)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"0f82f572490e18963e34fbe230545207b1754265","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"328f6f80_0574fafc","updated":"2026-04-28 19:15:08.000000000","message":"This should also fix issue mentioned here: https://review.opendev.org/c/openstack/trove/+/985262, but with a different approach.","commit_id":"44710535eca0234b85f15652d5c7ae17a72e2dbb"},{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"a07f88fae7a5263ac0623adb360bde2a584faacd","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"60a68e56_bc191bd7","updated":"2026-04-30 01:38:48.000000000","message":"The tests passed, which means these changes work correctly.\nHowever, with this update, once the operator upgrades to this version,\nit will need to rebuild all backup images — this could make the upgrade process less smooth.","commit_id":"e56f80a158e027803ae61f29feb0da168ab45fcd"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"0df7fbc9d7a1ddbd58b8396e99988f26c4951d1a","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"18ea8c72_28890357","in_reply_to":"082d46cd_63c9f2ff","updated":"2026-05-09 07:50:08.000000000","message":"Yes, sure. One of the recent tickets from a real customer was a request to assist with resizing the flavor of their database instance (the reason was that the flavor resize operation was broken, but that is a different topic).\nThe common procedure for operations that can potentially lead to data loss is:\n\n1. Create a backup\n2. Perform the potentially unsafe operation\n3. In case of emergency, restore the DB instance from the backup\n\nFor cloud administrators, obtaining user credentials is impossible because we do not store plain-text passwords for security reasons.\n\nTherefore, administrators can perform some instance actions only with administrator privileges.\n\n\nWu, thank you for the review.\nI will add a deprecation warning in trove-guestagent.log if credentials are still present in the guest, then.","commit_id":"e56f80a158e027803ae61f29feb0da168ab45fcd"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"fc4a45fed9343e4ebe4685840ab2e76243e4a843","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"83ccd34a_6a4804ab","in_reply_to":"48f5bcab_dcbb2c20","updated":"2026-04-30 03:36:50.000000000","message":"I\u0027m also have a crazy idea, which will, in addition, resolve the problem of compatibility with old datastores:\n\nInstead of building a backup image for each datastore version, we can use the SAME image as the database itself for backups: they all already have the required backup utility, with the correct version.\nFor transferring the backup stream outside of db_backup container, we can use:\n- named pipes (mounted from host system)\n- unix socket files  (mounted from host system)\n- network sockets\n\nWe need to research which way will work best. I don\u0027t see a fundamental problem that would make it impossible.\n\nThose backup images are like a cornerstone of the trove, and getting rid of them will make trove more versatile.\n\n@hiwkby@yahoo.com @ministry.96.nd@gmail.com @wchy1001@gmail.com we need an expertise of the core team on this topic.","commit_id":"e56f80a158e027803ae61f29feb0da168ab45fcd"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"b3707f89a6ed9fd02571b9eb0220764f9fcc2ef5","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"48f5bcab_dcbb2c20","in_reply_to":"60a68e56_bc191bd7","updated":"2026-04-30 02:42:26.000000000","message":"Yes, you\u0027re right.\nI can see at least two options here for operators:\n 1. Tell operators to keep old versions of backup images with rescope logic for compatibility with old guestagents; set new names for the backup images that are built during release upgrade; backup_image is set inside trove-guestagent.conf and will remain the same until rebuild.\n 2. add additional code for compatibility, which will use the old rescope method if `--os-auth-url` is provided for the backup container.