Reviewed: https://review.opendev.org/c/openstack/magnum/+/996409 Committed: https://opendev.org/openstack/magnum/commit/9f9c4b9fefe336f85770254823e2c817fbd8bdb5 Submitter: "Zuul (22348)" Branch: stable/2026.1
commit 9f9c4b9fefe336f85770254823e2c817fbd8bdb5 Author: Mahmoud Abouzeid <[email protected]> Date: Wed Jul 8 09:41:32 2026 +0300 Create trustee users with password-policy exemptions When Keystone PCI-DSS options are enabled ([security_compliance] change_password_upon_first_use / password_expires_days), every per-cluster trustee is created without exemptions, so trustee authentication fails with "The password is expired and needs to be changed" — breaking cluster health updates, the autoscaler, the cloud provider and cinder-csi on affected clouds. Keystone supports per-user options exactly for service accounts like these; create trustees with ignore_change_password_upon_first_use and ignore_password_expiry set, matching what Keystone documents for service users. NOTE: proposed for stable branches only (stable/2026.1 and earlier maintained branches): the trust manager was removed on master by 7999e015e ("Remove keystone trust manager"). Closes-Bug: #2038865 Change-Id: I751fe6e01a1b07d284638132309b04d7d1071b18 Signed-off-by: Mahmoud Abouzeid <[email protected]> -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2038865 Title: Template Create Fails if keystone.conf [security_compliance] settings are set To manage notifications about this bug go to: https://bugs.launchpad.net/magnum/+bug/2038865/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
