)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"f323d7896b3a241ce1b84acff643920169b96d77","unresolved":true,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Adds support for TLS backend for designate."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Implements: blueprint add-ssl-internal-network"},{"line_number":12,"context_line":"Change-Id: I7239be00e01f0880387f7252109231723d8e8672"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":20,"id":"7b8ec67d_f5c30266","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":2},"updated":"2024-08-13 13:52:05.000000000","message":"this link is wrong, I guess because it references the search and the search function seems only to find blueprints that are not marked as implemented? Not quite sure though.","commit_id":"e0051100206f3d7cb7d91eaa8835b50e3355e2c5"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"46dff5e16bae86336d01163e5fe205148ca2af3d","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Adds support for TLS backend for designate."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Implements: blueprint add-ssl-internal-network"},{"line_number":12,"context_line":"Change-Id: I7239be00e01f0880387f7252109231723d8e8672"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":20,"id":"b6ca838f_8a49cd83","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":2},"in_reply_to":"4816885f_b36a8df9","updated":"2024-08-21 11:09:53.000000000","message":"Done","commit_id":"e0051100206f3d7cb7d91eaa8835b50e3355e2c5"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"95bd26633898c4f11b6194c2307c976358ab746f","unresolved":true,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Adds support for TLS backend for designate."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Implements: blueprint add-ssl-internal-network"},{"line_number":12,"context_line":"Change-Id: I7239be00e01f0880387f7252109231723d8e8672"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":20,"id":"4816885f_b36a8df9","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":2},"in_reply_to":"4ddcb8a3_e188e2a8","updated":"2024-08-20 08:53:47.000000000","message":"I can do that. However, it shows up here https://blueprints.launchpad.net/kolla-ansible/+spec/add-ssl-internal-network\n\nThe important thing for me is that we secure the traffic on the internal network (as addressed by that Blueprint).","commit_id":"e0051100206f3d7cb7d91eaa8835b50e3355e2c5"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"3738ce822ea1167c599297c784ce7125195cb444","unresolved":true,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Adds support for TLS backend for designate."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Implements: blueprint add-ssl-internal-network"},{"line_number":12,"context_line":"Change-Id: I7239be00e01f0880387f7252109231723d8e8672"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":20,"id":"cf24e8c8_75e3e1fd","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":2},"in_reply_to":"7b8ec67d_f5c30266","updated":"2024-08-19 19:01:26.000000000","message":"I think it used to be available. It\u0027s been over a year...\n\nsuggestions?","commit_id":"e0051100206f3d7cb7d91eaa8835b50e3355e2c5"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"0875bd7d3d2e6589af83582e900be85bf030e73d","unresolved":true,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Adds support for TLS backend for designate."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Implements: blueprint add-ssl-internal-network"},{"line_number":12,"context_line":"Change-Id: I7239be00e01f0880387f7252109231723d8e8672"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":20,"id":"4ddcb8a3_e188e2a8","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":2},"in_reply_to":"cf24e8c8_75e3e1fd","updated":"2024-08-20 07:53:46.000000000","message":"my suggestion would be to remove it, because a dead link doesn\u0027t really help and we don\u0027t use bluenprints anymore as far as I know.","commit_id":"e0051100206f3d7cb7d91eaa8835b50e3355e2c5"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"75c833e702dbf708d55904b141619d3322b00e7c","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"0cbb4f34_88b1d474","updated":"2022-12-09 11:33:32.000000000","message":"unsure about the blueprint to reference.\n\nI found this suitable: https://blueprints.launchpad.net/kolla-ansible/+spec/add-ssl-internal-network\n\nbut it is marked as Implemented. However, Designate API still runs insecurely...","commit_id":"aae762ea1b9a710e6b71a4576bca18faaef458ae"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"c0fdda07a82e96af0fe6628a7ed8bbb61fc07ca9","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"c98c0683_599cd6bc","in_reply_to":"0cbb4f34_88b1d474","updated":"2022-12-12 09:16:17.000000000","message":"Done","commit_id":"aae762ea1b9a710e6b71a4576bca18faaef458ae"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"f52551829c4cba4da0acf105ce8689cbf6e426b3","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"327f5443_dd291cb8","updated":"2022-12-14 08:37:43.000000000","message":"We also need to update the Designate API healthcheck","commit_id":"302b8ca2d798753ca7003429717e93c746788d71"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"347ca61c7133e959d5e156fff6094bd22011bbea","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"1aeeb874_20497e67","in_reply_to":"327f5443_dd291cb8","updated":"2022-12-15 06:46:57.000000000","message":"Done","commit_id":"302b8ca2d798753ca7003429717e93c746788d71"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"347ca61c7133e959d5e156fff6094bd22011bbea","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"c1618ffd_598dc449","updated":"2022-12-15 06:46:57.000000000","message":"fixed","commit_id":"5d10912b44d71e710dfb78df1b1d2e1c98d7fcd4"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"1a94e004d30e861a745671a44fcd843cf11acb4b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"e47bc4cc_ac1736f4","updated":"2023-03-14 08:41:20.000000000","message":"This is badly needed to improve our protection against adversaries on the backend network. this should be backported imho","commit_id":"e6073d344e87155877f0a67f611a9f2ad1ab6d9a"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"3269d1181a5a74545d91c13e4f2931d95989ff65","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"5d4e0c62_8c69019f","in_reply_to":"e47bc4cc_ac1736f4","updated":"2024-11-27 16:08:16.000000000","message":"While I agree from a security point of view, as this is a new feature a backport of this is against the openstack backport guidelines and would at least need explicit approval.","commit_id":"e6073d344e87155877f0a67f611a9f2ad1ab6d9a"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"b88d701e7345c9017216a9218d31bebd33cafbdd","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"3c5431f2_08790342","updated":"2023-04-20 11:54:13.000000000","message":"also if we use syslog there is need to add fluentd filters","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"cbb14a46d975d16b0412aaf8994f1938e000dab0","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":12,"id":"7546e6ae_0320cdd9","updated":"2023-04-26 12:40:53.000000000","message":"this would mean an enhanced security stance with regards to the internal backend