)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"b457e6c6678ff7fd29f8040d7309597a56441a71","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"994fd928_28795199","updated":"2025-07-03 09:50:43.000000000","message":"I really don\u0027t think we should get rid of backend vars tbh thinking about this again now.","commit_id":"44bfae36fd9b6acf9a3de6873b30cf4a1f853a11"},{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"3874beabcef68a5f0f00ce1196001f3b0707c733","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"0159a05a_47145011","updated":"2025-07-07 17:22:54.000000000","message":"I think I would prefer to see this patch be a re-organisation of the code so that there is a uniform setup across CA and certificates, with clear tasks files at the top level for creation and installation.\n\nWe should move the actual implementation of the certificate installation for the \u0027standalone\u0027 backend into the standalone/ directory, as part of this patch does, and not rearrange the variables unnecessarily.","commit_id":"44bfae36fd9b6acf9a3de6873b30cf4a1f853a11"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"a38a0c609bb549e3c786a9e3ed02b1c1e4da7056","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"7ac81a8e_fdd617a3","updated":"2025-08-29 13:09:05.000000000","message":"it needs a rebase","commit_id":"51270ad7aa5a0cd012e325b754298f89ad53e905"}],"defaults/main.yml":[{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"d50da1059c030f3190f463a4e0e52175db2a3458","unresolved":true,"context_lines":[{"line_number":158,"context_line":"pki_key_mode: \"0600\""},{"line_number":159,"context_line":"pki_key_dir_mode: \"0700\""},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"# Command used to update CA trust store"},{"line_number":162,"context_line":"pki_ca_install_command:"},{"line_number":163,"context_line":"  apt: \"update-ca-certificates\""},{"line_number":164,"context_line":"  dnf: \"update-ca-trust extract\""},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"# standalone backend variables"},{"line_number":167,"context_line":"pki_dir: \"/etc/pki\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"6a72f5b2_b701cdfd","line":164,"range":{"start_line":161,"start_character":0,"end_line":164,"end_character":32},"updated":"2025-07-01 15:59:08.000000000","message":"this is probably also an internal implementation detail","commit_id":"44bfae36fd9b6acf9a3de6873b30cf4a1f853a11"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"ae85142c98aaa14d70d81db7ae27d12582f47c60","unresolved":false,"context_lines":[{"line_number":158,"context_line":"pki_key_mode: \"0600\""},{"line_number":159,"context_line":"pki_key_dir_mode: \"0700\""},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"# Command used to update CA trust store"},{"line_number":162,"context_line":"pki_ca_install_command:"},{"line_number":163,"context_line":"  apt: \"update-ca-certificates\""},{"line_number":164,"context_line":"  dnf: \"update-ca-trust extract\""},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"# standalone backend variables"},{"line_number":167,"context_line":"pki_dir: \"/etc/pki\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"8db4b8be_13a88c06","line":164,"range":{"start_line":161,"start_character":0,"end_line":164,"end_character":32},"in_reply_to":"6a72f5b2_b701cdfd","updated":"2025-07-17 22:33:24.000000000","message":"Done","commit_id":"44bfae36fd9b6acf9a3de6873b30cf4a1f853a11"},{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"a69b9312b719756d2e70f2be2d9c4dc588bbe206","unresolved":true,"context_lines":[{"line_number":157,"context_line":"pki_cert_dir_mode: \"0755\""},{"line_number":158,"context_line":"pki_key_mode: \"0600\""},{"line_number":159,"context_line":"pki_key_dir_mode: \"0700\""},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"# Command used to update CA trust store"},{"line_number":162,"context_line":"pki_ca_install_command:"},{"line_number":163,"context_line":"  apt: \"update-ca-certificates\""},{"line_number":164,"context_line":"  dnf: \"update-ca-trust extract\""},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"# standalone backend variables"},{"line_number":167,"context_line":"pki_dir: \"/etc/pki\""},{"line_number":168,"context_line":"cert_dir: \"{{ pki_dir }}/certs\""},{"line_number":169,"context_line":"# subdirectories to be created for holding server certs/keys/csr"},{"line_number":170,"context_line":"pki_cert_dirs: \"{{ _pki_cert_dirs }}\""},{"line_number":171,"context_line":"# directories for certificate authorities on the CA host"},{"line_number":172,"context_line":"pki_ca_dirs:"},{"line_number":173,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":174,"context_line":"  - path: \"{{ pki_dir ~ \u0027/roots\u0027 }}\""},{"line_number":175,"context_line":"# directories for server certificates on the CA