)]}'
{"id":"openstack%2Fopenstack-helm~1015455","triplet_id":"openstack%2Fopenstack-helm~master~Ie43eaf4ed7eec2d8dfb013bc4e8709c06418c68b","project":"openstack/openstack-helm","branch":"master","topic":"cinder-rootwrap-cleanup","attention_set":{},"removed_from_attention_set":{"3009":{"account":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"last_update":"2026-11-13 20:02:44.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Ie43eaf4ed7eec2d8dfb013bc4e8709c06418c68b","subject":"cinder: Use the rootwrap filters from the image","status":"MERGED","created":"2026-11-12 19:56:18.000000000","updated":"2026-11-13 20:04:37.000000000","submitted":"2026-11-13 20:02:44.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1015455-cinder-rootwrap-cleanup","meta_rev_id":"0017b74cea1ff4148f0c834e80eda8a307b4f92f","_number":1015455,"virtual_id_number":1015455,"owner":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"value":0,"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-11-13 20:02:44.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"all":[{"value":2,"date":"2026-11-13 02:20:29.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"value":2,"date":"2026-11-13 17:46:15.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},"all":[{"value":0,"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"value":1,"date":"2026-11-13 17:46:15.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-11-12 22:06:06.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-11-13 02:20:29.000000000","updated_by":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"reviewer":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"state":"REVIEWER"},{"updated":"2026-11-13 17:46:15.000000000","updated_by":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},"reviewer":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},"state":"REVIEWER"}],"messages":[{"id":"df7742013d210202e8d991bbdcacac10194087ff","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-11-12 19:56:18.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"10859760058d3b2a899c618f75bbc5caa90b22b2","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-11-12 22:06:06.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/692e8508e9a144c9936252180ee8688b\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/5b64d8a0aa87441397db0c212be3ecd0 : SUCCESS in 3m 23s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/50ea68d1bee24bea8bfbdc12f7e67947 : SUCCESS in 4m 20s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/9df42cdf2fd543bea2f57d3a1caed5d5 : SUCCESS in 2m 06s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/dcf2eb11ec734fbfbeba9fcb0fe96a36 : SUCCESS in 2m 32s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/e5f7542628a142a08d30da516887eef6 : SUCCESS in 2m 02s\n- openstack-helm-compute-kit-2025-2-ubuntu_noble https://zuul.opendev.org/t/openstack/build/f90139c64fea42ff86382b7cc75b4465 : SUCCESS in 1h 16m 39s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/1706a962f4fb4906bf626989afb44657 : SUCCESS in 1h 53m 59s\n- openstack-helm-tls-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/c3a8c153ef114d61b690e4112aa4bc3d : SUCCESS in 2h 04m 41s\n- openstack-helm-crd-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/83a22162e2f64353ae48ad4d24fbfedb : SUCCESS in 1h 35m 08s\n- openstack-helm-operators-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/c6abed36e6b447bb8c00872720d3507c : SUCCESS in 1h 48m 45s\n- openstack-helm-compute-kit-2026-2-ubuntu_resolute https://zuul.opendev.org/t/openstack/build/0b9a7634846642ef972b090acb64e9df : SUCCESS in 1h 20m 39s","accounts_in_message":[],"_revision_number":1},{"id":"e227056a8ab974c31277ca651a6807dcd5ca6622","author":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"date":"2026-11-13 02:20:29.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"77d9d4048a74d3595a1d8cb92dd6b096c1368b7c","author":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},"date":"2026-11-13 17:46:15.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"53ad291a83dd92e73a4b79d9f5c53838e406ad4a","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-11-13 17:48:47.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"402c1936346c2b65c3fc1317e3a6b0c7eef25529","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-11-13 20:02:44.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/cc7817b05f3747eca4674bf5f8798636\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/7afe076c0de54a05a9e609ed33cc3ab6 : SUCCESS in 4m 59s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/72ae99d596e14c15828b56df7c7a5957 : SUCCESS in 3m 10s\n- openstack-helm-release-notes https://zuul.opendev.org/t/openstack/build/b189282fb450459bbe288b488ef463a0 : SUCCESS in 1m 50s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/43be7126c9234b26af93006375b98b64 : SUCCESS in 1h 37m 33s\n- openstack-helm-logging https://zuul.opendev.org/t/openstack/build/9ebf5d345a8f47de92e61413b3d56a48 : SUCCESS in 31m 55s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/67d347e9eec74b14950b4d7a6567bde7 : SUCCESS in 29m 09s","accounts_in_message":[],"_revision_number":1},{"id":"6662595b2782062d368e7385e7cd720018489116","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-11-13 20:02:44.