communication.","commit_id":"46b2a44c85fb666c98d3cacd8800770e76a317dc"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"12431be1d877c0ebe5f98fc5e5df4ccfac9d3fcc","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":13,"id":"e4461fa2_16cf56b1","updated":"2023-04-26 13:40:18.000000000","message":"and certificates reole uses only one slash","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"13d9daf6c35c224442297535a3444433bce890ca","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":13,"id":"d640affe_0d917166","in_reply_to":"9f65eaee_c36994b4","updated":"2023-04-26 13:45:56.000000000","message":"only in your code, don\u0027t touch neutron and glance roles","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"e9534273cf847d6d8418017ced675c4704aa727b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":13,"id":"467b0e6b_d2ab9c4a","in_reply_to":"a29c3cea_5956a3f3","updated":"2023-04-26 13:48:56.000000000","message":"yes, that is fixed.","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"c9109286cedb7358f8491d29c7ce7be1e08d22f2","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":13,"id":"a29c3cea_5956a3f3","in_reply_to":"d640affe_0d917166","updated":"2023-04-26 13:47:08.000000000","message":"remove an extra slash","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"7ec397fe25a2ebf17a0618624496898efcdbe414","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":13,"id":"9f65eaee_c36994b4","in_reply_to":"e4461fa2_16cf56b1","updated":"2023-04-26 13:43:48.000000000","message":"sorry, I do not follow. what should I change and where?","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"1b8a829b82708b3c948f4d227ecf665e5d0911e6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":19,"id":"d47c5645_4102912c","updated":"2024-08-12 11:56:13.000000000","message":"recheck","commit_id":"0d389c45d4202c1256ee43eb6dd311a0896712c2"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"ee49eebf47ac1feda7276714d7ed6b00cc59bd0e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":20,"id":"63d9c6fe_1312228d","updated":"2024-08-13 08:53:56.000000000","message":"recheck","commit_id":"e0051100206f3d7cb7d91eaa8835b50e3355e2c5"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"6d09f37e5df1adf421d5664507348e39ca038cfd","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":25,"id":"3b65c5e5_b6c24bdc","updated":"2024-08-26 12:36:18.000000000","message":"imho this haproxy config should also be automatically validated like this: https://review.opendev.org/c/openstack/kolla-ansible/+/922840\n\nin general I find it problematic that we have different haproxy configs scattered around different roles, but I don\u0027t really know the history why this is done this way.","commit_id":"7d35f61ad0b29d5b75831efd8498d22606614179"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"b9ad6da6f9d23fd4cd644c9652f0f57ab65990f5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":25,"id":"90426ef7_1b8b1e8d","in_reply_to":"3b65c5e5_b6c24bdc","updated":"2024-08-26 13:41:42.000000000","message":"Good suggestion. However, I cannot immediately think of an acceptable solution.\n\nThe obvious path would be to include the Loadbalancer\u0027s HAProxy validation task to validate the configuration, but it is overfit towards Loadbalancers needs.\n\nAn I am not particularly impressed by that code, since it assumes / requires that HAProxy is already running to be able to verify the configuration.\n\nThe best way IMHO:\n\nCreate a generic `validate_config` in loadbalancer that:\n\n1. Writes the config to be validatated to a isolated location\n2. Start a fresh HAProxy container, mounting the config under evaluation\n3. Runs the configuration checks inside the temporary container\n\nThat is way out of scope for this merge request.","commit_id":"7d35f61ad0b29d5b75831efd8498d22606614179"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"3269d1181a5a74545d91c13e4f2931d95989ff65","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":29,"id":"4af71360_d5b58898","updated":"2024-11-27 16:08:16.000000000","message":"LGTM, need to take another look later though, before giving this +2.","commit_id":"cea2a9b10e1dc4804810c2e237fdbdf344216302"}],"ansible/roles/common/defaults/main.yml":[{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"b88d701e7345c9017216a9218d31bebd33cafbdd","unresolved":true,"context_lines":[{"line_number":79,"context_line":"syslog_haproxy_facility: \"local1\""},{"line_number":80,"context_line":"syslog_glance_tls_proxy_facility: \"local2\""},{"line_number":81,"context_line":"syslog_neutron_tls_proxy_facility: \"local4\""},{"line_number":82,"context_line":"syslog_designate_tls_proxy_facility: \"local4\""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"syslog_facilities:"},{"line_number":85,"context_line":"  - name: \"swift\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"ed35b9cf_f3585714","line":82,"range":{"start_line":82,"start_character":38,"end_line":82,"end_character":44},"updated":"2023-04-20 11:54:13.000000000","message":"share with neutron facility?","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"424f9dc38e23f1097024862a32c8a111b437eef2","unresolved":true,"context_lines":[{"line_number":79,"context_line":"syslog_haproxy_facility: \"local1\""},{"line_number":80,"context_line":"syslog_glance_tls_proxy_facility: \"local2\""},{"line_number":81,"context_line":"syslog_neutron_tls_proxy_facility: \"local4\""},{"line_number":82,"context_line":"syslog_designate_tls_proxy_facility: \"local4\""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"syslog_facilities:"},{"line_number":85,"context_line":"  - name: \"swift\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"826a9c94_fda72622","line":82,"range":{"start_line":82,"start_character":38,"end_line":82,"end_character":44},"in_reply_to":"0b928fca_98fab956","updated":"2023-04-25 13:41:19.000000000","message":"done. `local6` it is.","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"6d9781b507f62c50699192efbc81851b2fe67510","unresolved":true,"context_lines":[{"line_number":79,"context_line":"syslog_haproxy_facility: \"local1\""},{"line_number":80,"context_line":"syslog_glance_tls_proxy_facility: \"local2\""},{"line_number":81,"context_line":"syslog_neutron_tls_proxy_facility: \"local4\""},{"line_number":82,"context_line":"syslog_designate_tls_proxy_facility: \"local4\""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"syslog_facilities:"},{"line_number":85,"context_line":"  - name: \"swift\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"0b928fca_98fab956","line":82,"range":{"start_line":82,"start_character":38,"end_line":82,"end_character":44},"in_reply_to":"640c9b79_9375add7","updated":"2023-04-24 10:18:30.000000000","message":"use free one or related to Disignate service if used before.","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"57afc4658ab04291f049c7076c75ee9acbaae5af","unresolved":false,"context_lines":[{"line_number":79,"context_line":"syslog_haproxy_facility: \"local1\""},{"line_number":80,"context_line":"syslog_glance_tls_proxy_facility: \"local2\""},{"line_number":81,"context_line":"syslog_neutron_tls_proxy_facility: \"local4\""},{"line_number":82,"context_line":"syslog_designate_tls_proxy_facility: \"local4\""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"syslog_facilities:"},{"line_number":85,"context_line":"  - name: \"swift\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"258c0a08_af1f0bdf","line":82,"range":{"start_line":82,"start_character":38,"end_line":82,"end_character":44},"in_reply_to":"826a9c94_fda72622","updated":"2023-04-25 13:48:49.000000000","message":"Done","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"113b1bf7cf37ab5fafb3f3b9bf752a93ca612f80","unresolved":true,"context_lines":[{"line_number":79,"context_line":"syslog_haproxy_facility: \"local1\""},{"line_number":80,"context_line":"syslog_glance_tls_proxy_facility: \"local2\""},{"line_number":81,"context_line":"syslog_neutron_tls_proxy_facility: \"local4\""},{"line_number":82,"context_line":"syslog_designate_tls_proxy_facility: \"local4\""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"syslog_facilities:"},{"line_number":85,"context_line":"  - name: \"swift\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"640c9b79_9375add7","line":82,"range":{"start_line":82,"start_character":38,"end_line":82,"end_character":44},"in_reply_to":"ed35b9cf_f3585714","updated":"2023-04-24 07:49:56.000000000","message":"I am unsure what to put here. Do we want another facility? We should not use the same as neutron IMHO if the facilities are used somewhere to distinguish the sending process.\n\n`local5`?","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"}],"ansible/roles/designate/defaults/main.yml":[{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"b88d701e7345c9017216a9218d31bebd33cafbdd","unresolved":true,"context_lines":[{"line_number":404,"context_line":"# Backend TLS proxy"},{"line_number":405,"context_line":"####################"},{"line_number":406,"context_line":"syslog_server: \"{{ api_interface_address }}\""},{"line_number":407,"context_line":"syslog_designate_tls_proxy_facility: \"local4\""},{"line_number":408,"context_line":""},{"line_number":409,"context_line":"designate_tls_proxy_max_connections: 40000"},{"line_number":410,"context_line":"designate_tls_proxy_processes: 1"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"d1deda6b_2dbf1fb4","line":407,"range":{"start_line":407,"start_character":38,"end_line":407,"end_character":44},"updated":"2023-04-20 11:54:13.000000000","message":"ditto","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"57afc4658ab04291f049c7076c75ee9acbaae5af","unresolved":false,"context_lines":[{"line_number":404,"context_line":"# Backend TLS proxy"},{"line_number":405,"context_line":"####################"},{"line_number":406,"context_line":"syslog_server: \"{{ api_interface_address }}\""},{"line_number":407,"context_line":"syslog_designate_tls_proxy_facility: \"local4\""},{"line_number":408,"context_line":""},{"line_number":409,"context_line":"designate_tls_proxy_max_connections: 40000"},{"line_number":410,"context_line":"designate_tls_proxy_processes: 1"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"ef72d3fb_8138f197","line":407,"range":{"start_line":407,"start_character":38,"end_line":407,"end_character":44},"in_reply_to":"0230a28e_0a574d10","updated":"2023-04-25 13:48:49.000000000","message":"Done","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"424f9dc38e23f1097024862a32c8a111b437eef2","unresolved":true,"context_lines":[{"line_number":404,"context_line":"# Backend TLS proxy"},{"line_number":405,"context_line":"####################"},{"line_number":406,"context_line":"syslog_server: \"{{ api_interface_address }}\""},{"line_number":407,"context_line":"syslog_designate_tls_proxy_facility: \"local4\""},{"line_number":408,"context_line":""},{"line_number":409,"context_line":"designate_tls_proxy_max_connections: 40000"},{"line_number":410,"context_line":"designate_tls_proxy_processes: 1"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"0230a28e_0a574d10","line":407,"range":{"start_line":407,"start_character":38,"end_line":407,"end_character":44},"in_reply_to":"d1deda6b_2dbf1fb4","updated":"2023-04-25 13:41:19.000000000","message":"`local6` had a nice ring to it.","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"5591d4a6d8237654b956dda50bef56b10ca15943","unresolved":true,"context_lines":[{"line_number":139,"context_line":"designate_api_tag: \"{{ designate_tag }}\""},{"line_number":140,"context_line":"designate_api_image_full: \"{{ designate_api_image }}:{{ designate_api_tag }}\""},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"designate_tls_proxy_image: \"{{ docker_registry ~ \u0027/\u0027 if docker_registry else \u0027\u0027 }}{{ docker_namespace }}/haproxy\""},{"line_number":143,"context_line":"designate_tls_proxy_tag: \"{{ designate_tag }}\""},{"line_number":144,"context_line":"designate_tls_proxy_image_full: \"{{ designate_tls_proxy_image }}:{{ designate_tls_proxy_tag }}\""},{"line_number":145,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":14,"id":"59e2250a_2d9badc7","line":142,"updated":"2023-04-27 14:32:11.000000000","message":"maybe this should be moved down a few lines so as to maintain alphabetical sorting order for the params?","commit_id":"065b7de2aa902c1339beab88834df1e72f1dbf3a"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"8dc2603c0881f2f7916078dbf8bcc061bfe9bcf6","unresolved":true,"context_lines":[{"line_number":139,"context_line":"designate_api_tag: \"{{ designate_tag }}\""},{"line_number":140,"context_line":"designate_api_image_full: \"{{ designate_api_image }}:{{ designate_api_tag }}\""},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"designate_tls_proxy_image: \"{{ docker_registry ~ \u0027/\u0027 if docker_registry else \u0027\u0027 }}{{ docker_namespace }}/haproxy\""},{"line_number":143,"context_line":"designate_tls_proxy_tag: \"{{ designate_tag }}\""},{"line_number":144,"context_line":"designate_tls_proxy_image_full: \"{{ designate_tls_proxy_image }}:{{ designate_tls_proxy_tag }}\""},{"line_number":145,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":14,"id":"6eb631ea_4c649946","line":142,"in_reply_to":"59e2250a_2d9badc7","updated":"2023-04-27 14:36:58.000000000","message":"it would be nice","commit_id":"065b7de2aa902c1339beab88834df1e72f1dbf3a"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"3bb6bec6aca27f9a7e76f4914a152135190efe50","unresolved":false,"context_lines":[{"line_number":139,"context_line":"designate_api_tag: \"{{ designate_tag }}\""},{"line_number":140,"context_line":"designate_api_image_full: \"{{ designate_api_image }}:{{ designate_api_tag }}\""},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"designate_tls_proxy_image: \"{{ docker_registry ~ \u0027/\u0027 if docker_registry else \u0027\u0027 }}{{ docker_namespace }}/haproxy\""},{"line_number":143,"context_line":"designate_tls_proxy_tag: \"{{ designate_tag }}\""},{"line_number":144,"context_line":"designate_tls_proxy_image_full: \"{{ designate_tls_proxy_image }}:{{ designate_tls_proxy_tag }}\""},{"line_number":145,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":14,"id":"b066233c_5044bfb3","line":142,"in_reply_to":"6eb631ea_4c649946","updated":"2023-04-27 14:42:22.000000000","message":"done","commit_id":"065b7de2aa902c1339beab88834df1e72f1dbf3a"},{"author":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"change_message_id":"dce94c2708eae3177c4f6a2fa20cbe6a64afff14","unresolved":true,"context_lines":[{"line_number":152,"context_line":"designate_sink_image_full: \"{{ designate_sink_image }}:{{ designate_sink_tag }}\""},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"designate_tls_proxy_image: \"{{ docker_registry ~ \u0027/\u0027 if docker_registry else \u0027\u0027 }}{{ docker_namespace }}/haproxy\""},{"line_number":155,"context_line":"designate_tls_proxy_tag: \"{{ designate_tag }}\""},{"line_number":156,"context_line":"designate_tls_proxy_image_full: \"{{ designate_tls_proxy_image }}:{{ designate_tls_proxy_tag }}\""},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"designate_worker_image: \"{{ docker_registry ~ \u0027/\u0027 if docker_registry else \u0027\u0027 }}{{ docker_namespace }}/designate-worker\""}],"source_content_type":"text/x-yaml","patch_set":16,"id":"5ebf539b_0ca47bf7","line":155,"range":{"start_line":155,"start_character":28,"end_line":155,"end_character":43},"updated":"2023-05-05 09:08:18.000000000","message":"A separate ``haproxy_tag`` is used here in the Glance and Neutron roles. Should the same be done here?","commit_id":"82882ed1c617431570901f3cfe69a917ea54ff7c"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"98c217501f3c08d618650221a4466a543442b32c","unresolved":false,"context_lines":[{"line_number":152,"context_line":"designate_sink_image_full: \"{{ designate_sink_image }}:{{ designate_sink_tag }}\""},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"designate_tls_proxy_image: \"{{ docker_registry ~ \u0027/\u0027 if docker_registry else \u0027\u0027 }}{{ docker_namespace }}/haproxy\""},{"line_number":155,"context_line":"designate_tls_proxy_tag: \"{{ designate_tag }}\""},{"line_number":156,"context_line":"designate_tls_proxy_image_full: \"{{ designate_tls_proxy_image }}:{{ designate_tls_proxy_tag }}\""},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"designate_worker_image: \"{{ docker_registry ~ \u0027/\u0027 if docker_registry else \u0027\u0027 }}{{ docker_namespace }}/designate-worker\""}],"source_content_type":"text/x-yaml","patch_set":16,"id":"ab2330d3_90683246","line":155,"range":{"start_line":155,"start_character":28,"end_line":155,"end_character":43},"in_reply_to":"5ebf539b_0ca47bf7","updated":"2023-08-28 14:16:17.000000000","message":"Ack","commit_id":"82882ed1c617431570901f3cfe69a917ea54ff7c"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"6d09f37e5df1adf421d5664507348e39ca038cfd","unresolved":true,"context_lines":[{"line_number":174,"context_line":"designate_api_healthcheck_interval: \"{{ default_container_healthcheck_interval }}\""},{"line_number":175,"context_line":"designate_api_healthcheck_retries: \"{{ default_container_healthcheck_retries }}\""},{"line_number":176,"context_line":"designate_api_healthcheck_start_period: \"{{ default_container_healthcheck_start_period }}\""},{"line_number":177,"context_line":"designate_api_healthcheck_test: [\"CMD-SHELL\", \"healthcheck_curl http://{% if designate_enable_tls_backend | bool %}localhost{% else %}{{ api_interface_address |  put_address_in_context(\u0027url\u0027) }}{% endif %}:{{ designate_api_listen_port }}\"]"},{"line_number":178,"context_line":"designate_api_healthcheck_timeout: \"{{ default_container_healthcheck_timeout }}\""},{"line_number":179,"context_line":"designate_api_healthcheck:"},{"line_number":180,"context_line":"  interval: \"{{ designate_api_healthcheck_interval }}\""}],"source_content_type":"text/x-yaml","patch_set":25,"id":"37c278b2_406e333d","line":177,"range":{"start_line":177,"start_character":115,"end_line":177,"end_character":124},"updated":"2024-08-26 12:36:18.000000000","message":"why localhost?","commit_id":"7d35f61ad0b29d5b75831efd8498d22606614179"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"b9ad6da6f9d23fd4cd644c9652f0f57ab65990f5","unresolved":true,"context_lines":[{"line_number":174,"context_line":"designate_api_healthcheck_interval: \"{{ default_container_healthcheck_interval }}\""},{"line_number":175,"context_line":"designate_api_healthcheck_retries: \"{{ default_container_healthcheck_retries }}\""},{"line_number":176,"context_line":"designate_api_healthcheck_start_period: \"{{ default_container_healthcheck_start_period }}\""},{"line_number":177,"context_line":"designate_api_healthcheck_test: [\"CMD-SHELL\", \"healthcheck_curl http://{% if designate_enable_tls_backend | bool %}localhost{% else %}{{ api_interface_address |  put_address_in_context(\u0027url\u0027) }}{% endif %}:{{ designate_api_listen_port }}\"]"},{"line_number":178,"context_line":"designate_api_healthcheck_timeout: \"{{ default_container_healthcheck_timeout }}\""},{"line_number":179,"context_line":"designate_api_healthcheck:"},{"line_number":180,"context_line":"  interval: \"{{ designate_api_healthcheck_interval }}\""}],"source_content_type":"text/x-yaml","patch_set":25,"id":"896d118f_6d743aed","line":177,"range":{"start_line":177,"start_character":115,"end_line":177,"end_character":124},"in_reply_to":"37c278b2_406e333d","updated":"2024-08-26 13:41:42.000000000","message":"I will examine if it works to implement like Glance does - which just modifies the protocol section of the URL.\n\nBut using `localhost` is a good idea, since it only evaluates the function of the API process (which is mounted there). If one uses the externally available address, the API container would report \"UNHEALTHY\" in the case of a TLS-related problem, which could cause confusion. \n\nLet me know what you want me to do...","commit_id":"7d35f61ad0b29d5b75831efd8498d22606614179"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"59a5e157583b0917eda267d46b2defe7ed2e2cce","unresolved":false,"context_lines":[{"line_number":174,"context_line":"designate_api_healthcheck_interval: \"{{ default_container_healthcheck_interval }}\""},{"line_number":175,"context_line":"designate_api_healthcheck_retries: \"{{ default_container_healthcheck_retries }}\""},{"line_number":176,"context_line":"designate_api_healthcheck_start_period: \"{{ default_container_healthcheck_start_period }}\""},{"line_number":177,"context_line":"designate_api_healthcheck_test: [\"CMD-SHELL\", \"healthcheck_curl http://{% if designate_enable_tls_backend | bool %}localhost{% else %}{{ api_interface_address |  put_address_in_context(\u0027url\u0027) }}{% endif %}:{{ designate_api_listen_port }}\"]"},{"line_number":178,"context_line":"designate_api_healthcheck_timeout: \"{{ default_container_healthcheck_timeout }}\""},{"line_number":179,"context_line":"designate_api_healthcheck:"},{"line_number":180,"context_line":"  interval: \"{{ designate_api_healthcheck_interval }}\""}],"source_content_type":"text/x-yaml","patch_set":25,"id":"3e843f6d_99aa010d","line":177,"range":{"start_line":177,"start_character":115,"end_line":177,"end_character":124},"in_reply_to":"896d118f_6d743aed","updated":"2024-09-04 06:42:48.000000000","message":"I believe `localhost` is the best option per arguments above.","commit_id":"7d35f61ad0b29d5b75831efd8498d22606614179"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"3269d1181a5a74545d91c13e4f2931d95989ff65","unresolved":true,"context_lines":[{"line_number":421,"context_line":"designate_tls_proxy_client_timeout: \"1m\""},{"line_number":422,"context_line":"designate_tls_proxy_server_timeout: \"1m\""},{"line_number":423,"context_line":"designate_tls_proxy_check_timeout: \"10s\""},{"line_number":424,"context_line":"# Check http://www.haproxy.org/download/1.5/doc/configuration.txt for available options"},{"line_number":425,"context_line":"designate_tls_proxy_defaults_balance: \"roundrobin\""}],"source_content_type":"text/x-yaml","patch_set":29,"id":"d419f790_efe1dc6a","line":424,"range":{"start_line":424,"start_character":0,"end_line":424,"end_character":2},"updated":"2024-11-27 16:08:16.000000000","message":"nit: maybe use a less outdated link?