)]}'
{"releasenotes/notes/keystoneclient-openstacksdk-migration-23fe0611b0052209.yaml":[{"robot_id":"zuul","robot_run_id":"e7a6594ef9c849429f3f7125104b9582","url":"https://zuul.teim.app/t/main/buildset/e7a6594ef9c849429f3f7125104b9582","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"aa6c7750699b2f04697e56ea927f5f3ce2a5bb97","patch_set":1,"id":"9f922361_6d5711ed","line":4,"updated":"2026-05-04 09:03:14.000000000","message":"The release note has inconsistent line wrapping. The upgrade section line starting with \u0027directly to the [keystone] section\u0027 exceeds typical wrapping conventions within the YAML string.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: The release note may display awkwardly in rendered documentation. Minor readability concern for operators reading the release notes.\n\n**Suggestion**:\nRewrite the release note for consistent line wrapping, breaking \u0027Connection settings for Keystone should be added\u0027 and \u0027directly to the [keystone] section of the configuration now, instead of [keystone_client].\u0027 into separate lines.","commit_id":"4af2d1035b5dffa72d25c6bf0c248226d3df1233"},{"robot_id":"zuul","robot_run_id":"a107cc04fe5046d497dfff2ef6dd09a8","url":"https://zuul.teim.app/t/main/buildset/a107cc04fe5046d497dfff2ef6dd09a8","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"c6e43e6fc211e6905ace2f0d822488a586535185","patch_set":2,"id":"52c6a28d_9fe572a2","line":9,"updated":"2026-05-04 10:13:42.000000000","message":"The release notes file has one line at 80 characters, exceeding the typical 79-character limit used in OpenStack YAML files.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: Minor style violation that may be caught by linters or documentation build checks.\n\n**Suggestion**:\nWrap line 9 (\u0027The keystone_client configuration options are deprecated and will be removed\u0027) to stay within 79 characters.","commit_id":"5cad1996e2cbc87286ce58a5af55ac6b2b641aab"},{"robot_id":"zuul","robot_run_id":"aad00a4867434fcbbc1dee219a87fb45","url":"https://zuul.teim.app/t/main/buildset/aad00a4867434fcbbc1dee219a87fb45","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"f7c2bae40c70bf03f282de907bd63c5107a1b1ea","patch_set":3,"id":"9420230f_e46933b7","line":12,"updated":"2026-05-04 11:59:20.000000000","message":"The release note file `keystoneclient-openstacksdk-migration-23fe0611b0052209.yaml` has an `other` section stating \u0027Added support for openstacksdk as an alternative to keystoneclient\u0027 but the change actually replaces keystoneclient entirely, it does not add it as an alternative. This is misleading.\n\n**Severity**: WARNING | **Confidence**: 0.9\n\n**Impact**: Operators reading release notes may believe keystoneclient is still supported as a backend, when in fact it has been removed from KeystoneHelper. This could cause confusion during upgrades.\n\n**Suggestion**:\nChange the `other` section to more accurately describe the change, e.g., \u0027Replaced keystoneclient with openstacksdk for Keystone identity operations in KeystoneHelper.\u0027 or remove the `other` section since the upgrade and deprecations sections cover the operator-facing changes.","commit_id":"79cf4b3166b0b7bf39a244961cbc17ebe1638cc6"}],"watcher/common/keystone_helper.py":[{"robot_id":"zuul","robot_run_id":"e7a6594ef9c849429f3f7125104b9582","url":"https://zuul.teim.app/t/main/buildset/e7a6594ef9c849429f3f7125104b9582","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"aa6c7750699b2f04697e56ea927f5f3ce2a5bb97","patch_set":1,"id":"7d517f64_29b1963c","line":29,"updated":"2026-05-04 09:03:14.000000000","message":"The osc parameter in KeystoneHelper.__init__ is accepted but never passed to _create_sdk_connection. CollectorManager at manager.py:39 calls KeystoneHelper(self.osc), meaning the existing OpenStackClients instance is silently discarded.\n\n**Severity**: HIGH | **Confidence**: 0.9\n\n**Risk**: Every call to KeystoneHelper(osc\u003dsome_osc) creates a brand-new SDK connection instead of reusing the existing session, potentially leading to extra authentication requests and connection overhead in production.