)]}'
{"ansible/roles/common/defaults/main.yml":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"8f4760450c42a54c9ebc1213fb8bd326d0cf4fc6","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"syslog_swift_facility: \"local0\""},{"line_number":74,"context_line":"syslog_haproxy_facility: \"local1\""},{"line_number":75,"context_line":"syslog_tls_proxy_facility: \"local2\""},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"kolla_toolbox_default_volumes:"},{"line_number":78,"context_line":"  - \"{{ node_config_directory }}/kolla-toolbox/:{{ container_config_directory }}/:ro\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"1f493fa4_23013339","line":75,"range":{"start_line":75,"start_character":0,"end_line":75,"end_character":25},"updated":"2020-04-30 11:09:17.000000000","message":"Let\u0027s use syslog_glance_tls_proxy_facility to be clear.","commit_id":"92b4720aefdd885e0fad886eefc51c8f97278853"}],"ansible/roles/common/templates/conf/output/00-local.conf.j2":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"8f4760450c42a54c9ebc1213fb8bd326d0cf4fc6","unresolved":false,"context_lines":[{"line_number":110,"context_line":"  @type copy"},{"line_number":111,"context_line":"  \u003cstore\u003e"},{"line_number":112,"context_line":"    @type file"},{"line_number":113,"context_line":"    path /var/log/kolla/tls-proxy/haproxy_latest.*.log"},{"line_number":114,"context_line":"    output_tag false"},{"line_number":115,"context_line":"    output_time false"},{"line_number":116,"context_line":"    utc"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"1f493fa4_839127f4","line":113,"updated":"2020-04-30 11:09:17.000000000","message":"glance/glance-tls-proxy.log","commit_id":"92b4720aefdd885e0fad886eefc51c8f97278853"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"ddbe0bdb9faa2e8311ccc64673aec96cd9d7bc88","unresolved":false,"context_lines":[{"line_number":110,"context_line":"  @type copy"},{"line_number":111,"context_line":"  \u003cstore\u003e"},{"line_number":112,"context_line":"    @type file"},{"line_number":113,"context_line":"    path /var/log/kolla/tls-proxy/haproxy_latest.*.log"},{"line_number":114,"context_line":"    output_tag false"},{"line_number":115,"context_line":"    output_time false"},{"line_number":116,"context_line":"    utc"}],"source_content_type":"text/x-jinja2","patch_set":9,"id":"1f493fa4_c34e8f95","line":113,"in_reply_to":"1f493fa4_839127f4","updated":"2020-04-30 19:41:29.000000000","message":"maybe need to keep .*.log","commit_id":"92b4720aefdd885e0fad886eefc51c8f97278853"}],"ansible/roles/glance/defaults/main.yml":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"67e59987b7cef1f3697dfe71bd62a28e1eb59222","unresolved":false,"context_lines":[{"line_number":141,"context_line":"  - \"{% if enable_cinder | bool and enable_cinder_backend_iscsi | bool %}iscsi_info:/etc/iscsi{% endif %}\""},{"line_number":142,"context_line":"  - \"{% if enable_cinder | bool and enable_cinder_backend_iscsi | bool %}/dev:/dev{% endif %}\""},{"line_number":143,"context_line":"glance_haproxy_tls_default_volumes:"},{"line_number":144,"context_line":"  - \"{{ node_config_directory }}/glance-haproxy-tls/private/:/etc/glance-haproxy-tls/private/\""},{"line_number":145,"context_line":"  - \"{{ node_config_directory }}/glance-haproxy-tls/private/certs/:/etc/glance-haproxy-tls/private/certs/\""},{"line_number":146,"context_line":"  - \"{{ node_config_directory }}/glance-haproxy-tls/:{{ container_config_directory }}/:ro\""},{"line_number":147,"context_line":"  - \"/etc/localtime:/etc/localtime:ro\""},{"line_number":148,"context_line":"  - \"kolla_logs:/var/log/kolla/\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1f493fa4_37542353","line":145,"range":{"start_line":144,"start_character":0,"end_line":145,"end_character":106},"updated":"2020-04-27 11:24:45.000000000","message":"Why