)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"c78dd0818292e98db97efd6614ffea352d5c16f9","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"05a9c729_dc03a7ca","updated":"2025-11-24 18:45:37.000000000","message":"recheck centos","commit_id":"279510a8855491952b290cd224629aa827de25ab"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f0bb823b205002bbf0950f2520aba4cef0b867fa","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":16,"id":"b41e1764_a2f7f8e6","updated":"2026-01-27 18:30:01.000000000","message":"recheck libvirt-ceph-invalid-argument","commit_id":"7bed18cdb186c22509d8d0d1e2ce1c0ad0986791"},{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"f9be75e90e82ea736bc58c1d5a9b579c89269c04","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":19,"id":"3f7caba1_7d44408c","updated":"2026-02-18 19:35:58.000000000","message":"LGTM, threads should be resolved tho","commit_id":"d93142fad415021ddf0ea0f04a9d0ddbfaddaa95"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"c020e9aae84a8da15bfb019666d8b0a1d2d9b77a","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":19,"id":"fa75caa2_3c405c57","updated":"2026-02-16 18:46:32.000000000","message":"recheck node failure","commit_id":"d93142fad415021ddf0ea0f04a9d0ddbfaddaa95"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"da337d1cf22e031371a3c433ce63811e05ede667","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":19,"id":"e3af4036_c3d17718","updated":"2026-02-16 09:11:12.000000000","message":"recheck nova return 502s because of neutron returning 401s","commit_id":"d93142fad415021ddf0ea0f04a9d0ddbfaddaa95"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"393580c9a93cda621441896e685c3414f78767b2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":20,"id":"0bbcbe41_610b9715","updated":"2026-03-11 04:04:30.000000000","message":"recheck","commit_id":"bded4a9aa368b7d1870e8b0809d90d2fe1c447d1"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"fad0396dcb11478a1eab89a3084b380e5978c730","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":20,"id":"03eb4bde_64e25b7d","updated":"2026-03-13 06:20:05.000000000","message":"recheck everything-failed","commit_id":"bded4a9aa368b7d1870e8b0809d90d2fe1c447d1"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"0e98efbe97225d193e7888c4c127eb8d47fcca4c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":20,"id":"ec120912_1b2ef0e3","updated":"2026-03-10 21:55:38.000000000","message":"recheck mysql timeouts break neutron","commit_id":"bded4a9aa368b7d1870e8b0809d90d2fe1c447d1"},{"author":{"_account_id":17669,"name":"Doug Szumski","email":"doug@stackhpc.com","username":"DougSzumski"},"change_message_id":"4bcbcce617095c1b70797a8a193a174c9411284e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":28,"id":"2982ddd8_7a24441a","updated":"2026-04-09 10:45:45.000000000","message":"This is a nice piece of work, thanks Michael. A couple of small questions inline, but it looks pretty much ready to land IMO.","commit_id":"836fa71faa1b9a9e43eee36b6c276270cc592626"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"beb514956a9813fed53a00cb2cfc10fdd6e6af61","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":29,"id":"08a76691_5193406f","updated":"2026-04-10 07:13:00.000000000","message":"I am still seeking a combination of permissions for the new files in /etc/pki which actually results in a working SPICE session. Please do not merge this until I have confirmed that I have this working.","commit_id":"9ef9c1dadcb8bc4d04297360c02c5c8c49663885"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"514b2e3ff2c3b1e2d414f7ed78510d62856bc5ca","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":29,"id":"4cd5f6f3_fa3b6616","updated":"2026-04-10 00:31:29.000000000","message":"This permissions change is causing issues in my private CI runs:\n\n```\n2026-04-10T00:17:25.823740Z qemu-system-x86_64: failed to initialize spice server\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest Traceback (most recent call last):\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest   File \"/var/lib/kolla/venv/lib/python3.13/site-packages/nova/virt/libvirt/guest.py\", line 159, in launch\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest     return self._domain.createWithFlags(flags)\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest   File \"/var/lib/kolla/venv/lib/python3.13/site-packages/eventlet/tpool.py\", line 186, in doit\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest     result \u003d proxy_call(self._autowrap, f, *args, **kwargs)\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest   File \"/var/lib/kolla/venv/lib/python3.13/site-packages/eventlet/tpool.py\", line 144, in proxy_call\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest     rv \u003d execute(f, *args, **kwargs)\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest   File \"/var/lib/kolla/venv/lib/python3.13/site-packages/eventlet/tpool.py\", line 125, in execute\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest     raise e.with_traceback(tb)\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest   File \"/var/lib/kolla/venv/lib/python3.13/site-packages/eventlet/tpool.py\", line 82, in tworker\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest     rv \u003d meth(*args, **kwargs)\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest   File \"/usr/lib/python3/dist-packages/libvirt.py\", line 1426, in createWithFlags\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest     raise libvirtError(\u0027virDomainCreateWithFlags() failed\u0027)\n2026-04-10 00:17:25.971 7 ERROR nova.virt.libvirt.guest libvirt.libvirtError: internal error: process exited while connecting to monitor: 2026-04-10T00:17:25.822902Z qemu-system-x86_64: warning: Spice: ../server/reds.cpp:2838:reds_init_ssl: Could not load certificates from /etc/pki/libvirt-spice/server-cert.pem\n```\n\nlibvirt is running as root in the nova_libvirt container, but the qemu process that is the VMM for the instance (which I think is where this error is coming from) runs as the nova user. Perhaps setting the group for these files to nova or qemu and then adding read permissions for the group will help.\n\nI will iterate.","commit_id":"9ef9c1dadcb8bc4d04297360c02c5c8c49663885"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"2ce48189b5199e2253f544e96929f2f771eca144","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":30,"id":"da365f0f_190ac27e","updated":"2026-04-11 11:08:03.000000000","message":"Ok, this should be working again now.","commit_id":"8e62cd1e048c9a4eca5f49ec64503c7437f46d1a"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"dbd24d80ea2da21160ae64d6e4f66a3afc5787dd","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":30,"id":"8cbf17ed_a5d33282","updated":"2026-04-12 10:10:08.000000000","message":"thx for the update","commit_id":"8e62cd1e048c9a4eca5f49ec64503c7437f46d1a"},{"author":{"_account_id":17669,"name":"Doug Szumski","email":"doug@stackhpc.com","username":"DougSzumski"},"change_message_id":"d28d92f7c1809639f88542886c3f2c85744589e7","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":34,"id":"0272c126_2696beb2","updated":"2026-05-08 08:32:20.000000000","message":"Don\u0027t merge until we have the green light from @mnasiadka@gmail.com","commit_id":"dbbd159cb616523379086d12cf3b42944ffed118"},{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"fd56d2690b3af832136fdc00a6863ea72bee41d1","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":34,"id":"5d6b73ac_353d497a","in_reply_to":"0272c126_2696beb2","updated":"2026-05-09 08:43:22.000000000","message":"unresolve for visibility","commit_id":"dbbd159cb616523379086d12cf3b42944ffed118"},{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"65e44015fb016c4b2f243ccf7e29a6ba89a1616f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":34,"id":"10f41d5b_fb17bc20","in_reply_to":"5d6b73ac_353d497a","updated":"2026-05-20 06:39:57.000000000","message":"Done","commit_id":"dbbd159cb616523379086d12cf3b42944ffed118"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"093ce39fd33867bd5c0a3ec827cb86207f1a1862","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":43,"id":"86c5d1b2_670b204d","updated":"2026-05-14 20:46:44.000000000","message":"As seen in the zuul failure at https://zuul.opendev.org/t/openstack/build/8558f7c9dbdc4eea8b523726f2f5ab52, the kerbside role now also requires the nova_spice_require_secure variable. As discussed earlier in this review, finding this cross-role case justifies moving it back to group_vars/all/nova.yml -- I have therefore done that.","commit_id":"0eaad383bbedf470a7b410239fdb30e655c66a35"},{"author":{"_account_id":17669,"name":"Doug