)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"109d2dd1a33d30095bb7aa3d59abec96daba31ef","unresolved":true,"context_lines":[{"line_number":4,"context_line":"Commit:     Michal Arbet \u003cmichal.arbet@ultimum.io\u003e"},{"line_number":5,"context_line":"CommitDate: 2024-12-11 15:36:36 +0100"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add TLS support for MariaDB Connections"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Since Kolla-Ansible now supports TLS for MariaDB,"},{"line_number":10,"context_line":"this patch adds support for services that can use"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":35,"id":"532c78eb_8c99d588","line":7,"updated":"2024-12-18 10:58:45.000000000","message":"when using proxysql? I know it\u0027s the default, but not everybody might use it.","commit_id":"256cacb0499fe13bfa2e0b382c70d39c3d344798"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"97f5239afd2a245af4692e3e9293786a7efdf0da","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Michal Arbet \u003cmichal.arbet@ultimum.io\u003e"},{"line_number":5,"context_line":"CommitDate: 2024-12-11 15:36:36 +0100"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add TLS support for MariaDB Connections"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Since Kolla-Ansible now supports TLS for MariaDB,"},{"line_number":10,"context_line":"this patch adds support for services that can use"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":35,"id":"9582583e_668e5805","line":7,"in_reply_to":"1c188876_87da8453","updated":"2025-04-02 13:36:03.000000000","message":"Done","commit_id":"256cacb0499fe13bfa2e0b382c70d39c3d344798"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"d4a8745815241dfcfb5b10086024da13c546e2c8","unresolved":true,"context_lines":[{"line_number":4,"context_line":"Commit:     Michal Arbet \u003cmichal.arbet@ultimum.io\u003e"},{"line_number":5,"context_line":"CommitDate: 2024-12-11 15:36:36 +0100"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add TLS support for MariaDB Connections"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Since Kolla-Ansible now supports TLS for MariaDB,"},{"line_number":10,"context_line":"this patch adds support for services that can use"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":35,"id":"1c188876_87da8453","line":7,"in_reply_to":"532c78eb_8c99d588","updated":"2024-12-18 11:02:11.000000000","message":"Ack. Actually it\u0027is turned on only if tls internal is turned on and proxysql also \n\n\ndatabase_enable_tls_internal: \"{{ \u0027yes\u0027 if ((kolla_enable_tls_internal | bool ) and ( enable_proxysql | bool)) else \u0027no\u0027 }}\"\n\n\nBut yeah, i will change to be more clearer.","commit_id":"256cacb0499fe13bfa2e0b382c70d39c3d344798"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"ad076a7f69de7cef289037230a7578e94c604275","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"8608db36_cfaa3f88","updated":"2024-11-03 14:11:48.000000000","message":"Hmm, I\u0027m not sure how this can be handled – I\u0027m certain the patch is correct, but unfortunately, the upgrade jobs logically cannot pass...because the previous version does not support DB TLS. So, when the upgrade phase reconfigures ProxySQL to provide MariaDB as TLS-enabled, the services that are connecting at that moment will simply stop working.\n\nBut it still holds, of course, that if TLS was enabled, the upgrade will work fine, and if it was disabled, it will also work fine. (But from the version where this will be patched.)","commit_id":"0133ab2874e5b6a185d3c0c881269a24a2962978"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"6681ff343f16bbddddd6f2f9ebb108635c7ce8b4","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"1be5501d_6c993ea3","updated":"2024-11-03 14:20:34.000000000","message":"Hmm, maybe it\u0027s only config issue as there is nova-conductor bad config, ups 😊","commit_id":"0133ab2874e5b6a185d3c0c881269a24a2962978"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"f6eb24309c20a3080913292d2df7bc3f3142c318","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"9e91db47_725ccbb9","updated":"2024-11-03 14:13:36.000000000","message":"The solution would be to provide two users for the service – one for non-TLS and one for TLS – so that it would be possible to switch between them. Or should this be done only during the upgrade phase?","commit_id":"0133ab2874e5b6a185d3c0c881269a24a2962978"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"9d97b1b923b83a37e203440086feff49c8320cf5","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":14,"id":"289072d0_8558608c","updated":"2024-11-08 13:32:59.000000000","message":"mhm, something is weird:\n\nkolla-ansible-ubuntu-lets-encrypt\n\nfails with:\n\n Task Run check-config.sh script failed running on host secondary1 (and secondary2)\n\n```\nERROR: Unexpected permissions on directory /etc/kolla/nova-api-bootstrap. Got 755, expected 770\nERROR: Unexpected permissions on directory /etc/kolla/nova-cell-bootstrap. Got 755, expected 770\n```\n\n\nso something is mangling the permissions, but I don\u0027t see why just yet.\n\nlogs: https://zuul.opendev.org/t/openstack/build/6b5977331b2640ef88104ee30a555118","commit_id":"55e78e70f1959ef6c76add11a627f55af6414929"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"c7af48f4a832193e520b0c286551428b2c1ea90c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":14,"id":"3aa8ee98_eb0f28e9","updated":"2024-11-08 09:10:11.000000000","message":"recheck temporary failure with logging at rackspace","commit_id":"55e78e70f1959ef6c76add11a627f55af6414929"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"247867d75c8d1e5c8a305a7b722ff67fd9554695","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":14,"id":"52222827_f7f9af1c","in_reply_to":"289072d0_8558608c","updated":"2024-11-27 11:25:37.000000000","message":"don\u0027t worry, i will fix it. I think it\u0027s caused because I\u0027ve add import of service-copy-cert to copy CA into bootstrap container ...which will create different permissions.","commit_id":"55e78e70f1959ef6c76add11a627f55af6414929"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"b94a42de07da9376baf675915c08ce42365b0b87","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":14,"id":"b0dd89de_4dd5f2d3","in_reply_to":"52222827_f7f9af1c","updated":"2024-11-27 11:26:06.000000000","message":"Done","commit_id":"55e78e70f1959ef6c76add11a627f55af6414929"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"7889e1c38bd6c72a5a4742413d0659abc64ce7ab","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":15,"id":"2a836f31_eecb7a01","updated":"2024-11-26 10:02:46.000000000","message":"recheck unrelated CI issue Error mounting /var/lib/docker: mount: /var/lib/docker: can\u0027t find LABEL\u003dkolla.","commit_id":"2a1d153987d5f7406f92f4f0f213ff8acc515907"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"056fc4b1db085be87f6b661e8d824f09c5978c3a","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":16,"id":"ee6bf19f_0ca21bbf","updated":"2024-11-27 15:18:05.000000000","message":"recheck dockerhub pull limit reached","commit_id":"914e65822faab6f09acef8d34bfd07f01429da6b"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"7fc0ae31ff253091ca62e44d2bd57aedf24ebc18","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":17,"id":"7fafa91f_6ff77205","updated":"2024-11-28 20:03:25.000000000","message":"recheck","commit_id":"f2ab04de328b03adeb0e9cabc6479be42293362d"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"9d102c97d4961e617e1bf5dc582652b93748bc06","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":20,"id":"f66583ce_22e4a325","updated":"2024-11-29 09:30:39.000000000","message":"recheck