Test with secrets

Author: Alex-Welsh

etc/kayobe/environments/ci-tenks/automated-deployment.sh

@@ -14,6 +14,13 @@ KAYOBE_BRANCH=stackhpc/2025.1
 KAYOBE_CONFIG_REF=${KAYOBE_CONFIG_REF:-stackhpc/2025.1}
 KAYOBE_ENVIRONMENT=${KAYOBE_ENVIRONMENT:-ci-tenks}
 
+if [[ ! -f $BASE_PATH/vault-pw ]]; then
+    echo "Vault password file not found at $BASE_PATH/vault-pw"
+    exit 1
+fi
+
+export KAYOBE_VAULT_PASSWORD=$(cat $BASE_PATH/vault-pw)
+
 # Install git and tmux.
 if $(which dnf 2>/dev/null >/dev/null); then
     sudo dnf -y install git tmux python3.12

zuul.d/jobs.yaml

@@ -8,8 +8,10 @@
       Configures the primary VM as a seed hypervisor. Uses tenks to create
       a single overcloud host and test Bifrost provisioning.
     run: zuul.d/playbooks/tenks-base/run.yml
-    # post-run: zuul.d/playbooks/tenks-base/post.yml
+    post-run: zuul.d/playbooks/tenks-base/post.yml
     timeout: 10800
+    secrets:
+      - aio_vault_password
 
 - job:
     name: tenks-ubuntu-noble

zuul.d/playbooks/tenks-base/post.yml

@@ -1,11 +1,9 @@
 ---
 - hosts: all
-  vars:
-    script_path: "/home/zuul/src/github.com/stackhpc/stackhpc-kayobe-config/etc/kayobe/environments/ci-tenks/automated-deployment.sh"
   tasks:
     - name: debug 1
       shell:
-        cmd: "ls {{ script_path }}"
+        cmd: "echo ~"
         executable: /bin/bash
       register: debug1
       failed_when: false

zuul.d/playbooks/tenks-base/run.yml

@@ -3,6 +3,12 @@
   vars:
     script_path: "/home/zuul/src/github.com/stackhpc/stackhpc-kayobe-config/etc/kayobe/environments/ci-tenks/automated-deployment.sh"
   tasks:
+    - name: Write out vault password file
+      copy:
+        content: "{{ aio_vault_password.vault_pw | trim }}"
+        dest: "~/vault-pw"
+      no_log: true
+
     - name: Run deploy script
       environment:
         KAYOBE_CONFIG_REF: "{{ zuul.patchset }}"

zuul.d/project.yaml

@@ -4,6 +4,9 @@
     check:
       jobs:
         - openstack-tox-pep8
+
+    check-review:
+      jobs:
         - tenks-ubuntu-noble
         # - tenks-rocky-9
 

zuul.d/secrets.yaml

@@ -0,0 +1,15 @@
+---
+- secret:
+    name: aio_vault_password
+    data:
+      vault_pw: !encrypted/pkcs1-oaep
+        - HyNVu3K9CqgBWIdraZwqGBIgh+uNiHdPz43TOG0vGmm4sF++axK4/JFtoGeyV6UhtsqzC
+          5kXiKLjNj9HRxN9E7u5MDljIsduviEilkI5NQEJ5ctCJGMM0W42+7RtvwD/bIKK/ZHupV
+          suSDt0WxaBy6ipHjNj+3HgacxH0hG2B2wDuvxnkmMH1z5Z+LTQ4E8h3az/qwuxB9S7WK7
+          Mekq6ujBUKcgoZg7x9JGsbD0U2+pNSTSUtEzbM73jhtlTzZB8pYcgsYDyxF69yyf451Ww
+          L0vRbExNnfGxiclc4jWGpQHGUj4G0kPp+SYet3dzp8o29xzfr76e/9c3FCABXGQ8ShHin
+          uY7tzr07bqobWW3gRiyqDMZ8e41ipjTl+yN66TDLafftmk2k8uj8wxgf8X08eZhpYsOxx
+          BhDzI0IcC2vmhlp9HpF4oZBwtzZFD2XSGMVr79+535l49qzayJtgj2H6fBTonkf9WTjUC
+          lo1zXFr4Smer4FQJnIVK5N1GaW5PBTUNl2ZHxF9u/RIvf+XhHF0q540PNB1MQaTwptJw3
+          d2v19p9vbTk7pjrtgWZDy9g/G+vGjSJ/QPbItcp4MqmVhSZFT+B4v03xlNzi8/3CR5tIw
+          MPPm5+laBkk4PTU0sAJu7dbS9lonx0su2Rvjzoa/zxkVsGXW71ztkU45ODOPn8=