host"},{"line_number":176,"context_line":"_pki_cert_dirs:"},{"line_number":177,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":178,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs\u0027 }}\""},{"line_number":179,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""},{"line_number":180,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/csr\u0027 }}\""},{"line_number":181,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":182,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/private\u0027 }}\""},{"line_number":183,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":184,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/certs\u0027 }}\""},{"line_number":185,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"be95c31e_97864fcd","line":185,"range":{"start_line":160,"start_character":0,"end_line":185,"end_character":35},"updated":"2025-06-30 17:03:59.000000000","message":"this is a bit odd to add all these things to the defaults/main.yml file.\n\ndefaults/ should be the place where we put all of the \"external API\" that we expect users to understand and override, and we should put internal implementation details into vars/","commit_id":"44bfae36fd9b6acf9a3de6873b30cf4a1f853a11"},{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"d50da1059c030f3190f463a4e0e52175db2a3458","unresolved":true,"context_lines":[{"line_number":157,"context_line":"pki_cert_dir_mode: \"0755\""},{"line_number":158,"context_line":"pki_key_mode: \"0600\""},{"line_number":159,"context_line":"pki_key_dir_mode: \"0700\""},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"# Command used to update CA trust store"},{"line_number":162,"context_line":"pki_ca_install_command:"},{"line_number":163,"context_line":"  apt: \"update-ca-certificates\""},{"line_number":164,"context_line":"  dnf: \"update-ca-trust extract\""},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"# standalone backend variables"},{"line_number":167,"context_line":"pki_dir: \"/etc/pki\""},{"line_number":168,"context_line":"cert_dir: \"{{ pki_dir }}/certs\""},{"line_number":169,"context_line":"# subdirectories to be created for holding server certs/keys/csr"},{"line_number":170,"context_line":"pki_cert_dirs: \"{{ _pki_cert_dirs }}\""},{"line_number":171,"context_line":"# directories for certificate authorities on the CA host"},{"line_number":172,"context_line":"pki_ca_dirs:"},{"line_number":173,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":174,"context_line":"  - path: \"{{ pki_dir ~ \u0027/roots\u0027 }}\""},{"line_number":175,"context_line":"# directories for server certificates on the CA host"},{"line_number":176,"context_line":"_pki_cert_dirs:"},{"line_number":177,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":178,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs\u0027 }}\""},{"line_number":179,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""},{"line_number":180,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/csr\u0027 }}\""},{"line_number":181,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":182,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/private\u0027 }}\""},{"line_number":183,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":184,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/certs\u0027 }}\""},{"line_number":185,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ebea044e_d5477b01","line":185,"range":{"start_line":160,"start_character":0,"end_line":185,"end_character":35},"in_reply_to":"0245e2d5_32d91872","updated":"2025-07-01 15:59:08.000000000","message":"variables that start with _ are usually internal","commit_id":"44bfae36fd9b6acf9a3de6873b30cf4a1f853a11"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"e5e820d7a2f3f1caa756118fd4a86b5294b93bdc","unresolved":true,"context_lines":[{"line_number":157,"context_line":"pki_cert_dir_mode: \"0755\""},{"line_number":158,"context_line":"pki_key_mode: \"0600\""},{"line_number":159,"context_line":"pki_key_dir_mode: \"0700\""},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"# Command used to update CA trust store"},{"line_number":162,"context_line":"pki_ca_install_command:"},{"line_number":163,"context_line":"  apt: \"update-ca-certificates\""},{"line_number":164,"context_line":"  dnf: \"update-ca-trust extract\""},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"# standalone backend variables"},{"line_number":167,"context_line":"pki_dir: \"/etc/pki\""},{"line_number":168,"context_line":"cert_dir: \"{{ pki_dir }}/certs\""},{"line_number":169,"context_line":"# subdirectories to be created for holding server certs/keys/csr"},{"line_number":170,"context_line":"pki_cert_dirs: \"{{ _pki_cert_dirs }}\""},{"line_number":171,"context_line":"# directories for certificate authorities on the CA host"},{"line_number":172,"context_line":"pki_ca_dirs:"},{"line_number":173,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":174,"context_line":"  - path: \"{{ pki_dir ~ \u0027/roots\u0027 }}\""},{"line_number":175,"context_line":"# directories for server certificates on the CA host"},{"line_number":176,"context_line":"_pki_cert_dirs:"},{"line_number":177,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":178,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs\u0027 }}\""},{"line_number":179,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""},{"line_number":180,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/csr\u0027 }}\""},{"line_number":181,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":182,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/private\u0027 }}\""},{"line_number":183,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":184,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/certs\u0027 }}\""},{"line_number":185,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"d75f22dd_2c15f2b7","line":185,"range":{"start_line":160,"start_character":0,"end_line":185,"end_character":35},"in_reply_to":"7d344f81_1c16de4a","updated":"2025-07-02 19:46:08.000000000","message":"Also, to be completely honest, I don\u0027t see why one would override `pki_ca_dirs` or `pki_cert_dirs` at all, as these are used only to create a directory structure based on the `pki_dir` - they do not have any effect on how certs will be placed on generation.\n\nSo I would even consider making them internal-only, and remove from defaults.","commit_id":"44bfae36fd9b6acf9a3de6873b30cf4a1f853a11"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"ebf015607d31abb852dd0d2d667e1ce47dcb414f","unresolved":true,"context_lines":[{"line_number":157,"context_line":"pki_cert_dir_mode: \"0755\""},{"line_number":158,"context_line":"pki_key_mode: \"0600\""},{"line_number":159,"context_line":"pki_key_dir_mode: \"0700\""},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"# Command used to update CA trust store"},{"line_number":162,"context_line":"pki_ca_install_command:"},{"line_number":163,"context_line":"  apt: \"update-ca-certificates\""},{"line_number":164,"context_line":"  dnf: \"update-ca-trust extract\""},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"# standalone backend variables"},{"line_number":167,"context_line":"pki_dir: \"/etc/pki\""},{"line_number":168,"context_line":"cert_dir: \"{{ pki_dir }}/certs\""},{"line_number":169,"context_line":"# subdirectories to be created for holding server certs/keys/csr"},{"line_number":170,"context_line":"pki_cert_dirs: \"{{ _pki_cert_dirs }}\""},{"line_number":171,"context_line":"# directories for certificate authorities on the CA host"},{"line_number":172,"context_line":"pki_ca_dirs:"},{"line_number":173,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":174,"context_line":"  - path: \"{{ pki_dir ~ \u0027/roots\u0027 }}\""},{"line_number":175,"context_line":"# directories for server certificates on the CA host"},{"line_number":176,"context_line":"_pki_cert_dirs:"},{"line_number":177,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":178,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs\u0027 }}\""},{"line_number":179,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""},{"line_number":180,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/csr\u0027 }}\""},{"line_number":181,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":182,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/private\u0027 }}\""},{"line_number":183,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":184,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/certs\u0027 }}\""},{"line_number":185,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"0245e2d5_32d91872","line":185,"range":{"start_line":160,"start_character":0,"end_line":185,"end_character":35},"in_reply_to":"be95c31e_97864fcd","updated":"2025-06-30 21:23:06.000000000","message":"That\u0027s a valid point. But which of these variables are actually internal and not meant to be overridden by users?\n\nI believe it\u0027s only `pki_ca_install_command`. It makes sense to allow overriding `pki_ca_dirs` and `_pki_cert_dirs` in some cases. (Though actually, `_pki_cert_dirs` should just be removed, and its value moved to `pki_cert_dirs` - I missed that earlier.)