)]}'
{"ceilometer/polling/manager.py":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"c8d4182b7dc5fc0affc950aa471c8c4700115cb1","unresolved":true,"context_lines":[{"line_number":126,"context_line":"                    \u0027this CA (mutual TLS), restricting metrics access to \u0027"},{"line_number":127,"context_line":"                    \u0027authorized clients only.\u0027),"},{"line_number":128,"context_line":"    cfg.StrOpt(\u0027prometheus_tls_min_version\u0027,"},{"line_number":129,"context_line":"               default\u003d\u00271.3\u0027,"},{"line_number":130,"context_line":"               choices\u003d[\u00271.2\u0027, \u00271.3\u0027],"},{"line_number":131,"context_line":"               help\u003d\u0027Minimum TLS protocol version accepted by the Prometheus \u0027"},{"line_number":132,"context_line":"                    \u0027exporter scrape endpoint. Only used when \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"01a16154_06a3496c","line":129,"range":{"start_line":129,"start_character":23,"end_line":129,"end_character":29},"updated":"2026-10-22 10:37:34.000000000","message":"I might have overlooked this in a different review but isn\u0027t this a breaking change for any deploymens using TLS v1.2 (though I don\u0027t know how often it\u0027s used these days) ?\n\nWhile I understand using 1.3 is a preferred way, I tend to keep the existing behavior (unset both unless requested) and keep usage of 1.3 as recommendation.","commit_id":"101148255ea89fcc5de82cbf134fc903f7c6e068"},{"author":{"_account_id":32968,"name":"Juan Larriba","email":"jlarriba@redhat.com","username":"jlarriba"},"change_message_id":"f454f45a6f2719e506f6b70fa8f88a31f4b39a6e","unresolved":true,"context_lines":[{"line_number":126,"context_line":"                    \u0027this CA (mutual TLS), restricting metrics access to \u0027"},{"line_number":127,"context_line":"                    \u0027authorized clients only.\u0027),"},{"line_number":128,"context_line":"    cfg.StrOpt(\u0027prometheus_tls_min_version\u0027,"},{"line_number":129,"context_line":"               default\u003d\u00271.3\u0027,"},{"line_number":130,"context_line":"               choices\u003d[\u00271.2\u0027, \u00271.3\u0027],"},{"line_number":131,"context_line":"               help\u003d\u0027Minimum TLS protocol version accepted by the Prometheus \u0027"},{"line_number":132,"context_line":"                    \u0027exporter scrape endpoint. Only used when \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"63238080_c1c7a9e2","line":129,"range":{"start_line":129,"start_character":23,"end_line":129,"end_character":29},"in_reply_to":"01a16154_06a3496c","updated":"2026-10-22 10:48:59.000000000","message":"Well, just before pushing, that was a min version of 1.2, but the truth is that 1.2 does not provide protection against PQC attacks, so in this case I had to sit and think.\n\nThe whole change is intended to make the prometheus exporter resistant for PQC by default. In this case, breaking a current deployment will give the operator a warning that their system is vulnerable against this particular (and increseangly important) vulnerability, and refuse to work by default.\n\nThen the operator can choose: either to go to a non-secure option (change min_version to 1.2 specifically) or upgrade whatever is using the prometheus-exporter to 1.3. I think this is the proper workflow.","commit_id":"101148255ea89fcc5de82cbf134fc903f7c6e068"},{"author":{"_account_id":32968,"name":"Juan Larriba","email":"jlarriba@redhat.com","username":"jlarriba"},"change_message_id":"6301d90cd60a712270ec3812b89e2b12117f4f6d","unresolved":false,"context_lines":[{"line_number":126,"context_line":"                    \u0027this CA (mutual TLS), restricting metrics access to \u0027"},{"line_number":127,"context_line":"                    \u0027authorized clients only.\u0027),"},{"line_number":128,"context_line":"    cfg.StrOpt(\u0027prometheus_tls_min_version\u0027,"},{"line_number":129,"context_line":"               default\u003d\u00271.3\u0027,"},{"line_number":130,"context_line":"               choices\u003d[\u00271.2\u0027, \u00271.3\u0027],"},{"line_number":131,"context_line":"               help\u003d\u0027Minimum TLS protocol version accepted by the Prometheus \u0027"},{"line_number":132,"context_line":"                    \u0027exporter scrape endpoint. Only used when \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"9205646a_b0c6b117","line":129,"range":{"start_line":129,"start_character":23,"end_line":129,"end_character":29},"in_reply_to":"35f66d03_2da88137","updated":"2026-10-23 10:55:36.000000000","message":"Done","commit_id":"101148255ea89fcc5de82cbf134fc903f7c6e068"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"ca20f53afd83d1e59f378a44d37e73b9be3e11c4","unresolved":true,"context_lines":[{"line_number":126,"context_line":"                    \u0027this CA (mutual TLS), restricting metrics access to \u0027"},{"line_number":127,"context_line":"                    \u0027authorized clients only.