)]}'
{"id":"openstack%2Fopenstack-helm~1002206","triplet_id":"openstack%2Fopenstack-helm~master~I9c04787700accb2e57d44efb244b1d79c167ed11","project":"openstack/openstack-helm","branch":"master","attention_set":{},"removed_from_attention_set":{"3009":{"account":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"last_update":"2026-10-13 20:22:13.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"I9c04787700accb2e57d44efb244b1d79c167ed11","subject":"Declarative Keystone identity management","status":"MERGED","created":"2026-08-24 21:52:42.000000000","updated":"2026-10-13 20:24:54.000000000","submitted":"2026-10-13 20:22:13.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1002206","meta_rev_id":"03a4e5fb5246ff20fe7913963529fef15ba14217","_number":1002206,"virtual_id_number":1002206,"owner":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":29974,"name":"Stephen Taylor","email":"staylor@mirantis.com","username":"st053q"},{"value":0,"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-10-13 20:22:13.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":29974,"name":"Stephen Taylor","email":"staylor@mirantis.com","username":"st053q"},"all":[{"value":2,"date":"2026-10-13 18:57:22.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":29974,"name":"Stephen Taylor","email":"staylor@mirantis.com","username":"st053q"},{"value":2,"date":"2026-10-07 20:42:48.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":29974,"name":"Stephen Taylor","email":"staylor@mirantis.com","username":"st053q"},"all":[{"value":1,"date":"2026-10-13 18:57:22.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":29974,"name":"Stephen Taylor","email":"staylor@mirantis.com","username":"st053q"},{"value":0,"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":29974,"name":"Stephen Taylor","email":"staylor@mirantis.com","username":"st053q"},{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-24 23:03:16.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-10-07 20:42:48.000000000","updated_by":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},"reviewer":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},"state":"REVIEWER"},{"updated":"2026-10-13 18:57:22.000000000","updated_by":{"_account_id":29974,"name":"Stephen Taylor","email":"staylor@mirantis.com","username":"st053q"},"reviewer":{"_account_id":29974,"name":"Stephen Taylor","email":"staylor@mirantis.com","username":"st053q"},"state":"REVIEWER"}],"messages":[{"id":"23a1c87f183066599ba50beb4619982c9e15626f","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-08-24 21:52:42.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"776546ebcfa779a6ad2cf39383b798ee6241054a","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-24 23:03:16.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/e4f01cb412f444c8b8792c50bd68fd2c\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/422f5076e5654b11909b517efb5ada7d : SUCCESS in 3m 34s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/64ca7c8b7f374bce9d7063491949f28f : SUCCESS in 3m 30s\n- openstack-helm-keystone-crd-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/e4ae2599993d4ba9886958d71f08e288 : SUCCESS in 55m 27s","accounts_in_message":[],"_revision_number":1},{"id":"bb3d2ae79315b827c3f74c0d3e0976098a72e879","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-08-31 20:43:20.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"139898ba083e7b1915bd1d0c2aface408edaa2f6","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 22:11:01.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/7dba436a773b4ea3a3442a89a7f4e68a\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1a5a32edc41445d7abd3160c3b8f807c : SUCCESS in 3m 27s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/ef8ec5af4ba646fa9073ae110c5d668b : SUCCESS in 3m 57s\n- openstack-helm-keystone-crd-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/ccb28051957f40feaef7861e81e76722 : SUCCESS in 1h 21m 39s","accounts_in_message":[],"_revision_number":2},{"id":"2456b8a8d22e95ccca691745a70347576c8866ec","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-09-02 23:37:36.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"0393aac25cb28ed6609de05efb8228ca10a62957","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-03 00:32:08.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/7ad3d7d5931743808830db91248be4ef\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1dbb54f6536e42df91ff0242d2dbe43b : SUCCESS in 3m 23s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/158f07c8962d4827896cfe558f125db5 : SUCCESS in 2m 30s\n- openstack-helm-keystone-crd-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/54dfd93ef7d84e4895c409eaa717598e : SUCCESS in 53m 17s","accounts_in_message":[],"_revision_number":3},{"id":"50f1db9f9bab593223943ff299b5382bb6c43298","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-09-03 00:56:17.000000000","message":"Uploaded patch set 4: Commit message was updated.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":4},{"id":"d4b53b76bb7b67a15e77b65aa6c506fbbe9c53d3","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-09-03 02:00:41.000000000","message":"Uploaded patch set 5.","accounts_in_message":[],"_revision_number":5},{"id":"558dc06513b9137348ac10bf1fb492c3a046cb8a","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-03 03:05:41.000000000","message":"Patch Set 5: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/1db016a16c964946b66fd28dd8e44dec\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/4c9a2a2dd0aa40a6836ad0d163e4be84 : SUCCESS in 4m 19s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/658ae8d3ed1c4b3f8b2d96a2a305aa18 : SUCCESS in 3m 27s\n- openstack-helm-keystone-crd-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/bcd63777db8b4869a32dd147cfa06284 : SUCCESS in 1h 00m 20s","accounts_in_message":[],"_revision_number":5},{"id":"19d89852fe449c4b0a9ba6c235d2ed76a8167e77","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-09-03 05:22:09.000000000","message":"Uploaded patch set 6.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":6},{"id":"a6ca7bb01529bbbbf72f6ec55158717d0a44b521","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-03 06:49:08.000000000","message":"Patch Set 6: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/537750cb63a44737bcf0f40797b1cfb5\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d12f0406f52848f4871891cbf1116b15 : SUCCESS in 3m 00s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/8e417a599e02405390db81407925d2c7 : SUCCESS in 3m 04s\n- openstack-helm-keystone-crd-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/e1453ae550304cf8a2a3f34fd04efd45 : FAILURE in 1h 25m 31s","accounts_in_message":[],"_revision_number":6},{"id":"d2dbdff012bb8c9bae36a79832df312019d4b827","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-09-30 20:39:50.000000000","message":"Uploaded patch set 7.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":7},{"id":"474c2c4ed1c8a1bdc45e81d2de872b34a9c62497","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-09-30 20:45:36.000000000","message":"Uploaded patch set 8.","accounts_in_message":[],"_revision_number":8},{"id":"8a9d5a2fde6a6212d5aeeab09563fec48ff4122d","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-09-30 20:54:32.000000000","message":"Uploaded patch set 9: Commit message was updated.","accounts_in_message":[],"_revision_number":9},{"id":"6828085aaea0c331307066f8f491aeda6e4abc43","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-09-30 20:54:54.000000000","message":"Uploaded patch set 10: Commit message was updated.","accounts_in_message":[],"_revision_number":10},{"id":"03f5ee4e3f2031db7c67a250b08a982a21ea8789","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-30 23:06:14.000000000","message":"Patch Set 10: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/6c737df0514c4bd8829dead26d856783\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0c93ff9ef7db4e78a6a5d15c7a309b73 : SUCCESS in 3m 13s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/ebeee5c28b584097a0aa7b278bc22aa4 : SUCCESS in 3m 08s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/0e27406ba3b0417693d81c0c40fe87da : SUCCESS in 3m 27s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/5731187e9d36425d8b74c6898f914c48 : SUCCESS in 2m 28s\n- openstack-helm-bandit https://zuul.opendev.org/t/openstack/build/406272dc90f54a0d8dc572bca650b307 : SUCCESS in 3m 56s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/24672ed77ad74dd7a396dbd6de5687b9 : SUCCESS in 7m 19s\n- openstack-helm-compute-kit-2025-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/2e3f844726bc4e7db9f56265b3ae895c : SUCCESS in 1h 30m 59s\n- openstack-helm-compute-kit-2025-2-ubuntu_noble