)]}'
{"id":"openstack%2Fopenstack-helm~991719","triplet_id":"openstack%2Fopenstack-helm~master~Iffd31030c674e7f9d43ec33a332c90ef459c766a","project":"openstack/openstack-helm","branch":"master","topic":"mariadb-client-cert-tls","attention_set":{"3009":{"account":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"last_update":"2026-06-05 02:22:35.000000000","reason":"Someone else replied on the change"}},"removed_from_attention_set":{"34520":{"account":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},"last_update":"2026-06-08 21:03:47.000000000","reason":"\u003cGERRIT_ACCOUNT_34520\u003e replied on the change","reason_account":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"}}},"hashtags":[],"change_id":"Iffd31030c674e7f9d43ec33a332c90ef459c766a","subject":"Use a dedicated client certificate for MariaDB TLS connections","status":"NEW","created":"2026-06-04 18:49:16.000000000","updated":"2026-06-08 22:35:46.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"9bf3e160879b7f196c0997f65d8d6591a40aafb8","_number":991719,"virtual_id_number":991719,"owner":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},{"tag":"autogenerated:zuul:check","value":1,"date":"2026-06-08 22:35:46.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},"all":[{"value":2,"date":"2026-06-08 21:03:47.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"}],"CC":[{"_account_id":28237,"name":"att-airship-ci","email":"airship.jenkins@gmail.com","username":"ATT-airship-CI"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-06-04 18:49:28.000000000","updated_by":{"_account_id":28237,"name":"att-airship-ci","email":"airship.jenkins@gmail.com","username":"ATT-airship-CI"},"reviewer":{"_account_id":28237,"name":"att-airship-ci","email":"airship.jenkins@gmail.com","username":"ATT-airship-CI"},"state":"CC"},{"updated":"2026-06-04 19:37:01.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-06-08 19:44:00.000000000","updated_by":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},"reviewer":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},"state":"REVIEWER"}],"messages":[{"id":"e43f14b659fa88dbd6a7d4e6dcc15d060b302b89","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-06-04 18:49:16.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"6d39a6b3d9aa6625240a3343592dec33fae76cb4","tag":"autogenerated:jenkins-gerrit-trigger","author":{"_account_id":28237,"name":"att-airship-ci","email":"airship.jenkins@gmail.com","username":"ATT-airship-CI"},"date":"2026-06-04 18:49:28.000000000","message":"Patch Set 1:\n\nBuild Started","accounts_in_message":[],"_revision_number":1},{"id":"43dd9b67a6eb619133c8d7df018dab14fc80f775","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-04 19:37:01.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/daae153864ab488b84c6c51481c6cadd\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/6beb8c9525904b9bb8f9cf53645a307a : SUCCESS in 4m 04s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/1a24bbe51251476eb2aaaf7f82f7b71d : SUCCESS in 3m 09s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/2f01ee87e2b84a9a8c36a66dd65b16cd : FAILURE in 2m 56s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/43f693f5fd3d48b1b93e1069d5fa38ad : SUCCESS in 2m 44s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/65cfc31bf4d94fa58a9e01b4790695a7 : SUCCESS in 39m 16s\n- openstack-helm-cinder-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/07808e4fe6ea462d87530c26dac7cd23 : SUCCESS in 29m 32s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/02774dcc53494c6cb6cc3fb32d51cf94 : SUCCESS in 45m 50s\n- openstack-helm-compute-kit-tls-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/fa09325fefca4a5aaadaa1bddd3e450b : FAILURE in 30m 31s","accounts_in_message":[],"_revision_number":1},{"id":"c5b3725be7a0b5819a48391e1447201b74a9fe69","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-06-05 02:14:59.