)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"8cdfca28cbadfb51eb0500ab437616915dd901c2","unresolved":true,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2026-07-08 19:37:48 +0200"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Verify agent TLS certificate and provide diagnostics"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Change-Id: I6e5708eb48ea290421781df4f6f213e8ae8ae2bc"},{"line_number":10,"context_line":"Signed-off-by: Dmitry Tantsur \u003cdtantsur@protonmail.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"5f243541_4a6c4728","line":8,"updated":"2026-07-16 01:21:38.000000000","message":"could we get some more context into the why please?","commit_id":"d39541ccfb084c1bb0b639a7787c11f4a198841b"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"8cdfca28cbadfb51eb0500ab437616915dd901c2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"6ee52062_72253830","updated":"2026-07-16 01:21:38.000000000","message":"Okay, I think we need a little more verbosity in terms of framing so folks and future people going \"wut?\" can at least grok what/why. I do like the follow-up idea under the todo note, fwiw.","commit_id":"d39541ccfb084c1bb0b639a7787c11f4a198841b"}],"ironic/common/agent_tls.py":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"8cdfca28cbadfb51eb0500ab437616915dd901c2","unresolved":true,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"def verify_agent_certificate(node, agent_url, ca_path):"},{"line_number":73,"context_line":"    \"\"\"Verify the agent\u0027s TLS certificate and provide diagnostics.\"\"\""},{"line_number":74,"context_line":"    LOG.debug(\"Connecting to agent %(url)s on node %(node)s to verify its \""},{"line_number":75,"context_line":"              \"TLS settings\", {\u0027url\u0027: agent_url, \u0027node\u0027: node.uuid})"},{"line_number":76,"context_line":"    try:"}],"source_content_type":"text/x-python","patch_set":3,"id":"ee399c92_15242645","line":73,"updated":"2026-07-16 01:21:38.000000000","message":"a bit more verbosity here please.","commit_id":"d39541ccfb084c1bb0b639a7787c11f4a198841b"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"8cdfca28cbadfb51eb0500ab437616915dd901c2","unresolved":true,"context_lines":[{"line_number":77,"context_line":"        ctx \u003d ssl.SSLContext()"},{"line_number":78,"context_line":"        # Keeping verify_mode \u003d CERT_NONE on purpose, otherwise it\u0027s not"},{"line_number":79,"context_line":"        # possible to get detailed information about invalid certificates!"},{"line_number":80,"context_line":"        ctx.verify_mode \u003d ssl.VerifyMode.CERT_NONE"},{"line_number":81,"context_line":"        ctx.load_verify_locations(ca_path)"},{"line_number":82,"context_line":"    except Exception as exc:"},{"line_number":83,"context_line":"        LOG.error(\"Could not load TLS certificate for node %(node)s \""}],"source_content_type":"text/x-python","patch_set":3,"id":"323d46e5_ed6084f1","line":80,"updated":"2026-07-16 01:21:38.000000000","message":"*twitch* *twitch*\n\nI get we\u0027re doing the socket close, I think we need a very verbose docstring for any auditors hunting for no verification.","commit_id":"d39541ccfb084c1bb0b639a7787c11f4a198841b"}],"ironic/drivers/modules/agent_base.py":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"8cdfca28cbadfb51eb0500ab437616915dd901c2","unresolved":true,"context_lines":[{"line_number":680,"context_line":"        node.timestamp_driver_internal_info(\u0027agent_last_heartbeat\u0027)"},{"line_number":681,"context_line":"        if agent_verify_ca:"},{"line_number":682,"context_line":"            # TODO(dtantsur): we could verify the certificate on each heartbeat"},{"line_number":683,"context_line":"            # and reboot the node if it expires."},{"line_number":684,"context_line":"            if not node.driver_internal_info.get(\u0027agent_verify_ca\u0027):"},{"line_number":685,"context_line":"                agent_tls.verify_agent_certificate("},{"line_number":686,"context_line":"                    node, callback_url, agent_verify_ca)"}],"source_content_type":"text/x-python","patch_set":3,"id":"698c4d4b_40abb532","line":683,"updated":"2026-07-16 01:21:38.000000000","message":"Seems reasonable to do as a next step.","commit_id":"d39541ccfb084c1bb0b639a7787c11f4a198841b"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"8cdfca28cbadfb51eb0500ab437616915dd901c2","unresolved":true,"context_lines":[{"line_number":681,"context_line":"        if agent_verify_ca:"},{"line_number":682,"context_line":"            # TODO(dtantsur): we could verify the certificate on each heartbeat"},{"line_number":683,"context_line":"            # and reboot the node if it expires."},{"line_number":684,"context_line":"            if not node.driver_internal_info.get(\u0027agent_verify_ca\u0027):"},{"line_number":685,"context_line":"                agent_tls.verify_agent_certificate("},{"line_number":686,"context_line":"                    node, callback_url, agent_verify_ca)"},{"line_number":687,"context_line":"            node.set_driver_internal_info(\u0027agent_verify_ca\u0027, agent_verify_ca)"}],"source_content_type":"text/x-python","patch_set":3,"id":"72f9373f_a4b907ac","line":684,"updated":"2026-07-16 01:21:38.000000000","message":"Lets try and be a bit more verbose what is going on here, as in why we\u0027re attempting to verify.","commit_id":"d39541ccfb084c1bb0b639a7787c11f4a198841b"}],"releasenotes/notes/agent-verify-tls-86a5febd79bf51c2.yaml":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"8cdfca28cbadfb51eb0500ab437616915dd901c2","unresolved":true,"context_lines":[{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Ironic now validates the TLS certificate from the agent to ensure it\u0027s"},{"line_number":5,"context_line":"    valid on receiving. This is done to provide diagnostics when the clock"},{"line_number":6,"context_line":"    diverges so much between nodes and Ironic that the certificate\u0027s"},{"line_number":7,"context_line":"    validity date is in the future."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"df54cf9b_4733549e","line":6,"range":{"start_line":5,"start_character":29,"end_line":6,"end_character":68},"updated":"2026-07-16 01:21:38.000000000","message":"We\u0027re still having issues with this? Maybe we could go back to extending the grace window?","commit_id":"d39541ccfb084c1bb0b639a7787c11f4a198841b"}]}