)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"f814b23fcc708aec07cca2daaaa14ce469c15070","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"d2ee8379_f9e138c8","updated":"2023-04-25 10:36:17.000000000","message":"much better","commit_id":"95f64b7decddd8823c089d21c4231a75ca834bda"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"39d920426fa46b6db9582b142e0c9b0d17817054","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":3,"id":"b76428aa_19a22eb8","updated":"2023-04-26 11:59:28.000000000","message":"Would be nice to run it in octavia CI job - can you add this to test-octavia.sh?","commit_id":"3b8cef30a248bac6bdd1f37e06fb9cb26f7e7ab0"},{"author":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"change_message_id":"9fa6143f0644ff9fc890221f794d7cb8bbf153b5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"6170a58d_b6a8124a","in_reply_to":"b76428aa_19a22eb8","updated":"2023-05-03 09:53:42.000000000","message":"Done","commit_id":"3b8cef30a248bac6bdd1f37e06fb9cb26f7e7ab0"},{"author":{"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},"change_message_id":"24043d4cd10527d0418fcf360e975971957e57a0","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"ce989d74_5ea3fc74","updated":"2023-07-17 20:20:07.000000000","message":"LGTM","commit_id":"d9451f49f36f6851f2d10cc2abe31e3fdfd84ab6"},{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"a0373a64544fd9ed1e751887582a8ab4475d9809","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"5f2e822c_62457eee","updated":"2023-08-17 05:49:18.000000000","message":"LGTM, thanks","commit_id":"d9451f49f36f6851f2d10cc2abe31e3fdfd84ab6"},{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"fda633be8ca52ba6c0fc5da882047160ef61bf4c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"98a4827a_1220eb9f","updated":"2023-07-18 01:38:01.000000000","message":"if we run \u0027kolla-ansible octavia-certificates --check-expiry\u0027 at the first time, it should be failed, because the certificates have not generated. Is that correct ?","commit_id":"d9451f49f36f6851f2d10cc2abe31e3fdfd84ab6"},{"author":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"change_message_id":"7315051163400ddda6d4bfcee4558ca2dc56ea9e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"1c6f2f5d_dbc39227","in_reply_to":"98a4827a_1220eb9f","updated":"2023-07-18 08:01:36.000000000","message":"Yes, it will fail if ``kolla-ansible octavia-certificates`` has not been run without the extra flag first as that generates the certs.","commit_id":"d9451f49f36f6851f2d10cc2abe31e3fdfd84ab6"}],"ansible/roles/octavia-certificates/tasks/main.yml":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"b4ce9062a349094b14ebe4133fd20c32f1f91093","unresolved":true,"context_lines":[{"line_number":7,"context_line":"# Kolla Ansible prepares and controls the Client CA certificate and key."},{"line_number":8,"context_line":"# Client CA is used to generate certificates for Octavia controllers."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"- name: Check if any certificates are going to expire"},{"line_number":11,"context_line":"  command: \"openssl x509 -checkend {{ (octavia_certs_expiry_limit | int) * 864000 }} -noout -in {{ node_custom_config }}/octavia/{{ item }}\""},{"line_number":12,"context_line":"  delegate_to: localhost"},{"line_number":13,"context_line":"  with_items:"},{"line_number":14,"context_line":"    - \"server_ca.cert.pem\""},{"line_number":15,"context_line":"    - \"client_ca.cert.pem\""},{"line_number":16,"context_line":"    - \"client.cert-and-key.pem\""},{"line_number":17,"context_line":"  when: octavia_certs_check_expiry | bool"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"- block:"},{"line_number":20,"context_line":"    - name: Ensure server_ca and client_ca directories exist"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"39b207d7_e9841878","line":17,"range":{"start_line":10,"start_character":0,"end_line":17,"end_character":41},"updated":"2023-04-25 07:58:40.000000000","message":"wouldn\u0027t it be easier to have it in a separate playbook and use https://docs.ansible.com/ansible/latest/collections/community/crypto/x509_certificate_info_module.html ?","commit_id":"6baf532c2b8c4897c49bfece3b8b3db6baaa16f9"},{"author":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"change_message_id":"6b91a675b1ec31898aa8babe0fc9300490c3278d","unresolved":false,"context_lines":[{"line_number":7,"context_line":"# Kolla Ansible prepares and controls the Client CA certificate and key."