unrelated","commit_id":"e7e73d698532e5ddd68c0d19f1c961da4344ebdf"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"371fed1a7b598713952aa135ae7783e608915191","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":22,"id":"cf3e1523_35b43401","updated":"2024-12-01 09:51:01.000000000","message":"I would never have given myself a +2, it\u0027s a pity I\u0027m not a core reviewer(","commit_id":"123623d1bb698ac678a2b5ba3a5121594967ffb8"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"c0045d5d8cc55ea8ad55b953b7954ab104e17e1b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":22,"id":"dbc6dfcc_7744aa82","updated":"2024-12-01 08:30:56.000000000","message":"Please don’t +2 your own changes :)","commit_id":"123623d1bb698ac678a2b5ba3a5121594967ffb8"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"649a9c40d77f52e980281bf6ade47aaa728c2466","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":22,"id":"3f0e488c_b98befdd","in_reply_to":"9c2bf81f_0c3d4e5f","updated":"2024-12-03 05:42:13.000000000","message":"Why -1 then ?","commit_id":"123623d1bb698ac678a2b5ba3a5121594967ffb8"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"a9c232122014071893d230a64002b646316fa8a5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":22,"id":"9c2bf81f_0c3d4e5f","in_reply_to":"dbc6dfcc_7744aa82","updated":"2024-12-01 13:25:02.000000000","message":"Yeah, sorry, I didn\u0027t notice that it\u0027s my patch 😊. Because I was checking whole chain and was giving +2 as it is now all working. Is it -1 only because of my +2 ? Because now i reset it. Or do you have another comments I should address ?","commit_id":"123623d1bb698ac678a2b5ba3a5121594967ffb8"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"b1daeac3d658e735be7c1c27ea4dc7711b76a858","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":23,"id":"be88d032_7aeac4dc","updated":"2024-12-01 22:02:30.000000000","message":"recheck new image","commit_id":"087d50dcf60d731a9a6998ff835cff2c3c5b7a1a"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"18583351d576937a5b47de3b9bc659555c43b41b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":28,"id":"32ba9975_548f7629","updated":"2024-12-07 09:19:13.000000000","message":"recheck to confirm pipeline is ok because weird results in another review","commit_id":"851201310c0f56a4ac81a16145f0bcf189544ca2"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"7b45b2c6536ef181875c5b277f30978a21731bb6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":32,"id":"e6c85279_82001633","updated":"2024-12-08 19:59:07.000000000","message":"recheck after make pebble image public","commit_id":"e328434191d2bbda06ef49daaa173b25ce14810d"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"cd3bf2bddbdd81d58b583637ef2675d68b7b9d5f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":32,"id":"505bfed1_dac4dacd","updated":"2024-12-09 06:02:00.000000000","message":"recheck pebble quay made public","commit_id":"e328434191d2bbda06ef49daaa173b25ce14810d"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"8ee3ee04aa61996af222d7f5860d6fced2b304ce","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":34,"id":"2294e728_e1092fa5","updated":"2024-12-09 15:30:32.000000000","message":"recheck new images","commit_id":"b2b9d61e8735d1eb263f2c90892b17865c71360e"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"d1d08b184ba4f7be61083ecda62e545def389965","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":35,"id":"870654da_15a75270","updated":"2024-12-18 11:00:35.000000000","message":"otherwise looks good","commit_id":"256cacb0499fe13bfa2e0b382c70d39c3d344798"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"eee61333327c9d6e9eec489f42977afa19c6c18f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":36,"id":"8bcd079c_0ce4bb10","updated":"2025-01-10 09:17:13.000000000","message":"and all the other roles bootsrap.yml files","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"aa06e1dab7ae19d396007fb9accba92bf3b343db","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":36,"id":"eff0545d_39be1a15","updated":"2025-01-03 15:55:27.000000000","message":"recheck unrelated error","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"5003dc2f564157beca79f79dca37a570c70145a8","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":38,"id":"1e3a160f_41155020","updated":"2025-01-29 07:54:05.000000000","message":"recheck pull error","commit_id":"01cc4de77e6cc4e39ead566c8dc43b1f9a8ac73e"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"da384a28590d18214d9155a519481759554dd420","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":38,"id":"9b8cb4d8_dc9c56c1","updated":"2025-01-30 10:12:30.000000000","message":"recheck timeouts","commit_id":"01cc4de77e6cc4e39ead566c8dc43b1f9a8ac73e"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"ebee342878f64762caf7385a6955c1f6822565a2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":47,"id":"e3d3ee37_d0235941","updated":"2025-07-04 07:04:46.000000000","message":"-1 for posterity","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"8fe508137d7fe44bb8cc928130e69b264b3dca85","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":47,"id":"aa14951f_aaab4605","updated":"2025-07-04 00:18:34.000000000","message":"Not that I really miss it, since we don’t use TLS internally, but still, it probably deserves a review.","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"2ba372061ffa9b82637ac36fcacbec0c6473f751","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":47,"id":"e6637093_69aaad18","in_reply_to":"aa14951f_aaab4605","updated":"2025-07-04 07:04:37.000000000","message":"Missing sign off - can you add it?","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"643ced864374dcd1cedb147aa649e6295f92d39c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":47,"id":"8909a5f3_3939309c","in_reply_to":"e6637093_69aaad18","updated":"2025-07-09 11:33:01.000000000","message":"Done","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"}],"ansible/roles/aodh/tasks/bootstrap.yml":[{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"eee61333327c9d6e9eec489f42977afa19c6c18f","unresolved":true,"context_lines":[{"line_number":5,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":6,"context_line":"    module_name: mysql_db"},{"line_number":7,"context_line":"    module_args:"},{"line_number":8,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":9,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":10,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":11,"context_line":"      login_user: \"{{ aodh_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":36,"id":"05d67738_378fb4da","line":8,"range":{"start_line":8,"start_character":39,"end_line":8,"end_character":67},"updated":"2025-01-10 09:17:13.000000000","message":"\u0027aodh_database_enable_tls_internal\u0027\nsince we have role specific variable","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"e5d7243dad62eefc8eed83fef720f2b72107414b","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":6,"context_line":"    module_name: mysql_db"},{"line_number":7,"context_line":"    module_args:"},{"line_number":8,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":9,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":10,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":11,"context_line":"      login_user: \"{{ aodh_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":36,"id":"500726d3_c333d319","line":8,"range":{"start_line":8,"start_character":39,"end_line":8,"end_character":67},"in_reply_to":"05d67738_378fb4da","updated":"2025-04-02 13:33:32.000000000","message":"No, you probably misunderstood it — the database creation needs to be split based on whether a certificate is used or not. This is controlled by the variable database_enable_tls_internal, because based on this variable, ProxySQL either allows access through the root user or not.