\n \n I\u0027m not sure which one is better. Adding an additional caveat for the upgrade process is a bad thing, but keeping a lot of legacy code is not a good thing either.","commit_id":"e56f80a158e027803ae61f29feb0da168ab45fcd"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"e32bc6f523dec0d2ca50c80acce2cc9b56f68132","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"8213409e_ac5143b9","in_reply_to":"7056e7ab_643ac23a","updated":"2026-05-06 19:15:51.000000000","message":"Hello, Bo. Thank you for the comment.\n\nThere seems to be a misunderstanding regarding this patch. Below is a precise comparison of the current behavior and the behavior after applying the patch which I did manually just now.\n\nTest input: a database instance created in a user project by a Tempest scenario.\n\n__Current behavior__ (master, without this patch)\n - When creating a backup with project member credentials (user context: member in the user\u0027s project), the backup is stored in the user\u0027s project. The `database_backups` Swift container is created in the user\u0027s namespace.\n - When creating a backup with admin credentials (admin context: admin in the admin project), the backup is stored in the admin project. The `database_backups` Swift container is created in the admin\u0027s namespace.\n\n__Behavior with this patch applied__\n - When creating a backup with project member credentials (user context: member in the user\u0027s project), the backup is stored in the user\u0027s project. The `database_backups` Swift container is created in the user\u0027s namespace.\n - When creating a backup with admin credentials (admin context: admin in the admin project), the backup is stored in the admin project. The `database_backups` Swift container is created in the admin\u0027s namespace.\n\n__Conclusion__\n\nThis patch does not change the existing behavior. It only removes an unnecessary implicit token rescoping step.\n\nAdditionally, it becomes safe to remove credentials from `trove-guestagent.conf`. Keeping service account credentials there poses a huge security risk if they are compromised.\n\n__Regarding your opinions:__\n\n1. My opinion is: no, backups should NOT be transparent to all users. Backups are private data. Accessing other users\u0027 backups should be forbidden. A user may access only their own backups.\n2. Yes, we can add more features, including integration with S3.\nIn our company, we already have a prototype, and we plan to propose it upstream in the near future.\nFor implementing this, as I see it, we should extend the functionality of the existing backup strategy entity. Right now, you can only specify a Swift container name. We should add a \"type\" property, where users may choose, for example, between \"swift\" and \"s3\".\nFor the S3 backup strategy type, you should also provide a credentials reference from Barbican.\nThis will allow adding more backup strategies in the future.\n3. Neither the current logic nor this patch affects this.\n4. This point is related to my suggestion about using database images as backup images. I think it is better to move this conversation somewhere else, for example to this [Etherpad](https://etherpad.opendev.org/p/Trove_Hibiscus_cycle_roadmap) (I already sent you the link via email).","commit_id":"e56f80a158e027803ae61f29feb0da168ab45fcd"},{"author":{"_account_id":28691,"name":"Bo Tran","email":"ministry.96.nd@gmail.com","username":"ministry"},"change_message_id":"b4d95d57f90015846408f644b94004c147ba8f74","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"9942bbf7_10abd4cc","in_reply_to":"8213409e_ac5143b9","updated":"2026-05-09 02:20:17.000000000","message":"oh. yeah. haha. I agree with your opinions.\nbtw, \"my transparent\" has the same meaning as \"your transparent\".\n\nand why the admin need to created a backup? can you share some use cases?","commit_id":"e56f80a158e027803ae61f29feb0da168ab45fcd"},{"author":{"_account_id":28691,"name":"Bo Tran","email":"ministry.96.nd@gmail.com","username":"ministry"},"change_message_id":"3ce0c5e2fb9080d2d6c9c8c3c969c634d8dccde6","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"7056e7ab_643ac23a","in_reply_to":"83ccd34a_6a4804ab","updated":"2026-05-06 02:44:02.000000000","message":"I think we need an agreement about this topic and the next features for Trove.