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"36eb4a819a508c173be20d68bdacbb2c770d3c5d","tag":"autogenerated:jenkins-gerrit-trigger","author":{"_account_id":28237,"name":"att-airship-ci","email":"airship.jenkins@gmail.com","username":"ATT-airship-CI"},"date":"2026-06-05 02:15:10.000000000","message":"Patch Set 2:\n\nBuild Started","accounts_in_message":[],"_revision_number":2},{"id":"82dcd080ccaa0105cff2bb41b52023e0ae74f92f","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-06-05 02:22:23.000000000","message":"Uploaded patch set 3: New patch set was added with same tree, parent tree, and commit message as Patch Set 2.","accounts_in_message":[],"_revision_number":3},{"id":"713fd2570ee22490360e13152eb841588b545b7f","tag":"autogenerated:jenkins-gerrit-trigger","author":{"_account_id":28237,"name":"att-airship-ci","email":"airship.jenkins@gmail.com","username":"ATT-airship-CI"},"date":"2026-06-05 02:22:35.000000000","message":"Patch Set 3:\n\nBuild Started","accounts_in_message":[],"_revision_number":3},{"id":"b50a1ad88d45f539bf7dc8a84e50bb371e0346d7","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-06-05 03:34:45.000000000","message":"Uploaded patch set 4.","accounts_in_message":[],"_revision_number":4},{"id":"3de2bcc96c7dc9e62da540773de400908889d5ca","tag":"autogenerated:jenkins-gerrit-trigger","author":{"_account_id":28237,"name":"att-airship-ci","email":"airship.jenkins@gmail.com","username":"ATT-airship-CI"},"date":"2026-06-05 03:34:55.000000000","message":"Patch Set 4:\n\nBuild Started","accounts_in_message":[],"_revision_number":4},{"id":"db48edb7794ffb03812f2544796e12a1030b1384","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-06-05 04:21:06.000000000","message":"Uploaded patch set 5.","accounts_in_message":[],"_revision_number":5},{"id":"a288881d3340af240ebe1c18ba560a36fc689fe0","tag":"autogenerated:jenkins-gerrit-trigger","author":{"_account_id":28237,"name":"att-airship-ci","email":"airship.jenkins@gmail.com","username":"ATT-airship-CI"},"date":"2026-06-05 04:21:15.000000000","message":"Patch Set 5:\n\nBuild Started","accounts_in_message":[],"_revision_number":5},{"id":"b54db966f643a7ab2cafa04498ab292f6d25626e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-06-05 04:44:59.000000000","message":"Uploaded patch set 6.","accounts_in_message":[],"_revision_number":6},{"id":"fee66dbc531362006d269db56896f83e096cbc20","tag":"autogenerated:jenkins-gerrit-trigger","author":{"_account_id":28237,"name":"att-airship-ci","email":"airship.jenkins@gmail.com","username":"ATT-airship-CI"},"date":"2026-06-05 04:45:10.000000000","message":"Patch Set 6:\n\nBuild Started","accounts_in_message":[],"_revision_number":6},{"id":"648b520c3223cfdc875967d97e3a5ac53dde57f6","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-06-05 05:26:04.000000000","message":"Uploaded patch set 7.","accounts_in_message":[],"_revision_number":7},{"id":"76f55964e3d7c588aea65157acbc903afc767f68","tag":"autogenerated:jenkins-gerrit-trigger","author":{"_account_id":28237,"name":"att-airship-ci","email":"airship.jenkins@gmail.com","username":"ATT-airship-CI"},"date":"2026-06-05 05:26:16.000000000","message":"Patch Set 7:\n\nBuild Started","accounts_in_message":[],"_revision_number":7},{"id":"ed229aa667ea58a6706b6b90b3d70bed2accc0ce","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-05 06:28:15.000000000","message":"Patch Set 7: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/089419b9f92343dab8beb23d0a47c854\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/5ea485abc6f24156979538e65aaa5173 : SUCCESS in 3m 17s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/a16f7f9a5ab448c9b98d153e91451844 : SUCCESS in 6m 15s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/7b91e5aa5a1d4271bec82760d907e988 : SUCCESS in 3m 34s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/d7ca864edacf4e6fb3d6e3b56def966a : SUCCESS in 2m 46s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/3e25b33e128146039788493829cbbf31 : SUCCESS in 16m 02s\n- openstack-helm-cinder-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/a7f468612f3247d8acb0e1d9c190de80 : SUCCESS in 27m 39s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/1328bf79575148c49929377dfc5b5087 : SUCCESS in 1h 00m 14s\n- openstack-helm-compute-kit-tls-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/4576ed5d931f4078ae120e9b2c294097 : SUCCESS in 54m 20s","accounts_in_message":[],"_revision_number":7},{"id":"2116f466397ab9d616c5ab8f51b692f76e5a0636","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-06-05 22:08:31.000000000","message":"Uploaded patch set 8.