\n\nThen you also have aodh_database_enable_tls_internal — this one controls how the database connection config is rendered. It\u0027s true that it would work either way, but semantically, this approach is correct. That\u0027s because database_enable_tls_internal determines whether the database endpoint uses TLS or not.\n\nSo, simply put — when using the root user, it\u0027s either with TLS or without.","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"eee61333327c9d6e9eec489f42977afa19c6c18f","unresolved":true,"context_lines":[{"line_number":22,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":23,"context_line":"    module_name: mysql_user"},{"line_number":24,"context_line":"    module_args:"},{"line_number":25,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":26,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":27,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":28,"context_line":"      login_user: \"{{ aodh_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":36,"id":"e9e5bff4_cdd3f8c5","line":25,"range":{"start_line":25,"start_character":39,"end_line":25,"end_character":67},"updated":"2025-01-10 09:17:13.000000000","message":"ditto","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"e5d7243dad62eefc8eed83fef720f2b72107414b","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":23,"context_line":"    module_name: mysql_user"},{"line_number":24,"context_line":"    module_args:"},{"line_number":25,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":26,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":27,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":28,"context_line":"      login_user: \"{{ aodh_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":36,"id":"ae328e55_126d434a","line":25,"range":{"start_line":25,"start_character":39,"end_line":25,"end_character":67},"in_reply_to":"e9e5bff4_cdd3f8c5","updated":"2025-04-02 13:33:32.000000000","message":"ditto above comment","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"35523e1a9052a7db5fef20a777ebc233b129130d","unresolved":true,"context_lines":[{"line_number":5,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":6,"context_line":"    module_name: mysql_db"},{"line_number":7,"context_line":"    module_args:"},{"line_number":8,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":9,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":10,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":11,"context_line":"      login_user: \"{{ aodh_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":47,"id":"ce40a31b_fd2ef3eb","line":8,"updated":"2025-07-04 09:44:46.000000000","message":"it should be aodh_database_enable_tls_internal instead of global variable. also seen in other services","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"30f8274981f4520e1fbbeefc6b6ea4a08956d1ff","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":6,"context_line":"    module_name: mysql_db"},{"line_number":7,"context_line":"    module_args:"},{"line_number":8,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":9,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":10,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":11,"context_line":"      login_user: \"{{ aodh_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":47,"id":"a66dc168_60fbbf00","line":8,"in_reply_to":"4519545e_0c2a5c11","updated":"2025-07-09 11:19:42.000000000","message":"Nope, this patch provides the option to enable internal TLS for the database. This is, of course, handled by ProxySQL. But it’s important to realize that during the database bootstrap, the database itself needs to be created and permissions granted. This is done using the root user, and it happens in the kolla-toolbox and CA needs to be present if database_enable_tls_internal ......\n\nSo, for example, if Aodh has internal DB TLS disabled, that’s OK — but the creation of the database and user is still performed over an encrypted connection if database_enable_tls_internal is set to true. And that’s something we need to distinguish. Marking as resolved, please open the comment if you have another questions....","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"c958bec1eda24982907a2c7c78d2f204255f4fd0","unresolved":true,"context_lines":[{"line_number":5,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":6,"context_line":"    module_name: mysql_db"},{"line_number":7,"context_line":"    module_args:"},{"line_number":8,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":9,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":10,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":11,"context_line":"      login_user: \"{{ aodh_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":47,"id":"4519545e_0c2a5c11","line":8,"in_reply_to":"ce40a31b_fd2ef3eb","updated":"2025-07-04 10:20:04.000000000","message":"Yeah I was wondering the same. I think using service specific variable gives more choices to users while them not touching the global variable.","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"}],"ansible/roles/barbican/tasks/bootstrap.yml":[{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"eee61333327c9d6e9eec489f42977afa19c6c18f","unresolved":true,"context_lines":[{"line_number":5,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":6,"context_line":"    module_name: mysql_db"},{"line_number":7,"context_line":"    module_args:"},{"line_number":8,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":9,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":10,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":11,"context_line":"      login_user: \"{{ barbican_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":36,"id":"dbaabce5_3409b368","line":8,"range":{"start_line":8,"start_character":39,"end_line":8,"end_character":67},"updated":"2025-01-10 09:17:13.000000000","message":"barbican_database_enable_tls_internal","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"e5d7243dad62eefc8eed83fef720f2b72107414b","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":6,"context_line":"    module_name: mysql_db"},{"line_number":7,"context_line":"    module_args:"},{"line_number":8,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":9,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":10,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":11,"context_line":"      login_user: \"{{ barbican_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":36,"id":"e8d8a2a8_33ad11fd","line":8,"range":{"start_line":8,"start_character":39,"end_line":8,"end_character":67},"in_reply_to":"dbaabce5_3409b368","updated":"2025-04-02 13:33:32.000000000","message":"ditto","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"eee61333327c9d6e9eec489f42977afa19c6c18f","unresolved":true,"context_lines":[{"line_number":22,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":23,"context_line":"    module_name: mysql_user"},{"line_number":24,"context_line":"    module_args:"},{"line_number":25,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":26,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":27,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":28,"context_line":"      login_user: \"{{ barbican_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":36,"id":"6237a09e_6a58dda0","line":25,"range":{"start_line":25,"start_character":39,"end_line":25,"end_character":67},"updated":"2025-01-10 09:17:13.000000000","message":"ditto","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"e5d7243dad62eefc8eed83fef720f2b72107414b","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":23,"context_line":"    module_name: mysql_user"},{"line_number":24,"context_line":"    module_args:"},{"line_number":25,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":26,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":27,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":28,"context_line":"      