Comment 84 for bug 2004555

Reviewed the cinder patch (5fe7d14c097260). Code and tests look good. Just a few minor things:

api-ref/source/v3/attachments.inc
nit: s/cinder api/Block Storage API/

cinder/exception.py
nit: s/through nova/using the Compute API/

releasenote:
1. in 'critical': s/token services/service tokens/
2. in 'security': s/other/another/
3. in 'upgrade': s/service it's/service if it's/
4. in 'upgrade': the role, option, and section names should be in double-backticks (they're in single backticks, which will render as italics instead of monospace font)
actually, forget 3 & 4 and maybe rewrite the upgrade section slightly:

upgrade:
  - |
    Nova must be `configured to send service tokens
    <https://docs.openstack.org/cinder/latest/configuration/block-storage/service-token.html>`_
    **and** cinder must be configured to recognize at least one of the roles
    that the nova service user has been assigned in keystone. By default,
    cinder will recognize the ``service`` role, so if the nova service user
    is assigned a differently named role in your cloud, you must adjust your
    cinder configuration file (``service_token_roles`` configuration option
    in the ``keystone_authtoken`` section). If nova and cinder are not
    configured correctly in this regard, detaching volumes will no longer
    work (`Bug #2004555 <https://bugs.launchpad.net/cinder/+bug/2004555>`_).