)]}'
{"id":"openstack%2Fopenstack-helm~1010827","triplet_id":"openstack%2Fopenstack-helm~master~Ied7f6774f8e2642af42fa3a9ad6ce19af97cfd7d","project":"openstack/openstack-helm","branch":"master","topic":"cinder-backup-caps","attention_set":{},"removed_from_attention_set":{"7102":{"account":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"last_update":"2026-10-16 19:17:05.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Ied7f6774f8e2642af42fa3a9ad6ce19af97cfd7d","subject":"Add DAC_READ_SEARCH to the cinder-backup capabilities","status":"MERGED","created":"2026-10-16 08:06:21.000000000","updated":"2026-10-16 19:17:59.000000000","submitted":"2026-10-16 19:17:05.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1010827-cinder-backup-caps","meta_rev_id":"d1c2f5a238e8ee7eb272d5b9df18395bc1a6e7fe","_number":1010827,"virtual_id_number":1010827,"owner":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},{"value":0,"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-10-16 19:17:05.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"all":[{"value":2,"date":"2026-10-16 17:30:28.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},{"value":2,"date":"2026-10-16 15:38:13.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"all":[{"value":1,"date":"2026-10-16 17:30:28.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},{"value":0,"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-10-16 09:56:18.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-10-16 15:38:13.000000000","updated_by":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"reviewer":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"state":"REVIEWER"},{"updated":"2026-10-16 17:30:28.000000000","updated_by":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"reviewer":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"state":"REVIEWER"}],"messages":[{"id":"78db40174067d7520c77ee312d6b241b80c4c067","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"date":"2026-10-16 08:06:21.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"ebb71ee23e0c8a8403b029bd16d0badd2ce932d2","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-16 09:56:18.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/9ad4c7eb9427425a8e0b1b1ee2c47153\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8f8b58981c6e4c7dbd29e688278bd44c : SUCCESS in 4m 39s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/1dfcc83978ab4c28bfad4d98b30d8a0a : SUCCESS in 3m 16s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/f06f296d53a945038fe978b9cf10539a : SUCCESS in 2m 29s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/a075d3faf964473bafccf5d30861554d : SUCCESS in 1m 58s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/7fc9950c8c1f49b58d8656328ec0ea49 : SUCCESS in 2m 31s\n- openstack-helm-compute-kit-2025-2-ubuntu_noble https://zuul.opendev.org/t/openstack/build/7bf6696ae4714185b25af2d692483ead : SUCCESS in 1h 00m 01s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/ce1409261d9e40cb98548fa6a96fd628 : SUCCESS in 1h 43m 33s\n- openstack-helm-tls-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/7c864743afee4fdd8a821c5002c2d6c9 : SUCCESS in 1h 43m 18s\n- openstack-helm-crd-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/0fb3f747dfdf4efda67732a653b4b289 : SUCCESS in 1h 33m 09s\n- openstack-helm-operators-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/7855bfd9dc3648609d4cc456d304cd0d : SUCCESS in 1h 46m 29s\n- openstack-helm-compute-kit-2026-2-ubuntu_resolute https://zuul.opendev.org/t/openstack/build/6c5537a2fc184245b4e9bf438b4117af : SUCCESS in 1h 15m 29s","accounts_in_message":[],"_revision_number":1},{"id":"9b94b1b7f5a95abeeee1df79e7781cac9146a618","author":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"date":"2026-10-16 15:38:13.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"5e33e21c88c43d45f3b59128a6cefa1136962ad6","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-10-16 17:30:28.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"15a696283dab6f6d37bbcb70115f8af0e2b7edef","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-16 17:30:42.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"f19c88fe61ce4f852b5f07b33bbf04c3eeb68159","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-16 19:17:05.