\n\n**Priority**: Before merge\n**Why This Matters**: The CollectorManager passes its cached OpenStackClients instance expecting it to be reused. Silently ignoring it changes runtime behavior and could cause performance degradation or auth failures under load.\n\n**Recommendation**:\nEither: (1) extract the session from osc and pass it to _create_sdk_connection when osc is provided, e.g. self._create_sdk_connection(session\u003dosc.session if osc else None, context\u003dcontext); or (2) remove the osc parameter entirely and update the caller in manager.py to pass session\u003dosc.session explicitly. Option (1) preserves backward compatibility.","commit_id":"4af2d1035b5dffa72d25c6bf0c248226d3df1233"},{"robot_id":"zuul","robot_run_id":"e7a6594ef9c849429f3f7125104b9582","url":"https://zuul.teim.app/t/main/buildset/e7a6594ef9c849429f3f7125104b9582","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"aa6c7750699b2f04697e56ea927f5f3ce2a5bb97","patch_set":1,"id":"74d7ffa7_c34caed7","line":32,"updated":"2026-05-04 09:03:14.000000000","message":"The unused osc parameter should either be properly consumed or removed to avoid confusion. Currently it is documented in the docstring but has no effect on behavior.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: Removing dead parameters makes the API contract clearer and prevents future developers from incorrectly assuming the osc instance is being used.\n\n**Recommendation**:\nIf backward compatibility is needed, consume osc by extracting its session: session\u003dsession or (osc.session if osc else None). Otherwise, remove the osc parameter and update the single caller in manager.py.","commit_id":"4af2d1035b5dffa72d25c6bf0c248226d3df1233"},{"robot_id":"zuul","robot_run_id":"e7a6594ef9c849429f3f7125104b9582","url":"https://zuul.teim.app/t/main/buildset/e7a6594ef9c849429f3f7125104b9582","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"aa6c7750699b2f04697e56ea927f5f3ce2a5bb97","patch_set":1,"id":"999b1a27_e2c4ecda","line":48,"updated":"2026-05-04 09:03:14.000000000","message":"KeystoneHelper.__init__ should log or provide better diagnostics when falling back to the watcher_clients_auth config group, and should validate that at least one auth source is available.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: Improved error messages for operators who have neither [keystone] nor [watcher_clients_auth] configured, making debugging configuration issues faster.\n\n**Recommendation**:\nPromote the LOG.debug to LOG.info when falling back so operators can see which config group is being used. Also consider wrapping get_sdk_connection in a try/except and providing a clear error message indicating which config groups were attempted.","commit_id":"4af2d1035b5dffa72d25c6bf0c248226d3df1233"},{"robot_id":"zuul","robot_run_id":"a107cc04fe5046d497dfff2ef6dd09a8","url":"https://zuul.teim.app/t/main/buildset/a107cc04fe5046d497dfff2ef6dd09a8","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"c6e43e6fc211e6905ace2f0d822488a586535185","patch_set":2,"id":"534a30f2_ff8e95fc","line":29,"updated":"2026-05-04 10:13:42.000000000","message":"The osc parameter is accepted in __init__ for backward compatibility but is silently ignored. CollectorManager.is_cinder_enabled() passes self.osc to KeystoneHelper(self.osc), which now does nothing with it. This breaks the existing caller contract without any deprecation warning.\n\n**Severity**: HIGH | **Confidence**: 0.9\n\n**Risk**: CollectorManager and any other callers that pass osc expect the helper to use the provided OpenStackClients instance for its connection. The new implementation creates a separate SDK connection from config, ignoring the passed client entirely. This could lead to using different credentials or failing if config is incomplete.\n\n**Priority**: Before merge\n**Why This Matters**: The existing caller at watcher/decision_engine/model/collector/manager.py:39 passes self.osc to KeystoneHelper. The new constructor accepts osc as the first positional argument but discards it without warning. Either the caller should be updated to pass session/context, or KeystoneHelper should derive a session from osc when provided.\n\n**Recommendation**:\nEither update CollectorManager.is_cinder_enabled() to pass session\u003dself.osc.session instead of self.osc, or add logic in KeystoneHelper.