)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"9e810c01898696363e4a200eb848965008293add","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"5854bd3f_3d060c3b","updated":"2026-08-17 14:44:15.000000000","message":"Thanks Silvan — this is exactly the review the page needed, and you are right on\nthe systemic point. I\u0027ve reworked the patch: evidence no longer cites line\nnumbers anywhere, the Quobyte row is corrected, and your comments turned out to\napply to five other drivers as well.\n\n**Line references are gone.** You are right that `file:line` cannot survive\ncontact with a moving tree, and the numbers you followed had already rotted:\nfour commits touched `quobyte.py` between patch set 3 and today, so `:718-721`\n(which was the `mount.quobyte ... -c \u003cquobyte_client_cfg\u003e` command when I wrote\nit) now lands on `return target_volume`, and `:126` (`driver_volume_type`) now\nlands on the closing docstring quotes. Across the whole matrix that was 541\nline-pinned references over 136 files, 18 of which had already changed — so your\ncomments were the first symptom of a problem the page had everywhere, not just\nin the Quobyte column.\n\nRather than pin to a sha, evidence now cites a symbol:\n\n    cinder/volume/drivers/quobyte.py:QuobyteDriver._mount_quobyte\n    cinder/volume/driver.py:volume_opts[driver_ssl_cert_verify]\n\nA sha-pinned line would be accurate but sends the reader to an old tree and\nneeds re-pinning on every touch; a symbol moves with the code it names and can\nbe *checked*. So it is checked: `doc/source/_exts/security_matrix_refs.py`\nresolves every reference against the tree, the docs build fails on a dangling\ncitation, and a new unit test does the same — the gate that was missing before,\nsince the old validation only pattern-matched the reference syntax and so could\nnot see rot at all. Nine references are bare paths where the evidence is an\nimport-scope statement with no symbol to name; the caveat text names the call in\nthose cases.\n\nYour review enabledme to find the same defects in five other drivers. Rather than fix Quobyte and wait, I swept all 455 cells for each class of problem you raised. \n\nWhat that turned up:\n\n* The \"control lives outside Cinder, so the cell says not_securable\" error was in every other mount-based driver: nfs, veritas_cnfs, vmstore and the NFS half of netapp_ontap all had datapath_transport_encryption: not_securable when the operator\u0027s mount options are passed to the client unmodified and sec\u003dkrb5p is reachable. The nfs cell even cited nfs_opts[nfs_mount_options] — the option that provides the mechanism it claimed did not exist. All four are now securable. vzstorage had it too, but since I cannot tell from Cinder source whether the Virtuozzo client can encrypt its transport, that one is now unknown rather than a guess in either direction.\n* Sweeping in the opposite direction — cells scored worse than reality, which misleads operators rather than vendors — found one: NexentaStor4\u0027s mgmt_cert_verification was not_securable \"because the proxy never sets session.verify\". It builds a requests.Session and never overrides verify, so requests\u0027 default applies and the certificate is verified whenever https is selected, with no way to weaken it. Now securable.\n* Your point about driver_volume_type not being evidence of anything applied to 87 not_applicable cells carrying citations. Where the citation names the transport declaration I kept it, since driver_volume_type \u003d \u0027iscsi\u0027 exhaustively declares the transport and NVMe therefore cannot apply; where it named an iSCSI driver class or a CHAP helper as supposed proof of \"no NVMe\" I dropped it, because absence is not something a citation can establish. That is 17 citations gone, with the caveat left to carry the claim.\n* \"no TLS management client\" appeared in four more drivers. All reworded.","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13915,"name":"Silvan Kaiser","email":"silvan@quobyte.com","username":"kaisers"},"change_message_id":"18ac9f17738d80a025de723ab83c09241cc9d3c3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"7b51ec42_f2949493","updated":"2026-08-17 10:41:42.000000000","message":"There are issues with the code references in here. I only checked for the Quobyte driver but the code referenced is rarely related to the topic at hand (see inline comments). Also the code changes over time, so i think version / sha related addressing is required.\n\nLast but not least some aspects for the Quobyte driver are described incorrectly afaics, unless i misunderstood (see inline comments, again).","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13915,"name":"Silvan Kaiser","email":"silvan@quobyte.com","username":"kaisers"},"change_message_id":"ee6152ad5a85142e460f4a501e8e2d2ab584c841","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":11,"id":"e7e0510b_923fa416","updated":"2026-08-20 08:16:10.000000000","message":"@simon@everpuredata.com thanks for the extensive update \u0026 feedback!","commit_id":"ed949baea4c03a508a35fca86f45a42a026a128d"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"d9d5f2aad96198a7803839016d7ca54f7a84da26","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":11,"id":"ee68e6b7_09f470bb","updated":"2026-08-19 16:20:47.000000000","message":"recheck","commit_id":"ed949baea4c03a508a35fca86f45a42a026a128d"},{"author":{"_account_id":13915,"name":"Silvan Kaiser","email":"silvan@quobyte.com","username":"kaisers"},"change_message_id":"c1185ad3b56ae4829281abf2aaf3a147b954aff8","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":12,"id":"8d9a8a4e_7f4d73a2","updated":"2026-08-20 14:52:00.000000000","message":"Good work, thnx","commit_id":"3d13698a591adea1499d6a66a2b2c4d8c3005b2d"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"2c9af327b60439ea3244d1b241f71c0b5edfffc3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":13,"id":"073f282b_d473a89a","updated":"2026-09-02 