test(ci): exercise Keystone selective plan

.ansible-lint

@@ -14,6 +14,7 @@ exclude_paths:
   - zuul.d
 
 mock_roles:
+  - ensure-go
   - opendev.container_registry
 
 skip_list:

.gitignore

@@ -40,3 +40,4 @@ atmosphere/_version.py
 [._]*.un~
 Session.vim
 Sessionx.vim
+bin/

.goreleaser.yml

@@ -0,0 +1,31 @@
+# Copyright (c) 2026 VEXXHOST, Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+version: 2
+
+builds:
+  - id: atmosphere
+    main: ./cmd/atmosphere
+    binary: atmosphere
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm64
+    ldflags:
+      - -s -w
+
+archives:
+  - id: atmosphere
+    builds:
+      - atmosphere
+    format: tar.gz
+    name_template: "atmosphere_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+
+checksum:
+  name_template: "checksums.txt"
+
+changelog:
+  sort: asc

.zuul.yaml

@@ -1,3 +1,95 @@
+- job:
+    name: atmosphere-molecule-aio-openvswitch-selective
+    parent: atmosphere-molecule-aio-openvswitch
+    pre-run:
+      - test-playbooks/molecule/prepare.yml
+    run:
+      - test-playbooks/molecule/selective-run.yml
+    vars:
+      atmosphere_ci_job: aio-openvswitch
+
+- job:
+    name: atmosphere-molecule-aio-ovn-selective
+    parent: atmosphere-molecule-aio-ovn
+    pre-run:
+      - test-playbooks/molecule/prepare.yml
+    run:
+      - test-playbooks/molecule/selective-run.yml
+    vars:
+      atmosphere_ci_job: aio-ovn
+
+- job:
+    name: atmosphere-molecule-csi-local-path-provisioner-selective
+    parent: atmosphere-molecule-csi-local-path-provisioner
+    pre-run:
+      - test-playbooks/molecule/prepare.yml
+    run:
+      - test-playbooks/molecule/selective-run.yml
+    vars:
+      atmosphere_ci_job: csi-local-path-provisioner
+      atmosphere_deploy_tags:
+        - kubernetes
+        - csi
+
+- job:
+    name: atmosphere-molecule-csi-rbd-selective
+    parent: atmosphere-molecule-csi-rbd
+    pre-run:
+      - test-playbooks/molecule/prepare.yml
+    run:
+      - test-playbooks/molecule/selective-run.yml
+    vars:
+      atmosphere_ci_job: csi-rbd
+      atmosphere_deploy_tags:
+        - ceph
+        - kubernetes
+        - csi
+
+- job:
+    name: atmosphere-molecule-keycloak-selective
+    parent: atmosphere-molecule-keycloak
+    pre-run:
+      - test-playbooks/molecule/prepare.yml
+    run:
+      - test-playbooks/molecule/selective-run.yml
+    vars:
+      atmosphere_ci_job: keycloak
+      atmosphere_deploy_tags:
+        - kubernetes
+        - csi
+        - cert-manager
+        - cluster-issuer
+        - ingress-nginx
+        - rabbitmq-cluster-operator
+        - percona-xtradb-cluster-operator
+        - percona-xtradb-cluster
+        - valkey
+        - memcached
+        - keycloak
+        - kube-prometheus-stack
+        - keystone
+        - horizon
+
 - project:
-    templates:
-      - atmosphere-molecule-jobs
+    vars:
+      atmosphere_ci_plan_base: "origin/{{ zuul.branch }}"
+      ceph_public_network: >-
+        {{
+          ansible_facts['default_ipv4']['network']
+          + '/'
+          + (ansible_facts['default_ipv4']['prefix'] | string)
+        }}
+    check:
+      jobs:
+        - atmosphere-molecule-aio-openvswitch-selective
+        - atmosphere-molecule-aio-ovn-selective
+        - atmosphere-molecule-csi-local-path-provisioner-selective
+        - atmosphere-molecule-csi-rbd-selective
+        - atmosphere-molecule-keycloak-selective
+    gate:
+      jobs:
+        - atmosphere-molecule-aio-openvswitch-selective
+        - atmosphere-molecule-aio-ovn-selective
+        - atmosphere-molecule-csi-local-path-provisioner-selective
+        - atmosphere-molecule-csi-rbd-selective
+        - atmosphere-molecule-keycloak-selective

