)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"change_message_id":"12c59455c884dff97a7a9be14182759d8036f905","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"efb86ba9_8671834a","updated":"2026-06-22 14:41:23.000000000","message":"Great stuff, Richard. I have a few requests for clarification, but by and large the questions I had were immediately answered in the spec.","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"change_message_id":"2097882e84da9a02dd93098c7ca788f91c3d77c6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"2e7e74ce_cac98af5","updated":"2026-06-22 16:02:54.000000000","message":"Thanks @zachary.raines@canonical.com, great feedback! I\u0027ve added a few notes and I\u0027ll work on updating the spec, should be ready tomorrow","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"}],"specs/2026.2/pqc-strict-mode.rst":[{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"tag":"autogenerated:claude-review","change_message_id":"912fca46851deb5c8e8b595efdda99ec21371b51","unresolved":false,"context_lines":[{"line_number":133,"context_line":"The first is the per-certificate checker::"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"    check_algorithm_compliance(public_key_or_cert, plane) -\u003e (algorithm_name, is_compliant)"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"The ``plane`` parameter accepts ``\u0027control\u0027`` or ``\u0027data\u0027``, allowing the"},{"line_number":138,"context_line":"function to read the appropriate per-plane check-mode config option and apply"},{"line_number":139,"context_line":"it consistently.  The function:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"a33a492a_72e4b021","line":136,"updated":"2026-06-16 21:03:47.000000000","message":"The `plane` parameter is described as accepting the bare string literals `\u0027control\u0027` or `\u0027data\u0027`. This is an unvalidated enumerated parameter that is vulnerable to typo bugs that would silently misbehave.","commit_id":"59d1ed963724ce0f441d49e60246c7cebd24a3ff"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"tag":"autogenerated:claude-review","change_message_id":"912fca46851deb5c8e8b595efdda99ec21371b51","unresolved":false,"context_lines":[{"line_number":130,"context_line":"A new module ``octavia/common/tls_utils/pqc_utils.py`` exposes two public"},{"line_number":131,"context_line":"functions."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"The first is the per-certificate checker::"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"    check_algorithm_compliance(public_key_or_cert, plane) -\u003e (algorithm_name, is_compliant)"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"The ``plane`` parameter accepts ``\u0027control\u0027`` or ``\u0027data\u0027``, allowing the"},{"line_number":138,"context_line":"function to read the appropriate per-plane check-mode config option and apply"},{"line_number":139,"context_line":"it consistently.  The function:"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"* accepts a pyca/cryptography public key or X.509 certificate object;"},{"line_number":142,"context_line":"* extracts the public key algorithm using the library\u0027s own introspection"},{"line_number":143,"context_line":"  APIs (``isinstance`` checks against library key classes, OID comparison"},{"line_number":144,"context_line":"  for PQC key types);"},{"line_number":145,"context_line":"* returns the detected algorithm name and whether it appears in the"},{"line_number":146,"context_line":"  effective ``pqc_allowed_algorithms`` list."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"The function contains no custom OID tables or cryptographic logic — all"},{"line_number":149,"context_line":"algorithm knowledge comes from pyca/cryptography."