)]}'
{"id":"openstack%2Fopenstack-helm~1010666","triplet_id":"openstack%2Fopenstack-helm~master~I37f839be99cf69d42b03b1398a8862ca04e1a6a3","project":"openstack/openstack-helm","branch":"master","attention_set":{},"removed_from_attention_set":{"5890":{"account":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"last_update":"2026-10-17 10:09:38.000000000","reason":"Change was submitted"},"7156":{"account":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"last_update":"2026-10-16 21:30:03.000000000","reason":"\u003cGERRIT_ACCOUNT_7156\u003e replied on the change","reason_account":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"}}},"hashtags":[],"change_id":"I37f839be99cf69d42b03b1398a8862ca04e1a6a3","subject":"fix(designate): define the pod and container security contexts","status":"MERGED","created":"2026-10-15 12:36:01.000000000","updated":"2026-10-17 10:09:38.000000000","submitted":"2026-10-17 10:09:38.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":2,"unresolved_comment_count":2,"has_review_started":true,"submission_id":"1010666","meta_rev_id":"58af1c3303d3e0aad8ee44efcf23cb2929e7f02b","_number":1010666,"virtual_id_number":1010666,"owner":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},{"value":0,"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-10-17 10:09:38.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"all":[{"value":2,"date":"2026-10-17 08:03:20.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},{"value":2,"date":"2026-10-16 21:30:03.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"all":[{"value":1,"date":"2026-10-17 08:03:20.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},{"value":0,"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-10-15 13:17:38.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-10-15 17:58:32.000000000","updated_by":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"reviewer":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"state":"CC"},{"updated":"2026-10-16 15:18:16.000000000","updated_by":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"reviewer":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"state":"REVIEWER"},{"updated":"2026-10-17 08:03:20.000000000","updated_by":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"reviewer":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"state":"REVIEWER"}],"messages":[{"id":"d09b7f092f4247f11724b4bd37a6adf741c4c6d0","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"date":"2026-10-15 12:36:01.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"be745dbae4527537498181af98e33833e194afb2","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-15 13:17:38.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/b268935abc99410d94cebeb10852cdf4\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/195abf156dc445e384946a1543c82984 : SUCCESS in 2m 30s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/c92bbacfff15486996ca17d8f65325b2 : SUCCESS in 1m 56s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/19cdfbaa8c2b4cd294f5b71ae149658e : SUCCESS in 4m 05s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/3bc914357c8442aa9df81f7b2ef1c125 : SUCCESS in 1m 48s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/bf938f74298f4acfa84300d512c6d2d5 : SUCCESS in 2m 28s\n- openstack-helm-designate-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/0c3cfd61c12e4020973c183ccf9c3b73 : FAILURE in 34m 40s","accounts_in_message":[],"_revision_number":1},{"id":"7560307510e4b53117edb7b9a2cfc46ea459acbc","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-10-15 17:58:32.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"56b229b21d455f5c9473cd2f5c73f6701db7c81e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"date":"2026-10-16 15:02:06.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"2c27b4dc04bae2fcdcda2aa5a9afda7218a1fbdf","author":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"date":"2026-10-16 15:18:16.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"77e5cbd28abd339bc15dceaa94505b902cffadda","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-16 15:50:33.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/575977fa696f4bdebc1aea6347d2ca0e\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/21af5a4ce0d749a4ac78f4684710df8c : SUCCESS in 2m 51s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/938457c5812044b8b25d2cfac2178fbd : SUCCESS in 4m 04s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/a96342667dbc430b9455a3c770cff4cb : SUCCESS in 2m 56s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/62836ef95d1f49f9b3bab15361c12708 : SUCCESS in 1m 36s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/a823d54cae6141978124d3bdc3dd417b : SUCCESS in 2m 11s\n- openstack-helm-designate-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/8a6c3d03c71b49bc84241435941bab13 : FAILURE in 41m 26s","accounts_in_message":[],"_revision_number":2},{"id":"ba0cd738965c0a684429cf45195525fdebfebf33","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-10-16 15:58:46.