)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"f6f584c468316aaa000315adfeca6671ad53a944","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"a3d9325e_41757784","updated":"2026-09-21 23:37:31.000000000","message":"molecule is failing, I got it fixed locally by:\n\n- reverting the logic from tasks/main_ca_install.yml\n- `molecule/hashi_vault/group_vars/all.yml`: adding `vault_path: pki_root` to `foo_install_ca_variable`","commit_id":"cc136902e5025ad9fd2601339454a09abc69790b"}],"defaults/main.yml":[{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"f6f584c468316aaa000315adfeca6671ad53a944","unresolved":true,"context_lines":[{"line_number":69,"context_line":"#   - src: /opt/my-ca/MyRoot.crt"},{"line_number":70,"context_line":"#     filename: /etc/ssl/certs/MyRoot.crt"},{"line_number":71,"context_line":"#"},{"line_number":72,"context_line":"#   # CA certificate from Vault PKI"},{"line_number":73,"context_line":"#   - name: VaultCA"},{"line_number":74,"context_line":"#     vault_path: pki_int"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"fb16f4f3_ddcfca92","line":72,"updated":"2026-09-21 23:37:31.000000000","message":"If we go with the approach I suggested in the other comment, `vault_path` will be optional for `pki_install_ca`. So it would be nice to clarify it in here. I.e. change \"# CA certificate from Vault PKI\" to something like \"# CA intermediate certificate from Vault PKI where CA root is not managed by OSA\"","commit_id":"cc136902e5025ad9fd2601339454a09abc69790b"}],"releasenotes/notes/vault-install-ca-without-root-b86462b62cb724cd.yaml":[{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"f6f584c468316aaa000315adfeca6671ad53a944","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"upgrade:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    vault_path becomes required field in pki_install_ca when hash_vault backend"},{"line_number":5,"context_line":"    is used."},{"line_number":6,"context_line":"fixes:"},{"line_number":7,"context_line":"  - |"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"13cc54db_396dcd78","line":4,"updated":"2026-09-21 23:37:31.000000000","message":"typo: hashi_vault backend\n\nAdditionally, any changes in variables accepted in varialbes like `pki_install_certificates` need to be addressed in docs: https://docs.openstack.org/ansible-role-pki/latest/backends/hashi_vault.html","commit_id":"cc136902e5025ad9fd2601339454a09abc69790b"}],"tasks/hashi_vault/install_ca.yml":[{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"f6f584c468316aaa000315adfeca6671ad53a944","unresolved":true,"context_lines":[{"line_number":23,"context_line":"  community.hashi_vault.vault_read:"},{"line_number":24,"context_line":"    url: \"{{ pki_hashi_vault_host }}\""},{"line_number":25,"context_line":"    token: \"{{ vault_login_data.login.auth.client_token }}\""},{"line_number":26,"context_line":"    path: \"{{ (_pki_ca_defs | selectattr(\u0027name\u0027, \u0027equalto\u0027, ca.name) | map(attribute\u003d\u0027vault_path\u0027) | first) }}/cert/ca\""},{"line_number":27,"context_line":"  register: ca_cert"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"- name: Copy CA certificate to target host ({{ ca.name }})"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"b165302a_ee9d7d68","side":"PARENT","line":26,"updated":"2026-09-21 23:37:31.000000000","message":"maybe we can just use `\"{{ ca.vault_path }}/cert/ca\"` if it\u0027s defined but if it\u0027s not, just stick to the old value i.e. `{{ (_pki_ca_defs | selectattr(\u0027name\u0027, \u0027equalto\u0027, ca.name) | map(attribute\u003d\u0027vault_path\u0027) | first) }}/cert/ca\"`?\n\nthat would help us to avoid adding a hard requirement of defining `vault_path` as a strictly required field for `pki_install_ca`","commit_id":"f20a40f7959d49da8aeed9017ddfe8bf669bb6cc"}],"tasks/main_ca_install.yml":[{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"f6f584c468316aaa000315adfeca6671ad53a944","unresolved":true,"context_lines":[{"line_number":19,"context_line":"  loop_control:"},{"line_number":20,"context_line":"    loop_var: ca"},{"line_number":21,"context_line":"  vars:"},{"line_number":22,"context_line":"    ca_backend: \"{{ (_pki_ca_defs | selectattr(\u0027name\u0027, \u0027equalto\u0027, ca.name) | map(attribute\u003d\u0027backend\u0027) | first) }}\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"b428ede1_f2472256","side":"PARENT","line":22,"range":{"start_line":22,"start_character":4,"end_line":22,"end_character":14},"updated":"2026-09-21 23:37:31.000000000","message":"this logic is intentional, removing it will cause a regression by prohibiting users from installing CAs that belong multiple backends.\n\n\nIt may be useful sometimes. We already have places like Octavia where certs have to be issues by CA in a standalone backend.\n\nFrom what I understand, changing this logic is not really needed for your fix, so we can just keep it as is?","commit_id":"f20a40f7959d49da8aeed9017ddfe8bf669bb6cc"}]}