\n\n```suggestion\n# Check https://www.haproxy.org/download/2.5/doc/configuration.txt for available options\n```","commit_id":"cea2a9b10e1dc4804810c2e237fdbdf344216302"}],"ansible/roles/designate/handlers/main.yml":[{"author":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"change_message_id":"48a7c11de2ae7a186f232ea9ad82e3006053946e","unresolved":true,"context_lines":[{"line_number":124,"context_line":"    volumes: \"{{ service.volumes | reject(\u0027equalto\u0027, \u0027\u0027) | list }}\""},{"line_number":125,"context_line":"    dimensions: \"{{ service.dimensions }}\""},{"line_number":126,"context_line":"    healthcheck: \"{{ service.healthcheck | default(omit) }}\""},{"line_number":127,"context_line":"  when:"},{"line_number":128,"context_line":"    - kolla_action !\u003d \"config\""}],"source_content_type":"text/x-yaml","patch_set":29,"id":"4b24a663_f98b0a83","line":128,"range":{"start_line":127,"start_character":0,"end_line":128,"end_character":30},"updated":"2025-04-02 14:45:54.000000000","message":"Likewise, this can be dropped as per: https://review.opendev.org/c/openstack/kolla-ansible/+/745164","commit_id":"cea2a9b10e1dc4804810c2e237fdbdf344216302"}],"ansible/roles/designate/tasks/config.yml":[{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"b88d701e7345c9017216a9218d31bebd33cafbdd","unresolved":true,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy/\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"affd503b_6440da71","line":45,"range":{"start_line":45,"start_character":0,"end_line":45,"end_character":42},"updated":"2023-04-20 11:54:13.000000000","message":"why not use backend-cert.pem and backend-key.pem ?\nthere is need to update certificates role to use different files","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"6d9781b507f62c50699192efbc81851b2fe67510","unresolved":true,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy/\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"c562aaac_4625e661","line":45,"range":{"start_line":45,"start_character":0,"end_line":45,"end_character":42},"in_reply_to":"258f8943_c43f8d80","updated":"2023-04-24 10:18:30.000000000","message":"since we rely on kolla_enable_tls_backend enabled, so we should already have backend certificates, but you provide the new custom name of the backend certificates.","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"b207dd8ba63753be09eec7110d1f63c7a92c2ec8","unresolved":true,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy/\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"ec0e6f10_540fd4cc","line":45,"range":{"start_line":45,"start_character":0,"end_line":45,"end_character":42},"in_reply_to":"3e19be61_ed0c12a5","updated":"2023-04-25 17:43:36.000000000","message":"there are many peoples use certificates playbook which uses certificates role. when they enable tls for backend and deploy designate - the deploy would fail!","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"eff234bdf5eb1edb876f9cd60d0349a368762444","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy/\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"a46abac4_17059519","line":45,"range":{"start_line":45,"start_character":0,"end_line":45,"end_character":42},"in_reply_to":"4b5f5895_029867fc","updated":"2023-04-26 12:02:32.000000000","message":"Yes, you describe the correct workflow but forgot kolla_copy_ca_into_containers, by default it set to false, and backend certs didn\u0027t copied to the service certs, because service-cert-copy role not executed, so your task would fail. So if you rely on the default workflow you should support all the cases.","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"fa9d7f6b29c261bddd15f71ad1572a9491120edc","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy/\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"4b5f5895_029867fc","line":45,"range":{"start_line":45,"start_character":0,"end_line":45,"end_character":42},"in_reply_to":"af610850_fe74cfc4","updated":"2023-04-26 11:32:45.000000000","message":"\u003e 1. all certificates created on the deployment host.\n\nyes, if you use the `certificates` role. \n\nYou could ofc also have another orchestration that puts the same certificates on the Ansible Controller (`backend*`).\n\nFor enhanced security, one would place NO certificates on the Ansible Controller, instead configuring the `kolla_externally_managed_cert: true` setting, and ensuring that the required certificates are in the correct place. See [1].\n\n\u003e the certificates role doesn\u0027t create designate-cert.pem and designate-key.pem,\n\nYes, true. It creates the `backend-cert.pem` and `backend-key.pem` files when `kolla_enable_tls_backend | bool or rabbitmq_enable_tls | bool`. See [2].\n\n\u003e but creates another files when kolla_enable_tls_backend set to true.\n\nNo, see above.\n\nWhen `kolla_externally_managed_cert: false` and `kolla_enable_tls_backend: true`, the role `service-cert-copy` copies the `backend-cert.pem` and `backend-key.pem` files from the Ansible Controller to the Inventory Node. However, they are not named `backend-cert.pem` and `backend-key.pem` on the Inventory Node. They are named `\u003cservice\u003e-cert.pem` and `\u003cservice\u003e-key.pem`. For Designate, that would mean `designate-cert.pem` - and conversely for Neutron that would mean `neutron-cert.pem`\n\n[1] https://docs.openstack.org/kolla-ansible/latest/admin/tls.html#generating-your-certificates-without-kolla-ansible\n[2] https://opendev.org/openstack/kolla-ansible/src/commit/3b24d77c48d2d292c368c813f48b88ea01fa0977/ansible/roles/certificates/tasks/generate-backend.yml","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"113b1bf7cf37ab5fafb3f3b9bf752a93ca612f80","unresolved":true,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy/\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"258f8943_c43f8d80","line":45,"range":{"start_line":45,"start_character":0,"end_line":45,"end_character":42},"in_reply_to":"affd503b_6440da71","updated":"2023-04-24 07:49:56.000000000","message":"I copied the implementation from the other TLS Proxies in an attempt to not create a specific solution for designate.\n\nSo we should not change anything here IMHO.\n\nIt seems that the role `service-cert-copy` takes care of managing the backend certificates in a specific way, naming the copies in such a way so that the task above is correct.","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"424f9dc38e23f1097024862a32c8a111b437eef2","unresolved":true,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy/\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"3e19be61_ed0c12a5","line":45,"range":{"start_line":45,"start_character":0,"end_line":45,"end_character":42},"in_reply_to":"c562aaac_4625e661","updated":"2023-04-25 13:41:19.000000000","message":"yes, just like in:\n\nhttps://opendev.org/openstack/kolla-ansible/src/commit/3b24d77c48d2d292c368c813f48b88ea01fa0977/ansible/roles/neutron/tasks/config.yml#L27\n\nhttps://opendev.org/openstack/kolla-ansible/src/commit/3b24d77c48d2d292c368c813f48b88ea01fa0977/ansible/roles/glance/tasks/config.yml#L42\n\nWe are using Haproxy to terminate the TLS session. And it needs a file with the cert and key in the same file. As opposed to fex Cinder, where there is already support in the WSGI-configuration (which takes separate cert and key files).