https://zuul.opendev.org/t/openstack/build/8cd85690b22448348a09603422fb7f36 : FAILURE in 1h 44m 34s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/aca470e7c1ed49d8b760632e88a0e353 : POST_FAILURE in 2h 10m 15s\n- openstack-helm-tls-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/800b4be54abc432ea07e2132896f0064 : SUCCESS in 1h 09m 52s\n- openstack-helm-dpdk-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/f3ede264f1ed4ecd8ba1ab88cae8c062 : SUCCESS in 1h 00m 00s\n- openstack-helm-crd-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/531d95c5f5084dc6a51ae0487954cda9 : SUCCESS in 1h 05m 38s\n- openstack-helm-operators-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/ecf99d7aa4ad483aaab4d214163a8c0f : SUCCESS in 1h 38m 30s\n- openstack-helm-logging https://zuul.opendev.org/t/openstack/build/a9dd161bdac44daa96bf6f45e183ec6e : SUCCESS in 32m 24s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/c31dafccc4c043aeb85a5836f3a65c8e : SUCCESS in 29m 08s","accounts_in_message":[],"_revision_number":10},{"id":"ea5daf64ee3349365e93431b17bbc083bee56ec2","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-10-05 20:54:50.000000000","message":"Patch Set 10:\n\n(1 comment)","accounts_in_message":[],"_revision_number":10},{"id":"4a02b517f630cf5f7c3552de5a48bd63232b34c3","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-05 22:41:01.000000000","message":"Patch Set 10: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/7b8963d83da14fb9b44b8f1fbad3e0cf\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/5dd53ecad1c94021a64796253263cc37 : SUCCESS in 4m 55s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/a584b9951f304b40a39d4049205be26b : SUCCESS in 2m 47s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/efff52171d2d41a1a7da4b06809f2e4f : SUCCESS in 2m 23s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/3ea5fe29b8b24629a7c310e7b772357f : SUCCESS in 3m 26s\n- openstack-helm-bandit https://zuul.opendev.org/t/openstack/build/a20111d955cb43d187954f1f27f5ce7a : SUCCESS in 3m 25s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/e77905477cf04104992d3bdf8043b788 : SUCCESS in 6m 46s\n- openstack-helm-compute-kit-2025-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/dd78c971d5eb44b4b1d1bd7699dc02a7 : SUCCESS in 1h 01m 58s\n- openstack-helm-compute-kit-2025-2-ubuntu_noble https://zuul.opendev.org/t/openstack/build/633ffa9bf6bc444594409bd4b1c0e704 : SUCCESS in 1h 02m 47s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/3b4f71ba4db548cd891b92477988a4b2 : SUCCESS in 1h 39m 55s\n- openstack-helm-tls-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/0cdc527d6f6d44aa810108245ec0223f : SUCCESS in 1h 02m 26s\n- openstack-helm-dpdk-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/96a0b2f1ab9841c9a0ee1f4c8baf4ec4 : SUCCESS in 58m 12s\n- openstack-helm-crd-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/363bbc102ce24e25a1c1a890155f65e8 : SUCCESS in 1h 26m 31s\n- openstack-helm-operators-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/f57f2c9f7a3443e2af4a16be51618fbf : SUCCESS in 1h 39m 59s\n- openstack-helm-logging https://zuul.opendev.org/t/openstack/build/fc04a837fe8843efbbe4ca9170924f65 : SUCCESS in 41m 28s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/6b1b2adaff2e4b349cae684efc07db93 : SUCCESS in 33m 14s","accounts_in_message":[],"_revision_number":10},{"id":"1fe7bb14a52b77a6bd4cd5835b02e681f44dcc3c","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-10-07 14:47:30.000000000","message":"Uploaded patch set 11: Patch Set 10 was rebased. Commit message was updated.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":11},{"id":"0fcf6b204f135ea3605f7075af2674280d9fc6b4","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-07 16:50:00.000000000","message":"Patch Set 11: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2424fdbab4e4465fa2efd02db0e84c14\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ca68924a87284b5f94b38f9cba01c3cc : SUCCESS in 3m 47s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/e6081f4321774fd680412c2542089ac0 : SUCCESS in 3m 56s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/0d7f0b47c1d34947a1cc2ab95155c2b1 : SUCCESS in 3m 33s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/a9a65ffd453c4ae3812b4b19acd175ec : SUCCESS in 2m 42s\n- openstack-helm-bandit https://zuul.opendev.org/t/openstack/build/dce89f95d39144ac927809564d3facfc : SUCCESS in 4m 08s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/8c29d1e8e0d24d3fbc6fe0c10e9b9083 : SUCCESS in 6m 17s\n- openstack-helm-compute-kit-2025-2-ubuntu_noble https://zuul.opendev.org/t/openstack/build/88e368904c604f62bc90713dc7b2ea53 : SUCCESS in 1h 05m 00s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/09e5df7e9eb64be4b5e566c7559fb2e9 : SUCCESS in 1h 39m 36s\n- openstack-helm-tls-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/ae85c785abe24cd8a5580b805901b243 : SUCCESS in 1h 58m 47s\n- openstack-helm-dpdk-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/4b907e802fb640bd86bfcde504b69fbf : SUCCESS in 59m 11s\n- openstack-helm-crd-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/ef91beaec72245509c6aa23c151c8bde : SUCCESS in 1h 23m 34s\n- openstack-helm-operators-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/ceec88d22bcd42058bbcebad9b5d482f : SUCCESS in 1h 50m 55s\n- openstack-helm-compute-kit-2026-2-ubuntu_resolute https://zuul.opendev.org/t/openstack/build/8280f5c2c6734ad2968a0867ba58938b : SUCCESS in 1h 15m 52s\n- openstack-helm-logging https://zuul.opendev.org/t/openstack/build/6a9ce35f9f244147af0239455527f82f : SUCCESS in 51m 12s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/e862af9814fd446ab78a1592f8146b4e : SUCCESS in 26m 05s","accounts_in_message":[],"_revision_number":11},{"id":"2b18e21524646783920f0ca991b47266e65de431","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-10-07 17:24:57.000000000","message":"Patch Set 11:\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":11},{"id":"b15bc52e4a7c0fc6f2d96316c83ee67191dc923b","author":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},"date":"2026-10-07 20:42:48.000000000","message":"Patch Set 11: Code-Review+2","accounts_in_message":[],"_revision_number":11},{"id":"70d4f9041c4372d3042b35c768dcc5124b7c29da","author":{"_account_id":29974,"name":"Stephen Taylor","email":"staylor@mirantis.com","username":"st053q"},"date":"2026-10-13 18:57:22.000000000","message":"Patch Set 11: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":11},{"id":"cbd7727c8d4673090ecf2f1a7d5f8649bb71460a","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-13 18:58:02.000000000","message":"Patch Set 11: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":11},{"id":"77cefc491e2f28ce58f2abb03d9f7290b43abcea","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-13 20:22:13.000000000","message":"Patch Set 11: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/e801b9433f1e427080e6126229178919\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/6ca9ccd2d31e4d81bb19f7141bffbe5c : SUCCESS in 3m 02s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/24456cc2efdf44b7b8a253f5ef1a2a37 : SUCCESS in 3m 41s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/37050d975e41497597b842d7b9bb8071 : SUCCESS in 2m 11s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/4199dafac9d94e02894b5a0f0bd6277c : SUCCESS in 1h 12m 06s\n- openstack-helm-logging https://zuul.opendev.org/t/openstack/build/8e4f5d6cefe646c0ae37e933bb6e9107 : SUCCESS in 41m 04s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/53a7635454ab4e70ae1322584cd69562 : SUCCESS in 28m 35s","accounts_in_message":[],"_revision_number":11},{"id":"51662b32e116f7c9615a4ea280cdf4f7ff3ed285","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-13 20:22:13.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":11},{"id":"03a4e5fb5246ff20fe7913963529fef15ba14217","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-13 20:24:54.000000000","message":"Patch Set 11:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2f5b010865324758aea6c7a7271739c4\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d8b43b73c654412ab030ab37ae350757 : SUCCESS in 48s","accounts_in_message":[],"_revision_number":11}],"current_revision_number":11,"current_revision":"175b61e055f1f102161805e6302d8f9f8106d44a","revisions":{"c6d770f24ac09c73e7230ce0da61b8c26a7757f5":{"kind":"REWORK","_number":1,"created":"2026-08-24 21:52:42.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/06/1002206/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/06/1002206/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/1"}}},"commit":{"parents":[{"commit":"0ee5adeffcaefb6f7a78bb23bf845414672e6827","subject":"Merge \"Migrate to RabbitMQ 4.x by default\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/0ee5adeffcaefb6f7a78bb23bf845414672e6827"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-08-24 19:47:23.