Identity added: /runner/artifacts/35/ssh_key_data (a2-awx-dispatch-to-vm-dev-mgmt-01)
Using /runner/project/ansible.cfg as config file

PLAY [A2 dispatch A1 read-only validation on management Ansible host] **********

TASK [Run A1 read-only validation wrapper from management host] ****************
[WARNING]: Platform linux on host vm_dev_mgmt_01 is using the discovered Python
interpreter at /usr/bin/python3.10, but future installation of another Python
interpreter could change the meaning of that path. See
https://docs.ansible.com/ansible-
core/2.18/reference_appendices/interpreter_discovery.html for more information.
ok: [vm_dev_mgmt_01] => {"ansible_facts": {"discovered_interpreter_python": "/usr/bin/python3.10"}, "changed": false, "cmd": "set -euo pipefail\\ncd \\"/home/azureuser/azawslab-o3b-ansible\\"\\nA1_AWS_PROFILE=\\"o3b-mgmt-rolesanywhere\\" A1_AWS_REGION=\\"eu-west-1\\" network/scripts/run-readonly-validation.sh\\n", "delta": "0:00:14.262595", "end": "2026-05-13 13:05:42.818595", "msg": "", "rc": 0, "start": "2026-05-13 13:05:28.556000", "stderr": "Loading FortiGate API token from Azure Key Vault: kvdevazawsne01/p5-fortigate-api-token\\nLoading VyOS Ansible password from Azure Key Vault: kvdevazawsne01/o3b-vyos-ansible-password\\nUsing AWS profile for SSM: o3b-mgmt-rolesanywhere\\nValidating AWS identity before Cisco SSM read.\\nLoading Cisco RESTCONF password from AWS SSM: /azawslab/release2/o3b/cisco-restconf-password\\nA1 runtime secrets loaded into environment variables only.", "stderr_lines": ["Loading FortiGate API token from Azure Key Vault: kvdevazawsne01/p5-fortigate-api-token", "Loading VyOS Ansible password from Azure Key Vault: kvdevazawsne01/o3b-vyos-ansible-password", "Using AWS profile for SSM: o3b-mgmt-rolesanywhere", "Validating AWS identity before Cisco SSM read.", "Loading Cisco RESTCONF password from AWS SSM: /azawslab/release2/o3b/cisco-restconf-password", "A1 runtime secrets loaded into environment variables only."], "stdout": "\\nPLAY [A1 FortiGate read-only validation] ***************************************\\n\\nTASK [fortigate_readonly : Assert FortiGate API token is loaded from Azure Key Vault runtime environment] ***\\nok: [fortigate_azure] => changed=false \\n  msg: All assertions passed\\n\\nTASK [fortigate_readonly : Read FortiGate system status using bearer token] ****\\nok: [fortigate_azure]\\n\\nTASK [fortigate_readonly : Read FortiGate firewall policies] *******************\\nok: [fortigate_azure]\\n\\nTASK [fortigate_readonly : Read FortiGate static routes] ***********************\\nok: [fortigate_azure]\\n\\nTASK [fortigate_readonly : Save FortiGate read-only validation evidence] *******\\nok: [fortigate_azure -> localhost]\\n\\nPLAY [A1 VyOS read-only validation] ********************************************\\n\\nTASK [vyos_readonly : Assert VyOS password is loaded from Azure Key Vault runtime environment] ***\\nok: [vyos01] => changed=false \\n  msg: All assertions passed\\n\\nTASK [vyos_readonly : Read VyOS operational state] *****************************\\nok: [vyos01]\\n\\nTASK [vyos_readonly : Save VyOS read-only validation evidence] *****************\\nok: [vyos01 -> localhost]\\n\\nPLAY [A1 Cisco read-only validation] *******************************************\\n\\nTASK [cisco_readonly : Assert Cisco RESTCONF password is loaded from AWS SSM runtime environment] ***\\nok: [cisco_aws_branch_01] => changed=false \\n  msg: All assertions passed\\n\\nTASK [cisco_readonly : Read Cisco interfaces through RESTCONF] *****************\\nok: [cisco_aws_branch_01]\\n\\nTASK [cisco_readonly : Read Cisco BGP and route state through controlled OpenSSH fallback] ***\\nok: [cisco_aws_branch_01 -> localhost]\\n\\nTASK [cisco_readonly : Save Cisco read-only validation evidence] ***************\\nok: [cisco_aws_branch_01 -> localhost]\\n\\nPLAY RECAP *********************************************************************\\ncisco_aws_branch_01        : ok=4    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   \\nfortigate_azure            : ok=5    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   \\nvyos01                     : ok=3    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   \\n\\nA1 read-only validation complete. Runtime secrets unset.", "stdout_lines": ["", "PLAY [A1 FortiGate read-only validation] ***************************************", "", "TASK [fortigate_readonly : Assert FortiGate API token is loaded from Azure Key Vault runtime environment] ***", "ok: [fortigate_azure] => changed=false ", "  msg: All assertions passed", "", "TASK [fortigate_readonly : Read FortiGate system status using bearer token] ****", "ok: [fortigate_azure]", "", "TASK [fortigate_readonly : Read FortiGate firewall policies] *******************", "ok: [fortigate_azure]", "", "TASK [fortigate_readonly : Read FortiGate static routes] ***********************", "ok: [fortigate_azure]", "", "TASK [fortigate_readonly : Save FortiGate read-only validation evidence] *******", "ok: [fortigate_azure -> localhost]", "", "PLAY [A1 VyOS read-only validation] ********************************************", "", "TASK [vyos_readonly : Assert VyOS password is loaded from Azure Key Vault runtime environment] ***", "ok: [vyos01] => changed=false ", "  msg: All assertions passed", "", "TASK [vyos_readonly : Read VyOS operational state] *****************************", "ok: [vyos01]", "", "TASK [vyos_readonly : Save VyOS read-only validation evidence] *****************", "ok: [vyos01 -> localhost]", "", "PLAY [A1 Cisco read-only validation] *******************************************", "", "TASK [cisco_readonly : Assert Cisco RESTCONF password is loaded from AWS SSM runtime environment] ***", "ok: [cisco_aws_branch_01] => changed=false ", "  msg: All assertions passed", "", "TASK [cisco_readonly : Read Cisco interfaces through RESTCONF] *****************", "ok: [cisco_aws_branch_01]", "", "TASK [cisco_readonly : Read Cisco BGP and route state through controlled OpenSSH fallback] ***", "ok: [cisco_aws_branch_01 -> localhost]", "", "TASK [cisco_readonly : Save Cisco read-only validation evidence] ***************", "ok: [cisco_aws_branch_01 -> localhost]", "", "PLAY RECAP *********************************************************************", "cisco_aws_branch_01        : ok=4    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   ", "fortigate_azure            : ok=5    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   ", "vyos01                     : ok=3    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   ", "", "A1 read-only validation complete. Runtime secrets unset."]}