__init__ to extract a session from osc when provided: if osc is not None and session is None: session \u003d osc.session. Add a deprecation warning if osc is passed.","commit_id":"5cad1996e2cbc87286ce58a5af55ac6b2b641aab"},{"robot_id":"zuul","robot_run_id":"a107cc04fe5046d497dfff2ef6dd09a8","url":"https://zuul.teim.app/t/main/buildset/a107cc04fe5046d497dfff2ef6dd09a8","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"c6e43e6fc211e6905ace2f0d822488a586535185","patch_set":2,"id":"d7757c53_c65c1f1d","line":30,"updated":"2026-05-04 10:13:42.000000000","message":"The docstring for KeystoneHelper.__init__ documents osc as \u0027an OpenStackClients instance\u0027 but the parameter is now unused. The docstring should be updated to reflect the new behavior.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: Prevents developer confusion about whether osc is still used. Clear docstrings help future maintainers understand the migration path.\n\n**Recommendation**:\nUpdate the docstring to note that osc is accepted for backward compatibility but is not used. Mark it as deprecated in the docstring: \u0027:param osc: Deprecated. Previously an OpenStackClients instance. Use session or context instead.\u0027","commit_id":"5cad1996e2cbc87286ce58a5af55ac6b2b641aab"},{"robot_id":"zuul","robot_run_id":"a107cc04fe5046d497dfff2ef6dd09a8","url":"https://zuul.teim.app/t/main/buildset/a107cc04fe5046d497dfff2ef6dd09a8","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"c6e43e6fc211e6905ace2f0d822488a586535185","patch_set":2,"id":"b9d76a03_66a75fc9","line":64,"updated":"2026-05-04 10:13:42.000000000","message":"When ks_auth is None (no auth in [keystone]), the code falls back to watcher_clients_auth but still reads CONF.keystone.valid_interfaces and CONF.keystone.region_name on lines 64-65. If [keystone] has no auth, these adapter options may also be unset, causing AttributeError or returning None unexpectedly.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: In a fresh deployment where [keystone] has no configuration at all, accessing CONF.keystone.valid_interfaces could raise a cfg.NoSuchOptError or return a default that does not match the fallback auth group\u0027s intended settings.\n\n**Suggestion**:\nWhen falling back to watcher_clients_auth, also read interface and region_name from that group instead of always reading from CONF.keystone. For example, after setting auth_group \u003d clients_auth.WATCHER_CLIENTS_AUTH, also use CONF[auth_group].valid_interfaces and CONF[auth_group].region_name.","commit_id":"5cad1996e2cbc87286ce58a5af55ac6b2b641aab"},{"robot_id":"zuul","robot_run_id":"aad00a4867434fcbbc1dee219a87fb45","url":"https://zuul.teim.app/t/main/buildset/aad00a4867434fcbbc1dee219a87fb45","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"f7c2bae40c70bf03f282de907bd63c5107a1b1ea","patch_set":3,"id":"6e573cd9_53a6896e","line":29,"updated":"2026-05-04 11:59:20.000000000","message":"KeystoneHelper.__init__ accepts an `osc` parameter but silently ignores it. The old constructor used `osc` to obtain a keystone client; the new constructor never reads it. Callers passing `osc\u003d...` will get no error but their argument is discarded.\n\n**Severity**: HIGH | **Confidence**: 0.9\n\n**Risk**: Existing callers that pass osc\u003d will silently lose the ability to share an OpenStackClients instance, potentially creating duplicate sessions or failing to use the intended credentials.\n\n**Priority**: Before merge\n**Why This Matters**: Breaking the osc\u003d parameter silently is a backwards-compatibility hazard. Any code that instantiates KeystoneHelper(osc\u003dsome_client) will appear to work but will create a new SDK connection instead of reusing the provided client\u0027s session.\n\n**Recommendation**:\nEither remove the `osc` parameter from __init__ entirely (and update any callers), or implement a code path that uses the osc session when provided. At minimum, add a LOG.warning if osc is passed and ignored, so deployers can detect the issue.","commit_id":"79cf4b3166b0b7bf39a244961cbc17ebe1638cc6"},{"robot_id":"zuul","robot_run_id":"aad00a4867434fcbbc1dee219a87fb45","url":"https://zuul.teim.app/t/main/buildset/aad00a4867434fcbbc1dee219a87fb45","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"f7c2bae40c70bf03f282de907bd63c5107a1b1ea","patch_set":3,"id":"6c48b470_7a040369","line":30,"updated":"2026-05-04 11:59:20.000000000","message":"The docstring in keystone_helper.py:30 uses multi-line format without a blank line after the summary. The summary line \u0027Create and return a helper to call the keystone service\u0027 does not end with a period and runs directly into the param descriptions.