)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"1f3292c914754e2fda0f96a1384eb8928bf654a0","unresolved":true,"context_lines":[{"line_number":9,"context_line":"This commit adds a task for generating certificates for"},{"line_number":10,"context_line":"RabbitMQ internode TLS."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Currently, certificates  does not provide a way to"},{"line_number":13,"context_line":"generate certificates for rabbitmq that has hostnames of the nodes as"},{"line_number":14,"context_line":"SANs. Such a certificate is required for RabbitMQ internode TLS,"},{"line_number":15,"context_line":"because internally, RabbitMQ works with hostnames rather than IPs, thats"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"f49ee26b_e35898dc","line":12,"range":{"start_line":12,"start_character":0,"end_line":12,"end_character":2},"updated":"2024-06-07 10:28:48.000000000","message":"wording: \"Currently the kolla-ansible certificates role does not provide..\"","commit_id":"013204b03f3bbdc87b01a085de931a270c376a54"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"0ebe140ac317c2f7305621057d6cba866fb225e0","unresolved":false,"context_lines":[{"line_number":9,"context_line":"This commit adds a task for generating certificates for"},{"line_number":10,"context_line":"RabbitMQ internode TLS."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Currently, certificates  does not provide a way to"},{"line_number":13,"context_line":"generate certificates for rabbitmq that has hostnames of the nodes as"},{"line_number":14,"context_line":"SANs. Such a certificate is required for RabbitMQ internode TLS,"},{"line_number":15,"context_line":"because internally, RabbitMQ works with hostnames rather than IPs, thats"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"b980b7ef_4db429c4","line":12,"range":{"start_line":12,"start_character":0,"end_line":12,"end_character":2},"in_reply_to":"f49ee26b_e35898dc","updated":"2024-06-07 13:14:47.000000000","message":"Done","commit_id":"013204b03f3bbdc87b01a085de931a270c376a54"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"1f3292c914754e2fda0f96a1384eb8928bf654a0","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"f620dbb3_7f154119","updated":"2024-06-07 10:28:48.000000000","message":"This needs docs, at the very least a manual detailed instruction on how to do certificate renewal if the old ones are expiring, that procedure should be tested to work as well.\n\nBut honestly I would prefer a playbook for this to automate the certificate renewal, especially since it\u0027s self signed.\n\nPeople inevitably will not read the manual and end up with broken rabbitmq clusters down the line.\n\nThanks.","commit_id":"013204b03f3bbdc87b01a085de931a270c376a54"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"9b0494b2708fcd1257cf22138a7585e06ec25ede","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"8ac731f6_8d96ad6f","in_reply_to":"74a1d790_5dd8a585","updated":"2024-06-19 14:12:46.000000000","message":"I just updated the docs in this patch with certificate renewal steps.\nWe may want to make a playbook, because we need to restart all rabbitmq nodes one by one after updating certificates.","commit_id":"013204b03f3bbdc87b01a085de931a270c376a54"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"2f913ee3696fef762d42dd10ed3389ff2768007b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"c76ebe59_0fd7a2b4","in_reply_to":"8ac731f6_8d96ad6f","updated":"2024-07-17 12:57:35.000000000","message":"as I said in my other comment I will try to update the docs later myself in more detail. If someone is faster, I\u0027ll not complain though.","commit_id":"013204b03f3bbdc87b01a085de931a270c376a54"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"0ebe140ac317c2f7305621057d6cba866fb225e0","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"74a1d790_5dd8a585","in_reply_to":"f620dbb3_7f154119","updated":"2024-06-07 13:14:47.000000000","message":"A playbook for certificate renewal would be a great idea. Is there something like that for other certificates? If not, there should be one for all of them (internal, external, backend, libvirt)","commit_id":"013204b03f3bbdc87b01a085de931a270c376a54"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"b46dfed898066c391a98fb8891b6a48bdab1f104","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"1701bb2a_90d7e040","updated":"2024-06-19 16:40:37.000000000","message":"I unfortunately don\u0027t think the docs are sufficient.