)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"a88fc45649ed39f778edd34a3b18eb172c86f362","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"401c4c92_8cf6374e","updated":"2024-06-14 08:38:59.000000000","message":"That does not close the bug - what about service endpoints?\nI\u0027m also a bit worried, that we\u0027re not enforcing that we support just one ipv4 and one ipv6 address - so it\u0027s a place where people might misunderstand the variable name.\nIt\u0027s also missing some addition to the docs.","commit_id":"3a264dd653d1d4fb6cdd26a1afbdbd3aa122c00e"},{"author":{"_account_id":36319,"name":"Freerk-Ole Zakfeld","display_name":"Freerk-Ole Zakfeld","email":"freerk@zakfeld.com","username":"freerkzakfeld","status":"I work as a cloud engineer at ScaleUp Technologies"},"change_message_id":"f51ce80b3fdb769423bf83baa023170e29d3ebfb","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"4e447756_e4232be6","in_reply_to":"401c4c92_8cf6374e","updated":"2024-06-14 09:52:22.000000000","message":"I specifically made those variables to allow for any amount of bind addresses. My use-case described in the bug is to listen on IPv4/IPv6.\n\nkolla_external_vip_address doesn\u0027t specify an address family, so to me it doesn\u0027t make sense to add something like a `kolla_external_vip6_address` or similar.\n\nMaybe we can have a variable `kolla_external_vip_addresses` which defaults to `[kolla_external_vip_address]`? This would need to be updated in a lot of places though.\n\n\nRegarding service endpoints, I think they are covered by haproxy_single_service_split.cfg.j2 - at least I don\u0027t see anywhere in my config that listens otherwise (other than the single-external frontend)","commit_id":"3a264dd653d1d4fb6cdd26a1afbdbd3aa122c00e"},{"author":{"_account_id":36319,"name":"Freerk-Ole Zakfeld","display_name":"Freerk-Ole Zakfeld","email":"freerk@zakfeld.com","username":"freerkzakfeld","status":"I work as a cloud engineer at ScaleUp Technologies"},"change_message_id":"5ef6f93f87abb3c970feca49c90521c77ae21521","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"8edddc43_23fabfe6","in_reply_to":"4e447756_e4232be6","updated":"2024-06-14 10:02:46.000000000","message":"Another thought: we could introduce a kolla_external_vip4_address and kolla_external_vip6_address. \n\nBoth defaulting to \"{{ kolla_external_vip_address if kolla_external_vip_address is ansible.utils.ipv4/6 else None }}\"\n\nAnd template them only if set.\n\nThis way we have a clear seperation, but this would also mean a lot of changes within the code. I only really need to tacke the external bind addresses of HAProxy","commit_id":"3a264dd653d1d4fb6cdd26a1afbdbd3aa122c00e"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"bf3bf75d3064f520429c62b7973fd4f4e48fe3fa","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"1d58f272_e4a6fa86","in_reply_to":"4e447756_e4232be6","updated":"2024-06-14 09:55:09.000000000","message":"I meant keystone catalog endpoints, and no - they are covered by an invocation of ks-service-register role in each of the project roles (e.g. cinder) - and I never used multiple public endpoints for the same service - have no clue how that will behave.","commit_id":"3a264dd653d1d4fb6cdd26a1afbdbd3aa122c00e"},{"author":{"_account_id":36319,"name":"Freerk-Ole Zakfeld","display_name":"Freerk-Ole Zakfeld","email":"freerk@zakfeld.com","username":"freerkzakfeld","status":"I work as a cloud engineer at ScaleUp Technologies"},"change_message_id":"65e39babe481830ca902986ed63aa2e5e56e8c49","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"d02f2b41_d6c3cc1c","in_reply_to":"8edddc43_23fabfe6","updated":"2025-10-19 15:44:35.000000000","message":"@mnasiadka@gmail.com as this came up today, can we revisit this change? The HAProxy listening on multiple addresses AFAIK has nothing to do with the keystone endpoints, they will still point to probably a domain name. Having multiple addresses listening won\u0027t break anything, unless the DNS does not point to them (which is up to the operator and not managed by kolla-ansible).\n\nI can improve some docs for this, if the implementation is fine for you","commit_id":"3a264dd653d1d4fb6cdd26a1afbdbd3aa122c00e"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"f9bc7f1eaed49af36146397164fc39c113fee6a2","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"e4098b57_5ed8f9ae","in_reply_to":"d02f2b41_d6c3cc1c","updated":"2026-02-17 09:04:27.000000000","message":"Please rebase and fix merge conflicts","commit_id":"3a264dd653d1d4fb6cdd26a1afbdbd3aa122c00e"},{"author":{"_account_id":37313,"name":"Alma MAILLET-CONTOZ","display_name":"Alma MAILLET-CONTOZ","email":"alma.maillet-contoz@infomaniak.com","username":"nicolasmc","status":"Intern SRE at Infomaniak"},"change_message_id":"defa9a443d68186df74aef26e96db18a8dcf79b5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"2f620bed_e4cd2a4f","in_reply_to":"e4098b57_5ed8f9ae","updated":"2026-04-24 10:10:12.000000000","message":"Done","commit_id":"3a264dd653d1d4fb6cdd26a1afbdbd3aa122c00e"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"0ff65e9d01a2897883f5912f12c4fab488217c89","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":6,"id":"4f79ad1e_85f831fc","updated":"2026-04-24 10:28:54.000000000","message":"TLS configuration is shared across all bind addresses, which may lead to incorrect certificates being served when different IPs are associated with different domains.","commit_id":"f299e179e3ebd7a7eac337cf91e620f08a541725"},{"author":{"_account_id":36319,"name":"Freerk-Ole Zakfeld","display_name":"Freerk-Ole Zakfeld","email":"freerk@zakfeld.com","username":"freerkzakfeld","status":"I work as a cloud engineer at ScaleUp Technologies"},"change_message_id":"c28ab9baf330034093743151d0be938fdcbd0f4e","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":6,"id":"ba734e8a_cc30b64b","in_reply_to":"4f79ad1e_85f831fc","updated":"2026-04-24 10:51:37.000000000","message":"I don\u0027t see a problem here. TLS certs are almost certainly always issued to domain names, not IP addresses, and creating the DNS entries is a task for the cloud operator, not kolla-ansible.","commit_id":"f299e179e3ebd7a7eac337cf91e620f08a541725"}]}