)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"b89e4e0edb11b88a9d93a9ab760e6769a6ea4282","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"36c30363_26d7bc54","updated":"2026-06-15 06:38:54.000000000","message":"Assuming CI would pass.","commit_id":"6abfbee61a032aeab3201cea148c96596edd7c97"}],"castellan/key_manager/vault_key_manager.py":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"c143f2b8c1cd870a264f9fdb01945c907b1b36ed","unresolved":true,"context_lines":[{"line_number":65,"context_line":"        secret\u003dTrue,"},{"line_number":66,"context_line":"        help\u003d\u0027AppRole secret_id for authentication with vault\u0027,"},{"line_number":67,"context_line":"    ),"},{"line_number":68,"context_line":"    cfg.StrOpt("},{"line_number":69,"context_line":"        \u0027kubernetes_role\u0027,"},{"line_number":70,"context_line":"        help\u003d\u0027Vault role name for Kubernetes auth method. \u0027"},{"line_number":71,"context_line":"        \u0027Setting this option enables Kubernetes authentication \u0027"},{"line_number":72,"context_line":"        \u0027with Vault.\u0027,"},{"line_number":73,"context_line":"    ),"},{"line_number":74,"context_line":"    cfg.StrOpt("},{"line_number":75,"context_line":"        \u0027kubernetes_auth_mount\u0027,"},{"line_number":76,"context_line":"        default\u003d\u0027kubernetes\u0027,"},{"line_number":77,"context_line":"        help\u003d\u0027Mount path of the Kubernetes auth method in Vault \u0027"},{"line_number":78,"context_line":"        \u0027(e.g. \"kubernetes\" or \"kubernetes-my-cluster\"). \u0027"},{"line_number":79,"context_line":"        \u0027Defaults to \"kubernetes\".\u0027,"},{"line_number":80,"context_line":"    ),"},{"line_number":81,"context_line":"    cfg.StrOpt("},{"line_number":82,"context_line":"        \u0027kubernetes_sa_token_path\u0027,"},{"line_number":83,"context_line":"        default\u003d_DEFAULT_K8S_SA_TOKEN_PATH,"},{"line_number":84,"context_line":"        help\u003d\u0027Path to the Kubernetes ServiceAccount token file \u0027"},{"line_number":85,"context_line":"        \u0027used for Vault login. Defaults to the standard \u0027"},{"line_number":86,"context_line":"        \u0027projected token path.\u0027,"},{"line_number":87,"context_line":"    ),"},{"line_number":88,"context_line":"    cfg.StrOpt("},{"line_number":89,"context_line":"        \u0027kv_mountpoint\u0027,"},{"line_number":90,"context_line":"        default\u003d_DEFAULT_MOUNTPOINT,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3ea7090c_c02309c8","line":87,"range":{"start_line":68,"start_character":15,"end_line":87,"end_character":6},"updated":"2026-06-12 15:21:30.000000000","message":"Can we make these option more generic and independent from deployment-mechanism ? This is quite too much adopted to a specific deployment pattern and I don\u0027t even think this is the only pattern we expect in k8s.\n\nFor example kubernetes_auth_mount can be auth path option","commit_id":"1cbf1872cd36f26fc645dec38d011e21452b241b"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"fe64ea88a9e47aac42bcd97d5fca19e4f7ff06b6","unresolved":true,"context_lines":[{"line_number":65,"context_line":"        secret\u003dTrue,"},{"line_number":66,"context_line":"        help\u003d\u0027AppRole secret_id for authentication with vault\u0027,"},{"line_number":67,"context_line":"    ),"},{"line_number":68,"context_line":"    cfg.StrOpt("},{"line_number":69,"context_line":"        \u0027kubernetes_role\u0027,"},{"line_number":70,"context_line":"        help\u003d\u0027Vault role name for Kubernetes auth method. \u0027"},{"line_number":71,"context_line":"        \u0027Setting this option enables Kubernetes authentication \u0027"},{"line_number":72,"context_line":"        \u0027with Vault.