not use config.json?","commit_id":"e08130384f777ee15d8061f59dfafa02ba6432c7"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"1f4caf3ebd24c8e2454ee1fba893d7eb83292b85","unresolved":false,"context_lines":[{"line_number":33,"context_line":"        backend_http_extra:"},{"line_number":34,"context_line":"          - \"timeout server {{ haproxy_glance_api_server_timeout }}\""},{"line_number":35,"context_line":"        custom_member_list: \"{{ haproxy_members.split(\u0027;\u0027) }}\""},{"line_number":36,"context_line":"  glance-haproxy-tls:"},{"line_number":37,"context_line":"    container_name: glance_haproxy_tls"},{"line_number":38,"context_line":"    group: glance-api"},{"line_number":39,"context_line":"    host_in_groups: \"{{ inventory_hostname in glance_api_hosts }}\""},{"line_number":40,"context_line":"    enabled: \"{{ glance_enable_tls_backend }}\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f493fa4_38d99956","line":37,"range":{"start_line":36,"start_character":0,"end_line":37,"end_character":38},"updated":"2020-04-28 08:16:13.000000000","message":"I would just go for glance-tls-proxy as we don\u0027t care about the implementation. It\u0027s haproxy that does it at the moment but later maybe something else. To ease potential transition, let\u0027s not make it explicit in name.","commit_id":"bf692c7f5fcb4e7318c6b5079f326c08be719274"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"1f4caf3ebd24c8e2454ee1fba893d7eb83292b85","unresolved":false,"context_lines":[{"line_number":52,"context_line":"        backend_http_extra:"},{"line_number":53,"context_line":"          - \"timeout server {{ haproxy_glance_api_server_timeout }}\""},{"line_number":54,"context_line":"        custom_member_list: \"{{ haproxy_tls_members.split(\u0027;\u0027) }}\""},{"line_number":55,"context_line":"        tls_backend: \"yes\""},{"line_number":56,"context_line":"      glance_haproxy_tls_external:"},{"line_number":57,"context_line":"        enabled: \"{{ enable_glance | bool and glance_enable_tls_backend | bool }}\""},{"line_number":58,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f493fa4_d8223552","line":55,"range":{"start_line":55,"start_character":8,"end_line":55,"end_character":26},"updated":"2020-04-28 08:16:13.000000000","message":"this is irrelevant when we set custom member list","commit_id":"bf692c7f5fcb4e7318c6b5079f326c08be719274"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"0cd9fb6e8872ffa52a486a6125fbb4f443de2b7c","unresolved":false,"context_lines":[{"line_number":52,"context_line":"        backend_http_extra:"},{"line_number":53,"context_line":"          - \"timeout server {{ haproxy_glance_api_server_timeout }}\""},{"line_number":54,"context_line":"        custom_member_list: \"{{ haproxy_tls_members.split(\u0027;\u0027) }}\""},{"line_number":55,"context_line":"        tls_backend: \"yes\""},{"line_number":56,"context_line":"      glance_haproxy_tls_external:"},{"line_number":57,"context_line":"        enabled: \"{{ enable_glance | bool and glance_enable_tls_backend | bool }}\""},{"line_number":58,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f493fa4_24e4d43b","line":55,"range":{"start_line":55,"start_character":8,"end_line":55,"end_character":26},"in_reply_to":"1f493fa4_a3ce1e2a","updated":"2020-04-28 12:39:14.000000000","message":"Ah, right.","commit_id":"bf692c7f5fcb4e7318c6b5079f326c08be719274"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"ad9cfa644ea9d44b481fc64d31fb8d03b68f0534","unresolved":false,"context_lines":[{"line_number":52,"context_line":"        backend_http_extra:"},{"line_number":53,"context_line":"          - \"timeout server {{ haproxy_glance_api_server_timeout }}\""},{"line_number":54,"context_line":"        custom_member_list: \"{{ haproxy_tls_members.split(\u0027;\u0027) }}\""},{"line_number":55,"context_line":"        