}],"source_content_type":"text/x-rst","patch_set":1,"id":"e69bbcd5_615aee17","line":146,"range":{"start_line":133,"start_character":0,"end_line":146,"end_character":0},"updated":"2026-06-16 21:03:47.000000000","message":"The function is described as both returning `(algorithm_name, is_compliant)` and raising `CertificateValidationException` in STRICT mode. These two contracts are incompatible — callers cannot rely on the return value in STRICT mode because an exception is thrown instead. This creates an ambiguous API surface where the tuple return is useful only in PERMISSIVE/DISABLED paths.","commit_id":"59d1ed963724ce0f441d49e60246c7cebd24a3ff"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"tag":"autogenerated:claude-review","change_message_id":"912fca46851deb5c8e8b595efdda99ec21371b51","unresolved":false,"context_lines":[{"line_number":148,"context_line":"The function contains no custom OID tables or cryptographic logic — all"},{"line_number":149,"context_line":"algorithm knowledge comes from pyca/cryptography."},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"The existing ``cert_parser.py`` public key comparison uses ``.public_numbers()``,"},{"line_number":152,"context_line":"which is not available on ML-DSA and ML-KEM key objects.  This call is replaced"},{"line_number":153,"context_line":"with an algorithm-agnostic comparison using ``.public_bytes()`` serialisation,"},{"line_number":154,"context_line":"which works across all key types."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"The second function handles startup validation (described in Part 3)."},{"line_number":157,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"36c95137_08c5521b","line":154,"range":{"start_line":151,"start_character":0,"end_line":154,"end_character":0},"updated":"2026-06-16 21:03:47.000000000","message":"The spec proposes replacing `.public_numbers()` with `.public_bytes()` serialisation for algorithm-agnostic public key comparison, but does not specify the encoding parameters.","commit_id":"59d1ed963724ce0f441d49e60246c7cebd24a3ff"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"tag":"autogenerated:claude-review","change_message_id":"912fca46851deb5c8e8b595efdda99ec21371b51","unresolved":false,"context_lines":[{"line_number":207,"context_line":"the Octavia-maintained reference set of PQC-compliant algorithms, corresponding"},{"line_number":208,"context_line":"to NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA)::"},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"    PQC_SAFE_ALGORITHMS \u003d ["},{"line_number":211,"context_line":"        \u0027ML-DSA-44\u0027, \u0027ML-DSA-65\u0027, \u0027ML-DSA-87\u0027,"},{"line_number":212,"context_line":"        \u0027ML-KEM-512\u0027, \u0027ML-KEM-768\u0027, \u0027ML-KEM-1024\u0027,"},{"line_number":213,"context_line":"        \u0027SLH-DSA-SHAKE-128s\u0027, \u0027SLH-DSA-SHAKE-128f\u0027, \u0027SLH-DSA-SHAKE-256s\u0027,"},{"line_number":214,"context_line":"    ]"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"This constant is the single source of truth for what Octavia considers"},{"line_number":217,"context_line":"PQC-safe.  It does not change between releases unless the community"}],"source_content_type":"text/x-rst","patch_set":1,"id":"6d30b7be_3b9317ee","line":214,"range":{"start_line":210,"start_character":0,"end_line":214,"end_character":0},"updated":"2026-06-16 21:03:47.000000000","message":"`PQC_SAFE_ALGORITHMS` includes `ML-KEM-512`, `ML-KEM-768`, `ML-KEM-1024`. ML-KEM is a Key Encapsulation Mechanism standardised in FIPS 203. It is not a digital signature algorithm and would not appear as the public key algorithm in an X.509 TLS certificate under current TLS standards. Including it in a certificate-algorithm allowlist either silently accepts a malformed certificate or misleads implementers. The OpenSSL 3.5 dependency note correctly states that PQC key exchange (X25519MLKEM768) is negotiated at the TLS transport layer without Octavia involvement — which confirms Octavia has no reason to check for ML-KEM in X.509 certificates.","commit_id":"59d1ed963724ce0f441d49e60246c7cebd24a3ff"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"tag":"autogenerated:claude-review","change_message_id":"912fca46851deb5c8e8b595efdda99ec21371b51","unresolved":false,"context_lines":[{"line_number":262,"context_line":"   If the lists are identical (whether because the option was not set, or"},{"line_number":263,"context_line":"   because the operator set it to the same values), no warning is emitted."