\u0027,"},{"line_number":73,"context_line":"    ),"},{"line_number":74,"context_line":"    cfg.StrOpt("},{"line_number":75,"context_line":"        \u0027kubernetes_auth_mount\u0027,"},{"line_number":76,"context_line":"        default\u003d\u0027kubernetes\u0027,"},{"line_number":77,"context_line":"        help\u003d\u0027Mount path of the Kubernetes auth method in Vault \u0027"},{"line_number":78,"context_line":"        \u0027(e.g. \"kubernetes\" or \"kubernetes-my-cluster\"). \u0027"},{"line_number":79,"context_line":"        \u0027Defaults to \"kubernetes\".\u0027,"},{"line_number":80,"context_line":"    ),"},{"line_number":81,"context_line":"    cfg.StrOpt("},{"line_number":82,"context_line":"        \u0027kubernetes_sa_token_path\u0027,"},{"line_number":83,"context_line":"        default\u003d_DEFAULT_K8S_SA_TOKEN_PATH,"},{"line_number":84,"context_line":"        help\u003d\u0027Path to the Kubernetes ServiceAccount token file \u0027"},{"line_number":85,"context_line":"        \u0027used for Vault login. Defaults to the standard \u0027"},{"line_number":86,"context_line":"        \u0027projected token path.\u0027,"},{"line_number":87,"context_line":"    ),"},{"line_number":88,"context_line":"    cfg.StrOpt("},{"line_number":89,"context_line":"        \u0027kv_mountpoint\u0027,"},{"line_number":90,"context_line":"        default\u003d_DEFAULT_MOUNTPOINT,"}],"source_content_type":"text/x-python","patch_set":2,"id":"449adb99_b27346b0","line":87,"range":{"start_line":68,"start_character":15,"end_line":87,"end_character":6},"in_reply_to":"3ea7090c_c02309c8","updated":"2026-06-12 16:09:32.000000000","message":"Actually I hadn\u0027t seen it as being so generic (was definitely aiming for k8s specific), but now that you mention it, this really would essentially work for other deployment methods by just overloading these opts... I\u0027ll see if I can do the work to make it slightly more generic (though the only Vault I have access to is via a pretty specific k8s auth so I may need help verifying it works generically).","commit_id":"1cbf1872cd36f26fc645dec38d011e21452b241b"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"ee3ea19481097b2649578b299c8db4c34a074ff3","unresolved":false,"context_lines":[{"line_number":65,"context_line":"        secret\u003dTrue,"},{"line_number":66,"context_line":"        help\u003d\u0027AppRole secret_id for authentication with vault\u0027,"},{"line_number":67,"context_line":"    ),"},{"line_number":68,"context_line":"    cfg.StrOpt("},{"line_number":69,"context_line":"        \u0027kubernetes_role\u0027,"},{"line_number":70,"context_line":"        help\u003d\u0027Vault role name for Kubernetes auth method. \u0027"},{"line_number":71,"context_line":"        \u0027Setting this option enables Kubernetes authentication \u0027"},{"line_number":72,"context_line":"        \u0027with Vault.\u0027,"},{"line_number":73,"context_line":"    ),"},{"line_number":74,"context_line":"    cfg.StrOpt("},{"line_number":75,"context_line":"        \u0027kubernetes_auth_mount\u0027,"},{"line_number":76,"context_line":"        default\u003d\u0027kubernetes\u0027,"},{"line_number":77,"context_line":"        help\u003d\u0027Mount path of the Kubernetes auth method in Vault \u0027"},{"line_number":78,"context_line":"        \u0027(e.g. \"kubernetes\" or \"kubernetes-my-cluster\"). \u0027"},{"line_number":79,"context_line":"        \u0027Defaults to \"kubernetes\".\u0027,"},{"line_number":80,"context_line":"    ),"},{"line_number":81,"context_line":"    cfg.StrOpt("},{"line_number":82,"context_line":"        \u0027kubernetes_sa_token_path\u0027,"},{"line_number":83,"context_line":"        default\u003d_DEFAULT_K8S_SA_TOKEN_PATH,"},{"line_number":84,"context_line":"        help\u003d\u0027Path to the Kubernetes ServiceAccount token file \u0027"},{"line_number":85,"context_line":"        \u0027used for Vault login. Defaults to the standard \u0027"},{"line_number":86,"context_line":"        \u0027projected token path.