)]}'
{"id":"openstack%2Fopenstack-helm~1010863","triplet_id":"openstack%2Fopenstack-helm~master~Ieff2756cf55aca4abcd25fe6a67543faa4872a82","project":"openstack/openstack-helm","branch":"master","topic":"glance-barbican-auth","attention_set":{},"removed_from_attention_set":{"7102":{"account":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"last_update":"2026-10-16 22:59:20.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Ieff2756cf55aca4abcd25fe6a67543faa4872a82","subject":"fix(glance): configure castellan\u0027s barbican auth_endpoint","status":"MERGED","created":"2026-10-16 11:43:54.000000000","updated":"2026-10-16 23:00:19.000000000","submitted":"2026-10-16 22:59:20.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1010863-glance-barbican-auth","meta_rev_id":"939cd86886e451fb105d7df1aa5e8252a21052a3","_number":1010863,"virtual_id_number":1010863,"owner":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},{"value":0,"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-10-16 22:59:19.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"all":[{"value":2,"date":"2026-10-16 20:29:16.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},{"value":2,"date":"2026-10-16 21:31:03.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"all":[{"value":0,"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},{"value":1,"date":"2026-10-16 21:31:03.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-10-16 14:26:38.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-10-16 20:29:16.000000000","updated_by":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"reviewer":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"state":"REVIEWER"},{"updated":"2026-10-16 21:31:03.000000000","updated_by":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"reviewer":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"state":"REVIEWER"}],"messages":[{"id":"b07e9e33c1c79b4cc059af81b276f114d6d5d148","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"date":"2026-10-16 11:43:54.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"e6b88cb37019b8886accdb01edd0c1937ce034e1","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"date":"2026-10-16 12:16:01.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"03b21bbcbbee3554b5b92a9afcc7e660436245f5","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-16 14:26:38.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/a200c54d449e4f02af4b739e72a73472\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/18dd1d365c9b41e98c53bb545f87935f : SUCCESS in 3m 33s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/ae12a8eb05764dfa92c646ab754c684e : FAILURE in 3m 59s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/8a62f12d5e2c48b88764b701a0a99b6a : SUCCESS in 2m 08s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/521b500ec9784dc6a9489b904c124949 : SUCCESS in 1m 11s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/bdacce96931745d5b673c40f1c390f0b : SUCCESS in 1m 53s\n- openstack-helm-compute-kit-2025-2-ubuntu_noble https://zuul.opendev.org/t/openstack/build/9bb910ec7b8841de9a18d12aba42febf : SUCCESS in 57m 46s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/60f44714ec7a47feaf1f07afa67b84de : SUCCESS in 1h 46m 39s\n- openstack-helm-tls-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/097408f4cff54a5eb54d72cf708ae6f5 : SUCCESS in 2h 02m 24s\n- openstack-helm-crd-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/c79162b642214bc08861de2b7da61530 : SUCCESS in 1h 15m 43s\n- openstack-helm-operators-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/e1ba64a2f1804415b2e3fbc20a02218d : SUCCESS in 1h 39m 15s\n- openstack-helm-compute-kit-2026-2-ubuntu_resolute https://zuul.opendev.org/t/openstack/build/d6aeae0eda4e4a439ee16e0394126a82 : SUCCESS in 1h 16m 44s","accounts_in_message":[],"_revision_number":2},{"id":"430603903e6b1745dadfd1e365d04f7ae8265ad4","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"date":"2026-10-16 17:50:10.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"6a88dcf91408378d5af5be988238307b9f71994f","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-16 19:42:32.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/9364ff244e664c658dd7a517d58900f3\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0201bebbe28447258a9e6b41a47ea8b1 : SUCCESS in 2m 41s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/dcaf71bdd547423489821cfd044def0a : SUCCESS in 3m 20s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/7098f80e12fb450ca8d44629994f49cf : SUCCESS in 2m 38s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/8323d1cdfdad41008599d1ed92ef2879 : SUCCESS in 1m 35s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/fbba3243b9fc4ca08d050f802d579562 : SUCCESS in 3m 25s\n- openstack-helm-compute-kit-2025-2-ubuntu_noble https://zuul.opendev.org/t/openstack/build/4e14f44323ef40e68ae907a453f43949 : SUCCESS in 1h 40m 49s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/d5ff54694e4147a887410ac664e93704 : SUCCESS in 1h 33m 03s\n- openstack-helm-tls-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/2d53d3320e044e7dbec36a160c42eb83 : SUCCESS in 1h 46m 34s\n- openstack-helm-crd-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/1cc8761e63ed4528bc710db142b3bafa : SUCCESS in 1h 36m 43s\n- openstack-helm-operators-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/ae383381a5a3487aa5d1ba8d2d03f88b : SUCCESS in 1h 01m 11s\n- openstack-helm-compute-kit-2026-2-ubuntu_resolute https://zuul.opendev.org/t/openstack/build/2ef4b1a69a9e41999d5882229ce4b0d5 : SUCCESS in 1h 15m 33s","accounts_in_message":[],"_revision_number":3},{"id":"15af8c076f402734ceb9b569225c695b12909ef5","author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"date":"2026-10-16 20:29:16.000000000","message":"Patch Set 3: Code-Review+2","accounts_in_message":[],"_revision_number":3},{"id":"29e7c3f9cbfa3a60755cd1495194e175fd2c261a","author":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"date":"2026-10-16 21:31:03.000000000","message":"Patch Set 3: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":3},{"id":"4b5a75c313c6512972a724874d359ab211ce47f2","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-16 21:31:14.000000000","message":"Patch Set 3: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":3},{"id":"ba34f589415d2676aeb6078fd52edc8a88cfba7f","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-16 22:59:19.000000000","message":"Patch Set 3: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/51b14d469b9745099695085e5aa479af\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/350e657be8d14507b62178c28d441db9 : SUCCESS in 3m 19s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/5f3790277b974527a12eb076c7551bcb : SUCCESS in 3m 22s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/152b1c01d5a6495bb8ce346998c07f6f : SUCCESS in 2m 42s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/f05e998a8ec44598886897aef3a42e42 : SUCCESS in 1h 25m 54s\n- openstack-helm-logging https://zuul.opendev.org/t/openstack/build/59b14b466252444a8382eadf062de5c9 : SUCCESS in 41m 11s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/d58b544a23734ff0870f77231e217210 : SUCCESS in 26m 00s","accounts_in_message":[],"_revision_number":3},{"id":"d812079c1d8b641406c9101b3e8455dea0a68365","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-16 22:59:20.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":3},{"id":"939cd86886e451fb105d7df1aa5e8252a21052a3","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-16 23:00:19.000000000","message":"Patch Set 3:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/74dcdd38b16c42fa9d75c2b46d84550b\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/bd1a816f8fbe4f349d0824b479089a5d : SUCCESS in 51s","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"67c63b3a1b0c82d8dc417f1d6cb3bcda50919ab3","revisions":{"f0f203a867ff30625733a77487cd532e39706267":{"kind":"REWORK","_number":1,"created":"2026-10-16 11:43:54.000000000","uploader":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"ref":"refs/changes/63/1010863/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/63/1010863/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1010863/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1010863/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1010863/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/63/1010863/1"}}},"commit":{"parents":[{"commit":"ec221d6a59e4b0b361fc6d779626ac59c0b6f1c4","subject":"Merge \"masakari: render the db-sync job with helm-toolkit\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/ec221d6a59e4b0b361fc6d779626ac59c0b6f1c4"}]}],"author":{"name":"Thomas Bechtold","email":"thomasbechtold@jpberlin.de","date":"2026-10-16 11:07:49.000000000","tz":120},"committer":{"name":"Thomas Bechtold","email":"thomasbechtold@jpberlin.de","date":"2026-10-16 11:43:52.000000000","tz":120},"subject":"fix(glance): configure castellan\u0027s barbican auth_endpoint","message":"fix(glance): configure castellan\u0027s barbican auth_endpoint\n\nUploading a signed image fails with a 400 when glance verifies the\nsignature:\n\n  Signature verification failed for image ...: Signature verification\n  for the image failed: Unable to retrieve certificate with ID: ...\n\ncursive logs the cause at ERROR, but the cursive logger is dropped by\nthe chart\u0027s logging.conf (1010832). castellan builds its keystone auth\nfor glance from [barbican] auth_endpoint, because glance\u0027s\nRequestContext has no get_auth_plugin() as nova\u0027s and cinder\u0027s do, and\nthat option defaults to http://localhost/identity/v3:\n\n  KeyManagerError: Key manager error: Could not find versioned identity\n  endpoints when attempting to authenticate. ... Unable to establish\n  connection to http://localhost/identity/v3\n\nnova and cinder are not affected by this, so encrypted volumes work in\nthe same deployment.\n\nFill auth_endpoint from the internal identity endpoint, as is done for\nkeystone_authtoken, and look up barbican on its internal endpoint\ninstead of the public one.\n\nChecked on a single-node openstack-helm deployment with barbican: the\nbarbican-tempest-plugin image signing scenarios failed before and pass\nwith this change, and glance logs \"Successfully verified signature\".