},{"line_number":264,"context_line":""},{"line_number":265,"context_line":"2. **Control-plane consistency check**: if"},{"line_number":266,"context_line":"   ``pqc_control_plane_check_mode \u003d STRICT``, verify that ``key_algorithm``"},{"line_number":267,"context_line":"   is present in the effective ``pqc_allowed_algorithms`` list.  If it is"},{"line_number":268,"context_line":"   not, raise ``ConfigInvalidError`` at startup (rather than breaking amphora"},{"line_number":269,"context_line":"   provisioning mid-operation)."},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"Because ``validate_pqc_config()`` is called from the service entrypoint, the"},{"line_number":272,"context_line":"algorithm list warning is emitted exactly once per process start.  If the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"2db2cc3e_83a2cbe3","line":269,"range":{"start_line":265,"start_character":0,"end_line":269,"end_character":0},"updated":"2026-06-16 21:03:47.000000000","message":"The startup consistency check verifies that `key_algorithm` is in `pqc_allowed_algorithms` when `pqc_control_plane_check_mode \u003d STRICT`. However, there is a subtler case: if `pqc_control_plane_check_mode \u003d PERMISSIVE` and `key_algorithm` is not in `pqc_allowed_algorithms`, Octavia will generate amphora certificates and then immediately warn about them on every rotation. This is technically correct behaviour (PERMISSIVE warns, doesn\u0027t fail) but could lead to noisy logs that are difficult to silence without changing `key_algorithm`. The spec should note this edge case even if no code change is required.","commit_id":"59d1ed963724ce0f441d49e60246c7cebd24a3ff"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"tag":"autogenerated:claude-review","change_message_id":"912fca46851deb5c8e8b595efdda99ec21371b51","unresolved":false,"context_lines":[{"line_number":268,"context_line":"   not, raise ``ConfigInvalidError`` at startup (rather than breaking amphora"},{"line_number":269,"context_line":"   provisioning mid-operation)."},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"Because ``validate_pqc_config()`` is called from the service entrypoint, the"},{"line_number":272,"context_line":"algorithm list warning is emitted exactly once per process start.  If the"},{"line_number":273,"context_line":"service is reloaded via SIGHUP (config reload), the function is called again"},{"line_number":274,"context_line":"so that the warning reflects the newly loaded configuration — this is correct"},{"line_number":275,"context_line":"and expected behaviour for a config-reload event."},{"line_number":276,"context_line":""},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":1,"id":"6bd3e57d_81e321f3","line":275,"range":{"start_line":271,"start_character":0,"end_line":275,"end_character":0},"updated":"2026-06-16 21:03:47.000000000","message":"The claim that `validate_pqc_config()` runs on SIGHUP reload assumes all four services support oslo.config SIGHUP. This is not uniformly true in Octavia today.","commit_id":"59d1ed963724ce0f441d49e60246c7cebd24a3ff"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"tag":"autogenerated:claude-review","change_message_id":"912fca46851deb5c8e8b595efdda99ec21371b51","unresolved":false,"context_lines":[{"line_number":543,"context_line":""},{"line_number":544,"context_line":"1. Add ``PQC_SAFE_ALGORITHMS`` constant to ``octavia/common/constants.py``."},{"line_number":545,"context_line":""},{"line_number":546,"context_line":"2. Add ``key_algorithm``, ``pqc_control_plane_check_mode``,"},{"line_number":547,"context_line":"   ``pqc_data_plane_check_mode``, and ``pqc_allowed_algorithms`` config options"},{"line_number":548,"context_line":"   to ``octavia/certificates/common/local.py``; register them in"},{"line_number":549,"context_line":"   ``octavia/common/config.py``.  The ``pqc_allowed_algorithms`` default is"},{"line_number":550,"context_line":"   ``constants.PQC_SAFE_ALGORITHMS``."