)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"change_message_id":"e4c44675f0afbd33fa48b1fb1de832898b432d67","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"30673caa_10f88625","updated":"2026-10-28 08:51:41.000000000","message":"It appears _cred-clean.py.tpl was mostly copied from helm-toolkit/templates/scripts/_db-drop.py.tpl years ago.\nThe Job injects the root credentials which aren\u0027t used, so I would get ride of it.\nInstead of manually parsing the conf file, I suggests using oslo_config to load the configs. As an example, this script was refactored to use oslo_config: https://opendev.org/openstack/openstack-helm/src/branch/master/nova/templates/bin/_health-probe.py.tpl\nWe can then get ride of a lot of logic for OPENSTACK_CONFIG_FILE, OPENSTACK_CONFIG_DB_SECTION, OPENSTACK_CONFIG_DB_KEY.","commit_id":"25242f03fac5ef499b9dc5fc3fbd81373014c610"},{"author":{"_account_id":20248,"name":"Jaymes Mosher","email":"jmosher@mirantis.com","username":"jmosher"},"change_message_id":"44a62097848c48af13e74a0775f7a3a629dbf38e","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"59985cc3_de347461","in_reply_to":"30673caa_10f88625","updated":"2026-10-29 17:10:21.000000000","message":"I was on the fence about just refactoring the script or not, but you\u0027re right, it\u0027s a good idea.  Do you think I can remove those env vars, and the $dbToClean logic, completely then?  We already hardcode keystone.conf many other places","commit_id":"25242f03fac5ef499b9dc5fc3fbd81373014c610"}],"keystone/templates/bin/_cred-clean.py.tpl":[{"author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"change_message_id":"3b1b704f059b5317de09e20c9397836fa55cb01b","unresolved":true,"context_lines":[{"line_number":19,"context_line":"from sqlalchemy import text"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"from oslo_config import cfg"},{"line_number":22,"context_line":"from oslo_db import options as oslo_db_options"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"# Create logger, console handler and formatter"}],"source_content_type":"text/x-smarty","patch_set":4,"id":"b0a00370_55dd405a","line":22,"updated":"2026-11-05 18:49:38.000000000","message":"This is going to fail on the openstack-client image. We first need to install oslo.db into the image.","commit_id":"a66517fc37903d509e5a38eb89da84393b4d6dcc"}],"keystone/templates/job-credential-cleanup.yaml":[{"author":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"change_message_id":"e4c44675f0afbd33fa48b1fb1de832898b432d67","unresolved":true,"context_lines":[{"line_number":21,"context_line":"{{- $configMapEtc :\u003d \"keystone-etc\" -}}"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"{{- $dbToClean :\u003d dict }}"},{"line_number":24,"context_line":"{{- if kindIs \"invalid\" .Values.conf.keystone.database.connection -}}"},{"line_number":25,"context_line":"{{- $dbToClean \u003d index . \"dbToClean\" | default ( dict \"adminSecret\" $envAll.Values.secrets.oslo_db.admin \"configFile\" (printf \"/etc/%s/%s.conf.d/%s.conf\" $serviceName $serviceName \"database\" ) \"logConfigFile\" (printf \"/etc/%s/logging.conf\" $serviceName ) \"configDbSection\" \"database\" \"configDbKey\" \"connection\" \"inputType\" \"oslo-snippet\" ) -}}"},{"line_number":26,"context_line":"{{- else -}}"},{"line_number":27,"context_line":"{{- $dbToClean \u003d index . \"dbToClean\" | default ( dict \"adminSecret\" $envAll.Values.secrets.oslo_db.admin \"configFile\" (printf \"/etc/%s/%s.conf\" $serviceName $serviceName ) \"logConfigFile\" (printf \"/etc/%s/logging.conf\" $serviceName ) \"configDbSection\" \"database\" \"configDbKey\" \"connection\" ) -}}"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"bf4fee7f_d5fb25d1","line":24,"updated":"2026-10-28 08:51:41.000000000","message":"I suggest using $envAll.Values for consistencies with the rest in this template.","commit_id":"25242f03fac5ef499b9dc5fc3fbd81373014c610"},{"author":{"_account_id":20248,"name":"Jaymes Mosher","email":"jmosher@mirantis.com","username":"jmosher"},"change_message_id":"76fd67b1d2c2ba5d4f5edc8ef9e33afc66965bea","unresolved":false,"context_lines":[{"line_number":21,"context_line":"{{- $configMapEtc :\u003d \"keystone-etc\" -}}"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"{{- $dbToClean :\u003d dict }}"},{"line_number":24,"context_line":"{{- if kindIs \"invalid\" .Values.conf.keystone.database.connection -}}"},{"line_number":25,"context_line":"{{- $dbToClean \u003d index . \"dbToClean\" | default ( dict \"adminSecret\" $envAll.Values.secrets.oslo_db.admin \"configFile\" (printf \"/etc/%s/%s.conf.d/%s.conf\" $serviceName $serviceName \"database\" ) \"logConfigFile\" (printf \"/etc/%s/logging.conf\" $serviceName ) \"configDbSection\" \"database\" \"configDbKey\" \"connection\" \"inputType\" \"oslo-snippet\" ) -}}"},{"line_number":26,"context_line":"{{- else -}}"},{"line_number":27,"context_line":"{{- $dbToClean \u003d index . \"dbToClean\" | default ( dict \"adminSecret\" $envAll.Values.secrets.oslo_db.admin \"configFile\" (printf \"/etc/%s/%s.conf\" $serviceName $serviceName ) \"logConfigFile\" (printf \"/etc/%s/logging.conf\" $serviceName ) \"configDbSection\" \"database\" \"configDbKey\" \"connection\" ) -}}"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"717535f1_a3ca7737","line":24,"in_reply_to":"bf4fee7f_d5fb25d1","updated":"2026-10-29 18:19:12.000000000","message":"Done","commit_id":"25242f03fac5ef499b9dc5fc3fbd81373014c610"},{"author":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"change_message_id":"e4c44675f0afbd33fa48b1fb1de832898b432d67","unresolved":true,"context_lines":[{"line_number":26,"context_line":"{{- else -}}"},{"line_number":27,"context_line":"{{- $dbToClean \u003d index . \"dbToClean\" | default ( dict \"adminSecret\" $envAll.Values.secrets.oslo_db.admin \"configFile\" (printf \"/etc/%s/%s.conf\" $serviceName $serviceName ) \"logConfigFile\" (printf \"/etc/%s/logging.conf\" $serviceName ) \"configDbSection\" \"database\" \"configDbKey\" \"connection\" ) -}}"},{"line_number":28,"context_line":"{{- end -}}"},{"line_number":29,"context_line":"{{- $etcSources :\u003d .Values.pod.etcSources.keystone_credential_cleanup -}}"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"{{ tuple $envAll \"credential_cleanup\" $serviceName | include \"helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount\" }}"},{"line_number":32,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"bb6c28d1_ae7cd6e5","line":29,"updated":"2026-10-28 08:51:41.000000000","message":"You should add an override in values_overrides/keystone/mariadb-crd.yaml to exercise the code:\n```\n    keystone_credential_cleanup:\n      - secret:\n          name: keystone-db-conn\n```","commit_id":"25242f03fac5ef499b9dc5fc3fbd81373014c610"},{"author":{"_account_id":20248,"name":"Jaymes Mosher","email":"jmosher@mirantis.com","username":"jmosher"},"change_message_id":"76fd67b1d2c2ba5d4f5edc8ef9e33afc66965bea","unresolved":false,"context_lines":[{"line_number":26,"context_line":"{{- else -}}"},{"line_number":27,"context_line":"{{- $dbToClean \u003d index . \"dbToClean\" | default ( dict \"adminSecret\" $envAll.Values.secrets.oslo_db.admin \"configFile\" (printf \"/etc/%s/%s.conf\" $serviceName $serviceName ) \"logConfigFile\" (printf \"/etc/%s/logging.conf\" $serviceName ) \"configDbSection\" \"database\" \"configDbKey\" \"connection\" ) -}}"},{"line_number":28,"context_line":"{{- end -}}"},{"line_number":29,"context_line":"{{- $etcSources :\u003d .Values.pod.etcSources.keystone_credential_cleanup -}}"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"{{ tuple $envAll \"credential_cleanup\" $serviceName | include \"helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount\" }}"},{"line_number":32,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"cfc0e44a_d5ac18d7","line":29,"in_reply_to":"bb6c28d1_ae7cd6e5","updated":"2026-10-29 18:19:12.000000000","message":"Done","commit_id":"25242f03fac5ef499b9dc5fc3fbd81373014c610"},{"author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"change_message_id":"3b1b704f059b5317de09e20c9397836fa55cb01b","unresolved":true,"context_lines":[{"line_number":20,"context_line":"{{- $configMapBin :\u003d \"keystone-bin\" -}}"},{"line_number":21,"context_line":"{{- $configMapEtc :\u003d \"keystone-etc\" -}}"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"{{- $etcSources :\u003d $envAll.Values.pod.etcSources.keystone_credential_cleanup -}}"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"{{ tuple $envAll \"credential_cleanup\" $serviceName | include \"helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount\" }}"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"e7151021_79006f1d","line":23,"updated":"2026-11-05 18:49:38.000000000","message":"Since f4a3524c Mariadb CRs are rendered by default and the DB clients must mount credential secret. See for example https://opendev.org/openstack/openstack-helm/src/branch/master/keystone/templates/deployment-api.yaml#L31-L34 The secret is appended to etcSources.","commit_id":"a66517fc37903d509e5a38eb89da84393b4d6dcc"}]}