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":8},{"id":"09a22bc7bafc19c992a905231d95d8438dd14d79","tag":"autogenerated:jenkins-gerrit-trigger","author":{"_account_id":28237,"name":"att-airship-ci","email":"airship.jenkins@gmail.com","username":"ATT-airship-CI"},"date":"2026-06-05 22:08:42.000000000","message":"Patch Set 8:\n\nBuild Started","accounts_in_message":[],"_revision_number":8},{"id":"4c836ceed4cb6d95af604bc32ee75b80fae867f6","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-05 23:26:48.000000000","message":"Patch Set 8: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/7d16d555d6844fdfaedc80ac615b4440\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/fd6a7500b19c43fcbf3eb729541a554f : SUCCESS in 3m 22s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/157dedc8bb384d5583f958201e68ed19 : SUCCESS in 3m 15s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/de81fd1a9ba6427980fa64aab800899a : SUCCESS in 3m 25s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/7c15edc9d1f842ad973cba900ce72bb6 : SUCCESS in 2m 32s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/0957ba5732ea4621bbc7c8737b495dac : SUCCESS in 38m 03s\n- openstack-helm-cinder-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/1117bf1b0fb24d2f8ce6073427ada4b1 : SUCCESS in 45m 57s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/36ae003a51064fe7ab062126253a2598 : SUCCESS in 1h 12m 49s\n- openstack-helm-compute-kit-tls-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/1cbb047e665b405ea008a5df09be7e7b : SUCCESS in 44m 59s","accounts_in_message":[],"_revision_number":8},{"id":"51a69fc33390b8fb88100732fcbecc3edf903be1","author":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},"date":"2026-06-08 19:44:00.000000000","message":"Patch Set 8: Code-Review+2","accounts_in_message":[],"_revision_number":8},{"id":"8fc68ad521557ca0215db040f4bbdae6d4e757b4","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"date":"2026-06-08 20:59:29.000000000","message":"Uploaded patch set 9.\n\nOutdated Votes:\n* Code-Review+2 (copy condition: \"changekind:TRIVIAL_REBASE OR is:MIN\")\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":9},{"id":"b5b6ea7593b166abb202d6dcb25acf2ea8d034b5","tag":"autogenerated:jenkins-gerrit-trigger","author":{"_account_id":28237,"name":"att-airship-ci","email":"airship.jenkins@gmail.com","username":"ATT-airship-CI"},"date":"2026-06-08 20:59:39.000000000","message":"Patch Set 9:\n\nBuild Started","accounts_in_message":[],"_revision_number":9},{"id":"7c8f0eb231be30bbad53f9fc7a6f163709d91104","author":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"},"date":"2026-06-08 21:03:47.000000000","message":"Patch Set 9: Code-Review+2","accounts_in_message":[],"_revision_number":9},{"id":"9bf3e160879b7f196c0997f65d8d6591a40aafb8","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-08 22:35:46.000000000","message":"Patch Set 9: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/744a0e77628342f08f85663e5de39231\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/4fcc8a64194f498c9ff6e95854c3e3c4 : SUCCESS in 3m 42s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/7e435dd173ac4b40b61e2a38e5c2637d : SUCCESS in 3m 06s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/df1ff3ffa0054941a08da4a74f7ff3dd : SUCCESS in 2m 22s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/26a40d60d93f4572a133e490b94681c0 : SUCCESS in 2m 07s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/803f3c46a46c4b6ab5292bfbe02c1579 : SUCCESS in 26m 16s\n- openstack-helm-cinder-2025-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/6e4f2ce2ade54f6ab3db2e764a3b6634 : SUCCESS in 26m 17s\n- openstack-helm-compute-kit-2025-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/a23d1a6c364a4afa8bd3847329b59068 : SUCCESS in 1h 14m 27s\n- openstack-helm-cinder-2025-2-ubuntu_noble https://zuul.opendev.org/t/openstack/build/b18091f4533f40b69e954adbffaf8f9f : SUCCESS in 37m 14s\n- openstack-helm-compute-kit-2025-2-ubuntu_noble https://zuul.opendev.org/t/openstack/build/ecab17531a8b4a9c95a60a68945f375f : SUCCESS in 44m 29s\n- openstack-helm-cinder-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/c92e6d1827734316b7eab0019a6536a1 : SUCCESS in 45m 15s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/167c4a7884e8471c9d64159a27e95d2d : SUCCESS in 1h 12m 06s\n- openstack-helm-compute-kit-tls-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/f6b3e11a567344608fb72d1ebebc58f2 : SUCCESS in 1h 15m 17s\n- openstack-helm-compute-kit-ovn-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/b404aea5d67043fc9707035296c7b8cb : SUCCESS in 44m 34s\n- openstack-helm-compute-kit-dpdk-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/47ccae3f77e54978a011b9381fd01477 : SUCCESS in 56m 08s\n- openstack-helm-octavia-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/b0ef118a25bd4e4d9dcc6346d6c05456 : SUCCESS in 48m 22s\n- openstack-helm-blazar-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/d10bf06f4ab34278b8a4d75112959b94 : SUCCESS in 57m 12s\n- openstack-helm-freezer-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/b407124eb8134fdabeaa809fb62e54ae : SUCCESS in 27m 57s\n- openstack-helm-horizon-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/ee3610c19107403582caa1b3fa8489fd : SUCCESS in 20m 32s\n- openstack-helm-manila-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/7f7d350c30ac4ae49588a37aebd099ae : SUCCESS in 1h 28m 13s\n- openstack-helm-zaqar-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/30ce71db94594bfe88f767749c1e2baa : SUCCESS in 24m 01s\n- openstack-helm-logging https://zuul.opendev.org/t/openstack/build/3537c003f79c43bf8912c9fce686b206 : SUCCESS in 32m 11s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/2c5c47a90c9444ceabd5af6edbad3ba5 : SUCCESS in 28m 49s","accounts_in_message":[],"_revision_number":9}],"current_revision_number":9,"current_revision":"72bc3884dff60cf56fa1320e98331fb96387af75","revisions":{"cd8f3f64fda80efdca8bef64f088b5e0b5864a56":{"kind":"REWORK","_number":1,"created":"2026-06-04 18:49:16.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/19/991719/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/19/991719/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/1"}}},"commit":{"parents":[{"commit":"d3fa14f5129df62a449dd466f0f09e99bf5c291f","subject":"Merge \"[manila] Add optional StatefulSet for manila-share\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d3fa14f5129df62a449dd466f0f09e99bf5c291f"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-04 17:01:55.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-04 18:49:08.000000000","tz":-300},"subject":"Use a dedicated client certificate for MariaDB TLS connections","message":"Use a dedicated client certificate for MariaDB TLS connections\n\nCharts that terminate TLS to MariaDB reused the MariaDB server\ncertificate on the client side. Render and use a dedicated client\ncertificate instead, and gate the MariaDB connection TLS on the\ntls.oslo_db value so it can be enabled independently of the API TLS.\n\nApplied to keystone and the charts that previously mounted the server\ncertificate as a client certificate: barbican, blazar, cinder, freezer,\nglance, heat, horizon, manila, neutron, nova, placement, zaqar. The\nexisting tls.yaml value overrides are updated to configure the client\ncertificate and enable tls.oslo_db.\n\nThe helm-toolkit mysql db-init and db-drop manifests now gate the client\ncertificate mount and the REQUIRE X509 grant on tls.oslo_db as well.\n\nChange-Id: Iffd31030c674e7f9d43ec33a332c90ef459c766a\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/cd8f3f64fda80efdca8bef64f088b5e0b5864a56"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/cd8f3f64fda80efdca8bef64f088b5e0b5864a56"}]},"branch":"refs/heads/master"},"4bd125ffb20d83cb1a208b696bb8b281abe954d0":{"kind":"REWORK","_number":2,"created":"2026-06-05 02:14:59.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/19/991719/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/19/991719/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/2"}}},"commit":{"parents":[{"commit":"d3fa14f5129df62a449dd466f0f09e99bf5c291f","subject":"Merge \"[manila] Add optional StatefulSet for manila-share\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d3fa14f5129df62a449dd466f0f09e99bf5c291f"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-04 17:01:55.