tls_backend: \"yes\""},{"line_number":56,"context_line":"      glance_haproxy_tls_external:"},{"line_number":57,"context_line":"        enabled: \"{{ enable_glance | bool and glance_enable_tls_backend | bool }}\""},{"line_number":58,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f493fa4_a3ce1e2a","line":55,"range":{"start_line":55,"start_character":8,"end_line":55,"end_character":26},"in_reply_to":"1f493fa4_d8223552","updated":"2020-04-28 09:44:40.000000000","message":"It\u0027s required for the certs to be copied.","commit_id":"bf692c7f5fcb4e7318c6b5079f326c08be719274"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"1f4caf3ebd24c8e2454ee1fba893d7eb83292b85","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    image: \"{{ glance_haproxy_tls_image_full }}\""},{"line_number":42,"context_line":"    volumes: \"{{ glance_haproxy_tls_default_volumes + glance_haproxy_tls_extra_volumes }}\""},{"line_number":43,"context_line":"    dimensions: \"{{ glance_haproxy_tls_dimensions }}\""},{"line_number":44,"context_line":"    haproxy:"},{"line_number":45,"context_line":"      glance_haproxy_tls:"},{"line_number":46,"context_line":"        enabled: \"{{ enable_glance | bool and glance_enable_tls_backend | bool }}\""},{"line_number":47,"context_line":"        mode: \"http\""},{"line_number":48,"context_line":"        external: false"},{"line_number":49,"context_line":"        port: \"{{ glance_api_port }}\""},{"line_number":50,"context_line":"        frontend_http_extra:"},{"line_number":51,"context_line":"          - \"timeout client {{ haproxy_glance_api_client_timeout }}\""},{"line_number":52,"context_line":"        backend_http_extra:"},{"line_number":53,"context_line":"          - \"timeout server {{ haproxy_glance_api_server_timeout }}\""},{"line_number":54,"context_line":"        custom_member_list: \"{{ haproxy_tls_members.split(\u0027;\u0027) }}\""},{"line_number":55,"context_line":"        tls_backend: \"yes\""},{"line_number":56,"context_line":"      glance_haproxy_tls_external:"},{"line_number":57,"context_line":"        enabled: \"{{ enable_glance | bool and glance_enable_tls_backend | bool }}\""},{"line_number":58,"context_line":"        mode: \"http\""},{"line_number":59,"context_line":"        external: true"},{"line_number":60,"context_line":"        port: \"{{ glance_api_port }}\""},{"line_number":61,"context_line":"        frontend_http_extra:"},{"line_number":62,"context_line":"          - \"timeout client {{ haproxy_glance_api_client_timeout }}\""},{"line_number":63,"context_line":"        backend_http_extra:"},{"line_number":64,"context_line":"          - \"timeout server {{ haproxy_glance_api_server_timeout }}\""},{"line_number":65,"context_line":"        custom_member_list: \"{{ haproxy_tls_members.split(\u0027;\u0027) }}\""},{"line_number":66,"context_line":"        tls_backend: \"yes\""},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"####################"},{"line_number":69,"context_line":"# HAProxy"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f493fa4_3866b9c2","line":66,"range":{"start_line":44,"start_character":0,"end_line":66,"end_character":26},"updated":"2020-04-28 08:16:13.000000000","message":"what prohibits us from reusing the definitions above? glance-api has to be enabled anyway, and this is just a helper tls service that makes tls work.","commit_id":"bf692c7f5fcb4e7318c6b5079f326c08be719274"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"0cd9fb6e8872ffa52a486a6125fbb4f443de2b7c","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    image: \"{{ glance_haproxy_tls_image_full }}\""},{"line_number":42,"context_line":"    volumes: \"{{ glance_haproxy_tls_default_volumes + glance_haproxy_tls_extra_volumes }}\""},{"line_number":43,"context_line":"    dimensions: \"{{ glance_haproxy_tls_dimensions }}\""},{"line_number":44,"context_line":"    