Merge ~al3jandrosg/ubuntu/+source/heat:fix-auth-trusts-plucky into ubuntu/+source/heat:ubuntu/plucky-devel

[Alejandro Santoyo Gonzalez]

[Simon Chopin (schopin)]

Please fix your git commit author metadata :)

6d16f98... by Alejandro Santoyo Gonzalez on 2025-10-28

Fix stack update when reauthentication_auth_method=trusts

When a stack is created with a certain user,
"reauthentication_auth_method=trusts" and an update is
triggered, the update fails because after the trust
regeneration the user_creds_id values are deleted for
the stack and the nested resources. Only the parent
stack gets a new set of creds but those are not
propagated to the nested resources.

This patch grabs the user_creds_id created for the
parent stack upon trust regeneration and propagates
that to the nested stacks.

Unmerged commits

6d16f98... by Alejandro Santoyo Gonzalez on 2025-10-28

Fix stack update when reauthentication_auth_method=trusts

When a stack is created with a certain user,
"reauthentication_auth_method=trusts" and an update is
triggered, the update fails because after the trust
regeneration the user_creds_id values are deleted for
the stack and the nested resources. Only the parent
stack gets a new set of creds but those are not
propagated to the nested resources.

This patch grabs the user_creds_id created for the
parent stack upon trust regeneration and propagates
that to the nested stacks.

diff --git a/debian/changelog b/debian/changelog
index e179d2d..47d5fa3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+heat (1:24.0.0-0ubuntu1.1) plucky; urgency=medium
+
+  * Fix stack update when reauth = trusts (LP: #2097539).
+    - d/p/lp2097539-Fix-stack-update-when-reauthentication_auth_method-t.patch
+
+ -- Alejandro Santoyo Gonzalez <[e-mail]>  Tue, 16 Sep 2025 08:51:43 +0000
+
 heat (1:24.0.0-0ubuntu1) plucky; urgency=medium
 
   * d/watch: Track Epoxy series releases.
diff --git a/debian/patches/lp2097539-Fix-stack-update-when-reauthentication_auth_method-t.patch b/debian/patches/lp2097539-Fix-stack-update-when-reauthentication_auth_method-t.patch
 new file mode 100644
index 0000000..5a3267c
--- /dev/null
+++ b/debian/patches/lp2097539-Fix-stack-update-when-reauthentication_auth_method-t.patch
@@ -0,0 +1,52 @@
+From bb309bde1114a2095a2088623dcc0ba45c7ee860
+From: Alejandro Santoyo <[e-mail]>
+Date: Wed, 26 Feb 2025 13:59:41 +0100
+Subject: Fix stack update when reauthentication_auth_method=trusts
+
+When a stack is created with a certain user,
+"reauthentication_auth_method=trusts" and an update is
+triggered, the update fails because after the trust
+regeneration the user_creds_id values are deleted for
+the stack and the nested resources. Only the parent
+stack gets a new set of creds but those are not
+propagated to the nested resources.
+
+This patch grabs the user_creds_id created for the
+parent stack upon trust regeneration and propagates
+that to the nested stacks.
+
+story: 2011342
+task: 51653
+
+Change-Id: I9a3263c6ab3d515fa468cfb7ce3cd6cfbf39aa57
+Signed-off-by: Alejandro Santoyo <[e-mail]>
+Origin: upstream, https://opendev.org/openstack/heat/commit/bb309bde1114a2095a2088623dcc0ba45c7ee860
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/heat/+bug/2097539
+---
+ heat/engine/stack.py | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/heat/engine/stack.py b/heat/engine/stack.py
+index f00e2b3dd..d4e93a64a 100644
+--- a/heat/engine/stack.py
++++ b/heat/engine/stack.py
+@@ -285,6 +285,16 @@ class Stack(collections.abc.Mapping):
+             parent_rsrc.use_parent_stack(parent_info, parent_stack)
+ 
+     def stored_context(self):
++        if not self.user_creds_id:
++            # if it's a nested stack and the creds have been deleted after
++            # the trust is regenerated, make sure we grab the newly created
++            # user_creds_id from the parent stack value for the nested stack
++            parent_id = self.root_stack_id()
++            if parent_id:  # check if it's a nested stack
++                stack = stack_object.Stack.get_by_id(self.context, parent_id,
++                                                     show_deleted=True)
++                self.user_creds_id = stack.user_creds_id
++
+         if self.user_creds_id:
+             creds_obj = ucreds_object.UserCreds.get_by_id(
+                 self.context, self.user_creds_id)
+-- 
+2.34.1
+
diff --git a/debian/patches/series b/debian/patches/series
index e394474..93c50c8 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,4 @@
 drop-zun.patch
 sudoers_patch.patch
 install-missing-files.patch
+lp2097539-Fix-stack-update-when-reauthentication_auth_method-t.patch