14:49:06.000000000","message":"@anoop.shukla@netapp.com rebuilt for you","commit_id":"fc07820fd47dc8b09962edf3d58812f943ce02ed"},{"author":{"_account_id":38059,"name":"Anoop Kumar Shukla","display_name":"Anoop Shukla","email":"anoop.shukla@netapp.com","username":"anoop2","status":"NetApp"},"change_message_id":"cb7cf457f7e33f24eb4804422a01f2889b899fd6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":13,"id":"a5013f78_1678e329","updated":"2026-09-12 19:01:47.000000000","message":"LGTM. Thank you for the rebuild.","commit_id":"fc07820fd47dc8b09962edf3d58812f943ce02ed"}],"doc/source/_exts/security_matrix.py":[{"author":{"_account_id":33612,"name":"yuval","email":"yuval@lightbitslabs.com","username":"yuval"},"change_message_id":"10770149e34788f4792551f7e6c44b8dc7af5d01","unresolved":true,"context_lines":[{"line_number":49,"context_line":"    (\u0027datapath_auth_iscsi\u0027, \u0027iSCSI auth\u0027,"},{"line_number":50,"context_line":"     \u0027iSCSI data-path authentication (CHAP)\u0027),"},{"line_number":51,"context_line":"    (\u0027datapath_auth_nvme\u0027, \u0027NVMe auth\u0027,"},{"line_number":52,"context_line":"     \u0027NVMe in-band authentication (DH-HMAC-CHAP / TP8010)\u0027),"},{"line_number":53,"context_line":"    (\u0027datapath_transport_encryption\u0027, \u0027Data-path TLS\u0027,"},{"line_number":54,"context_line":"     \u0027Data-path transport encryption (iSCSI/NVMe treq)\u0027),"},{"line_number":55,"context_line":"    (\u0027discovery_exposure\u0027, \u0027Discovery\u0027,"}],"source_content_type":"text/x-python","patch_set":9,"id":"26f6c9c8_64970b2e","line":52,"updated":"2026-08-18 13:25:17.000000000","message":"NIT: nvme in-band auth is tp8006","commit_id":"de37d24c5167cf4664ab08387b1c9025538fe312"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"24cd67ebe56c7dd9eb208ce9aa9939c74ecf3c53","unresolved":false,"context_lines":[{"line_number":49,"context_line":"    (\u0027datapath_auth_iscsi\u0027, \u0027iSCSI auth\u0027,"},{"line_number":50,"context_line":"     \u0027iSCSI data-path authentication (CHAP)\u0027),"},{"line_number":51,"context_line":"    (\u0027datapath_auth_nvme\u0027, \u0027NVMe auth\u0027,"},{"line_number":52,"context_line":"     \u0027NVMe in-band authentication (DH-HMAC-CHAP / TP8010)\u0027),"},{"line_number":53,"context_line":"    (\u0027datapath_transport_encryption\u0027, \u0027Data-path TLS\u0027,"},{"line_number":54,"context_line":"     \u0027Data-path transport encryption (iSCSI/NVMe treq)\u0027),"},{"line_number":55,"context_line":"    (\u0027discovery_exposure\u0027, \u0027Discovery\u0027,"}],"source_content_type":"text/x-python","patch_set":9,"id":"d65c80e2_73bdaed9","line":52,"in_reply_to":"26f6c9c8_64970b2e","updated":"2026-08-18 13:38:37.000000000","message":"Acknowledged","commit_id":"de37d24c5167cf4664ab08387b1c9025538fe312"}],"doc/source/reference/security-matrix/_framework.yaml":[{"author":{"_account_id":4523,"name":"Eric Harney","email":"eharney@redhat.com","username":"eharney"},"change_message_id":"cb2e8660470583d5b81c24ec614b86eb14e0813f","unresolved":true,"context_lines":[{"line_number":60,"context_line":"    evidence: [\"cinder/volume/driver.py:ISCSIDriver._do_iscsi_discovery\"]"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"tier2_process_global:"},{"line_number":63,"context_line":"  - driver: lightos"},{"line_number":64,"context_line":"    effect: \u003e"},{"line_number":65,"context_line":"      urllib3.disable_warnings() is called at import scope, suppressing TLS"},{"line_number":66,"context_line":"      warnings process-wide and affecting every backend in a shared"},{"line_number":67,"context_line":"      cinder-volume process, not just LightOS."},{"line_number":68,"context_line":"    evidence: [\"cinder/volume/drivers/lightos.py\"]"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"  - driver: kioxia_kumoscale"},{"line_number":71,"context_line":"    effect: \u003e"},{"line_number":72,"context_line":"      urllib3.disable_warnings() is called at import scope (same process-wide"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"9867786c_c1f6d83f","line":69,"range":{"start_line":63,"start_character":0,"end_line":69,"end_character":1},"updated":"2026-08-19 14:06:43.000000000","message":"```suggestion\n\n```\n\nThis is now presumably fixed by https://review.opendev.org/c/openstack/cinder/+/1001074","commit_id":"c34ad73045844ef08f0ffda705006cae92b693e0"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"e1260c59622d76bf31aefa7c348a8ec895f85942","unresolved":false,"context_lines":[{"line_number":60,"context_line":"    evidence: [\"cinder/volume/driver.py:ISCSIDriver._do_iscsi_discovery\"]"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"tier2_process_global:"},{"line_number":63,"context_line":"  - driver: lightos"},{"line_number":64,"context_line":"    effect: \u003e"},{"line_number":65,"context_line":"      urllib3.disable_warnings() is called at import scope, suppressing TLS"},{"line_number":66,"context_line":"      warnings process-wide and affecting every backend in a shared"},{"line_number":67,"context_line":"      cinder-volume process, not just LightOS."},{"line_number":68,"context_line":"    evidence: [\"cinder/volume/drivers/lightos.py\"]"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"  - driver: kioxia_kumoscale"},{"line_number":71,"context_line":"    effect: \u003e"},{"line_number":72,"context_line":"      urllib3.disable_warnings() is called at import scope (same process-wide"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"9b865364_84e048c3","line":69,"range":{"start_line":63,"start_character":0,"end_line":69,"end_character":1},"in_reply_to":"9867786c_c1f6d83f","updated":"2026-08-19 15:26:24.000000000","message":"rebased and rebuilt","commit_id":"c34ad73045844ef08f0ffda705006cae92b693e0"}],"doc/source/reference/security-matrix/drivers/lightos.yaml":[{"author":{"_account_id":33612,"name":"yuval","email":"yuval@lightbitslabs.com","username":"yuval"},"change_message_id":"e9e7b0b5a6dbc470f75c70625c03e6af0be0a8c4","unresolved":true,"context_lines":[{"line_number":13,"context_line":"    evidence:"},{"line_number":14,"context_line":"      - \"cinder/volume/drivers/lightos.py:LightOSConnection.