)]}'
{"id":"openstack%2Fkolla~999866","triplet_id":"openstack%2Fkolla~master~I3babba42d619a061b7eab4baaccc1aaf019dfce2","project":"openstack/kolla","branch":"master","hashtags":[],"change_id":"I3babba42d619a061b7eab4baaccc1aaf019dfce2","subject":"letsencrypt: Fail when lego cannot obtain a certificate","status":"NEW","created":"2026-08-05 15:50:10.000000000","updated":"2026-08-05 17:56:52.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":false,"submittable":false,"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"414c19fc5d93c138528a04a641e25e08bdbbee33","_number":999866,"virtual_id_number":999866,"owner":{"_account_id":39361,"name":"Premysl Kouril","display_name":"premek","email":"premysl.kouril@ultimum.io","username":"premek4"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-08-05 17:56:52.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Backport-Candidate":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Do Not Backport"," 0":"Backport Review Needed","+1":"Should Backport"},"description":"","default_value":0,"optional":true},"Review-Priority":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Branch Freeze"," 0":"No Priority","+1":"Important Change","+2":"Gate Blocker Fix / Urgent Change"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-05 17:14:25.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"CC"},{"updated":"2026-08-05 17:56:52.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"acc96e66fa2845d10e340630fd8a38f76c5f4418","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":39361,"name":"Premysl Kouril","display_name":"premek","email":"premysl.kouril@ultimum.io","username":"premek4"},"date":"2026-08-05 15:50:10.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"0ce4d509b52159a3827ba7df9f6869b69b0e9a04","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":39361,"name":"Premysl Kouril","display_name":"premek","email":"premysl.kouril@ultimum.io","username":"premek4"},"date":"2026-08-05 16:16:23.000000000","message":"Patch Set 2: Commit message was updated.","accounts_in_message":[],"_revision_number":2},{"id":"ae0fab1461f13f92696987256ebe38da5f67eb76","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-05 17:14:25.000000000","message":"Patch Set 2:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/57526894386c4732ba4a0f9034e66005\n\n- kolla-build-centos-10s-arm64 https://zuul.opendev.org/t/openstack/build/03203f4821cb40f5b9f97fda3313c3e5 : SUCCESS in 34m 11s (non-voting)\n- kolla-build-debian-trixie-arm64 https://zuul.opendev.org/t/openstack/build/a0473d06bb944452828e15c28500805b : SUCCESS in 32m 45s (non-voting)\n- kolla-build-rocky-10-arm64 https://zuul.opendev.org/t/openstack/build/2a341abda6b848bebbdaa2a9777d4c65 : SUCCESS in 33m 38s (non-voting)\n- kolla-build-ubuntu-noble-arm64 https://zuul.opendev.org/t/openstack/build/7763e5c8848441d6ac6aaefdfc739fdb : SUCCESS in 34m 35s (non-voting)\n- kolla-ansible-debian-trixie-aarch64 https://zuul.opendev.org/t/openstack/build/6261bf82295b4a22a3b44c8c267d49d5 : FAILURE in 56m 38s (non-voting)\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/210cf704a4cb46458152a10273ddb845 : SUCCESS in 4m 42s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/520c96b5093443b99b7518d9a966d1f7 : SUCCESS in 5m 09s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/35d547cdc1c34dcaa26235dea79af6b1 : SUCCESS in 6m 06s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"414c19fc5d93c138528a04a641e25e08bdbbee33","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-05 17:56:52.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/7f082cee5976493b89bc939a8a3da9cc\n\n- kolla-build-centos-10s https://zuul.opendev.org/t/openstack/build/956a1c68ebf84f62b73ab0e40b0d07a4 : SUCCESS in 59m 36s (non-voting)\n- kolla-build-debian-trixie https://zuul.opendev.org/t/openstack/build/411a15b19864434083f6f2b71196c6ca : SUCCESS in 23m 15s\n- kolla-build-debian-trixie-podman https://zuul.opendev.org/t/openstack/build/f6fa3474644349a0a0dc91824e181b34 : SUCCESS in 27m 55s\n- kolla-build-rocky-10 https://zuul.opendev.org/t/openstack/build/25a0c110e1924952a5935f144fb64c81 : SUCCESS in 27m 07s\n- kolla-build-rocky-10-podman https://zuul.opendev.org/t/openstack/build/b3b4f0c0dcda4681a86f6b7c1bcf497d : SUCCESS in 49m 28s\n- kolla-build-ubuntu-noble https://zuul.opendev.org/t/openstack/build/ba1cb183680b454a87ed3fdd835ac4a0 : SUCCESS in 18m 03s\n- kolla-build-ubuntu-noble-podman https://zuul.opendev.org/t/openstack/build/7d35b09936a443c5ab6cc2777132ce46 : SUCCESS in 29m 17s\n- kolla-ansible-debian-trixie https://zuul.opendev.org/t/openstack/build/393cc594168c4aacb3c1e9f82af4358b : SUCCESS in 1h 05m 52s (non-voting)\n- kolla-ansible-debian-trixie-upgrade https://zuul.opendev.org/t/openstack/build/e30551aed63b46ada9ce3fd7de6e3ec2 : SUCCESS in 1h 36m 57s (non-voting)\n- kolla-ansible-rocky-10 https://zuul.opendev.org/t/openstack/build/6e662afaf2d24c8fa37fb16ee13f7639 : SUCCESS in 1h 09m 19s\n- kolla-ansible-rocky-10-upgrade https://zuul.opendev.org/t/openstack/build/350b088a688f4039a3987f88cc9d2d04 : SUCCESS in 1h 34m 38s\n- kolla-ansible-ubuntu-noble https://zuul.opendev.org/t/openstack/build/186b50b789724b60b6c5993888a770ed : SUCCESS in 1h 02m 24s\n- kolla-ansible-ubuntu-noble-upgrade https://zuul.opendev.org/t/openstack/build/eea2a402316e49cab0b671e718037132 : SUCCESS in 1h 39m 19s\n- kolla-tox-genconfig https://zuul.opendev.org/t/openstack/build/c688ec1a5cde491093afaa0f212cd788 : SUCCESS in 2m 57s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e20dbbb20bc94f058075661f3e6d9c35 : SUCCESS in 3m 48s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/d88bc32774104f4292a1402de0ba0ec8 : SUCCESS in 3m 04s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/5887734ce14f4e5ca8c92d01f4227c5e : SUCCESS in 2m 00s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/f9e0aeed32c5420e93ca869d336955c3 : SUCCESS in 5m 13s (non-voting)\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/999e0b2f32034fb9952868c2dd75d54a : SUCCESS in 5m 50s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/71a8689ba1794aedb284551fbd740d6b : SUCCESS in 6m 32s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/3a0c087380b44c1d94c1133c14afcd67 : SUCCESS in 11m 55s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"a2e9fbd74dc6a84b31106cb9562260b65e07730a","revisions":{"44613011bf1cdafbe05c88535e7d0eb634feeaae":{"kind":"REWORK","_number":1,"created":"2026-08-05 15:50:10.000000000","uploader":{"_account_id":39361,"name":"Premysl Kouril","display_name":"premek","email":"premysl.kouril@ultimum.io","username":"premek4"},"ref":"refs/changes/66/999866/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/kolla","ref":"refs/changes/66/999866/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/kolla refs/changes/66/999866/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/kolla refs/changes/66/999866/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/kolla refs/changes/66/999866/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/kolla refs/changes/66/999866/1"}}},"commit":{"parents":[{"commit":"8e912a9db7f013a1abfc1e70a829e435d50622db","subject":"Merge \"ironic-pxe: don\u0027t fail if symlinks already exist\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/kolla/commit/8e912a9db7f013a1abfc1e70a829e435d50622db"}]}],"author":{"name":"Premysl Kouril","email":"premysl.kouril@ultimum.io","date":"2026-08-05 15:37:46.000000000","tz":120},"committer":{"name":"Premysl Kouril","email":"premysl.kouril@ultimum.io","date":"2026-08-05 15:50:05.000000000","tz":120},"subject":"letsencrypt: Fail when lego cannot obtain a certificate","message":"letsencrypt: Fail when lego cannot obtain a certificate\n\nletsencrypt-certificates.sh captured lego\u0027s output via process\nsubstitution and never inspected its exit status, and the script\u0027s\nown exit status was that of the trailing chown. As a result every\nfailed issuance or renewal - unreachable ACME server, port conflict,\nbad EAB credentials - was reported as success. Since renewals run\nfrom cron every few hours with no other feedback channel, a\npersistent failure stayed invisible until the certificate expired.\n\nCapture lego\u0027s exit status, log an error when it is non-zero, and\nexit non-zero if any requested certificate could not be obtained or\nrenewed. A renewal that lego skips because the certificate is not\nyet due still exits 0, as lego reports success in that case.\n\nThis is a behaviour change: cron jobs and callers that previously\nalways saw exit 0 will now see a non-zero status on failure.\n\nNote that kolla-ansible\u0027s crontab and letsencrypt-lego-run.sh\ntemplates currently pipe this script through \u0027tee\u0027 without pipefail,\nso the exit status is not yet observed there; the [ERROR] log line is\nthe immediately visible signal in those contexts. Propagating the\nstatus through those pipelines is left to a kolla-ansible follow-up.