)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"e8fd6d448284045bb492662e10534d3deef16c34","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"27bdb959_ac3b7331","updated":"2025-03-26 19:45:27.000000000","message":"Why is the CI not failing without this patch? I assume we’re using backend TLS?","commit_id":"6b5f7a1dd82035d2cace4b5d9a823aaf7e704391"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"3e19e33db58099e911ba7531d44edc9cce829b25","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"546296d4_fde12a1a","updated":"2025-04-01 09:35:48.000000000","message":"there is another complex topic for mariadb tls https://review.opendev.org/q/topic:%22proxysql-and-tls%22","commit_id":"6b5f7a1dd82035d2cace4b5d9a823aaf7e704391"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"3d329b9102869af5dafb99d2fe5dcf4b35a430e4","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"1b302930_b9d99823","in_reply_to":"27bdb959_ac3b7331","updated":"2025-03-27 11:02:13.000000000","message":"Does the CI use self-signed cert?","commit_id":"6b5f7a1dd82035d2cace4b5d9a823aaf7e704391"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"41c6ad89bd4114294caad550eba1065a203939a0","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"f281e0f5_12fea0d6","updated":"2025-06-19 12:43:57.000000000","message":"Here is something the user is doing wrong. Our CI has TLS enabled and uses the standard kolla-Ansible certificates, which generate self-signed certificates, and everything works correctly. Keystone must trust the backend certificate if the CA is imported which it is for example, here \u003e\u003e \n\nhttps://storage.gra.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_fc1/openstack/fc17e9c595ef4c74866af76efa5b03fe/primary/logs/kolla_configs/keystone/keystone.conf\n\nhttps://storage.gra.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_fc1/openstack/fc17e9c595ef4c74866af76efa5b03fe/primary/logs/kolla_configs/keystone/ca-certificates/index.html\n\nPlease, write CI patch to show us ..where the problem actually is.","commit_id":"4483834234ef9914e76c409a4a7a3ebfc040e493"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"2584567b33e860a035a4bb0ff9046430db53f4f3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"918393a4_27f7f5ba","updated":"2025-04-02 08:26:21.000000000","message":"In bugreport you are talking about self-signed backend API cert ..while in this patch you are trying to fix DB cert ? \n\nEven if it is self-signed ... kolla containers should copy and trust, can u share your globals into bugreport please ? \n\nWhat about kolla_copy_ca_into_containers ? Do you have this set ?  \nAlso, what about your openstack_cacert ?","commit_id":"4483834234ef9914e76c409a4a7a3ebfc040e493"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"7072efbfcadbb2f3c4d9251787a91ebec214d11e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"e1e7b726_b97dfdbd","updated":"2025-07-02 09:20:48.000000000","message":"Sorry, I finally found that this was caused by the combination of bug from ProxySQL https://github.com/sysown/proxysql/issues/4877 and our environment using intermediate CA between root CA and leaf certs.\nI\u0027ll close this and the bug report","commit_id":"4483834234ef9914e76c409a4a7a3ebfc040e493"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"d56784edaea7c8dae191ed8ee04ff982fcbdec9c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"c01f38e8_373ef71a","updated":"2025-04-02 09:29:06.000000000","message":"can u try with patch I\u0027ve asked in your another review please ?","commit_id":"4483834234ef9914e76c409a4a7a3ebfc040e493"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"5fef07115f68a5c454f4c9dfb8bfa37b6b989e7f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"01892a66_97b531d9","in_reply_to":"918393a4_27f7f5ba","updated":"2025-04-02 09:26:20.000000000","message":"I\u0027m not trying to fix DB cert. I\u0027m trying to add DB cert to the trusted root CAs for keystone containers.\nIf it is self signed, keystone can\u0027t verify the cert with current set of trusted CA.