__send_cmd\""},{"line_number":15,"context_line":"      - \"cinder/volume/drivers/lightos.py:LightOSConnection.__send_cmd\""},{"line_number":16,"context_line":"    caveat: \"honors driver_ssl_cert_verify; but lightos.py:47 calls urllib3.disable_warnings() at import (Tier 2)\""},{"line_number":17,"context_line":"  datapath_auth_iscsi:"},{"line_number":18,"context_line":"    state: not_applicable"},{"line_number":19,"context_line":"    evidence:"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"10391a31_561457e5","line":16,"updated":"2026-08-18 09:13:28.000000000","message":"We have a patch to remove this: https://review.opendev.org/c/openstack/cinder/+/1001074\nLets work to merge it and remove this caveat before this patch is merged.\nThank you.","commit_id":"de37d24c5167cf4664ab08387b1c9025538fe312"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"24cd67ebe56c7dd9eb208ce9aa9939c74ecf3c53","unresolved":false,"context_lines":[{"line_number":13,"context_line":"    evidence:"},{"line_number":14,"context_line":"      - \"cinder/volume/drivers/lightos.py:LightOSConnection.__send_cmd\""},{"line_number":15,"context_line":"      - \"cinder/volume/drivers/lightos.py:LightOSConnection.__send_cmd\""},{"line_number":16,"context_line":"    caveat: \"honors driver_ssl_cert_verify; but lightos.py:47 calls urllib3.disable_warnings() at import (Tier 2)\""},{"line_number":17,"context_line":"  datapath_auth_iscsi:"},{"line_number":18,"context_line":"    state: not_applicable"},{"line_number":19,"context_line":"    evidence:"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"b589577a_2a94211d","line":16,"in_reply_to":"10391a31_561457e5","updated":"2026-08-18 13:38:37.000000000","message":"Well it really depends on the order of merging. If the docs merge first, then you can update the upstream lightos.yaml to fix the entry. If your patch merges first, I will rerun the build and make sure your entry is correct before publication.","commit_id":"de37d24c5167cf4664ab08387b1c9025538fe312"},{"author":{"_account_id":33612,"name":"yuval","email":"yuval@lightbitslabs.com","username":"yuval"},"change_message_id":"e9e7b0b5a6dbc470f75c70625c03e6af0be0a8c4","unresolved":true,"context_lines":[{"line_number":20,"context_line":"      - \"cinder/volume/drivers/lightos.py:LightOSVolumeDriver\""},{"line_number":21,"context_line":"      - \"cinder/volume/drivers/lightos.py:LightOSVolumeDriver.initialize_connection\""},{"line_number":22,"context_line":"    caveat: \"NVMe/TCP only (driver_volume_type lightos)\""},{"line_number":23,"context_line":"  datapath_auth_nvme:"},{"line_number":24,"context_line":"    state: not_securable"},{"line_number":25,"context_line":"    evidence:"},{"line_number":26,"context_line":"      - \"cinder/volume/drivers/lightos.py:LightOSVolumeDriver.initialize_connection\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"faddd581_5c5da156","line":23,"updated":"2026-08-18 09:13:28.000000000","message":"Thanks for putting this together. I think our `datapath_auth_nvme` cell should be `securable` rather than `not_securable`, and the caveat\u0027s \"no DH-HMAC-CHAP\" clause is not accurate LightOS has supported bidirectional DH-HMAC-CHAP.\n\nI verified it end to end on a live cluster (LightOS 3.21.1) with\nunmodified Cinder and os-brick: enable in-band auth on the cluster, create a\ntrusted host for each compute node\u0027s NQN, and put the issued secrets in that\nnode\u0027s `discovery-client.yaml` the secret is bound to the host NQN, so it\u0027s\nper-compute-node configuration and never touches `connection_info` or the Cinder\ndatabase.\n\nOur documentation for the procedure:\nhttps://documentation.lightbitslabs.com/lightbits-private-cloud/nvme-tcp-in-band-authentication#enabling-in-band-authentication-feature-support\n\nThat matches this page\u0027s own definition — \"a safe configuration is reachable but\nis not the default; operator action is required\" — so `securable` seems right. Happy to send a patch adding the procedure to `lightbits-lightos-driver.rst` so it\u0027s documented in Cinder\u0027s tree as well.","commit_id":"de37d24c5167cf4664ab08387b1c9025538fe312"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"24cd67ebe56c7dd9eb208ce9aa9939c74ecf3c53","unresolved":false,"context_lines":[{"line_number":20,"context_line":"      - \"cinder/volume/drivers/lightos.py:LightOSVolumeDriver\""},{"line_number":21,"context_line":"      - \"cinder/volume/drivers/lightos.py:LightOSVolumeDriver.initialize_connection\""},{"line_number":22,"context_line":"    caveat: \"NVMe/TCP only (driver_volume_type lightos)\""},{"line_number":23,"context_line":"  datapath_auth_nvme:"},{"line_number":24,"context_line":"    state: not_securable"},{"line_number":25,"context_line":"    evidence:"},{"line_number":26,"context_line":"      - \"cinder/volume/drivers/lightos.py:LightOSVolumeDriver.initialize_connection\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"10434643_ad7c6476","line":23,"in_reply_to":"faddd581_5c5da156","updated":"2026-08-18 13:38:37.000000000","message":"Acknowledged. Reworking the build logic so your driver is flagged correctly.","commit_id":"de37d24c5167cf4664ab08387b1c9025538fe312"}],"doc/source/reference/security-matrix/drivers/netapp_ontap.yaml":[{"author":{"_account_id":38059,"name":"Anoop Kumar Shukla","display_name":"Anoop Shukla","email":"anoop.shukla@netapp.com","username":"anoop2","status":"NetApp"},"change_message_id":"e51ec8bde8f2dc34022020e872b11c5e76592cfc","unresolved":true,"context_lines":[{"line_number":3,"context_line":"protocols: [iscsi, fc, nvme-tcp, nfs]"},{"line_number":4,"context_line":"properties:"},{"line_number":5,"context_line":"  mgmt_transport_encryption:"},{"line_number":6,"context_line":"    state: securable"},{"line_number":7,"context_line":"    evidence:"},{"line_number":8,"context_line":"      - \"cinder/volume/drivers/netapp/options.py:netapp_transport_opts[netapp_transport_type]\""},{"line_number":9,"context_line":"      - \"cinder/volume/drivers/netapp/dataontap/client/api.py:RestNaServer._get_base_url\""}],"source_content_type":"text/x-yaml","patch_set":12,"id":"61fd5d0c_bec7d149","line":6,"range":{"start_line":6,"start_character":11,"end_line":6,"end_character":20},"updated":"2026-09-02 07:13:52.000000000","message":"With the security from NetApp driver patch merged, this now needs to be changed to secure_by_default from Hibiscus onwards.: https://review.opendev.org/c/openstack/cinder/+/993952","commit_id":"3d13698a591adea1499d6a66a2b2c4d8c3005b2d"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"2c9af327b60439ea3244d1b241f71c0b5edfffc3","unresolved":false,"context_lines":[{"line_number":3,"context_line":"protocols: [iscsi, fc, nvme-tcp, nfs]"},{"line_number":4,"context_line":"properties:"},{"line_number":5,"context_line":"  mgmt_transport_encryption:"},{"line_number":6,"context_line":"    state: securable"},{"line_number":7,"context_line":"    evidence:"},{"line_number":8,"context_line":"      - \"cinder/volume/drivers/netapp/options.py:netapp_transport_opts[netapp_transport_type]\""},{"line_number":9,"context_line":"      - \"cinder/volume/drivers/netapp/dataontap/client/api.py:RestNaServer._get_base_url\""}],"source_content_type":"text/x-yaml","patch_set":12,"id":"c832ccc9_b7cea4ea","line":6,"range":{"start_line":6,"start_character":11,"end_line":6,"end_character":20},"in_reply_to":"61fd5d0c_bec7d149","updated":"2026-09-02 14:49:06.000000000","message":"Rebuilt","commit_id":"3d13698a591adea1499d6a66a2b2c4d8c3005b2d"},{"author":{"_account_id":38059,"name":"Anoop Kumar Shukla","display_name":"Anoop Shukla","email":"anoop.shukla@netapp.com","username":"anoop2","status":"NetApp"},"change_message_id":"e51ec8bde8f2dc34022020e872b11c5e76592cfc","unresolved":true,"context_lines":[{"line_number":30,"context_line":"      LP #2157914; verification is on NetApp-private options throughout, never"},{"line_number":31,"context_line":"      driver_ssl_cert_verify.\""},{"line_number":32,"context_line":"  datapath_auth_iscsi:"},{"line_number":33,"context_line":"    state: securable"},{"line_number":34,"context_line":"    evidence:"},{"line_number":35,"context_line":"      - \"cinder/volume/driver.py:volume_opts[use_chap_auth]\""},{"line_number":36,"context_line":"      - \"cinder/volume/drivers/netapp/dataontap/block_base.py:NetAppBlockStorageLibrary.initialize_connection_iscsi\""}],"source_content_type":"text/x-yaml","patch_set":12,"id":"07ff5c5e_040f039b","line":33,"range":{"start_line":33,"start_character":11,"end_line":33,"end_character":20},"updated":"2026-09-02 07:13:52.000000000","message":"With the security from NetApp driver patch merged, this now needs to be changed to secure_by_default from Hibiscus onwards.: https://review.opendev.org/c/openstack/cinder/+/993952","commit_id":"3d13698a591adea1499d6a66a2b2c4d8c3005b2d"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"2c9af327b60439ea3244d1b241f71c0b5edfffc3","unresolved":false,"context_lines":[{"line_number":30,"context_line":"      LP #2157914; verification is on NetApp-private options throughout, never"},{"line_number":31,"context_line":"      driver_ssl_cert_verify.\""},{"line_number":32,"context_line":"  datapath_auth_iscsi:"},{"line_number":33,"context_line":"    state: securable"},{"line_number":34,"context_line":"    evidence:"},{"line_number":35,"context_line":"      - \"cinder/volume/driver.py:volume_opts[use_chap_auth]\""},{"line_number":36,"context_line":"      - \"cinder/volume/drivers/netapp/dataontap/block_base.py:NetAppBlockStorageLibrary.initialize_connection_iscsi\""}],"source_content_type":"text/x-yaml","patch_set":12,"id":"6ac6ba79_776ef014","line":33,"range":{"start_line":33,"start_character":11,"end_line":33,"end_character":20},"in_reply_to":"07ff5c5e_040f039b","updated":"2026-09-02 14:49:06.000000000","message":"rebuilt","commit_id":"3d13698a591adea1499d6a66a2b2c4d8c3005b2d"}],"doc/source/reference/security-matrix/drivers/quobyte.yaml":[{"author":{"_account_id":13915,"name":"Silvan Kaiser","email":"silvan@quobyte.com","username":"kaisers"},"change_message_id":"18ac9f17738d80a025de723ab83c09241cc9d3c3","unresolved":true,"context_lines":[{"line_number":2,"context_line":"title: \"Quobyte\""},{"line_number":3,"context_line":"protocols: [quobyte, nfs]"},{"line_number":4,"context_line":"properties:"},{"line_number":5,"context_line":"  mgmt_transport_encryption:"},{"line_number":6,"context_line":"    state: not_applicable"},{"line_number":7,"context_line":"    evidence:"},{"line_number":8,"context_line":"      - \"cinder/volume/drivers/quobyte.py:718-721\""},{"line_number":9,"context_line":"    caveat: \"mount.quobyte FUSE only; no REST channel\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"5aca777b_d7a64c3a","line":6,"range":{"start_line":5,"start_character":2,"end_line":6,"end_character":25},"updated":"2026-08-17 10:41:42.000000000","message":"management transport encryption uses the same encryption setup as referenced below in the datapath_transport_encryption comment, pls see below.","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"9e810c01898696363e4a200eb848965008293add","unresolved":false,"context_lines":[{"line_number":2,"context_line":"title: \"Quobyte\""},{"line_number":3,"context_line":"protocols: [quobyte, nfs]"},{"line_number":4,"context_line":"properties:"},{"line_number":5,"context_line":"  