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-05 02:07:09.000000000","tz":-300},"subject":"Use a dedicated client certificate for MariaDB TLS connections","message":"Use a dedicated client certificate for MariaDB TLS connections\n\nCharts that terminate TLS to MariaDB reused the MariaDB server\ncertificate on the client side. Render and use a dedicated client\ncertificate instead, and gate the MariaDB connection TLS on the\ntls.oslo_db value so it can be enabled independently of the API TLS.\n\nApplied to keystone and the charts that previously mounted the server\ncertificate as a client certificate: barbican, blazar, cinder, freezer,\nglance, heat, horizon, manila, neutron, nova, placement, zaqar. The\nexisting tls.yaml value overrides are updated to configure the client\ncertificate and enable tls.oslo_db.\n\nThe helm-toolkit mysql db-init and db-drop manifests now gate the client\ncertificate mount and the REQUIRE X509 grant on tls.oslo_db as well.\n\nChange-Id: Iffd31030c674e7f9d43ec33a332c90ef459c766a\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/4bd125ffb20d83cb1a208b696bb8b281abe954d0"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/4bd125ffb20d83cb1a208b696bb8b281abe954d0"}]},"branch":"refs/heads/master"},"279809e8ffae40cb56c10f3c6d516f62fa45f6da":{"kind":"NO_CHANGE","_number":3,"created":"2026-06-05 02:22:23.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/19/991719/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/19/991719/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/3"}}},"commit":{"parents":[{"commit":"d3fa14f5129df62a449dd466f0f09e99bf5c291f","subject":"Merge \"[manila] Add optional StatefulSet for manila-share\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d3fa14f5129df62a449dd466f0f09e99bf5c291f"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-05 02:22:22.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-05 02:22:22.000000000","tz":-300},"subject":"Use a dedicated client certificate for MariaDB TLS connections","message":"Use a dedicated client certificate for MariaDB TLS connections\n\nCharts that terminate TLS to MariaDB reused the MariaDB server\ncertificate on the client side. Render and use a dedicated client\ncertificate instead, and gate the MariaDB connection TLS on the\ntls.oslo_db value so it can be enabled independently of the API TLS.\n\nApplied to keystone and the charts that previously mounted the server\ncertificate as a client certificate: barbican, blazar, cinder, freezer,\nglance, heat, horizon, manila, neutron, nova, placement, zaqar. The\nexisting tls.yaml value overrides are updated to configure the client\ncertificate and enable tls.oslo_db.\n\nThe helm-toolkit mysql db-init and db-drop manifests now gate the client\ncertificate mount and the REQUIRE X509 grant on tls.oslo_db as well.\n\nChange-Id: Iffd31030c674e7f9d43ec33a332c90ef459c766a\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/279809e8ffae40cb56c10f3c6d516f62fa45f6da"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/279809e8ffae40cb56c10f3c6d516f62fa45f6da"}]},"branch":"refs/heads/master"},"111c7bc779cc44a736568ecd4b3ca7dba15441aa":{"kind":"REWORK","_number":4,"created":"2026-06-05 03:34:45.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/19/991719/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/19/991719/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/4"}}},"commit":{"parents":[{"commit":"d3fa14f5129df62a449dd466f0f09e99bf5c291f","subject":"Merge \"[manila] Add optional StatefulSet for manila-share\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d3fa14f5129df62a449dd466f0f09e99bf5c291f"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-05 02:22:22.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-05 03:34:37.000000000","tz":-300},"subject":"Use a dedicated client certificate for MariaDB TLS connections","message":"Use a dedicated client certificate for MariaDB TLS connections\n\nCharts that terminate TLS to MariaDB reused the MariaDB server\ncertificate on the client side. Render and use a dedicated client\ncertificate instead, and gate the MariaDB connection TLS on the\ntls.oslo_db value so it can be enabled independently of the API TLS.