\u0027,"},{"line_number":87,"context_line":"    ),"},{"line_number":88,"context_line":"    cfg.StrOpt("},{"line_number":89,"context_line":"        \u0027kv_mountpoint\u0027,"},{"line_number":90,"context_line":"        default\u003d_DEFAULT_MOUNTPOINT,"}],"source_content_type":"text/x-python","patch_set":2,"id":"76f00005_e059da38","line":87,"range":{"start_line":68,"start_character":15,"end_line":87,"end_character":6},"in_reply_to":"449adb99_b27346b0","updated":"2026-06-12 16:20:30.000000000","message":"Done -- kind of amazed that\u0027s all that we needed to make it truly generic.","commit_id":"1cbf1872cd36f26fc645dec38d011e21452b241b"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"f8c7ad2eca7314f0fc4c39cbe5bc73f8c04c55cf","unresolved":false,"context_lines":[{"line_number":102,"context_line":"    cfg.URIOpt("},{"line_number":103,"context_line":"        \u0027vault_url\u0027,"},{"line_number":104,"context_line":"        default\u003d_DEFAULT_VAULT_URL,"},{"line_number":105,"context_line":"        schemes\u003d(\u0027http\u0027, \u0027https\u0027),"},{"line_number":106,"context_line":"        help\u003d\u0027Use this endpoint to connect to Vault\u0027,"},{"line_number":107,"context_line":"    ),"},{"line_number":108,"context_line":"    cfg.StrOpt(\u0027ssl_ca_crt_file\u0027, help\u003d\u0027Absolute path to ca cert file\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"c9a12ea3_6e1c4145","line":105,"updated":"2026-06-11 23:32:06.000000000","message":"pep8: error: Argument \"schemes\" to \"URIOpt\" has incompatible type \"tuple[str, str]\"; expected \"list[str] | None\"  [arg-type]","commit_id":"1cbf1872cd36f26fc645dec38d011e21452b241b"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"a6da14d1e96d64112514a455c612c4740940dec5","unresolved":true,"context_lines":[{"line_number":72,"context_line":"        \u0027enables token file authentication with Vault.\u0027,"},{"line_number":73,"context_line":"    ),"},{"line_number":74,"context_line":"    cfg.StrOpt("},{"line_number":75,"context_line":"        \u0027token_auth_mount\u0027,"},{"line_number":76,"context_line":"        default\u003d\u0027kubernetes\u0027,"},{"line_number":77,"context_line":"        help\u003d\u0027Mount path of the token-based auth method in \u0027"},{"line_number":78,"context_line":"        \u0027Vault (e.g. \"kubernetes\", \"jwt\", \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"2165d88b_a6e59739","line":75,"range":{"start_line":75,"start_character":9,"end_line":75,"end_character":25},"updated":"2026-06-12 16:27:15.000000000","message":"\u0027mount\u0027 is confusing because it indicates filesystem path but it is actually a request path.\n\nI wonder if we can add auth_method option, which defaults to approle ? We can define `choices\u003d(\u0027approle\u0027, \u0027kubernetes\u0027)` to restrict methods for now","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a9ec8681e3f1d78ba5c421d19e3fd83a743123c0","unresolved":true,"context_lines":[{"line_number":72,"context_line":"        \u0027enables token file authentication with Vault.