)]}'
{"id":"openstack%2Fopenstack-helm~1009862","triplet_id":"openstack%2Fopenstack-helm~master~Ia23de0fdc76f02367b8ceee3bd92d1cce050a9d6","project":"openstack/openstack-helm","branch":"master","attention_set":{},"removed_from_attention_set":{"35943":{"account":{"_account_id":35943,"name":"Aleksei Chekunov","display_name":"Aleksei Chekunov","email":"chekunov87@gmail.com","username":"az7961"},"last_update":"2026-10-14 17:23:29.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Ia23de0fdc76f02367b8ceee3bd92d1cce050a9d6","subject":"fix(grafana): mount client certs in set-admin-user and stop hiding failures","status":"MERGED","created":"2026-10-09 20:56:40.000000000","updated":"2026-10-14 17:24:31.000000000","submitted":"2026-10-14 17:23:29.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1009862","meta_rev_id":"f9e5678b306799065e1e486a8e0e2c15e4c3688f","_number":1009862,"virtual_id_number":1009862,"owner":{"_account_id":35943,"name":"Aleksei Chekunov","display_name":"Aleksei Chekunov","email":"chekunov87@gmail.com","username":"az7961"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},{"value":0,"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-10-14 17:23:29.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"all":[{"value":2,"date":"2026-10-14 15:14:39.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},{"value":2,"date":"2026-10-14 15:32:19.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"all":[{"value":0,"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},{"value":1,"date":"2026-10-14 15:32:19.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-10-09 21:16:17.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-10-14 15:14:39.000000000","updated_by":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"reviewer":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"state":"REVIEWER"},{"updated":"2026-10-14 15:32:19.000000000","updated_by":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"reviewer":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"state":"REVIEWER"}],"messages":[{"id":"86f0603bb8411cdd77cdd8f5b03b2755ae052220","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35943,"name":"Aleksei Chekunov","display_name":"Aleksei Chekunov","email":"chekunov87@gmail.com","username":"az7961"},"date":"2026-10-09 20:56:40.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"0a4f9e0d2bf3dab44437ab348d75900a50fd557d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-09 21:16:17.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/b8962e9bedf7416ebe179858866df578\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d658c25a22f14ac08bf1ad818f8417ed : SUCCESS in 2m 50s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/4b88ad886491480291f57004cd560269 : SUCCESS in 3m 19s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/89bdafc7b3ba4544b0ed3c5504a0cd69 : SUCCESS in 3m 01s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/913c0a0065f5444e881315dbfb03eb61 : SUCCESS in 2m 37s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/3925bf78a0984d1b866692d99741edd1 : SUCCESS in 3m 05s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/85c498f1b94c4933bdd21da918769e4c : SUCCESS in 18m 18s","accounts_in_message":[],"_revision_number":1},{"id":"82bdd1c93efa4a1324f360da600684c9727de9a9","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35943,"name":"Aleksei Chekunov","display_name":"Aleksei Chekunov","email":"chekunov87@gmail.com","username":"az7961"},"date":"2026-10-13 14:27:27.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"d32fcc6e0d3b914d7b9bb42ed47f9713408029a5","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-13 14:51:05.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/489c81de2ce54cd9a8f7bb0f2328f3af\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/610c374ea796447d908f5e2aea3d652b : SUCCESS in 2m 42s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/31c8514054f64c1198245461b4005a33 : SUCCESS in 2m 17s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/e08bd5124a6c49fb8bd37911d29e715c : SUCCESS in 2m 05s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/a6d9d88eba824db4b36f988dc1afa34e : FAILURE in 1m 41s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/d68abc38e9aa446db577c1a362c914ee : SUCCESS in 2m 14s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/df0d254b13b840f1b8cb34d08493b1d1 : SUCCESS in 20m 13s","accounts_in_message":[],"_revision_number":2},{"id":"c3f1170a6bdd7675dd63e24326ff3e8ab99fd45d","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35943,"name":"Aleksei Chekunov","display_name":"Aleksei Chekunov","email":"chekunov87@gmail.com","username":"az7961"},"date":"2026-10-13 21:26:52.