\n\nBTW, if we use a pre-auth token for the Swift client, it seems to break the logic of Trove. Let\u0027s think about backups afterward. Should all backups be in the same project (aka same owner)? Is that really what we want?\n\nSo, my opinions are:\n1. Backups should be transparent to all users.\n2. With the current (old) logic, can we add more features such as integrating with S3 (like AWS, Ceph RadosGW, ...)?\n3. Users should be able to download and view their backups easily.\n4. We should build a backup image for each datastore version — this was my previous idea because of some issues:\n   - We need better control over library conflicts.\n   - It\u0027s not transparent; if we change some logic, the latest image may not work as expected, which could cause various problems for new backups of all datastores.\n   \n   \n\nBTW, in my production, I doing use S3 (Ceph Rados GW) as backend storage for backups. It\u0027s make my clients can be download, view, ... the backups directly.\nWe require my client use S3 service and payment for backups size, more backup more money","commit_id":"e56f80a158e027803ae61f29feb0da168ab45fcd"},{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"0a27ff57bfdaf49dc81bd1f3e3b76c8f79a6a69b","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"082d46cd_63c9f2ff","in_reply_to":"9942bbf7_10abd4cc","updated":"2026-05-09 07:32:47.000000000","message":"Should we create a separate story for this topic and move the discussion there?\n\nIn my opinion, the current patch does not change anything related to the existing backup logic. It only affects the configuration in the Trove guest agent. Removing the sensitive configuration from the agent would certainly make the agent more secure. But we also need to consider the upgrade process.\nGenerally, changes related to configuration file updates require more careful consideration, as they may negatively impact the user upgrade experience. It seems we have to keep some legacy code in the current release cycle and add deprecation warnings for operators.\nWhether to move backup tools to datastore images should be treated as a separate topic.\nAdditionally, in my environment, I use Ceph RGW as a Swift implementation, so the current Swift backend works fine for me.","commit_id":"e56f80a158e027803ae61f29feb0da168ab45fcd"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"000676693bd184cfdd8e69d9435e2a82bf15e8f2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"6aaa9415_ac873980","updated":"2026-04-30 07:43:27.000000000","message":"With the latest patchset, backward compatibility is working.\n\nThe sequence I used in my DevStack:\n1. switch to the branch with this patchet applied\n2. build and push backup docker images\n3. systemctl restart devstack@tr-tmgr.service devstack@tr-cond.service apache2\n4. run backup tests - OK\n5. switch back to master\n\n*emulate backup run on old guestagent, new control plane (do not restart services), new backup images:*\n6. run backup tests - OK\n\n*emulate backup run on old guestagent, old control plane, new backup images:*\n7. systemctl restart devstack@tr-tmgr.service devstack@tr-cond.service apache2\n8. run backup tests - OK","commit_id":"2d64d5d187f4dc48d268cfbf1022dbf6b5099f30"},{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"f03cde435f8c827120d727074815f230af58eade","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"26dbcb95_db9940a7","updated":"2026-06-10 08:47:31.000000000","message":"Hello, it looks like putting the backup utilities into their corresponding database images is a good idea. It works better for the upgrade process, and we can easily maintain these images in the quay.io repository. Do we need to spend effort on this?","commit_id":"9e37055d79b8bd24ccd7321795871166d86d7372"},{"author":{"_account_id":35986,"name":"Adrian Jarvis","email":"adrian.r.jarvis@gmail.com","username":"adrian_jarvis"},"change_message_id":"4ab526272f5a6005313d04a22077f639bef2c820","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"869c9e99_7a0baaec","updated":"2026-06-10 05:14:56.000000000","message":"Hi Eric,\n\nComparing this change with mine, I think that your approach is better and should remove the need to specify the region_name.  