\u0027,"},{"line_number":73,"context_line":"    ),"},{"line_number":74,"context_line":"    cfg.StrOpt("},{"line_number":75,"context_line":"        \u0027token_auth_mount\u0027,"},{"line_number":76,"context_line":"        default\u003d\u0027kubernetes\u0027,"},{"line_number":77,"context_line":"        help\u003d\u0027Mount path of the token-based auth method in \u0027"},{"line_number":78,"context_line":"        \u0027Vault (e.g. \"kubernetes\", \"jwt\", \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"51ba49d3_ba28f3be","line":75,"range":{"start_line":75,"start_character":9,"end_line":75,"end_character":25},"in_reply_to":"2165d88b_a6e59739","updated":"2026-06-12 17:44:12.000000000","message":"Would you want \"approle\" and \"token\"? to keep things non-k8s-specific?","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"55e7763f3dbe7fc8c6dd7b06e0361866ea606cf7","unresolved":true,"context_lines":[{"line_number":72,"context_line":"        \u0027enables token file authentication with Vault.\u0027,"},{"line_number":73,"context_line":"    ),"},{"line_number":74,"context_line":"    cfg.StrOpt("},{"line_number":75,"context_line":"        \u0027token_auth_mount\u0027,"},{"line_number":76,"context_line":"        default\u003d\u0027kubernetes\u0027,"},{"line_number":77,"context_line":"        help\u003d\u0027Mount path of the token-based auth method in \u0027"},{"line_number":78,"context_line":"        \u0027Vault (e.g. \"kubernetes\", \"jwt\", \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"8d304d35_a935fec9","line":75,"range":{"start_line":75,"start_character":9,"end_line":75,"end_character":25},"in_reply_to":"3be80abc_a58a705c","updated":"2026-06-15 04:31:45.000000000","message":"I started adding token, but it really is exactly the same codepath as kubernetes... I feel like the approach of just making it generically \"token\" and then setting a default path that matches the most likely case (which happens to BE kubernetes) is a reasonable compromise?","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"ad5d620ed7586c8584428c12049843afbb798613","unresolved":true,"context_lines":[{"line_number":72,"context_line":"        \u0027enables token file authentication with Vault.\u0027,"},{"line_number":73,"context_line":"    ),"},{"line_number":74,"context_line":"    cfg.StrOpt("},{"line_number":75,"context_line":"        \u0027token_auth_mount\u0027,"},{"line_number":76,"context_line":"        default\u003d\u0027kubernetes\u0027,"},{"line_number":77,"context_line":"        help\u003d\u0027Mount path of the token-based auth method in \u0027"},{"line_number":78,"context_line":"        \u0027Vault (e.g. \"kubernetes\", \"jwt\", \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"d350da99_6c36981d","line":75,"range":{"start_line":75,"start_character":9,"end_line":75,"end_character":25},"in_reply_to":"489f0028_a25e8336","updated":"2026-06-15 06:06:57.000000000","message":"We still need the ability to specify a custom path -- our path in our deployment (as I thought I mentioned) is not simply the default \"kubernetes\". It is somewhat often a custom path in complex deployments. Removing this makes this unusable for my case.","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"338232539c163cb4f5fbed8637ce06a004012347","unresolved":true,"context_lines":[{"line_number":72,"context_line":"        \u0027enables token file authentication with Vault.\u0027,"},{"line_number":73,"context_line":"    ),"},{"line_number":74,"context_line":"    cfg.StrOpt("},{"line_number":75,"context_line":"        \u0027token_auth_mount\u0027,"},{"line_number":76,"context_line":"        default\u003d\u0027kubernetes\u0027,"},{"line_number":77,"context_line":"        help\u003d\u0027Mount path of the token-based auth method in \u0027"},{"line_number":78,"context_line":"        \u0027Vault (e.g. \"kubernetes\", \"jwt\", \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"3be80abc_a58a705c","line":75,"range":{"start_line":75,"start_character":9,"end_line":75,"end_character":25},"in_reply_to":"51ba49d3_ba28f3be","updated":"2026-06-13 07:58:36.000000000","message":"I think it\u0027s ok to expose kubernetes here because that\u0027s within the context of auth method defined in vault. We could also add \u0027token\u0027 as a supported auth method.","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"f52ff5b784661fb89aca59ebd9357cfbb8c6b28b","unresolved":true,"context_lines":[{"line_number":72,"context_line":"        \u0027enables token file authentication with Vault.