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: Docstring does not follow the OpenStack H404/H405 conventions. The summary should be a single brief line ending with a period, followed by a blank line, then detailed description and params.\n\n**Suggestion**:\nReformat to: \u0027\"\"\"Create and return a helper to call the keystone service.\\n\\n:param osc: ...\\n\"\"\"\u0027","commit_id":"79cf4b3166b0b7bf39a244961cbc17ebe1638cc6"},{"robot_id":"zuul","robot_run_id":"aad00a4867434fcbbc1dee219a87fb45","url":"https://zuul.teim.app/t/main/buildset/aad00a4867434fcbbc1dee219a87fb45","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"f7c2bae40c70bf03f282de907bd63c5107a1b1ea","patch_set":3,"id":"ce1398ee_49befd4a","line":60,"updated":"2026-05-04 11:59:20.000000000","message":"The `is_service_enabled_by_type` method uses `self.connection.identity.services(type\u003dsvc_type)` which returns a generator in openstacksdk. If the fallback path in `_create_sdk_connection` is taken (auth_group becomes watcher_clients_auth), the `CONF.keystone.valid_interfaces` and `CONF.keystone.region_name` access on line 64-65 may raise a NoSuchOptError because the [keystone] group may not have adapter opts registered in that fallback scenario.\n\n**Severity**: HIGH | **Confidence**: 0.8\n\n**Risk**: If the [keystone] section is not configured (the common case for existing deployments), the fallback uses watcher_clients_auth for the connection, but still reads CONF.keystone.valid_interfaces and CONF.keystone.region_name which require the [keystone] group to have adapter options registered. Since register_opts does register the group, these opts will exist with defaults, so the risk is mitigated but the semantic coupling is fragile.\n\n**Priority**: Before merge\n**Why This Matters**: The fallback path reads config from a different group than the one used for auth. If the [keystone] adapter options are not explicitly set, CONF.keystone.valid_interfaces defaults to None, which is passed as interface to get_sdk_connection. This could result in unexpected behavior where the fallback connection does not use the expected endpoint interface.\n\n**Recommendation**:\nWhen using the fallback auth_group, read interface and region_name from the fallback group\u0027s config instead of hardcoding CONF.keystone. Consider: `interface\u003dCONF[auth_group].valid_interfaces if auth_group \u003d\u003d \u0027keystone\u0027 else None` or simply always pass interface/region_name from the determined auth_group config.","commit_id":"79cf4b3166b0b7bf39a244961cbc17ebe1638cc6"}],"watcher/conf/keystone.py":[{"robot_id":"zuul","robot_run_id":"e7a6594ef9c849429f3f7125104b9582","url":"https://zuul.teim.app/t/main/buildset/e7a6594ef9c849429f3f7125104b9582","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"aa6c7750699b2f04697e56ea927f5f3ce2a5bb97","patch_set":1,"id":"82dd768e_d553f1ed","line":24,"updated":"2026-05-04 09:03:14.000000000","message":"The http_retries and http_retry_interval options are defined in keystone.py but never referenced in keystone_helper.py or any other file. These options appear to be dead configuration.\n\n**Severity**: WARNING | **Confidence**: 0.9\n\n**Impact**: Operators may set these options expecting retry behavior, but the values are never consumed. This creates a misleading configuration surface.\n\n**Suggestion**:\nEither implement retry logic in keystone_helper.py using CONF.keystone.http_retries and CONF.keystone.http_retry_interval (as nova_helper.py does), or remove these options from the config group until the retry functionality is implemented.","commit_id":"4af2d1035b5dffa72d25c6bf0c248226d3df1233"},{"robot_id":"zuul","robot_run_id":"a107cc04fe5046d497dfff2ef6dd09a8","url":"https://zuul.teim.app/t/main/buildset/a107cc04fe5046d497dfff2ef6dd09a8","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"c6e43e6fc211e6905ace2f0d822488a586535185","patch_set":2,"id":"6e513198_7e76b399","line":25,"updated":"2026-05-04 10:13:42.000000000","message":"The _deprecations() function in keystone.py returns a new dict on every call but is only used as a constant. It could be a module-level constant for clarity.