)]}'
{"id":"openstack%2Fopenstack-helm~1011563","triplet_id":"openstack%2Fopenstack-helm~master~Iff349e2845c3281af1b1989528b3730e859fbba6","project":"openstack/openstack-helm","branch":"master","hashtags":[],"change_id":"Iff349e2845c3281af1b1989528b3730e859fbba6","subject":"[WIP] Declarative Ceph pool and client management","status":"NEW","created":"2026-10-20 21:18:01.000000000","updated":"2026-10-20 23:02:17.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":0,"unresolved_comment_count":0,"work_in_progress":true,"has_review_started":false,"meta_rev_id":"0d19304ae84e40feda14f21f9774f111f8b6d79c","_number":1011563,"virtual_id_number":1011563,"owner":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-10-20 23:02:17.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"reviewer_updates":[{"updated":"2026-10-20 23:02:17.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"e7cc681c191d6dd53af93a508eef5a4a12053db7","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-10-20 21:18:01.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"cf6ac75a4a73745f7ca99a476a627741e47b2179","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-10-20 22:03:32.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"0d19304ae84e40feda14f21f9774f111f8b6d79c","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-10-20 23:02:17.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/93524f5c36374f5186fa7d5b3467c3e1\n\n- openstack-helm-crd-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/4b34fc03929b4520ab1c8e319c319f2a : SUCCESS in 57m 13s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"5ad394f105e447982d7ba0063b9395222faec86c","revisions":{"1b2f5897ba1a4694716cb64452650cb0422b520d":{"kind":"REWORK","_number":1,"created":"2026-10-20 21:18:01.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/63/1011563/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/63/1011563/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1011563/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1011563/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1011563/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/63/1011563/1"}}},"commit":{"parents":[{"commit":"d2b2059ceeaed0b31b9166cfbac8811f4c513eab","subject":"Merge \"feat(masakari): run the engine as a StatefulSet\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d2b2059ceeaed0b31b9166cfbac8811f4c513eab"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-10-20 20:57:17.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-10-20 21:17:58.000000000","tz":-300},"subject":"[WIP] Declarative Ceph pool and client management","message":"[WIP] Declarative Ceph pool and client management\n\nImplements the declarative Ceph spec for glance, cinder and nova.\n\nEach chart gains templates/ceph-resources.yaml, gated by\nmanifests.ceph_resources, which renders CephBlockPool and CephClient\nresources into the Ceph cluster namespace (ceph_resources.namespace),\nbecause that is the only namespace Rook reconciles them in. The pools,\nsizes, users and caps come from the values the storage-init scripts\nalready use. ceph_resources.api_group picks the reconciler:\n\n  ceph.rook.io            Rook\n  ceph.osh.openstack.org  the new ceph-controller chart\n\nceph-controller ships the two definitions, generated from the Rook\nv1.20.6 ones with every spec field kept, and a single-file Python\nreconciler on the ceph-config-helper image. It is the only component\nthat uses the administrative key. It takes the key from a secret (a\nfull keyring or a bare key) and the monitors from a ceph.conf or a\nmonitor list, so it can serve the legacy charts or any other cluster.\nIt writes the same status (phase, observedGeneration) and the same key\nsecret as Rook, refuses the fields it does not implement, adopts\nexisting pools and users without changing their keys, and never\ndeletes a pool.\n\nThe change is backward compatible: manifests.ceph_resources chooses the\npath per chart. With false, the default, a chart renders the\nstorage-init jobs and no custom resources, byte for byte as before.\nWith true the storage-init jobs no longer mount the\nadministrative key. They run helm-toolkit.scripts.ceph_resources,\nwhich waits for the resources and copies the user\u0027s key into\nsecrets.rbd, through a Role in the Ceph namespace limited by\nresourceNames. The jobs keep their names and the service pods are\nunchanged.\n\nThe crd job deploys ceph-controller against the Rook cluster, with\nRook\u0027s admin key and monitor list, and layers ceph-crd.yaml. The\noperators job adds ceph-rook.yaml, so Rook reconciles the same resources\n(that job is commented out in check while this is WIP). Both run glance\non the rbd store, and a verify step checks the resources, the key\nsecrets, and that no storage-init job mounts the admin key. nova-compute\nand libvirt still read the admin key; that is a follow-up.\n\nWIP: zuul.d/project.yaml comments out every check job except\nopenstack-helm-crd-2026-1-ubuntu_noble, so a patch set runs only the\njob that deploys OpenStack with the Ceph custom resources. Restore\nthem before this leaves WIP.