I would suggest adding unit testing for the changes with backup/storage/swift.py to ensure that both paths of obtaining the swift client are covered.  The test I wrote might be helpful as a basis https://review.opendev.org/c/openstack/trove/+/992385/1/backup/tests/unittests/storage/test_swift.py ?","commit_id":"9e37055d79b8bd24ccd7321795871166d86d7372"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"d4b6c88d1c6696efbd8daa6ebd8d777a56ac2ae3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"83c6deda_fbe3f891","in_reply_to":"26dbcb95_db9940a7","updated":"2026-06-10 19:12:03.000000000","message":"I think this will be a good investment. Getting rid of separate backup images will benefit both our development team and cloud operators by simplifying the setup, maintenance, and upgrade processes.\n\nNote: backup utilities are already embedded in the database images; we just need to use them directly from the guest agent, without the additional layer introduced by backup images.","commit_id":"9e37055d79b8bd24ccd7321795871166d86d7372"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"d4b6c88d1c6696efbd8daa6ebd8d777a56ac2ae3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"4b7b9b2f_7c931fdf","in_reply_to":"869c9e99_7a0baaec","updated":"2026-06-10 19:12:03.000000000","message":"Hello, Adrian.\nYes, I had the same idea when I saw that test in your MR. I will incorporate a modified version of it here. Also, including the backup test calls in `tox.ini` is a good catch. They should have been there a long time ago.","commit_id":"9e37055d79b8bd24ccd7321795871166d86d7372"},{"author":{"_account_id":35986,"name":"Adrian Jarvis","email":"adrian.r.jarvis@gmail.com","username":"adrian_jarvis"},"change_message_id":"36adbc20eee7ec8397339d2c6183569516944f81","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"81262a9d_3bc2dc00","updated":"2026-06-16 02:53:15.000000000","message":"Nice work Eric...\n\nMy only nit would be to have been to separate the changes for the service credentials and the use of the preauth, but regardless it is a good fix.","commit_id":"14f76970d41ae762d44243efa2ddf4ccd7916d13"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"8c0ebc88ce9da2bcff0e863a8aef70375df1db12","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"283d8f77_5b8879fe","in_reply_to":"81262a9d_3bc2dc00","updated":"2026-06-16 08:11:28.000000000","message":"Thank you. Yes, you\u0027re right.\nOriginally, I wanted to check that service credentials may be safely removed, and it worked. We can split this MR now, [here](https://review.opendev.org/c/openstack/trove/+/993522) it is.","commit_id":"14f76970d41ae762d44243efa2ddf4ccd7916d13"},{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"7a47064ff042b8b4ee78ca5f38ec7a3951cdbdd0","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":11,"id":"6593431f_0a587b83","updated":"2026-06-18 08:44:23.000000000","message":"LGTM","commit_id":"804f960b1dccf61b9ec5c78fa88223077eb5fc0d"},{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"7a47064ff042b8b4ee78ca5f38ec7a3951cdbdd0","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":11,"id":"3abbee3e_380b8c2c","updated":"2026-06-18 08:44:23.000000000","message":"thanks","commit_id":"804f960b1dccf61b9ec5c78fa88223077eb5fc0d"}],"backup/main.py":[{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"f03cde435f8c827120d727074815f230af58eade","unresolved":true,"context_lines":[{"line_number":53,"context_line":"    cfg.StrOpt(\u0027db-datadir\u0027),"},{"line_number":54,"context_line":"    cfg.StrOpt(\u0027os-token\u0027),"},{"line_number":55,"context_line":"    # backward compat, remove after 2027.2 release cycle"},{"line_number":56,"context_line":"    