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/a6267e498bfc4d60832652d326ab7f5e\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0786525a3c4a4f66bd9b4a96f3d2e6b3 : SUCCESS in 5m 17s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/6510236f771e4b138190d11e77f364b4 : SUCCESS in 2m 36s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/f20a4ee2dcd24c5dbb794f47ff8b4d99 : SUCCESS in 1m 44s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/12bfd9b046884dfb9d972823f692b0b8 : SUCCESS in 1h 39m 24s\n- openstack-helm-logging https://zuul.opendev.org/t/openstack/build/0e3773d9dc114a85b8f40fc3fd5a5b4c : SUCCESS in 42m 50s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/d66b3de7a1c544b3a7f72507396b249b : SUCCESS in 29m 08s","accounts_in_message":[],"_revision_number":1},{"id":"04feddc3e281da4045eb9d6f84ca3125b3dcc7f4","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-16 19:17:05.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"d1c2f5a238e8ee7eb272d5b9df18395bc1a6e7fe","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-16 19:17:59.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/aa412ea0449e4dd78a53a0ae2330441a\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8da664e6d748497a8ae90eb7e2329a21 : SUCCESS in 45s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"47ef097b99af0c5454828fc12be78626130e1b8b","revisions":{"47ef097b99af0c5454828fc12be78626130e1b8b":{"kind":"REWORK","_number":1,"created":"2026-10-16 08:06:21.000000000","uploader":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"ref":"refs/changes/27/1010827/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/27/1010827/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/27/1010827/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/27/1010827/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/27/1010827/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/27/1010827/1"}}},"commit":{"parents":[{"commit":"6c105b29b55eae8f8a91f470179d70caf0658aff","subject":"Merge \"fix(cyborg): Run api and conductor as non-root\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/6c105b29b55eae8f8a91f470179d70caf0658aff"}]}],"author":{"name":"Thomas Bechtold","email":"thomasbechtold@jpberlin.de","date":"2026-10-16 08:02:55.000000000","tz":120},"committer":{"name":"Thomas Bechtold","email":"thomasbechtold@jpberlin.de","date":"2026-10-16 08:02:55.000000000","tz":120},"subject":"Add DAC_READ_SEARCH to the cinder-backup capabilities","message":"Add DAC_READ_SEARCH to the cinder-backup capabilities\n\ncinder-backup leaves every backup in \u0027creating\u0027 and its volume in\n\u0027backing-up\u0027. continue_backup() asks os-brick for the connector\nproperties before it enters its try block, and that starts the os-brick\nprivsep daemon, which fails:\n\n  oslo_privsep.daemon.FailedToDropPrivileges: Privsep daemon failed to start\n\nThe exception escapes the RPC handler before the backup is set to\nerror, and the default logging.conf drops it, since everything outside\nthe cinder logger goes to the root logger and its null handler.\nRestores fail the same way, in _run_restore().\n\nSince os-brick 6.13.0 (2025.2, commit e0460de \"Remove usage of the\n\"VIRTUAL_ENV\" environment variable\") the os-brick privsep contexts\nalways keep CAP_SYS_ADMIN and CAP_DAC_READ_SEARCH. Before that,\nDAC_READ_SEARCH was only kept when VIRTUAL_ENV was set. The daemon is\nstarted as root through sudo and cinder-rootwrap, and sets its\ncapabilities with capset(), which cannot add a capability that is not\nin the permitted set. For root in a container the permitted set is the\nbounding set, the runtime defaults plus capabilities.add, and\ncinder-backup only adds SYS_ADMIN, so capset() fails with EPERM.\n\nAdd DAC_READ_SEARCH, which together with SYS_ADMIN is what the os-brick\ncontexts ask for. cinder-backup uses no other privsep context.\ncinder-volume runs privileged and is not affected.\n\nChecked on a single-node openstack-helm deployment with 2026.1 images\n(os-brick 7.0.0, oslo.privsep 3.10.1, ceph backup driver): in the\ncinder-backup pod brick_get_connector_properties() raised the error\nabove, privsep-helper failed in drop_all_caps_except() with\nPermissionError [Errno 1], and CapBnd was a82425fb. With\nDAC_READ_SEARCH added CapBnd is a82425ff, the call returns in about a\nsecond, and a backup of a 1 GB volume was available after 7 seconds.\n\nAssisted-by: Claude Opus 5.5\nChange-Id: Ied7f6774f8e2642af42fa3a9ad6ce19af97cfd7d\nSigned-off-by: Thomas Bechtold \u003cthomasbechtold@jpberlin.de\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/47ef097b99af0c5454828fc12be78626130e1b8b"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/47ef097b99af0c5454828fc12be78626130e1b8b"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}