\nThey should include the complete steps necessary to renew certs.\nI guess some commands can be copied from the playbook.","commit_id":"955ec9b34e42c2c999a2221059df6ae2e0c92af0"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"7b30f5f62509f6dd82d31d50f374240dffa05c0e","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":6,"id":"101c2e87_e1718489","updated":"2024-06-21 09:44:50.000000000","message":"I\u0027m still debating with myself if the cert rene","commit_id":"376677df5cd5496534eea66b3051d9e5ba96e7e6"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"ac597928aef76d11a459864060c13ec254959a5d","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"fdbac9dc_3e184c4c","updated":"2024-07-17 14:20:48.000000000","message":"LGTM! As already said, we still must look into cert renewal, but I think it can go in a separate change.","commit_id":"376677df5cd5496534eea66b3051d9e5ba96e7e6"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"3a1d1f93ad7d9b1d15c9c2b1201c7022d25bc934","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":6,"id":"77128a03_d030c245","in_reply_to":"101c2e87_e1718489","updated":"2024-06-21 11:46:41.000000000","message":"Sorry, the above comment got cut off, somehow.\n\nWhat I meant to say is that I still look into if we could generate more secure certs (rsa 2048 is a decent baseline but not futureproof) and if we shouldn\u0027t automate it directly, as it\u0027s a rather arcane procedure where operators can introduce many failures.","commit_id":"376677df5cd5496534eea66b3051d9e5ba96e7e6"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"67bdb7657cd7ddcd612bb8c0874e85ced874bf17","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":6,"id":"81bc9528_c61dec82","in_reply_to":"10d38c6d_d72df84e","updated":"2024-07-09 11:16:04.000000000","message":"But I think this role should be in a different patch.","commit_id":"376677df5cd5496534eea66b3051d9e5ba96e7e6"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"762334c5dd59256fb6e25963f618869312f89114","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":6,"id":"10d38c6d_d72df84e","in_reply_to":"77128a03_d030c245","updated":"2024-07-08 13:03:44.000000000","message":"I decided to create a role for certificate renewal. I guess we can just automate the steps I made in the documentation. I may add it to a different patch","commit_id":"376677df5cd5496534eea66b3051d9e5ba96e7e6"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"2f913ee3696fef762d42dd10ed3389ff2768007b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"60fa356d_30de7e8d","in_reply_to":"81bc9528_c61dec82","updated":"2024-07-17 12:57:35.000000000","message":"agreed, let\u0027s move on for now.\n\nAs said in downstreams sovereign cloudstack IaaS Call, I will either provide docs on how to rotate these, or maybe even supply a playbook to do this semi-automatically.\n\nIf someone beats me and has something like this already in their private docs, I would be happy to accept contributions from other people of course, as it might take some time until I get to writing these docs.\n\nThanks","commit_id":"376677df5cd5496534eea66b3051d9e5ba96e7e6"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"cd02793fbdbc1cb24aa469eb9bfa303c24f02e51","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":18,"id":"19e7e627_e8cf6636","updated":"2024-09-06 13:46:18.000000000","message":"afaik we need to rebase this on top of 863d6d35 to remove the corresponding CI errors about msteams in https://review.opendev.org/c/openstack/kolla-ansible/+/921381\n\nthe rebase has conflicts though, and I didn\u0027t want to interfere with your development workflow. Could you rebase this, please?","commit_id":"2c0785014ac1ce8f3f0803df3c3bc121f05d237c"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"bc83f79e27bbf2a0ec5e7d1157c54f6fad019f5e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":18,"id":"5c67f305_27bbd443","in_reply_to":"19e7e627_e8cf6636","updated":"2024-09-09 