cfg.StrOpt(\u0027os-auth-url\u0027),"},{"line_number":57,"context_line":"    # backward compat, remove after 2027.2 release cycle"},{"line_number":58,"context_line":"    cfg.StrOpt(\u0027os-region-name\u0027),"},{"line_number":59,"context_line":"    # backward compat, remove after 2027.2 release cycle"}],"source_content_type":"text/x-python","patch_set":7,"id":"d0b2d61c_05f88bec","line":56,"range":{"start_line":56,"start_character":0,"end_line":56,"end_character":30},"updated":"2026-06-10 08:47:31.000000000","message":"hello, Please refer to https://github.com/openstack/trove/blob/master/trove/common/cfg.py#L352\nWe can set deprecate reason in cfg Opts. we should use that directly.","commit_id":"9e37055d79b8bd24ccd7321795871166d86d7372"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"d4b6c88d1c6696efbd8daa6ebd8d777a56ac2ae3","unresolved":false,"context_lines":[{"line_number":53,"context_line":"    cfg.StrOpt(\u0027db-datadir\u0027),"},{"line_number":54,"context_line":"    cfg.StrOpt(\u0027os-token\u0027),"},{"line_number":55,"context_line":"    # backward compat, remove after 2027.2 release cycle"},{"line_number":56,"context_line":"    cfg.StrOpt(\u0027os-auth-url\u0027),"},{"line_number":57,"context_line":"    # backward compat, remove after 2027.2 release cycle"},{"line_number":58,"context_line":"    cfg.StrOpt(\u0027os-region-name\u0027),"},{"line_number":59,"context_line":"    # backward compat, remove after 2027.2 release cycle"}],"source_content_type":"text/x-python","patch_set":7,"id":"b97423f6_899736bb","line":56,"range":{"start_line":56,"start_character":0,"end_line":56,"end_character":30},"in_reply_to":"d0b2d61c_05f88bec","updated":"2026-06-10 19:12:03.000000000","message":"Nice catch, thank you.","commit_id":"9e37055d79b8bd24ccd7321795871166d86d7372"},{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"f03cde435f8c827120d727074815f230af58eade","unresolved":true,"context_lines":[{"line_number":54,"context_line":"    cfg.StrOpt(\u0027os-token\u0027),"},{"line_number":55,"context_line":"    # backward compat, remove after 2027.2 release cycle"},{"line_number":56,"context_line":"    cfg.StrOpt(\u0027os-auth-url\u0027),"},{"line_number":57,"context_line":"    # backward compat, remove after 2027.2 release cycle"},{"line_number":58,"context_line":"    cfg.StrOpt(\u0027os-region-name\u0027),"},{"line_number":59,"context_line":"    # backward compat, remove after 2027.2 release cycle"},{"line_number":60,"context_line":"    cfg.StrOpt(\u0027os-tenant-id\u0027),"}],"source_content_type":"text/x-python","patch_set":7,"id":"028a4d51_f4465871","line":57,"updated":"2026-06-10 08:47:31.000000000","message":"ditto","commit_id":"9e37055d79b8bd24ccd7321795871166d86d7372"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"d4b6c88d1c6696efbd8daa6ebd8d777a56ac2ae3","unresolved":false,"context_lines":[{"line_number":54,"context_line":"    cfg.StrOpt(\u0027os-token\u0027),"},{"line_number":55,"context_line":"    # backward compat, remove after 2027.2 release cycle"},{"line_number":56,"context_line":"    cfg.StrOpt(\u0027os-auth-url\u0027),"},{"line_number":57,"context_line":"    # backward compat, remove after 2027.2 release cycle"},{"line_number":58,"context_line":"    cfg.StrOpt(\u0027os-region-name\u0027),"},{"line_number":59,"context_line":"    # backward compat, remove after 2027.2 release cycle"},{"line_number":60,"context_line":"    cfg.StrOpt(\u0027os-tenant-id\u0027),"}],"source_content_type":"text/x-python","patch_set":7,"id":"1ef94f51_8a9be50e","line":57,"in_reply_to":"028a4d51_f4465871","updated":"2026-06-10 19:12:03.000000000","message":"Done","commit_id":"9e37055d79b8bd24ccd7321795871166d86d7372"},{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"f03cde435f8c827120d727074815f230af58eade","unresolved":true,"context_lines":[{"line_number":56,"context_line":"    cfg.StrOpt(\u0027os-auth-url\u0027),"},{"line_number":57,"context_line":"    # backward compat, remove after 2027.2 release cycle"},{"line_number":58,"context_line":"    cfg.StrOpt(\u0027os-region-name\u0027),"},{"line_number":59,"context_line":"    # backward compat, remove after 2027.2 release cycle"},{"line_number":60,"context_line":"    cfg.StrOpt(\u0027os-tenant-id\u0027),"},{"line_number":61,"context_line":"    cfg.StrOpt(\u0027swift-container\u0027, default\u003d\u0027database_backups\u0027),"},{"line_number":62,"context_line":"    cfg.DictOpt(\u0027swift-extra-metadata\u0027),"}],"source_content_type":"text/x-python","patch_set":7,"id":"67def1c4_f1690c22","line":59,"updated":"2026-06-10 08:47:31.000000000","message":"ditto","commit_id":"9e37055d79b8bd24ccd7321795871166d86d7372"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"d4b6c88d1c6696efbd8daa6ebd8d777a56ac2ae3","unresolved":false,"context_lines":[{"line_number":56,"context_line":"    cfg.StrOpt(\u0027os-auth-url\u0027),"},{"line_number":57,"context_line":"    # backward compat, remove after 2027.2 release cycle"},{"line_number":58,"context_line":"    cfg.StrOpt(\u0027os-region-name\u0027),"},{"line_number":59,"context_line":"    # backward compat, remove after 2027.2 release cycle"},{"line_number":60,"context_line":"    cfg.StrOpt(\u0027os-tenant-id\u0027),"},{"line_number":61,"context_line":"    cfg.StrOpt(\u0027swift-container\u0027, default\u003d\u0027database_backups\u0027),"},{"line_number":62,"context_line":"    cfg.DictOpt(\u0027swift-extra-metadata\u0027),"}],"source_content_type":"text/x-python","patch_set":7,"id":"5cf22850_4539af5a","line":59,"in_reply_to":"67def1c4_f1690c22","updated":"2026-06-10 19:12:03.000000000","message":"Done","commit_id":"9e37055d79b8bd24ccd7321795871166d86d7372"},{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"668a9f8584b980aeefda4e8c8769200817e91d92","unresolved":true,"context_lines":[{"line_number":41,"context_line":"    ),"},{"line_number":42,"context_line":"    cfg.BoolOpt(\u0027backup\u0027),"},{"line_number":43,"context_line":"    cfg.StrOpt(\u0027swift-url\u0027),"},{"line_number":44,"context_line":"    cfg.BoolOpt(\u0027swift-api-insecure\u0027),"},{"line_number":45,"context_line":"    cfg.StrOpt("},{"line_number":46,"context_line":"        \u0027backup-encryption-key\u0027,"},{"line_number":47,"context_line":"        help\u003d\u0027This is only for backward compatibility. The backups \u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"4fbd32da_cfeaa937","line":44,"range":{"start_line":44,"start_character":2,"end_line":44,"end_character":38},"updated":"2026-06-16 03:23:51.000000000","message":"This looks like a leftover config?","commit_id":"14f76970d41ae762d44243efa2ddf4ccd7916d13"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"8c0ebc88ce9da2bcff0e863a8aef70375df1db12","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    ),"},{"line_number":42,"context_line":"    cfg.BoolOpt(\u0027backup\u0027),"},{"line_number":43,"context_line":"    cfg.StrOpt(\u0027swift-url\u0027),"},{"line_number":44,"context_line":"    cfg.BoolOpt(\u0027swift-api-insecure\u0027),"},{"line_number":45,"context_line":"    cfg.StrOpt("},{"line_number":46,"context_line":"        \u0027backup-encryption-key\u0027,"},{"line_number":47,"context_line":"        help\u003d\u0027This is only for backward compatibility. The backups \u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"e3a8fe8f_2dec8406","line":44,"range":{"start_line":44,"start_character":2,"end_line":44,"end_character":38},"in_reply_to":"4fbd32da_cfeaa937","updated":"2026-06-16 08:11:28.000000000","message":"No, it\u0027s intentional. This parameter is passed in the command line as a flag argument to the backup container now, if `CONF.swift_api_insecure\u003dTrue` in `trove-guestagent.conf`.\nPreviously, it was hardcoded as `insecure\u003dTrue`, which is not correct from a security perspective.