)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"80eef6a1f0d772431f35bc5647180e955d4c2f64","unresolved":true,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Use region and interface for trust-scoped keystone client"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"_admin_client() built the keystoneclient with only a session, so keystoneclient picked the first \u0027admin\u0027 identity endpoint of the service catalog regardless of region."},{"line_number":10,"context_line":"In deployments with one keystone per region, trusts are created in the local keystone but then looked up and deleted in whichever keystone is listed first, failing with \"Could not find trust\" and leaking the trust on trigger deletion."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Closes-Bug: #1862940"},{"line_number":13,"context_line":"Change-Id: I1aaabdb164415bb550186da09af7be9e4e0d8698"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"0ba73ecf_a614cd43","line":10,"range":{"start_line":9,"start_character":0,"end_line":10,"end_character":234},"updated":"2026-10-01 15:33:50.000000000","message":"Please wrap lines at 72 characters.\n\nhttps://wiki.openstack.org/wiki/GitCommitMessages#Summary_of_Git_commit_message_structure","commit_id":"94f3e472ba3dcf11cf4fbc9e7fcafea4d70c413c"},{"author":{"_account_id":39240,"name":"Christopher Barnes","display_name":"Christopher Barnes","email":"christopher.barnes@cern.ch","username":"barnes-c"},"change_message_id":"fdcdc14401a19e79fd871279ed92d8b6365f4c65","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Use region and interface for trust-scoped keystone client"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"_admin_client() built the keystoneclient with only a session, so keystoneclient picked the first \u0027admin\u0027 identity endpoint of the service catalog regardless of region."},{"line_number":10,"context_line":"In deployments with one keystone per region, trusts are created in the local keystone but then looked up and deleted in whichever keystone is listed first, failing with \"Could not find trust\" and leaking the trust on trigger deletion."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Closes-Bug: #1862940"},{"line_number":13,"context_line":"Change-Id: I1aaabdb164415bb550186da09af7be9e4e0d8698"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"396ce996_580adec7","line":10,"range":{"start_line":9,"start_character":0,"end_line":10,"end_character":234},"in_reply_to":"0ba73ecf_a614cd43","updated":"2026-10-04 10:20:23.000000000","message":"Done","commit_id":"94f3e472ba3dcf11cf4fbc9e7fcafea4d70c413c"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"920bd46702a151acab0605bba35b1339ad8b7ad7","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"4a3e12f2_6112c4c6","updated":"2026-10-01 14:32:49.000000000","message":"I\u0027ve not tested this actually in real env but I doubt this works without register_adapter_conf_options call.\n\nAlso adapter options from keystone contain more than these two options like endpoint_override and you should re-implement the client implementation to use adapter, instead of session to avoid ignore options.\n\nIt\u0027s probably better to implement these options locally (like we do in ceilometer for example) along with the existing usage of keystoneauth session.","commit_id":"4c5e8e0ca1f198fb5785a5f4fa4952c9ceee475e"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"d3ea84acf6aaec1cc0fed362946a2da2333e235c","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"977a9873_e5d2e7f0","in_reply_to":"4a3e12f2_6112c4c6","updated":"2026-10-01 14:33:49.000000000","message":"\u003e I\u0027ve not tested this actually in real env but I doubt this works without register_adapter_conf_options call.\n\nSorry I somehow overlooked you added this, so ignore my first sentence.","commit_id":"4c5e8e0ca1f198fb5785a5f4fa4952c9ceee475e"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"61749f6d473bf658f9487105bc6c7500d960d5fb","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"389b4368_192aa2c8","in_reply_to":"977a9873_e5d2e7f0","updated":"2026-10-01 15:33:59.000000000","message":"Done","commit_id":"4c5e8e0ca1f198fb5785a5f4fa4952c9ceee475e"},{"author":{"_account_id":39240,"name":"Christopher Barnes","display_name":"Christopher Barnes","email":"christopher.barnes@cern.ch","username":"barnes-c"},"change_message_id":"598bcfac095fb49840ed491ac06d0f635c71a744","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"3218b00d_69ddfcd8","in_reply_to":"977a9873_e5d2e7f0","updated":"2026-10-04 10:19:01.000000000","message":"Thanks for the quick reply Takashi! I will re-implement it to use the adapter","commit_id":"4c5e8e0ca1f198fb5785a5f4fa4952c9ceee475e"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"80eef6a1f0d772431f35bc5647180e955d4c2f64","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"d0952137_47d7b9be","updated":"2026-10-01 15:33:50.000000000","message":"Thanks for the update !","commit_id":"94f3e472ba3dcf11cf4fbc9e7fcafea4d70c413c"}],"mistral/config.py":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"80eef6a1f0d772431f35bc5647180e955d4c2f64","unresolved":true,"context_lines":[{"line_number":892,"context_line":"                      \u0027operations. Required in deployments with one \u0027"},{"line_number":893,"context_line":"                      \u0027Identity service per region.