\n\n**Severity**: SUGGESTION | **Confidence**: 0.7\n\n**Benefit**: Minor readability improvement by making the deprecation mapping a module-level constant, consistent with how other modules define their option lists.\n\n**Recommendation**:\nConsider defining DEPRECATED_OPTS as a module-level dict constant instead of wrapping it in a function, or alternatively document why a function is preferred (e.g., to avoid import-time side effects). This matches the pattern used in nova.py but is a low-priority style improvement.","commit_id":"5cad1996e2cbc87286ce58a5af55ac6b2b641aab"},{"robot_id":"zuul","robot_run_id":"a107cc04fe5046d497dfff2ef6dd09a8","url":"https://zuul.teim.app/t/main/buildset/a107cc04fe5046d497dfff2ef6dd09a8","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"c6e43e6fc211e6905ace2f0d822488a586535185","patch_set":2,"id":"e71f3062_4eb75d1d","line":28,"updated":"2026-05-04 10:13:42.000000000","message":"The deprecation mapping for \u0027interface\u0027 uses key \u0027interface\u0027, but keystoneauth1 register_adapter_conf_options registers the option as \u0027valid_interfaces\u0027 (plural, list type). The deprecated_opts dict keys must match the new option name, not the old one.\n\n**Severity**: HIGH | **Confidence**: 0.9\n\n**Risk**: Operators using the deprecated [keystone_client] interface option will not have their value migrated to [keystone] valid_interfaces automatically. The deprecated opt mapping silently fails, meaning deployments relying on the old config would break on upgrade.\n\n**Priority**: Before merge\n**Why This Matters**: The deprecated_opts dict keys must match the new option names registered by keystoneauth1 (valid_interfaces, not interface). The current mapping creates a deprecated alias for a non-existent \u0027interface\u0027 option in the adapter, so the old [keystone_client] interface value will not be picked up.\n\n**Recommendation**:\nChange the deprecation mapping from \u0027interface\u0027 to \u0027valid_interfaces\u0027: \u0027valid_interfaces\u0027: [cfg.DeprecatedOpt(\u0027interface\u0027, \u0027keystone_client\u0027)]. Note that the old option is a single string while the new one is a list, so this may also require a custom converter. Compare with the nova.py pattern which deliberately omits the interface mapping for this reason.","commit_id":"5cad1996e2cbc87286ce58a5af55ac6b2b641aab"},{"robot_id":"zuul","robot_run_id":"aad00a4867434fcbbc1dee219a87fb45","url":"https://zuul.teim.app/t/main/buildset/aad00a4867434fcbbc1dee219a87fb45","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"f7c2bae40c70bf03f282de907bd63c5107a1b1ea","patch_set":3,"id":"39fac894_44d8c40f","line":25,"updated":"2026-05-04 11:59:20.000000000","message":"The `_deprecations()` function in watcher/conf/keystone.py creates a new dict on every call. Since it is called in both register_opts and list_opts, and the deprecation mapping is static, it could be a module-level constant instead.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: Avoids repeated dict creation and makes the deprecation mapping more discoverable as a module-level constant.\n\n**Recommendation**:\nMove the deprecation dict to module level: `_DEPRECATED_OPTS \u003d {\u0027region_name\u0027: [...], \u0027valid-interfaces\u0027: [...]}` and reference it directly in register_opts and list_opts.","commit_id":"79cf4b3166b0b7bf39a244961cbc17ebe1638cc6"},{"robot_id":"zuul","robot_run_id":"aad00a4867434fcbbc1dee219a87fb45","url":"https://zuul.teim.app/t/main/buildset/aad00a4867434fcbbc1dee219a87fb45","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"f7c2bae40c70bf03f282de907bd63c5107a1b1ea","patch_set":3,"id":"a9a19ee8_22cf0f4f","line":27,"updated":"2026-05-04 11:59:20.000000000","message":"The `_deprecations()` function in watcher/conf/keystone.py maps \u0027valid-interfaces\u0027 to a deprecated \u0027interface\u0027 opt from keystone_client, but the old option in keystone_client.py is named \u0027interface\u0027 (not \u0027valid-interfaces\u0027). The mapping direction seems correct (new valid-interfaces deprecates old interface), but this should be verified against keystoneauth1\u0027s adapter conf options to ensure the key \u0027valid-interfaces\u0027 matches exactly what ks_loading expects.