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"0b2867fee98b989b4d731c71ba810e7d9c637ebe","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"date":"2026-10-16 20:27:27.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Code-Review+2 (copy condition: \"changekind:TRIVIAL_REBASE OR is:MIN\")\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"18cf20e9abbbf29fc1ba2edc1010f7ad106a52fd","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-16 20:45:57.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d0c6554fe7df40a1b9b6a47c6ae0edad\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/c8af191c29aa44ca9d995bc967289089 : SUCCESS in 6m 08s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/9f104511846c40c692785204ee9874fe : SUCCESS in 2m 55s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/7b712366a76742baa8d75281e87d5913 : SUCCESS in 5m 28s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/bea80419e95648daa760a3d840180702 : SUCCESS in 4m 08s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/123ae896855345b3a423d199d569369d : SUCCESS in 2m 18s\n- openstack-helm-designate-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/5c1cb57ee9e04b24ad1c5c36d3209c93 : SUCCESS in 17m 19s","accounts_in_message":[],"_revision_number":3},{"id":"26f75e30003c2777ef986663587152d258897e97","author":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"date":"2026-10-16 21:30:03.000000000","message":"Patch Set 3: Code-Review+2","accounts_in_message":[],"_revision_number":3},{"id":"d734ad129ba6f96c0c518f6248db391bf3e3b0f4","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-10-17 08:03:20.000000000","message":"Patch Set 3: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":3},{"id":"2ceeb1e400166f1d788f889a9f88dadee6e703f4","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-17 08:03:30.000000000","message":"Patch Set 3: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":3},{"id":"fd93e74fdad5fecc4c58f05ff95f8f5d98925a99","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-17 10:09:38.000000000","message":"Patch Set 3: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/c439067cdc29438b9810c143ee15d81e\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ac48811ead714c50bd0729dac6b25a6c : SUCCESS in 4m 10s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/a66d5000c73b47a7b989682ce041ad09 : SUCCESS in 2m 48s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/d576e7ada4654c198eddaeac795abeb7 : SUCCESS in 2m 13s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/61f4faac8fab43ac92150aaead2a8941 : SUCCESS in 1h 36m 40s\n- openstack-helm-logging https://zuul.opendev.org/t/openstack/build/5ac7cec9a2014164b7a5d9f0bbbf1220 : SUCCESS in 38m 23s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/587d8f4d6845444a919a0b05d61eac3e : SUCCESS in 30m 15s","accounts_in_message":[],"_revision_number":3},{"id":"58af1c3303d3e0aad8ee44efcf23cb2929e7f02b","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-17 10:09:38.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"02656876710ee3eed5596bdd5106436561d1741f","revisions":{"3bb916f835015b92eff312ff1b1259491141208f":{"kind":"REWORK","_number":1,"created":"2026-10-15 12:36:01.000000000","uploader":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"ref":"refs/changes/66/1010666/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/66/1010666/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/66/1010666/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/66/1010666/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/66/1010666/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/66/1010666/1"}}},"commit":{"parents":[{"commit":"0890dba9c4091aebdcc3c968645b9f91a08305f8","subject":"fix(designate): define the missing resources and dependencies","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/0890dba9c4091aebdcc3c968645b9f91a08305f8"}]}],"author":{"name":"Doug Goldstein","email":"cardoe@cardoe.com","date":"2026-10-01 00:51:07.000000000","tz":-300},"committer":{"name":"Doug Goldstein","email":"cardoe@cardoe.com","date":"2026-10-15 12:35:53.000000000","tz":-300},"subject":"fix(designate): define the pod and container security contexts","message":"fix(designate): define the pod and container security contexts\n\nEvery designate Deployment read pod.security_context.designate, but\nvalues.yaml never defined it, so helm-toolkit rendered nothing and the\npods ran with no security context at all. The central, producer, sink\nand worker pods did not even render the pod-level snippet, and the\nworker\u0027s designate-worker-init container rendered no container snippet.\n\nDefine the context in the shape barbican and heat use: run as 42424,\nwith allowPrivilegeEscalation false and a read-only root filesystem for\nevery container. The services and the pools.yaml init write only to\nthe emptyDir volumes mounted at /etc/designate, /var/cache/designate\nand the oslo lock path. Render the pod snippet in the four pods that\nlacked it and give designate-worker-init its own container key.