\u0027)),"},{"line_number":894,"context_line":"    cfg.StrOpt(\u0027interface\u0027,"},{"line_number":895,"context_line":"               default\u003d\u0027admin\u0027,"},{"line_number":896,"context_line":"               choices\u003d(\u0027public\u0027, \u0027internal\u0027, \u0027admin\u0027),"},{"line_number":897,"context_line":"               help\u003d_(\u0027Type of the Identity endpoint used for trust \u0027"},{"line_number":898,"context_line":"                      \u0027operations.\u0027)),"}],"source_content_type":"text/x-python","patch_set":3,"id":"567df0d3_efc36a71","line":895,"range":{"start_line":895,"start_character":24,"end_line":895,"end_character":29},"updated":"2026-10-01 15:33:50.000000000","message":"I\u0027d like to hear some opinion from mistral cores here but in recent keystone admin endpoint is optional and I feel like public endpoint is the better default. Maybe we can merge this and also add a change to move it to public with upgrade impact noted ?","commit_id":"94f3e472ba3dcf11cf4fbc9e7fcafea4d70c413c"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"fe6da4ab97ca6a953d6ad20d48eadac66c313430","unresolved":false,"context_lines":[{"line_number":892,"context_line":"                      \u0027operations. Required in deployments with one \u0027"},{"line_number":893,"context_line":"                      \u0027Identity service per region.\u0027)),"},{"line_number":894,"context_line":"    cfg.StrOpt(\u0027interface\u0027,"},{"line_number":895,"context_line":"               default\u003d\u0027admin\u0027,"},{"line_number":896,"context_line":"               choices\u003d(\u0027public\u0027, \u0027internal\u0027, \u0027admin\u0027),"},{"line_number":897,"context_line":"               help\u003d_(\u0027Type of the Identity endpoint used for trust \u0027"},{"line_number":898,"context_line":"                      \u0027operations.\u0027)),"}],"source_content_type":"text/x-python","patch_set":3,"id":"7af4607d_d33a0d33","line":895,"range":{"start_line":895,"start_character":24,"end_line":895,"end_character":29},"in_reply_to":"166c5c31_4a14a81c","updated":"2026-10-05 09:21:44.000000000","message":"Done","commit_id":"94f3e472ba3dcf11cf4fbc9e7fcafea4d70c413c"},{"author":{"_account_id":39240,"name":"Christopher Barnes","display_name":"Christopher Barnes","email":"christopher.barnes@cern.ch","username":"barnes-c"},"change_message_id":"fdcdc14401a19e79fd871279ed92d8b6365f4c65","unresolved":true,"context_lines":[{"line_number":892,"context_line":"                      \u0027operations. Required in deployments with one \u0027"},{"line_number":893,"context_line":"                      \u0027Identity service per region.\u0027)),"},{"line_number":894,"context_line":"    cfg.StrOpt(\u0027interface\u0027,"},{"line_number":895,"context_line":"               default\u003d\u0027admin\u0027,"},{"line_number":896,"context_line":"               choices\u003d(\u0027public\u0027, \u0027internal\u0027, \u0027admin\u0027),"},{"line_number":897,"context_line":"               help\u003d_(\u0027Type of the Identity endpoint used for trust \u0027"},{"line_number":898,"context_line":"                      \u0027operations.\u0027)),"}],"source_content_type":"text/x-python","patch_set":3,"id":"5fc1fd04_208a949d","line":895,"range":{"start_line":895,"start_character":24,"end_line":895,"end_character":29},"in_reply_to":"567df0d3_efc36a71","updated":"2026-10-04 10:20:23.000000000","message":"In https://review.opendev.org/c/openstack/mistral/+/1008706 I prepared the change for making the default `public`","commit_id":"94f3e472ba3dcf11cf4fbc9e7fcafea4d70c413c"},{"author":{"_account_id":39240,"name":"Christopher Barnes","display_name":"Christopher Barnes","email":"christopher.barnes@cern.ch","username":"barnes-c"},"change_message_id":"d0f9f18699c0e06f9bea66e4bc2ad1f8386a57f7","unresolved":true,"context_lines":[{"line_number":892,"context_line":"                      \u0027operations. Required in deployments with one \u0027"},{"line_number":893,"context_line":"                      \u0027Identity service per region.\u0027)),"},{"line_number":894,"context_line":"    cfg.StrOpt(\u0027interface\u0027,"},{"line_number":895,"context_line":"               default\u003d\u0027admin\u0027,"},{"line_number":896,"context_line":"               choices\u003d(\u0027public\u0027, \u0027internal\u0027, \u0027admin\u0027),"},{"line_number":897,"context_line":"               help\u003d_(\u0027Type of the Identity endpoint used for trust \u0027"},{"line_number":898,"context_line":"                      \u0027operations.