08:35:22.000000000","message":"Done","commit_id":"2c0785014ac1ce8f3f0803df3c3bc121f05d237c"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"7808baa82e7e3f0b09f353fb89f2006be1078227","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":23,"id":"5f6ba058_1b816341","updated":"2024-09-11 14:00:29.000000000","message":"recheck unable to access \u0027https://opendev.org/openstack/ansible-collection-kolla/\u0027: Failed to connect to opendev.org port 443 after 131090 ms: Connection timed out","commit_id":"0bc41c096f96712ee3e9b1a56c16ca1b1710967d"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"a147de58ef0769eeecbfa22d485ccb3d5c65481b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":23,"id":"0c8f75f3_016da457","in_reply_to":"5f6ba058_1b816341","updated":"2024-09-12 07:15:11.000000000","message":"Done","commit_id":"0bc41c096f96712ee3e9b1a56c16ca1b1710967d"}],"ansible/roles/certificates/tasks/generate-rabbitmq.yml":[{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"1f3292c914754e2fda0f96a1384eb8928bf654a0","unresolved":true,"context_lines":[{"line_number":42,"context_line":"    -extensions v3_req"},{"line_number":43,"context_line":"    -extfile \"{{ kolla_certificates_dir }}/openssl-kolla-rabbitmq.cnf\""},{"line_number":44,"context_line":"    -out \"{{ rabbitmq_dir }}/rabbitmq-internode.crt\""},{"line_number":45,"context_line":"    -days 500"},{"line_number":46,"context_line":"    -sha256"},{"line_number":47,"context_line":"  args:"},{"line_number":48,"context_line":"    creates: \"{{ rabbitmq_dir }}/rabbitmq-internode.crt\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"178bef89_5bdfc450","line":45,"range":{"start_line":45,"start_character":0,"end_line":45,"end_character":2},"updated":"2024-06-07 10:28:48.000000000","message":"this seems rather arbitrary, something closer to a year or so would be more appropriate imho, or even shorter time frames, taking inspiration from Let\u0027s Encrypt/the ACME protocol.\n\nwe also need to at least document this in bold letters, or even better, provide some playbook to rotate this, as the use will face rabbitmq failure when the certificate is about to expire in X days.","commit_id":"013204b03f3bbdc87b01a085de931a270c376a54"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"4a966c5d6c79659432d89f6b4e343f78040950a4","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    -extensions v3_req"},{"line_number":43,"context_line":"    -extfile \"{{ kolla_certificates_dir }}/openssl-kolla-rabbitmq.cnf\""},{"line_number":44,"context_line":"    -out \"{{ rabbitmq_dir }}/rabbitmq-internode.crt\""},{"line_number":45,"context_line":"    -days 500"},{"line_number":46,"context_line":"    -sha256"},{"line_number":47,"context_line":"  args:"},{"line_number":48,"context_line":"    creates: \"{{ rabbitmq_dir }}/rabbitmq-internode.crt\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"8a0fbbed_99b31148","line":45,"range":{"start_line":45,"start_character":0,"end_line":45,"end_character":2},"in_reply_to":"178bef89_5bdfc450","updated":"2024-06-20 08:28:03.000000000","message":"Done","commit_id":"013204b03f3bbdc87b01a085de931a270c376a54"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"c99f38acf670ea6cbb47b4e897d62b9f806b08bf","unresolved":true,"context_lines":[{"line_number":42,"context_line":"    -extensions v3_req"},{"line_number":43,"context_line":"    -extfile \"{{ kolla_certificates_dir }}/openssl-kolla-rabbitmq.cnf\""},{"line_number":44,"context_line":"    -out \"{{ rabbitmq_dir }}/rabbitmq-internode.crt\""},{"line_number":45,"context_line":"    -days 500"},{"line_number":46,"context_line":"    -sha256"},{"line_number":47,"context_line":"  args:"},{"line_number":48,"context_line":"    creates: \"{{ rabbitmq_dir }}/rabbitmq-internode.crt\""}],"source_content_type":"text/x-yaml","patch_set":12,"id":"ac9b1a2c_889772e2","line":45,"range":{"start_line":45,"start_character":10,"end_line":45,"end_character":13},"updated":"2024-09-04 10:01:01.000000000","message":"I would rather keep this shorter, other opinions?