},{"line_number":551,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"4f5ec3ec_904cb252","line":548,"range":{"start_line":546,"start_character":0,"end_line":548,"end_character":0},"updated":"2026-06-16 21:03:47.000000000","message":"The work item says *\"Add ... config options to `octavia/certificates/common/local.py`\"*. This file path does not correspond to a standard oslo.config registration location in Octavia. Option registration belongs in `octavia/common/config.py`. The file `octavia/certificates/common/local.py` may be confused with `octavia/certificates/generator/local.py`.","commit_id":"59d1ed963724ce0f441d49e60246c7cebd24a3ff"},{"author":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"change_message_id":"12c59455c884dff97a7a9be14182759d8036f905","unresolved":true,"context_lines":[{"line_number":232,"context_line":""},{"line_number":233,"context_line":"The second function in ``pqc_utils.py``::"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"    validate_pqc_config()"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"is called once at service startup, after oslo.config is fully loaded, from"},{"line_number":238,"context_line":"each Octavia service entrypoint (``octavia.cmd.api``,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7fbd94f4_95eedd42","line":235,"range":{"start_line":235,"start_character":4,"end_line":235,"end_character":23},"updated":"2026-06-22 14:41:23.000000000","message":"Our validation doesn\u0027t include checking any already deployed certificates, right? It might be worth emphasizing, in the spec and in the output, that lack of warnings in permissive mode, does not guarantee that the cluster is PQC safe, since some old certs may be hanging around.\n\nIs adding a check for the current certs beyond scope here? If so I assume we\u0027ll put into the docs some instructions on ensuring that everything is ready to go to strict mode.","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"change_message_id":"73687aed280681b0d9ab318aa70eb96005370d1e","unresolved":true,"context_lines":[{"line_number":232,"context_line":""},{"line_number":233,"context_line":"The second function in ``pqc_utils.py``::"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"    validate_pqc_config()"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"is called once at service startup, after oslo.config is fully loaded, from"},{"line_number":238,"context_line":"each Octavia service entrypoint (``octavia.cmd.api``,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7e66c12c_1604af70","line":235,"range":{"start_line":235,"start_character":4,"end_line":235,"end_character":23},"in_reply_to":"1dfa291e_bec53c54","updated":"2026-06-25 12:34:01.000000000","message":"I\u0027ve looked over it and checking the certs when they\u0027re loaded from Barbican (or equivalent) seems easiest. This means any listener operation or a failover should trigger the checks. A running listener will be unaffected until something changes. I\u0027ve tried to clarify this section to capture that","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"change_message_id":"2097882e84da9a02dd93098c7ca788f91c3d77c6","unresolved":true,"context_lines":[{"line_number":232,"context_line":""},{"line_number":233,"context_line":"The second function in ``pqc_utils.py``::"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"    validate_pqc_config()"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"is called once at service startup, after oslo.config is fully loaded, from"},{"line_number":238,"context_line":"each Octavia service entrypoint (``octavia.cmd.api``,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9583c5db_df80dd5a","line":235,"range":{"start_line":235,"start_character":4,"end_line":235,"end_character":23},"in_reply_to":"7fbd94f4_95eedd42","updated":"2026-06-22 16:02:54.000000000","message":"Yeah that\u0027s a good point an definitely worth clarifying. My assumption would be that any existing certs would not be checked and only in the case of a new cert would it be validated for PQC compliance. \n\nHowever, there is the case that an operator would gradually transition everything over and once all their listener certs are compliant they would set everything to STRICT mode for PQC\n\nThis kind of implies that existing certs should be checked as well to ensure compliance. This doesn\u0027t necessarily need to be automated, it could be a separate script. But it might be possible to insert it into the existing amphora cert logic as well\n\nLet me take a look