)]}'
{"ansible/certificates.yml":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"dd0fe6088a0f2a922fe5a10ddd08541d59ab183f","unresolved":false,"context_lines":[{"line_number":2,"context_line":"- import_playbook: gather-facts.yml"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"- name: Apply role certificates"},{"line_number":5,"context_line":"  hosts: control"},{"line_number":6,"context_line":"  roles:"},{"line_number":7,"context_line":"    - certificates"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9fb8cfa7_8b7cf1b5","line":5,"range":{"start_line":5,"start_character":9,"end_line":5,"end_character":16},"updated":"2019-06-06 15:26:59.000000000","message":"This is wrong - certificates should be generated locally, then kolla-ansible will transfer them to remote hosts during deploy.","commit_id":"0ff0d48114e5bc4998ae0c5a05fa10c11563a547"},{"author":{"_account_id":16036,"name":"Krzysztof Klimonda","email":"kklimonda@syntaxhighlighted.com","username":"kklimonda"},"change_message_id":"b1804d0da2c26ac4676bd031759e6529bd9b2d3f","unresolved":false,"context_lines":[{"line_number":2,"context_line":"- import_playbook: gather-facts.yml"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"- name: Apply role certificates"},{"line_number":5,"context_line":"  hosts: control"},{"line_number":6,"context_line":"  roles:"},{"line_number":7,"context_line":"    - certificates"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9fb8cfa7_237721a3","line":5,"range":{"start_line":5,"start_character":9,"end_line":5,"end_character":16},"in_reply_to":"9fb8cfa7_8b7cf1b5","updated":"2019-06-07 06:52:34.000000000","message":"I actually delegated all tasks to localhost, but there was no need for that change anyway as gather-facts playbook fetches all facts from all hosts in the inventory anyway. I\u0027ll revert that in the next patchset.","commit_id":"0ff0d48114e5bc4998ae0c5a05fa10c11563a547"}],"ansible/group_vars/all.yml":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"dd0fe6088a0f2a922fe5a10ddd08541d59ab183f","unresolved":false,"context_lines":[{"line_number":726,"context_line":"kolla_enable_tls_external: \"no\""},{"line_number":727,"context_line":"kolla_enable_tls_internal: \"no\""},{"line_number":728,"context_line":"kolla_verify_tls: \"yes\""},{"line_number":729,"context_line":"kolla_external_fqdn_cert: \"{{ node_config }}/certificates/haproxy-external.pem\""},{"line_number":730,"context_line":"kolla_internal_fqdn_cert: \"{{ node_config }}/certificates/haproxy-internal.pem\""},{"line_number":731,"context_line":"kolla_external_fqdn_cacert: \"{{ node_config }}/certificates/haproxy-ca.crt\""},{"line_number":732,"context_line":"haproxy_ca_certs_bundle: \"{{ \u0027ca-certificates.crt\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027ca-bundle.trust.crt\u0027 }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9fb8cfa7_ab60d502","line":729,"range":{"start_line":729,"start_character":66,"end_line":729,"end_character":74},"updated":"2019-06-06 15:26:59.000000000","message":"I think we\u0027ll need to keep this the same for backwards compat.","commit_id":"0ff0d48114e5bc4998ae0c5a05fa10c11563a547"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"fe32e927161efe953322677b04da0681d709c706","unresolved":false,"context_lines":[{"line_number":726,"context_line":"kolla_enable_tls_external: \"no\""},{"line_number":727,"context_line":"kolla_enable_tls_internal: \"no\""},{"line_number":728,"context_line":"kolla_verify_tls: \"yes\""},{"line_number":729,"context_line":"kolla_external_fqdn_cert: \"{{ node_config }}/certificates/haproxy-external.pem\""},{"line_number":730,"context_line":"kolla_internal_fqdn_cert: \"{{ node_config }}/certificates/haproxy-internal.pem\""},{"line_number":731,"context_line":"kolla_external_fqdn_cacert: \"{{ node_config }}/certificates/haproxy-ca.crt\""},{"line_number":732,"context_line":"haproxy_ca_certs_bundle: \"{{ \u0027ca-certificates.crt\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027ca-bundle.trust.crt\u0027 }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9fb8cfa7_99cc3a6b","line":729,"range":{"start_line":729,"start_character":66,"end_line":729,"end_character":74},"in_reply_to":"9fb8cfa7_03745d98","updated":"2019-06-07 