haproxy:"},{"line_number":45,"context_line":"      glance_haproxy_tls:"},{"line_number":46,"context_line":"        enabled: \"{{ enable_glance | bool and glance_enable_tls_backend | bool }}\""},{"line_number":47,"context_line":"        mode: \"http\""},{"line_number":48,"context_line":"        external: false"},{"line_number":49,"context_line":"        port: \"{{ glance_api_port }}\""},{"line_number":50,"context_line":"        frontend_http_extra:"},{"line_number":51,"context_line":"          - \"timeout client {{ haproxy_glance_api_client_timeout }}\""},{"line_number":52,"context_line":"        backend_http_extra:"},{"line_number":53,"context_line":"          - \"timeout server {{ haproxy_glance_api_server_timeout }}\""},{"line_number":54,"context_line":"        custom_member_list: \"{{ haproxy_tls_members.split(\u0027;\u0027) }}\""},{"line_number":55,"context_line":"        tls_backend: \"yes\""},{"line_number":56,"context_line":"      glance_haproxy_tls_external:"},{"line_number":57,"context_line":"        enabled: \"{{ enable_glance | bool and glance_enable_tls_backend | bool }}\""},{"line_number":58,"context_line":"        mode: \"http\""},{"line_number":59,"context_line":"        external: true"},{"line_number":60,"context_line":"        port: \"{{ glance_api_port }}\""},{"line_number":61,"context_line":"        frontend_http_extra:"},{"line_number":62,"context_line":"          - \"timeout client {{ haproxy_glance_api_client_timeout }}\""},{"line_number":63,"context_line":"        backend_http_extra:"},{"line_number":64,"context_line":"          - \"timeout server {{ haproxy_glance_api_server_timeout }}\""},{"line_number":65,"context_line":"        custom_member_list: \"{{ haproxy_tls_members.split(\u0027;\u0027) }}\""},{"line_number":66,"context_line":"        tls_backend: \"yes\""},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"####################"},{"line_number":69,"context_line":"# HAProxy"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f493fa4_044f1834","line":66,"range":{"start_line":44,"start_character":0,"end_line":66,"end_character":26},"in_reply_to":"1f493fa4_23e20ea1","updated":"2020-04-28 12:39:14.000000000","message":"Ah, true.","commit_id":"bf692c7f5fcb4e7318c6b5079f326c08be719274"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"ad9cfa644ea9d44b481fc64d31fb8d03b68f0534","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    image: \"{{ glance_haproxy_tls_image_full }}\""},{"line_number":42,"context_line":"    volumes: \"{{ glance_haproxy_tls_default_volumes + glance_haproxy_tls_extra_volumes }}\""},{"line_number":43,"context_line":"    dimensions: \"{{ glance_haproxy_tls_dimensions }}\""},{"line_number":44,"context_line":"    haproxy:"},{"line_number":45,"context_line":"      glance_haproxy_tls:"},{"line_number":46,"context_line":"        enabled: \"{{ enable_glance | bool and glance_enable_tls_backend | bool }}\""},{"line_number":47,"context_line":"        mode: \"http\""},{"line_number":48,"context_line":"        external: false"},{"line_number":49,"context_line":"        port: \"{{ glance_api_port }}\""},{"line_number":50,"context_line":"        frontend_http_extra:"},{"line_number":51,"context_line":"          - \"timeout client {{ haproxy_glance_api_client_timeout }}\""},{"line_number":52,"context_line":"        backend_http_extra:"},{"line_number":53,"context_line":"          - \"timeout server {{ haproxy_glance_api_server_timeout }}\""},{"line_number":54,"context_line":"        custom_member_list: \"{{ haproxy_tls_members.split(\u0027;\u0027) }}\""},{"line_number":55,"context_line":"        tls_backend: \"yes\""},{"line_number":56,"context_line":"      glance_haproxy_tls_external:"},{"line_number":57,"context_line":"        enabled: \"{{ enable_glance | bool and glance_enable_tls_backend | bool }}\""},{"line_number":58,"context_line":"        