\nPeople are already bad at rotating certificates, they need to get trained to not forget to do it. imho this is achieved by making them rotate certs faster.\n\nanother idea: make this configurable, via a variable which maybe defaults to roughly one year?","commit_id":"156bbfd3ffd293b479a27ca2ac74299b12773813"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"91efc10beaac2249b9fd260af10c852a5dc07df6","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    -extensions v3_req"},{"line_number":43,"context_line":"    -extfile \"{{ kolla_certificates_dir }}/openssl-kolla-rabbitmq.cnf\""},{"line_number":44,"context_line":"    -out \"{{ rabbitmq_dir }}/rabbitmq-internode.crt\""},{"line_number":45,"context_line":"    -days 500"},{"line_number":46,"context_line":"    -sha256"},{"line_number":47,"context_line":"  args:"},{"line_number":48,"context_line":"    creates: \"{{ rabbitmq_dir }}/rabbitmq-internode.crt\""}],"source_content_type":"text/x-yaml","patch_set":12,"id":"43c749f7_94c87755","line":45,"range":{"start_line":45,"start_character":10,"end_line":45,"end_character":13},"in_reply_to":"ac612b9e_3ed649ae","updated":"2024-09-06 13:47:18.000000000","message":"Done","commit_id":"156bbfd3ffd293b479a27ca2ac74299b12773813"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"6ff6d3a6fbf6a26b0152ec5abc6b1db8f0b79b24","unresolved":true,"context_lines":[{"line_number":42,"context_line":"    -extensions v3_req"},{"line_number":43,"context_line":"    -extfile \"{{ kolla_certificates_dir }}/openssl-kolla-rabbitmq.cnf\""},{"line_number":44,"context_line":"    -out \"{{ rabbitmq_dir }}/rabbitmq-internode.crt\""},{"line_number":45,"context_line":"    -days 500"},{"line_number":46,"context_line":"    -sha256"},{"line_number":47,"context_line":"  args:"},{"line_number":48,"context_line":"    creates: \"{{ rabbitmq_dir }}/rabbitmq-internode.crt\""}],"source_content_type":"text/x-yaml","patch_set":12,"id":"ac612b9e_3ed649ae","line":45,"range":{"start_line":45,"start_character":10,"end_line":45,"end_character":13},"in_reply_to":"ac9b1a2c_889772e2","updated":"2024-09-05 08:18:44.000000000","message":"i made it configurable with the default `365` days","commit_id":"156bbfd3ffd293b479a27ca2ac74299b12773813"}],"ansible/roles/certificates/templates/openssl-kolla-rabbitmq.cnf.j2":[{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"26172e0bdae52ee1d4c09ea51490fafbd31a99c9","unresolved":true,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"[alt_names]"},{"line_number":16,"context_line":"{% for host in groups[\u0027control\u0027] %}"},{"line_number":17,"context_line":"DNS.{{ loop.index }} \u003d {{ hostvars[host].migration_hostname | default(hostvars[host].ansible_facts.nodename) }}"},{"line_number":18,"context_line":"{% endfor %}"}],"source_content_type":"text/x-jinja2","patch_set":13,"id":"3ec13efd_e06ce73c","line":17,"updated":"2024-09-05 08:28:33.000000000","message":"looks like this is failing in the upgrade job\n\njinja2.exceptions.UndefinedError: \u0027dict object\u0027 has no attribute \u0027nodename\u0027\n\nhttps://storage.bhs.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_cee/921380/12/check/kolla-ansible-ubuntu-upgrade-cephadm/cee8214/primary/logs/ansible/certificates","commit_id":"a6564cd83cb896c1a2a773c3711c894961c17904"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"391df4b8298bedb4673783a7d384e54dbafb70ed","unresolved":true,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"[alt_names]"},{"line_number":16,"context_line":"{% for host in groups[\u0027control\u0027] %}"},{"line_number":17,"context_line":"DNS.{{ loop.index }} \u003d {{ hostvars[host].migration_hostname | default(hostvars[host].ansible_facts.nodename) }}"},{"line_number":18,"context_line":"{% endfor %}"}],"source_content_type":"text/x-jinja2","patch_set":13,"id":"7ee1229f_58d0269b","line":17,"in_reply_to":"3ec13efd_e06ce73c","updated":"2024-09-05 13:40:17.000000000","message":"Looks like `ansible_facts` are not gathered properly. I can\u0027t reproduce this on my setup. It\u0027s weird that this specifically happen in `upgrade-cephadm` pipelines.