login_user: \"{{ barbican_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":36,"id":"47b8d166_138d66da","line":25,"range":{"start_line":25,"start_character":39,"end_line":25,"end_character":67},"in_reply_to":"6237a09e_6a58dda0","updated":"2025-04-02 13:33:32.000000000","message":"ditto","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"}],"ansible/roles/barbican/templates/barbican-api.json.j2":[{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"eee61333327c9d6e9eec489f42977afa19c6c18f","unresolved":true,"context_lines":[{"line_number":37,"context_line":"            \"dest\": \"/etc/barbican/{{ barbican_policy_file }}\","},{"line_number":38,"context_line":"            \"owner\": \"barbican\","},{"line_number":39,"context_line":"            \"perm\": \"0600\""},{"line_number":40,"context_line":"        }{% endif %}{% if kolla_copy_ca_into_containers | bool %},"},{"line_number":41,"context_line":"        {"},{"line_number":42,"context_line":"            \"source\": \"{{ container_config_directory }}/ca-certificates\","},{"line_number":43,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","}],"source_content_type":"text/x-jinja2","patch_set":36,"id":"6467d710_46e78a3c","line":40,"range":{"start_line":40,"start_character":26,"end_line":40,"end_character":55},"updated":"2025-01-10 09:17:13.000000000","message":"barbican_copy_certs","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"e5d7243dad62eefc8eed83fef720f2b72107414b","unresolved":false,"context_lines":[{"line_number":37,"context_line":"            \"dest\": \"/etc/barbican/{{ barbican_policy_file }}\","},{"line_number":38,"context_line":"            \"owner\": \"barbican\","},{"line_number":39,"context_line":"            \"perm\": \"0600\""},{"line_number":40,"context_line":"        }{% endif %}{% if kolla_copy_ca_into_containers | bool %},"},{"line_number":41,"context_line":"        {"},{"line_number":42,"context_line":"            \"source\": \"{{ container_config_directory }}/ca-certificates\","},{"line_number":43,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","}],"source_content_type":"text/x-jinja2","patch_set":36,"id":"68059c0c_82b37dbc","line":40,"range":{"start_line":40,"start_character":26,"end_line":40,"end_character":55},"in_reply_to":"6467d710_46e78a3c","updated":"2025-04-02 13:33:32.000000000","message":"No, this is a similar trick — barbican_copy_certs controls whether copy-certs.yml runs, while kolla_copy_ca_into_containers controls whether config.json for copying CAs is rendered, just as the variable name suggests. I recommend deploying it with this code. I don’t mean to sound rude, sorry, but it would make more sense to you if you saw how it\u0027s all connected — it’s set up this way on purpose.","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"35523e1a9052a7db5fef20a777ebc233b129130d","unresolved":true,"context_lines":[{"line_number":37,"context_line":"            \"dest\": \"/etc/barbican/{{ barbican_policy_file }}\","},{"line_number":38,"context_line":"            \"owner\": \"barbican\","},{"line_number":39,"context_line":"            \"perm\": \"0600\""},{"line_number":40,"context_line":"        }{% endif %}{% if kolla_copy_ca_into_containers | bool %},"},{"line_number":41,"context_line":"        {"},{"line_number":42,"context_line":"            \"source\": \"{{ container_config_directory }}/ca-certificates\","},{"line_number":43,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"fb7b65d8_6d5926eb","line":40,"updated":"2025-07-04 09:44:46.000000000","message":"why switch to global variable? applies to other services templates","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"30f8274981f4520e1fbbeefc6b6ea4a08956d1ff","unresolved":false,"context_lines":[{"line_number":37,"context_line":"            \"dest\": \"/etc/barbican/{{ barbican_policy_file }}\","},{"line_number":38,"context_line":"            \"owner\": \"barbican\","},{"line_number":39,"context_line":"            \"perm\": \"0600\""},{"line_number":40,"context_line":"        }{% endif %}{% if kolla_copy_ca_into_containers | bool %},"},{"line_number":41,"context_line":"        {"},{"line_number":42,"context_line":"            \"source\": \"{{ container_config_directory }}/ca-certificates\","},{"line_number":43,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"96fe201f_3d5b1314","line":40,"in_reply_to":"7556c399_c3be9bae","updated":"2025-07-09 11:19:42.000000000","message":"No, because the service-cert-copy  role or better said certs,keys,CAs copy is indeed controlled by a service-level variable on *_copy_certs, but the JSON is conditionally structured correctly only in this patch semantically. Notice that the service certificates and keys are in a different JSON block above. /var/lib/kolla/share/ca-certificates is really only for CA certificates, and it’s a global value — there’s no reason to complicate it any further and it makes sense now. Closing the comment @bartosz@stackhpc.com , please reopen if you don\u0027t agree.","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"c958bec1eda24982907a2c7c78d2f204255f4fd0","unresolved":true,"context_lines":[{"line_number":37,"context_line":"            \"dest\": \"/etc/barbican/{{ barbican_policy_file }}\","},{"line_number":38,"context_line":"            \"owner\": \"barbican\","},{"line_number":39,"context_line":"            \"perm\": \"0600\""},{"line_number":40,"context_line":"        }{% endif %}{% if kolla_copy_ca_into_containers | bool %},"},{"line_number":41,"context_line":"        {"},{"line_number":42,"context_line":"            \"source\": \"{{ container_config_directory }}/ca-certificates\","},{"line_number":43,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"7556c399_c3be9bae","line":40,"in_reply_to":"fb7b65d8_6d5926eb","updated":"2025-07-04 10:20:04.000000000","message":"``barbican_copy_certs`` is not just a mirror of ``kolla_copy_ca_into_containers`` in this patch. So, shouldn\u0027t we keep using service specific copy_certs variables?","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"}],"ansible/roles/barbican/templates/barbican-keystone-listener.json.j2":[{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"eee61333327c9d6e9eec489f42977afa19c6c18f","unresolved":true,"context_lines":[{"line_number":12,"context_line":"            \"dest\": \"/etc/barbican/{{ barbican_policy_file }}\","},{"line_number":13,"context_line":"            \"owner\": \"barbican\","},{"line_number":14,"context_line":"            \"perm\": \"0600\""},{"line_number":15,"context_line":"        }{% endif %}{% if kolla_copy_ca_into_containers | bool %},"},{"line_number":16,"context_line":"        {"},{"line_number":17,"context_line":"            \"source\": \"{{ container_config_directory }}/ca-certificates\","},{"line_number":18,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","}],"source_content_type":"text/x-jinja2","patch_set":36,"id":"12994305_f439c11e","line":15,"range":{"start_line":15,"start_character":26,"end_line":15,"end_character":55},"updated":"2025-01-10 09:17:13.000000000","message":"barbican_copy_certs","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"e5d7243dad62eefc8eed83fef720f2b72107414b","unresolved":false,"context_lines":[{"line_number":12,"context_line":"            \"dest\": \"/etc/barbican/{{ barbican_policy_file }}\","},{"line_number":13,"context_line":"            \"owner\": \"barbican\","},{"line_number":14,"context_line":"            \"perm\": \"0600\""},{"line_number":15,"context_line":"        }{% endif %}{% if kolla_copy_ca_into_containers | bool %},"},{"line_number":16,"context_line":"        {"},{"line_number":17,"context_line":"            \"source\": \"{{ container_config_directory }}/ca-certificates\","},{"line_number":18,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","}],"source_content_type":"text/x-jinja2","patch_set":36,"id":"e30787a9_bc9e028f","line":15,"range":{"start_line":15,"start_character":26,"end_line":15,"end_character":55},"in_reply_to":"12994305_f439c11e","updated":"2025-04-02 13:33:32.000000000","message":"ditto","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"}],"ansible/roles/barbican/templates/barbican-worker.json.j2":[{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"eee61333327c9d6e9eec489f42977afa19c6c18f","unresolved":true,"context_lines":[{"line_number":13,"context_line":"            \"owner\": \"barbican\","},{"line_number":14,"context_line":"            \"perm\": \"0600\""},{"line_number":15,"context_line":"        }{% endif %}"},{"line_number":16,"context_line":"        {% if kolla_copy_ca_into_containers | bool %},"},{"line_number":17,"context_line":"        {"},{"line_number":18,"context_line":"            \"source\": \"{{ container_config_directory }}/ca-certificates\","},{"line_number":19,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","}],"source_content_type":"text/x-jinja2","patch_set":36,"id":"3b43b855_0ff3daa7","line":16,"range":{"start_line":16,"start_character":14,"end_line":16,"end_character":43},"updated":"2025-01-10 09:17:13.000000000","message":"barbican_copy_certs","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"e5d7243dad62eefc8eed83fef720f2b72107414b","unresolved":false,"context_lines":[{"line_number":13,"context_line":"            \"owner\": \"barbican\","},{"line_number":14,"context_line":"            \"perm\": \"0600\""},{"line_number":15,"context_line":"        }{% endif %}"},{"line_number":16,"context_line":"        {% if kolla_copy_ca_into_containers | bool %},"},{"line_number":17,"context_line":"        {"},{"line_number":18,"context_line":"            \"source\": \"{{ container_config_directory }}/ca-certificates\","},{"line_number":19,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","}],"source_content_type":"text/x-jinja2","patch_set":36,"id":"a03803d4_bcc3a7a8","line":16,"range":{"start_line":16,"start_character":14,"end_line":16,"end_character":43},"in_reply_to":"3b43b855_0ff3daa7","updated":"2025-04-02 13:33:32.000000000","message":"ditto","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"}],"ansible/roles/blazar/tasks/bootstrap.yml":[{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"eee61333327c9d6e9eec489f42977afa19c6c18f","unresolved":true,"context_lines":[{"line_number":5,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":6,"context_line":"    module_name: mysql_db"},{"line_number":7,"context_line":"    module_args:"},{"line_number":8,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":9,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":10,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":11,"context_line":"      login_user: \"{{ blazar_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":36,"id":"b921c739_1e2105e3","line":8,"range":{"start_line":8,"start_character":39,"end_line":8,"end_character":67},"updated":"2025-01-10 09:17:13.000000000","message":"blazar_database_enable_tls_internal","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"e5d7243dad62eefc8eed83fef720f2b72107414b","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":6,"context_line":"    module_name: mysql_db"},{"line_number":7,"context_line":"    module_args:"},{"line_number":8,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":9,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":10,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":11,"context_line":"      login_user: \"{{ blazar_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":36,"id":"0b7ce0e6_ca6ee56b","line":8,"range":{"start_line":8,"start_character":39,"end_line":8,"end_character":67},"in_reply_to":"b921c739_1e2105e3","updated":"2025-04-02 13:33:32.000000000","message":"ditto comments before","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"eee61333327c9d6e9eec489f42977afa19c6c18f","unresolved":true,"context_lines":[{"line_number":22,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":23,"context_line":"    module_name: mysql_user"},{"line_number":24,"context_line":"    module_args:"},{"line_number":25,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":26,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":27,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":28,"context_line":"      login_user: \"{{ blazar_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":36,"id":"3e539c8e_4be3c0f7","line":25,"range":{"start_line":25,"start_character":39,"end_line":25,"end_character":67},"updated":"2025-01-10 09:17:13.000000000","message":"ditto","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"e5d7243dad62eefc8eed83fef720f2b72107414b","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":23,"context_line":"    module_name: mysql_user"},{"line_number":24,"context_line":"    module_args:"},{"line_number":25,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":26,"context_line":"      login_host: \"{{ database_address }}\""},{"line_number":27,"context_line":"      login_port: \"{{ database_port }}\""},{"line_number":28,"context_line":"      login_user: \"{{ blazar_database_shard_root_user }}\""}],"source_content_type":"text/x-yaml","patch_set":36,"id":"dc2f42a5_bfd21722","line":25,"range":{"start_line":25,"start_character":39,"end_line":25,"end_character":67},"in_reply_to":"3e539c8e_4be3c0f7","updated":"2025-04-02 13:33:32.000000000","message":"ditto","commit_id":"11fd5658126c27ac8c994e151bc94639e06488ee"}],"ansible/roles/mariadb/defaults/main.yml":[{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"c958bec1eda24982907a2c7c78d2f204255f4fd0","unresolved":true,"context_lines":[{"line_number":143,"context_line":"###################"},{"line_number":144,"context_line":"# Copy certificates"},{"line_number":145,"context_line":"###################"},{"line_number":146,"context_line":"mariadb_copy_certs: \"{{ kolla_copy_ca_into_containers | bool or database_enable_tls_backend | bool }}\""}],"source_content_type":"text/x-yaml","patch_set":47,"id":"78f1c2a3_e41e77e8","line":146,"updated":"2025-07-04 10:20:04.000000000","message":"Plus ``or database_enable_tls_internal`` ?","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"ec16d592eac2c5787616d2333172d0bf476b0bf3","unresolved":false,"context_lines":[{"line_number":143,"context_line":"###################"},{"line_number":144,"context_line":"# Copy certificates"},{"line_number":145,"context_line":"###################"},{"line_number":146,"context_line":"mariadb_copy_certs: \"{{ kolla_copy_ca_into_containers | bool or database_enable_tls_backend | bool }}\""}],"source_content_type":"text/x-yaml","patch_set":47,"id":"cedf3f3f_ec23fb19","line":146,"in_reply_to":"78f1c2a3_e41e77e8","updated":"2025-07-09 11:31:19.000000000","message":"Nope, the controlling variable for copying the necessary certificates for the backend — which in this case is MariaDB — follows the same principle as when it’s for Glance or Keystone. In this case, it’s just Keystone replaced by MariaDB simply said.\n\nThe variable database_enable_tls_internal is essentially a controlling variable for the configuration files, because it only makes sense when using ProxySQL. It doesn’t provide a reasonable purpose for the actual copying of certificates.\nMoreover, you have to realize that from Kolla’s perspective, you need to be able to enable TLS for MariaDB itself (the configuration on the MariaDB side) and also enable the TLS endpoint (ProxySQL) — which also makes sense, for example, when using an external load balancer.