mode: \"http\""},{"line_number":59,"context_line":"        external: true"},{"line_number":60,"context_line":"        port: \"{{ glance_api_port }}\""},{"line_number":61,"context_line":"        frontend_http_extra:"},{"line_number":62,"context_line":"          - \"timeout client {{ haproxy_glance_api_client_timeout }}\""},{"line_number":63,"context_line":"        backend_http_extra:"},{"line_number":64,"context_line":"          - \"timeout server {{ haproxy_glance_api_server_timeout }}\""},{"line_number":65,"context_line":"        custom_member_list: \"{{ haproxy_tls_members.split(\u0027;\u0027) }}\""},{"line_number":66,"context_line":"        tls_backend: \"yes\""},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"####################"},{"line_number":69,"context_line":"# HAProxy"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f493fa4_23e20ea1","line":66,"range":{"start_line":44,"start_character":0,"end_line":66,"end_character":26},"in_reply_to":"1f493fa4_3866b9c2","updated":"2020-04-28 09:44:40.000000000","message":"If TLS backend is enabled, we want glance_haproxy_tls to be the backend configured in (main) HAProxy, otherwise glance-api is configured as the backend. Doing it this way means we can use the existing service-cert-copy role to copy the certs into the glance_haproxy_tls config dir.","commit_id":"bf692c7f5fcb4e7318c6b5079f326c08be719274"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"1f4caf3ebd24c8e2454ee1fba893d7eb83292b85","unresolved":false,"context_lines":[{"line_number":142,"context_line":"  - \"{% if enable_cinder | bool and enable_cinder_backend_iscsi | bool %}/dev:/dev{% endif %}\""},{"line_number":143,"context_line":"glance_haproxy_tls_default_volumes:"},{"line_number":144,"context_line":"  - \"{{ node_config_directory }}/glance-haproxy-tls/:{{ container_config_directory }}/:ro\""},{"line_number":145,"context_line":"  - \"/etc/localtime:/etc/localtime:ro\""},{"line_number":146,"context_line":"  - \"kolla_logs:/var/log/kolla/\""},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"glance_extra_volumes: \"{{ default_extra_volumes }}\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f493fa4_b8712979","line":145,"updated":"2020-04-28 08:16:13.000000000","message":"and timezone too","commit_id":"bf692c7f5fcb4e7318c6b5079f326c08be719274"}],"ansible/roles/glance/tasks/config.yml":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"67e59987b7cef1f3697dfe71bd62a28e1eb59222","unresolved":false,"context_lines":[{"line_number":64,"context_line":"  when:"},{"line_number":65,"context_line":"    - glance_enable_tls_backend | bool"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"- name: Creating backend internal PEM File"},{"line_number":68,"context_line":"  assemble:"},{"line_number":69,"context_line":"    src: \"{{ node_config_directory }}/glance-haproxy-tls/private/certs\""},{"line_number":70,"context_line":"    dest: \"{{ node_config_directory }}/glance-haproxy-tls/private/glance-backend-tls.pem\""},{"line_number":71,"context_line":"    mode: \"0660\""},{"line_number":72,"context_line":"  when:"},{"line_number":73,"context_line":"    - glance_enable_tls_backend | bool"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"- name: Copying over config.json files for services"},{"line_number":76,"context_line":"  template:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1f493fa4_d764df24","line":73,"range":{"start_line":67,"start_character":0,"end_line":73,"end_character":38},"updated":"2020-04-27 11:24:45.000000000","message":"I think you just need one task here. The files should have been copied into place in copy-certs.yml, and are at {{ node_config_directory }}/glance-haproxy-tls/glance-cert.pem and {{ node_config_directory }}/glance-haproxy-tls/glance-key.pem.