TASK [Assert A1 read-only validation completed successfully] *******************
ok: [vm_dev_mgmt_01] => {
    "changed": false,
    "msg": "A1 read-only validation completed successfully from the management host."
}

TASK [Show A1 read-only validation output] *************************************
ok: [vm_dev_mgmt_01] => {
    "a2_a1_readonly_dispatch.stdout_lines": [
        "",
        "PLAY [A1 FortiGate read-only validation] ***************************************",
        "",
        "TASK [fortigate_readonly : Assert FortiGate API token is loaded from Azure Key Vault runtime environment] ***",
        "ok: [fortigate_azure] => changed=false ",
        "  msg: All assertions passed",
        "",
        "TASK [fortigate_readonly : Read FortiGate system status using bearer token] ****",
        "ok: [fortigate_azure]",
        "",
        "TASK [fortigate_readonly : Read FortiGate firewall policies] *******************",
        "ok: [fortigate_azure]",
        "",
        "TASK [fortigate_readonly : Read FortiGate static routes] ***********************",
        "ok: [fortigate_azure]",
        "",
        "TASK [fortigate_readonly : Save FortiGate read-only validation evidence] *******",
        "ok: [fortigate_azure -> localhost]",
        "",
        "PLAY [A1 VyOS read-only validation] ********************************************",
        "",
        "TASK [vyos_readonly : Assert VyOS password is loaded from Azure Key Vault runtime environment] ***",
        "ok: [vyos01] => changed=false ",
        "  msg: All assertions passed",
        "",
        "TASK [vyos_readonly : Read VyOS operational state] *****************************",
        "ok: [vyos01]",
        "",
        "TASK [vyos_readonly : Save VyOS read-only validation evidence] *****************",
        "ok: [vyos01 -> localhost]",
        "",
        "PLAY [A1 Cisco read-only validation] *******************************************",
        "",
        "TASK [cisco_readonly : Assert Cisco RESTCONF password is loaded from AWS SSM runtime environment] ***",
        "ok: [cisco_aws_branch_01] => changed=false ",
        "  msg: All assertions passed",
        "",
        "TASK [cisco_readonly : Read Cisco interfaces through RESTCONF] *****************",
        "ok: [cisco_aws_branch_01]",
        "",
        "TASK [cisco_readonly : Read Cisco BGP and route state through controlled OpenSSH fallback] ***",
        "ok: [cisco_aws_branch_01 -> localhost]",
        "",
        "TASK [cisco_readonly : Save Cisco read-only validation evidence] ***************",
        "ok: [cisco_aws_branch_01 -> localhost]",
        "",
        "PLAY RECAP *********************************************************************",
        "cisco_aws_branch_01        : ok=4    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   ",
        "fortigate_azure            : ok=5    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   ",
        "vyos01                     : ok=3    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   ",
        "",
        "A1 read-only validation complete. Runtime secrets unset."
    ]
}

PLAY RECAP *********************************************************************
vm_dev_mgmt_01             : ok=3    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0