09:43:22.000000000","message":"That one\u0027s less important - we have control over it. We shouldn\u0027t change the user configuration format on localhost though.","commit_id":"0ff0d48114e5bc4998ae0c5a05fa10c11563a547"},{"author":{"_account_id":16036,"name":"Krzysztof Klimonda","email":"kklimonda@syntaxhighlighted.com","username":"kklimonda"},"change_message_id":"b1804d0da2c26ac4676bd031759e6529bd9b2d3f","unresolved":false,"context_lines":[{"line_number":726,"context_line":"kolla_enable_tls_external: \"no\""},{"line_number":727,"context_line":"kolla_enable_tls_internal: \"no\""},{"line_number":728,"context_line":"kolla_verify_tls: \"yes\""},{"line_number":729,"context_line":"kolla_external_fqdn_cert: \"{{ node_config }}/certificates/haproxy-external.pem\""},{"line_number":730,"context_line":"kolla_internal_fqdn_cert: \"{{ node_config }}/certificates/haproxy-internal.pem\""},{"line_number":731,"context_line":"kolla_external_fqdn_cacert: \"{{ node_config }}/certificates/haproxy-ca.crt\""},{"line_number":732,"context_line":"haproxy_ca_certs_bundle: \"{{ \u0027ca-certificates.crt\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027ca-bundle.trust.crt\u0027 }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9fb8cfa7_03745d98","line":729,"range":{"start_line":729,"start_character":66,"end_line":729,"end_character":74},"in_reply_to":"9fb8cfa7_ab60d502","updated":"2019-06-07 06:52:34.000000000","message":"Hmmm, we should probably also keep the original path on controller nodes too in that case.","commit_id":"0ff0d48114e5bc4998ae0c5a05fa10c11563a547"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"7f08c80697909fa46097da7d2ff4d48f996fd144","unresolved":false,"context_lines":[{"line_number":720,"context_line":"# HAProxy options"},{"line_number":721,"context_line":"####################"},{"line_number":722,"context_line":"haproxy_user: \"openstack\""},{"line_number":723,"context_line":"haproxy_enable_external_vip: \"{{ \u0027no\u0027 if kolla_external_vip_address \u003d\u003d kolla_internal_vip_address else \u0027yes\u0027 }}\""},{"line_number":724,"context_line":"kolla_enable_tls_external: \"no\""},{"line_number":725,"context_line":"kolla_enable_tls_internal: \"no\""},{"line_number":726,"context_line":"kolla_external_fqdn_cert: \"{{ node_config }}/certificates/haproxy.pem\""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"9fb8cfa7_4fd366d6","line":723,"range":{"start_line":723,"start_character":33,"end_line":723,"end_character":108},"updated":"2019-06-21 09:00:07.000000000","message":"I think we\u0027re going to need more of this kind of logic to handle the case where internal and external endpoints use the same network.\n\nIt might be a good time to add a helper variable like this:\n\nexternal_api_is_separate: \"{{ kolla_external_vip_address !\u003d kolla_internal_vip_address }}\"\n\n(needs a better name)","commit_id":"3354f53ae67bfbd7503ac05455baa4e39ec07669"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"7f08c80697909fa46097da7d2ff4d48f996fd144","unresolved":false,"context_lines":[{"line_number":725,"context_line":"kolla_enable_tls_internal: \"no\""},{"line_number":726,"context_line":"kolla_external_fqdn_cert: \"{{ node_config }}/certificates/haproxy.pem\""},{"line_number":727,"context_line":"kolla_internal_fqdn_cert: \"{{ node_config }}/certificates/haproxy-internal.pem\""},{"line_number":728,"context_line":"kolla_external_fqdn_cacert: \"{{ node_config }}/certificates/haproxy-ca.crt\""},{"line_number":729,"context_line":""},{"line_number":730,"context_line":""},{"line_number":731,"context_line":"####################"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"9fb8cfa7_afe302a4","line":728,"updated":"2019-06-21 09:00:07.000000000","message":"Do we need a separate CA cert for the internal network? It should probably be used in ansible/roles/common/templates/admin-openrc.sh.j2 rather than the external one.","commit_id":"3354f53ae67bfbd7503ac05455baa4e39ec07669"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d56829361d81e302aa638267dd5407d49fc2df6a","unresolved":false,"context_lines":[{"line_number":36,"context_line":"kolla_internal_fqdn: \"{{ kolla_internal_vip_address }}\""},{"line_number":37,"context_line":"kolla_external_vip_address: \"{{ kolla_internal_vip_address }}\""},{"line_number":38,"context_line":"kolla_same_external_internal_vip: \"{{ kolla_external_vip_address \u003d\u003d kolla_internal_vip_address }}\""},{"line_number":39,"context_line":"kolla_external_fqdn: \"{{ kolla_internal_fqdn if kolla_same_external_internal_vip else kolla_external_vip_address }}\""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"kolla_enable_sanity_checks: \"no\""},{"line_number":42,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":10,"id":"7faddb67_c803760c","line":39,"range":{"start_line":39,"start_character":48,"end_line":39,"end_character":80},"updated":"2019-08-19 12:01:47.000000000","message":"kolla_same_external_internal_vip | bool","commit_id":"c802239ea384c2b9127edbb7f8bc3b7d7a62df78"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d56829361d81e302aa638267dd5407d49fc2df6a","unresolved":false,"context_lines":[{"line_number":724,"context_line":"# HAProxy options"},{"line_number":725,"context_line":"####################"},{"line_number":726,"context_line":"haproxy_user: \"openstack\""},{"line_number":727,"context_line":"haproxy_enable_external_vip: \"{{ \u0027no\u0027 if kolla_same_external_internal_vip else \u0027yes\u0027 }}\""},{"line_number":728,"context_line":"kolla_enable_tls_external: \"no\""},{"line_number":729,"context_line":"kolla_enable_tls_internal: \"no\""},{"line_number":730,"context_line":"kolla_external_fqdn_cert: \"{{ node_config }}/certificates/haproxy.pem\""}],"source_content_type":"text/x-yaml","patch_set":10,"id":"7faddb67_a8fe3a02","line":727,"range":{"start_line":727,"start_character":41,"end_line":727,"end_character":73},"updated":"2019-08-19 12:01:47.000000000","message":"kolla_same_external_internal_vip | bool","commit_id":"c802239ea384c2b9127edbb7f8bc3b7d7a62df78"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d56829361d81e302aa638267dd5407d49fc2df6a","unresolved":false,"context_lines":[{"line_number":725,"context_line":"####################"},{"line_number":726,"context_line":"haproxy_user: \"openstack\""},{"line_number":727,"context_line":"haproxy_enable_external_vip: \"{{ \u0027no\u0027 if kolla_same_external_internal_vip else \u0027yes\u0027 }}\""},{"line_number":728,"context_line":"kolla_enable_tls_external: \"no\""},{"line_number":729,"context_line":"kolla_enable_tls_internal: \"no\""},{"line_number":730,"context_line":"kolla_external_fqdn_cert: \"{{ node_config }}/certificates/haproxy.pem\""},{"line_number":731,"context_line":"kolla_internal_fqdn_cert: \"{{ node_config }}/certificates/haproxy-internal.pem\""}],"source_content_type":"text/x-yaml","patch_set":10,"id":"7faddb67_e5021b0c","line":728,"range":{"start_line":728,"start_character":28,"end_line":728,"end_character":30},"updated":"2019-08-19 12:01:47.000000000","message":"how about:\n\nkolla_enable_tls_external: \"{{ kolla_enable_tls_internal if  kolla_same_external_internal_vip | bool else \u0027no\u0027 }}\"","commit_id":"c802239ea384c2b9127edbb7f8bc3b7d7a62df78"}],"ansible/roles/common/templates/admin-openrc.sh.j2":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"2782521670671ee2972b8f67ef60d6761a17cfa2","unresolved":false,"context_lines":[{"line_number":10,"context_line":"export OS_REGION_NAME\u003d{{ openstack_region_name }}"},{"line_number":11,"context_line":"export OS_AUTH_PLUGIN\u003dpassword"},{"line_number":12,"context_line":"{% if kolla_enable_tls_internal | bool and kolla_external_fqdn_cacert %}"},{"line_number":13,"context_line":"export OS_CACERT\u003d{{ kolla_internal_fqdn_cacert }}"},{"line_number":14,"context_line":"{% elif  kolla_enable_tls_external | bool and kolla_external_fqdn_cacert %}"},{"line_number":15,"context_line":"export OS_CACERT\u003d{{ kolla_external_fqdn_cacert }}"},{"line_number":16,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":8,"id":"7faddb67_40a0d6f3","line":13,"range":{"start_line":13,"start_character":20,"end_line":13,"end_character":46},"updated":"2019-08-16 08:51:45.000000000","message":"I think this needs to be added to