mgmt_transport_encryption:"},{"line_number":6,"context_line":"    state: not_applicable"},{"line_number":7,"context_line":"    evidence:"},{"line_number":8,"context_line":"      - \"cinder/volume/drivers/quobyte.py:718-721\""},{"line_number":9,"context_line":"    caveat: \"mount.quobyte FUSE only; no REST channel\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"143b3931_0c47a715","line":6,"range":{"start_line":5,"start_character":2,"end_line":6,"end_character":25},"in_reply_to":"5aca777b_d7a64c3a","updated":"2026-08-17 14:44:15.000000000","message":"Agreed, and fixed: securable (new line 6). Cinder has no management channel of its own here — the driver\u0027s only interaction with the backend is invoking mount.quobyte — so the encryption setup is the same client-side one as for the data path, configured through quobyte_client_cfg. Scoring that not_applicable implied the property could not exist, when in fact it exists and is reachable by the operator; the caveat now says exactly where it lives.","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13915,"name":"Silvan Kaiser","email":"silvan@quobyte.com","username":"kaisers"},"change_message_id":"18ac9f17738d80a025de723ab83c09241cc9d3c3","unresolved":true,"context_lines":[{"line_number":5,"context_line":"  mgmt_transport_encryption:"},{"line_number":6,"context_line":"    state: not_applicable"},{"line_number":7,"context_line":"    evidence:"},{"line_number":8,"context_line":"      - \"cinder/volume/drivers/quobyte.py:718-721\""},{"line_number":9,"context_line":"    caveat: \"mount.quobyte FUSE only; no REST channel\""},{"line_number":10,"context_line":"  mgmt_cert_verification:"},{"line_number":11,"context_line":"    state: not_applicable"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"8cb496ce_77d2505e","line":8,"range":{"start_line":8,"start_character":6,"end_line":8,"end_character":50},"updated":"2026-08-17 10:41:42.000000000","message":"see data_transport_encryption, same reference.","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"9e810c01898696363e4a200eb848965008293add","unresolved":false,"context_lines":[{"line_number":5,"context_line":"  mgmt_transport_encryption:"},{"line_number":6,"context_line":"    state: not_applicable"},{"line_number":7,"context_line":"    evidence:"},{"line_number":8,"context_line":"      - \"cinder/volume/drivers/quobyte.py:718-721\""},{"line_number":9,"context_line":"    caveat: \"mount.quobyte FUSE only; no REST channel\""},{"line_number":10,"context_line":"  mgmt_cert_verification:"},{"line_number":11,"context_line":"    state: not_applicable"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"9841da29_f03af941","line":8,"range":{"start_line":8,"start_character":6,"end_line":8,"end_character":50},"in_reply_to":"8cb496ce_77d2505e","updated":"2026-08-17 14:44:15.000000000","message":"Right on both counts: same underlying mechanism, and the reference itself was broken. 718-721 was the mount.quobyte ... -c \u003cquobyte_client_cfg\u003e command when the patch was written, but four commits have touched quobyte.py since and those lines are now return target_volume. Evidence in the whole matrix no longer uses line numbers — this cell cites quobyte.py:QuobyteDriver._mount_quobyte, which is the code you would want to read and cannot drift. The docs build and a unit test now resolve every reference, so this class of rot fails CI instead of sitting there.","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13915,"name":"Silvan Kaiser","email":"silvan@quobyte.com","username":"kaisers"},"change_message_id":"18ac9f17738d80a025de723ab83c09241cc9d3c3","unresolved":true,"context_lines":[{"line_number":11,"context_line":"    state: not_applicable"},{"line_number":12,"context_line":"    control: null"},{"line_number":13,"context_line":"    evidence:"},{"line_number":14,"context_line":"      - \"cinder/volume/drivers/quobyte.py:685-733\""},{"line_number":15,"context_line":"    caveat: \"no TLS management client\""},{"line_number":16,"context_line":"  datapath_auth_iscsi:"},{"line_number":17,"context_line":"    state: not_applicable"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"7bf1ca28_7e6a8a7c","line":14,"range":{"start_line":14,"start_character":0,"end_line":14,"end_character":2},"updated":"2026-08-17 10:41:42.000000000","message":"I fail to see how the referenced code lines [1] are related to certificate verification. That happens in the Quobyte client based on the Cinder Drivers client config.\n\n[1] https://opendev.org/openstack/cinder/src/commit/b5b763129e2bde5077c0cf3a5eb434021abaa6e0/cinder/volume/drivers/quobyte.py#L667-L733","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"9e810c01898696363e4a200eb848965008293add","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    state: not_applicable"},{"line_number":12,"context_line":"    control: null"},{"line_number":13,"context_line":"    evidence:"},{"line_number":14,"context_line":"      - \"cinder/volume/drivers/quobyte.py:685-733\""},{"line_number":15,"context_line":"    caveat: \"no TLS management client\""},{"line_number":16,"context_line":"  datapath_auth_iscsi:"},{"line_number":17,"context_line":"    state: not_applicable"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"b8ffb8c6_518884f3","line":14,"range":{"start_line":14,"start_character":0,"end_line":14,"end_character":2},"in_reply_to":"7bf1ca28_7e6a8a7c","updated":"2026-08-17 14:44:15.000000000","message":"Correct, and your description is what the cell now says. It cites _mount_quobyte — the one place the driver touches the client\u0027s configuration, by passing -c \u003cquobyte_client_cfg\u003e — and the caveat states that verification is performed by the Quobyte client according to that file, not by Cinder, and that driver_ssl_cert_verify does not apply. The state moved from not_applicable to securable for the same reason as line 