\n\nThe reason I\u0027m hesitant to keep variables that can be overridden in some cases inside `vars/` is because of Ansible\u0027s variable precedence: variables in `vars/` cannot be overridden by `group_vars/`, and I’ve already run into issues a few times because of this.","commit_id":"44bfae36fd9b6acf9a3de6873b30cf4a1f853a11"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"8fd7e1c0e84a910ebd0a9017909f6b2d12d4871b","unresolved":true,"context_lines":[{"line_number":157,"context_line":"pki_cert_dir_mode: \"0755\""},{"line_number":158,"context_line":"pki_key_mode: \"0600\""},{"line_number":159,"context_line":"pki_key_dir_mode: \"0700\""},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"# Command used to update CA trust store"},{"line_number":162,"context_line":"pki_ca_install_command:"},{"line_number":163,"context_line":"  apt: \"update-ca-certificates\""},{"line_number":164,"context_line":"  dnf: \"update-ca-trust extract\""},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"# standalone backend variables"},{"line_number":167,"context_line":"pki_dir: \"/etc/pki\""},{"line_number":168,"context_line":"cert_dir: \"{{ pki_dir }}/certs\""},{"line_number":169,"context_line":"# subdirectories to be created for holding server certs/keys/csr"},{"line_number":170,"context_line":"pki_cert_dirs: \"{{ _pki_cert_dirs }}\""},{"line_number":171,"context_line":"# directories for certificate authorities on the CA host"},{"line_number":172,"context_line":"pki_ca_dirs:"},{"line_number":173,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":174,"context_line":"  - path: \"{{ pki_dir ~ \u0027/roots\u0027 }}\""},{"line_number":175,"context_line":"# directories for server certificates on the CA host"},{"line_number":176,"context_line":"_pki_cert_dirs:"},{"line_number":177,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":178,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs\u0027 }}\""},{"line_number":179,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""},{"line_number":180,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/csr\u0027 }}\""},{"line_number":181,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":182,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/private\u0027 }}\""},{"line_number":183,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":184,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/certs\u0027 }}\""},{"line_number":185,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"f97899b1_7e6e9945","line":185,"range":{"start_line":160,"start_character":0,"end_line":185,"end_character":35},"in_reply_to":"d75f22dd_2c15f2b7","updated":"2025-07-17 22:33:13.000000000","message":"I reorganized defaults and vars","commit_id":"44bfae36fd9b6acf9a3de6873b30cf4a1f853a11"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"cb7cfa352910d7638340ae96047836005acbf680","unresolved":true,"context_lines":[{"line_number":157,"context_line":"pki_cert_dir_mode: \"0755\""},{"line_number":158,"context_line":"pki_key_mode: \"0600\""},{"line_number":159,"context_line":"pki_key_dir_mode: \"0700\""},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"# Command used to update CA trust store"},{"line_number":162,"context_line":"pki_ca_install_command:"},{"line_number":163,"context_line":"  apt: \"update-ca-certificates\""},{"line_number":164,"context_line":"  dnf: \"update-ca-trust extract\""},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"# standalone backend variables"},{"line_number":167,"context_line":"pki_dir: \"/etc/pki\""},{"line_number":168,"context_line":"cert_dir: \"{{ pki_dir }}/certs\""},{"line_number":169,"context_line":"# subdirectories to be created for holding server certs/keys/csr"},{"line_number":170,"context_line":"pki_cert_dirs: \"{{ _pki_cert_dirs }}\""},{"line_number":171,"context_line":"# directories for certificate authorities on the CA host"},{"line_number":172,"context_line":"pki_ca_dirs:"},{"line_number":173,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":174,"context_line":"  - path: \"{{ pki_dir ~ \u0027/roots\u0027 }}\""},{"line_number":175,"context_line":"# directories for server certificates on the CA host"},{"line_number":176,"context_line":"_pki_cert_dirs:"},{"line_number":177,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":178,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs\u0027 }}\""},{"line_number":179,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""},{"line_number":180,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/csr\u0027 }}\""},{"line_number":181,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":182,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/private\u0027 }}\""},{"line_number":183,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":184,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/certs\u0027 }}\""},{"line_number":185,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"7d344f81_1c16de4a","line":185,"range":{"start_line":160,"start_character":0,"end_line":185,"end_character":35},"in_reply_to":"ebea044e_d5477b01","updated":"2025-07-02 19:41:56.000000000","message":"Um, `pki_cert_dirs` is already in defaults and can be overriden by group_vars. So it does not really justify or explain removal of vars file.