group_vars/all.yml","commit_id":"55327f6f08e44358e13b38b0445d7bbff3bf013d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d56829361d81e302aa638267dd5407d49fc2df6a","unresolved":false,"context_lines":[{"line_number":9,"context_line":"export OS_IDENTITY_API_VERSION\u003d3"},{"line_number":10,"context_line":"export OS_REGION_NAME\u003d{{ openstack_region_name }}"},{"line_number":11,"context_line":"export OS_AUTH_PLUGIN\u003dpassword"},{"line_number":12,"context_line":"{% if kolla_enable_tls_internal | bool and kolla_external_fqdn_cacert %}"},{"line_number":13,"context_line":"export OS_CACERT\u003d{{ kolla_internal_fqdn_cacert }}"},{"line_number":14,"context_line":"{% elif  kolla_enable_tls_external | bool and kolla_external_fqdn_cacert %}"},{"line_number":15,"context_line":"export OS_CACERT\u003d{{ kolla_external_fqdn_cacert }}"}],"source_content_type":"text/x-jinja2","patch_set":10,"id":"7faddb67_28124a59","line":12,"range":{"start_line":12,"start_character":49,"end_line":12,"end_character":57},"updated":"2019-08-19 12:01:47.000000000","message":"internal","commit_id":"c802239ea384c2b9127edbb7f8bc3b7d7a62df78"}],"ansible/roles/haproxy-config/templates/haproxy_single_service_listen.cfg.j2":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"7f08c80697909fa46097da7d2ff4d48f996fd144","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"9fb8cfa7_af91c2f3","updated":"2019-06-21 09:00:07.000000000","message":"We also have haproxy_single_service_split.cfg.j2.","commit_id":"3354f53ae67bfbd7503ac05455baa4e39ec07669"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"7f08c80697909fa46097da7d2ff4d48f996fd144","unresolved":false,"context_lines":[{"line_number":38,"context_line":"        {% set vip_address \u003d kolla_external_vip_address %}"},{"line_number":39,"context_line":"        {% if service_mode \u003d\u003d \u0027http\u0027 %}"},{"line_number":40,"context_line":"            {% set tls_option \u003d external_tls_bind_info %}"},{"line_number":41,"context_line":"    {# Replace the XFP header for external https requests #}"},{"line_number":42,"context_line":"    http-request set-header X-Forwarded-Proto https if { ssl_fc }"},{"line_number":43,"context_line":"        {% endif %}"},{"line_number":44,"context_line":"    {% else %}"},{"line_number":45,"context_line":"        {% set vip_address \u003d kolla_internal_vip_address %}"}],"source_content_type":"text/x-jinja2","patch_set":6,"id":"9fb8cfa7_6f942ae9","line":42,"range":{"start_line":41,"start_character":0,"end_line":42,"end_character":65},"updated":"2019-06-21 09:00:07.000000000","message":"Need one of these?","commit_id":"3354f53ae67bfbd7503ac05455baa4e39ec07669"}],"ansible/roles/haproxy/tasks/precheck.yml":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d56829361d81e302aa638267dd5407d49fc2df6a","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  check_mode: no"},{"line_number":78,"context_line":"  run_once: true"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"- name: Checking if haproxy certificate exists"},{"line_number":81,"context_line":"  run_once: true"},{"line_number":82,"context_line":"  local_action: stat path\u003d{{ kolla_external_fqdn_cert }}"},{"line_number":83,"context_line":"  register: haproxy_cert_file"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"7faddb67_45244f0d","line":80,"updated":"2019-08-19 12:01:47.000000000","message":"external","commit_id":"c802239ea384c2b9127edbb7f8bc3b7d7a62df78"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d56829361d81e302aa638267dd5407d49fc2df6a","unresolved":false,"context_lines":[{"line_number":84,"context_line":"  changed_when: false"},{"line_number":85,"context_line":"  when: kolla_enable_tls_external | bool"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"- name: Fail if haproxy certificate is absent"},{"line_number":88,"context_line":"  run_once: true"},{"line_number":89,"context_line":"  local_action: fail msg\u003d\"haproxy certificate file is not found. Ensure it exists as {{ kolla_external_fqdn_cert }}\""},{"line_number":90,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"7faddb67_2527d314","line":87,"updated":"2019-08-19 