and see what we can do","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"change_message_id":"8591ab4a2fc78ab59fa94426df2f362d3c62f9cb","unresolved":true,"context_lines":[{"line_number":232,"context_line":""},{"line_number":233,"context_line":"The second function in ``pqc_utils.py``::"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"    validate_pqc_config()"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"is called once at service startup, after oslo.config is fully loaded, from"},{"line_number":238,"context_line":"each Octavia service entrypoint (``octavia.cmd.api``,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1dfa291e_bec53c54","line":235,"range":{"start_line":235,"start_character":4,"end_line":235,"end_character":23},"in_reply_to":"9583c5db_df80dd5a","updated":"2026-06-23 18:23:27.000000000","message":"Yeah. A separate script would work too, or just emphasizing to the user what is and isn\u0027t checked.","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"change_message_id":"12c59455c884dff97a7a9be14182759d8036f905","unresolved":true,"context_lines":[{"line_number":244,"context_line":"   ``constants.PQC_SAFE_ALGORITHMS``.  If the lists differ, emit a single"},{"line_number":245,"context_line":"   ``LOG.warning`` of the form::"},{"line_number":246,"context_line":""},{"line_number":247,"context_line":"       PQC allowed algorithm list differs from Octavia defaults."},{"line_number":248,"context_line":"         Added (not in Octavia defaults): [\u0027CUSTOM-ALG\u0027]"},{"line_number":249,"context_line":"         Removed (from Octavia defaults): [\u0027ML-DSA-44\u0027]"},{"line_number":250,"context_line":"         Effective list: [\u0027ML-DSA-65\u0027, ..., \u0027CUSTOM-ALG\u0027]"},{"line_number":251,"context_line":"         See the PQC Migration operator guide for the rationale behind the"},{"line_number":252,"context_line":"         Octavia default list."},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"   Both directions of the diff are reported:"},{"line_number":255,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"eb55717f_fe824afd","line":252,"range":{"start_line":247,"start_character":5,"end_line":252,"end_character":30},"updated":"2026-06-22 14:41:23.000000000","message":"This is a good friction point to make users consider the algorithms their using, but maybe worth emphasizing that we don\u0027t protect the user from choosing an unsafe algorithm if they really want.","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"change_message_id":"73687aed280681b0d9ab318aa70eb96005370d1e","unresolved":true,"context_lines":[{"line_number":244,"context_line":"   ``constants.PQC_SAFE_ALGORITHMS``.  If the lists differ, emit a single"},{"line_number":245,"context_line":"   ``LOG.warning`` of the form::"},{"line_number":246,"context_line":""},{"line_number":247,"context_line":"       PQC allowed algorithm list differs from Octavia defaults."},{"line_number":248,"context_line":"         Added (not in Octavia defaults): [\u0027CUSTOM-ALG\u0027]"},{"line_number":249,"context_line":"         Removed (from Octavia defaults): [\u0027ML-DSA-44\u0027]"},{"line_number":250,"context_line":"         Effective list: [\u0027ML-DSA-65\u0027, ..., \u0027CUSTOM-ALG\u0027]"},{"line_number":251,"context_line":"         See the PQC Migration operator guide for the rationale behind the"},{"line_number":252,"context_line":"         Octavia default list."},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"   Both directions of the diff are reported:"},{"line_number":255,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"d142bd9b_b69be26c","line":252,"range":{"start_line":247,"start_character":5,"end_line":252,"end_character":30},"in_reply_to":"404bda13_5530a9b2","updated":"2026-06-25 12:34:01.000000000","message":"I\u0027ve added a note to explain this point at L275, hopefully it\u0027s enough but I suspect we\u0027ll see the occasional battery of questions on this","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"change_message_id":"2097882e84da9a02dd93098c7ca788f91c3d77c6","unresolved":true,"context_lines":[{"line_number":244,"context_line":"   ``constants.PQC_SAFE_ALGORITHMS``.  