)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":28558,"name":"Ghada Khalil","email":"ghada.khalil@windriver.com","username":"gkhalil"},"change_message_id":"d832c2a6e48671bd2fc5b878d0ecba035d3aea61","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"02fc0e3d_7a037796","updated":"2021-11-04 20:02:56.000000000","message":"@Steve, please merge based on Andy\u0027s and Sabeel\u0027s review. Thanks.","commit_id":"947226b935c77b86464b80e189e302bc05feb380"},{"author":{"_account_id":32877,"name":"Joao Soubihe","email":"JoaoPaulo.Soubihe@windriver.com","username":"jsoubihe"},"change_message_id":"465114f6bd30f522cb2979017f90f6b598a52743","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"80239a42_bc2f1e10","updated":"2021-11-01 17:14:00.000000000","message":"Looks good to me.","commit_id":"947226b935c77b86464b80e189e302bc05feb380"},{"author":{"_account_id":24777,"name":"Steven Webster","email":"steven.webster@windriver.com","username":"swebster"},"change_message_id":"72716e6b24e0d9a65db30fd4e526a322a215f40b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"6b0a6f09_9f21ba19","updated":"2021-11-04 20:11:46.000000000","message":"Looks ok to me.  Merging based on qualified reviews from Sabeel, Joao, Andy, Al","commit_id":"947226b935c77b86464b80e189e302bc05feb380"},{"author":{"_account_id":31500,"name":"Sabeel Ansari","email":"Sabeel.Ansari@windriver.com","username":"sansari"},"change_message_id":"5a5e0aec9e510ecb92f5a8fa649e717f1a812929","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"6c15932a_edcbef80","updated":"2021-11-01 20:25:09.000000000","message":"This is adding the expiring-soon to ignore list. The alarm can be raised for any entity. Is this checking against the entity id?\n\nSame goes for expired alarm. Expired alarm can be raised against any entity.","commit_id":"947226b935c77b86464b80e189e302bc05feb380"},{"author":{"_account_id":15435,"name":"Al Bailey","email":"albailey1974@gmail.com","username":"albailey"},"change_message_id":"cc55b02d5ad0a234332c6c5a31ca22624b4af0ff","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"353f043f_dcc549fd","in_reply_to":"6c15932a_edcbef80","updated":"2021-11-01 20:32:47.000000000","message":"The ignore list (at this level) does not have filtering by internal values.\nIt basically would just blanket-ignore any alarms of this type when determining if the system is sane enough to exercise this operation.\nIf the underlying cause for that alarm ends up blocking an action later, we would just report that failure when it happens.","commit_id":"947226b935c77b86464b80e189e302bc05feb380"}],"sysinv/sysinv/sysinv/sysinv/api/controllers/v1/kube_rootca_update.py":[{"author":{"_account_id":32877,"name":"Joao Soubihe","email":"JoaoPaulo.Soubihe@windriver.com","username":"jsoubihe"},"change_message_id":"9bd86970b453018652a3d8278db165f35d4ed52f","unresolved":true,"context_lines":[{"line_number":589,"context_line":""},{"line_number":590,"context_line":"        self._check_cluster_health("},{"line_number":591,"context_line":"            \"kube-rootca-update-complete\","},{"line_number":592,"context_line":"            alarm_ignore_list\u003d["},{"line_number":593,"context_line":"                fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_IN_PROGRESS,"},{"line_number":594,"context_line":"                fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_AUTO_APPLY_INPROGRESS,"},{"line_number":595,"context_line":"                fm_constants.FM_ALARM_ID_CERT_EXPIRING_SOON],"},{"line_number":596,"context_line":"            force\u003dforce,"},{"line_number":597,"context_line":"        )"},{"line_number":598,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"48a188d2_42b37f83","line":595,"range":{"start_line":592,"start_character":12,"end_line":595,"end_character":61},"updated":"2021-11-01 12:13:38.000000000","message":"Maybe we should add fm_constants.FM_ALARM_ID_CERT_EXPIRED also? Guess a case in which the current procedure will be triggered while the above alarm is raised is a valid one...","commit_id":"620c7aadbb8418db7422e93b06a22284c6c06157"},{"author":{"_account_id":33667,"name":"Rafael