Hello (again),

This is a follow-up to a prior mail

http://lists.zuul-ci.org/pipermail/zuul-discuss/2018-June/000446.html

---

The "validate-host" role [1] currently creates the "inventory.yaml" [2] file, which contains the ansible inventory information for the job.

For some history, the role was originally called "debug-ansible" but renamed to "validate-host". Since it collects other ansible information, saving the inventory was added to the role shortly after the rename.

As copying this inventory information requires access to the executor context, it must be run as a privileged job. However, the role also includes quite a number of other operations that do not have similar requirements.

Due to not currently having an automated CI testing framework for privileged jobs, this leaves changes to these unrelated parts (like [3]) with insufficient testing coverage.

The creation of the inventory file has been moved into a separate role "log-inventory" [4]. We now wish to remove the inventory creation from the "validate-host" role [5]. This will lower the surface-area of privileged jobs and also enable more straight-forward testing of the rest of the "validate-host" role [6].

For the OpenStack ecosystem, the new role will be added to the base job [7] so this should be entirely transparent.

If you build your own base templates you will need to add the "log-inventory" role to continue collecting the inventory.yaml. You can do this *now*, and thus be unaffected when the creation is removed from "validate-host", with one caveat:

Note that testing uncovered an issue with the original role -- the "inventory_file" variable is not set by Ansible for localhost only jobs. Thus "log-inventory" will not break any jobs where "validate-host" was working, but you should be careful not to additionally introduce it into localhost (that is to say, executor-only) jobs without considering this.

Longer term, the issue has been fixed and "log-inventory" is safe to use in all contexts. A separate variable for the inventory file has been added to the executor context with [8] and is now conditionally used in "log-inventory" with [9] (thus if you are using zuul from master, you are unaffected). Per the deprecation policy for requiring new zuul features [10], this new variable will be used unconditionally to copy the file with [11] around 4 weeks after the next zuul release.

Taking into consideration:

* reviews posted for several weeks * pending debugging of gate issues with "validate-host" * the informational/debugging nature of the output * the relative ease of adding the new role to maintain the status quo * interaction with current users of the roles

I would suggest we merge

[7] - addition of "log-inventory" to base jobs in project-config [5] - removal of inventory copy from "validate-host"

To complete the initial part of this transition.

Thank you

-i

[1] https://git.openstack.org/cgit/openstack-infra/zuul-jobs/tree/roles/validate... [2] see any job results zuul-info/inventory.yaml [3] https://review.openstack.org/576351 [4] https://git.openstack.org/cgit/openstack-infra/zuul-jobs/tree/roles/log-inve... [5] https://review.openstack.org/563790 [6] https://review.openstack.org/563788 [7] https://review.openstack.org/563789 [8] https://review.openstack.org/578235 [9] https://review.openstack.org/578234 [10] https://zuul-ci.org/docs/zuul-jobs/deprecation.html [11] https://review.openstack.org/578238