\n\nChangelog: added: The new ceph-controller chart reconciles CephBlockPool and CephClient custom resources in the ceph.osh.openstack.org group, with the same fields as Rook\u0027s, using the Ceph administrative key\nChangelog: added: glance, cinder and nova can declare their Ceph pools and cephx users as CephBlockPool and CephClient resources (manifests.ceph_resources), reconciled by Rook or by the ceph-controller chart; the storage-init jobs then only copy each user\u0027s key and no longer need the Ceph administrative key\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\nChange-Id: Iff349e2845c3281af1b1989528b3730e859fbba6\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/1b2f5897ba1a4694716cb64452650cb0422b520d"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/1b2f5897ba1a4694716cb64452650cb0422b520d"}]},"branch":"refs/heads/master"},"5ad394f105e447982d7ba0063b9395222faec86c":{"kind":"REWORK","_number":2,"created":"2026-10-20 22:03:32.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/63/1011563/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/63/1011563/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1011563/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1011563/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/63/1011563/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/63/1011563/2"}}},"commit":{"parents":[{"commit":"d2b2059ceeaed0b31b9166cfbac8811f4c513eab","subject":"Merge \"feat(masakari): run the engine as a StatefulSet\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d2b2059ceeaed0b31b9166cfbac8811f4c513eab"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-10-20 20:57:17.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-10-20 21:57:57.000000000","tz":-300},"subject":"[WIP] Declarative Ceph pool and client management","message":"[WIP] Declarative Ceph pool and client management\n\nImplements the declarative Ceph spec for glance, cinder and nova.\n\nWith manifests.ceph_resources a chart renders CephBlockPool and\nCephClient resources in its own namespace and no storage-init job.\nceph_resources.api_group picks the reconciler:\n\n  ceph.rook.io            Rook, through an external CephCluster in the\n                          OpenStack namespace\n  ceph.osh.openstack.org  the new ceph-controller chart\n\nRook reconciles these kinds only in the namespace of a CephCluster, so\nthe OpenStack namespace gets an external one, connected to the real\nCeph cluster with the administrative key. Either reconciler writes the\nkey of a user into rook-ceph-client-\u003cuser\u003e next to the CephClient. The\nworkloads mount it directly (an items entry maps userKey to the file\nname they already read), and wait for their resources through\ncustom_resources dependencies on status.phase Ready, added by\nhelm-toolkit.utils.ceph_resources_dependencies so that they follow the\nAPI group and do not clash with dependency lists set in overrides.\n\nceph-controller ships the two definitions, generated from the Rook\nv1.20.6 ones with every spec field kept, and a single-file Python\nreconciler on the ceph-config-helper image. It runs in its own\nnamespace with the administrative key and watches the namespaces in\nwatch_namespaces, so the key never enters them. It writes the same\nstatus and key secret as Rook, refuses the fields it does not\nimplement, adopts existing pools and users without changing their\nkeys, and never deletes a pool.\n\nThe change is backward compatible: with manifests.ceph_resources false,\nthe default, a chart renders the storage-init jobs and no custom\nresources, byte for byte as before. Rendering fails if the switch is on\nwhile the storage-init job it replaces is still enabled; the\nceph-crd.yaml overrides disable it, and ceph-rook.yaml switches the\ngroup to Rook.\n\nThe crd job layers both overrides. It connects Rook to the gate\u0027s Rook\ncluster through an external CephCluster in the osh namespace (new\ndeploy-ceph tasks_from: external), runs glance on the rbd store, and a\nverify step checks the resources, the key secrets, and that no\nstorage-init job runs. ceph-controller is not deployed in CI. Still\nusing the admin key or ceph-adapter-rook: nova-compute and libvirt, and\nthe ceph-etc configmap; those are follow-ups.\n\nWIP: zuul.d/project.yaml comments out every check job except\nopenstack-helm-crd-2026-1-ubuntu_noble, so a patch set runs only the\njob that deploys OpenStack with the Ceph custom resources. Restore\nthem before this leaves WIP.\n\nChangelog: added: The new ceph-controller chart reconciles CephBlockPool and CephClient custom resources in the ceph.osh.openstack.org group, with the same fields as Rook\u0027s, in the namespaces it watches, using the Ceph administrative key from its own namespace\nChangelog: added: glance, cinder and nova can declare their Ceph pools and cephx users as CephBlockPool and CephClient resources in their own namespace (manifests.ceph_resources), reconciled by Rook through an external CephCluster or by the ceph-controller chart, instead of running storage-init jobs with the Ceph administrative key\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\nChange-Id: Iff349e2845c3281af1b1989528b3730e859fbba6\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/5ad394f105e447982d7ba0063b9395222faec86c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/5ad394f105e447982d7ba0063b9395222faec86c"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}