\n\nGenerated-By: Claude Code\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nChange-Id: I3babba42d619a061b7eab4baaccc1aaf019dfce2\nSigned-off-by: Premysl Kouril \u003cpremysl.kouril@ultimum.io\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/kolla/commit/44613011bf1cdafbe05c88535e7d0eb634feeaae"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/kolla/commit/44613011bf1cdafbe05c88535e7d0eb634feeaae"}]},"branch":"refs/heads/master"},"a2e9fbd74dc6a84b31106cb9562260b65e07730a":{"kind":"NO_CODE_CHANGE","_number":2,"created":"2026-08-05 16:16:23.000000000","uploader":{"_account_id":39361,"name":"Premysl Kouril","display_name":"premek","email":"premysl.kouril@ultimum.io","username":"premek4"},"ref":"refs/changes/66/999866/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/kolla","ref":"refs/changes/66/999866/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/kolla refs/changes/66/999866/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/kolla refs/changes/66/999866/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/kolla refs/changes/66/999866/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/kolla refs/changes/66/999866/2"}}},"commit":{"parents":[{"commit":"8e912a9db7f013a1abfc1e70a829e435d50622db","subject":"Merge \"ironic-pxe: don\u0027t fail if symlinks already exist\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/kolla/commit/8e912a9db7f013a1abfc1e70a829e435d50622db"}]}],"author":{"name":"Premysl Kouril","email":"premysl.kouril@ultimum.io","date":"2026-08-05 15:37:46.000000000","tz":120},"committer":{"name":"Premysl Kouril","email":"premysl.kouril@ultimum.io","date":"2026-08-05 16:16:23.000000000","tz":0},"subject":"letsencrypt: Fail when lego cannot obtain a certificate","message":"letsencrypt: Fail when lego cannot obtain a certificate\n\nletsencrypt-certificates.sh captured lego\u0027s output via process\nsubstitution and never inspected its exit status, and the script\u0027s\nown exit status was that of the trailing chown. As a result every\nfailed issuance or renewal - unreachable ACME server, port conflict,\nbad EAB credentials - was reported as success. Since renewals run\nfrom cron every few hours with no other feedback channel, a\npersistent failure stayed invisible until the certificate expired.\n\nCapture lego\u0027s exit status, log an error when it is non-zero, and\nexit non-zero if any requested certificate could not be obtained or\nrenewed. A renewal that lego skips because the certificate is not\nyet due still exits 0, as lego reports success in that case.\n\nThis is a behaviour change: cron jobs and callers that previously\nalways saw exit 0 will now see a non-zero status on failure.\n\nNote that kolla-ansible\u0027s crontab and letsencrypt-lego-run.sh\ntemplates currently pipe this script through \u0027tee\u0027 without pipefail,\nso the exit status is not yet observed there; the [ERROR] log line is\nthe immediately visible signal in those contexts. Propagating the\nstatus through those pipelines is left to a kolla-ansible follow-up.\n\nAssisted-By: Claude Code\nChange-Id: I3babba42d619a061b7eab4baaccc1aaf019dfce2\nSigned-off-by: Premysl Kouril \u003cpremysl.kouril@ultimum.io\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/kolla/commit/a2e9fbd74dc6a84b31106cb9562260b65e07730a"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/kolla/commit/a2e9fbd74dc6a84b31106cb9562260b65e07730a"}]},"branch":"refs/heads/master","description":"Edit commit message"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"},{"label":"Backport-Candidate","status":"MAY"},{"label":"Review-Priority","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Backport-Candidate","description":"Backport candidate status","status":"NOT_APPLICABLE","is_legacy":false,"applicability_expression_result":{"fulfilled":false,"status":"FAIL"},"submittability_expression_result":{"expression":"is:true","fulfilled":true,"status":"NOT_EVALUATED","passing_atoms":[],"failing_atoms":[],"atom_explanations":{}}},{"name":"NonZeroBackportCandidate","description":"A non-zero vote on Backport-Candidate is required before submitting changes","status":"UNSATISFIED","is_legacy":false,"applicability_expression_result":{"fulfilled":true,"status":"PASS"},"submittability_expression_result":{"expression":"label:Backport-Candidate\u003d1 OR label:Backport-Candidate\u003d-1","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Backport-Candidate\u003d1","label:Backport-Candidate\u003d-1"],"atom_explanations":{"label:Backport-Candidate\u003d1":"","label:Backport-Candidate\u003d-1":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Review-Priority","description":"Review priority","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"-label:Review-Priority\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":[],"failing_atoms":["label:Review-Priority\u003dMIN"],"atom_explanations":{"label:Review-Priority\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}