)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"619fa0fb578d3b2ddb655f53a93a9dcf92abbe09","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":3,"id":"b6acaf1d_eb9df22a","updated":"2023-08-26 23:55:47.000000000","message":"should we up this since CVE is resolved?","commit_id":"51a3291e42eec0fc1e4706ab5b2443acaf56ba1c"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"4a354e1ba5bd8fc034f145d49c3746223c726266","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"378c97b7_437cff3e","in_reply_to":"6ba1f938_d899a97a","updated":"2023-09-25 12:15:23.000000000","message":"Done","commit_id":"51a3291e42eec0fc1e4706ab5b2443acaf56ba1c"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"a1f25e75a5abc4fb5d506322479ab179c0e3ab8c","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":3,"id":"6ba1f938_d899a97a","in_reply_to":"b6acaf1d_eb9df22a","updated":"2023-09-22 21:25:20.000000000","message":"I think you are right :) , rebased.","commit_id":"51a3291e42eec0fc1e4706ab5b2443acaf56ba1c"}],"ansible/group_vars/all.yml":[{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"fc6362d60ead55db2a3ff5c1121bcfa1fe1e9e7f","unresolved":false,"context_lines":[{"line_number":758,"context_line":"####################"},{"line_number":759,"context_line":"haproxy_user: \"openstack\""},{"line_number":760,"context_line":"haproxy_enable_external_vip: \"{{ \u0027no\u0027 if kolla_same_external_internal_vip | bool else \u0027yes\u0027 }}\""},{"line_number":761,"context_line":"haproxy_enable_http2: \"no\""},{"line_number":762,"context_line":"haproxy_http2_protocol: \"alpn h2,http/1.1\""},{"line_number":763,"context_line":"kolla_enable_tls_internal: \"no\""},{"line_number":764,"context_line":"kolla_enable_tls_external: \"{{ kolla_enable_tls_internal if kolla_same_external_internal_vip | bool else \u0027no\u0027 }}\""},{"line_number":765,"context_line":"kolla_certificates_dir: \"{{ node_config }}/certificates\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"9f560f44_a50c05ed","line":762,"range":{"start_line":761,"start_character":0,"end_line":762,"end_character":42},"updated":"2020-08-28 16:00:05.000000000","message":"I think it might be best to just generalise it to pass extra tls bind options to internal and external and document how to enable ALPN with http/2","commit_id":"51a3291e42eec0fc1e4706ab5b2443acaf56ba1c"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"d28447821a8fb1e10767bd119f5b282be3fb44df","unresolved":true,"context_lines":[{"line_number":939,"context_line":"####################"},{"line_number":940,"context_line":"haproxy_user: \"openstack\""},{"line_number":941,"context_line":"haproxy_enable_external_vip: \"{{ \u0027no\u0027 if kolla_same_external_internal_vip | bool else \u0027yes\u0027 }}\""},{"line_number":942,"context_line":"haproxy_enable_http2: \"no\""},{"line_number":943,"context_line":"haproxy_http2_protocol: \"alpn h2,http/1.1\""},{"line_number":944,"context_line":"kolla_enable_tls_internal: \"no\""},{"line_number":945,"context_line":"kolla_enable_tls_external: \"{{ kolla_enable_tls_internal if kolla_same_external_internal_vip | bool else \u0027no\u0027 }}\""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"727a7542_006c5d34","line":942,"range":{"start_line":942,"start_character":0,"end_line":942,"end_character":26},"updated":"2023-09-25 06:19:46.000000000","message":"is there a reason it\u0027s off by default?","commit_id":"692a3a8a6a9b7cae60abda329fe06e0e604682ff"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"ec4b1572e0705087d48509b2a06a3d151319301b","unresolved":true,"context_lines":[{"line_number":939,"context_line":"####################"},{"line_number":940,"context_line":"haproxy_user: \"openstack\""},{"line_number":941,"context_line":"haproxy_enable_external_vip: \"{{ \u0027no\u0027 if kolla_same_external_internal_vip | bool else \u0027yes\u0027 }}\""},{"line_number":942,"context_line":"haproxy_enable_http2: \"no\""},{"line_number":943,"context_line":"haproxy_http2_protocol: \"alpn