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-08-24 21:52:41.000000000","tz":-300},"subject":"[WIP] Declarative Keystone identity management","message":"[WIP] Declarative Keystone identity management\n\nEvery chart that owns a service catalog entry provisions it with three\none-shot jobs -- ks-service, ks-user and ks-endpoints -- each mounting the\nKeystone administrative openrc secret into a pod in the OpenStack namespace\nand driving the openstack CLI with it. Thirty-four charts render a ks-user\njob, and eighty-seven of these jobs exist in total. They reconcile nothing,\nreport no status, and repair no drift.\n\nThe keystone chart gains seven custom resource definitions in the\nkeystone.osh.openstack.org/v1alpha1 group -- Domain, Project, Role, User,\nRoleAssignment, Service and Endpoint -- and a single-file Python reconciler,\nkeystone-identity-controller, which holds the only copy of the administrative\ncredentials that provisioning needs. Every operation is find-or-create:\nfind it, patch it if a field drifted, create it if absent. Readiness is a\nmetav1.Condition of type Ready, the same shape the mariadb and rabbitmq\ngroups use, and every kind joins the keystone category.\n\nTwo behaviours of the scripts are deliberately not carried over. An endpoint\nwhose URL changed is patched rather than deleted and recreated, so it keeps\nits ID; and duplicate endpoints are reported in the Ready message rather than\ndeleted, since deleting objects it did not create is not something a\ncontroller should do quietly. The password probe is carried over unchanged in\nsubstance: Keystone invalidates every token a user holds on any password\nwrite, so the password is only written when authenticating with it fails.\n\nEvery chart the compute kit deploys that owns a catalog entry is converted --\nglance, cinder, placement, nova, neutron and heat -- each rendering its\nresources in its own templates/identity-entities.yaml from the values it\nalready declares. There is no Helm-toolkit manifest generating them, because\na chart\u0027s users and catalog entries are part of its contract. The service\nusers, service types and endpoint URLs each chart declares were diffed\nagainst the env its three jobs render, and match. Heat keeps its\nks-user-domain job: the domain-scoped heat_stack_user account is not part of\nthis path.\n\nmanifests.identity_entities defaults to false in every consumer chart and\nmanifests.deployment_identity_controller to false in the keystone chart, so\nevery consumer chart renders byte for byte as before and the keystone chart\ngains only the definitions, which are inert with nothing to reconcile. The\ntwo paths are mutually exclusive and rendering fails if both are enabled.\n\nA check job deploys the compute kit plus Ceph and cinder over the new path.\nWhile this is WIP every other check job is commented out, so a buildset runs\nonly that one; they are restored before this merges.\n\nImplements the spec: declarative Keystone identity management.\n\nChange-Id: I9c04787700accb2e57d44efb244b1d79c167ed11\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/c6d770f24ac09c73e7230ce0da61b8c26a7757f5"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/c6d770f24ac09c73e7230ce0da61b8c26a7757f5"}]},"branch":"refs/heads/master"},"e494076bcb8e1f2ea74a1b4fd8e2cbc91538394f":{"kind":"REWORK","_number":2,"created":"2026-08-31 20:43:20.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/06/1002206/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/06/1002206/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/2"}}},"commit":{"parents":[{"commit":"a62d0e547362ee909d8c23b426d0ecfc5c171587","subject":"Merge \"ovn: add liveness probe checking br-int OpenFlow connectivity\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/a62d0e547362ee909d8c23b426d0ecfc5c171587"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-08-24 19:47:23.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-08-31 20:43:12.000000000","tz":-300},"subject":"[WIP] Declarative Keystone identity management","message":"[WIP] Declarative Keystone identity management\n\nEvery chart that owns a service catalog entry provisions it with three\none-shot jobs -- ks-service, ks-user and ks-endpoints -- each mounting the\nKeystone administrative openrc secret into a pod in the OpenStack namespace\nand driving the openstack CLI with it. Thirty-four charts render a ks-user\njob, and eighty-seven of these jobs exist in total. They reconcile nothing,\nreport no status, and repair no drift.\n\nThe keystone chart gains eight custom resource definitions in the\nkeystone.osh.openstack.org/v1alpha1 group -- Domain, Project, Role, Group,\nUser, RoleAssignment, Service and Endpoint -- and a single-file Python\nreconciler, keystone-identity-controller, which holds the only copy of the\nadministrative credentials that provisioning needs. Every operation is\nfind-or-create: find it, patch it if a field drifted, create it if absent.\nReadiness is a metav1.Condition of type Ready, the same shape the mariadb and\nrabbitmq groups use, and every kind joins the keystone category.\n\nTwo behaviours of the scripts are deliberately not carried over. An endpoint\nwhose URL changed is patched rather than deleted and recreated, so it keeps\nits ID; and duplicate endpoints are reported in the Ready message rather than\ndeleted, since deleting objects it did not create is not something a\ncontroller should do quietly. The password probe is carried over unchanged in\nsubstance: Keystone invalidates every token a user holds on any password\nwrite, so the password is only written when authenticating with it fails.\n\nRoleAssignment names exactly one subject, a user or a group, enforced the way\nits project-or-domain scope already is. Nothing converted here declares a\ngroup -- a service account is a user -- so Group and the group subject exist\nfor federation, which is the case that has no user to name: identities arrive\nfrom the identity provider as shadow users and are mapped into groups, which\ncarry the role assignments. They are settled now rather than with the rest of\nthe federation kinds because adding a subject to a required field later would\nbe a breaking change.\n\nEvery chart the compute kit deploys that owns a catalog entry is converted --\nglance, cinder, placement, nova, neutron and heat -- each rendering its\nresources in its own templates/identity-entities.yaml from the values it\nalready declares. There is no Helm-toolkit manifest generating them, because\na chart\u0027s users and catalog entries are part of its contract. The service\nusers, service types and endpoint URLs each chart declares were diffed\nagainst the env its three jobs render, and match. Heat keeps its\nks-user-domain job: the domain-scoped heat_stack_user account is not part of\nthis path.\n\nmanifests.identity_entities defaults to false in every consumer chart and\nmanifests.deployment_identity_controller to false in the keystone chart, so\nevery consumer chart renders byte for byte as before and the keystone chart\ngains only the definitions, which are inert with nothing to reconcile. The\ntwo paths are mutually exclusive and rendering fails if both are enabled.\n\nA check job deploys the compute kit plus Ceph and cinder over the new path.\nWhile this is WIP every other check job is commented out, so a buildset runs\nonly that one; they are restored before this merges.\n\nImplements the spec: declarative Keystone identity management.\n\nChange-Id: I9c04787700accb2e57d44efb244b1d79c167ed11\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/e494076bcb8e1f2ea74a1b4fd8e2cbc91538394f"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/e494076bcb8e1f2ea74a1b4fd8e2cbc91538394f"}]},"branch":"refs/heads/master"},"808c891b316f3eb2956b29b638f043342a8969c9":{"kind":"REWORK","_number":3,"created":"2026-09-02 23:37:36.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/06/1002206/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/06/1002206/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/3"}}},"commit":{"parents":[{"commit":"0ddd9fe771963b00609d678d9d813f9bbeeacd7d","subject":"Merge \"Reconcile the RabbitMQ resources with the upstream operator\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/0ddd9fe771963b00609d678d9d813f9bbeeacd7d"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-08-24 19:47:23.