\n\nSo you could do something like this:\n\n- name: Creating backend internal PEM File\n  assemble:\n    src: \"{{ node_config_directory }}/glance-haproxy-tls/\"\n    dest: \"{{ node_config_directory }}/glance-haproxy-tls/glance-cert-and-key.pem\"\n    mode: \"0660\"\n    regexp: \"^glance-(cert|key)\\.pem$\"\n    remote_src: true\n  when:\n    - glance_enable_tls_backend | bool","commit_id":"e08130384f777ee15d8061f59dfafa02ba6432c7"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"55b60dd1f5d0c67b39f86f8af53c06b0c92abd5f","unresolved":false,"context_lines":[{"line_number":64,"context_line":"  when:"},{"line_number":65,"context_line":"    - glance_enable_tls_backend | bool"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"- name: Creating backend internal PEM File"},{"line_number":68,"context_line":"  assemble:"},{"line_number":69,"context_line":"    src: \"{{ node_config_directory }}/glance-haproxy-tls/private/certs\""},{"line_number":70,"context_line":"    dest: \"{{ node_config_directory }}/glance-haproxy-tls/private/glance-backend-tls.pem\""},{"line_number":71,"context_line":"    mode: \"0660\""},{"line_number":72,"context_line":"  when:"},{"line_number":73,"context_line":"    - glance_enable_tls_backend | bool"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"- name: Copying over config.json files for services"},{"line_number":76,"context_line":"  template:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1f493fa4_aa056a13","line":73,"range":{"start_line":67,"start_character":0,"end_line":73,"end_character":38},"in_reply_to":"1f493fa4_d764df24","updated":"2020-04-27 11:26:21.000000000","message":"Also, needs become: true","commit_id":"e08130384f777ee15d8061f59dfafa02ba6432c7"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"67e59987b7cef1f3697dfe71bd62a28e1eb59222","unresolved":false,"context_lines":[{"line_number":104,"context_line":"  notify:"},{"line_number":105,"context_line":"    - Restart glance-api container"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"- name: Copying over haproxy-run.sh"},{"line_number":108,"context_line":"  vars:"},{"line_number":109,"context_line":"    glance_haproxy_tls: \"{{ glance_services[\u0027glance-haproxy-tls\u0027] }}\""},{"line_number":110,"context_line":"  copy:"},{"line_number":111,"context_line":"    src: \"{{ role_path }}/templates/haproxy_run.sh.j2\""},{"line_number":112,"context_line":"    dest: \"{{ node_config_directory }}/glance-haproxy-tls/haproxy_run.sh\""},{"line_number":113,"context_line":"    mode: \"0660\""},{"line_number":114,"context_line":"  become: true"},{"line_number":115,"context_line":"  when:"},{"line_number":116,"context_line":"    - glance_haproxy_tls.enabled | bool"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"- name: Copying over glance-haproxy-tls.cfg"},{"line_number":119,"context_line":"  vars:"},{"line_number":120,"context_line":"    glance_haproxy_tls: \"{{ glance_services[\u0027glance-haproxy-tls\u0027] }}\""},{"line_number":121,"context_line":"  template:"},{"line_number":122,"context_line":"    src: \"{{ role_path }}/templates/glance-haproxy-tls.cfg.j2\""},{"line_number":123,"context_line":"    dest: \"{{ node_config_directory }}/glance-haproxy-tls/glance-haproxy-tls.cfg\""},{"line_number":124,"context_line":"    mode: \"0660\""},{"line_number":125,"context_line":"  become: true"},{"line_number":126,"context_line":"  when:"},{"line_number":127,"context_line":"    - glance_haproxy_tls.enabled | bool"},{"line_number":128,"context_line":"    - glance_haproxy_tls.host_in_groups | bool"},{"line_number":129,"context_line":"  notify:"},{"line_number":130,"context_line":"    - Restart glance-haproxy-tls container"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"- name: Copying over glance-cache.conf for glance_api"},{"line_number":133,"context_line":"  