\u0027,"},{"line_number":73,"context_line":"    ),"},{"line_number":74,"context_line":"    cfg.StrOpt("},{"line_number":75,"context_line":"        \u0027token_auth_mount\u0027,"},{"line_number":76,"context_line":"        default\u003d\u0027kubernetes\u0027,"},{"line_number":77,"context_line":"        help\u003d\u0027Mount path of the token-based auth method in \u0027"},{"line_number":78,"context_line":"        \u0027Vault (e.g. \"kubernetes\", \"jwt\", \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"489f0028_a25e8336","line":75,"range":{"start_line":75,"start_character":9,"end_line":75,"end_character":25},"in_reply_to":"8d304d35_a935fec9","updated":"2026-06-15 05:47:42.000000000","message":"I noticed I should have mentioned \"jwt\" instead of \"token\". I\u0027ve updated the implementation accordingly. This allows us to switch auth mechanism by the single method option, not by two options, auth_method and auth_path.","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"01278365b605456bd2e7b7a5a449a182b652b7cc","unresolved":true,"context_lines":[{"line_number":72,"context_line":"        \u0027enables token file authentication with Vault.\u0027,"},{"line_number":73,"context_line":"    ),"},{"line_number":74,"context_line":"    cfg.StrOpt("},{"line_number":75,"context_line":"        \u0027token_auth_mount\u0027,"},{"line_number":76,"context_line":"        default\u003d\u0027kubernetes\u0027,"},{"line_number":77,"context_line":"        help\u003d\u0027Mount path of the token-based auth method in \u0027"},{"line_number":78,"context_line":"        \u0027Vault (e.g. \"kubernetes\", \"jwt\", \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"e22e22f6_69e56734","line":75,"range":{"start_line":75,"start_character":9,"end_line":75,"end_character":25},"in_reply_to":"d350da99_6c36981d","updated":"2026-06-15 06:13:34.000000000","message":"Could you help me understand how that customized path look like ?\n\nI checked the vault documentation in https://developer.hashicorp.com/vault/api-docs/auth/kubernetes#login and it describes that paths are changed according to auth method and does not provide any information about how it could be changed. Is that path caused by any front-facing lb or similar thing ?","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"b2589e7a93b00d5864ae5d715dd50ebe3bfc805c","unresolved":false,"context_lines":[{"line_number":72,"context_line":"        \u0027enables token file authentication with Vault.\u0027,"},{"line_number":73,"context_line":"    ),"},{"line_number":74,"context_line":"    cfg.StrOpt("},{"line_number":75,"context_line":"        \u0027token_auth_mount\u0027,"},{"line_number":76,"context_line":"        default\u003d\u0027kubernetes\u0027,"},{"line_number":77,"context_line":"        help\u003d\u0027Mount path of the token-based auth method in \u0027"},{"line_number":78,"context_line":"        \u0027Vault (e.g. \"kubernetes\", \"jwt\", \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"ebeeb22f_cc3c4fe0","line":75,"range":{"start_line":75,"start_character":9,"end_line":75,"end_character":25},"in_reply_to":"e22e22f6_69e56734","updated":"2026-06-15 06:35:06.000000000","message":"So according to https://developer.hashicorp.com/vault/docs/auth/userpass#configuration vault allows customized path which replaces the auth_method string so we can implement a similar interface then.","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"a6da14d1e96d64112514a455c612c4740940dec5","unresolved":true,"context_lines":[{"line_number":81,"context_line":"    ),"},{"line_number":82,"context_line":"    cfg.StrOpt("},{"line_number":83,"context_line":"        \u0027token_file\u0027,"},{"line_number":84,"context_line":"        default\u003d_DEFAULT_TOKEN_FILE_PATH,"},{"line_number":85,"context_line":"        help\u003d\u0027Path to the token file used for Vault login \u0027"},{"line_number":86,"context_line":"        \u0027(e.g. a Kubernetes ServiceAccount token or a \u0027"},{"line_number":87,"context_line":"        \u0027JWT from an OIDC provider). Defaults to the \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"6247e3fa_41e33c0e","line":84,"range":{"start_line":84,"start_character":16,"end_line":84,"end_character":40},"updated":"2026-06-12 16:27:15.000000000","message":"I\u0027m against adding this kubernetes specific default here. Can we remove it and require explicitly passing it ?","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"f52ff5b784661fb89aca59ebd9357cfbb8c6b28b","unresolved":true,"context_lines":[{"line_number":81,"context_line":"    ),"},{"line_number":82,"context_line":"    cfg.StrOpt("},{"line_number":83,"context_line":"        \u0027token_file\u0027,"},{"line_number":84,"context_line":"        default\u003d_DEFAULT_TOKEN_FILE_PATH,"},{"line_number":85,"context_line":"        help\u003d\u0027Path to the token file used for Vault login \u0027"},{"line_number":86,"context_line":"        \u0027(e.g. a Kubernetes ServiceAccount token or a \u0027"},{"line_number":87,"context_line":"        \u0027JWT from an OIDC provider). Defaults to the \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"ec7706c6_5dc2c241","line":84,"range":{"start_line":84,"start_character":16,"end_line":84,"end_character":40},"in_reply_to":"0361ac18_b4cf330c","updated":"2026-06-15 05:47:42.000000000","message":"If we want it kubernetes-specifc then we likely need options per auth method like jwt_token_file and kubernetes_token_file but I find it quite redundant.\nUsers have to set auth_method according to their deployments so having them configure the path option too does not sounds like large drawback IMHO.","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"3646fe7fd107c195215267f0bccf1a4995668f7b","unresolved":false,"context_lines":[{"line_number":81,"context_line":"    ),"},{"line_number":82,"context_line":"    cfg.StrOpt("},{"line_number":83,"context_line":"        \u0027token_file\u0027,"},{"line_number":84,"context_line":"        default\u003d_DEFAULT_TOKEN_FILE_PATH,"},{"line_number":85,"context_line":"        help\u003d\u0027Path to the token file used for Vault login \u0027"},{"line_number":86,"context_line":"        \u0027(e.g. a Kubernetes ServiceAccount token or a \u0027"},{"line_number":87,"context_line":"        \u0027JWT from an OIDC provider). Defaults to the \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"6559566b_09ca0c4e","line":84,"range":{"start_line":84,"start_character":16,"end_line":84,"end_character":40},"in_reply_to":"60fba0ab_13e004e8","updated":"2026-06-15 09:11:41.000000000","message":"Done","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a9ec8681e3f1d78ba5c421d19e3fd83a743123c0","unresolved":true,"context_lines":[{"line_number":81,"context_line":"    ),"},{"line_number":82,"context_line":"    cfg.StrOpt("},{"line_number":83,"context_line":"        \u0027token_file\u0027,"},{"line_number":84,"context_line":"        default\u003d_DEFAULT_TOKEN_FILE_PATH,"},{"line_number":85,"context_line":"        help\u003d\u0027Path to the token file used for Vault login \u0027"},{"line_number":86,"context_line":"        \u0027(e.g. a Kubernetes ServiceAccount token or a \u0027"},{"line_number":87,"context_line":"        \u0027JWT from an OIDC provider). Defaults to the \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"bb8d14a4_828503fa","line":84,"range":{"start_line":84,"start_character":16,"end_line":84,"end_character":40},"in_reply_to":"6247e3fa_41e33c0e","updated":"2026-06-12 17:44:12.000000000","message":"Yeah, that\u0027s fine.","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"55e7763f3dbe7fc8c6dd7b06e0361866ea606cf7","unresolved":true,"context_lines":[{"line_number":81,"context_line":"    ),"},{"line_number":82,"context_line":"    cfg.StrOpt("},{"line_number":83,"context_line":"        \u0027token_file\u0027,"},{"line_number":84,"context_line":"        default\u003d_DEFAULT_TOKEN_FILE_PATH,"},{"line_number":85,"context_line":"        help\u003d\u0027Path to the token file used for Vault login \u0027"},{"line_number":86,"context_line":"        \u0027(e.g. a Kubernetes ServiceAccount token or a \u0027"},{"line_number":87,"context_line":"        \u0027JWT from an OIDC provider). Defaults to the \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"0361ac18_b4cf330c","line":84,"range":{"start_line":84,"start_character":16,"end_line":84,"end_character":40},"in_reply_to":"bb8d14a4_828503fa","updated":"2026-06-15 04:31:45.000000000","message":"Ok, so I had removed it, and have it back again -- this really is likely to be the default I think in a huge amount of cases, and if it isn\u0027t, people are welcome to override it. There\u0027s certainly not going to be a default filesystem path if you\u0027re not using kubernetes, so the alternative is to set it to nothing and have it be required... I just don\u0027t see the harm in making it a k8s sensible default. Technically my deployment doesn\u0027t use this default because we\u0027re highly customized, but I anticipate simpler deployments would.","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"d21766d3a78b2eb1dd0e698841fcf7ac5da755f3","unresolved":true,"context_lines":[{"line_number":81,"context_line":"    ),"},{"line_number":82,"context_line":"    cfg.StrOpt("},{"line_number":83,"context_line":"        \u0027token_file\u0027,"},{"line_number":84,"context_line":"        default\u003d_DEFAULT_TOKEN_FILE_PATH,"},{"line_number":85,"context_line":"        help\u003d\u0027Path to the token file used for Vault login \u0027"},{"line_number":86,"context_line":"        \u0027(e.g. a Kubernetes ServiceAccount token or a \u0027"},{"line_number":87,"context_line":"        \u0027JWT from an OIDC provider). Defaults to the \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"60fba0ab_13e004e8","line":84,"range":{"start_line":84,"start_character":16,"end_line":84,"end_character":40},"in_reply_to":"c7979ee8_958adc5d","updated":"2026-06-15 06:37:46.000000000","message":"Maybe, though current oslo.config does not allow us to define defaults according to different options. Let\u0027s start with the current implementation (without default) and if we learn people use only k8s then we can add the override and deprecate jwt.","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"ad5d620ed7586c8584428c12049843afbb798613","unresolved":true,"context_lines":[{"line_number":81,"context_line":"    ),"},{"line_number":82,"context_line":"    cfg.StrOpt("},{"line_number":83,"context_line":"        \u0027token_file\u0027,"},{"line_number":84,"context_line":"        default\u003d_DEFAULT_TOKEN_FILE_PATH,"},{"line_number":85,"context_line":"        help\u003d\u0027Path to the token file used for Vault login \u0027"},{"line_number":86,"context_line":"        \u0027(e.g. a Kubernetes ServiceAccount token or a \u0027"},{"line_number":87,"context_line":"        \u0027JWT from an OIDC provider). Defaults to the \u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"c7979ee8_958adc5d","line":84,"range":{"start_line":84,"start_character":16,"end_line":84,"end_character":40},"in_reply_to":"ec7706c6_5dc2c241","updated":"2026-06-15 