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"baecc7af7a1c043183e956a564653692c64c335d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-13 22:01:18.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d479491fb9d14d7cb051ce88e19398da\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d0c961b3f85f464f86529e95a5e86141 : SUCCESS in 3m 07s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/3c77522e278647e2ad9de61f7b482c4f : SUCCESS in 3m 01s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/18baba6121e34139aa2cc6470c628bc5 : SUCCESS in 2m 50s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/be4c2392542048dfbe6fd9f484487b7a : SUCCESS in 1m 35s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/8b55a3a904a148ac8f1008778340b67e : SUCCESS in 2m 33s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/fd6297323c244ddd9d2f5530bd1b97b8 : SUCCESS in 28m 35s","accounts_in_message":[],"_revision_number":3},{"id":"feb6a40018b96f16ae1a4ce9c5f7193db6f8eadf","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-10-14 15:14:39.000000000","message":"Patch Set 3: Code-Review+2","accounts_in_message":[],"_revision_number":3},{"id":"9d3453cfd151d206461b72839eddcb352b1a2737","author":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"date":"2026-10-14 15:32:19.000000000","message":"Patch Set 3: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":3},{"id":"48e3e5b819de7bf0b63c2ae91e85b3e9f3c830e6","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-14 15:32:29.000000000","message":"Patch Set 3: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":3},{"id":"0753dc032db9bd36753ab63b85d848db625d9bd3","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-14 17:23:29.000000000","message":"Patch Set 3: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/0756a39ca74a480ea21df4979fc105ad\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/6f19176aa0da4a60baedc9b867284634 : SUCCESS in 2m 37s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/776611a02dbf4304b17f53d0390c1449 : SUCCESS in 3m 19s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/4fd456a821b04684a686cc43a711a63f : SUCCESS in 1m 44s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/66cd188e084546f9b14389d0111195a5 : SUCCESS in 1h 48m 42s\n- openstack-helm-logging https://zuul.opendev.org/t/openstack/build/7b56e08f95b14103b9b9ae35dbdf8bdd : SUCCESS in 38m 56s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/57ed9914d8314cb78cfec71f0fd640b3 : SUCCESS in 29m 00s","accounts_in_message":[],"_revision_number":3},{"id":"d0fd256d40e2be94a79899884c9eac3a73f9d5c4","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-14 17:23:29.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":3},{"id":"f9e5678b306799065e1e486a8e0e2c15e4c3688f","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-14 17:24:31.000000000","message":"Patch Set 3:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/42db9c10c2d14da1988752b1a1b7870d\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/6b5db5c9714a4250800f46c95e8abaef : SUCCESS in 45s","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"8d5d2e496cc7809821a78d37dcd4a389fd71900d","revisions":{"cd9aa8288dbb39a67818278af828478c6a8edd3b":{"kind":"REWORK","_number":1,"created":"2026-10-09 20:56:40.000000000","uploader":{"_account_id":35943,"name":"Aleksei Chekunov","display_name":"Aleksei Chekunov","email":"chekunov87@gmail.com","username":"az7961"},"ref":"refs/changes/62/1009862/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/62/1009862/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/62/1009862/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/62/1009862/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/62/1009862/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/62/1009862/1"}}},"commit":{"parents":[{"commit":"a8e60bfead5eac20548c04afb7f322d39eb62393","subject":"Merge \"Run deployment jobs only for