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-09-02 23:37:09.000000000","tz":-300},"subject":"[WIP] Declarative Keystone identity management","message":"[WIP] Declarative Keystone identity management\n\nEvery chart that owns a service catalog entry provisions it with three\none-shot jobs: ks-service, ks-user and ks-endpoints. Each mounts the\nKeystone administrative openrc secret into a pod in the OpenStack\nnamespace and drives the openstack CLI with it. Thirty-four charts\nrender a ks-user job, and eighty-seven of these jobs exist in total.\nThey reconcile nothing, report no status and repair no drift.\n\nThe keystone chart gains eight custom resource definitions in the\nkeystone.osh.openstack.org/v1alpha1 group: Domain, Project, Role,\nGroup, User, RoleAssignment, Service and Endpoint. It also gains a\nsingle-file Python reconciler, keystone-identity-controller, which\nholds the only copy of the administrative credentials that\nprovisioning needs. Every operation looks an object up, patches it if\na field drifted, and creates it if it is absent. Readiness is a\nmetav1.Condition of type Ready, the same shape the mariadb and\nrabbitmq groups use, and every kind joins the keystone category.\n\nThe reconciler reaches Kubernetes with the official kubernetes client\nand Keystone with openstacksdk. Both are installed on the\nopenstack-client image it runs on, so nothing has to be added to that\nimage. openstacksdk loads its auth plugin from the environment, so an\nalternative keystoneauth plugin configured through identity.openrc is\nhonoured. keystoneauth1 is used directly in one place only, the\npassword probe, which needs the 401 that Connection.authorize\nflattens into a message: writing the password when Keystone is\nunreachable would invalidate every token the user holds.\n\nTwo behaviours of the scripts are deliberately not carried over. An\nendpoint whose URL changed is patched instead of being deleted and\nrecreated, so it keeps its ID. Duplicate endpoints are reported in\nthe Ready message instead of being deleted, because a controller\nshould not silently delete objects it did not create. The password\nprobe is kept unchanged in substance: Keystone invalidates every\ntoken a user holds on any password write, so the password is written\nonly when authenticating with it fails.\n\nRoleAssignment names exactly one subject, a user or a group, enforced\nthe way its project-or-domain scope already is. Nothing converted\nhere declares a group, because a service account is a user. Group and\nthe group subject exist for federation, which is the case with no\nuser to name: identities arrive from the identity provider as shadow\nusers and are mapped into groups, which carry the role assignments.\nThey are settled now rather than with the rest of the federation\nkinds, because adding a subject to a required field later would be a\nbreaking change.\n\nEvery chart the compute kit deploys that owns a catalog entry is\nconverted: glance, cinder, placement, nova, neutron and heat. Each\nrenders its resources in its own templates/identity-entities.yaml\nfrom the values it already declares. There is no Helm-toolkit\nmanifest generating them, because a chart\u0027s users and catalog entries\nare part of its contract. The service users, service types and\nendpoint URLs each chart declares were diffed against the env its\nthree jobs render, and they match. Heat keeps its ks-user-domain job,\nbecause the domain-scoped heat_stack_user account is not part of this\npath.\n\nmanifests.identity_entities defaults to false in every consumer chart\nand manifests.deployment_identity_controller to false in the keystone\nchart. Every consumer chart therefore renders byte for byte as\nbefore, and the keystone chart gains only the definitions, which do\nnothing while no resources exist. The two paths are mutually\nexclusive, and rendering fails if both are enabled.\n\nA check job deploys the compute kit plus Ceph and cinder over the new\npath. While this is WIP every other check job is commented out, so a\nbuildset runs only that one. They are restored before this merges.\n\nImplements the spec: declarative Keystone identity management.\n\nChange-Id: I9c04787700accb2e57d44efb244b1d79c167ed11\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/808c891b316f3eb2956b29b638f043342a8969c9"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/808c891b316f3eb2956b29b638f043342a8969c9"}]},"branch":"refs/heads/master"},"6b6ea6fcfb3ea7ec55198144bf7d10bdcd9a348c":{"kind":"NO_CODE_CHANGE","_number":4,"created":"2026-09-03 00:56:17.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/06/1002206/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/06/1002206/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/4"}}},"commit":{"parents":[{"commit":"0ddd9fe771963b00609d678d9d813f9bbeeacd7d","subject":"Merge \"Reconcile the RabbitMQ resources with the upstream operator\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/0ddd9fe771963b00609d678d9d813f9bbeeacd7d"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-08-24 19:47:23.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-09-03 00:56:14.000000000","tz":-300},"subject":"[WIP] Declarative Keystone identity management","message":"[WIP] Declarative Keystone identity management\n\nEvery chart that owns a service catalog entry provisions it with three\none-shot jobs: ks-service, ks-user and ks-endpoints. Each mounts the\nKeystone administrative openrc secret into a pod in the OpenStack\nnamespace and drives the openstack CLI with it. Thirty-four charts\nrender a ks-user job, and eighty-seven of these jobs exist in total.\nThey reconcile nothing, report no status and repair no drift.\n\nThe keystone chart gains eight custom resource definitions in the\nkeystone.osh.openstack.org/v1alpha1 group: Domain, Project, Role,\nGroup, User, RoleAssignment, Service and Endpoint. It also gains a\nsingle-file Python reconciler, keystone-identity-controller, which\nholds the only copy of the administrative credentials that\nprovisioning needs. Every operation looks an object up, patches it if\na field drifted, and creates it if it is absent. Readiness is a\nmetav1.Condition of type Ready, the same shape the mariadb and\nrabbitmq groups use, and every kind joins the keystone category.\n\nThe reconciler reaches Kubernetes with the official kubernetes client\nand Keystone with openstacksdk. Both are installed on the\nopenstack-client image it runs on, so nothing has to be added to that\nimage. openstacksdk loads its auth plugin from the environment, so an\nalternative keystoneauth plugin configured through identity.openrc is\nhonoured. keystoneauth1 is used directly in one place only, the\npassword probe, which needs the 401 that Connection.authorize\nflattens into a message: writing the password when Keystone is\nunreachable would invalidate every token the user holds.\n\nTwo behaviours of the scripts are deliberately not carried over. An\nendpoint whose URL changed is patched instead of being deleted and\nrecreated, so it keeps its ID. Duplicate endpoints are reported in\nthe Ready message instead of being deleted, because a controller\nshould not silently delete objects it did not create. The password\nprobe is kept unchanged in substance: Keystone invalidates every\ntoken a user holds on any password write, so the password is written\nonly when authenticating with it fails.\n\nA role is granted to a subject: either a user or a group.\nRoleAssignment therefore sets spec.user or spec.group, never both,\nenforced the way its project-or-domain scope already is. Nothing\nconverted here sets spec.group, because a service account is a user.\nGroup and the group subject exist for federation, which is the case\nwith no user to name: identities arrive from the identity provider as\nshadow users and are mapped into groups, which carry the role\nassignments. They are defined here rather than with the rest of the\nfederation kinds because they are the only part of federation that\nchanges a kind this change already defines. Adding them later would\nbe backward compatible, but would mean editing RoleAssignment\u0027s\nrequired fields and validation rules a second time.\n\nEvery chart the compute kit deploys that owns a catalog entry is\nconverted: glance, cinder, placement, nova, neutron and heat. Each\nrenders its resources in its own templates/identity-entities.yaml\nfrom the values it already declares. There is no Helm-toolkit\nmanifest generating them, because a chart\u0027s users and catalog entries\nare part of its contract. The service users, service types and\nendpoint URLs each chart declares were diffed against the env its\nthree jobs render, and they match. Heat keeps its ks-user-domain job,\nbecause the domain-scoped heat_stack_user account is not part of this\npath.