\u0027),"},{"line_number":128,"context_line":"    cfg.StrOpt(\u0027prometheus_tls_min_version\u0027,"},{"line_number":129,"context_line":"               default\u003d\u00271.3\u0027,"},{"line_number":130,"context_line":"               choices\u003d[\u00271.2\u0027, \u00271.3\u0027],"},{"line_number":131,"context_line":"               help\u003d\u0027Minimum TLS protocol version accepted by the Prometheus \u0027"},{"line_number":132,"context_line":"                    \u0027exporter scrape endpoint. Only used when \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"93404e03_f2567c89","line":129,"range":{"start_line":129,"start_character":23,"end_line":129,"end_character":29},"in_reply_to":"63238080_c1c7a9e2","updated":"2026-10-22 10:59:33.000000000","message":"OK. I don\u0027t have very strong opinion to reject the bump, but please document this upgrade impact in the release note.\n\nWe have https://review.opendev.org/c/openstack/aetos/+/1006156 proposed already but this has different interface/behavior. We should at least provide consistent behavior/interface among telemetry projects so should decide the basic strategy in one and apply it in the other.","commit_id":"101148255ea89fcc5de82cbf134fc903f7c6e068"},{"author":{"_account_id":32968,"name":"Juan Larriba","email":"jlarriba@redhat.com","username":"jlarriba"},"change_message_id":"ef0e64936557bbc5a4921eb390ef146ad63bac6a","unresolved":true,"context_lines":[{"line_number":126,"context_line":"                    \u0027this CA (mutual TLS), restricting metrics access to \u0027"},{"line_number":127,"context_line":"                    \u0027authorized clients only.\u0027),"},{"line_number":128,"context_line":"    cfg.StrOpt(\u0027prometheus_tls_min_version\u0027,"},{"line_number":129,"context_line":"               default\u003d\u00271.3\u0027,"},{"line_number":130,"context_line":"               choices\u003d[\u00271.2\u0027, \u00271.3\u0027],"},{"line_number":131,"context_line":"               help\u003d\u0027Minimum TLS protocol version accepted by the Prometheus \u0027"},{"line_number":132,"context_line":"                    \u0027exporter scrape endpoint. Only used when \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"d4f4819a_fe5abf2d","line":129,"range":{"start_line":129,"start_character":23,"end_line":129,"end_character":29},"in_reply_to":"75bb88c2_9221be8d","updated":"2026-10-22 14:20:59.000000000","message":"ok, ill update the release note to highlight it","commit_id":"101148255ea89fcc5de82cbf134fc903f7c6e068"},{"author":{"_account_id":34975,"name":"Jaromír Wysoglad","email":"jwysogla@redhat.com","username":"jwysogla"},"change_message_id":"6464dbfbe9503bd898b910c8a4b333548ddb6db8","unresolved":true,"context_lines":[{"line_number":126,"context_line":"                    \u0027this CA (mutual TLS), restricting metrics access to \u0027"},{"line_number":127,"context_line":"                    \u0027authorized clients only.\u0027),"},{"line_number":128,"context_line":"    cfg.StrOpt(\u0027prometheus_tls_min_version\u0027,"},{"line_number":129,"context_line":"               default\u003d\u00271.3\u0027,"},{"line_number":130,"context_line":"               choices\u003d[\u00271.2\u0027, \u00271.3\u0027],"},{"line_number":131,"context_line":"               help\u003d\u0027Minimum TLS protocol version accepted by the Prometheus \u0027"},{"line_number":132,"context_line":"                    \u0027exporter scrape endpoint. Only used when \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"75bb88c2_9221be8d","line":129,"range":{"start_line":129,"start_character":23,"end_line":129,"end_character":29},"in_reply_to":"93404e03_f2567c89","updated":"2026-10-22 12:21:40.000000000","message":"I did some quick research.\n\nopenssl added TLS 1.3 support in version 1.1.1, which seems to have been released in Sep 2018 (8 years ago). Python seems to support it since like 3.7? And Prometheus added TLS min_version config in 2.35.0 released in April 2022, which already supported 1.3 as one of the options my guess would be the server would accept 1.3 even before that though.