\n\nI will add it to the release note now.","commit_id":"14f76970d41ae762d44243efa2ddf4ccd7916d13"}],"releasenotes/notes/service-credentials-guestagent-conf-removal-377052be45e7f046.yaml":[{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"f03cde435f8c827120d727074815f230af58eade","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":7,"id":"c06b546c_dbd38d1a","line":8,"range":{"start_line":4,"start_character":1,"end_line":8,"end_character":0},"updated":"2026-06-10 08:47:31.000000000","message":"Also add a note to reminder operators to rebuild all the backup images? Otherwise, the existing backup images will not work with the newly built guest-agent.","commit_id":"9e37055d79b8bd24ccd7321795871166d86d7372"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"d4b6c88d1c6696efbd8daa6ebd8d777a56ac2ae3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"c95cc472_6a7faa55","line":8,"range":{"start_line":4,"start_character":1,"end_line":8,"end_character":0},"in_reply_to":"c06b546c_dbd38d1a","updated":"2026-06-10 19:12:03.000000000","message":"Done","commit_id":"9e37055d79b8bd24ccd7321795871166d86d7372"},{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"668a9f8584b980aeefda4e8c8769200817e91d92","unresolved":true,"context_lines":[{"line_number":7,"context_line":"    Storing credentials on guest instances represents a security risk."},{"line_number":8,"context_line":"upgrade:"},{"line_number":9,"context_line":"  - |"},{"line_number":10,"context_line":"    Existing backup images must be rebuilt after upgrading to this"},{"line_number":11,"context_line":"    release. Backup images created with previous versions may contain"},{"line_number":12,"context_line":"    obsolete guestagent configuration and will not function correctly"},{"line_number":13,"context_line":"    after the upgrade."}],"source_content_type":"text/x-yaml","patch_set":9,"id":"0029edc2_f54a7fe7","line":13,"range":{"start_line":10,"start_character":0,"end_line":13,"end_character":22},"updated":"2026-06-16 03:23:51.000000000","message":"This description may not be precise enough. Even after upgrading to this version, the existing guest-agent images will function normally alongside the existing backup images. However, to ensure compatibility with newly built guest images as well as the legacy ones, you must rebuild the backup images.","commit_id":"14f76970d41ae762d44243efa2ddf4ccd7916d13"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"8c0ebc88ce9da2bcff0e863a8aef70375df1db12","unresolved":false,"context_lines":[{"line_number":7,"context_line":"    Storing credentials on guest instances represents a security risk."},{"line_number":8,"context_line":"upgrade:"},{"line_number":9,"context_line":"  - |"},{"line_number":10,"context_line":"    Existing backup images must be rebuilt after upgrading to this"},{"line_number":11,"context_line":"    release. Backup images created with previous versions may contain"},{"line_number":12,"context_line":"    obsolete guestagent configuration and will not function correctly"},{"line_number":13,"context_line":"    after the upgrade."}],"source_content_type":"text/x-yaml","patch_set":9,"id":"598754c8_a5719c4d","line":13,"range":{"start_line":10,"start_character":0,"end_line":13,"end_character":22},"in_reply_to":"0029edc2_f54a7fe7","updated":"2026-06-16 08:11:28.000000000","message":"Done\nI split this changes into separate commit [here](https://review.opendev.org/c/openstack/trove/+/993522)","commit_id":"14f76970d41ae762d44243efa2ddf4ccd7916d13"}],"trove/cmd/common.py":[{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"f03cde435f8c827120d727074815f230af58eade","unresolved":true,"context_lines":[{"line_number":68,"context_line":"# NOTE(mangust404): Remove this deprecation checks after 2027.2"},{"line_number":69,"context_line":"# release cycle"},{"line_number":70,"context_line":"def warn_if_service_credentials_present():"},{"line_number":71,"context_line":"    import configparser"},{"line_number":72,"context_line":"    from oslo_log import log as logging"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    LOG \u003d logging.getLogger(__name__)"}],"source_content_type":"text/x-python","patch_set":7,"id":"4a7b695d_316ab412","line":71,"updated":"2026-06-10 08:47:31.000000000","message":"This helper utility may not be necessary, as we can add deprecation information directly to the cfg options object.