\n\nmanifests.identity_entities defaults to false in every consumer chart\nand manifests.deployment_identity_controller to false in the keystone\nchart. Every consumer chart therefore renders byte for byte as\nbefore, and the keystone chart gains only the definitions, which do\nnothing while no resources exist. The two paths are mutually\nexclusive, and rendering fails if both are enabled.\n\nA check job deploys the compute kit plus Ceph and cinder over the new\npath. While this is WIP every other check job is commented out, so a\nbuildset runs only that one. They are restored before this merges.\n\nImplements the spec: declarative Keystone identity management.\n\nChange-Id: I9c04787700accb2e57d44efb244b1d79c167ed11\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/6b6ea6fcfb3ea7ec55198144bf7d10bdcd9a348c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/6b6ea6fcfb3ea7ec55198144bf7d10bdcd9a348c"}]},"branch":"refs/heads/master"},"bc065c60c7f3151a3cab20e73224eb344e7f19d8":{"kind":"REWORK","_number":5,"created":"2026-09-03 02:00:41.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/06/1002206/5","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/06/1002206/5","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/5 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/5 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/5 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/5"}}},"commit":{"parents":[{"commit":"0ddd9fe771963b00609d678d9d813f9bbeeacd7d","subject":"Merge \"Reconcile the RabbitMQ resources with the upstream operator\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/0ddd9fe771963b00609d678d9d813f9bbeeacd7d"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-08-24 19:47:23.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-09-03 02:00:39.000000000","tz":-300},"subject":"[WIP] Declarative Keystone identity management","message":"[WIP] Declarative Keystone identity management\n\nEvery chart that owns a service catalog entry provisions it with three\none-shot jobs: ks-service, ks-user and ks-endpoints. Each mounts the\nKeystone administrative openrc secret into a pod in the OpenStack\nnamespace and drives the openstack CLI with it. Thirty-four charts\nrender a ks-user job, and eighty-eight of these jobs exist in total.\nThey reconcile nothing, report no status and repair no drift.\n\nThe keystone chart gains eight custom resource definitions in the\nkeystone.osh.openstack.org/v1alpha1 group: Domain, Project, Role,\nGroup, User, RoleAssignment, Service and Endpoint. It also gains a\nsingle-file Python reconciler, keystone-identity-controller, which\nholds the only copy of the administrative credentials that\nprovisioning needs. Every operation looks an object up, patches it if\na field drifted, and creates it if it is absent. Readiness is a\nmetav1.Condition of type Ready, the same shape the mariadb and\nrabbitmq groups use, and every kind joins the keystone category.\n\nThe reconciler reaches Kubernetes with the official kubernetes client\nand Keystone with openstacksdk. Both are installed on the\nopenstack-client image it runs on, so nothing has to be added to that\nimage. openstacksdk loads its auth plugin from the environment, so an\nalternative keystoneauth plugin configured through identity.openrc is\nhonoured. keystoneauth1 is used directly in one place only, the\npassword probe, which needs the 401 that Connection.authorize\nflattens into a message: writing the password when Keystone is\nunreachable would invalidate every token the user holds.\n\nTwo behaviours of the scripts are deliberately not carried over. An\nendpoint whose URL changed is patched instead of being deleted and\nrecreated, so it keeps its ID. Duplicate endpoints are reported in\nthe Ready message instead of being deleted, because a controller\nshould not silently delete objects it did not create. The password\nprobe is kept unchanged in substance: Keystone invalidates every\ntoken a user holds on any password write, so the password is written\nonly when authenticating with it fails.\n\nA role is granted to a subject: either a user or a group.\nRoleAssignment therefore sets spec.user or spec.group, never both,\nenforced the way its project-or-domain scope already is. Nothing\nconverted here sets spec.group, because a service account is a user.\nGroup and the group subject exist for federation, which is the case\nwith no user to name: identities arrive from the identity provider as\nshadow users and are mapped into groups, which carry the role\nassignments. They are defined here rather than with the rest of the\nfederation kinds because they are the only part of federation that\nchanges a kind this change already defines. Adding them later would\nbe backward compatible, but would mean editing RoleAssignment\u0027s\nrequired fields and validation rules a second time.\n\nEvery chart the compute kit deploys that owns a catalog entry is\nconverted: glance, cinder, placement, nova, neutron and heat. Each\nrenders its resources in its own templates/identity-entities.yaml\nfrom the values it already declares. There is no Helm-toolkit\nmanifest generating them, because a chart\u0027s users and catalog entries\nare part of its contract. The service users, service types and\nendpoint URLs each chart declares were diffed against the env its\nthree jobs render, and they match. Heat keeps its ks-user-domain job,\nbecause the domain-scoped heat_stack_user account is not part of this\npath.\n\nmanifests.identity_entities defaults to false in every consumer chart\nand manifests.deployment_identity_controller to false in the keystone\nchart. Every consumer chart therefore renders byte for byte as\nbefore, and the keystone chart gains only the definitions, which do\nnothing while no resources exist. The two paths are mutually\nexclusive, and rendering fails if both are enabled.\n\nThe keystone chart gains secrets.tls.ca, the key the identity\ncontroller reads to verify the Keystone API it reconciles against.\nThe consumer charts already declare it; keystone did not, so the\ncontroller\u0027s TLS branch could never fire.\n\nA check job deploys the compute kit plus Ceph and cinder over the new\npath. While this is WIP every other check job is commented out, so a\nbuildset runs only that one. They are restored before this merges.\n\nImplements the spec: declarative Keystone identity management.\n\nChange-Id: I9c04787700accb2e57d44efb244b1d79c167ed11\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/bc065c60c7f3151a3cab20e73224eb344e7f19d8"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/bc065c60c7f3151a3cab20e73224eb344e7f19d8"}]},"branch":"refs/heads/master"},"94a0c43e0fac8ae1cae4b7fe29b1a5299b7bf223":{"kind":"REWORK","_number":6,"created":"2026-09-03 05:22:09.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/06/1002206/6","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/06/1002206/6","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/6 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/6 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/6 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/6"}}},"commit":{"parents":[{"commit":"0ddd9fe771963b00609d678d9d813f9bbeeacd7d","subject":"Merge \"Reconcile the RabbitMQ resources with the upstream operator\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/0ddd9fe771963b00609d678d9d813f9bbeeacd7d"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-08-24 19:47:23.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-09-03 05:22:06.000000000","tz":-300},"subject":"[WIP] Declarative Keystone identity management","message":"[WIP] Declarative Keystone identity management\n\nEvery chart that owns a service catalog entry provisions it with three\none-shot jobs: ks-service, ks-user and ks-endpoints. Each mounts the\nKeystone administrative openrc secret into a pod in the OpenStack\nnamespace and drives the openstack CLI with it. Thirty-four charts\nrender a ks-user job, and eighty-eight of these jobs exist in total.\nThey reconcile nothing, report no status and repair no drift.\n\nThe keystone chart gains eight custom resource definitions in the\nkeystone.osh.openstack.org/v1alpha1 group: Domain, Project, Role,\nGroup, User, RoleAssignment, Service and Endpoint. It also gains a\nsingle-file Python reconciler, keystone-identity-controller, which\nholds the only copy of the administrative credentials that\nprovisioning needs. Every operation looks an object up, patches it if\na field drifted, and creates it if it is absent. Readiness is a\nmetav1.Condition of type Ready, the same shape the mariadb and\nrabbitmq groups use, and every kind joins the keystone category.