vars:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1f493fa4_f76f5bf9","line":130,"range":{"start_line":107,"start_character":0,"end_line":130,"end_character":42},"updated":"2020-04-27 11:24:45.000000000","message":"I don\u0027t think we need this complexity for a single service.","commit_id":"e08130384f777ee15d8061f59dfafa02ba6432c7"}],"ansible/roles/glance/templates/glance-haproxy-tls.cfg.j2":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"67e59987b7cef1f3697dfe71bd62a28e1eb59222","unresolved":false,"context_lines":[{"line_number":1,"context_line":"defaults"},{"line_number":2,"context_line":"    timeout connect 10s"},{"line_number":3,"context_line":"    timeout client 30s"},{"line_number":4,"context_line":"    timeout server 30s"},{"line_number":5,"context_line":"    log 127.0.0.1 local0"},{"line_number":6,"context_line":"    mode http"},{"line_number":7,"context_line":"    option httplog"}],"source_content_type":"text/x-jinja2","patch_set":3,"id":"1f493fa4_173927f1","line":4,"range":{"start_line":3,"start_character":0,"end_line":4,"end_character":22},"updated":"2020-04-27 11:24:45.000000000","message":"These should probably use haproxy_glance_api_client_timeout and haproxy_glance_api_server_timeout.","commit_id":"e08130384f777ee15d8061f59dfafa02ba6432c7"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"67e59987b7cef1f3697dfe71bd62a28e1eb59222","unresolved":false,"context_lines":[{"line_number":2,"context_line":"    timeout connect 10s"},{"line_number":3,"context_line":"    timeout client 30s"},{"line_number":4,"context_line":"    timeout server 30s"},{"line_number":5,"context_line":"    log 127.0.0.1 local0"},{"line_number":6,"context_line":"    mode http"},{"line_number":7,"context_line":"    option httplog"},{"line_number":8,"context_line":"    maxconn 3000"}],"source_content_type":"text/x-jinja2","patch_set":3,"id":"1f493fa4_b73793ff","line":5,"range":{"start_line":5,"start_character":18,"end_line":5,"end_character":24},"updated":"2020-04-27 11:24:45.000000000","message":":( logging is a pain with HAProxy. Might need a new facility.","commit_id":"e08130384f777ee15d8061f59dfafa02ba6432c7"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"67e59987b7cef1f3697dfe71bd62a28e1eb59222","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    bind {{ api_interface_address }}:{{ glance_api_listen_port }} ssl crt /etc/glance/private/glance-backend-tls.pem"},{"line_number":12,"context_line":"    default_backend web_servers"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"backend web_servers"},{"line_number":15,"context_line":"    server glance-api 127.0.0.1:{{ glance_api_listen_port }} check"}],"source_content_type":"text/x-jinja2","patch_set":3,"id":"1f493fa4_f748fb87","line":14,"range":{"start_line":14,"start_character":8,"end_line":14,"end_character":19},"updated":"2020-04-27 11:24:45.000000000","message":"glance_api","commit_id":"e08130384f777ee15d8061f59dfafa02ba6432c7"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"ad9cfa644ea9d44b481fc64d31fb8d03b68f0534","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    log 127.0.0.1 local0"},{"line_number":6,"context_line":"    mode http"},{"line_number":7,"context_line":"    option httplog"},{"line_number":8,"context_line":"    maxconn 3000"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"frontend glance_backend_tls"},{"line_number":11,"context_line":"    bind {{ api_interface_address }}:{{ glance_api_listen_port }} ssl crt /etc/glance/glance-cert-and-key.pem"}],"source_content_type":"text/x-jinja2","patch_set":4,"id":"1f493fa4_3e050112","line":8,"updated":"2020-04-28 09:44:40.000000000","message":"Comparing with the main HAProxy config:\n\nglobal\n    chroot /var/lib/haproxy\n    user haproxy\n    group haproxy\n    daemon\n    log {{ syslog_server }}:{{ syslog_udp_port }} {{ syslog_haproxy_facility }}\n    maxconn {{ haproxy_max_connections }}\n    nbproc {{ haproxy_processes }}\n    {% if (haproxy_processes | int \u003e 1) and (haproxy_process_cpu_map | bool) %}\n        {% for cpu_idx in range(0, haproxy_processes) %}\n    cpu-map {{ cpu_idx + 1 }} {{ cpu_idx }}\n        {% endfor %}\n    {% endif %}\n    stats socket /var/lib/kolla/haproxy/haproxy.sock group kolla mode 660 \n    {% if kolla_enable_tls_external | bool or kolla_enable_tls_internal | bool %}\n    ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES\n    ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11\n    tune.ssl.default-dh-param 4096\n    {% endif %}\n    {% if kolla_enable_tls_internal | bool or kolla_enable_tls_external | bool %}\n    ca-base {{ haproxy_backend_cacert_dir }}\n    {% endif %}\n\ndefaults\n    log global\n    option redispatch\n    retries 3\n    timeout http-request {{ haproxy_http_request_timeout }}\n    timeout queue {{ haproxy_queue_timeout }}\n    timeout connect {{ haproxy_connect_timeout }}\n    timeout client {{ haproxy_client_timeout }}\n    timeout server {{ haproxy_server_timeout }}\n    timeout check {{ haproxy_check_timeout }}\n    balance {{ haproxy_defaults_balance }}\n    maxconn {{ haproxy_defaults_max_connections }}\n\nOf these we can probably do without stats stuff, switch user/group to glance, and ignore ca-base. Syslog facility should be changed, and fluentd config updated to consume it.","commit_id":"bf692c7f5fcb4e7318c6b5079f326c08be719274"}],"ansible/roles/glance/templates/glance-haproxy-tls.json.j2":[{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"1f4caf3ebd24c8e2454ee1fba893d7eb83292b85","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"command\": \"xargs /usr/sbin/haproxy -W -db -p /run/haproxy.pid -f /etc/glance/glance-haproxy-tls.cfg\","},{"line_number":3,"context_line":"    \"config_files\": ["},{"line_number":4,"context_line":"        {"},{"line_number":5,"context_line":"            \"source\": \"{{ container_config_directory }}/glance-haproxy-tls.cfg\","}],"source_content_type":"text/x-jinja2","patch_set":4,"id":"1f493fa4_f8c3b155","line":2,"range":{"start_line":2,"start_character":16,"end_line":2,"end_character":21},"updated":"2020-04-28 08:16:13.000000000","message":"without xargs","commit_id":"bf692c7f5fcb4e7318c6b5079f326c08be719274"}],"ansible/roles/glance/templates/haproxy_run.sh.j2":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"67e59987b7cef1f3697dfe71bd62a28e1eb59222","unresolved":false,"context_lines":[{"line_number":1,"context_line":"#!/bin/bash -x"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"xargs /usr/sbin/haproxy -W -db -p /run/haproxy.pid -f /etc/glance/glance-haproxy-tls.cfg"}],"source_content_type":"text/x-jinja2","patch_set":3,"id":"1f493fa4_d71b3f7e","line":3,"updated":"2020-04-27 11:24:45.000000000","message":"No need for this script - just put this in config.json.","commit_id":"e08130384f777ee15d8061f59dfafa02ba6432c7"}],"releasenotes/notes/encrypt-backend-haproxy-fb96285d74fb464c.yaml":[{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"1404351030028158d23fb2188fa8f6b9a95d7609","unresolved":false,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Added configuration options to enable backend TLS encryption from HAProxy"},{"line_number":5,"context_line":"    to the Keystone, Glance, Heat, and Cinder services. When used in"},{"line_number":6,"context_line":"    conjunction with enabling TLS for service API endpoints, network"},{"line_number":7,"context_line":"    communcation will be encrypted end to end, from client through HAProxy to"},{"line_number":8,"context_line":"    the backend service."}],"source_content_type":"text/x-yaml","patch_set":12,"id":"1f493fa4_e4c2a784","line":5,"range":{"start_line":5,"start_character":39,"end_line":5,"end_character":45},"updated":"2020-04-30 19:47:53.000000000","message":"finally :D","commit_id":"f87814f794701103bd1cea280eb9140bde04d146"}]}