12:01:47.000000000","message":"external","commit_id":"c802239ea384c2b9127edbb7f8bc3b7d7a62df78"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d56829361d81e302aa638267dd5407d49fc2df6a","unresolved":false,"context_lines":[{"line_number":100,"context_line":""},{"line_number":101,"context_line":"- name: Fail if internal haproxy certificate is absent"},{"line_number":102,"context_line":"  run_once: true"},{"line_number":103,"context_line":"  local_action: fail msg\u003d\"internal haproxy certificate file is not found. Ensure it exists as {{ kolla_internal_fqdn_cert }}\""},{"line_number":104,"context_line":"  when:"},{"line_number":105,"context_line":"    - kolla_enable_tls_internal | bool"},{"line_number":106,"context_line":"    - haproxy_internal_cert_file.stat.exists \u003d\u003d false"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"7faddb67_657e2be4","line":103,"range":{"start_line":103,"start_character":94,"end_line":103,"end_character":96},"updated":"2019-08-19 12:01:47.000000000","message":"jinja will template this, which is probably not what is wanted. Maybe just something like:\n\nInternal haproxy certificate file is not found. It is configured via \u0027kolla_internal_fqdn_cert\u0027.\n\nSame for external task.","commit_id":"c802239ea384c2b9127edbb7f8bc3b7d7a62df78"}],"ansible/roles/haproxy/templates/haproxy_main.cfg.j2":[{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"a34e42bea81e6838aa2a054c1f163a4d6548808c","unresolved":false,"context_lines":[{"line_number":13,"context_line":"        {% endfor %}"},{"line_number":14,"context_line":"    {% endif %}"},{"line_number":15,"context_line":"    stats socket /var/lib/kolla/haproxy/haproxy.sock group kolla mode 660"},{"line_number":16,"context_line":"    {% if kolla_enable_tls_external or kolla_enable_tls_internal | bool %}"},{"line_number":17,"context_line":"    ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES"},{"line_number":18,"context_line":"    ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11"},{"line_number":19,"context_line":"    tune.ssl.default-dh-param 4096"}],"source_content_type":"text/x-jinja2","patch_set":19,"id":"5faad753_db8a6968","line":16,"range":{"start_line":16,"start_character":10,"end_line":16,"end_character":35},"updated":"2019-09-14 19:51:28.000000000","message":"\u0027|bool\u0027 to fix here as well","commit_id":"b0ecd8b67c916225944880c025340dfdfcf48588"}],"ansible/roles/horizon/templates/horizon.conf.j2":[{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"7ace655da3bc22f7576a5f74fbba5f017b504cb1","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    \u003c/Location\u003e"},{"line_number":33,"context_line":"\u003c/VirtualHost\u003e"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"{% if kolla_enable_tls_external or kolla_enable_tls_internal| bool %}"},{"line_number":36,"context_line":"Header edit Location ^http://(.*)$ https://$1"},{"line_number":37,"context_line":"{% endif %}"},{"line_number":38,"context_line":""}],"source_content_type":"text/x-jinja2","patch_set":19,"id":"5faad753_bb9c4dc0","line":35,"range":{"start_line":35,"start_character":6,"end_line":35,"end_character":31},"updated":"2019-09-14 19:45:31.000000000","message":"missed \u0027|bool\u0027 caused https://bugs.launchpad.net/kolla-ansible/+bug/1844016\n\nanother reason we should test horizon access in CI","commit_id":"b0ecd8b67c916225944880c025340dfdfcf48588"}],"ansible/roles/horizon/templates/local_settings.j2":[{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"a34e42bea81e6838aa2a054c1f163a4d6548808c","unresolved":false,"context_lines":[{"line_number":55,"context_line":"#CSRF_COOKIE_SECURE \u003d True"},{"line_number":56,"context_line":"#SESSION_COOKIE_SECURE \u003d True"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"{% if kolla_enable_tls_external or kolla_enable_tls_internal | bool %}"},{"line_number":59,"context_line":"SECURE_PROXY_SSL_HEADER \u003d (\u0027HTTP_X_FORWARDED_PROTO\u0027, \u0027https\u0027)"},{"line_number":60,"context_line":"CSRF_COOKIE_SECURE \u003d True"},{"line_number":61,"context_line":"SESSION_COOKIE_SECURE \u003d True"}],"source_content_type":"text/x-jinja2","patch_set":19,"id":"5faad753_9b807148","line":58,"range":{"start_line":58,"start_character":6,"end_line":58,"end_character":31},"updated":"2019-09-14 