\n\nAdded my globals.yml to the bug report now\n\n``kolla_copy_ca_into_containers: \u0027yes\u0027``\n``openstack_cacert: /etc/ssl/certs/ca-certificates.crt``","commit_id":"4483834234ef9914e76c409a4a7a3ebfc040e493"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"fcceb5356c8cbaf35f52eee526a5f100a977f13b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"07275274_acf55b94","in_reply_to":"c01f38e8_373ef71a","updated":"2025-04-03 11:15:41.000000000","message":"I tested a deployment with https://review.opendev.org/c/openstack/kolla-ansible/+/937108 , https://review.opendev.org/c/openstack/kolla-ansible/+/946022 and https://review.opendev.org/c/openstack/kolla-ansible/+/945645 and all services were deployed with no problem.\nThe cloud also passed refstack tempest test","commit_id":"4483834234ef9914e76c409a4a7a3ebfc040e493"}],"ansible/roles/keystone/tasks/copy-certs.yml":[{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"4195dc9d4a532423c2ffa2a1fc2bde3348c7fd9a","unresolved":true,"context_lines":[{"line_number":10,"context_line":"    certs:"},{"line_number":11,"context_line":"      - \"{{ kolla_certificates_dir }}/{{ inventory_hostname }}/mariadb-cert.pem\""},{"line_number":12,"context_line":"      - \"{{ kolla_certificates_dir }}/{{ inventory_hostname }}-cert.pem\""},{"line_number":13,"context_line":"      - \"{{ kolla_certificates_dir }}/{{ project_name }}-cert.pem\""},{"line_number":14,"context_line":"      - \"{{ kolla_tls_backend_cert }}\""},{"line_number":15,"context_line":"    backend_tls_cert: \"{{ lookup(\u0027first_found\u0027, certs) }}\""},{"line_number":16,"context_line":"    project_services: \"{{ keystone_services }}\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"fba18871_e19e7666","line":13,"updated":"2025-04-01 06:21:30.000000000","message":"This would be `keystone-cert.pem`, wouldn\u0027t we rather want `mariadb-cert.pem` matching the host-specific name above?","commit_id":"6b5f7a1dd82035d2cace4b5d9a823aaf7e704391"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"3b164859ac97ba3fb049dc2b2cd654a5195d6ce8","unresolved":false,"context_lines":[{"line_number":10,"context_line":"    certs:"},{"line_number":11,"context_line":"      - \"{{ kolla_certificates_dir }}/{{ inventory_hostname }}/mariadb-cert.pem\""},{"line_number":12,"context_line":"      - \"{{ kolla_certificates_dir }}/{{ inventory_hostname }}-cert.pem\""},{"line_number":13,"context_line":"      - \"{{ kolla_certificates_dir }}/{{ project_name }}-cert.pem\""},{"line_number":14,"context_line":"      - \"{{ kolla_tls_backend_cert }}\""},{"line_number":15,"context_line":"    backend_tls_cert: \"{{ lookup(\u0027first_found\u0027, certs) }}\""},{"line_number":16,"context_line":"    project_services: \"{{ keystone_services }}\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"d7cee233_53726c62","line":13,"in_reply_to":"fba18871_e19e7666","updated":"2025-04-01 14:51:56.000000000","message":"Nice catch. Yes you\u0027re right.","commit_id":"6b5f7a1dd82035d2cace4b5d9a823aaf7e704391"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"4195dc9d4a532423c2ffa2a1fc2bde3348c7fd9a","unresolved":true,"context_lines":[{"line_number":22,"context_line":"  when:"},{"line_number":23,"context_line":"    - kolla_copy_backend_tls_files | bool"},{"line_number":24,"context_line":"    - kolla_copy_ca_into_containers | bool"},{"line_number":25,"context_line":"  with_dict: \"{{ project_services | select_services_enabled_and_mapped_to_host }}\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"aa4ca751_b9e09a71","line":25,"updated":"2025-04-01 06:21:30.000000000","message":"shouldn\u0027t this also notify a container restart like the service-cert-copy role does for each copy task?","commit_id":"6b5f7a1dd82035d2cace4b5d9a823aaf7e704391"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"3b164859ac97ba3fb049dc2b2cd654a5195d6ce8","unresolved":true,"context_lines":[{"line_number":22,"context_line":"  when:"},{"line_number":23,"context_line":"    - kolla_copy_backend_tls_files | bool"},{"line_number":24,"context_line":"    - kolla_copy_ca_into_containers | bool"},{"line_number":25,"context_line":"  with_dict: \"{{ project_services | select_services_enabled_and_mapped_to_host }}\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"6915b119_967ae5ab","line":25,"in_reply_to":"aa4ca751_b9e09a71","updated":"2025-04-01 14:51:56.000000000","message":"I thought we don\u0027t do that anymore: https://review.opendev.org/c/openstack/kolla-ansible/+/924651","commit_id":"6b5f7a1dd82035d2cace4b5d9a823aaf7e704391"}]}