\n\nThe reconciler reaches Kubernetes with the official kubernetes client\nand Keystone with openstacksdk. Both are installed on the\nopenstack-client image it runs on, so nothing has to be added to that\nimage. openstacksdk loads its auth plugin from the environment, so an\nalternative keystoneauth plugin configured through identity.openrc is\nhonoured. keystoneauth1 is used directly in one place only, the\npassword probe, which needs the 401 that Connection.authorize\nflattens into a message: writing the password when Keystone is\nunreachable would invalidate every token the user holds.\n\nTwo behaviours of the scripts are deliberately not carried over. An\nendpoint whose URL changed is patched instead of being deleted and\nrecreated, so it keeps its ID. Duplicate endpoints are reported in\nthe Ready message instead of being deleted, because a controller\nshould not silently delete objects it did not create. The password\nprobe is kept unchanged in substance: Keystone invalidates every\ntoken a user holds on any password write, so the password is written\nonly when authenticating with it fails.\n\nA role is granted to a subject: either a user or a group.\nRoleAssignment therefore sets spec.user or spec.group, never both,\nenforced the way its project-or-domain scope already is. Nothing\nconverted here sets spec.group, because a service account is a user.\nGroup and the group subject exist for federation, which is the case\nwith no user to name: identities arrive from the identity provider as\nshadow users and are mapped into groups, which carry the role\nassignments. They are defined here rather than with the rest of the\nfederation kinds because they are the only part of federation that\nchanges a kind this change already defines. Adding them later would\nbe backward compatible, but would mean editing RoleAssignment\u0027s\nrequired fields and validation rules a second time.\n\nEvery chart the compute kit deploys that owns a catalog entry is\nconverted: glance, cinder, placement, nova, neutron and heat. Each\nrenders its resources in its own templates/identity-entities.yaml\nfrom the values it already declares. There is no Helm-toolkit\nmanifest generating them, because a chart\u0027s users and catalog entries\nare part of its contract. The service users, service types and\nendpoint URLs each chart declares were diffed against the env its\nthree jobs render, and they match. Heat keeps its ks-user-domain job,\nbecause the domain-scoped heat_stack_user account is not part of this\npath.\n\nmanifests.identity_entities defaults to false in every consumer chart\nand manifests.deployment_identity_controller to false in the keystone\nchart. Every consumer chart therefore renders byte for byte as\nbefore, and the keystone chart gains only the definitions, which do\nnothing while no resources exist. The two paths are mutually\nexclusive, and rendering fails if both are enabled.\n\nThe ks_user and ks_endpoints jobs were also kubernetes-entrypoint\ndependencies of every component that reaches the Keystone catalog,\nand dependency_jobs_filter drops a disabled job from those lists.\nEach override therefore adds a custom_resources dependency for the\nsame components, on the readiness of the User and Endpoint the chart\ndeclares, so they wait for the work itself instead of for a job that\ndid the work. kubernetes-entrypoint selects a condition by type, as\nthe merged nova mariadb-crd override already relies on, and the RBAC\nan init container needs is emitted automatically from the entry\u0027s\napiVersion and kind.\n\nThe keystone chart gains secrets.tls.ca, the key the identity\ncontroller reads to verify the Keystone API it reconciles against.\nThe consumer charts already declare it; keystone did not, so the\ncontroller\u0027s TLS branch could never fire.\n\nA check job deploys the compute kit plus Ceph and cinder over the new\npath. While this is WIP every other check job is commented out, so a\nbuildset runs only that one. They are restored before this merges.\n\nImplements the spec: declarative Keystone identity management.\n\nChange-Id: I9c04787700accb2e57d44efb244b1d79c167ed11\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/94a0c43e0fac8ae1cae4b7fe29b1a5299b7bf223"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/94a0c43e0fac8ae1cae4b7fe29b1a5299b7bf223"}]},"branch":"refs/heads/master"},"44cd5869d89e5a09dd03e1ecb9547facdd84ac75":{"kind":"REWORK","_number":7,"created":"2026-09-30 20:39:50.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/06/1002206/7","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/06/1002206/7","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/7 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/7 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/7 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/7"}}},"commit":{"parents":[{"commit":"d0117155722f99b903a6681909fc957b81eec15f","subject":"Merge \"fix(neutron): render the missing pod annotations\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d0117155722f99b903a6681909fc957b81eec15f"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-08-24 19:47:23.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-09-30 18:26:21.000000000","tz":-300},"subject":"[WIP] Declarative Keystone identity management","message":"[WIP] Declarative Keystone identity management\n\nEvery chart that owns a service catalog entry provisions it with three\none-shot jobs: ks-service, ks-user and ks-endpoints. Each mounts the\nKeystone administrative openrc secret into a pod in the OpenStack\nnamespace and drives the openstack CLI with it. Thirty-four charts\nrender a ks-user job, and eighty-eight of these jobs exist in total.\nThey reconcile nothing, report no status and repair no drift.\n\nThe keystone chart gains eight custom resource definitions in the\nkeystone.osh.openstack.org/v1alpha1 group: Domain, Project, Role,\nGroup, User, RoleAssignment, Service and Endpoint. It also gains a\nsingle-file Python reconciler, keystone-identity-controller, which\nholds the only copy of the administrative credentials that\nprovisioning needs. Every operation looks an object up, patches it if\na field drifted, and creates it if it is absent. Readiness is a\nmetav1.Condition of type Ready, the same shape the mariadb and\nrabbitmq groups use, and every kind joins the keystone category.\n\nThe reconciler reaches Kubernetes with the official kubernetes client\nand Keystone with openstacksdk. Both are installed on the\nopenstack-client image it runs on, so nothing has to be added to that\nimage. openstacksdk loads its auth plugin from the environment, so an\nalternative keystoneauth plugin configured through identity.openrc is\nhonoured. keystoneauth1 is used directly in one place only, the\npassword probe, which needs the 401 that Connection.authorize\nflattens into a message: writing the password when Keystone is\nunreachable would invalidate every token the user holds.\n\nTwo behaviours of the scripts are deliberately not carried over. An\nendpoint whose URL changed is patched instead of being deleted and\nrecreated, so it keeps its ID. Duplicate endpoints are reported in\nthe Ready message instead of being deleted, because a controller\nshould not silently delete objects it did not create. The password\nprobe is kept unchanged in substance: Keystone invalidates every\ntoken a user holds on any password write, so the password is written\nonly when authenticating with it fails.\n\nA role is granted to a subject: either a user or a group.\nRoleAssignment therefore sets spec.user or spec.group, never both,\nenforced the way its project-or-domain scope already is. Nothing\nconverted here sets spec.group, because a service account is a user.\nGroup and the group subject exist for federation, which is the case\nwith no user to name: identities arrive from the identity provider as\nshadow users and are mapped into groups, which carry the role\nassignments. They are defined here rather than with the rest of the\nfederation kinds because they are the only part of federation that\nchanges a kind this change already defines. Adding them later would\nbe backward compatible, but would mean editing RoleAssignment\u0027s\nrequired fields and validation rules a second time.\n\nEvery chart the compute kit deploys that owns a catalog entry is\nconverted: glance, cinder, placement, nova, neutron and heat. Each\nrenders its resources in its own templates/identity-entities.yaml\nfrom the values it already declares. There is no Helm-toolkit\nmanifest generating them, because a chart\u0027s users and catalog entries\nare part of its contract. The service users, service types and\nendpoint URLs each chart declares were diffed against the env its\nthree jobs render, and they match. Heat keeps its ks-user-domain job,\nbecause the domain-scoped heat_stack_user account is not part of this\npath.