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"0017b74cea1ff4148f0c834e80eda8a307b4f92f","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-11-13 20:04:37.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/3234e0cbba1b489e80386789b08b31b8\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/46553878c2234213b174908843f61a47 : SUCCESS in 47s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"c43cb82ed51062d119c052a01e45c8b1aaacb0f4","revisions":{"c43cb82ed51062d119c052a01e45c8b1aaacb0f4":{"kind":"REWORK","_number":1,"created":"2026-11-12 19:56:18.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/55/1015455/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/55/1015455/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/55/1015455/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/55/1015455/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/55/1015455/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/55/1015455/1"}}},"commit":{"parents":[{"commit":"7e771dee0d9ff5de37006529567f758f2c9b1642","subject":"Merge \"[ceph-osd] Fail pod init if CRUSH placement fails the retry loop\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/7e771dee0d9ff5de37006529567f758f2c9b1642"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-11-12 18:40:18.000000000","tz":-360},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-11-12 19:56:15.000000000","tz":-360},"subject":"cinder: Use the rootwrap filters from the image","message":"cinder: Use the rootwrap filters from the image\n\nThe default conf.rootwrap_filters.volume was an old copy of cinder\u0027s\netc/cinder/rootwrap.d/volume.filters, and rootwrap.conf loaded only\nthe chart files. Since then cinder moved most privileged commands to\noslo.privsep (targets, LVM changes, cgroups, file operations) and\nremoved many drivers (HUS, HBSD, DRBD, the TSM backup driver, AoE), so\nthe copy allowed 65 commands that cinder no longer runs through\nrootwrap, among them tee, cat, mkdir, umount and the tgt and IET\ntools. It also missed 16 commands that cinder added later. One of them\nbreaks the LVM driver: with an lvm.conf in /etc/cinder, os-brick runs\n\"env LC_ALL\u003dC LVM_SYSTEM_DIR\u003d... vgs\" and the old filters reject it.\ncryptsetup, gzip, the Quobyte mount helpers and the cinder sys_admin\nprivsep filter were missing as well.\n\nCinder installs its own filters with the code: LOCI images have them\nin /var/lib/openstack/etc/cinder/rootwrap.d and Kolla images in\n/etc/cinder/rootwrap.d. These files always match the cinder version in\nthe image, while a copy in the chart has to be updated by hand and\ndoes not fit every release the chart deploys. Add the LOCI directory\nand /usr/share/cinder/rootwrap, which cinder\u0027s own rootwrap.conf has,\nto filters_path, as the neutron chart already does, and remove the\ndefault entry from conf.rootwrap_filters. Deployers can still add\nfilter files there. Cinder\u0027s filters name the IBM GPFS commands\nwithout a path and expect /usr/lpp/mmfs/bin in exec_dirs, as cinder\u0027s\nown rootwrap.conf has it, so add that directory too. The old filters\nused full paths for these commands.\n\nThe rendered cinder-etc Secret no longer has volume.filters,\nrootwrap.conf has the new filters_path and exec_dirs, the volume pod\nno longer mounts volume.filters, and the secret-etc-hash annotations\nchange. The same differences show with the default values and with\nevery file in values_overrides/cinder except netpol.yaml, which fails\nto parse on the parent commit too. In the cinder 2026.2 image,\ncinder-rootwrap with the new rootwrap.conf and no chart filters loads\nvolume.filters from the image, accepts all four LVM command forms that\nos-brick builds and cryptsetup, and rejects tgtadm and tee. The\n2025.2 and 2026.1 cinder images have volume.filters in the same\ndirectory.\n\nA deployment that overrides conf.rootwrap keeps its own filters_path\nand gets no cinder filters at all after this change, so it must add\nthe image directory to its filters_path. An image that installs\ncinder somewhere else must put the filters into one of the\ndirectories in filters_path.\n\nChangelog: fixed: The cinder volume pod now uses the rootwrap filters that cinder installs in the image, so the LVM driver works with an lvm.conf in /etc/cinder and the filters no longer allow commands that cinder moved to privsep or removed.\nChangelog: changed: Deployments that override conf.rootwrap in the cinder chart must add /var/lib/openstack/etc/cinder/rootwrap.d (LOCI images) to filters_path, because the chart no longer ships volume.filters.\nAssisted-By: Claude Opus 5.5\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\nChange-Id: Ie43eaf4ed7eec2d8dfb013bc4e8709c06418c68b\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/c43cb82ed51062d119c052a01e45c8b1aaacb0f4"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/c43cb82ed51062d119c052a01e45c8b1aaacb0f4"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}