\nEven in the logs [facts.json](https://afc5a8633c363afe224f-83635154d4e9ad424ed62c3282739e98.ssl.cf2.rackcdn.com/921381/22/check/kolla-ansible-rocky9-upgrade/7eb7a99/primary/logs/facts.json) there\u0027s ansible_facts.nodename","commit_id":"a6564cd83cb896c1a2a773c3711c894961c17904"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"f4a5e175e0efb39bdec25cc6519e4b61592a2603","unresolved":true,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"[alt_names]"},{"line_number":16,"context_line":"{% for host in groups[\u0027control\u0027] %}"},{"line_number":17,"context_line":"DNS.{{ loop.index }} \u003d {{ hostvars[host].migration_hostname | default(hostvars[host].ansible_facts.nodename) }}"},{"line_number":18,"context_line":"{% endfor %}"}],"source_content_type":"text/x-jinja2","patch_set":13,"id":"9398282b_8793d42b","line":17,"in_reply_to":"7ee1229f_58d0269b","updated":"2024-09-10 06:49:34.000000000","message":"The pipelines are no longer failing, I just need to remove the `debug`","commit_id":"a6564cd83cb896c1a2a773c3711c894961c17904"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"c718d07a6f891fefdab62c9c627f3e350a823f79","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"[alt_names]"},{"line_number":16,"context_line":"{% for host in groups[\u0027control\u0027] %}"},{"line_number":17,"context_line":"DNS.{{ loop.index }} \u003d {{ hostvars[host].migration_hostname | default(hostvars[host].ansible_facts.nodename) }}"},{"line_number":18,"context_line":"{% endfor %}"}],"source_content_type":"text/x-jinja2","patch_set":13,"id":"ab9a9bbd_53a49470","line":17,"in_reply_to":"9398282b_8793d42b","updated":"2024-09-10 09:28:53.000000000","message":"Done","commit_id":"a6564cd83cb896c1a2a773c3711c894961c17904"}],"doc/source/admin/tls.rst":[{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"b46dfed898066c391a98fb8891b6a48bdab1f104","unresolved":true,"context_lines":[{"line_number":370,"context_line":"The following commands need to be run on every node."},{"line_number":371,"context_line":".. code-block:: console"},{"line_number":372,"context_line":""},{"line_number":373,"context_line":"  sudo cp new-rabbitmq-certificate.pem /etc/kolla/rabbitmq/rabbitmq-internode-cert.pem"},{"line_number":374,"context_line":"  sudo cp new-rabbitmq-key.pem /etc/kolla/rabbitmq/rabbitmq-internode-cert.pem"},{"line_number":375,"context_line":"  sudo cp new-rabbitmq-certificate.pem /etc/kolla/kolla-toolbox/rabbitmq-internode-cert.pem"},{"line_number":376,"context_line":"  sudo cp new-rabbitmq-key.pem /etc/kolla/kolla-toolbox/rabbitmq-internode-key.pem"},{"line_number":377,"context_line":"  sudo docker restart rabbitmq"},{"line_number":378,"context_line":"  sudo docker restart kolla_toolbox"}],"source_content_type":"text/x-rst","patch_set":4,"id":"a940816f_f52dad2f","line":376,"range":{"start_line":373,"start_character":0,"end_line":376,"end_character":82},"updated":"2024-06-19 16:40:37.000000000","message":"where do the new certificates come from?","commit_id":"955ec9b34e42c2c999a2221059df6ae2e0c92af0"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"2f913ee3696fef762d42dd10ed3389ff2768007b","unresolved":false,"context_lines":[{"line_number":370,"context_line":"The following commands need to be run on every node."},{"line_number":371,"context_line":".. code-block:: console"},{"line_number":372,"context_line":""},{"line_number":373,"context_line":"  sudo cp new-rabbitmq-certificate.pem /etc/kolla/rabbitmq/rabbitmq-internode-cert.pem"},{"line_number":374,"context_line":"  sudo cp new-rabbitmq-key.pem /etc/kolla/rabbitmq/rabbitmq-internode-cert.pem"},{"line_number":375,"context_line":"  sudo cp new-rabbitmq-certificate.pem /etc/kolla/kolla-toolbox/rabbitmq-internode-cert.pem"},{"line_number":376,"context_line":"  sudo cp new-rabbitmq-key.pem /etc/kolla/kolla-toolbox/rabbitmq-internode-key.pem"},{"line_number":377,"context_line":"  sudo docker restart rabbitmq"},{"line_number":378,"context_line":"  sudo docker restart kolla_toolbox"}],"source_content_type":"text/x-rst","patch_set":4,"id":"82085d27_4322cc80","line":376,"range":{"start_line":373,"start_character":0,"end_line":376,"end_character":82},"in_reply_to":"618980a7_03e876f1","updated":"2024-07-17 12:57:35.000000000","message":"Done","commit_id":"955ec9b34e42c2c999a2221059df6ae2e0c92af0"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"7b30f5f62509f6dd82d31d50f374240dffa05c0e","unresolved":true,"context_lines":[{"line_number":370,"context_line":"The following commands need to be run on every node."