_CODE" >> $GITHUB_OUTPUT
+          cat result.log
+
+      - name: Comment on PR if body length check failed
+        if: steps.bodylength.outputs.exit_code != '0'
+        uses: peter-evans/create-or-update-comment@v5
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          body-path: ./result.log
+          reactions: confused

.github/workflows/documentation.yml

@@ -14,6 +14,7 @@ on:  # noqa: yaml[truthy]
 jobs:
   build-and-check:
     runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request_target' || github.event_name == 'pull_request' || github.event.comment.body == 'recheck'
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/sync_branches_reusable_workflow.yml

@@ -0,0 +1,40 @@
+---
+name: Sync a target branch with source branch
+on:
+  workflow_call:
+    inputs:
+      source-branch:
+        required: true
+        type: string
+      target-branch:
+        required: true
+        type: string
+    secrets:
+      ssh-key:
+        description: 'Deploy token write access'
+        required: true
+
+jobs:
+  sync-branches:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ssh-key: ${{ secrets.ssh-key }}
+          persist-credentials: true
+
+      - name: Git config
+        run: |
+          git config --global user.name "openstack-k8s-ci-robot"
+          git config --global user.email "[email protected]"
+
+      - name: Rebase and Push
+        run: |
+          git fetch origin ${{ inputs.source-branch }}
+          git checkout ${{ inputs.target-branch }}
+          git rebase FETCH_HEAD
+          git push --force origin ${{ inputs.target-branch }}

.github/workflows/sync_branches_with_ext_trigger.yml

@@ -0,0 +1,14 @@
+---
+name: Sync a target branch with source branch
+on:
+  repository_dispatch:
+    types: [trigger-sync]
+
+jobs:
+  trigger-sync:
+    uses: openstack-k8s-operators/ci-framework/.github/workflows/sync_branches_reusable_workflow.yml@main
+    with:
+      source-branch: ${{ github.event.client_payload.source-branch }}
+      target-branch: ${{ github.event.client_payload.target-branch }}
+    secrets:
+      ssh-key: ${{ secrets.DEPLOY_KEY }}

.gitignore

@@ -7,3 +7,4 @@ docs/dictionary/tmp
 .venv/*
 .env
 .idea/
+.ansible/

CONTRIBUTING.md

@@ -45,6 +45,19 @@ Here is an example, based on a common use-case, on how to use those variables
     oc get openstackdataplane -n {{ cifmw_install_yamls_defaults['NAMESPACE'] }}
 ~~~
 
+## A few words about using Git
+
+Before you make a pull request, make sure that:
+
+* the title of your git commit message begins with the role
+  name in brackets: `[my_wonderful_role]` or `(my_wonderful_role)`
+* the git commit body message is longer than 10 characters and describes
+  the reason why you added this change
+* sign your git commit using the `Signed-Off-By` option by
+  adding: `--signoff` or `-s` when using the command: `git commit`.
+* if you already make a commit, and you want to add `Signed-Off-By`,
+  use command: `git commit --amend --signoff`
+
 ### Documentation
 
 A new role must get proper documentation. Please edit the README.md located in

_skeleton_role_/molecule/default/molecule.yml.j2

@@ -0,0 +1,33 @@
+---
+# Mainly used to override the defaults set in .config/molecule/
+# By default, it uses the "config_podman.yml" - in CI, it will use
+# "config_local.yml".
+#
+# Do not add host_vars and group_vars within this config file.
+# To add host_vars, uncomment the links: host_vars config and add
+# host_vars file in roles/{{ role_name }}/molecule/host_vars/instance.yml.
+#
+# To add group_vars, uncomment platforms section so that
+# the molecule test is added to required groups. After that,
+# create group_vars/molecule/{{ role_name }}_molecule.yml file
+# and add group_vars specific to this molecule test there.
+#
+# Reason is, you can either have links to group_vars/host_vars
+# or add group_vars/host_vars directly. Ref [1]
+# [1] https://ansible.readthedocs.io/projects/molecule/configuration/#provisioner-pre-ansible-native
+log: true
+
+#platforms:
+#  - name: instance
+#    groups:
+#      - molecule
+#      - {{ role_name }}_molecule
+
+provisioner:
+  name: ansible
+  log: true
+  env:
+    ANSIBLE_STDOUT_CALLBACK: yaml
+#  inventory:
+#    links:
+#      host_vars: ./host_vars/

ansible.cfg

@@ -5,8 +5,11 @@ roles_path = ~/ci-framework-data/artifacts/roles:./roles:/usr/share/ansible/role
 filter_plugins = ./plugins/filter:~/plugins/filter:/usr/share/ansible/plugins/filter
 log_path = ~/ansible.log
 # We may consider ansible.builtin.junit
-callbacks_enabled = ansible.posix.profile_tasks,yaml
-stdout_callback = yaml
+callbacks_enabled = ansible.posix.profile_tasks,ansible.builtin.default
+stdout_callback = ansible.builtin.default
+callback_format_pretty = yaml
+callback_result_format = yaml
+show_task_path_on_failure = true
 display_args_to_stdout = True
 gathering = smart
 fact_caching = jsonfile
@@ -15,5 +18,6 @@ fact_caching_timeout = 0
 inventory = inventory.yml
 pipelining = True
 any_errors_fatal = True
+jinja2_native = True
 [ssh_connection]
-ssh_args = -o ControlMaster=auto -o ControlPersist=60s
+ssh_args = -o ControlMaster=auto -o ControlPersist=300

bindep.txt

@@ -22,7 +22,6 @@ podman            [platform:rpm]
 python3-devel     [platform:rpm !platform:rhel-7 !platform:centos-7]
 python3-libvirt   [platform:rpm]
 python3-lxml      [platform:rpm]
-PyYAML            [platform:rpm !platform:rhel-8 !platform:centos-8 !platform:rhel-9 !platform:centos-9 !platform:fedora]
 python3-pyyaml    [platform:rpm !platform:rhel-7 !platform:centos-7]
 python3-dnf       [platform:rpm !platform:rhel-7 !platform:centos-7]