\u0027)),"}],"source_content_type":"text/x-python","patch_set":3,"id":"166c5c31_4a14a81c","line":895,"range":{"start_line":895,"start_character":24,"end_line":895,"end_character":29},"in_reply_to":"5fc1fd04_208a949d","updated":"2026-10-05 08:34:04.000000000","message":"i abandoned the patch mentioned above. I see that keystone defaults to public already","commit_id":"94f3e472ba3dcf11cf4fbc9e7fcafea4d70c413c"},{"author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"change_message_id":"529e7ac8f6edd7b376417cc505d2650671ed5948","unresolved":true,"context_lines":[{"line_number":886,"context_line":"                       \u0027reference/healthcheck_plugins.html.\u0027)),"},{"line_number":887,"context_line":"]"},{"line_number":888,"context_line":""},{"line_number":889,"context_line":"keystone_opts \u003d ["},{"line_number":890,"context_line":"    cfg.StrOpt(\u0027region_name\u0027,"},{"line_number":891,"context_line":"               help\u003d_(\u0027Region of the Identity endpoint used for trust \u0027"},{"line_number":892,"context_line":"                      \u0027operations. Required in deployments with one \u0027"}],"source_content_type":"text/x-python","patch_set":5,"id":"9e3d2b52_ba989b4f","line":889,"updated":"2026-10-15 21:49:10.000000000","message":"I am wondering if all of this is needed, the trust is created correctly based on auth_url in keystone_authtoken section.\nNow the question is, why are we not reusing the same when using a trust?\nShould we?","commit_id":"40e6c8f2abfa4ebf4c0f568d4ba8b60be5e84e7c"},{"author":{"_account_id":39240,"name":"Christopher Barnes","display_name":"Christopher Barnes","email":"christopher.barnes@cern.ch","username":"barnes-c"},"change_message_id":"beda7b655cbd86f931ae278de01c4c3f196d68e0","unresolved":false,"context_lines":[{"line_number":886,"context_line":"                       \u0027reference/healthcheck_plugins.html.\u0027)),"},{"line_number":887,"context_line":"]"},{"line_number":888,"context_line":""},{"line_number":889,"context_line":"keystone_opts \u003d ["},{"line_number":890,"context_line":"    cfg.StrOpt(\u0027region_name\u0027,"},{"line_number":891,"context_line":"               help\u003d_(\u0027Region of the Identity endpoint used for trust \u0027"},{"line_number":892,"context_line":"                      \u0027operations. Required in deployments with one \u0027"}],"source_content_type":"text/x-python","patch_set":5,"id":"fdaccaae_7986cec7","line":889,"in_reply_to":"82f438a2_2c3405bb","updated":"2026-10-16 10:46:03.000000000","message":"Done","commit_id":"40e6c8f2abfa4ebf4c0f568d4ba8b60be5e84e7c"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"563ce9b1e1040315e9395edff7f3163fcf268ae8","unresolved":true,"context_lines":[{"line_number":886,"context_line":"                       \u0027reference/healthcheck_plugins.html.\u0027)),"},{"line_number":887,"context_line":"]"},{"line_number":888,"context_line":""},{"line_number":889,"context_line":"keystone_opts \u003d ["},{"line_number":890,"context_line":"    cfg.StrOpt(\u0027region_name\u0027,"},{"line_number":891,"context_line":"               help\u003d_(\u0027Region of the Identity endpoint used for trust \u0027"},{"line_number":892,"context_line":"                      \u0027operations. Required in deployments with one \u0027"}],"source_content_type":"text/x-python","patch_set":5,"id":"d16a8b01_3f93baa9","line":889,"in_reply_to":"9e3d2b52_ba989b4f","updated":"2026-10-16 06:46:29.000000000","message":"auth_url is used only when session instance authenticate with keystone initially, and later keystone endpoint is \"discovered\" through the catalog. We need these options passed to the client/adapter so that the remaining keystone API access used the desired endpoint.\n\nAlternative approach would be passing auth_url as the endpoint_override arg then that discovery step is omitted and auth_url is used.","commit_id":"40e6c8f2abfa4ebf4c0f568d4ba8b60be5e84e7c"},{"author":{"_account_id":39240,"name":"Christopher Barnes","display_name":"Christopher Barnes","email":"christopher.barnes@cern.ch","username":"barnes-c"},"change_message_id":"be024ff461028003bfecfe77e1c71057a46b5273","unresolved":true,"context_lines":[{"line_number":886,"context_line":"                       \u0027reference/healthcheck_plugins.html.\u0027)),"},{"line_number":887,"context_line":"]"},{"line_number":888,"context_line":""},{"line_number":889,"context_line":"keystone_opts \u003d ["},{"line_number":890,"context_line":"    cfg.StrOpt(\u0027region_name\u0027,"},{"line_number":891,"context_line":"               help\u003d_(\u0027Region of the Identity endpoint used for trust \u0027"},{"line_number":892,"context_line":"                      \u0027operations. Required in deployments with one \u0027"}],"source_content_type":"text/x-python","patch_set":5,"id":"82f438a2_2c3405bb","line":889,"in_reply_to":"d16a8b01_3f93baa9","updated":"2026-10-16 07:44:58.000000000","message":"Thanks both for the input.\nI\u0027ll switch to passing auth_url as endpoint_override and drop the new options, so trust lookups/deletes hit the same keystone the trust is created in.","commit_id":"40e6c8f2abfa4ebf4c0f568d4ba8b60be5e84e7c"}]}