},{"line_number":371,"context_line":".. code-block:: console"},{"line_number":372,"context_line":""},{"line_number":373,"context_line":"  sudo cp new-rabbitmq-certificate.pem /etc/kolla/rabbitmq/rabbitmq-internode-cert.pem"},{"line_number":374,"context_line":"  sudo cp new-rabbitmq-key.pem /etc/kolla/rabbitmq/rabbitmq-internode-cert.pem"},{"line_number":375,"context_line":"  sudo cp new-rabbitmq-certificate.pem /etc/kolla/kolla-toolbox/rabbitmq-internode-cert.pem"},{"line_number":376,"context_line":"  sudo cp new-rabbitmq-key.pem /etc/kolla/kolla-toolbox/rabbitmq-internode-key.pem"},{"line_number":377,"context_line":"  sudo docker restart rabbitmq"},{"line_number":378,"context_line":"  sudo docker restart kolla_toolbox"}],"source_content_type":"text/x-rst","patch_set":4,"id":"618980a7_03e876f1","line":376,"range":{"start_line":373,"start_character":0,"end_line":376,"end_character":82},"in_reply_to":"865108cf_af6246a7","updated":"2024-06-21 09:44:50.000000000","message":"I\u0027m still debating with myself if these are sufficient docs, as this is quite some critical component.\nI would also like to get more opinions of other reviewers here.\n\nThank you for the docs added so far!","commit_id":"955ec9b34e42c2c999a2221059df6ae2e0c92af0"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"044278f00db77c89c417c2aede6da3a2383de0d8","unresolved":true,"context_lines":[{"line_number":370,"context_line":"The following commands need to be run on every node."},{"line_number":371,"context_line":".. code-block:: console"},{"line_number":372,"context_line":""},{"line_number":373,"context_line":"  sudo cp new-rabbitmq-certificate.pem /etc/kolla/rabbitmq/rabbitmq-internode-cert.pem"},{"line_number":374,"context_line":"  sudo cp new-rabbitmq-key.pem /etc/kolla/rabbitmq/rabbitmq-internode-cert.pem"},{"line_number":375,"context_line":"  sudo cp new-rabbitmq-certificate.pem /etc/kolla/kolla-toolbox/rabbitmq-internode-cert.pem"},{"line_number":376,"context_line":"  sudo cp new-rabbitmq-key.pem /etc/kolla/kolla-toolbox/rabbitmq-internode-key.pem"},{"line_number":377,"context_line":"  sudo docker restart rabbitmq"},{"line_number":378,"context_line":"  sudo docker restart kolla_toolbox"}],"source_content_type":"text/x-rst","patch_set":4,"id":"865108cf_af6246a7","line":376,"range":{"start_line":373,"start_character":0,"end_line":376,"end_character":82},"in_reply_to":"a8cd39ca_24109546","updated":"2024-06-20 11:20:33.000000000","message":"I updated the docs so it\u0027s more in detail.","commit_id":"955ec9b34e42c2c999a2221059df6ae2e0c92af0"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"2c8a91150a97d1bb360e41fdc0189964ecf2fd19","unresolved":true,"context_lines":[{"line_number":370,"context_line":"The following commands need to be run on every node."},{"line_number":371,"context_line":".. code-block:: console"},{"line_number":372,"context_line":""},{"line_number":373,"context_line":"  sudo cp new-rabbitmq-certificate.pem /etc/kolla/rabbitmq/rabbitmq-internode-cert.pem"},{"line_number":374,"context_line":"  sudo cp new-rabbitmq-key.pem /etc/kolla/rabbitmq/rabbitmq-internode-cert.pem"},{"line_number":375,"context_line":"  sudo cp new-rabbitmq-certificate.pem /etc/kolla/kolla-toolbox/rabbitmq-internode-cert.pem"},{"line_number":376,"context_line":"  sudo cp new-rabbitmq-key.pem /etc/kolla/kolla-toolbox/rabbitmq-internode-key.pem"},{"line_number":377,"context_line":"  sudo docker restart rabbitmq"},{"line_number":378,"context_line":"  sudo docker restart kolla_toolbox"}],"source_content_type":"text/x-rst","patch_set":4,"id":"a8cd39ca_24109546","line":376,"range":{"start_line":373,"start_character":0,"end_line":376,"end_character":82},"in_reply_to":"a940816f_f52dad2f","updated":"2024-06-20 07:39:38.000000000","message":"In my case I just deleted the old certs from `/etc/kolla/certificates/` and then I ran `kolla-ansible certificates`. But user may define their own, in fact, `kolla-ansible certificates` playbook isn\u0027t for production use according to the [docs](https://docs.openstack.org/kolla-ansible/latest/admin/tls.html#generating-a-private-certificate-authority). We may add a playbook for certificate renewal something like `kolla-ansible renew-certs`, but I think we should include it in a different patch, since it\u0027s not just RabbitMQ. \n\nThis guide is mainly about correctly restarting RabbitMQ so you don\u0027t break the the cluster when you rotate certificates.","commit_id":"955ec9b34e42c2c999a2221059df6ae2e0c92af0"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"7b30f5f62509f6dd82d31d50f374240dffa05c0e","unresolved":true,"context_lines":[{"line_number":369,"context_line":"RabbitMQ nodes need to be manually restarted after their"},{"line_number":370,"context_line":"certificates are updated. The following actions need to be performed:"},{"line_number":371,"context_line":""},{"line_number":372,"context_line":"1. Obtain new certificates. You can delete the old certificates from"},{"line_number":373,"context_line":"deploy node rerun `kolla-ansible certificates` role, or you can"},{"line_number":374,"context_line":"generate certificates manually."},{"line_number":375,"context_line":"2. Copy all certificates to the RabbitMQ nodes."},{"line_number":376,"context_line":".. code-block:: console"},{"line_number":377,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1b4736fd_eb2d99d8","line":374,"range":{"start_line":372,"start_character":0,"end_line":374,"end_character":31},"updated":"2024-06-21 09:44:50.000000000","message":"I\u0027m sorry, I don\u0027t quite understand if this means to rerun the role to delete the old certificates, maybe rephrase it a little bit?\n\n\n```suggestion\n1. You can delete the old certificates. To obtain new certificates\nfrom the deploy node rerun the `kolla-ansible certificates` role.\nAlternatively you can generate new certificates manually.\n```","commit_id":"376677df5cd5496534eea66b3051d9e5ba96e7e6"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"bf47d978b75e2492034d57d549f8d22fd2d7a60a","unresolved":false,"context_lines":[{"line_number":369,"context_line":"RabbitMQ nodes need to be manually restarted after their"},{"line_number":370,"context_line":"certificates are updated. The following actions need to be performed:"},{"line_number":371,"context_line":""},{"line_number":372,"context_line":"1. Obtain new certificates. You can delete the old certificates from"},{"line_number":373,"context_line":"deploy node rerun `kolla-ansible certificates` role, or you can"},{"line_number":374,"context_line":"generate certificates manually."},{"line_number":375,"context_line":"2. Copy all certificates to the RabbitMQ nodes."},{"line_number":376,"context_line":".. code-block:: console"},{"line_number":377,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"0a43c735_22999797","line":374,"range":{"start_line":372,"start_character":0,"end_line":374,"end_character":31},"in_reply_to":"1b4736fd_eb2d99d8","updated":"2024-07-17 13:32:49.000000000","message":"Fix applied.","commit_id":"376677df5cd5496534eea66b3051d9e5ba96e7e6"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"0261d9b29ffc68e40b0a7d8f1fcd9e5be3d7b856","unresolved":true,"context_lines":[{"line_number":364,"context_line":"If using this option, make sure that all certificates are present on the"},{"line_number":365,"context_line":"appropriate hosts in the appropriate location."},{"line_number":366,"context_line":""},{"line_number":367,"context_line":"Renewing certificates for RabbitMQ internode TLS"},{"line_number":368,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":369,"context_line":"RabbitMQ nodes need to be manually restarted after their"},{"line_number":370,"context_line":"certificates are updated. The following actions need to be performed:"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ceb16b4f_8e7bd6ae","line":367,"updated":"2024-08-14 15:40:49.000000000","message":"Any chance to get that automated?","commit_id":"b04980418d9d632709039b738aad67756bcf9d28"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"32fd13bf3d923ccceb9031da26ffdd7bde8b3e6c","unresolved":false,"context_lines":[{"line_number":364,"context_line":"If using this option, make sure that all certificates are present on the"},{"line_number":365,"context_line":"appropriate hosts in the appropriate location."