)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"change_message_id":"107e3c7cb83a1f1c140f5313effa75daeb7d04f5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"973bf6e9_2aebf374","updated":"2026-05-08 11:38:54.000000000","message":"### octavia-v2-dsvm-tls-barbican-stable-2025-1\n\n- **Build URL:** https://zuul.opendev.org/t/openstack/build/af5dfe2892fc4fe69bcf67c3c16b88cc\n- **Log URL:** https://935da3ee72c2327c0d83-6d27f622786e2e5d7efb56feaf2b64dc.ssl.cf5.rackcdn.com/openstack/af5dfe2892fc4fe69bcf67c3c16b88cc/\n- **Duration:** 42m 54s\n- **Voting:** Yes (blocks merge)\n\n**Root Cause Analysis:**\n\nDevstack setup completed successfully in 620 seconds (2026-05-07 13:47:19 UTC). Out of 17 tests in `TLSWithBarbicanTest`, 16 passed and 1 failed: `test_pool_reencryption` (UUID `ee0faf71-d11e-4323-8673-e5e15779749b`).\n\nThe failure is an `InvalidHttpSuccessCode` assertion at `test_tls_barbican.py` line 1422:\n\n```python\nself.validate_URL_response(url, expected_status_code\u003d503)\n```\n\nThe test expected HTTP **503** (Service Unavailable) from the load balancer, but received HTTP **200** (OK). At this point in the test, the pool has just been updated via PUT to alter its TLS reencryption configuration. The 503 expectation indicates the test is verifying that the load balancer correctly returns 503 when the backend pool cannot properly complete a TLS handshake (e.g., due to a missing or invalid certificate reference being applied). Instead, the backend pool is returning 200, meaning octavia is continuing to forward traffic to the backend even though it should be failing the TLS reencrypt verification.\n\nThe `octavia-tenant-traffic_log.txt` confirms SSL handshake failures elsewhere in the test run (`error:0A0000C7:SSL routines::peer did not return a certificate`), but those are from separate `client_auth` test cases (different listener IDs). For `test_pool_reencryption`, octavia is silently succeeding where it should fail — this points to an octavia data-plane regression on the **stable-2025-1** branch (octavia-worker version 16.0.2.dev14), specifically around TLS pool reencryption enforcement.\n\nThis failure is **unrelated to the current patchset**: the patchset is for `octavia-tempest-plugin`, and the 16 other TLS/Barbican tests pass cleanly in the same job. The `test_pool_reencryption` failure reflects an octavia behavioral regression in the stable-2025-1 environment — octavia is not correctly enforcing TLS reencryption failure when it should, returning 200 instead of 503. This is a pre-existing issue with the octavia service (or its Barbican integration) on this branch, not caused by this tempest plugin change.\n\nThis is a **voting** job and currently **blocks merge**.\n\n**Key Log Evidence:**\n```\n# testr_results.html — 17 tests, 16 PASS, 1 FAIL\nTest Group: octavia_tempest_plugin.tests.barbican_scenario.v2.test_tls_barbican.TLSWithBarbicanTest\n  Count: 17  Pass: 16  Fail: 1  Error: 0  Skip: 0\nFAIL: test_pool_reencryption[id-ee0faf71-d11e-4323-8673-e5e15779749b]\n\n# Full traceback from testr_results.html\nTraceback (most recent call last):\n  File \"...octavia_tempest_plugin/tests/barbican_scenario/v2/test_tls_barbican.py\", line 1422,\n        in test_pool_reencryption\n    self.validate_URL_response(url, expected_status_code\u003d503)\n  File \"...octavia_tempest_plugin/tests/validators.py\", line 95, in validate_URL_response\n    raise exceptions.InvalidHttpSuccessCode(\ntempest.lib.exceptions.InvalidHttpSuccessCode: The success code is different than the expected one\nDetails: 200 is not the expected code 503\n\n# Test flow showing pool created and traffic validated before the failing assertion:\n2026-05-07 14:05:59,395 128512 INFO [tempest.lib.common.rest_client]\n    Request (TLSWithBarbicanTest:test_pool_reencryption): 201 POST\n    .../lbaas/pools  Body: {\"pool\": {\"protocol\": \"HTTP\",\n    \"lb_algorithm\": \"ROUND_ROBIN\", ..., \"tls_enabled\": true}}\n2026-05-07 14:06:50,728 128512 DEBUG [octavia_tempest_plugin.tests.validators]\n    Loadbalancer response totals: {\u00271\u0027: 1, \u00275\u0027: 1}\n2026-05-07 14:06:51,941 128512 DEBUG [octavia_tempest_plugin.tests.validators]\n    Loadbalancer response totals: {\u00271\u0027: 10, \u00275\u0027: 10}\n[pool update PUT issued — octavia returns ACTIVE — test expects 503 but gets 200]\n\n# octavia-tenant-traffic_log.txt — unrelated SSL failures from other test cases:\n172.24.5.1:49586 [07/May/2026:14:09:44.407] .../1:\n    SSL handshake failure (error:0A0000C7:SSL routines::peer did not return a certificate)\n172.24.5.1:50162 [07/May/2026:14:11:52.160] .../1:\n    SSL handshake failure (error:0A0000C7:SSL routines::peer did not return a certificate)\n\n# screen-o-hm.txt — octavia version on stable-2025-1\nMay 07 13:46:12.750319 octavia-health-manager[120967]: version 16.0.2.dev14\n  Load balancer topology: SINGLE\n\n# devstacklog.txt.summary — stack completed successfully\n2026-05-07 13:47:19.252 | stack.sh completed in 620 seconds.\n```\n\n**Category:** UNRELATED\n\n**Recommendation:** This failure is a pre-existing octavia behavioral regression on stable-2025-1 (octavia 16.0.2.dev14), not caused by this patchset. Since 16/17 TLS/Barbican tests pass, the plugin test infrastructure is working correctly. Post a `recheck` to re-run; if the failure persists, open a bug against `openstack/octavia` tracking the pool reencryption 503-vs-200 behavior on stable-2025-1, and consider skipping or marking `test_pool_reencryption` as expected-failure (`@decorators.skip_because`) on that branch until the octavia fix lands.\n\nAnalysis generated with assistance from Claude Sonnet 4.6","commit_id":"96b403e42139978c505a27e260f9a439ef6fdc97"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"change_message_id":"b6191eed93c700a3f8c1e342d65f87b46835a010","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"510ba72a_dc5b1a21","updated":"2026-05-08 11:37:51.000000000","message":"recheck - CI fail was due to an unrelated test","commit_id":"96b403e42139978c505a27e260f9a439ef6fdc97"}]}