related changes\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/a8e60bfead5eac20548c04afb7f322d39eb62393"}]}],"author":{"name":"Aleksei Chekunov","email":"chekunov87@gmail.com","date":"2026-10-07 15:33:33.000000000","tz":-300},"committer":{"name":"Aleksei Chekunov","email":"chekunov87@gmail.com","date":"2026-10-09 20:56:29.000000000","tz":-300},"subject":"fix(grafana): mount client certs in set-admin-user and stop hiding failures","message":"fix(grafana): mount client certs in set-admin-user and stop hiding failures\n\njob-set-admin-user is the only grafana workload that touches the\ndatabase without mounting /etc/mysql/certs. With tls.oslo_db the\nrendered grafana.ini points ca_cert_path, client_cert_path and\nclient_key_path at files that are never mounted, so grafana-cli cannot\nconnect. It now mounts the client certificate the same way\njob-run-migrator, job-db-session-sync and the deployment do.\n\nThe failure went unnoticed because set-admin-password.sh exits 0 on\nevery path and treats a non-zero exit as \"the admin user does not exist\nyet\". grafana-cli reset-admin-password does not work that way: it exits\n0 when the admin user does not exist, and also when reading or updating\nthe user fails, and exits non-zero when the database cannot be reached\nor the password is refused. The script now judges by what grafana-cli\nprinted, accepts only a changed password or a missing admin user, and\nfails otherwise, so the job no longer reports Completed for work it\nnever did. The password is quoted so it reaches grafana-cli as one\nargument.\n\nChange-Id: Ia23de0fdc76f02367b8ceee3bd92d1cce050a9d6\nSigned-off-by: Aleksei Chekunov \u003cchekunov87@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/cd9aa8288dbb39a67818278af828478c6a8edd3b"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/cd9aa8288dbb39a67818278af828478c6a8edd3b"}]},"branch":"refs/heads/master"},"4cd70073787533a9790b1c66f1842d04260c9143":{"kind":"REWORK","_number":2,"created":"2026-10-13 14:27:27.000000000","uploader":{"_account_id":35943,"name":"Aleksei Chekunov","display_name":"Aleksei Chekunov","email":"chekunov87@gmail.com","username":"az7961"},"ref":"refs/changes/62/1009862/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/62/1009862/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/62/1009862/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/62/1009862/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/62/1009862/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/62/1009862/2"}}},"commit":{"parents":[{"commit":"bab4db238180f4fc330fa8c2e43522833d5441e1","subject":"Merge \"fix(skyline): size the skyline pod\u0027s containers\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/bab4db238180f4fc330fa8c2e43522833d5441e1"}]}],"author":{"name":"Aleksei Chekunov","email":"chekunov87@gmail.com","date":"2026-10-07 15:33:33.000000000","tz":-300},"committer":{"name":"Aleksei Chekunov","email":"chekunov87@gmail.com","date":"2026-10-13 14:20:23.000000000","tz":-300},"subject":"fix(grafana): mount client certs in set-admin-user and stop hiding failures","message":"fix(grafana): mount client certs in set-admin-user and stop hiding failures\n\njob-set-admin-user is the only grafana workload that touches the\ndatabase without mounting /etc/mysql/certs. With tls.oslo_db the\nrendered grafana.ini points ca_cert_path, client_cert_path and\nclient_key_path at files that are never mounted, so grafana-cli cannot\nconnect. It now mounts the client certificate the same way\njob-run-migrator, job-db-session-sync and the deployment do.\n\nThe failure went unnoticed because set-admin-password.sh exits 0 on\nevery path and treats a non-zero exit as \"the admin user does not exist\nyet\". grafana-cli reset-admin-password does not work that way: it exits\n0 when reading or updating the user fails, and non-zero when the\ndatabase cannot be reached or the password is refused. The script now\njudges by what grafana-cli printed, accepts only a changed password or\na missing admin user, and fails otherwise, so the job no longer reports\nCompleted for work it never did. The password is quoted so it reaches\ngrafana-cli as one argument.