\n\nAnother question is that we do have a big currently, as https://opendev.org/openstack/ansible-role-pki/src/commit/83fb106afd27291b6c69204b7b51c89d8daf7726/vars/standalone_ca.yml#L17 should obviously be `_pki_ca_dirs`","commit_id":"44bfae36fd9b6acf9a3de6873b30cf4a1f853a11"},{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"9512d84e4fa066bceb0a6c7b4b02de5ae42dabfa","unresolved":true,"context_lines":[{"line_number":107,"context_line":"# Python interpreter that will be used during cert generation"},{"line_number":108,"context_line":"pki_setup_host_python_interpreter: \"{{ (pki_setup_host \u003d\u003d \u0027localhost\u0027) | ternary(ansible_playbook_python, ansible_facts[\u0027python\u0027][\u0027executable\u0027]) }}\""},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"# base directory for the CA and server certificates"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"# certificates to install"},{"line_number":113,"context_line":"pki_install_certificates: []"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"c0ad084b_4c6a8a21","line":110,"range":{"start_line":110,"start_character":0,"end_line":110,"end_character":51},"updated":"2025-09-24 20:11:56.000000000","message":"does this comment remain but the var is absent?","commit_id":"3812f90982771223495fbe35ec473ec79c3b9923"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"5307eb620803d1c331499cd964924544a2f60d3e","unresolved":false,"context_lines":[{"line_number":107,"context_line":"# Python interpreter that will be used during cert generation"},{"line_number":108,"context_line":"pki_setup_host_python_interpreter: \"{{ (pki_setup_host \u003d\u003d \u0027localhost\u0027) | ternary(ansible_playbook_python, ansible_facts[\u0027python\u0027][\u0027executable\u0027]) }}\""},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"# base directory for the CA and server certificates"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"# certificates to install"},{"line_number":113,"context_line":"pki_install_certificates: []"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"ee1d4f0f_35014040","line":110,"range":{"start_line":110,"start_character":0,"end_line":110,"end_character":51},"in_reply_to":"c0ad084b_4c6a8a21","updated":"2025-09-25 19:04:18.000000000","message":"ah good catch, I forgot to move the comment. fixed.","commit_id":"3812f90982771223495fbe35ec473ec79c3b9923"}],"tasks/main_ca.yml":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"0534a2daa9785e34ff1e8759a11bb5da9d5e371a","unresolved":true,"context_lines":[{"line_number":13,"context_line":"# See the License for the specific language governing permissions and"},{"line_number":14,"context_line":"# limitations under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"- name: Include {{ pki_default_backend }} CA variables"},{"line_number":17,"context_line":"  ansible.builtin.include_vars:"},{"line_number":18,"context_line":"    file: \"{{ pki_default_backend ~ \u0027_ca.yml\u0027 }}\""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"- name: Create PKI directories"},{"line_number":21,"context_line":"  ansible.builtin.file:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"b732d4d1_632e399f","side":"PARENT","line":18,"range":{"start_line":16,"start_character":0,"end_line":18,"end_character":49},"updated":"2025-06-26 14:03:06.000000000","message":"I\u0027m not sure I understand reason of getting rid of vars include here. I see that there are bunch of variables introduced by vault backend as well. So why not keep having a backend-specific vars file for standalone/vault?","commit_id":"9b94a7ab37bf2ed78466204b5158e4ce0ebe0037"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"ebf015607d31abb852dd0d2d667e1ce47dcb414f","unresolved":true,"context_lines":[{"line_number":13,"context_line":"# See the License for the specific language governing permissions and"},{"line_number":14,"context_line":"# limitations under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"- name: Include {{ pki_default_backend }} CA variables"},{"line_number":17,"context_line":"  ansible.builtin.include_vars:"},{"line_number":18,"context_line":"    file: \"{{ pki_default_backend ~ \u0027_ca.yml\u0027 }}\""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"- name: Create PKI directories"},{"line_number":21,"context_line":"  ansible.builtin.file:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"c20b5f29_42fbcfde","side":"PARENT","line":18,"range":{"start_line":16,"start_character":0,"end_line":18,"end_character":49},"in_reply_to":"b732d4d1_632e399f","updated":"2025-06-30 21:23:06.000000000","message":"The reason I\u0027m hesitant to keep variables that can be overridden in some cases inside `vars/` is because of Ansible\u0027s variable precedence: variables in `vars/` cannot be overridden by `group_vars/`, and I’ve already run into issues a few times because of this.