},{"line_number":366,"context_line":""},{"line_number":367,"context_line":"Renewing certificates for RabbitMQ internode TLS"},{"line_number":368,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":369,"context_line":"RabbitMQ nodes need to be manually restarted after their"},{"line_number":370,"context_line":"certificates are updated. The following actions need to be performed:"}],"source_content_type":"text/x-rst","patch_set":8,"id":"c6365ca2_faa8454c","line":367,"in_reply_to":"a339c134_829a390c","updated":"2024-08-21 07:05:53.000000000","message":"Acknowledged","commit_id":"b04980418d9d632709039b738aad67756bcf9d28"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"f58e98b6f71a300db0555e287f50bfaf1488490e","unresolved":true,"context_lines":[{"line_number":364,"context_line":"If using this option, make sure that all certificates are present on the"},{"line_number":365,"context_line":"appropriate hosts in the appropriate location."},{"line_number":366,"context_line":""},{"line_number":367,"context_line":"Renewing certificates for RabbitMQ internode TLS"},{"line_number":368,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":369,"context_line":"RabbitMQ nodes need to be manually restarted after their"},{"line_number":370,"context_line":"certificates are updated. The following actions need to be performed:"}],"source_content_type":"text/x-rst","patch_set":8,"id":"a339c134_829a390c","line":367,"in_reply_to":"ceb16b4f_8e7bd6ae","updated":"2024-08-15 08:33:40.000000000","message":"We discussed this with @kieske@osism.tech we decided that he will provide documentation for certificate renewal. As for automation, we decided that it should be in a dedicated patch. We may discuss this further for example on the next Kolla meeting.","commit_id":"b04980418d9d632709039b738aad67756bcf9d28"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"a496dcf91564165f79bc17f6c73c1d757a402961","unresolved":true,"context_lines":[{"line_number":389,"context_line":""},{"line_number":390,"context_line":"The ``kolla_haproxy_ssl_settings`` setting also affects the glance and"},{"line_number":391,"context_line":"neutron haproxy TLS settings, if these proxy services are enabled."},{"line_number":392,"context_line":"Renewing certificates for RabbitMQ internode TLS"},{"line_number":393,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":394,"context_line":"RabbitMQ nodes need to be manually restarted after their"},{"line_number":395,"context_line":"certificates are updated. The following actions need to be performed:"}],"source_content_type":"text/x-rst","patch_set":21,"id":"4fcb1ec2_bbef8af7","line":392,"updated":"2024-09-11 09:07:14.000000000","message":"newline before that?","commit_id":"2aedb29979e867bbb46581e3122d3fdc6feb5b55"},{"author":{"_account_id":36624,"name":"Matúš Jenča","email":"matus.jenca@dnation.cloud","username":"matusjenca"},"change_message_id":"f1d33c98adc7697879af4d5bf27933f8dc4d7e1b","unresolved":false,"context_lines":[{"line_number":389,"context_line":""},{"line_number":390,"context_line":"The ``kolla_haproxy_ssl_settings`` setting also affects the glance and"},{"line_number":391,"context_line":"neutron haproxy TLS settings, if these proxy services are enabled."},{"line_number":392,"context_line":"Renewing certificates for RabbitMQ internode TLS"},{"line_number":393,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":394,"context_line":"RabbitMQ nodes need to be manually restarted after their"},{"line_number":395,"context_line":"certificates are updated. The following actions need to be performed:"}],"source_content_type":"text/x-rst","patch_set":21,"id":"c8b64238_d3d92c38","line":392,"in_reply_to":"4fcb1ec2_bbef8af7","updated":"2024-09-11 10:30:15.000000000","message":"Done","commit_id":"2aedb29979e867bbb46581e3122d3fdc6feb5b55"}]}