\n\n**Severity**: WARNING | **Confidence**: 0.7\n\n**Impact**: If the deprecated option mapping key does not match keystoneauth1\u0027s expected format, the deprecation warnings may not fire for operators using the old [keystone_client] interface option, leading to silent config breakage on upgrade.\n\n**Suggestion**:\nVerify that ks_loading.register_adapter_conf_options correctly uses \u0027valid-interfaces\u0027 as the option name when looking up deprecated_opts. The keystoneauth adapter typically registers valid_interfaces (with underscore), so the key in the deprecations dict should match the registered opt name.","commit_id":"79cf4b3166b0b7bf39a244961cbc17ebe1638cc6"}],"watcher/tests/fixtures/watcher.py":[{"robot_id":"zuul","robot_run_id":"e7a6594ef9c849429f3f7125104b9582","url":"https://zuul.teim.app/t/main/buildset/e7a6594ef9c849429f3f7125104b9582","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"aa6c7750699b2f04697e56ea927f5f3ce2a5bb97","patch_set":1,"id":"c86980a5_089f6fa0","line":138,"updated":"2026-05-04 09:03:14.000000000","message":"The test fixture KeystoneClient mocks clients.get_sdk_connection globally. If other tests also use get_sdk_connection, they may be affected by this mock.\n\n**Severity**: SUGGESTION | **Confidence**: 0.7\n\n**Benefit**: More isolated tests that are less likely to cause interference between test cases using different mocked services.\n\n**Recommendation**:\nThe current approach is acceptable since the fixture is opt-in. Consider adding a comment noting that this mock affects all calls to clients.get_sdk_connection within the test scope, to help future test authors.","commit_id":"4af2d1035b5dffa72d25c6bf0c248226d3df1233"},{"robot_id":"zuul","robot_run_id":"a107cc04fe5046d497dfff2ef6dd09a8","url":"https://zuul.teim.app/t/main/buildset/a107cc04fe5046d497dfff2ef6dd09a8","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"c6e43e6fc211e6905ace2f0d822488a586535185","patch_set":2,"id":"0c118406_4112bc60","line":128,"updated":"2026-05-04 10:13:42.000000000","message":"The KeystoneClient fixture class name in watcher/tests/fixtures/watcher.py is now somewhat misleading since it mocks openstacksdk Connection rather than keystoneclient.\n\n**Severity**: SUGGESTION | **Confidence**: 0.7\n\n**Benefit**: Renaming to KeystoneConnection or SdkKeystoneFixture would better reflect that it now mocks an openstacksdk Connection, improving test readability.\n\n**Recommendation**:\nConsider renaming the fixture class from KeystoneClient to something like KeystoneConnection or KeystoneSdkFixture in a follow-up cleanup patch to avoid confusion with the old keystoneclient naming.","commit_id":"5cad1996e2cbc87286ce58a5af55ac6b2b641aab"},{"robot_id":"zuul","robot_run_id":"aad00a4867434fcbbc1dee219a87fb45","url":"https://zuul.teim.app/t/main/buildset/aad00a4867434fcbbc1dee219a87fb45","author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"f7c2bae40c70bf03f282de907bd63c5107a1b1ea","patch_set":3,"id":"41db162b_acf97333","line":128,"updated":"2026-05-04 11:59:20.000000000","message":"The test fixture `KeystoneClient` in watcher/tests/fixtures/watcher.py patches `clients.get_sdk_connection` but the mock is set up to return `self.mock_connection` for all calls regardless of arguments. The `m_keystone` attribute is set to `self.mock_connection.identity`, which means tests must know the internal structure of the mock.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: Tests relying on this fixture are tightly coupled to the mock structure. If the openstacksdk Connection API changes or KeystoneHelper changes how it accesses identity services, tests may silently pass when they should fail.\n\n**Suggestion**:\nConsider adding a comment explaining the mock structure. Also consider using `autospec\u003dTrue` on the mock.patch.object call for `get_sdk_connection` to ensure the mock validates the function signature.","commit_id":"79cf4b3166b0b7bf39a244961cbc17ebe1638cc6"}]}