\n\nBut if we want to avoid storing backend-specific variables in defaults/main.yml, maybe we can move them to `defaults/standalone.yml` and `defaults/hashi_vault.yml` and define some `include_vars` task in the playbook? (but they include should go in the different place since each certificate can be linked to a different backend).","commit_id":"9b94a7ab37bf2ed78466204b5158e4ce0ebe0037"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"8fd7e1c0e84a910ebd0a9017909f6b2d12d4871b","unresolved":false,"context_lines":[{"line_number":13,"context_line":"# See the License for the specific language governing permissions and"},{"line_number":14,"context_line":"# limitations under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"- name: Include {{ pki_default_backend }} CA variables"},{"line_number":17,"context_line":"  ansible.builtin.include_vars:"},{"line_number":18,"context_line":"    file: \"{{ pki_default_backend ~ \u0027_ca.yml\u0027 }}\""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"- name: Create PKI directories"},{"line_number":21,"context_line":"  ansible.builtin.file:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"f4072101_c2e5f90f","side":"PARENT","line":18,"range":{"start_line":16,"start_character":0,"end_line":18,"end_character":49},"in_reply_to":"c20b5f29_42fbcfde","updated":"2025-07-17 22:33:13.000000000","message":"Done","commit_id":"9b94a7ab37bf2ed78466204b5158e4ce0ebe0037"}],"tasks/main_ca_install.yml":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"0534a2daa9785e34ff1e8759a11bb5da9d5e371a","unresolved":true,"context_lines":[{"line_number":13,"context_line":"# See the License for the specific language governing permissions and"},{"line_number":14,"context_line":"# limitations under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"- name: Include {{ pki_default_backend }} CA variables"},{"line_number":17,"context_line":"  ansible.builtin.include_vars:"},{"line_number":18,"context_line":"    file: \"{{ pki_default_backend ~ \u0027_ca.yml\u0027 }}\""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"- name: Install certificate authorities"},{"line_number":21,"context_line":"  ansible.builtin.include_tasks: \"{{ pki_default_backend }}/install_ca.yml\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"eeee525e_67788e69","side":"PARENT","line":18,"range":{"start_line":16,"start_character":0,"end_line":18,"end_character":49},"updated":"2025-06-26 14:03:06.000000000","message":"same thing here","commit_id":"9b94a7ab37bf2ed78466204b5158e4ce0ebe0037"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"ebf015607d31abb852dd0d2d667e1ce47dcb414f","unresolved":false,"context_lines":[{"line_number":13,"context_line":"# See the License for the specific language governing permissions and"},{"line_number":14,"context_line":"# limitations under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"- name: Include {{ pki_default_backend }} CA variables"},{"line_number":17,"context_line":"  ansible.builtin.include_vars:"},{"line_number":18,"context_line":"    file: \"{{ pki_default_backend ~ \u0027_ca.yml\u0027 }}\""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"- name: Install certificate authorities"},{"line_number":21,"context_line":"  ansible.builtin.include_tasks: \"{{ pki_default_backend }}/install_ca.yml\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"166c6c4d_58c5551b","side":"PARENT","line":18,"range":{"start_line":16,"start_character":0,"end_line":18,"end_character":49},"in_reply_to":"eeee525e_67788e69","updated":"2025-06-30 21:23:06.000000000","message":"Done","commit_id":"9b94a7ab37bf2ed78466204b5158e4ce0ebe0037"}],"tasks/standalone/create_ca.yml":[{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"9512d84e4fa066bceb0a6c7b4b02de5ae42dabfa","unresolved":true,"context_lines":[{"line_number":13,"context_line":"# See the License for the specific language governing permissions and"},{"line_number":14,"context_line":"# limitations under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"- name: Set CA-related variables"},{"line_number":17,"context_line":"  ansible.builtin.set_fact:"},{"line_number":18,"context_line":"    ca_dir: \"{{ pki_dir }}/roots/{{ ca.name }}\""},{"line_number":19,"context_line":"    ca_cert_prefix: \"{{ pki_dir }}/roots/{{ ca.name }}/certs/{{ ca.name }}\""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"- name: Create PKI directories"},{"line_number":22,"context_line":"  ansible.builtin.file:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"17866ba2_ac00c893","line":19,"range":{"start_line":16,"start_character":0,"end_line":19,"end_character":75},"updated":"2025-09-24 20:11:56.000000000","message":"is there a reason these need to be set_fact rather than just be internal lazily evaulated variables from the vars/ file?