\n\nWe can add deprecate information here: https://github.com/openstack/trove/blob/master/trove/common/cfg.py#L1511\n\nThis section is used by both trove.conf and guest-agent.conf. We can add a notice here and avoid forced removal for backward compatibility.refer to: https://github.com/openstack/trove/blob/master/trove/common/cfg.py#L347\n\nAdd a deprecation like: Please do not set these options in guest-agent.conf. and remove this function in the current changes.","commit_id":"9e37055d79b8bd24ccd7321795871166d86d7372"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"d4b6c88d1c6696efbd8daa6ebd8d777a56ac2ae3","unresolved":true,"context_lines":[{"line_number":68,"context_line":"# NOTE(mangust404): Remove this deprecation checks after 2027.2"},{"line_number":69,"context_line":"# release cycle"},{"line_number":70,"context_line":"def warn_if_service_credentials_present():"},{"line_number":71,"context_line":"    import configparser"},{"line_number":72,"context_line":"    from oslo_log import log as logging"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    LOG \u003d logging.getLogger(__name__)"}],"source_content_type":"text/x-python","patch_set":7,"id":"43e7eb27_556d74fa","line":71,"in_reply_to":"4a7b695d_316ab412","updated":"2026-06-10 19:12:03.000000000","message":"Yes, that\u0027s a better approach. I\u0027m not quite familiar with the deprecations workflow yet.\nI\u0027ve added a notice in cfg.py that service credentials are still required in trove.conf and should be removed from guest-agent.conf.\nPlease check it out.","commit_id":"9e37055d79b8bd24ccd7321795871166d86d7372"}],"trove/guestagent/datastore/service.py":[{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"a07f88fae7a5263ac0623adb360bde2a584faacd","unresolved":true,"context_lines":[{"line_number":489,"context_line":"        return cfg.get_configuration_property(\u0027backup_strategy\u0027)"},{"line_number":490,"context_line":""},{"line_number":491,"context_line":"    def create_backup(self, context, backup_info, volumes_mapping\u003d{},"},{"line_number":492,"context_line":"                      need_dbuser\u003dTrue, extra_params\u003d\u0027\u0027, is_local\u003dFalse):"},{"line_number":493,"context_line":"        storage_driver \u003d backup_info.get("},{"line_number":494,"context_line":"            \u0027storage_driver\u0027, CONF.storage_strategy)"},{"line_number":495,"context_line":"        backup_driver \u003d self.get_backup_strategy()"}],"source_content_type":"text/x-python","patch_set":5,"id":"abf4f304_450e2193","line":492,"range":{"start_line":492,"start_character":57,"end_line":492,"end_character":72},"updated":"2026-04-30 01:38:48.000000000","message":"It looks like this parameter is not used ?","commit_id":"e56f80a158e027803ae61f29feb0da168ab45fcd"},{"author":{"_account_id":36080,"name":"Erkin Mussurmankulov","display_name":"Eric","email":"mangust404@gmail.com","username":"mongoose404","status":"PS Cloud services employee"},"change_message_id":"b3707f89a6ed9fd02571b9eb0220764f9fcc2ef5","unresolved":false,"context_lines":[{"line_number":489,"context_line":"        return cfg.get_configuration_property(\u0027backup_strategy\u0027)"},{"line_number":490,"context_line":""},{"line_number":491,"context_line":"    def create_backup(self, context, backup_info, volumes_mapping\u003d{},"},{"line_number":492,"context_line":"                      need_dbuser\u003dTrue, extra_params\u003d\u0027\u0027, is_local\u003dFalse):"},{"line_number":493,"context_line":"        storage_driver \u003d backup_info.get("},{"line_number":494,"context_line":"            \u0027storage_driver\u0027, CONF.storage_strategy)"},{"line_number":495,"context_line":"        backup_driver \u003d self.get_backup_strategy()"}],"source_content_type":"text/x-python","patch_set":5,"id":"f23c598e_fc9fc4cf","line":492,"range":{"start_line":492,"start_character":57,"end_line":492,"end_character":72},"in_reply_to":"abf4f304_450e2193","updated":"2026-04-30 02:42:26.000000000","message":"Acknowledged, it\u0027s some leftover from the draft","commit_id":"e56f80a158e027803ae61f29feb0da168ab45fcd"}]}