},{"line_number":8,"context_line":"# Client CA is used to generate certificates for Octavia controllers."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"- name: Check if any certificates are going to expire"},{"line_number":11,"context_line":"  command: \"openssl x509 -checkend {{ (octavia_certs_expiry_limit | int) * 864000 }} -noout -in {{ node_custom_config }}/octavia/{{ item }}\""},{"line_number":12,"context_line":"  delegate_to: localhost"},{"line_number":13,"context_line":"  with_items:"},{"line_number":14,"context_line":"    - \"server_ca.cert.pem\""},{"line_number":15,"context_line":"    - \"client_ca.cert.pem\""},{"line_number":16,"context_line":"    - \"client.cert-and-key.pem\""},{"line_number":17,"context_line":"  when: octavia_certs_check_expiry | bool"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"- block:"},{"line_number":20,"context_line":"    - name: Ensure server_ca and client_ca directories exist"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"c9129bd2_e725dd0d","line":17,"range":{"start_line":10,"start_character":0,"end_line":17,"end_character":41},"in_reply_to":"39b207d7_e9841878","updated":"2023-04-25 08:39:13.000000000","message":"Sure that looks better, I\u0027ve updated to use it.","commit_id":"6baf532c2b8c4897c49bfece3b8b3db6baaa16f9"}],"tools/kolla-ansible":[{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"5b9e7692106372ab20eb182914c10d270843e50c","unresolved":true,"context_lines":[{"line_number":538,"context_line":"        ;;"},{"line_number":539,"context_line":"(octavia-certificates)"},{"line_number":540,"context_line":"        ACTION\u003d\"Generate octavia Certificates\""},{"line_number":541,"context_line":"        PLAYBOOK\u003d\"${BASEDIR}/ansible/octavia-certificates.yml\""},{"line_number":542,"context_line":"        if [[ ! -z \"${OCTAVIA_CERTS_EXPIRY}\" ]]; then"},{"line_number":543,"context_line":"            EXTRA_OPTS\u003d\"$EXTRA_OPTS -e octavia_certs_check_expiry\u003dyes -e octavia_certs_expiry_limit\u003d${OCTAVIA_CERTS_EXPIRY}\""},{"line_number":544,"context_line":"        fi"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"ec9f41d8_502c6a32","line":541,"range":{"start_line":541,"start_character":37,"end_line":541,"end_character":61},"updated":"2023-07-24 01:31:30.000000000","message":"what about we remove the octavia_certs_check_expiry logic to octavia-certificates.yaml? if true, we can import the octavia-certificates role, and set the tasks_from: check_expiry?","commit_id":"d9451f49f36f6851f2d10cc2abe31e3fdfd84ab6"},{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"294a9aa6dd18e7aadb5bb9619314a62abd5468ff","unresolved":true,"context_lines":[{"line_number":538,"context_line":"        ;;"},{"line_number":539,"context_line":"(octavia-certificates)"},{"line_number":540,"context_line":"        ACTION\u003d\"Generate octavia Certificates\""},{"line_number":541,"context_line":"        PLAYBOOK\u003d\"${BASEDIR}/ansible/octavia-certificates.yml\""},{"line_number":542,"context_line":"        if [[ ! -z \"${OCTAVIA_CERTS_EXPIRY}\" ]]; then"},{"line_number":543,"context_line":"            EXTRA_OPTS\u003d\"$EXTRA_OPTS -e octavia_certs_check_expiry\u003dyes -e octavia_certs_expiry_limit\u003d${OCTAVIA_CERTS_EXPIRY}\""},{"line_number":544,"context_line":"        fi"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"8680f1df_8902484f","line":541,"range":{"start_line":541,"start_character":37,"end_line":541,"end_character":61},"in_reply_to":"6ff50010_7e63f5c1","updated":"2023-07-27 03:25:32.000000000","message":"yes, Let\u0027s wait for more reviewer\u0027s opinion.","commit_id":"d9451f49f36f6851f2d10cc2abe31e3fdfd84ab6"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"f3bec7d06825f9d53fd68d31f4a78311f6f0445e","unresolved":true,"context_lines":[{"line_number":538,"context_line":"        ;;"},{"line_number":539,"context_line":"(octavia-certificates)"},{"line_number":540,"context_line":"        ACTION\u003d\"Generate octavia Certificates\""},{"line_number":541,"context_line":"        PLAYBOOK\u003d\"${BASEDIR}/ansible/octavia-certificates.yml\""},{"line_number":542,"context_line":"        if [[ ! -z \"${OCTAVIA_CERTS_EXPIRY}\" ]]; then"},{"line_number":543,"context_line":"            EXTRA_OPTS\u003d\"$EXTRA_OPTS -e octavia_certs_check_expiry\u003dyes -e octavia_certs_expiry_limit\u003d${OCTAVIA_CERTS_EXPIRY}\""},{"line_number":544,"context_line":"        