If the lists differ, emit a single"},{"line_number":245,"context_line":"   ``LOG.warning`` of the form::"},{"line_number":246,"context_line":""},{"line_number":247,"context_line":"       PQC allowed algorithm list differs from Octavia defaults."},{"line_number":248,"context_line":"         Added (not in Octavia defaults): [\u0027CUSTOM-ALG\u0027]"},{"line_number":249,"context_line":"         Removed (from Octavia defaults): [\u0027ML-DSA-44\u0027]"},{"line_number":250,"context_line":"         Effective list: [\u0027ML-DSA-65\u0027, ..., \u0027CUSTOM-ALG\u0027]"},{"line_number":251,"context_line":"         See the PQC Migration operator guide for the rationale behind the"},{"line_number":252,"context_line":"         Octavia default list."},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"   Both directions of the diff are reported:"},{"line_number":255,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"404bda13_5530a9b2","line":252,"range":{"start_line":247,"start_character":5,"end_line":252,"end_character":30},"in_reply_to":"eb55717f_fe824afd","updated":"2026-06-22 16:02:54.000000000","message":"We\u0027ll have to make an all caps note in the docs about this. I think people will still get it wrong unfortunately 😕","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"change_message_id":"12c59455c884dff97a7a9be14182759d8036f905","unresolved":true,"context_lines":[{"line_number":271,"context_line":""},{"line_number":272,"context_line":"Because ``validate_pqc_config()`` is called from the service entrypoint, the"},{"line_number":273,"context_line":"algorithm list warning is emitted exactly once per process start.  If the"},{"line_number":274,"context_line":"service is reloaded via SIGHUP (config reload), the function is called again"},{"line_number":275,"context_line":"so that the warning reflects the newly loaded configuration — this is correct"},{"line_number":276,"context_line":"and expected behaviour for a config-reload event."},{"line_number":277,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"2eec8603_3413f2cb","line":274,"range":{"start_line":274,"start_character":24,"end_line":274,"end_character":30},"updated":"2026-06-22 14:41:23.000000000","message":"I agree that this is the sane behavior. One tangential note is that reloading octavia with SIGHUP doesn\u0027t always work as expected, for example with the ovn-provider, so it\u0027s worth thinking about what happens if the the reload fails.","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"change_message_id":"73687aed280681b0d9ab318aa70eb96005370d1e","unresolved":false,"context_lines":[{"line_number":271,"context_line":""},{"line_number":272,"context_line":"Because ``validate_pqc_config()`` is called from the service entrypoint, the"},{"line_number":273,"context_line":"algorithm list warning is emitted exactly once per process start.  If the"},{"line_number":274,"context_line":"service is reloaded via SIGHUP (config reload), the function is called again"},{"line_number":275,"context_line":"so that the warning reflects the newly loaded configuration — this is correct"},{"line_number":276,"context_line":"and expected behaviour for a config-reload event."},{"line_number":277,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a91e67a_8447a83c","line":274,"range":{"start_line":274,"start_character":24,"end_line":274,"end_character":30},"in_reply_to":"0bdfc173_029902ab","updated":"2026-06-25 12:34:01.000000000","message":"Done","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"change_message_id":"2097882e84da9a02dd93098c7ca788f91c3d77c6","unresolved":true,"context_lines":[{"line_number":271,"context_line":""},{"line_number":272,"context_line":"Because ``validate_pqc_config()`` is called from the service entrypoint, the"},{"line_number":273,"context_line":"algorithm list warning is emitted exactly once per process start.  If the"},{"line_number":274,"context_line":"service is reloaded via SIGHUP (config reload), the function is called again"},{"line_number":275,"context_line":"so that the warning reflects the newly loaded configuration — this is correct"},{"line_number":276,"context_line":"and expected behaviour for a config-reload event."