\n\nSo I like this approach:\n- It works\n- It uses the same mechanics as code already in kolla-ansible\n- The backend files are actually copied to the folders as \u003cservice\u003e-cert and \u003cservice\u003e-key (no \"backend\" here) https://opendev.org/openstack/kolla-ansible/src/commit/6c3738a84c1b84ac9224f97742511c83b98458de/ansible/roles/service-cert-copy/tasks/main.yml#L24\n- We need to assemble the cert and key. Let\u0027s name it similar to Neutron and Glance.","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"483f880f7517f95b2875e29e119877999ee361d6","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy/\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"af610850_fe74cfc4","line":45,"range":{"start_line":45,"start_character":0,"end_line":45,"end_character":42},"in_reply_to":"e79f9730_70bd2da9","updated":"2023-04-26 11:06:10.000000000","message":"1. all certificates created on the deployment host.\n2. the certificates role doesn\u0027t create designate-cert.pem and designate-key.pem, but creates another files when kolla_enable_tls_backend set to true.","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"431bbab4f2ab145070a14a5a784106789f1a9359","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy/\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"e79f9730_70bd2da9","line":45,"range":{"start_line":45,"start_character":0,"end_line":45,"end_character":42},"in_reply_to":"ec0e6f10_540fd4cc","updated":"2023-04-26 10:36:18.000000000","message":"No, that is not correct. It is all explained in the comment above.\n\nI believe that you are misunderstanding how the certificates are distributed. \n\nThe role `certificates` does indeed create certificate files named `backend*`. However, these files are created on the Ansible Controller - not on the inventory nodes.\n\nAs explained in my comment above, when role `service-cert-copy` runs it copies the `backend*` certificates (or specifically named certificates if they exist instead) to the Inventory Node, but the certificate file is NOT named `backend*` there. See above.\n\nSo, again:\n\n1. This works for all deployment scenarios\n2. It uses the same approach as other services (Neutron TLS Proxy and Glance TLS Proxy)","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"eff234bdf5eb1edb876f9cd60d0349a368762444","unresolved":true,"context_lines":[{"line_number":48,"context_line":"  when:"},{"line_number":49,"context_line":"    - designate_tls_proxy.enabled | bool"},{"line_number":50,"context_line":"    - designate_tls_proxy.host_in_groups | bool"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"- name: Copying over config.json files for services"},{"line_number":53,"context_line":"  template:"},{"line_number":54,"context_line":"    src: \"{{ item.key }}.json.j2\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"fdd84a72_2c770441","line":51,"updated":"2023-04-26 12:02:32.000000000","message":"- kolla_copy_ca_into_containers | bool","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"1cc538242d96d0bebe3b630268a2e5fdb92bbd47","unresolved":false,"context_lines":[{"line_number":48,"context_line":"  when:"},{"line_number":49,"context_line":"    - designate_tls_proxy.enabled | bool"},{"line_number":50,"context_line":"    - designate_tls_proxy.host_in_groups | bool"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"- name: Copying over config.json files for services"},{"line_number":53,"context_line":"  template:"},{"line_number":54,"context_line":"    src: \"{{ item.key }}.json.j2\""}],"source_content_type":"text/x-yaml","patch_set":9,"id":"4949c186_401e061c","line":51,"in_reply_to":"fdd84a72_2c770441","updated":"2023-04-26 12:36:56.000000000","message":"good spot. fixed.","commit_id":"83f7c6fb1aebcce53d7b7ed092125a9e8f2c0a5d"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"bcff638e216768fbe4cba8b63f73e6f2a4361fd6","unresolved":true,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy/\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":12,"id":"be2055fa_ad877c48","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"updated":"2023-04-26 12:59:01.000000000","message":"not an error but extra slash not needed","commit_id":"46b2a44c85fb666c98d3cacd8800770e76a317dc"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"56e9904d58b9dfa93ebeca5e9dd5c800c4d79d95","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy/\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":12,"id":"e8aecce5_f128597a","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"in_reply_to":"4151fa01_250e461b","updated":"2023-04-26 13:38:45.000000000","message":"Neutron and Glance roles uses two slashes, but octavia-certificates role only one)","commit_id":"46b2a44c85fb666c98d3cacd8800770e76a317dc"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"5c2eaf134815321817ce035afb8585e2a637d192","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy/\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":12,"id":"4151fa01_250e461b","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"in_reply_to":"7715a89a_03492c16","updated":"2023-04-26 13:32:33.000000000","message":"ok","commit_id":"46b2a44c85fb666c98d3cacd8800770e76a317dc"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"a6110abfa991717b2f17d88491c61f660070a93f","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy/\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":12,"id":"7715a89a_03492c16","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"in_reply_to":"a84ee848_071c5718","updated":"2023-04-26 13:19:53.000000000","message":"you don\u0027t need to fix other changes. this is not an error (https://paste.openstack.org/show/bKLtgkb3mvWgR2ZG9GAH/), but leftovers.","commit_id":"46b2a44c85fb666c98d3cacd8800770e76a317dc"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"61ea111b63b9b43b132a15dfb528a1863b77f656","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy/\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":12,"id":"a84ee848_071c5718","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"in_reply_to":"be2055fa_ad877c48","updated":"2023-04-26 13:09:48.000000000","message":"removed it. should I change Neutron and Glance as well? They use the same setting. The examples from Ansible docs does not use a slash at the end, so it is probably the cleanest.","commit_id":"46b2a44c85fb666c98d3cacd8800770e76a317dc"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"3f8e2e5af5601aabe994192a40f6f2c882e2adcb","unresolved":true,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"6f3ba738_bbcc67ba","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"updated":"2023-04-26 16:42:10.000000000","message":"not fixed yet","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"faf8bc97e3cbf85a20aee53ee3725408e472baf9","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"4e92d32e_96a95d0f","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"in_reply_to":"374242ea_35d4f42a","updated":"2023-04-28 