\n\nAssisted-by: Claude Opus 5.5\nChange-Id: I37f839be99cf69d42b03b1398a8862ca04e1a6a3\nSigned-off-by: Doug Goldstein \u003ccardoe@cardoe.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/3bb916f835015b92eff312ff1b1259491141208f"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/3bb916f835015b92eff312ff1b1259491141208f"}]},"branch":"refs/heads/master"},"967bcf02ecf78497ee689e7eaac1ed864eba7ee4":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-10-16 15:02:06.000000000","uploader":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"ref":"refs/changes/66/1010666/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/66/1010666/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/66/1010666/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/66/1010666/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/66/1010666/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/66/1010666/2"}}},"commit":{"parents":[{"commit":"17ede4464992312c8b184696d7c3add6371b67c0","subject":"fix(designate): define the missing resources and dependencies","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/17ede4464992312c8b184696d7c3add6371b67c0"}]}],"author":{"name":"Doug Goldstein","email":"cardoe@cardoe.com","date":"2026-10-01 00:51:07.000000000","tz":-300},"committer":{"name":"Doug Goldstein","email":"cardoe@cardoe.com","date":"2026-10-16 14:59:39.000000000","tz":-300},"subject":"fix(designate): define the pod and container security contexts","message":"fix(designate): define the pod and container security contexts\n\nEvery designate Deployment read pod.security_context.designate, but\nvalues.yaml never defined it, so helm-toolkit rendered nothing and the\npods ran with no security context at all. The central, producer, sink\nand worker pods did not even render the pod-level snippet, and the\nworker\u0027s designate-worker-init container rendered no container snippet.\n\nDefine the context in the shape barbican and heat use: run as 42424,\nwith allowPrivilegeEscalation false and a read-only root filesystem for\nevery container. The services and the pools.yaml init write only to\nthe emptyDir volumes mounted at /etc/designate, /var/cache/designate\nand the oslo lock path. Render the pod snippet in the four pods that\nlacked it and give designate-worker-init its own container key.\n\nAssisted-by: Claude Opus 5.5\nChange-Id: I37f839be99cf69d42b03b1398a8862ca04e1a6a3\nSigned-off-by: Doug Goldstein \u003ccardoe@cardoe.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/967bcf02ecf78497ee689e7eaac1ed864eba7ee4"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/967bcf02ecf78497ee689e7eaac1ed864eba7ee4"}]},"branch":"refs/heads/master"},"02656876710ee3eed5596bdd5106436561d1741f":{"kind":"REWORK","_number":3,"created":"2026-10-16 20:27:27.000000000","uploader":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"ref":"refs/changes/66/1010666/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/66/1010666/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/66/1010666/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/66/1010666/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/66/1010666/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/66/1010666/3"}}},"commit":{"parents":[{"commit":"07022c167becfcc9a06a659f38e984118be00e92","subject":"Merge \"fix(neutron): Mount the oslo.concurrency lock path in neutron-server\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/07022c167becfcc9a06a659f38e984118be00e92"}]}],"author":{"name":"Doug Goldstein","email":"cardoe@cardoe.com","date":"2026-10-01 00:51:07.000000000","tz":-300},"committer":{"name":"Doug Goldstein","email":"cardoe@cardoe.com","date":"2026-10-16 20:26:56.000000000","tz":-300},"subject":"fix(designate): define the pod and container security contexts","message":"fix(designate): define the pod and container security contexts\n\nEvery designate Deployment read pod.security_context.designate, but\nvalues.yaml never defined it, so helm-toolkit rendered nothing and the\npods ran with no security context at all. The central, producer, sink\nand worker pods did not even render the pod-level snippet, and the\nworker\u0027s designate-worker-init container rendered no container snippet.\n\nDefine the context in the shape barbican and heat use: run as 42424,\nwith allowPrivilegeEscalation false and a read-only root filesystem for\nevery container. The services and the pools.yaml init write only to\nthe emptyDir volumes mounted at /etc/designate, /var/cache/designate\nand the oslo lock path. Render the pod snippet in the four pods that\nlacked it and give designate-worker-init its own container key.\n\nAssisted-by: Claude Opus 5.5\nChange-Id: I37f839be99cf69d42b03b1398a8862ca04e1a6a3\nSigned-off-by: Doug Goldstein \u003ccardoe@cardoe.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/02656876710ee3eed5596bdd5106436561d1741f"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/02656876710ee3eed5596bdd5106436561d1741f"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}