6.","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13915,"name":"Silvan Kaiser","email":"silvan@quobyte.com","username":"kaisers"},"change_message_id":"18ac9f17738d80a025de723ab83c09241cc9d3c3","unresolved":true,"context_lines":[{"line_number":12,"context_line":"    control: null"},{"line_number":13,"context_line":"    evidence:"},{"line_number":14,"context_line":"      - \"cinder/volume/drivers/quobyte.py:685-733\""},{"line_number":15,"context_line":"    caveat: \"no TLS management client\""},{"line_number":16,"context_line":"  datapath_auth_iscsi:"},{"line_number":17,"context_line":"    state: not_applicable"},{"line_number":18,"context_line":"    evidence:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"846fe389_48ff9b99","line":15,"range":{"start_line":15,"start_character":0,"end_line":15,"end_character":2},"updated":"2026-08-17 10:41:42.000000000","message":"I do not fully grasp what this means, which client should offer TLS management?","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"9e810c01898696363e4a200eb848965008293add","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    control: null"},{"line_number":13,"context_line":"    evidence:"},{"line_number":14,"context_line":"      - \"cinder/volume/drivers/quobyte.py:685-733\""},{"line_number":15,"context_line":"    caveat: \"no TLS management client\""},{"line_number":16,"context_line":"  datapath_auth_iscsi:"},{"line_number":17,"context_line":"    state: not_applicable"},{"line_number":18,"context_line":"    evidence:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"8be4dd59_908976ed","line":15,"range":{"start_line":15,"start_character":0,"end_line":15,"end_character":2},"in_reply_to":"846fe389_48ff9b99","updated":"2026-08-17 14:44:15.000000000","message":"That phrasing was bad and is gone. What I was trying to say is that Cinder itself opens no management connection for this driver — there is no REST or TLS session in the Cinder process whose certificate handling could be assessed — so anything of that kind belongs to the Quobyte client. The caveat now states that directly instead of implying some client was missing a feature. For what it\u0027s worth the same phrase had spread to four other drivers (lvm, nfs, veritas_cnfs, vzstorage); all four are reworded.","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13915,"name":"Silvan Kaiser","email":"silvan@quobyte.com","username":"kaisers"},"change_message_id":"18ac9f17738d80a025de723ab83c09241cc9d3c3","unresolved":true,"context_lines":[{"line_number":16,"context_line":"  datapath_auth_iscsi:"},{"line_number":17,"context_line":"    state: not_applicable"},{"line_number":18,"context_line":"    evidence:"},{"line_number":19,"context_line":"      - \"cinder/volume/drivers/quobyte.py:126\""},{"line_number":20,"context_line":"    caveat: \"FUSE filesystem datapath; no iSCSI\""},{"line_number":21,"context_line":"  datapath_auth_nvme:"},{"line_number":22,"context_line":"    state: not_applicable"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"c34477cc_0e13ea54","line":19,"range":{"start_line":19,"start_character":0,"end_line":19,"end_character":2},"updated":"2026-08-17 10:41:42.000000000","message":"I think this code ref [1] is unrelated to this entry. Quobyte simply does not use ISCSI.\n\n[1] https://opendev.org/openstack/cinder/src/commit/b5b763129e2bde5077c0cf3a5eb434021abaa6e0/cinder/volume/drivers/quobyte.py#L126","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"9e810c01898696363e4a200eb848965008293add","unresolved":false,"context_lines":[{"line_number":16,"context_line":"  datapath_auth_iscsi:"},{"line_number":17,"context_line":"    state: not_applicable"},{"line_number":18,"context_line":"    evidence:"},{"line_number":19,"context_line":"      - \"cinder/volume/drivers/quobyte.py:126\""},{"line_number":20,"context_line":"    caveat: \"FUSE filesystem datapath; no iSCSI\""},{"line_number":21,"context_line":"  datapath_auth_nvme:"},{"line_number":22,"context_line":"    state: not_applicable"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"5f7c9284_7067f0d0","line":19,"range":{"start_line":19,"start_character":0,"end_line":19,"end_character":2},"in_reply_to":"c34477cc_0e13ea54","updated":"2026-08-17 14:44:15.000000000","message":"Agreed — and the general point is that absence is not something a citation can establish. :126 was driver_volume_type \u003d \u0027quobyte\u0027, which shows what the transport is but proves nothing about iSCSI, and in today\u0027s tree that line is the closing docstring quotes anyway. The state stays not_applicable, the citation is dropped (the schema does not require evidence for not_applicable), and the caveat carries the claim. Same treatment for datapath_auth_nvme, and for 17 similar citations across the other drivers.","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13915,"name":"Silvan Kaiser","email":"silvan@quobyte.com","username":"kaisers"},"change_message_id":"18ac9f17738d80a025de723ab83c09241cc9d3c3","unresolved":true,"context_lines":[{"line_number":23,"context_line":"    evidence:"},{"line_number":24,"context_line":"      - \"cinder/volume/drivers/quobyte.py:126\""},{"line_number":25,"context_line":"    caveat: \"no NVMe-oF\""},{"line_number":26,"context_line":"  datapath_transport_encryption:"},{"line_number":27,"context_line":"    state: not_securable"},{"line_number":28,"context_line":"    evidence:"},{"line_number":29,"context_line":"      - \"cinder/volume/drivers/quobyte.py:718-721\""},{"line_number":30,"context_line":"    caveat: \"FUSE mount; transport security is a Quobyte client-config concern, not driver-enforced\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"2368b6f0_9ab4c930","line":27,"range":{"start_line":26,"start_character":1,"end_line":27,"end_character":24},"updated":"2026-08-17 10:41:42.000000000","message":"Transport encryption happens between the Quobyte client and the backend