06:06:57.000000000","message":"We can split them just to have different defaults if we want? It\u0027s just that given they both are the same code path, and there IS no real sane default for jwt (it\u0027s just wherever you put it on your filesystem) I thought this made sense to use, but if it\u0027s that big of a point of contention we can just leave it as required.","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"tag":"autogenerated:zuul:check","change_message_id":"0a5cb4dc3bee8a82f849a9dba5e3a5789786b1f3","unresolved":false,"context_lines":[{"line_number":104,"context_line":"    cfg.URIOpt("},{"line_number":105,"context_line":"        \u0027vault_url\u0027,"},{"line_number":106,"context_line":"        default\u003d_DEFAULT_VAULT_URL,"},{"line_number":107,"context_line":"        schemes\u003d(\u0027http\u0027, \u0027https\u0027),"},{"line_number":108,"context_line":"        help\u003d\u0027Use this endpoint to connect to Vault\u0027,"},{"line_number":109,"context_line":"    ),"},{"line_number":110,"context_line":"    cfg.StrOpt(\u0027ssl_ca_crt_file\u0027, help\u003d\u0027Absolute path to ca cert file\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"c10bc2e7_f7d055f1","line":107,"updated":"2026-06-12 16:51:32.000000000","message":"pep8: error: Argument \"schemes\" to \"URIOpt\" has incompatible type \"tuple[str, str]\"; expected \"list[str] | None\"  [arg-type]","commit_id":"18def48b7b5ca75d5dfcfaa3d515221c9e1b0913"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"fd14218fb78c295de7f517becaa9795d69637081","unresolved":true,"context_lines":[{"line_number":81,"context_line":"        \u0027Required when auth_method is jwt or kubernetes.\u0027,"},{"line_number":82,"context_line":"    ),"},{"line_number":83,"context_line":"    cfg.StrOpt("},{"line_number":84,"context_line":"        \u0027auth_path\u0027,"},{"line_number":85,"context_line":"        help\u003d\u0027Mount path of the Vault auth backend, used in \u0027"},{"line_number":86,"context_line":"        \u0027the login URL /v1/auth/\u003cauth_path\u003e/login. \u0027"},{"line_number":87,"context_line":"        \u0027Defaults to the value of auth_method when not set. \u0027"}],"source_content_type":"text/x-python","patch_set":7,"id":"ee618ca9_c9d57cc8","line":84,"range":{"start_line":84,"start_character":9,"end_line":84,"end_character":18},"updated":"2026-06-15 06:19:10.000000000","message":"I wonder if there is a terminology in Vault which corresponds to that path element (between auth and login) ? Then we can use that name.","commit_id":"6abfbee61a032aeab3201cea148c96596edd7c97"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ec771065322ed1a4be9c04c5980692ea38642d62","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        \u0027Required when auth_method is jwt or kubernetes.\u0027,"},{"line_number":82,"context_line":"    ),"},{"line_number":83,"context_line":"    cfg.StrOpt("},{"line_number":84,"context_line":"        \u0027auth_path\u0027,"},{"line_number":85,"context_line":"        help\u003d\u0027Mount path of the Vault auth backend, used in \u0027"},{"line_number":86,"context_line":"        \u0027the login URL /v1/auth/\u003cauth_path\u003e/login. \u0027"},{"line_number":87,"context_line":"        \u0027Defaults to the value of auth_method when not set. \u0027"}],"source_content_type":"text/x-python","patch_set":7,"id":"6191e2df_404a83c0","line":84,"range":{"start_line":84,"start_character":9,"end_line":84,"end_character":18},"in_reply_to":"ee618ca9_c9d57cc8","updated":"2026-06-15 06:35:32.000000000","message":"Ignore this. I think this interface is consistent with vault now.\n\nhttps://developer.hashicorp.com/vault/docs/auth/userpass#configuration","commit_id":"6abfbee61a032aeab3201cea148c96596edd7c97"}]}