\n\nApplied to keystone and the charts that previously mounted the server\ncertificate as a client certificate: barbican, blazar, cinder, freezer,\nglance, heat, horizon, manila, neutron, nova, placement, zaqar. The\nexisting tls.yaml value overrides are updated to configure the client\ncertificate and enable tls.oslo_db.\n\nThe helm-toolkit mysql db-init and db-drop manifests now gate the client\ncertificate mount and the REQUIRE X509 grant on tls.oslo_db as well.\n\nEnable MariaDB server-side TLS in the gate via\nvalues_overrides/mariadb/mariadb-tls.yaml so the compute-kit-tls job\ndeploys MariaDB with a server certificate; otherwise services that\nrequire client TLS cannot complete the handshake.\n\nChange-Id: Iffd31030c674e7f9d43ec33a332c90ef459c766a\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/111c7bc779cc44a736568ecd4b3ca7dba15441aa"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/111c7bc779cc44a736568ecd4b3ca7dba15441aa"}]},"branch":"refs/heads/master"},"6cc07742dcbac52de119b5849bae0d6af58d0427":{"kind":"REWORK","_number":5,"created":"2026-06-05 04:21:06.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/19/991719/5","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/19/991719/5","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/5 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/5 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/5 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/5"}}},"commit":{"parents":[{"commit":"d3fa14f5129df62a449dd466f0f09e99bf5c291f","subject":"Merge \"[manila] Add optional StatefulSet for manila-share\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d3fa14f5129df62a449dd466f0f09e99bf5c291f"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-05 02:22:22.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-05 04:21:04.000000000","tz":-300},"subject":"Use a dedicated client certificate for MariaDB TLS connections","message":"Use a dedicated client certificate for MariaDB TLS connections\n\nCharts that terminate TLS to MariaDB reused the MariaDB server\ncertificate on the client side. Render and use a dedicated client\ncertificate instead, and gate the MariaDB connection TLS on the\ntls.oslo_db value so it can be enabled independently of the API TLS.\n\nApplied to keystone and the charts that previously mounted the server\ncertificate as a client certificate: barbican, blazar, cinder, freezer,\nglance, heat, horizon, manila, neutron, nova, placement, zaqar. The\nexisting tls.yaml value overrides are updated to configure the client\ncertificate and enable tls.oslo_db.\n\nThe helm-toolkit mysql db-init and db-drop manifests now gate the client\ncertificate mount and the REQUIRE X509 grant on tls.oslo_db as well.\n\nEnable MariaDB server-side TLS in the gate via\nvalues_overrides/mariadb/mariadb-tls.yaml so the compute-kit-tls job\ndeploys MariaDB with a server certificate; otherwise services that\nrequire client TLS cannot complete the handshake.\n\nChange-Id: Iffd31030c674e7f9d43ec33a332c90ef459c766a\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/6cc07742dcbac52de119b5849bae0d6af58d0427"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/6cc07742dcbac52de119b5849bae0d6af58d0427"}]},"branch":"refs/heads/master"},"c016f1492e743f9c030072d23bea0299a89ed0cf":{"kind":"REWORK","_number":6,"created":"2026-06-05 04:44:59.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/19/991719/6","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/19/991719/6","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/6 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/6 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/6 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/6"}}},"commit":{"parents":[{"commit":"d3fa14f5129df62a449dd466f0f09e99bf5c291f","subject":"Merge \"[manila] Add optional StatefulSet for manila-share\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d3fa14f5129df62a449dd466f0f09e99bf5c291f"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-05 02:22:22.