Camargos","email":"RafaelLucas.Camargos@windriver.com","username":"rcamargo"},"change_message_id":"cfc98eedbaeb303f276d2da745c788dacc7e91b6","unresolved":true,"context_lines":[{"line_number":589,"context_line":""},{"line_number":590,"context_line":"        self._check_cluster_health("},{"line_number":591,"context_line":"            \"kube-rootca-update-complete\","},{"line_number":592,"context_line":"            alarm_ignore_list\u003d["},{"line_number":593,"context_line":"                fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_IN_PROGRESS,"},{"line_number":594,"context_line":"                fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_AUTO_APPLY_INPROGRESS,"},{"line_number":595,"context_line":"                fm_constants.FM_ALARM_ID_CERT_EXPIRING_SOON],"},{"line_number":596,"context_line":"            force\u003dforce,"},{"line_number":597,"context_line":"        )"},{"line_number":598,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"b07425c9_4a5d31f1","line":595,"range":{"start_line":592,"start_character":12,"end_line":595,"end_character":61},"in_reply_to":"48a188d2_42b37f83","updated":"2021-11-01 13:33:36.000000000","message":"Hi John,\n\nAccording to the bug report the scenario we are considering here is when the user generates a new rootca that is expiring soon, which is a possible and valid case, as opposed to generating an expired certificate, which is not allowed on `kube-rootca-update-generate-cert` neither a valid use case given that it disrupts the communication with the cluster.","commit_id":"620c7aadbb8418db7422e93b06a22284c6c06157"},{"author":{"_account_id":33667,"name":"Rafael Camargos","email":"RafaelLucas.Camargos@windriver.com","username":"rcamargo"},"change_message_id":"c6ad1c1b641fed263bb9282dedcfea3f38a533c4","unresolved":false,"context_lines":[{"line_number":589,"context_line":""},{"line_number":590,"context_line":"        self._check_cluster_health("},{"line_number":591,"context_line":"            \"kube-rootca-update-complete\","},{"line_number":592,"context_line":"            alarm_ignore_list\u003d["},{"line_number":593,"context_line":"                fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_IN_PROGRESS,"},{"line_number":594,"context_line":"                fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_AUTO_APPLY_INPROGRESS,"},{"line_number":595,"context_line":"                fm_constants.FM_ALARM_ID_CERT_EXPIRING_SOON],"},{"line_number":596,"context_line":"            force\u003dforce,"},{"line_number":597,"context_line":"        )"},{"line_number":598,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"e03d6db2_d2a2f695","line":595,"range":{"start_line":592,"start_character":12,"end_line":595,"end_character":61},"in_reply_to":"5f925dc8_6fc71c86","updated":"2021-11-04 18:20:13.000000000","message":"Ack","commit_id":"620c7aadbb8418db7422e93b06a22284c6c06157"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"406648a5db31e01fe830acf05ccc0d6901c1ec7d","unresolved":true,"context_lines":[{"line_number":589,"context_line":""},{"line_number":590,"context_line":"        self._check_cluster_health("},{"line_number":591,"context_line":"            \"kube-rootca-update-complete\","},{"line_number":592,"context_line":"            alarm_ignore_list\u003d["},{"line_number":593,"context_line":"                fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_IN_PROGRESS,"},{"line_number":594,"context_line":"                fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_AUTO_APPLY_INPROGRESS,"},{"line_number":595,"context_line":"                fm_constants.FM_ALARM_ID_CERT_EXPIRING_SOON],"},{"line_number":596,"context_line":"            force\u003dforce,"},{"line_number":597,"context_line":"        )"},{"line_number":598,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"f5ed928a_b28b301a","line":595,"range":{"start_line":592,"start_character":12,"end_line":595,"end_character":61},"in_reply_to":"b07425c9_4a5d31f1","updated":"2021-11-01 14:07:07.000000000","message":"I think it\u0027s fine to add the expiring soon alarm here. But I think we need to add this alarm to the ignore list in the start request as well, to cover the case where the alarm already raised before update start. This would be a normal use case where the user get the expiring soon alarm, and he starts to update the cert.