\n\nSo I think the 1.3 support is there long enough in all the components (longer even than this prometheus exporter implementation in ceilometer), so it\u0027s unlikely the default will break anything and the idea of being more secure by default is quite appealing to me, so I\u0027d agree for going with these defaults. But I agree, that we should be consistent and that the change. should be mentioned in the upgrade release note.","commit_id":"101148255ea89fcc5de82cbf134fc903f7c6e068"},{"author":{"_account_id":32968,"name":"Juan Larriba","email":"jlarriba@redhat.com","username":"jlarriba"},"change_message_id":"94dd79da0fdf9337f7379499feab3fcd47743c6a","unresolved":true,"context_lines":[{"line_number":126,"context_line":"                    \u0027this CA (mutual TLS), restricting metrics access to \u0027"},{"line_number":127,"context_line":"                    \u0027authorized clients only.\u0027),"},{"line_number":128,"context_line":"    cfg.StrOpt(\u0027prometheus_tls_min_version\u0027,"},{"line_number":129,"context_line":"               default\u003d\u00271.3\u0027,"},{"line_number":130,"context_line":"               choices\u003d[\u00271.2\u0027, \u00271.3\u0027],"},{"line_number":131,"context_line":"               help\u003d\u0027Minimum TLS protocol version accepted by the Prometheus \u0027"},{"line_number":132,"context_line":"                    \u0027exporter scrape endpoint. Only used when \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"f62f1b22_e3dee92b","line":129,"range":{"start_line":129,"start_character":23,"end_line":129,"end_character":29},"in_reply_to":"d4f4819a_fe5abf2d","updated":"2026-10-22 15:07:50.000000000","message":"I was re-reading now the release note to look at where to inform about the 1.3 defaults, and we are mentioning those already there. I dont think a modification is needed.","commit_id":"101148255ea89fcc5de82cbf134fc903f7c6e068"},{"author":{"_account_id":32968,"name":"Juan Larriba","email":"jlarriba@redhat.com","username":"jlarriba"},"change_message_id":"0bbf0e4850587f32b438cd9b0c13f6e4aaf8f72f","unresolved":true,"context_lines":[{"line_number":126,"context_line":"                    \u0027this CA (mutual TLS), restricting metrics access to \u0027"},{"line_number":127,"context_line":"                    \u0027authorized clients only.\u0027),"},{"line_number":128,"context_line":"    cfg.StrOpt(\u0027prometheus_tls_min_version\u0027,"},{"line_number":129,"context_line":"               default\u003d\u00271.3\u0027,"},{"line_number":130,"context_line":"               choices\u003d[\u00271.2\u0027, \u00271.3\u0027],"},{"line_number":131,"context_line":"               help\u003d\u0027Minimum TLS protocol version accepted by the Prometheus \u0027"},{"line_number":132,"context_line":"                    \u0027exporter scrape endpoint. Only used when \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"35f66d03_2da88137","line":129,"range":{"start_line":129,"start_character":23,"end_line":129,"end_character":29},"in_reply_to":"d6a7bd14_bc8fbc73","updated":"2026-10-22 15:48:50.000000000","message":"ack","commit_id":"101148255ea89fcc5de82cbf134fc903f7c6e068"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"885d67e50b00981e72b95d51b0e40224e96d2e63","unresolved":true,"context_lines":[{"line_number":126,"context_line":"                    \u0027this CA (mutual TLS), restricting metrics access to \u0027"},{"line_number":127,"context_line":"                    \u0027authorized clients only.\u0027),"},{"line_number":128,"context_line":"    cfg.StrOpt(\u0027prometheus_tls_min_version\u0027,"},{"line_number":129,"context_line":"               default\u003d\u00271.3\u0027,"},{"line_number":130,"context_line":"               choices\u003d[\u00271.2\u0027, \u00271.3\u0027],"},{"line_number":131,"context_line":"               help\u003d\u0027Minimum TLS protocol version accepted by the Prometheus \u0027"},{"line_number":132,"context_line":"                    \u0027exporter scrape endpoint. Only used when \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"d6a7bd14_bc8fbc73","line":129,"range":{"start_line":129,"start_character":23,"end_line":129,"end_character":29},"in_reply_to":"f62f1b22_e3dee92b","updated":"2026-10-22 15:37:28.000000000","message":"The dafault is mentioned in the feature section but that requires users to read the whole release note carefully to find out that actually affect their deployment. \nWe should add more specific description about its upgrade impact in the upgrade section, IMHO.","commit_id":"101148255ea89fcc5de82cbf134fc903f7c6e068"}]}