},{"line_number":277,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9e9ffa1b_ab189fc5","line":274,"range":{"start_line":274,"start_character":24,"end_line":274,"end_character":30},"in_reply_to":"2eec8603_3413f2cb","updated":"2026-06-22 16:02:54.000000000","message":"Actually I might remove the SIGHUP reference, it\u0027s a bit too specific in my opinion","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"change_message_id":"8591ab4a2fc78ab59fa94426df2f362d3c62f9cb","unresolved":false,"context_lines":[{"line_number":271,"context_line":""},{"line_number":272,"context_line":"Because ``validate_pqc_config()`` is called from the service entrypoint, the"},{"line_number":273,"context_line":"algorithm list warning is emitted exactly once per process start.  If the"},{"line_number":274,"context_line":"service is reloaded via SIGHUP (config reload), the function is called again"},{"line_number":275,"context_line":"so that the warning reflects the newly loaded configuration — this is correct"},{"line_number":276,"context_line":"and expected behaviour for a config-reload event."},{"line_number":277,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"0bdfc173_029902ab","line":274,"range":{"start_line":274,"start_character":24,"end_line":274,"end_character":30},"in_reply_to":"9e9ffa1b_ab189fc5","updated":"2026-06-23 18:23:27.000000000","message":"Acknowledged","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"change_message_id":"12c59455c884dff97a7a9be14182759d8036f905","unresolved":true,"context_lines":[{"line_number":357,"context_line":""},{"line_number":358,"context_line":"* ``PUT`` equivalents of the above: same."},{"line_number":359,"context_line":""},{"line_number":360,"context_line":"When ``pqc_data_plane_check_mode \u003d PERMISSIVE``, the same operations succeed"},{"line_number":361,"context_line":"but emit a WARNING log entry.  When ``DISABLED`` (the default), no behavioural"},{"line_number":362,"context_line":"change occurs."},{"line_number":363,"context_line":""},{"line_number":364,"context_line":"The behaviour change is controlled entirely by operator configuration.  It does"}],"source_content_type":"text/x-rst","patch_set":4,"id":"d6f4883c_29dd1038","line":361,"range":{"start_line":360,"start_character":0,"end_line":361,"end_character":30},"updated":"2026-06-22 14:41:23.000000000","message":"The idea here is that this is an operator facing concern, so we only log to the octavia log instead of also returning a warning with the API call? Probably worth adding an explicit note to clarify.","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"change_message_id":"2097882e84da9a02dd93098c7ca788f91c3d77c6","unresolved":true,"context_lines":[{"line_number":357,"context_line":""},{"line_number":358,"context_line":"* ``PUT`` equivalents of the above: same."},{"line_number":359,"context_line":""},{"line_number":360,"context_line":"When ``pqc_data_plane_check_mode \u003d PERMISSIVE``, the same operations succeed"},{"line_number":361,"context_line":"but emit a WARNING log entry.  When ``DISABLED`` (the default), no behavioural"},{"line_number":362,"context_line":"change occurs."},{"line_number":363,"context_line":""},{"line_number":364,"context_line":"The behaviour change is controlled entirely by operator configuration.  It does"}],"source_content_type":"text/x-rst","patch_set":4,"id":"e435ec18_2623cb6f","line":361,"range":{"start_line":360,"start_character":0,"end_line":361,"end_character":30},"in_reply_to":"d6f4883c_29dd1038","updated":"2026-06-22 16:02:54.000000000","message":"Agree, I\u0027ll reword this to clarify","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"change_message_id":"73687aed280681b0d9ab318aa70eb96005370d1e","unresolved":true,"context_lines":[{"line_number":357,"context_line":""},{"line_number":358,"context_line":"* ``PUT`` equivalents of the above: same."},{"line_number":359,"context_line":""},{"line_number":360,"context_line":"When ``pqc_data_plane_check_mode \u003d PERMISSIVE``, the same operations succeed"},{"line_number":361,"context_line":"but emit a WARNING log entry.  When ``DISABLED`` (the default), no behavioural"},{"line_number":362,"context_line":"change occurs."