\n\nA missing admin user is accepted whatever the exit status. The admin\nuser does not exist until grafana has started for the first time, and\nthis job runs before it does, so a fresh install always takes this\npath. grafana-cli prints \"Admin user cannot be found\" and then lists\nthe existing admins to suggest a --user-id, and that listing can fail\non its own and make grafana-cli exit non-zero, as it does in 12.4.x\nwith \"sql: expected 1 arguments, got 2\". Requiring a zero exit there\nwould fail the job on every fresh install, and the grafana deployment,\nwhich waits for it, would never start to create the admin user.\n\nChange-Id: Ia23de0fdc76f02367b8ceee3bd92d1cce050a9d6\nSigned-off-by: Aleksei Chekunov \u003cchekunov87@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/4cd70073787533a9790b1c66f1842d04260c9143"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/4cd70073787533a9790b1c66f1842d04260c9143"}]},"branch":"refs/heads/master"},"8d5d2e496cc7809821a78d37dcd4a389fd71900d":{"kind":"REWORK","_number":3,"created":"2026-10-13 21:26:52.000000000","uploader":{"_account_id":35943,"name":"Aleksei Chekunov","display_name":"Aleksei Chekunov","email":"chekunov87@gmail.com","username":"az7961"},"ref":"refs/changes/62/1009862/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/62/1009862/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/62/1009862/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/62/1009862/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/62/1009862/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/62/1009862/3"}}},"commit":{"parents":[{"commit":"bab4db238180f4fc330fa8c2e43522833d5441e1","subject":"Merge \"fix(skyline): size the skyline pod\u0027s containers\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/bab4db238180f4fc330fa8c2e43522833d5441e1"}]}],"author":{"name":"Aleksei Chekunov","email":"chekunov87@gmail.com","date":"2026-10-07 15:33:33.000000000","tz":-300},"committer":{"name":"Aleksei Chekunov","email":"chekunov87@gmail.com","date":"2026-10-13 21:23:49.000000000","tz":-300},"subject":"fix(grafana): mount client certs in set-admin-user and stop hiding failures","message":"fix(grafana): mount client certs in set-admin-user and stop hiding failures\n\njob-set-admin-user is the only grafana workload that touches the\ndatabase without mounting /etc/mysql/certs. With tls.oslo_db the\nrendered grafana.ini points ca_cert_path, client_cert_path and\nclient_key_path at files that are never mounted, so grafana-cli cannot\nconnect. It now mounts the client certificate the same way\njob-run-migrator, job-db-session-sync and the deployment do.\n\nThe failure went unnoticed because set-admin-password.sh exits 0 on\nevery path and treats a non-zero exit as \"the admin user does not exist\nyet\". grafana-cli reset-admin-password does not work that way: it exits\n0 when reading or updating the user fails, and non-zero when the\ndatabase cannot be reached or the password is refused. The script now\njudges by what grafana-cli printed, accepts only a changed password or\na missing admin user, and fails otherwise, so the job no longer reports\nCompleted for work it never did. The password is quoted so it reaches\ngrafana-cli as one argument.\n\nA missing admin user is accepted whatever the exit status. The admin\nuser does not exist until grafana has started for the first time, and\nthis job runs before it does, so a fresh install always takes this\npath. grafana-cli prints \"Admin user cannot be found\" and then lists\nthe existing admins to suggest a --user-id, and that listing can fail\non its own and make grafana-cli exit non-zero, as it does in 12.4.x\nwith \"sql: expected 1 arguments, got 2\". Requiring a zero exit there\nwould fail the job on every fresh install, and the grafana deployment,\nwhich waits for it, would never start to create the admin user.\n\nChangelog: fixed: set-admin-user mounts the MariaDB client certificate when tls.oslo_db is enabled, and fails instead of reporting success when the admin password was not updated\nChange-Id: Ia23de0fdc76f02367b8ceee3bd92d1cce050a9d6\nSigned-off-by: Aleksei Chekunov \u003cchekunov87@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/8d5d2e496cc7809821a78d37dcd4a389fd71900d"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/8d5d2e496cc7809821a78d37dcd4a389fd71900d"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}