\n\nmanifests.identity_entities defaults to false in every consumer chart\nand manifests.deployment_identity_controller to false in the keystone\nchart. Every consumer chart therefore renders byte for byte as\nbefore, and the keystone chart gains only the definitions, which do\nnothing while no resources exist. The two paths are mutually\nexclusive, and rendering fails if both are enabled.\n\nThe ks_user and ks_endpoints jobs were also kubernetes-entrypoint\ndependencies of every component that reaches the Keystone catalog,\nand dependency_jobs_filter drops a disabled job from those lists.\nEach override therefore adds a custom_resources dependency for the\nsame components, on the readiness of the User and Endpoint the chart\ndeclares, so they wait for the work itself instead of for a job that\ndid the work. kubernetes-entrypoint selects a condition by type, as\nthe merged nova mariadb-crd override already relies on, and the RBAC\nan init container needs is emitted automatically from the entry\u0027s\napiVersion and kind.\n\nThe keystone chart gains secrets.tls.ca, the key the identity\ncontroller reads to verify the Keystone API it reconciles against.\nThe consumer charts already declare it; keystone did not, so the\ncontroller\u0027s TLS branch could never fire.\n\nThe openstack-helm-crd check job, which already exercises the mariadb\nand rabbitmq chart controllers, gains the identity-entities override.\nOne job rather than one per resource kind is deliberate: a real\ndeployment turns every declarative path on at once, and only a job\nthat does the same can catch them interfering.\n\nImplements the spec: declarative Keystone identity management.\n\nChange-Id: I9c04787700accb2e57d44efb244b1d79c167ed11\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/44cd5869d89e5a09dd03e1ecb9547facdd84ac75"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/44cd5869d89e5a09dd03e1ecb9547facdd84ac75"}]},"branch":"refs/heads/master"},"4e019f994a04bcba4efdcc08f5f9b83c7bd25cc6":{"kind":"REWORK","_number":8,"created":"2026-09-30 20:45:36.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/06/1002206/8","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/06/1002206/8","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/8 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/8 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/8 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/8"}}},"commit":{"parents":[{"commit":"d0117155722f99b903a6681909fc957b81eec15f","subject":"Merge \"fix(neutron): render the missing pod annotations\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d0117155722f99b903a6681909fc957b81eec15f"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-08-24 19:47:23.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-09-30 20:45:31.000000000","tz":-300},"subject":"[WIP] Declarative Keystone identity management","message":"[WIP] Declarative Keystone identity management\n\nEvery chart that owns a service catalog entry provisions it with three\none-shot jobs: ks-service, ks-user and ks-endpoints. Each mounts the\nKeystone administrative openrc secret into a pod in the OpenStack\nnamespace and drives the openstack CLI with it. Thirty-four charts\nrender a ks-user job, and eighty-eight of these jobs exist in total.\nThey reconcile nothing, report no status and repair no drift.\n\nThe keystone chart gains eight custom resource definitions in the\nkeystone.osh.openstack.org/v1alpha1 group: Domain, Project, Role,\nGroup, User, RoleAssignment, Service and Endpoint. It also gains a\nsingle-file Python reconciler, keystone-identity-controller, which\nholds the only copy of the administrative credentials that\nprovisioning needs. Every operation looks an object up, patches it if\na field drifted, and creates it if it is absent. Readiness is a\nmetav1.Condition of type Ready, the same shape the mariadb and\nrabbitmq groups use, and every kind joins the keystone category.\n\nThe reconciler reaches Kubernetes with the official kubernetes client\nand Keystone with openstacksdk. Both are installed on the\nopenstack-client image it runs on, so nothing has to be added to that\nimage. openstacksdk loads its auth plugin from the environment, so an\nalternative keystoneauth plugin configured through identity.openrc is\nhonoured. keystoneauth1 is used directly in one place only, the\npassword probe, which needs the 401 that Connection.authorize\nflattens into a message: writing the password when Keystone is\nunreachable would invalidate every token the user holds.\n\nTwo behaviours of the scripts are deliberately not carried over. An\nendpoint whose URL changed is patched instead of being deleted and\nrecreated, so it keeps its ID. Duplicate endpoints are reported in\nthe Ready message instead of being deleted, because a controller\nshould not silently delete objects it did not create. The password\nprobe is kept unchanged in substance: Keystone invalidates every\ntoken a user holds on any password write, so the password is written\nonly when authenticating with it fails.\n\nA role is granted to a subject: either a user or a group.\nRoleAssignment therefore sets spec.user or spec.group, never both,\nenforced the way its project-or-domain scope already is. Nothing\nconverted here sets spec.group, because a service account is a user.\nGroup and the group subject exist for federation, which is the case\nwith no user to name: identities arrive from the identity provider as\nshadow users and are mapped into groups, which carry the role\nassignments. They are defined here rather than with the rest of the\nfederation kinds because they are the only part of federation that\nchanges a kind this change already defines. Adding them later would\nbe backward compatible, but would mean editing RoleAssignment\u0027s\nrequired fields and validation rules a second time.\n\nEvery chart the compute kit deploys that owns a catalog entry is\nconverted: glance, cinder, placement, nova, neutron and heat. Each\nrenders its resources in its own templates/identity-entities.yaml\nfrom the values it already declares. There is no Helm-toolkit\nmanifest generating them, because a chart\u0027s users and catalog entries\nare part of its contract. The service users, service types and\nendpoint URLs each chart declares were diffed against the env its\nthree jobs render, and they match. Heat keeps its ks-user-domain job,\nbecause the domain-scoped heat_stack_user account is not part of this\npath.\n\nmanifests.identity_entities defaults to false in every consumer chart\nand manifests.deployment_identity_controller to false in the keystone\nchart. Every consumer chart therefore renders byte for byte as\nbefore, and the keystone chart gains only the definitions, which do\nnothing while no resources exist. The two paths are mutually\nexclusive, and rendering fails if both are enabled.\n\nThe ks_user and ks_endpoints jobs were also kubernetes-entrypoint\ndependencies of every component that reaches the Keystone catalog,\nand dependency_jobs_filter drops a disabled job from those lists.\nEach override therefore adds a custom_resources dependency for the\nsame components, on the readiness of the User and Endpoint the chart\ndeclares, so they wait for the work itself instead of for a job that\ndid the work. kubernetes-entrypoint selects a condition by type, as\nthe merged nova mariadb-crd override already relies on, and the RBAC\nan init container needs is emitted automatically from the entry\u0027s\napiVersion and kind.\n\nThe keystone chart gains secrets.tls.ca, the key the identity\ncontroller reads to verify the Keystone API it reconciles against.\nThe consumer charts already declare it; keystone did not, so the\ncontroller\u0027s TLS branch could never fire.\n\nThe openstack-helm-crd check job, which already exercises the mariadb\nand rabbitmq chart controllers, gains the identity-entities override.\nOne job rather than one per resource kind is deliberate: a real\ndeployment turns every declarative path on at once, and only a job\nthat does the same can catch them interfering.\n\nThe controller no longer passes _content_type when it patches a\nresource. kubernetes 35, which upper-constraints pins for this image,\nrejects that keyword on patch_namespaced_custom_object_status, so\nevery status write raised ApiTypeError: the Keystone objects were\ncreated but no resource ever reported Ready, and the components\nwaiting on them never started. Patching uses a client of its own\nwhose default Content-Type is the merge patch instead, which the\nclient applies over the content type it picked, on both the pinned\nrelease and the next one.