fi"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"2caed2b5_23a25c5b","line":541,"range":{"start_line":541,"start_character":37,"end_line":541,"end_character":61},"in_reply_to":"8680f1df_8902484f","updated":"2023-07-31 10:21:14.000000000","message":"I think that should be fine, I doubt that needs to be ready for large scale ;-)","commit_id":"d9451f49f36f6851f2d10cc2abe31e3fdfd84ab6"},{"author":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"change_message_id":"d9a28259251c7de4f07fb5a3474f16907939bce1","unresolved":true,"context_lines":[{"line_number":538,"context_line":"        ;;"},{"line_number":539,"context_line":"(octavia-certificates)"},{"line_number":540,"context_line":"        ACTION\u003d\"Generate octavia Certificates\""},{"line_number":541,"context_line":"        PLAYBOOK\u003d\"${BASEDIR}/ansible/octavia-certificates.yml\""},{"line_number":542,"context_line":"        if [[ ! -z \"${OCTAVIA_CERTS_EXPIRY}\" ]]; then"},{"line_number":543,"context_line":"            EXTRA_OPTS\u003d\"$EXTRA_OPTS -e octavia_certs_check_expiry\u003dyes -e octavia_certs_expiry_limit\u003d${OCTAVIA_CERTS_EXPIRY}\""},{"line_number":544,"context_line":"        fi"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"6ff50010_7e63f5c1","line":541,"range":{"start_line":541,"start_character":37,"end_line":541,"end_character":61},"in_reply_to":"be2cf44e_4cf80dc8","updated":"2023-07-25 14:26:43.000000000","message":"Scalability is a good point, I\u0027d agree that the current way would be a bit of a pain to scale. However, I\u0027m not sure if we even need to plan for scaling here; would there be much more that Kolla Ansible might do with Octavia certificates?\n\nWould be interested to hear what other reviewers think (particularly those that have already +1\u0027d) before I put any time into changing implementation.","commit_id":"d9451f49f36f6851f2d10cc2abe31e3fdfd84ab6"},{"author":{"_account_id":26285,"name":"wu.chunyang","email":"wchy1001@gmail.com","username":"wu.chunyang"},"change_message_id":"b06591284367fa7f45d7aa7c003bc4ff3513bcee","unresolved":true,"context_lines":[{"line_number":538,"context_line":"        ;;"},{"line_number":539,"context_line":"(octavia-certificates)"},{"line_number":540,"context_line":"        ACTION\u003d\"Generate octavia Certificates\""},{"line_number":541,"context_line":"        PLAYBOOK\u003d\"${BASEDIR}/ansible/octavia-certificates.yml\""},{"line_number":542,"context_line":"        if [[ ! -z \"${OCTAVIA_CERTS_EXPIRY}\" ]]; then"},{"line_number":543,"context_line":"            EXTRA_OPTS\u003d\"$EXTRA_OPTS -e octavia_certs_check_expiry\u003dyes -e octavia_certs_expiry_limit\u003d${OCTAVIA_CERTS_EXPIRY}\""},{"line_number":544,"context_line":"        fi"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"be2cf44e_4cf80dc8","line":541,"range":{"start_line":541,"start_character":37,"end_line":541,"end_character":61},"in_reply_to":"c925b653_df67d7d6","updated":"2023-07-25 08:27:11.000000000","message":"In this way, we don\u0027t need to change the ansible/roles/octavia-certificates/tasks/main.yml file which was changed a lot in this commit. moreover, this approach seems to be less conducive to scalability. what do you think about this?\n\nany way, both solution should be work properly, just my own opinion.","commit_id":"d9451f49f36f6851f2d10cc2abe31e3fdfd84ab6"},{"author":{"_account_id":35263,"name":"Matt Crees","email":"mattc@stackhpc.com","username":"mattcrees"},"change_message_id":"865da60905aee281056884bba4a8d0098423f984","unresolved":true,"context_lines":[{"line_number":538,"context_line":"        ;;"},{"line_number":539,"context_line":"(octavia-certificates)"},{"line_number":540,"context_line":"        ACTION\u003d\"Generate octavia Certificates\""},{"line_number":541,"context_line":"        PLAYBOOK\u003d\"${BASEDIR}/ansible/octavia-certificates.yml\""},{"line_number":542,"context_line":"        if [[ ! -z \"${OCTAVIA_CERTS_EXPIRY}\" ]]; then"},{"line_number":543,"context_line":"            EXTRA_OPTS\u003d\"$EXTRA_OPTS -e octavia_certs_check_expiry\u003dyes -e octavia_certs_expiry_limit\u003d${OCTAVIA_CERTS_EXPIRY}\""},{"line_number":544,"context_line":"        fi"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"c925b653_df67d7d6","line":541,"range":{"start_line":541,"start_character":37,"end_line":541,"end_character":61},"in_reply_to":"ec9f41d8_502c6a32","updated":"2023-07-25 08:13:27.000000000","message":"Sounds like that would work, but why do you want to make this change?","commit_id":"d9451f49f36f6851f2d10cc2abe31e3fdfd84ab6"}]}