\n\nMarking as resolved, please reopen if any questions.","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"}],"ansible/roles/mariadb/tasks/check.yml":[{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"c958bec1eda24982907a2c7c78d2f204255f4fd0","unresolved":true,"context_lines":[{"line_number":8,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":9,"context_line":"    module_name: mysql_query"},{"line_number":10,"context_line":"    module_args:"},{"line_number":11,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":12,"context_line":"      login_user: \"{{ mariadb_shard_database_user }}\""},{"line_number":13,"context_line":"      login_password: \"{{ database_password }}\""},{"line_number":14,"context_line":"      login_host: \"{{ database_address }}\""}],"source_content_type":"text/x-yaml","patch_set":47,"id":"b63c595e_92b2b962","line":11,"updated":"2025-07-04 10:20:04.000000000","message":"Like other comments, what about using ``maraidb_copy_certs`` here and others?","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"ec16d592eac2c5787616d2333172d0bf476b0bf3","unresolved":false,"context_lines":[{"line_number":8,"context_line":"    container_engine: \"{{ kolla_container_engine }}\""},{"line_number":9,"context_line":"    module_name: mysql_query"},{"line_number":10,"context_line":"    module_args:"},{"line_number":11,"context_line":"      ca_cert: \"{{ openstack_cacert if database_enable_tls_internal | bool else omit }}\""},{"line_number":12,"context_line":"      login_user: \"{{ mariadb_shard_database_user }}\""},{"line_number":13,"context_line":"      login_password: \"{{ database_password }}\""},{"line_number":14,"context_line":"      login_host: \"{{ database_address }}\""}],"source_content_type":"text/x-yaml","patch_set":47,"id":"141823fd_ea64d0e8","line":11,"in_reply_to":"b63c595e_92b2b962","updated":"2025-07-09 11:31:19.000000000","message":"Replied in another comment, closing.","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"}],"ansible/roles/nova-cell/tasks/config_bootstrap.yml":[{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"b183f05953a75f7313f322da99f00c721f9198a0","unresolved":true,"context_lines":[{"line_number":8,"context_line":"    state: \"directory\""},{"line_number":9,"context_line":"    owner: \"{{ config_owner_user }}\""},{"line_number":10,"context_line":"    group: \"{{ config_owner_group }}\""},{"line_number":11,"context_line":"    mode: \"0770\""},{"line_number":12,"context_line":"  when: inventory_hostname \u003d\u003d groups[nova_cell_conductor_group][0]"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"- name: Copying over config.json files for nova-cell-bootstrap"}],"source_content_type":"text/x-yaml","patch_set":15,"id":"9d7dcfcb_dfc8703c","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":2},"updated":"2024-11-26 17:43:55.000000000","message":"Somehow this patchset triggers a bug or something, because in job:\nkolla-ansible-ubuntu-lets-encrypt (non-voting) we now got (and repeatedly so, in multiple runs):\n\nTask \nRun check-config.sh script failed running on host secondary1\n\nERROR: Unexpected permissions on directory /etc/kolla/nova-cell-bootstrap. Got 755, expected 770","commit_id":"2a1d153987d5f7406f92f4f0f213ff8acc515907"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"b94a42de07da9376baf675915c08ce42365b0b87","unresolved":false,"context_lines":[{"line_number":8,"context_line":"    state: \"directory\""},{"line_number":9,"context_line":"    owner: \"{{ config_owner_user }}\""},{"line_number":10,"context_line":"    group: \"{{ config_owner_group }}\""},{"line_number":11,"context_line":"    mode: \"0770\""},{"line_number":12,"context_line":"  when: inventory_hostname \u003d\u003d groups[nova_cell_conductor_group][0]"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"- name: Copying over config.json files for nova-cell-bootstrap"}],"source_content_type":"text/x-yaml","patch_set":15,"id":"a8007cf3_2038e17d","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":2},"in_reply_to":"033b5079_ce4cd1c0","updated":"2024-11-27 11:26:06.000000000","message":"Done","commit_id":"2a1d153987d5f7406f92f4f0f213ff8acc515907"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"247867d75c8d1e5c8a305a7b722ff67fd9554695","unresolved":true,"context_lines":[{"line_number":8,"context_line":"    state: \"directory\""},{"line_number":9,"context_line":"    owner: \"{{ config_owner_user }}\""},{"line_number":10,"context_line":"    group: \"{{ config_owner_group }}\""},{"line_number":11,"context_line":"    mode: \"0770\""},{"line_number":12,"context_line":"  when: inventory_hostname \u003d\u003d groups[nova_cell_conductor_group][0]"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"- name: Copying over config.json files for nova-cell-bootstrap"}],"source_content_type":"text/x-yaml","patch_set":15,"id":"033b5079_ce4cd1c0","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":2},"in_reply_to":"9d7dcfcb_dfc8703c","updated":"2024-11-27 11:25:37.000000000","message":"12:12 \u003ckevko\u003e SvenKieske: i probably know what triggered permissions check fail \n12:15 \u003ckevko\u003e SvenKieske: point is that without TLS to mariadb there is a container for bootstrap cell right ? ...it\u0027s done on servers[0] .... BUT i\u0027ve added support to completly switch to TLS ...so i needed to import copy-config role (or what is the name) ... which produced /etc/kolla/nova-cell-bootstrap.... on every host ...but then task which changing permissions touch only the servers[0] ... so ..before the script was checking all for 0770 .. and when it wasn\u0027t on other hosts ..it\u0027s ok ...but now it\u0027s on every host ...but kolla-ansible change only on first ...\n12:15 \u003ckevko\u003e SvenKieske: so i think the solution is fix all permissions ..or import role and add when servers[0]\n12:15 \u003cSvenKieske\u003e yep\n12:15 \u003ckevko\u003e so the bootstrap folder under /etc/kolla will be created only on server[0] ..as before ...\n12:16 \u003cSvenKieske\u003e But I was wondering: that cert directory will end up on all servers anyway, no? so what is fixing permissions before your change? or don\u0027t we have certs distributed on all servers before your change?\n12:16 \u003ckevko\u003e (but my opinion is that it should be everywhere ...as host[0] is bad from the beginning)\n12:16 \u003cSvenKieske\u003e not sure I understand 100% the situation before your patch :D\n12:16 \u003cSvenKieske\u003e yep, host[0] is somehow an antipattern I think, don\n12:17 \u003cSvenKieske\u003e \u0027t want to grep where we have that everywhere..\n12:17 \u003ckevko\u003e SvenKieske: okay, again ...there is nova-cell-bootstrap container ...which done something OK ? \n12:17 \u003ckevko\u003e SvenKieske: but there is only config.json ..nova.conf and that\u0027s it ...right ? \n12:17 \u003ckevko\u003e SvenKieske: so there is simple task to ensure that files exist ..and then run container which do some work ...\n12:18 \u003ckevko\u003e SvenKieske: BUT ... if you are using TLS ... you need to have root.crt imported into nova-cell-bootstrap container when it\u0027s boostraping ..\n12:19 \u003ckevko\u003e SvenKieske: so I took the common role to achieve cert copy inside /etc/kolla/nova-cell-boostrap -\u003e https://review.opendev.org/c/openstack/kolla-ansible/+/933924/15/ansible/roles/nova-cell/tasks/config_bootstrap.yml\n12:19 \u003ckevko\u003e SvenKieske: after this it\u0027s working ... but problem is that I missed when: inventory_hostname \u003d\u003d groups[nova_cell_conductor_group][0]  during the import ...