08:12:56.000000000","message":"this is because of double quotes. ok, leave as is.","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"ed4cb7b5c918953862f58b395efda5657ec5e1e1","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"55d60548_af926f73","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"in_reply_to":"4e92d32e_96a95d0f","updated":"2023-04-28 10:49:49.000000000","message":"OK","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"19871336a71d01b3e0d386338e4feaaffa5fdb95","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"cfad785d_15ffde89","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"in_reply_to":"53135dd9_7c828679","updated":"2023-04-27 13:55:41.000000000","message":"IMHO there is no need in extra backslash, which confuses folks who didn\u0027t read Ansible module documentation and have only knowledge about regexp and Python re library.","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"3f9be2226908857174d3271dad1c3fb265095ea9","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"9fb79cf5_e231c1f9","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"in_reply_to":"6f3ba738_bbcc67ba","updated":"2023-04-27 06:43:57.000000000","message":"on L45 nothing can be changed. \n\nExplanation:\n\nThe regexp needs no match the `.` character in the filename. In regexp, `.` normally means \"a character, except for newline\". So, to actually match `.` one needs to escape it to `\\.`. \n\nBut due to shenanigans, the `\\` also needs to be escaped, yielding `\\\\.` -  because of YAML-formatting (?). See [1].\n\nThe `^designate-(cert|key)\\\\.pem$\"` regexp will match the files:\n- designate-cert.pem\n- designate-key.pem\n\nWhich is the intended outcome. See Neutron and Glance.\n\n[1] https://docs.ansible.com/ansible/latest/collections/ansible/builtin/assemble_module.html#parameter-regexp","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"96970a7b17cdc4b56b1be3bca15deb9baf700821","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"dbc5d9b1_34fd049a","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"in_reply_to":"7620cc58_210231e4","updated":"2023-04-27 13:33:22.000000000","message":"interesting. so it seems to work either way. weird. OK so what to conform to. Neutron / Glance that also creates a combined file or as in Octavia / Certificates?","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"43c4ff67c84d6b35e0df72c8da42b92ed1ba93e4","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"374242ea_35d4f42a","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"in_reply_to":"97740b1e_b91b4aa4","updated":"2023-04-28 07:49:42.000000000","message":"Unfortunately your suggestion caused the linters to fail.\n\n```\nlinters: 24862 W commands[7]\u003e yamllint -s . [tox/tox_env/api.py:428]\n./ansible/roles/designate/tasks/config.yml\n  45:36     error    syntax error: found unknown escape character \u0027.\u0027 (syntax)\n```\n\nrestoring to per Ansible documentation and as done in Neutron and Glance","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"10ba7d0fd4a3affe44542c61608b09f0aa2496d7","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"eddde8ab_99200751","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"in_reply_to":"9fb79cf5_e231c1f9","updated":"2023-04-27 11:43:35.000000000","message":"1. https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/octavia-certificates/tasks/client_cert.yml#L47\n2. https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/certificates/tasks/generate.yml#L135","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"862ff367a924b78dffcf6663566156de655cfef0","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"97740b1e_b91b4aa4","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"in_reply_to":"cfad785d_15ffde89","updated":"2023-04-27 14:25:51.000000000","message":"done","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"a379cff8df81150acac9e380a534fc9c47dd4e1c","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"53135dd9_7c828679","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"in_reply_to":"dbc5d9b1_34fd049a","updated":"2023-04-27 13:49:59.000000000","message":"it should work. the module documentation in ansible forgot the word \u0027single\u0027. Every *single* backslash must be escaped....\nofficial yaml documentation says nothing about double backslash everywhere: https://yaml.org/spec/1.2.2/#23-scalars","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"3b69dbfe9520288880f89bb2b693dbd46d887b77","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy\""},{"line_number":43,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":44,"context_line":"    mode: \"0660\""},{"line_number":45,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":46,"context_line":"    remote_src: true"},{"line_number":47,"context_line":"  become: true"},{"line_number":48,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"7620cc58_210231e4","line":45,"range":{"start_line":45,"start_character":34,"end_line":45,"end_character":35},"in_reply_to":"eddde8ab_99200751","updated":"2023-04-27 11:46:34.000000000","message":"https://paste.openstack.org/show/bKLtgkb3mvWgR2ZG9GAH/","commit_id":"15a9aaa0f2a61465186fac1cfea6d9b5d402b216"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"0875bd7d3d2e6589af83582e900be85bf030e73d","unresolved":true,"context_lines":[{"line_number":32,"context_line":"  when:"},{"line_number":33,"context_line":"    - kolla_copy_ca_into_containers | bool or designate_enable_tls_backend | bool"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"- name: Creating TLS backend PEM File"},{"line_number":36,"context_line":"  vars:"},{"line_number":37,"context_line":"    designate_tls_proxy: \"{{ designate_services[\u0027designate-tls-proxy\u0027] }}\""},{"line_number":38,"context_line":"  assemble:"},{"line_number":39,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy\""},{"line_number":40,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":41,"context_line":"    mode: \"0660\""},{"line_number":42,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":43,"context_line":"    remote_src: true"},{"line_number":44,"context_line":"  become: true"},{"line_number":45,"context_line":"  when:"},{"line_number":46,"context_line":"    - designate_tls_proxy.enabled | bool"},{"line_number":47,"context_line":"    - designate_tls_proxy.host_in_groups | bool"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"- name: Copying over config.json files for services"},{"line_number":50,"context_line":"  template:"}],"source_content_type":"text/x-yaml","patch_set":21,"id":"6499718b_4f6e712b","line":47,"range":{"start_line":35,"start_character":0,"end_line":47,"end_character":47},"updated":"2024-08-20 07:53:46.000000000","message":"any reason this can\u0027t use the generic role `service-cert-copy´ in kolla-ansible?","commit_id":"4e63db96ec568814e342e49d4048e0767bd41df7"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"cc2eb49764fd4b7a10f5230fe2098355db510ced","unresolved":false,"context_lines":[{"line_number":32,"context_line":"  when:"},{"line_number":33,"context_line":"    - kolla_copy_ca_into_containers | bool or designate_enable_tls_backend | bool"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"- name: Creating TLS backend PEM File"},{"line_number":36,"context_line":"  