based on the client config set up for the Quobyte Cinder driver. \"not_securable\" is wrong unless I seriously misunderstood something?","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"9e810c01898696363e4a200eb848965008293add","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    evidence:"},{"line_number":24,"context_line":"      - \"cinder/volume/drivers/quobyte.py:126\""},{"line_number":25,"context_line":"    caveat: \"no NVMe-oF\""},{"line_number":26,"context_line":"  datapath_transport_encryption:"},{"line_number":27,"context_line":"    state: not_securable"},{"line_number":28,"context_line":"    evidence:"},{"line_number":29,"context_line":"      - \"cinder/volume/drivers/quobyte.py:718-721\""},{"line_number":30,"context_line":"    caveat: \"FUSE mount; transport security is a Quobyte client-config concern, not driver-enforced\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"bb34eee9_bd4251bb","line":27,"range":{"start_line":26,"start_character":1,"end_line":27,"end_character":24},"in_reply_to":"2368b6f0_9ab4c930","updated":"2026-08-17 14:44:15.000000000","message":"You did not misunderstand — this was the real error in the row, and the cell contradicted itself: not_securable is defined on the page as \"no mechanism exists to secure the property\", while my own caveat admitted the mechanism was a client-config concern. It is now securable, with the caveat naming quobyte_client_cfg… The page now also states the rule that was missing, which is what let this happen… Applying that rule found the same mistake in nfs, veritas_cnfs, vmstore and the NFS half of netapp_ontap.","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13915,"name":"Silvan Kaiser","email":"silvan@quobyte.com","username":"kaisers"},"change_message_id":"18ac9f17738d80a025de723ab83c09241cc9d3c3","unresolved":true,"context_lines":[{"line_number":26,"context_line":"  datapath_transport_encryption:"},{"line_number":27,"context_line":"    state: not_securable"},{"line_number":28,"context_line":"    evidence:"},{"line_number":29,"context_line":"      - \"cinder/volume/drivers/quobyte.py:718-721\""},{"line_number":30,"context_line":"    caveat: \"FUSE mount; transport security is a Quobyte client-config concern, not driver-enforced\""},{"line_number":31,"context_line":"  discovery_exposure:"},{"line_number":32,"context_line":"    state: securable"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ae42ed3e_f07c5360","line":29,"range":{"start_line":29,"start_character":0,"end_line":29,"end_character":2},"updated":"2026-08-17 10:41:42.000000000","message":"This points to [1] which is no related to this datapath_transport_encryption afaics? I am not sure which evidence exactly is looked for, here.\n\n[1] https://opendev.org/openstack/cinder/src/commit/b5b763129e2bde5077c0cf3a5eb434021abaa6e0/cinder/volume/drivers/quobyte.py#L718-L721","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"9e810c01898696363e4a200eb848965008293add","unresolved":false,"context_lines":[{"line_number":26,"context_line":"  datapath_transport_encryption:"},{"line_number":27,"context_line":"    state: not_securable"},{"line_number":28,"context_line":"    evidence:"},{"line_number":29,"context_line":"      - \"cinder/volume/drivers/quobyte.py:718-721\""},{"line_number":30,"context_line":"    caveat: \"FUSE mount; transport security is a Quobyte client-config concern, not driver-enforced\""},{"line_number":31,"context_line":"  discovery_exposure:"},{"line_number":32,"context_line":"    state: securable"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ddd5fe78_13fb69d6","line":29,"range":{"start_line":29,"start_character":0,"end_line":29,"end_character":2},"in_reply_to":"ae42ed3e_f07c5360","updated":"2026-08-17 14:44:15.000000000","message":"Two separate problems, both fixed. The drift is as in comment 2. On what evidence is looked for: a citation should point at the code that determines the property — here _mount_quobyte, because that is where the driver hands quobyte_client_cfg to the client with -c, which is the whole extent of Cinder\u0027s involvement in data-path security… The page has also gained a short section on what a reference is and what it is for, since your question showed that was never written down.","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13915,"name":"Silvan Kaiser","email":"silvan@quobyte.com","username":"kaisers"},"change_message_id":"18ac9f17738d80a025de723ab83c09241cc9d3c3","unresolved":true,"context_lines":[{"line_number":31,"context_line":"  discovery_exposure:"},{"line_number":32,"context_line":"    state: securable"},{"line_number":33,"context_line":"    evidence:"},{"line_number":34,"context_line":"      - \"cinder/volume/drivers/quobyte.py:302-336\""},{"line_number":35,"context_line":"    caveat: \"single configured quobyte_volume_url; access control backend-side\""},{"line_number":36,"context_line":"  secret_handling:"},{"line_number":37,"context_line":"    state: unknown"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"e7b03a97_f8f56109","line":34,"range":{"start_line":34,"start_character":0,"end_line":34,"end_character":2},"updated":"2026-08-17 10:41:42.000000000","message":"Code ref [1] looks unrelated to discovery to me, too. [2] might be correct if i understand this discovery_exposure aspect correctly.