)]}'
{"id":"openstack%2Fopenstack-helm~997798","triplet_id":"openstack%2Fopenstack-helm~master~I352651353fad9169350a8f6e7dfb1319d491d655","project":"openstack/openstack-helm","branch":"master","hashtags":[],"change_id":"I352651353fad9169350a8f6e7dfb1319d491d655","subject":"feat(keystone): prevent deletion of fernet/credential key secrets","status":"NEW","created":"2026-07-17 22:08:06.000000000","updated":"2026-07-20 18:14:52.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":0,"unresolved_comment_count":0,"work_in_progress":true,"has_review_started":true,"meta_rev_id":"c98358380d9cd3241f09b1156f6dc0120be944ea","_number":997798,"virtual_id_number":997798,"owner":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"actions":{},"labels":{"Verified":{"disliked":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":-1,"date":"2026-07-20 18:14:52.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":-1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"reviewer_updates":[{"updated":"2026-07-17 23:54:32.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"ea3743d9e3401edf86c2679df1e125a5eba55ff2","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"date":"2026-07-17 22:08:06.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"427cfcf1c65545d20bd287bf532f8b343b043d48","tag":"autogenerated:gerrit:setWorkInProgress","author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"date":"2026-07-17 22:08:27.000000000","message":"Set Work In Progress","accounts_in_message":[],"_revision_number":1},{"id":"700919831b2a33ccc614aaf65d1d5b32647a37d8","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-17 23:54:32.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f6bc834b01004314b3d9b1b1d94a2329\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8e1730de4a62459bb4c7cbc445081c84 : SUCCESS in 3m 50s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/6cc0c2c6ac6e4e89badbf569be80b89d : SUCCESS in 3m 22s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/248c45a743664bb5bc01c9134248d370 : SUCCESS in 2m 12s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/c02e541f8c3a4fd39a4372208cd72d67 : SUCCESS in 2m 03s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/fa0a2c47e93041daa49ab6ce0aee2eec : SUCCESS in 1m 57s\n- openstack-helm-cinder-2025-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/de7d64862cd444cfa17f5da36953648e : SUCCESS in 30m 14s\n- openstack-helm-compute-kit-2025-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/9adf2a24f0a1463a999d5fd22ad61f53 : SUCCESS in 1h 12m 02s\n- openstack-helm-cinder-2025-2-ubuntu_noble https://zuul.opendev.org/t/openstack/build/07b017af51874d45816805eb4c41d3dc : SUCCESS in 45m 36s\n- openstack-helm-compute-kit-2025-2-ubuntu_noble https://zuul.opendev.org/t/openstack/build/a3b34a23e863473496001c11e6a3f433 : SUCCESS in 1h 15m 10s\n- openstack-helm-cinder-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/663b3d172b8a4f9585d8b2ffe3dd5cac : SUCCESS in 44m 36s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/14074ca1ea764dc2bfcca64b9909844c : SUCCESS in 1h 14m 45s\n- openstack-helm-tls-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/595bd9d8d8424f24a363b1018d979442 : SUCCESS in 1h 40m 18s\n- openstack-helm-octavia-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/5b41b8ebcb494f1ba7c1167ddb37f30a : SUCCESS in 1h 15m 14s\n- openstack-helm-logging https://zuul.opendev.org/t/openstack/build/24734b25f9ee4691963facf07594a450 : SUCCESS in 32m 50s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/f566cad9407c47898f35f6c078c4d5c1 : SUCCESS in 30m 06s","accounts_in_message":[],"_revision_number":1},{"id":"ebf25e58c0483215d15a4ad44677647e63a4420e","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"date":"2026-07-20 15:22:15.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"c98358380d9cd3241f09b1156f6dc0120be944ea","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-20 18:14:52.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/585827d65c994844838307a34dac729d\n\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/81aa848aa27f44b2902d0eed4a99f319 : SUCCESS in 5m 04s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/4529453923c54b079c57fc100120d717 : SUCCESS in 3m 18s\n- openstack-helm-linter https://zuul.opendev.org/t/openstack/build/dc42123dd75246609508a0f83901d180 : SUCCESS in 3m 10s\n- openstack-helm-pre-commit https://zuul.opendev.org/t/openstack/build/7bf9c8098a09402d886ec2b24913d2e6 : SUCCESS in 2m 54s\n- openstack-helm-build-charts https://zuul.opendev.org/t/openstack/build/d0823f27fbfe4e57b844ec3ad1fd9613 : SUCCESS in 3m 19s\n- openstack-helm-cinder-2025-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/e6a291c7dcf4406ca82bab404744df4a : SUCCESS in 45m 39s\n- openstack-helm-compute-kit-2025-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/68a0c5c9d71e47d0a8bc64b6c27fba23 : SUCCESS in 1h 14m 45s\n- openstack-helm-cinder-2025-2-ubuntu_noble https://zuul.opendev.org/t/openstack/build/9c38ae8d509e4ff9958b78624bdecdc8 : SUCCESS in 41m 33s\n- openstack-helm-compute-kit-2025-2-ubuntu_noble https://zuul.opendev.org/t/openstack/build/961f5b3b7c9b423bb66c3cfba4a403b3 : SUCCESS in 1h 22m 14s\n- openstack-helm-cinder-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/0e9144db9f334cecbee5c3910f78614b : SUCCESS in 47m 23s\n- openstack-helm-compute-kit-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/c108994384aa48bca3e364b8973501eb : FAILURE in 2h 46m 41s\n- openstack-helm-tls-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/b2f4e0e8170247289c07229bfc67e3ee : FAILURE in 37m 13s\n- openstack-helm-octavia-2026-1-ubuntu_noble https://zuul.opendev.org/t/openstack/build/9677029d80c44d838e66952953572900 : SUCCESS in 1h 32m 11s\n- openstack-helm-logging https://zuul.opendev.org/t/openstack/build/8ec33ee37ccc4ca4a37f7b5ffa8921a7 : SUCCESS in 44m 03s\n- openstack-helm-monitoring https://zuul.opendev.org/t/openstack/build/184f9c88054447b4bd28bdce23c2102b : SUCCESS in 25m 34s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"583eb1f11deda918e52e63fbff1dca2503309848","revisions":{"0d6b24dc0681a4d1222ba3d0ff0634b3ce507a82":{"kind":"REWORK","_number":1,"created":"2026-07-17 22:08:06.000000000","uploader":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"ref":"refs/changes/98/997798/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/98/997798/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/98/997798/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/98/997798/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/98/997798/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/98/997798/1"}}},"commit":{"parents":[{"commit":"170e670c63180b4286ff756911e2821cd679eba8","subject":"feat(keystone): allow users to set custom annotations on secrets","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/170e670c63180b4286ff756911e2821cd679eba8"}]}],"author":{"name":"Doug Goldstein","email":"cardoe@cardoe.com","date":"2026-07-17 22:00:25.000000000","tz":-300},"committer":{"name":"Doug Goldstein","email":"cardoe@cardoe.com","date":"2026-07-17 22:07:05.000000000","tz":-300},"subject":"feat(keystone): prevent deletion of fernet/credential key secrets","message":"feat(keystone): prevent deletion of fernet/credential key secrets\n\nThe keystone-fernet-keys and keystone-credential-keys secrets are\npre-install hooks annotated with helm.sh/resource-policy: keep, but set\nno helm.sh/hook-delete-policy. GitOps tools such as Argo CD re-run\npre-install hooks on every sync and, absent a delete-policy, default to\nbefore-hook-creation -- deleting and recreating the populated secret\nempty each sync. The fernet/credential setup jobs then regenerate the\nkeys, invalidating all issued tokens.\n\nSet helm.sh/hook-delete-policy: hook-failed so the kept secrets are never\ndeleted, matching the existing resource-policy: keep intent. This has no\neffect on plain Helm installs: pre-install hooks run only on install, and\na Secret hook never enters a failed state.\n\nAssisted-By: Claude Opus 4.8\nChange-Id: I352651353fad9169350a8f6e7dfb1319d491d655\nSigned-off-by: Doug Goldstein \u003ccardoe@cardoe.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/0d6b24dc0681a4d1222ba3d0ff0634b3ce507a82"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/0d6b24dc0681a4d1222ba3d0ff0634b3ce507a82"}]},"branch":"refs/heads/master"},"583eb1f11deda918e52e63fbff1dca2503309848":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-07-20 15:22:15.000000000","uploader":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"ref":"refs/changes/98/997798/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/openstack-helm","ref":"refs/changes/98/997798/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/98/997798/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/98/997798/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/openstack-helm refs/changes/98/997798/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/openstack-helm refs/changes/98/997798/2"}}},"commit":{"parents":[{"commit":"ae525e1de83f5e1add99362dba3b333f5f9e6aeb","subject":"feat(keystone): allow users to set custom annotations on secrets","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/ae525e1de83f5e1add99362dba3b333f5f9e6aeb"}]}],"author":{"name":"Doug Goldstein","email":"cardoe@cardoe.com","date":"2026-07-17 22:00:25.000000000","tz":-300},"committer":{"name":"Doug Goldstein","email":"cardoe@cardoe.com","date":"2026-07-20 14:44:54.000000000","tz":-300},"subject":"feat(keystone): prevent deletion of fernet/credential key secrets","message":"feat(keystone): prevent deletion of fernet/credential key secrets\n\nThe keystone-fernet-keys and keystone-credential-keys secrets are\npre-install hooks annotated with helm.sh/resource-policy: keep, but set\nno helm.sh/hook-delete-policy. GitOps tools such as Argo CD re-run\npre-install hooks on every sync and, absent a delete-policy, default to\nbefore-hook-creation -- deleting and recreating the populated secret\nempty each sync. The fernet/credential setup jobs then regenerate the\nkeys, invalidating all issued tokens.\n\nSet helm.sh/hook-delete-policy: hook-failed so the kept secrets are never\ndeleted, matching the existing resource-policy: keep intent. This has no\neffect on plain Helm installs: pre-install hooks run only on install, and\na Secret hook never enters a failed state.\n\nAssisted-By: Claude Opus 4.8\nChange-Id: I352651353fad9169350a8f6e7dfb1319d491d655\nSigned-off-by: Doug Goldstein \u003ccardoe@cardoe.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/583eb1f11deda918e52e63fbff1dca2503309848"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/openstack-helm/commit/583eb1f11deda918e52e63fbff1dca2503309848"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}