\n\nAssisted-by: Claude Opus 5.5\nChange-Id: Ieff2756cf55aca4abcd25fe6a67543faa4872a82\nSigned-off-by: Thomas Bechtold \u003cthomasbechtold@jpberlin.de\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/f0f203a867ff30625733a77487cd532e39706267"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/f0f203a867ff30625733a77487cd532e39706267"}]},"branch":"refs/heads/master"},"d204e6007e79ab9abc1d63e1468442193348612c":{"kind":"REWORK","_number":2,"created":"2026-10-16 12:16:01.000000000","uploader":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"ref":"refs/changes/63/1010863/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/63/1010863/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1010863/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1010863/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1010863/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/63/1010863/2"}}},"commit":{"parents":[{"commit":"ec221d6a59e4b0b361fc6d779626ac59c0b6f1c4","subject":"Merge \"masakari: render the db-sync job with helm-toolkit\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/ec221d6a59e4b0b361fc6d779626ac59c0b6f1c4"}]}],"author":{"name":"Thomas Bechtold","email":"thomasbechtold@jpberlin.de","date":"2026-10-16 11:07:49.000000000","tz":120},"committer":{"name":"Thomas Bechtold","email":"thomasbechtold@jpberlin.de","date":"2026-10-16 11:56:15.000000000","tz":120},"subject":"fix(glance): configure castellan\u0027s barbican auth_endpoint","message":"fix(glance): configure castellan\u0027s barbican auth_endpoint\n\nUploading a signed image fails with a 400 when glance verifies the\nsignature:\n\n  Signature verification failed for image ...: Signature verification\n  for the image failed: Unable to retrieve certificate with ID: ...\n\ncursive logs the cause at ERROR, but the cursive logger is dropped by\nthe chart\u0027s logging.conf (1010832). castellan builds its keystone auth\nfor glance from [barbican] auth_endpoint, because glance\u0027s\nRequestContext has no get_auth_plugin() as nova\u0027s and cinder\u0027s do, and\nthat option defaults to http://localhost/identity/v3:\n\n  KeyManagerError: Key manager error: Could not find versioned identity\n  endpoints when attempting to authenticate. ... Unable to establish\n  connection to http://localhost/identity/v3\n\nnova and cinder are not affected by this, so encrypted volumes work in\nthe same deployment.\n\nFill auth_endpoint and barbican_region_name from the identity endpoint\nas is done for keystone_authtoken, and look up barbican on its internal\nendpoint instead of the public one. castellan does not use the\nkeystone_authtoken CA, so the TLS override points verify_ssl_path at the\nsame CA file.\n\nChecked on a single-node openstack-helm deployment with barbican: the\nbarbican-tempest-plugin image signing scenarios failed before and pass\nwith this change, and glance logs \"Successfully verified signature\".\n\nAssisted-by: Claude Opus 5.5\nChange-Id: Ieff2756cf55aca4abcd25fe6a67543faa4872a82\nSigned-off-by: Thomas Bechtold \u003cthomasbechtold@jpberlin.de\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d204e6007e79ab9abc1d63e1468442193348612c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d204e6007e79ab9abc1d63e1468442193348612c"}]},"branch":"refs/heads/master"},"67c63b3a1b0c82d8dc417f1d6cb3bcda50919ab3":{"kind":"REWORK","_number":3,"created":"2026-10-16 17:50:10.000000000","uploader":{"_account_id":7102,"name":"Thomas Bechtold","email":"thomas.bechtold@chainguard.dev","username":"toabctl"},"ref":"refs/changes/63/1010863/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/63/1010863/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1010863/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1010863/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1010863/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/63/1010863/3"}}},"commit":{"parents":[{"commit":"ec221d6a59e4b0b361fc6d779626ac59c0b6f1c4","subject":"Merge \"masakari: render the db-sync job with helm-toolkit\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/ec221d6a59e4b0b361fc6d779626ac59c0b6f1c4"}]}],"author":{"name":"Thomas Bechtold","email":"thomasbechtold@jpberlin.de","date":"2026-10-16 11:07:49.000000000","tz":120},"committer":{"name":"Thomas Bechtold","email":"thomasbechtold@jpberlin.de","date":"2026-10-16 13:54:51.000000000","tz":120},"subject":"fix(glance): configure castellan\u0027s barbican auth_endpoint","message":"fix(glance): configure castellan\u0027s barbican auth_endpoint\n\nUploading a signed image fails with a 400 when glance verifies the\nsignature:\n\n  Signature verification failed for image ...: Signature verification\n  for the image failed: Unable to retrieve certificate with ID: ...\n\ncursive logs the cause at ERROR, but the cursive logger is dropped by\nthe chart\u0027s logging.conf (1010832). castellan builds its keystone auth\nfor glance from [barbican] auth_endpoint, because glance\u0027s\nRequestContext has no get_auth_plugin() as nova\u0027s and cinder\u0027s do, and\nthat option defaults to http://localhost/identity/v3:\n\n  KeyManagerError: Key manager error: Could not find versioned identity\n  endpoints when attempting to authenticate. ... Unable to establish\n  connection to http://localhost/identity/v3\n\nnova and cinder are not affected by this, so encrypted volumes work in\nthe same deployment.\n\nFill auth_endpoint and barbican_region_name from the identity endpoint\nas is done for keystone_authtoken, and look up barbican on its internal\nendpoint instead of the public one. castellan does not use the\nkeystone_authtoken CA, so the TLS override points verify_ssl_path at the\nsame CA file.\n\nChecked on a single-node openstack-helm deployment with barbican: the\nbarbican-tempest-plugin image signing scenarios failed before and pass\nwith this change, and glance logs \"Successfully verified signature\".\n\nAssisted-by: Claude Opus 5.5\nChange-Id: Ieff2756cf55aca4abcd25fe6a67543faa4872a82\nSigned-off-by: Thomas Bechtold \u003cthomasbechtold@jpberlin.de\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/67c63b3a1b0c82d8dc417f1d6cb3bcda50919ab3"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/67c63b3a1b0c82d8dc417f1d6cb3bcda50919ab3"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}