\n12:20 \u003ckevko\u003e SvenKieske: so it actually created folder and ca-certificates as it is on my testing stack -\u003e https://paste.openstack.org/show/bkP8JVvqTDvW8EmemRzg/\n12:23 \u003copendevreview\u003e Michal Arbet proposed openstack/kolla-ansible master: Add TLS support for MariaDB Connections  https://review.opendev.org/c/openstack/kolla-ansible/+/933924\n12:23 \u003ckevko\u003e SvenKieske: TLDR , simply said ...this should fix :D ^^","commit_id":"2a1d153987d5f7406f92f4f0f213ff8acc515907"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"b183f05953a75f7313f322da99f00c721f9198a0","unresolved":true,"context_lines":[{"line_number":9,"context_line":"    owner: \"{{ config_owner_user }}\""},{"line_number":10,"context_line":"    group: \"{{ config_owner_group }}\""},{"line_number":11,"context_line":"    mode: \"0770\""},{"line_number":12,"context_line":"  when: inventory_hostname \u003d\u003d groups[nova_cell_conductor_group][0]"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"- name: Copying over config.json files for nova-cell-bootstrap"},{"line_number":15,"context_line":"  become: true"}],"source_content_type":"text/x-yaml","patch_set":15,"id":"2230b7d4_c7f50b26","line":12,"range":{"start_line":12,"start_character":0,"end_line":12,"end_character":2},"updated":"2024-11-26 17:43:55.000000000","message":"not sure, but what ensures that `mode` is set correctly on secondary nodes?\nBecause that seems to be lacking somehow.\n\nNot sure if/why this is the first changeset to trigger this, but from my current understanding either the permission need to be set on all nodes, or we need to relax the check in `check-config.sh` to not look for bootstrap folder permissions on secondary hosts.\n\nThis got introduced in: https://review.opendev.org/c/openstack/kolla-ansible/+/675659\nBut it was not a topic that came up during that review, as far as I can see.\n\nI would appreciate comments from people more familiar with nova-cell bootstrapping, will look into it myself, but I first need to read up a bit on this code part, before I can comment in detail.\n\nThanks","commit_id":"2a1d153987d5f7406f92f4f0f213ff8acc515907"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"247867d75c8d1e5c8a305a7b722ff67fd9554695","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    owner: \"{{ config_owner_user }}\""},{"line_number":10,"context_line":"    group: \"{{ config_owner_group }}\""},{"line_number":11,"context_line":"    mode: \"0770\""},{"line_number":12,"context_line":"  when: inventory_hostname \u003d\u003d groups[nova_cell_conductor_group][0]"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"- name: Copying over config.json files for nova-cell-bootstrap"},{"line_number":15,"context_line":"  become: true"}],"source_content_type":"text/x-yaml","patch_set":15,"id":"d7952603_fe565b9c","line":12,"range":{"start_line":12,"start_character":0,"end_line":12,"end_character":2},"in_reply_to":"2230b7d4_c7f50b26","updated":"2024-11-27 11:25:37.000000000","message":"12:12 \u003ckevko\u003e SvenKieske: i probably know what triggered permissions check fail \n12:15 \u003ckevko\u003e SvenKieske: point is that without TLS to mariadb there is a container for bootstrap cell right ? ...it\u0027s done on servers[0] .... BUT i\u0027ve added support to completly switch to TLS ...so i needed to import copy-config role (or what is the name) ... which produced /etc/kolla/nova-cell-bootstrap.... on every host ...but then task which changing permissions touch only the servers[0] ... so ..before the script was checking all for 0770 .. and when it wasn\u0027t on other hosts ..it\u0027s ok ...but now it\u0027s on every host ...but kolla-ansible change only on first ...\n12:15 \u003ckevko\u003e SvenKieske: so i think the solution is fix all permissions ..or import role and add when servers[0]\n12:15 \u003cSvenKieske\u003e yep\n12:15 \u003ckevko\u003e so the bootstrap folder under /etc/kolla will be created only on server[0] ..as before ...\n12:16 \u003cSvenKieske\u003e But I was wondering: that cert directory will end up on all servers anyway, no? so what is fixing permissions before your change? or don\u0027t we have certs distributed on all servers before your change?\n12:16 \u003ckevko\u003e (but my opinion is that it should be everywhere ...as host[0] is bad from the beginning)\n12:16 \u003cSvenKieske\u003e not sure I understand 100% the situation before your patch :D\n12:16 \u003cSvenKieske\u003e yep, host[0] is somehow an antipattern I think, don\n12:17 \u003cSvenKieske\u003e \u0027t want to grep where we have that everywhere..\n12:17 \u003ckevko\u003e SvenKieske: okay, again ...there is nova-cell-bootstrap container ...which done something OK ? \n12:17 \u003ckevko\u003e SvenKieske: but there is only config.json ..nova.conf and that\u0027s it ...right ? \n12:17 \u003ckevko\u003e SvenKieske: so there is simple task to ensure that files exist ..and then run container which do some work ...\n12:18 \u003ckevko\u003e SvenKieske: BUT ... if you are using TLS ... you need to have root.crt imported into nova-cell-bootstrap container when it\u0027s boostraping ..\n12:19 \u003ckevko\u003e SvenKieske: so I took the common role to achieve cert copy inside /etc/kolla/nova-cell-boostrap -\u003e https://review.opendev.org/c/openstack/kolla-ansible/+/933924/15/ansible/roles/nova-cell/tasks/config_bootstrap.yml\n12:19 \u003ckevko\u003e SvenKieske: after this it\u0027s working ... but problem is that I missed when: inventory_hostname \u003d\u003d groups[nova_cell_conductor_group][0]  during the import ...\n12:20 \u003ckevko\u003e SvenKieske: so it actually created folder and ca-certificates as it is on my testing stack -\u003e https://paste.openstack.org/show/bkP8JVvqTDvW8EmemRzg/\n12:23 \u003copendevreview\u003e Michal Arbet proposed openstack/kolla-ansible master: Add TLS support for MariaDB Connections  https://review.opendev.org/c/openstack/kolla-ansible/+/933924\n12:23 \u003ckevko\u003e SvenKieske: TLDR , simply said ...this should fix :D ^^","commit_id":"2a1d153987d5f7406f92f4f0f213ff8acc515907"}],"ansible/roles/nova-cell/tasks/create_cells.yml":[{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"35523e1a9052a7db5fef20a777ebc233b129130d","unresolved":true,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"- name: Update cell"},{"line_number":32,"context_line":"  vars:"},{"line_number":33,"context_line":"    nova_cell_database_url: \"mysql+pymysql://{{ nova_cell_database_user }}:{{ nova_cell_database_password }}@{{ nova_cell_database_address | put_address_in_context(\u0027url\u0027) }}:{{ nova_cell_database_port }}/{{ nova_cell_database_name }}\"  # noqa 204{{ \u0027?ssl_ca\u003d\u0027 ~ openstack_cacert if nova-cell_database_enable_tls_internal | bool }}"},{"line_number":34,"context_line":"    nova_conductor: \"{{ nova_cell_services[\u0027nova-conductor\u0027] }}\""},{"line_number":35,"context_line":"  become: true"},{"line_number":36,"context_line":"  kolla_container:"}],"source_content_type":"text/x-yaml","patch_set":47,"id":"39183717_47acc134","line":33,"updated":"2025-07-04 09:44:46.000000000","message":"typo","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"643ced864374dcd1cedb147aa649e6295f92d39c","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"- name: Update cell"},{"line_number":32,"context_line":"  vars:"},{"line_number":33,"context_line":"    nova_cell_database_url: \"mysql+pymysql://{{ nova_cell_database_user }}:{{ nova_cell_database_password }}@{{ nova_cell_database_address | put_address_in_context(\u0027url\u0027) }}:{{ nova_cell_database_port }}/{{ nova_cell_database_name }}\"  # noqa 204{{ \u0027?ssl_ca\u003d\u0027 ~ openstack_cacert if nova-cell_database_enable_tls_internal | bool }}"},{"line_number":34,"context_line":"    nova_conductor: \"{{ nova_cell_services[\u0027nova-conductor\u0027] }}\""},{"line_number":35,"context_line":"  become: true"},{"line_number":36,"context_line":"  kolla_container:"}],"source_content_type":"text/x-yaml","patch_set":47,"id":"64820cfd_d4dd2426","line":33,"in_reply_to":"39183717_47acc134","updated":"2025-07-09 