19:51:28.000000000","message":"and here","commit_id":"b0ecd8b67c916225944880c025340dfdfcf48588"}],"ansible/roles/neutron/tasks/bootstrap.yml":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"dd0fe6088a0f2a922fe5a10ddd08541d59ab183f","unresolved":false,"context_lines":[{"line_number":33,"context_line":"    - not use_preconfigured_databases | bool"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"- include_tasks: bootstrap_service.yml"},{"line_number":36,"context_line":"  #when: database.changed or use_preconfigured_databases | bool"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9fb8cfa7_4e03670e","line":36,"updated":"2019-06-06 15:26:59.000000000","message":"Wrong commit?","commit_id":"0ff0d48114e5bc4998ae0c5a05fa10c11563a547"},{"author":{"_account_id":16036,"name":"Krzysztof Klimonda","email":"kklimonda@syntaxhighlighted.com","username":"kklimonda"},"change_message_id":"b1804d0da2c26ac4676bd031759e6529bd9b2d3f","unresolved":false,"context_lines":[{"line_number":33,"context_line":"    - not use_preconfigured_databases | bool"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"- include_tasks: bootstrap_service.yml"},{"line_number":36,"context_line":"  #when: database.changed or use_preconfigured_databases | bool"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9fb8cfa7_835fed0c","line":36,"in_reply_to":"9fb8cfa7_4e03670e","updated":"2019-06-07 06:52:34.000000000","message":"Yes, there seems to a.. bug (or perhaps a limitation) somewhere when you end up with missing database if initial deployment fails. But that\u0027s not for this review.","commit_id":"0ff0d48114e5bc4998ae0c5a05fa10c11563a547"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"fe32e927161efe953322677b04da0681d709c706","unresolved":false,"context_lines":[{"line_number":33,"context_line":"    - not use_preconfigured_databases | bool"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"- include_tasks: bootstrap_service.yml"},{"line_number":36,"context_line":"  #when: database.changed or use_preconfigured_databases | bool"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9fb8cfa7_19de0a11","line":36,"in_reply_to":"9fb8cfa7_835fed0c","updated":"2019-06-07 09:43:22.000000000","message":"Yeah this catches a lot of people out. I proposed a solution here: https://review.opendev.org/650962. Reviews welcome :)","commit_id":"0ff0d48114e5bc4998ae0c5a05fa10c11563a547"}],"ansible/roles/nova/templates/nova.conf.j2":[{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"a34e42bea81e6838aa2a054c1f163a4d6548808c","unresolved":false,"context_lines":[{"line_number":234,"context_line":""},{"line_number":235,"context_line":"[wsgi]"},{"line_number":236,"context_line":"api_paste_config \u003d /etc/nova/api-paste.ini"},{"line_number":237,"context_line":"{% if kolla_enable_tls_external or kolla_enable_tls_internal | bool %}"},{"line_number":238,"context_line":"secure_proxy_ssl_header \u003d HTTP_X_FORWARDED_PROTO"},{"line_number":239,"context_line":"{% endif %}"},{"line_number":240,"context_line":""}],"source_content_type":"text/x-jinja2","patch_set":19,"id":"5faad753_5b967995","line":237,"range":{"start_line":237,"start_character":6,"end_line":237,"end_character":31},"updated":"2019-09-14 19:51:28.000000000","message":"and here","commit_id":"b0ecd8b67c916225944880c025340dfdfcf48588"}],"ansible/roles/prechecks/tasks/service_checks.yml":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d56829361d81e302aa638267dd5407d49fc2df6a","unresolved":false,"context_lines":[{"line_number":39,"context_line":"#  local_action: fail msg\u003d\u0027kolla_external_vip_address and kolla_internal_vip_address must not be the same when TLS is enabled\u0027"},{"line_number":40,"context_line":"#  changed_when: false"},{"line_number":41,"context_line":"#  when:"},{"line_number":42,"context_line":"#    - kolla_enable_tls_external | bool"},{"line_number":43,"context_line":"#    - kolla_same_external_internal_vip"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"7faddb67_4521afb3","line":42,"range":{"start_line":42,"start_character":7,"end_line":42,"end_character":39},"updated":"2019-08-19 12:01:47.000000000","message":"We could keep this check, to catch the case where internal is true