\n\nImplements the spec: declarative Keystone identity management.\n\nChange-Id: I9c04787700accb2e57d44efb244b1d79c167ed11\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/4e019f994a04bcba4efdcc08f5f9b83c7bd25cc6"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/4e019f994a04bcba4efdcc08f5f9b83c7bd25cc6"}]},"branch":"refs/heads/master"},"07f1480cc6cffb354a704f87872eb47fa8226904":{"kind":"NO_CODE_CHANGE","_number":9,"created":"2026-09-30 20:54:32.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/06/1002206/9","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/06/1002206/9","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/9 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/9 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/9 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/9"}}},"commit":{"parents":[{"commit":"d0117155722f99b903a6681909fc957b81eec15f","subject":"Merge \"fix(neutron): render the missing pod annotations\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d0117155722f99b903a6681909fc957b81eec15f"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-08-24 19:47:23.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-09-30 20:54:29.000000000","tz":-300},"subject":"[WIP] Declarative Keystone identity management","message":"[WIP] Declarative Keystone identity management\n\nEvery chart owning a catalog entry provisions it with three one-shot\njobs -- ks-service, ks-user, ks-endpoints -- each mounting the Keystone\nadministrative openrc secret into a pod. Eighty-eight exist and repair\nno drift.\n\nThe keystone chart gains eight custom resource definitions in the\nkeystone.osh.openstack.org/v1alpha1 group -- Domain, Project, Role,\nGroup, User, RoleAssignment, Service, Endpoint -- and a single-file\nPython reconciler holding the only copy of those credentials. It looks\neach object up, patches drift, creates what is absent and reports a\nReady condition.\n\nSix charts are converted: glance, cinder, placement, nova, neutron and\nheat, each rendering resources from values it declares; these\nmatch the env its three jobs render. Heat keeps its ks-user-domain\njob, which this path does not replace.\n\nmanifests.identity_entities defaults to false in every consumer chart\nand manifests.deployment_identity_controller to false in keystone, so\nnothing changes by default. The paths are mutually exclusive. The\ndisabled ks_user and ks_endpoints jobs were kubernetes-entrypoint\ndependencies, so each override adds a custom_resources dependency on\nthe User and Endpoint the chart declares.\n\nThe openstack-helm-crd job, which already covers the mariadb and\nrabbitmq controllers, gains the identity-entities override.\n\nChange-Id: I9c04787700accb2e57d44efb244b1d79c167ed11\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/07f1480cc6cffb354a704f87872eb47fa8226904"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/07f1480cc6cffb354a704f87872eb47fa8226904"}]},"branch":"refs/heads/master"},"17afc67d3dc7860040aedcd7f4eaa73fbe375a94":{"kind":"NO_CODE_CHANGE","_number":10,"created":"2026-09-30 20:54:54.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/06/1002206/10","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/06/1002206/10","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/10 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/10 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/10 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/10"}}},"commit":{"parents":[{"commit":"d0117155722f99b903a6681909fc957b81eec15f","subject":"Merge \"fix(neutron): render the missing pod annotations\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d0117155722f99b903a6681909fc957b81eec15f"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-08-24 19:47:23.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-09-30 20:54:52.000000000","tz":-300},"subject":"[WIP] Declarative Keystone identity management","message":"[WIP] Declarative Keystone identity management\n\nEvery chart owning a catalog entry provisions it with three one-shot\njobs -- ks-service, ks-user, ks-endpoints -- each mounting the Keystone\nadministrative openrc secret into a pod. Eighty-eight exist and repair\nno drift.\n\nThe keystone chart gains eight custom resource definitions in the\nkeystone.osh.openstack.org/v1alpha1 group -- Domain, Project, Role,\nGroup, User, RoleAssignment, Service, Endpoint -- and a single-file\nPython reconciler holding the only copy of those credentials. It looks\neach object up, patches drift, creates what is absent and reports a\nReady condition.\n\nSix charts are converted: glance, cinder, placement, nova, neutron and\nheat, each rendering resources from values it declares; these match\nthe env its three jobs render. Heat keeps its ks-user-domain job,\nwhich this path does not replace.\n\nmanifests.identity_entities defaults to false in every consumer chart\nand manifests.deployment_identity_controller to false in keystone, so\nnothing changes by default. The paths are mutually exclusive. The\ndisabled ks_user and ks_endpoints jobs were kubernetes-entrypoint\ndependencies, so each override adds a custom_resources dependency on\nthe User and Endpoint the chart declares.\n\nThe openstack-helm-crd job, which already covers the mariadb and\nrabbitmq controllers, gains the identity-entities override.\n\nChange-Id: I9c04787700accb2e57d44efb244b1d79c167ed11\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/17afc67d3dc7860040aedcd7f4eaa73fbe375a94"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/17afc67d3dc7860040aedcd7f4eaa73fbe375a94"}]},"branch":"refs/heads/master"},"175b61e055f1f102161805e6302d8f9f8106d44a":{"kind":"TRIVIAL_REBASE_WITH_MESSAGE_UPDATE","_number":11,"created":"2026-10-07 14:47:30.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/06/1002206/11","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/06/1002206/11","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/11 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/11 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/11 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/06/1002206/11"}}},"commit":{"parents":[{"commit":"6b033dc746a01fa9ec31f6de01fdf17cb11b4d73","subject":"Merge \"fix(nova): add the StatefulSet governing services and upgrade policy\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/6b033dc746a01fa9ec31f6de01fdf17cb11b4d73"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-08-24 19:47:23.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-10-07 14:13:32.000000000","tz":-300},"subject":"Declarative Keystone identity management","message":"Declarative Keystone identity management\n\nEvery chart owning a catalog entry provisions it with three one-shot\njobs -- ks-service, ks-user, ks-endpoints -- each mounting the Keystone\nadministrative openrc secret into a pod. Eighty-eight exist and repair\nno drift.\n\nThe keystone chart gains eight custom resource definitions in the\nkeystone.osh.openstack.org/v1alpha1 group -- Domain, Project, Role,\nGroup, User, RoleAssignment, Service, Endpoint -- and a single-file\nPython reconciler holding the only copy of those credentials. It looks\neach object up, patches drift, creates what is absent and reports a\nReady condition.\n\nSix charts are converted: glance, cinder, placement, nova, neutron and\nheat, each rendering resources from values it declares; these match\nthe env its three jobs render. Heat keeps its ks-user-domain job,\nwhich this path does not replace.\n\nmanifests.identity_entities defaults to false in every consumer chart\nand manifests.deployment_identity_controller to false in keystone, so\nnothing changes by default. The paths are mutually exclusive. The\ndisabled ks_user and ks_endpoints jobs were kubernetes-entrypoint\ndependencies, so each override adds a custom_resources dependency on\nthe User and Endpoint the chart declares.\n\nThe openstack-helm-crd job, which already covers the mariadb and\nrabbitmq controllers, gains the identity-entities override.\n\nChange-Id: I9c04787700accb2e57d44efb244b1d79c167ed11\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/175b61e055f1f102161805e6302d8f9f8106d44a"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/175b61e055f1f102161805e6302d8f9f8106d44a"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":29974,"name":"Stephen Taylor","email":"staylor@mirantis.com","username":"st053q"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}