},{"line_number":363,"context_line":""},{"line_number":364,"context_line":"The behaviour change is controlled entirely by operator configuration.  It does"}],"source_content_type":"text/x-rst","patch_set":4,"id":"4c03fc97_9d423eb6","line":361,"range":{"start_line":360,"start_character":0,"end_line":361,"end_character":30},"in_reply_to":"e435ec18_2623cb6f","updated":"2026-06-25 12:34:01.000000000","message":"I removed the SIGHUP reference, too much scope for confusion","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38360,"name":"Zachary Mark Raines","display_name":"Zachary Raines","email":"zachary.raines@canonical.com","username":"raineszm","status":"Sustaining Engineer @ Canonical"},"change_message_id":"12c59455c884dff97a7a9be14182759d8036f905","unresolved":true,"context_lines":[{"line_number":479,"context_line":"      pqc_data_plane_check_mode    \u003d PERMISSIVE"},{"line_number":480,"context_line":""},{"line_number":481,"context_line":"   Review the log output to build an inventory of non-compliant resources."},{"line_number":482,"context_line":"   Silence a fully-migrated plane by returning it to ``DISABLED`` while the"},{"line_number":483,"context_line":"   other remains in ``PERMISSIVE``."},{"line_number":484,"context_line":""},{"line_number":485,"context_line":"3. **Control-plane migration** — when pyca/cryptography ships ML-DSA support,"},{"line_number":486,"context_line":"   set ``key_algorithm`` to the desired PQC algorithm.  New amphora"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a271d67_41f8c508","line":483,"range":{"start_line":482,"start_character":3,"end_line":483,"end_character":35},"updated":"2026-06-22 14:41:23.000000000","message":"What is the motivation for returning a fully migrated plane to disabled? Shouldn\u0027t permissive be a no-op on a migrated plane?","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"change_message_id":"73687aed280681b0d9ab318aa70eb96005370d1e","unresolved":true,"context_lines":[{"line_number":479,"context_line":"      pqc_data_plane_check_mode    \u003d PERMISSIVE"},{"line_number":480,"context_line":""},{"line_number":481,"context_line":"   Review the log output to build an inventory of non-compliant resources."},{"line_number":482,"context_line":"   Silence a fully-migrated plane by returning it to ``DISABLED`` while the"},{"line_number":483,"context_line":"   other remains in ``PERMISSIVE``."},{"line_number":484,"context_line":""},{"line_number":485,"context_line":"3. **Control-plane migration** — when pyca/cryptography ships ML-DSA support,"},{"line_number":486,"context_line":"   set ``key_algorithm`` to the desired PQC algorithm.  New amphora"}],"source_content_type":"text/x-rst","patch_set":4,"id":"f2e26790_f8122fcf","line":483,"range":{"start_line":482,"start_character":3,"end_line":483,"end_character":35},"in_reply_to":"0ae0c1e8_78da3e48","updated":"2026-06-25 12:34:01.000000000","message":"Should be fixed now","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"},{"author":{"_account_id":38562,"name":"Richard Cruise","email":"rcruise@redhat.com","username":"rcruise"},"change_message_id":"2097882e84da9a02dd93098c7ca788f91c3d77c6","unresolved":true,"context_lines":[{"line_number":479,"context_line":"      pqc_data_plane_check_mode    \u003d PERMISSIVE"},{"line_number":480,"context_line":""},{"line_number":481,"context_line":"   Review the log output to build an inventory of non-compliant resources."},{"line_number":482,"context_line":"   Silence a fully-migrated plane by returning it to ``DISABLED`` while the"},{"line_number":483,"context_line":"   other remains in ``PERMISSIVE``."},{"line_number":484,"context_line":""},{"line_number":485,"context_line":"3. **Control-plane migration** — when pyca/cryptography ships ML-DSA support,"},{"line_number":486,"context_line":"   set ``key_algorithm`` to the desired PQC algorithm.  New amphora"}],"source_content_type":"text/x-rst","patch_set":4,"id":"0ae0c1e8_78da3e48","line":483,"range":{"start_line":482,"start_character":3,"end_line":483,"end_character":35},"in_reply_to":"9a271d67_41f8c508","updated":"2026-06-22 16:02:54.000000000","message":"Yes, this is badly written, I\u0027ll remove it","commit_id":"20a4d449d4b8d38516e450a7021a84540225ea57"}]}