11:33:01.000000000","message":"Done","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"}],"ansible/roles/octavia/templates/octavia.conf.j2":[{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"35523e1a9052a7db5fef20a777ebc233b129130d","unresolved":true,"context_lines":[{"line_number":171,"context_line":"jobboard_redis_sentinel \u003d kolla"},{"line_number":172,"context_line":"jobboard_redis_sentinel_ssl_options \u003d ssl:False"},{"line_number":173,"context_line":"persistence_connection \u003d mysql+pymysql://{{ octavia_persistence_database_user }}:{{ octavia_persistence_database_password }}@{{ octavia_persistence_database_address }}/{{ octavia_persistence_database_name }}{{ \u0027?ssl_ca\u003d\u0027 ~ openstack_cacert if octavia_database_enable_tls_internal | bool }}"},{"line_number":174,"context_line":"jobboard_enabled \u003d true"},{"line_number":175,"context_line":"jobboard_backend_password \u003d \"{{ redis_master_password }}\""},{"line_number":176,"context_line":"jobboard_backend_port \u003d \"{{ redis_port }}\""},{"line_number":177,"context_line":"jobboard_backend_hosts \u003d {% for host in groups[\u0027redis\u0027] %}{{ \u0027api\u0027 | kolla_address(host) | put_address_in_context(\u0027url\u0027) }}{% if not loop.last %},{% endif %}{% endfor %}"}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"426e1bec_2e1c7046","line":174,"updated":"2025-07-04 09:44:46.000000000","message":"several duplicate vars","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"ae8d93769bcb5e69e43661380bda813b1dc50047","unresolved":false,"context_lines":[{"line_number":171,"context_line":"jobboard_redis_sentinel \u003d kolla"},{"line_number":172,"context_line":"jobboard_redis_sentinel_ssl_options \u003d ssl:False"},{"line_number":173,"context_line":"persistence_connection \u003d mysql+pymysql://{{ octavia_persistence_database_user }}:{{ octavia_persistence_database_password }}@{{ octavia_persistence_database_address }}/{{ octavia_persistence_database_name }}{{ \u0027?ssl_ca\u003d\u0027 ~ openstack_cacert if octavia_database_enable_tls_internal | bool }}"},{"line_number":174,"context_line":"jobboard_enabled \u003d true"},{"line_number":175,"context_line":"jobboard_backend_password \u003d \"{{ redis_master_password }}\""},{"line_number":176,"context_line":"jobboard_backend_port \u003d \"{{ redis_port }}\""},{"line_number":177,"context_line":"jobboard_backend_hosts \u003d {% for host in groups[\u0027redis\u0027] %}{{ \u0027api\u0027 | kolla_address(host) | put_address_in_context(\u0027url\u0027) }}{% if not loop.last %},{% endif %}{% endfor %}"}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"73da957d_9d05760d","line":174,"in_reply_to":"426e1bec_2e1c7046","updated":"2025-07-09 11:41:52.000000000","message":"Good catch, bad rebase, thanks.","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"}],"ansible/roles/venus/templates/venus.conf.j2":[{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"35523e1a9052a7db5fef20a777ebc233b129130d","unresolved":true,"context_lines":[{"line_number":16,"context_line":"transport_url \u003d {{ rpc_transport_url }}"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"[database]"},{"line_number":19,"context_line":"connection \u003d mysql+pymysql://{{ venus_database_user }}:{{ venus_database_password }}@{{ venus_database_address }}/{{ venus_database_name }}?charset\u003dutf8{{ \u0027?ssl_ca\u003d\u0027 ~ openstack_cacert if venus_database_enable_tls_internal | bool }}"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"[keystone_authtoken]"},{"line_number":22,"context_line":"cafile \u003d {{ openstack_cacert }}"}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"77a54d31_110578be","line":19,"updated":"2025-07-04 09:44:46.000000000","message":"it would render double \"?\"","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"ae8d93769bcb5e69e43661380bda813b1dc50047","unresolved":false,"context_lines":[{"line_number":16,"context_line":"transport_url \u003d {{ rpc_transport_url }}"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"[database]"},{"line_number":19,"context_line":"connection \u003d mysql+pymysql://{{ venus_database_user }}:{{ venus_database_password }}@{{ venus_database_address }}/{{ venus_database_name }}?charset\u003dutf8{{ \u0027?ssl_ca\u003d\u0027 ~ openstack_cacert if venus_database_enable_tls_internal | bool }}"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"[keystone_authtoken]"},{"line_number":22,"context_line":"cafile \u003d {{ openstack_cacert }}"}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"7f984c13_babd85eb","line":19,"in_reply_to":"52481437_c4f45a04","updated":"2025-07-09 11:41:52.000000000","message":"Aaaaaaaa, I got it ?ssl_ca is of course bad .... fixed to be \u0026ssl_ca , good catch, thanks !","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"ec16d592eac2c5787616d2333172d0bf476b0bf3","unresolved":true,"context_lines":[{"line_number":16,"context_line":"transport_url \u003d {{ rpc_transport_url }}"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"[database]"},{"line_number":19,"context_line":"connection \u003d mysql+pymysql://{{ venus_database_user }}:{{ venus_database_password }}@{{ venus_database_address }}/{{ venus_database_name }}?charset\u003dutf8{{ \u0027?ssl_ca\u003d\u0027 ~ openstack_cacert if venus_database_enable_tls_internal | bool }}"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"[keystone_authtoken]"},{"line_number":22,"context_line":"cafile \u003d {{ openstack_cacert }}"}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"52481437_c4f45a04","line":19,"in_reply_to":"77a54d31_110578be","updated":"2025-07-09 11:31:19.000000000","message":"What do you mean double ? This is just following the same approach as in other files ... for example glance \n\n [database]\n-connection \u003d mysql+pymysql://{{ glance_database_user }}:{{ glance_database_password }}@{{ glance_database_address }}/{{ glance_database_name }}\n+connection \u003d mysql+pymysql://{{ glance_database_user }}:{{ glance_database_password }}@{{ glance_database_address }}/{{ glance_database_name }}{{ \u0027?ssl_ca\u003d\u0027 ~ openstack_cacert if glance_database_enable_tls_internal | bool }}\n\nLeaving open, @bartosz@stackhpc.com I really can\u0027t see any issue, what do you mean double ?","commit_id":"06121ac7cdb3890f261619aea8129a23a567d550"}],"releasenotes/notes/tls-for-database-6b203025b6f31a17.yaml":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"60c778656ced8b9b071a7c18ee27868d530600a8","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    TLS support for MariaDB connections has been enabled for all services."}],"source_content_type":"text/x-yaml","patch_set":35,"id":"66b01d18_9d503991","line":4,"updated":"2024-12-18 10:59:06.000000000","message":"when using ProxySQL","commit_id":"256cacb0499fe13bfa2e0b382c70d39c3d344798"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"d4a8745815241dfcfb5b10086024da13c546e2c8","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    TLS support for MariaDB connections has been enabled for all services."}],"source_content_type":"text/x-yaml","patch_set":35,"id":"bc279651_94c9bf03","line":4,"in_reply_to":"66b01d18_9d503991","updated":"2024-12-18 11:02:11.000000000","message":"ack","commit_id":"256cacb0499fe13bfa2e0b382c70d39c3d344798"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"1092911f2c7d9b7b92586a25c2c4148ba9955297","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    TLS support for MariaDB connections has been enabled for all services."}],"source_content_type":"text/x-yaml","patch_set":35,"id":"ea5acb3f_9f067bdd","line":4,"in_reply_to":"bc279651_94c9bf03","updated":"2025-04-09 10:48:15.000000000","message":"Done","commit_id":"256cacb0499fe13bfa2e0b382c70d39c3d344798"}]}