\n\nRafael, can you do some tests to see if adding \"-f\" will force the update complete successfully? I don\u0027t think the Jira reporter tried \"-f\" to complete.","commit_id":"620c7aadbb8418db7422e93b06a22284c6c06157"},{"author":{"_account_id":33667,"name":"Rafael Camargos","email":"RafaelLucas.Camargos@windriver.com","username":"rcamargo"},"change_message_id":"6d1321f4c1a0affadab37d8df483fb033de22983","unresolved":true,"context_lines":[{"line_number":589,"context_line":""},{"line_number":590,"context_line":"        self._check_cluster_health("},{"line_number":591,"context_line":"            \"kube-rootca-update-complete\","},{"line_number":592,"context_line":"            alarm_ignore_list\u003d["},{"line_number":593,"context_line":"                fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_IN_PROGRESS,"},{"line_number":594,"context_line":"                fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_AUTO_APPLY_INPROGRESS,"},{"line_number":595,"context_line":"                fm_constants.FM_ALARM_ID_CERT_EXPIRING_SOON],"},{"line_number":596,"context_line":"            force\u003dforce,"},{"line_number":597,"context_line":"        )"},{"line_number":598,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"5f925dc8_6fc71c86","line":595,"range":{"start_line":592,"start_character":12,"end_line":595,"end_character":61},"in_reply_to":"f5ed928a_b28b301a","updated":"2021-11-01 15:29:34.000000000","message":"Good catch regarding ignoring the alarm on the update start as well Andy, updated.\n\nRegarding forcing the complete command, you are right: using the -f here forces the update to complete successfully even with the expiring soon alarm engaged.","commit_id":"620c7aadbb8418db7422e93b06a22284c6c06157"},{"author":{"_account_id":15435,"name":"Al Bailey","email":"albailey1974@gmail.com","username":"albailey"},"change_message_id":"cc55b02d5ad0a234332c6c5a31ca22624b4af0ff","unresolved":true,"context_lines":[{"line_number":457,"context_line":"        alarm_ignore_list \u003d body.get(\u0027alarm_ignore_list\u0027, [])"},{"line_number":458,"context_line":"        alarm_ignore_list.extend(["},{"line_number":459,"context_line":"            fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_ABORTED,"},{"line_number":460,"context_line":"            fm_constants.FM_ALARM_ID_CERT_EXPIRING_SOON])"},{"line_number":461,"context_line":""},{"line_number":462,"context_line":"        try:"},{"line_number":463,"context_line":"            update \u003d pecan.request.dbapi.kube_rootca_update_get_one()"}],"source_content_type":"text/x-python","patch_set":2,"id":"4a72aff1_852d9549","line":460,"updated":"2021-11-01 20:32:47.000000000","message":"I would suggest adding the \u0027expired\u0027  at the same time.   I dont know for certain if that is critical or not, but the VIM has started suppressing it, so if it does block anything it will be later on.\nAs Sabeel indicated,  these alarms can be raised for multiple certificate types.\n\nHaving an un-related certificate expiring or expired  probably should not block us from being able to run operations here.","commit_id":"947226b935c77b86464b80e189e302bc05feb380"},{"author":{"_account_id":33667,"name":"Rafael Camargos","email":"RafaelLucas.Camargos@windriver.com","username":"rcamargo"},"change_message_id":"6e885ee18306cd38dd2be19bcfb8acef869847eb","unresolved":true,"context_lines":[{"line_number":457,"context_line":"        alarm_ignore_list \u003d body.get(\u0027alarm_ignore_list\u0027, [])"},{"line_number":458,"context_line":"        alarm_ignore_list.extend(["},{"line_number":459,"context_line":"            fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_ABORTED,"},{"line_number":460,"context_line":"            fm_constants.FM_ALARM_ID_CERT_EXPIRING_SOON])"},{"line_number":461,"context_line":""},{"line_number":462,"context_line":"        try:"},{"line_number":463,"context_line":"            update \u003d pecan.request.dbapi.kube_rootca_update_get_one()"}],"source_content_type":"text/x-python","patch_set":2,"id":"a40360e9_827ae923","line":460,"in_reply_to":"4a72aff1_852d9549","updated":"2021-11-03 11:33:05.000000000","message":"While I agree that it is not ideal to ignore unrelated expiring certificates here I think we should drive our discussion based on the purpose of the design of these checks, which can be interpreted as \u0027verify the system is healthy when starting the process and that it finishes as healthy as it was before\u0027.