vars:"},{"line_number":37,"context_line":"    designate_tls_proxy: \"{{ designate_services[\u0027designate-tls-proxy\u0027] }}\""},{"line_number":38,"context_line":"  assemble:"},{"line_number":39,"context_line":"    src: \"{{ node_config_directory }}/designate-tls-proxy\""},{"line_number":40,"context_line":"    dest: \"{{ node_config_directory }}/designate-tls-proxy/designate-cert-and-key.pem\""},{"line_number":41,"context_line":"    mode: \"0660\""},{"line_number":42,"context_line":"    regexp: \"^designate-(cert|key)\\\\.pem$\""},{"line_number":43,"context_line":"    remote_src: true"},{"line_number":44,"context_line":"  become: true"},{"line_number":45,"context_line":"  when:"},{"line_number":46,"context_line":"    - designate_tls_proxy.enabled | bool"},{"line_number":47,"context_line":"    - designate_tls_proxy.host_in_groups | bool"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"- name: Copying over config.json files for services"},{"line_number":50,"context_line":"  template:"}],"source_content_type":"text/x-yaml","patch_set":21,"id":"969f9463_2a865424","line":47,"range":{"start_line":35,"start_character":0,"end_line":47,"end_character":47},"in_reply_to":"6499718b_4f6e712b","updated":"2024-08-20 08:46:19.000000000","message":"It does not create the file `\u003cservice\u003e-cert-and-key.pem` which is necessary for the TLS Proxy. \n\nSame pattern as `neutron-tls-proxy` and `glance-tls-proxy`","commit_id":"4e63db96ec568814e342e49d4048e0767bd41df7"},{"author":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"change_message_id":"48a7c11de2ae7a186f232ea9ad82e3006053946e","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":29,"id":"1e61739e_6a5094fb","line":168,"range":{"start_line":166,"start_character":2,"end_line":168,"end_character":1},"updated":"2025-04-02 14:45:54.000000000","message":"We don\u0027t need this `notify` statement here, as per: https://review.opendev.org/c/openstack/kolla-ansible/+/745164","commit_id":"cea2a9b10e1dc4804810c2e237fdbdf344216302"}],"ansible/roles/designate/templates/designate-tls-proxy.cfg.j2":[{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"6d09f37e5df1adf421d5664507348e39ca038cfd","unresolved":true,"context_lines":[{"line_number":13,"context_line":"        {% endfor %}"},{"line_number":14,"context_line":"    {% endif %}"},{"line_number":15,"context_line":"    ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES"},{"line_number":16,"context_line":"    ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11"},{"line_number":17,"context_line":"    tune.ssl.default-dh-param 4096"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"defaults"}],"source_content_type":"text/x-jinja2","patch_set":25,"id":"d38c7c0a_64bd33ae","line":16,"range":{"start_line":16,"start_character":0,"end_line":16,"end_character":2},"updated":"2024-08-26 12:36:18.000000000","message":"could you adapt this to my new patchset? https://review.opendev.org/c/openstack/kolla-ansible/+/915403\n\nin general I wonder if it\u0027s good that we have now different copies of haproxy config files scattered around the repository, which makes this harder to maintain securely.","commit_id":"7d35f61ad0b29d5b75831efd8498d22606614179"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"59a5e157583b0917eda267d46b2defe7ed2e2cce","unresolved":false,"context_lines":[{"line_number":13,"context_line":"        {% endfor %}"},{"line_number":14,"context_line":"    {% endif %}"},{"line_number":15,"context_line":"    ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES"},{"line_number":16,"context_line":"    ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11"},{"line_number":17,"context_line":"    tune.ssl.default-dh-param 4096"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"defaults"}],"source_content_type":"text/x-jinja2","patch_set":25,"id":"8a19beaf_3816150d","line":16,"range":{"start_line":16,"start_character":0,"end_line":16,"end_character":2},"in_reply_to":"aa7399e5_c9b08078","updated":"2024-09-04 06:42:48.000000000","message":"i fixed this now, great.","commit_id":"7d35f61ad0b29d5b75831efd8498d22606614179"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"b9ad6da6f9d23fd4cd644c9652f0f57ab65990f5","unresolved":true,"context_lines":[{"line_number":13,"context_line":"        {% endfor %}"},{"line_number":14,"context_line":"    {% endif %}"},{"line_number":15,"context_line":"    ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES"},{"line_number":16,"context_line":"    ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11"},{"line_number":17,"context_line":"    tune.ssl.default-dh-param 4096"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"defaults"}],"source_content_type":"text/x-jinja2","patch_set":25,"id":"aa7399e5_c9b08078","line":16,"range":{"start_line":16,"start_character":0,"end_line":16,"end_character":2},"in_reply_to":"d38c7c0a_64bd33ae","updated":"2024-08-26 13:41:42.000000000","message":"yes, that is certainly doable and a great idea.\n\nMay I suggest that the patchset mentioned above parameterizes these settings and inserts them into the templates of all HAProxy proxies?\n\nCurrently there are 3 HAProxy configurations:\n\nLoadbalancer\nGlance\nNeutron\n\nand soon (hopefully) Designate. \n\nThey should all use the same TLS settings, ofc.","commit_id":"7d35f61ad0b29d5b75831efd8498d22606614179"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"6d09f37e5df1adf421d5664507348e39ca038cfd","unresolved":true,"context_lines":[{"line_number":44,"context_line":"    default_backend designate_server"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"backend designate_server"},{"line_number":47,"context_line":"    server designate-server 127.0.0.1:{{ designate_api_listen_port }} check"}],"source_content_type":"text/x-jinja2","patch_set":25,"id":"f2c898d7_dc7b60bb","line":47,"range":{"start_line":47,"start_character":28,"end_line":47,"end_character":37},"updated":"2024-08-26 12:36:18.000000000","message":"not sure if it\u0027s good to hardcode this?","commit_id":"7d35f61ad0b29d5b75831efd8498d22606614179"},{"author":{"_account_id":25238,"name":"Magnus Lööf","email":"magnus.loof@basalt.se","username":"magnusloof"},"change_message_id":"b9ad6da6f9d23fd4cd644c9652f0f57ab65990f5","unresolved":false,"context_lines":[{"line_number":44,"context_line":"    default_backend designate_server"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"backend designate_server"},{"line_number":47,"context_line":"    server designate-server 127.0.0.1:{{ designate_api_listen_port }} check"}],"source_content_type":"text/x-jinja2","patch_set":25,"id":"3e450162_5b122516","line":47,"range":{"start_line":47,"start_character":28,"end_line":47,"end_character":37},"in_reply_to":"f2c898d7_dc7b60bb","updated":"2024-08-26 13:41:42.000000000","message":"I\u0027m pretty sure it\u0027s the only way. to ensure that TLS is required and prevent unencrypted communication, the API port is bound to localhost and localhost only. \n\nThen HAProxy is used to connect an externally reachable port (with TLS protection) with the service that is exposed to localhost. \n\nI fail to see any scenario where it would be beneficial to be able to modify this param...\n\nSame pattern as Glance and Neutrons TLS Proxies.","commit_id":"7d35f61ad0b29d5b75831efd8498d22606614179"}]}