and external is false or vice-versa.","commit_id":"c802239ea384c2b9127edbb7f8bc3b7d7a62df78"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"029105ef1b59ef9f004f8f058ae03de867f7c5f4","unresolved":false,"context_lines":[{"line_number":40,"context_line":"  when:"},{"line_number":41,"context_line":"    - kolla_enable_tls_external | bool or kolla_enable_tls_internal | bool"},{"line_number":42,"context_line":"    - not (kolla_enable_tls_external | bool and kolla_enable_tls_internal | bool)"},{"line_number":43,"context_line":"    - kolla_same_external_internal_vip"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"7faddb67_6cdda16e","line":43,"range":{"start_line":43,"start_character":6,"end_line":43,"end_character":38},"updated":"2019-08-20 09:05:08.000000000","message":"| bool","commit_id":"deaf1c98126672884569b5a969b446d088dc0355"}],"doc/source/admin/advanced-configuration.rst":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"9e6f657e760c75cfefc1e51102c4bac6177b4519","unresolved":false,"context_lines":[{"line_number":73,"context_line":"~~~~~~~~~~~~~~~~~"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"An additional endpoint configuration option is to enable or disable"},{"line_number":76,"context_line":"TLS protection for the external VIP. TLS allows a client to authenticate"},{"line_number":77,"context_line":"the OpenStack service endpoint and allows for encryption of the requests"},{"line_number":78,"context_line":"and responses."},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"7faddb67_6caee881","line":76,"range":{"start_line":76,"start_character":23,"end_line":76,"end_character":31},"updated":"2019-08-21 10:56:18.000000000","message":"external and/or internal","commit_id":"b9ad037d99142540bf7248f3b7cdfe3ff7648526"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"9e6f657e760c75cfefc1e51102c4bac6177b4519","unresolved":false,"context_lines":[{"line_number":75,"context_line":"An additional endpoint configuration option is to enable or disable"},{"line_number":76,"context_line":"TLS protection for the external VIP. TLS allows a client to authenticate"},{"line_number":77,"context_line":"the OpenStack service endpoint and allows for encryption of the requests"},{"line_number":78,"context_line":"and responses."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"The configuration variables that control TLS networking are:"},{"line_number":81,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"7faddb67_0c4094a1","line":78,"updated":"2019-08-21 10:56:18.000000000","message":"I think we need a new paragraph here describing the additional requirements for internal TLS, i.e. that your containers must trust the appropriate CA.","commit_id":"b9ad037d99142540bf7248f3b7cdfe3ff7648526"},{"author":{"_account_id":30810,"name":"James Kirsch","email":"generalfuzz@gmail.com","username":"generalfuzz"},"change_message_id":"0584fc5a405e3069ab540e47c340fc0ac9e7f8bb","unresolved":false,"context_lines":[{"line_number":75,"context_line":"An additional endpoint configuration option is to enable or disable"},{"line_number":76,"context_line":"TLS protection for the external VIP. TLS allows a client to authenticate"},{"line_number":77,"context_line":"the OpenStack service endpoint and allows for encryption of the requests"},{"line_number":78,"context_line":"and responses."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"The configuration variables that control TLS networking are:"},{"line_number":81,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"7faddb67_aeb850c7","line":78,"in_reply_to":"7faddb67_0c4094a1","updated":"2019-08-21 18:46:34.000000000","message":"I think this could come with the next changeset, which allows more granular Control to allow containers to have an \"insecure\" mode where they do not verify the certificate (and trust is more configurable).","commit_id":"b9ad037d99142540bf7248f3b7cdfe3ff7648526"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"4b3577226d9d4be6dc4c8f5e05444898e27b5005","unresolved":false,"context_lines":[{"line_number":75,"context_line":"An additional endpoint configuration option is to enable or disable"},{"line_number":76,"context_line":"TLS protection for the external VIP. TLS allows a client to authenticate"},{"line_number":77,"context_line":"the OpenStack service endpoint and allows for encryption of the requests"},{"line_number":78,"context_line":"and responses."