\n\nIf they are only used in this file, alternatively move the definition to vars: on the block: below perhaps.","commit_id":"3812f90982771223495fbe35ec473ec79c3b9923"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"5307eb620803d1c331499cd964924544a2f60d3e","unresolved":false,"context_lines":[{"line_number":13,"context_line":"# See the License for the specific language governing permissions and"},{"line_number":14,"context_line":"# limitations under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"- name: Set CA-related variables"},{"line_number":17,"context_line":"  ansible.builtin.set_fact:"},{"line_number":18,"context_line":"    ca_dir: \"{{ pki_dir }}/roots/{{ ca.name }}\""},{"line_number":19,"context_line":"    ca_cert_prefix: \"{{ pki_dir }}/roots/{{ ca.name }}/certs/{{ ca.name }}\""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"- name: Create PKI directories"},{"line_number":22,"context_line":"  ansible.builtin.file:"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"22024cd5_e018e8de","line":19,"range":{"start_line":16,"start_character":0,"end_line":19,"end_character":75},"in_reply_to":"17866ba2_ac00c893","updated":"2025-09-25 19:04:18.000000000","message":"fixed","commit_id":"3812f90982771223495fbe35ec473ec79c3b9923"}],"tasks/standalone/install_cert.yml":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"0534a2daa9785e34ff1e8759a11bb5da9d5e371a","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"# Copyright 2021, BBC"},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\");"},{"line_number":5,"context_line":"# you may not use this file except in compliance with the License."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3f083c8a_4a0b5449","line":2,"range":{"start_line":2,"start_character":0,"end_line":2,"end_character":21},"updated":"2025-06-26 14:03:06.000000000","message":"wrong copyright","commit_id":"44bfae36fd9b6acf9a3de6873b30cf4a1f853a11"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"bb90b1f62d7279e71ebc2ad6def1d00744d84565","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"# Copyright 2021, BBC"},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\");"},{"line_number":5,"context_line":"# you may not use this file except in compliance with the License."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"50139452_ad3a837f","line":2,"range":{"start_line":2,"start_character":0,"end_line":2,"end_character":21},"in_reply_to":"3f083c8a_4a0b5449","updated":"2025-06-30 21:39:01.000000000","message":"Acknowledged","commit_id":"44bfae36fd9b6acf9a3de6873b30cf4a1f853a11"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"8fd7e1c0e84a910ebd0a9017909f6b2d12d4871b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"# Copyright 2021, BBC"},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\");"},{"line_number":5,"context_line":"# you may not use this file except in compliance with the License."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"0ac6dede_4ae15d1d","line":2,"range":{"start_line":2,"start_character":0,"end_line":2,"end_character":21},"in_reply_to":"50139452_ad3a837f","updated":"2025-07-17 22:33:13.000000000","message":"Done","commit_id":"44bfae36fd9b6acf9a3de6873b30cf4a1f853a11"}],"vars/main.yml":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"6e2e05920d96a0cbaa0cb454c9b13480671df309","unresolved":true,"context_lines":[{"line_number":39,"context_line":"  apt: /usr/local/share/ca-certificates/"},{"line_number":40,"context_line":"  dnf: /etc/pki/ca-trust/source/anchors/"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"# standalone backend variables"},{"line_number":43,"context_line":"cert_dir: \"{{ pki_dir }}/certs\""},{"line_number":44,"context_line":"# subdirectories to be created for holding server certs/keys/csr"},{"line_number":45,"context_line":"pki_cert_dirs:"},{"line_number":46,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":47,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs\u0027 }}\""},{"line_number":48,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""},{"line_number":49,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/csr\u0027 }}\""},{"line_number":50,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":51,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/private\u0027 }}\""},{"line_number":52,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":53,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/certs\u0027 }}\""},{"line_number":54,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""},{"line_number":55,"context_line":"# directories for certificate authorities on the CA host"},{"line_number":56,"context_line":"pki_ca_dirs:"},{"line_number":57,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":58,"context_line":"  - path: \"{{ pki_dir ~ \u0027/roots\u0027 }}\""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"74640d8f_936f1c7b","line":58,"range":{"start_line":42,"start_character":0,"end_line":58,"end_character":36},"updated":"2025-08-26 11:58:21.000000000","message":"ok, I think I\u0027m asking the same question again, but what is the reason not to use a backend-specific vars file which will be included depending on supplied backend?