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-05 04:44:58.000000000","tz":-300},"subject":"Use a dedicated client certificate for MariaDB TLS connections","message":"Use a dedicated client certificate for MariaDB TLS connections\n\nCharts that terminate TLS to MariaDB reused the MariaDB server\ncertificate on the client side. Render and use a dedicated client\ncertificate instead, and gate the MariaDB connection TLS on the\ntls.oslo_db value so it can be enabled independently of the API TLS.\n\nApplied to keystone and the charts that previously mounted the server\ncertificate as a client certificate: barbican, blazar, cinder, freezer,\nglance, heat, horizon, manila, neutron, nova, placement, zaqar. The\nexisting tls.yaml value overrides are updated to configure the client\ncertificate and enable tls.oslo_db.\n\nThe helm-toolkit mysql db-init and db-drop manifests now gate the client\ncertificate mount and the REQUIRE X509 grant on tls.oslo_db as well.\n\nEnable MariaDB server-side TLS in the gate via\nvalues_overrides/mariadb/mariadb-tls.yaml so the compute-kit-tls job\ndeploys MariaDB with a server certificate; otherwise services that\nrequire client TLS cannot complete the handshake.\n\nChange-Id: Iffd31030c674e7f9d43ec33a332c90ef459c766a\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/c016f1492e743f9c030072d23bea0299a89ed0cf"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/c016f1492e743f9c030072d23bea0299a89ed0cf"}]},"branch":"refs/heads/master"},"73c5dbf3b50b4b552c02c9ae39e352bd1899347a":{"kind":"REWORK","_number":7,"created":"2026-06-05 05:26:04.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/19/991719/7","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/19/991719/7","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/7 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/7 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/7 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/7"}}},"commit":{"parents":[{"commit":"d3fa14f5129df62a449dd466f0f09e99bf5c291f","subject":"Merge \"[manila] Add optional StatefulSet for manila-share\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d3fa14f5129df62a449dd466f0f09e99bf5c291f"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-05 02:22:22.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-05 05:26:03.000000000","tz":-300},"subject":"Use a dedicated client certificate for MariaDB TLS connections","message":"Use a dedicated client certificate for MariaDB TLS connections\n\nCharts that terminate TLS to MariaDB reused the MariaDB server\ncertificate on the client side. Render and use a dedicated client\ncertificate instead, and gate the MariaDB connection TLS on the\ntls.oslo_db value so it can be enabled independently of the API TLS.\n\nApplied to keystone and the charts that previously mounted the server\ncertificate as a client certificate: barbican, blazar, cinder, freezer,\nglance, heat, horizon, manila, neutron, nova, placement, zaqar. The\nexisting tls.yaml value overrides are updated to configure the client\ncertificate and enable tls.oslo_db.\n\nThe helm-toolkit mysql db-init and db-drop manifests now gate the client\ncertificate mount and the REQUIRE X509 grant on tls.oslo_db as well.\n\nEnable MariaDB server-side TLS in the gate via\nvalues_overrides/mariadb/mariadb-tls.yaml so the compute-kit-tls job\ndeploys MariaDB with a server certificate; otherwise services that\nrequire client TLS cannot complete the handshake.\n\nChange-Id: Iffd31030c674e7f9d43ec33a332c90ef459c766a\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/73c5dbf3b50b4b552c02c9ae39e352bd1899347a"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/73c5dbf3b50b4b552c02c9ae39e352bd1899347a"}]},"branch":"refs/heads/master"},"72ac0fb8da67321816f1a9656a89c6c1e472011a":{"kind":"REWORK","_number":8,"created":"2026-06-05 22:08:31.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/19/991719/8","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/19/991719/8","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/8 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/8 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/8 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/8"}}},"commit":{"parents":[{"commit":"d3fa14f5129df62a449dd466f0f09e99bf5c291f","subject":"Merge \"[manila] Add optional StatefulSet for manila-share\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d3fa14f5129df62a449dd466f0f09e99bf5c291f"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-05 02:22:22.