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"The configuration variables that control TLS networking are:"},{"line_number":81,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"7faddb67_86c52a5f","line":78,"in_reply_to":"7faddb67_aeb850c7","updated":"2019-08-22 09:29:34.000000000","message":"Ok","commit_id":"b9ad037d99142540bf7248f3b7cdfe3ff7648526"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"9e6f657e760c75cfefc1e51102c4bac6177b4519","unresolved":false,"context_lines":[{"line_number":76,"context_line":"TLS protection for the external VIP. TLS allows a client to authenticate"},{"line_number":77,"context_line":"the OpenStack service endpoint and allows for encryption of the requests"},{"line_number":78,"context_line":"and responses."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"The configuration variables that control TLS networking are:"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"- kolla_enable_tls_internal"}],"source_content_type":"text/x-rst","patch_set":13,"id":"7faddb67_4c23ec05","line":79,"updated":"2019-08-21 10:56:18.000000000","message":"Possibly also a paragraph about what to do if you don\u0027t have separate internal and external networks, but still want to use TLS.","commit_id":"b9ad037d99142540bf7248f3b7cdfe3ff7648526"},{"author":{"_account_id":30810,"name":"James Kirsch","email":"generalfuzz@gmail.com","username":"generalfuzz"},"change_message_id":"0584fc5a405e3069ab540e47c340fc0ac9e7f8bb","unresolved":false,"context_lines":[{"line_number":76,"context_line":"TLS protection for the external VIP. TLS allows a client to authenticate"},{"line_number":77,"context_line":"the OpenStack service endpoint and allows for encryption of the requests"},{"line_number":78,"context_line":"and responses."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"The configuration variables that control TLS networking are:"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"- kolla_enable_tls_internal"}],"source_content_type":"text/x-rst","patch_set":13,"id":"7faddb67_4ef51c82","line":79,"in_reply_to":"7faddb67_4c23ec05","updated":"2019-08-21 18:46:34.000000000","message":"What did you have in mind around this? Just that there is a single  external network, which needs to be configured with TLS?","commit_id":"b9ad037d99142540bf7248f3b7cdfe3ff7648526"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"4b3577226d9d4be6dc4c8f5e05444898e27b5005","unresolved":false,"context_lines":[{"line_number":76,"context_line":"TLS protection for the external VIP. TLS allows a client to authenticate"},{"line_number":77,"context_line":"the OpenStack service endpoint and allows for encryption of the requests"},{"line_number":78,"context_line":"and responses."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"The configuration variables that control TLS networking are:"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"- kolla_enable_tls_internal"}],"source_content_type":"text/x-rst","patch_set":13,"id":"7faddb67_66a26eb0","line":79,"in_reply_to":"7faddb67_4ef51c82","updated":"2019-08-22 09:29:34.000000000","message":"It would be a single internal network - external would be disabled. Users should use the *internal* variables and leave the external ones alone.","commit_id":"b9ad037d99142540bf7248f3b7cdfe3ff7648526"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"9e6f657e760c75cfefc1e51102c4bac6177b4519","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":"- kolla_enable_tls_internal"},{"line_number":83,"context_line":"- kolla_enable_tls_external"},{"line_number":84,"context_line":"- kolla_external_fqdn_cert"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":".. note::"},{"line_number":87,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"7faddb67_2ccc7068","line":84,"range":{"start_line":84,"start_character":2,"end_line":84,"end_character":26},"updated":"2019-08-21 10:56:18.000000000","message":"kolla_internal_fqdn_cert","commit_id":"b9ad037d99142540bf7248f3b7cdfe3ff7648526"}]}