ci/molecule-plan.yaml

@@ -0,0 +1,233 @@
+---
+version: 1
+
+# Ordinary service changes use the current Atmosphere default backend. Direct
+# networking changes can opt into both variants below.
+canonical_network_backend: openvswitch
+full_network_backends:
+  - openvswitch
+  - ovn
+
+# The AIO Molecule inventory uses local-path storage for Kubernetes workloads.
+# OpenStack services which require Ceph still pull it into their closure through
+# ceph-provisioners and their service dependencies.
+dependency_options:
+  csi_driver: local-path-provisioner
+
+full_verification_profiles:
+  - full
+
+# Zuul jobs are static, but each job consumes an explicit decision from the
+# plan. Backend jobs run the matching AIO variant. Dedicated scenario jobs run
+# only when one of their verification profiles is requested.
+jobs:
+  aio-openvswitch:
+    scenario: aio
+    network_backend: openvswitch
+    skip_if_only_verification_profiles:
+      - csi
+      - keycloak-federation
+
+  aio-ovn:
+    scenario: aio
+    network_backend: ovn
+    skip_if_only_verification_profiles:
+      - csi
+      - keycloak-federation
+
+  csi-local-path-provisioner:
+    scenario: csi
+    verification_profiles:
+      - csi
+
+  csi-rbd:
+    scenario: csi
+    verification_profiles:
+      - csi
+
+  keycloak:
+    scenario: keycloak
+    verification_profiles:
+      - keycloak-federation
+
+rules:
+  - name: planner-policy
+    action: full
+    reason: CI selection policy changed and must validate its conservative fallback
+    paths:
+      - ci/molecule-plan.yaml
+      - cmd/atmosphere/ci.go
+      - cmd/atmosphere/deploy.go
+      - cmd/atmosphere/main.go
+      - internal/ciplan/**
+      - internal/deploy/component.go
+      - internal/deploy/orchestrator.go
+      - pkg/dag/**
+      - molecule/aio/**
+      - test-playbooks/molecule/**
+      - .zuul.yaml
+      - tox.ini
+
+  - name: shared-deployment-code
+    action: full
+    reason: shared deployment code can affect multiple unrelated components
+    paths:
+      - .charts.yml
+      - galaxy.yml
+      - go.mod
+      - go.sum
+      - pyproject.toml
+      - requirements.txt
+      - uv.lock
+      - playbooks/generate_workspace.yml
+      - playbooks/infrastructure.yml
+      - playbooks/monitoring.yml
+      - playbooks/openstack.yml
+      - playbooks/site.yml
+      - molecule/shared/**
+      - plugins/**
+      - roles/defaults/**
+      - roles/ingress/**
+      - roles/openstack_helm_endpoints/**
+      - roles/openstack_helm_ingress/**
+      - roles/openstacksdk/**
+      - roles/rabbitmq/**
+      - roles/tempest/**
+      - charts/tempest/**
+      - charts/patches/tempest/**
+
+  - name: openvswitch-runtime
+    action: targets
+    targets:
+      - openvswitch
+    verification_profiles:
+      - openvswitch
+    network_backends:
+      - openvswitch
+    paths:
+      - Cargo.lock
+      - Cargo.toml
+      - crates/ovsinit/**
+
+  - name: non-runtime
+    action: ignore
+    paths:
+      - .agents/**
+      - .github/**
+      - .gitignore
+      - .gitreview
+      - .pre-commit-config.yaml
+      - .vale.ini
+      - AGENTS.md
+      - CLAUDE.md
+      - CODEOWNERS
+      - LICENSE
+      - README.md
+      - doc/**
+      - releasenotes/**
+      - reno.yaml
+      - renovate.json
+
+components:
+  cert-manager:
+    paths:
+      - charts/cert-manager-webhook-infoblox-wapi/**
+      - charts/patches/cert-manager-webhook-infoblox-wapi/**
+      - charts/godaddy-webhook/**
+      - charts/patches/godaddy-webhook/**
+    verification_profiles:
+      - cert-manager
+
+  csi:
+    paths:
+      - roles/ceph_csi_rbd/**
+      - roles/local_path_provisioner/**
+      - roles/powerstore_csi/**
+      - roles/portworx/**
+      - roles/storpool_csi/**
+      - roles/ibm_block_csi_driver/**
+      - charts/ceph-csi-rbd/**
+      - charts/local-path-provisioner/**
+    verification_profiles:
+      - csi
+
+  percona-xtradb-cluster-operator:
+    paths:
+      - charts/pxc-operator/**
+      - charts/patches/pxc-operator/**
+    verification_profiles:
+      - percona-xtradb-cluster
+
+  keycloak:
+    test_requires:
+      - keystone
+    verification_profiles:
+      - identity
+      - keycloak-federation
+
+  keystone:
+    verification_profiles:
+      - identity
+      - keycloak-federation
+
+  glance:
+    verification_profiles:
+      - image
+
+  cinder:
+    verification_profiles:
+      - volume
+
+  placement:
+    verification_profiles:
+      - placement
+
+  nova:
+    test_requires:
+      - glance-images
+      - neutron
+    verification_profiles:
+      - compute
+    network_backends:
+      - canonical
+
+  neutron:
+    verification_profiles:
+      - network
+    network_backends:
+      - openvswitch
+      - ovn
+
+  heat:
+    test_requires:
+      - glance-images
+      - neutron
+    verification_profiles:
+      - orchestration
+    network_backends:
+      - canonical
+
+  octavia:
+    verification_profiles:
+      - load-balancer
+    network_backends:
+      - canonical
+
+  manila:
+    verification_profiles:
+      - shared-file-system
+    network_backends:
+      - canonical
+
+  magnum:
+    test_requires:
+      - barbican
+      - cinder
+      - glance-images
+      - heat
+      - neutron
+      - octavia
+    verification_profiles:
+      - container-infrastructure
+    network_backends:
+      - canonical