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-05 22:08:30.000000000","tz":-300},"subject":"Use a dedicated client certificate for MariaDB TLS connections","message":"Use a dedicated client certificate for MariaDB TLS connections\n\nCharts that terminate TLS to MariaDB reused the MariaDB server\ncertificate on the client side. Render and use a dedicated client\ncertificate instead, and gate the MariaDB connection TLS on the\ntls.oslo_db value so it can be enabled independently of the API TLS.\n\nApplied to keystone and the charts that previously mounted the server\ncertificate as a client certificate: barbican, blazar, cinder, freezer,\nglance, heat, horizon, manila, neutron, nova, placement, zaqar. The\nexisting tls.yaml value overrides are updated to configure the client\ncertificate and enable tls.oslo_db.\n\nThe helm-toolkit mysql db-init and db-drop manifests now gate the client\ncertificate mount and the REQUIRE X509 grant on tls.oslo_db as well.\n\nEnable MariaDB server-side TLS in the gate via\nvalues_overrides/mariadb/mariadb-tls.yaml so the compute-kit-tls job\ndeploys MariaDB with a server certificate; otherwise services that\nrequire client TLS cannot complete the handshake.\n\nChange-Id: Iffd31030c674e7f9d43ec33a332c90ef459c766a\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/72ac0fb8da67321816f1a9656a89c6c1e472011a"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/72ac0fb8da67321816f1a9656a89c6c1e472011a"}]},"branch":"refs/heads/master"},"72bc3884dff60cf56fa1320e98331fb96387af75":{"kind":"REWORK","_number":9,"created":"2026-06-08 20:59:29.000000000","uploader":{"_account_id":3009,"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","username":"kozhukalov"},"ref":"refs/changes/19/991719/9","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/19/991719/9","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/9 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/9 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/9 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/19/991719/9"}}},"commit":{"parents":[{"commit":"d3fa14f5129df62a449dd466f0f09e99bf5c291f","subject":"Merge \"[manila] Add optional StatefulSet for manila-share\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/d3fa14f5129df62a449dd466f0f09e99bf5c291f"}]}],"author":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-05 02:22:22.000000000","tz":-300},"committer":{"name":"Vladimir Kozhukalov","email":"kozhukalov@gmail.com","date":"2026-06-08 20:53:58.000000000","tz":-300},"subject":"Use a dedicated client certificate for MariaDB TLS connections","message":"Use a dedicated client certificate for MariaDB TLS connections\n\nCharts that terminate TLS to MariaDB reused the MariaDB server\ncertificate on the client side. Render and use a dedicated client\ncertificate instead, and gate the MariaDB connection TLS on the\ntls.oslo_db value so it can be enabled independently of the API TLS.\n\nApplied to keystone and the charts that previously mounted the server\ncertificate as a client certificate: barbican, blazar, cinder, freezer,\nglance, heat, horizon, manila, neutron, nova, placement, zaqar. The\nexisting tls.yaml value overrides are updated to configure the client\ncertificate and enable tls.oslo_db.\n\nThe helm-toolkit mysql db-init and db-drop manifests now gate the client\ncertificate mount and the REQUIRE X509 grant on tls.oslo_db as well.\n\nEnable MariaDB server-side TLS in the gate via\nvalues_overrides/mariadb/mariadb-tls.yaml so the compute-kit-tls job\ndeploys MariaDB with a server certificate; otherwise services that\nrequire client TLS cannot complete the handshake.\n\nChange-Id: Iffd31030c674e7f9d43ec33a332c90ef459c766a\nSigned-off-by: Vladimir Kozhukalov \u003ckozhukalov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/72bc3884dff60cf56fa1320e98331fb96387af75"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/72bc3884dff60cf56fa1320e98331fb96387af75"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":34520,"name":"Sergiy Markin","email":"smarkin@mirantis.com","username":"sm515x"}},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}