\n\nIs it due to the mix of backends we might have at the same time for some cases?","commit_id":"51270ad7aa5a0cd012e325b754298f89ad53e905"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"2e48d8c0408dfdf11f36b0c0013b2b1d28421758","unresolved":true,"context_lines":[{"line_number":39,"context_line":"  apt: /usr/local/share/ca-certificates/"},{"line_number":40,"context_line":"  dnf: /etc/pki/ca-trust/source/anchors/"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"# standalone backend variables"},{"line_number":43,"context_line":"cert_dir: \"{{ pki_dir }}/certs\""},{"line_number":44,"context_line":"# subdirectories to be created for holding server certs/keys/csr"},{"line_number":45,"context_line":"pki_cert_dirs:"},{"line_number":46,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":47,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs\u0027 }}\""},{"line_number":48,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""},{"line_number":49,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/csr\u0027 }}\""},{"line_number":50,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":51,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/private\u0027 }}\""},{"line_number":52,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":53,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/certs\u0027 }}\""},{"line_number":54,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""},{"line_number":55,"context_line":"# directories for certificate authorities on the CA host"},{"line_number":56,"context_line":"pki_ca_dirs:"},{"line_number":57,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":58,"context_line":"  - path: \"{{ pki_dir ~ \u0027/roots\u0027 }}\""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"928505e6_f3bbca86","line":58,"range":{"start_line":42,"start_character":0,"end_line":58,"end_character":36},"in_reply_to":"74640d8f_936f1c7b","updated":"2025-08-27 10:49:18.000000000","message":"I see two main reasons:\n\n1. we have very little backend-specific variables in vars/\n  - 3 standalone backend variables: `cert_dir`, `pki_cert_dirs`, `pki_ca_dirs`\n  - 0 hashi_vault backend variables\n  - While we have 10 variables that are used in both backends\n\n\n\n2. It\u0027s not that you choose one backend for the whole environment. Each certificate can be bound to a different backend.\nAdditionally, if you\u0027re using hashi_vault backend, for some certificates you still will be forced to use standalone backend(when you have octavia enabled in your environment or when you want to install user-defined certificates).\nSo mixing backends in a single environment would be a pretty common approach in my opinion.\n\n\nI just see very little advantage of creating a separate vars/ file for each backend.","commit_id":"51270ad7aa5a0cd012e325b754298f89ad53e905"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"8960c0c94fdb3491650c90dfbcaede411143ae7f","unresolved":false,"context_lines":[{"line_number":39,"context_line":"  apt: /usr/local/share/ca-certificates/"},{"line_number":40,"context_line":"  dnf: /etc/pki/ca-trust/source/anchors/"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"# standalone backend variables"},{"line_number":43,"context_line":"cert_dir: \"{{ pki_dir }}/certs\""},{"line_number":44,"context_line":"# subdirectories to be created for holding server certs/keys/csr"},{"line_number":45,"context_line":"pki_cert_dirs:"},{"line_number":46,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":47,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs\u0027 }}\""},{"line_number":48,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""},{"line_number":49,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/csr\u0027 }}\""},{"line_number":50,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":51,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/private\u0027 }}\""},{"line_number":52,"context_line":"    mode: \"{{ pki_key_dir_mode }}\""},{"line_number":53,"context_line":"  - path: \"{{ pki_dir ~ \u0027/certs/certs\u0027 }}\""},{"line_number":54,"context_line":"    mode: \"{{ pki_cert_dir_mode }}\""},{"line_number":55,"context_line":"# directories for certificate authorities on the CA host"},{"line_number":56,"context_line":"pki_ca_dirs:"},{"line_number":57,"context_line":"  - path: \"{{ pki_dir }}\""},{"line_number":58,"context_line":"  - path: \"{{ pki_dir ~ \u0027/roots\u0027 }}\""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"0c0ca307_b9fc678d","line":58,"range":{"start_line":42,"start_character":0,"end_line":58,"end_character":36},"in_reply_to":"928505e6_f3bbca86","updated":"2025-08-29 13:08:22.000000000","message":"Ah, ok, as if it was just second point - we could get list of backends from supplied vars and include the list, so it\u0027s not a blocker.\nAnd about vault I saw bunch of new vars to be introduced in https://review.opendev.org/c/openstack/ansible-role-pki/+/948881/14/defaults/main.yml#180 but indeed looking at them today - they are not for vars anyway.\n\nSo thanks for explanation, this sounds reasonable to me.","commit_id":"51270ad7aa5a0cd012e325b754298f89ad53e905"}]}