\n\nWith that in mind, I don\u0027t think that having an expired cert on the system fits in these requirements, especially if this expired cert is the root CA one, given that the cluster connection is damaged and this procedure cannot be executed.","commit_id":"947226b935c77b86464b80e189e302bc05feb380"},{"author":{"_account_id":33667,"name":"Rafael Camargos","email":"RafaelLucas.Camargos@windriver.com","username":"rcamargo"},"change_message_id":"c6ad1c1b641fed263bb9282dedcfea3f38a533c4","unresolved":false,"context_lines":[{"line_number":457,"context_line":"        alarm_ignore_list \u003d body.get(\u0027alarm_ignore_list\u0027, [])"},{"line_number":458,"context_line":"        alarm_ignore_list.extend(["},{"line_number":459,"context_line":"            fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_ABORTED,"},{"line_number":460,"context_line":"            fm_constants.FM_ALARM_ID_CERT_EXPIRING_SOON])"},{"line_number":461,"context_line":""},{"line_number":462,"context_line":"        try:"},{"line_number":463,"context_line":"            update \u003d pecan.request.dbapi.kube_rootca_update_get_one()"}],"source_content_type":"text/x-python","patch_set":2,"id":"04b3ecef_fd596fb7","line":460,"in_reply_to":"77841ceb_b2f89e50","updated":"2021-11-04 18:20:13.000000000","message":"Ack","commit_id":"947226b935c77b86464b80e189e302bc05feb380"},{"author":{"_account_id":15435,"name":"Al Bailey","email":"albailey1974@gmail.com","username":"albailey"},"change_message_id":"1920bdb25802051822dc658a6d3a9fd64ee77957","unresolved":true,"context_lines":[{"line_number":457,"context_line":"        alarm_ignore_list \u003d body.get(\u0027alarm_ignore_list\u0027, [])"},{"line_number":458,"context_line":"        alarm_ignore_list.extend(["},{"line_number":459,"context_line":"            fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_ABORTED,"},{"line_number":460,"context_line":"            fm_constants.FM_ALARM_ID_CERT_EXPIRING_SOON])"},{"line_number":461,"context_line":""},{"line_number":462,"context_line":"        try:"},{"line_number":463,"context_line":"            update \u003d pecan.request.dbapi.kube_rootca_update_get_one()"}],"source_content_type":"text/x-python","patch_set":2,"id":"beb4516a_6d75d771","line":460,"in_reply_to":"a40360e9_827ae923","updated":"2021-11-03 19:19:49.000000000","message":"would the \u0027complete\u0027 procedure be able to run with an expired cert.  ie:  a person detects they are expiring,  perform most of the operations, and then forget to do the final stage.  I would assume at that point,  cert-alarm would no longer raise an expired anyways","commit_id":"947226b935c77b86464b80e189e302bc05feb380"},{"author":{"_account_id":33667,"name":"Rafael Camargos","email":"RafaelLucas.Camargos@windriver.com","username":"rcamargo"},"change_message_id":"434a68ed01d8ac3ddc9bfb6bad76affb8ab02b83","unresolved":true,"context_lines":[{"line_number":457,"context_line":"        alarm_ignore_list \u003d body.get(\u0027alarm_ignore_list\u0027, [])"},{"line_number":458,"context_line":"        alarm_ignore_list.extend(["},{"line_number":459,"context_line":"            fm_constants.FM_ALARM_ID_KUBE_ROOTCA_UPDATE_ABORTED,"},{"line_number":460,"context_line":"            fm_constants.FM_ALARM_ID_CERT_EXPIRING_SOON])"},{"line_number":461,"context_line":""},{"line_number":462,"context_line":"        try:"},{"line_number":463,"context_line":"            update \u003d pecan.request.dbapi.kube_rootca_update_get_one()"}],"source_content_type":"text/x-python","patch_set":2,"id":"77841ceb_b2f89e50","line":460,"in_reply_to":"beb4516a_6d75d771","updated":"2021-11-04 14:45:10.000000000","message":"Yes, you\u0027re correct: the alarm is removed during the `system kube-rootca-host-update host --phase\u003dtrust-new-ca` command.","commit_id":"947226b935c77b86464b80e189e302bc05feb380"}]}