h2,http/1.1\""},{"line_number":944,"context_line":"kolla_enable_tls_internal: \"no\""},{"line_number":945,"context_line":"kolla_enable_tls_external: \"{{ kolla_enable_tls_internal if kolla_same_external_internal_vip | bool else \u0027no\u0027 }}\""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"e9c42412_04bba150","line":942,"range":{"start_line":942,"start_character":0,"end_line":942,"end_character":26},"in_reply_to":"727a7542_006c5d34","updated":"2023-09-25 07:47:07.000000000","message":"agree, lets enable h2 by default, because there is HTTP/1.1 as a backup","commit_id":"692a3a8a6a9b7cae60abda329fe06e0e604682ff"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"752ef95682d9a5af1dde274357e2fb29c671db2a","unresolved":false,"context_lines":[{"line_number":939,"context_line":"####################"},{"line_number":940,"context_line":"haproxy_user: \"openstack\""},{"line_number":941,"context_line":"haproxy_enable_external_vip: \"{{ \u0027no\u0027 if kolla_same_external_internal_vip | bool else \u0027yes\u0027 }}\""},{"line_number":942,"context_line":"haproxy_enable_http2: \"no\""},{"line_number":943,"context_line":"haproxy_http2_protocol: \"alpn h2,http/1.1\""},{"line_number":944,"context_line":"kolla_enable_tls_internal: \"no\""},{"line_number":945,"context_line":"kolla_enable_tls_external: \"{{ kolla_enable_tls_internal if kolla_same_external_internal_vip | bool else \u0027no\u0027 }}\""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3c571e8e_5398babd","line":942,"range":{"start_line":942,"start_character":0,"end_line":942,"end_character":26},"in_reply_to":"e9c42412_04bba150","updated":"2023-09-25 09:37:19.000000000","message":"Done","commit_id":"692a3a8a6a9b7cae60abda329fe06e0e604682ff"}],"ansible/roles/haproxy-config/templates/haproxy_single_service_listen.cfg.j2":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"ef3138b39a5a143cbab8dd5ef7551021e3416972","unresolved":false,"context_lines":[{"line_number":1,"context_line":"#jinja2: lstrip_blocks: True"},{"line_number":2,"context_line":"{%- set external_tls_bind_info \u003d \u0027ssl crt /etc/haproxy/haproxy.pem alpn h2,http/1.1\u0027 if kolla_enable_tls_external|bool else \u0027\u0027 %}"},{"line_number":3,"context_line":"{%- set internal_tls_bind_info \u003d \u0027ssl crt /etc/haproxy/haproxy-internal.pem alpn h2,http/1.1\u0027 if kolla_enable_tls_internal|bool else \u0027\u0027 %}"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"{%- macro userlist_macro(service_name, auth_user, auth_pass) %}"}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"3fa7e38b_1a426dad","line":2,"range":{"start_line":2,"start_character":67,"end_line":2,"end_character":83},"updated":"2019-12-05 12:46:29.000000000","message":"Do we have a recent enough version of haproxy to use this? Reading around suggests support was added in haproxy 1.8. CentOS 7 has 1.5. It also requires SSL libraries to be compiled with support for ALPN.\n\nAn alternative would be to make TLS bind options configurable.","commit_id":"e80f824afd3480e318bf78b39b51a54fdfd21589"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"fc6362d60ead55db2a3ff5c1121bcfa1fe1e9e7f","unresolved":false,"context_lines":[{"line_number":2,"context_line":"{%- set external_tls_bind_info \u003d \u0027ssl crt /etc/haproxy/haproxy.pem\u0027 if kolla_enable_tls_external|bool else \u0027\u0027 %}"},{"line_number":3,"context_line":"{%- set external_tls_bind_info \u003d \"%s %s\" % (external_tls_bind_info, haproxy_http2_protocol) if kolla_enable_tls_external|bool and haproxy_enable_http2|bool else external_tls_bind_info %}"},{"line_number":4,"context_line":"{%- set internal_tls_bind_info \u003d \u0027ssl crt /etc/haproxy/haproxy-internal.pem\u0027 if kolla_enable_tls_internal|bool else \u0027\u0027 %}"},{"line_number":5,"context_line":"{%- set internal_tls_bind_info \u003d \"%s %s\" % (internal_tls_bind_info, haproxy_http2_protocol) if kolla_enable_tls_internal|bool and haproxy_enable_http2|bool else external_tls_bind_info %}"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"{%- macro userlist_macro(service_name, auth_user, auth_pass) %}"},{"line_number":8,"context_line":"userlist {{ service_name }}-user"}],"source_content_type":"text/x-jinja2","patch_set":3,"id":"9f560f44_8543c113","line":5,"range":{"start_line":5,"start_character":161,"end_line":5,"end_character":183},"updated":"2020-08-28 16:00:05.000000000","message":"internal_tls_bind_info","commit_id":"51a3291e42eec0fc1e4706ab5b2443acaf56ba1c"}],"ansible/roles/haproxy-config/templates/haproxy_single_service_split.cfg.j2":[{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"fc6362d60ead55db2a3ff5c1121bcfa1fe1e9e7f","unresolved":false,"context_lines":[{"line_number":2,"context_line":"{%- set external_tls_bind_info \u003d \u0027ssl crt /etc/haproxy/haproxy.pem\u0027 if kolla_enable_tls_external|bool else \u0027\u0027 %}"},{"line_number":3,"context_line":"{%- set external_tls_bind_info \u003d \"%s %s\" % (external_tls_bind_info, haproxy_http2_protocol) if kolla_enable_tls_external|bool and haproxy_enable_http2|bool else external_tls_bind_info %}"},{"line_number":4,"context_line":"{%- set internal_tls_bind_info \u003d \u0027ssl crt /etc/haproxy/haproxy-internal.pem\u0027 if kolla_enable_tls_internal|bool else \u0027\u0027 %}"},{"line_number":5,"context_line":"{%- set internal_tls_bind_info \u003d \"%s %s\" % (internal_tls_bind_info, haproxy_http2_protocol) if kolla_enable_tls_internal|bool and haproxy_enable_http2|bool else external_tls_bind_info %}"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"{%- macro userlist_macro(service_name, auth_user, auth_pass) %}"},{"line_number":8,"context_line":"userlist {{ service_name }}-user"}],"source_content_type":"text/x-jinja2","patch_set":3,"id":"9f560f44_25bd9502","line":5,"range":{"start_line":5,"start_character":161,"end_line":5,"end_character":183},"updated":"2020-08-28 16:00:05.000000000","message":"internal_tls_bind_info","commit_id":"51a3291e42eec0fc1e4706ab5b2443acaf56ba1c"}],"releasenotes/notes/add-haproxy-http2-support-3a8575889cabe064.yaml":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"d28447821a8fb1e10767bd119f5b282be3fb44df","unresolved":true,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Adds http/2 support to HAProxy frontends. It will be enabled when"},{"line_number":5,"context_line":"    ``kolla_enable_tls_external`` and ``haproxy_enable_http2`` are set"},{"line_number":6,"context_line":"    to ``yes``."}],"source_content_type":"text/x-yaml","patch_set":6,"id":"2a254b6b_ffa713bf","line":5,"updated":"2023-09-25 06:19:46.000000000","message":"that should go into docs, right?","commit_id":"692a3a8a6a9b7cae60abda329fe06e0e604682ff"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"ec4b1572e0705087d48509b2a06a3d151319301b","unresolved":true,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Adds http/2 support to HAProxy frontends. It will be enabled when"},{"line_number":5,"context_line":"    ``kolla_enable_tls_external`` and ``haproxy_enable_http2`` are set"},{"line_number":6,"context_line":"    to ``yes``."}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3854efbc_d7bdcebc","line":5,"in_reply_to":"2a254b6b_ffa713bf","updated":"2023-09-25 07:47:07.000000000","message":"also we should mention that h2 is enabled by default and there is HTTP/1.1 as a backup for old clients.","commit_id":"692a3a8a6a9b7cae60abda329fe06e0e604682ff"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"752ef95682d9a5af1dde274357e2fb29c671db2a","unresolved":false,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Adds http/2 support to HAProxy frontends. It will be enabled when"},{"line_number":5,"context_line":"    ``kolla_enable_tls_external`` and ``haproxy_enable_http2`` are set"},{"line_number":6,"context_line":"    to ``yes``."}],"source_content_type":"text/x-yaml","patch_set":6,"id":"7464fbe3_9002d0e0","line":5,"in_reply_to":"3854efbc_d7bdcebc","updated":"2023-09-25 09:37:19.000000000","message":"Done","commit_id":"692a3a8a6a9b7cae60abda329fe06e0e604682ff"}]}