\n\n[1] https://opendev.org/openstack/cinder/src/commit/b5b763129e2bde5077c0cf3a5eb434021abaa6e0/cinder/volume/drivers/quobyte.py#L302-L336\n[2] https://opendev.org/openstack/cinder/src/commit/b5b763129e2bde5077c0cf3a5eb434021abaa6e0/cinder/volume/drivers/quobyte.py#L667-L676","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13915,"name":"Silvan Kaiser","email":"silvan@quobyte.com","username":"kaisers"},"change_message_id":"8d88b50b58c992be782faea89ac9796daa7333f8","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  discovery_exposure:"},{"line_number":32,"context_line":"    state: securable"},{"line_number":33,"context_line":"    evidence:"},{"line_number":34,"context_line":"      - \"cinder/volume/drivers/quobyte.py:302-336\""},{"line_number":35,"context_line":"    caveat: \"single configured quobyte_volume_url; access control backend-side\""},{"line_number":36,"context_line":"  secret_handling:"},{"line_number":37,"context_line":"    state: unknown"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"37addec6_98d68f37","line":34,"range":{"start_line":34,"start_character":0,"end_line":34,"end_character":2},"in_reply_to":"27d542ab_469c666b","updated":"2026-08-20 14:16:40.000000000","message":"Understandable, in that case I\u0027d argue for dropping the nas_secure aspect in here as it is just one of many settings that can be configured to be insecure and not a general issue to be pointed out here.","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"74c114c0cd761e4930ae3e57e3dd9571391159cc","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  discovery_exposure:"},{"line_number":32,"context_line":"    state: securable"},{"line_number":33,"context_line":"    evidence:"},{"line_number":34,"context_line":"      - \"cinder/volume/drivers/quobyte.py:302-336\""},{"line_number":35,"context_line":"    caveat: \"single configured quobyte_volume_url; access control backend-side\""},{"line_number":36,"context_line":"  secret_handling:"},{"line_number":37,"context_line":"    state: unknown"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"d6a6d6fd_deea9457","line":34,"range":{"start_line":34,"start_character":0,"end_line":34,"end_character":2},"in_reply_to":"37addec6_98d68f37","updated":"2026-08-20 14:27:59.000000000","message":"Done. A comment is now added about the scope of this page","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13915,"name":"Silvan Kaiser","email":"silvan@quobyte.com","username":"kaisers"},"change_message_id":"ee6152ad5a85142e460f4a501e8e2d2ab584c841","unresolved":true,"context_lines":[{"line_number":31,"context_line":"  discovery_exposure:"},{"line_number":32,"context_line":"    state: securable"},{"line_number":33,"context_line":"    evidence:"},{"line_number":34,"context_line":"      - \"cinder/volume/drivers/quobyte.py:302-336\""},{"line_number":35,"context_line":"    caveat: \"single configured quobyte_volume_url; access control backend-side\""},{"line_number":36,"context_line":"  secret_handling:"},{"line_number":37,"context_line":"    state: unknown"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"f539716e_36866616","line":34,"range":{"start_line":34,"start_character":0,"end_line":34,"end_character":2},"in_reply_to":"de28a715_7df1df79","updated":"2026-08-20 08:16:10.000000000","message":"Interesting question about the nas_secure setting, this can be set to false as mentioned. I wonder if this does mean all settings that can be set to an insecure setting need to be mentioned in this matrix? Because that would mean there\u0027s a lot more to add as most aspects are configurable (and therefore can be set to less secure settings).","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"9e810c01898696363e4a200eb848965008293add","unresolved":true,"context_lines":[{"line_number":31,"context_line":"  discovery_exposure:"},{"line_number":32,"context_line":"    state: securable"},{"line_number":33,"context_line":"    evidence:"},{"line_number":34,"context_line":"      - \"cinder/volume/drivers/quobyte.py:302-336\""},{"line_number":35,"context_line":"    caveat: \"single configured quobyte_volume_url; access control backend-side\""},{"line_number":36,"context_line":"  secret_handling:"},{"line_number":37,"context_line":"    state: unknown"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"de28a715_7df1df79","line":34,"range":{"start_line":34,"start_character":0,"end_line":34,"end_character":2},"in_reply_to":"e7b03a97_f8f56109","updated":"2026-08-17 14:44:15.000000000","message":"Agreed on both. 302-336 is set_nas_security_options… and your [2] is the right target: the cell now cites _ensure_share_mounted first. I kept set_nas_security_options as a second citation for one narrow reason: the caveat now also discloses that nas_secure_file_permissions\u003dfalse leaves volume files mode 666, which is a real exposure even though it is not discovery exposure. There is no better cell for it in the current property set. If you would rather that not ride along here, say so and I will drop it — it is arguably a gap in the property list rather than something to bolt onto this row.","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"},{"author":{"_account_id":13425,"name":"Simon Dodsley","email":"simon@everpuredata.com","username":"sdodsley"},"change_message_id":"eb5fddfa50ad9b73791c5a0a9d9c94cc808690bc","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  discovery_exposure:"},{"line_number":32,"context_line":"    state: securable"},{"line_number":33,"context_line":"    evidence:"},{"line_number":34,"context_line":"      - \"cinder/volume/drivers/quobyte.py:302-336\""},{"line_number":35,"context_line":"    caveat: \"single configured quobyte_volume_url; access control backend-side\""},{"line_number":36,"context_line":"  secret_handling:"},{"line_number":37,"context_line":"    state: unknown"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"27d542ab_469c666b","line":34,"range":{"start_line":34,"start_character":0,"end_line":34,"end_character":2},"in_reply_to":"f539716e_36866616","updated":"2026-08-20 11:44:00.000000000","message":"For this first iteration I think we should keep the property list where it is. As you point out, we could cover a lot of other secure/insecure parameters, but the page is big enough as it is and we don\u0027t want to dilute the critical areas that the TC raised, that caused this work to be done in the first place.","commit_id":"d978ee8c2937356dcdb333fde4f8633c7aa9b6cf"}]}