Szumski","email":"doug@stackhpc.com","username":"DougSzumski"},"change_message_id":"c801bf1f58c315b12f585fd3f31a04d8d92ac2b1","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":50,"id":"e95b8d74_5ff52791","updated":"2026-05-20 09:01:41.000000000","message":"recheck","commit_id":"d7f296e04cf362ce393910e7a6aca30e1c180137"},{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"23dcc50da34c9b05885345e5b3a6c33c3a03c161","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":50,"id":"99f1ae02_b13ebc7c","updated":"2026-05-21 07:50:08.000000000","message":"recheck - rocky bug","commit_id":"d7f296e04cf362ce393910e7a6aca30e1c180137"},{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"bf8662c5fa8a38fdd8a3dd9040749c0041ac2424","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":52,"id":"a5741be9_153d1e90","updated":"2026-05-26 17:30:00.000000000","message":"This LGTM, I may not know enough about the intricacies of it to merge it but logically it looks sound.\n\nSome other core should take a look probbly","commit_id":"e39c34e2ad8b200e88197a9945985a69a8d6ddf2"}],"ansible/group_vars/all/nova.yml":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"9ed3c91fadacfb6ca07166148b6e12f054922bb7","unresolved":true,"context_lines":[{"line_number":74,"context_line":"nova_spice_zlib_compression: \"auto\""},{"line_number":75,"context_line":"nova_spice_playback_compression: \"yes\""},{"line_number":76,"context_line":"nova_spice_streaming_mode: \"filter\""},{"line_number":77,"context_line":"nova_spice_require_secure: \"no\""}],"source_content_type":"text/x-yaml","patch_set":8,"id":"6e038352_a84625ac","line":77,"updated":"2025-12-10 11:09:28.000000000","message":"Does it need to be here instead of nova-cell role?","commit_id":"b4641c90af57cb1d72cd6fdca45b015b81f65334"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"bbc40f3ae6a08d9c5488b33acdcf33884f0e16ba","unresolved":false,"context_lines":[{"line_number":74,"context_line":"nova_spice_zlib_compression: \"auto\""},{"line_number":75,"context_line":"nova_spice_playback_compression: \"yes\""},{"line_number":76,"context_line":"nova_spice_streaming_mode: \"filter\""},{"line_number":77,"context_line":"nova_spice_require_secure: \"no\""}],"source_content_type":"text/x-yaml","patch_set":8,"id":"8e6f6e2d_83a543e8","line":77,"in_reply_to":"12562972_904c4e85","updated":"2026-03-25 10:53:25.000000000","message":"\"all in one place\" sounds like a reasonable strategy to me here","commit_id":"b4641c90af57cb1d72cd6fdca45b015b81f65334"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"3cf5a596719581f2eaf41dfdb426efc00d517f69","unresolved":true,"context_lines":[{"line_number":74,"context_line":"nova_spice_zlib_compression: \"auto\""},{"line_number":75,"context_line":"nova_spice_playback_compression: \"yes\""},{"line_number":76,"context_line":"nova_spice_streaming_mode: \"filter\""},{"line_number":77,"context_line":"nova_spice_require_secure: \"no\""}],"source_content_type":"text/x-yaml","patch_set":8,"id":"12562972_904c4e85","line":77,"in_reply_to":"6e038352_a84625ac","updated":"2026-01-22 21:23:56.000000000","message":"I am a bit conflicted about this -- the other SPICE configuration options are set here which makes them available to both the \"nova\" and the \"nova-cells\" roles. While it is true that some of these values are only used in nova-cells, it feels confusing to me that some variables would be in one place and some others would be in another if I was looking for the default for a specific variable.\n\nI can see that swtpm is set in nova-cells/defaults/main.yml, but I can\u0027t see any other obvious examples of this sort of global value being there instead of in the group_vars.\n\nI am happy to go either way, I think what I am trying to say is \"this feels cleaner to me\".","commit_id":"b4641c90af57cb1d72cd6fdca45b015b81f65334"},{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"f9be75e90e82ea736bc58c1d5a9b579c89269c04","unresolved":true,"context_lines":[{"line_number":74,"context_line":"nova_spice_zlib_compression: \"auto\""},{"line_number":75,"context_line":"nova_spice_playback_compression: true"},{"line_number":76,"context_line":"nova_spice_streaming_mode: \"filter\""},{"line_number":77,"context_line":"nova_spice_require_secure: false"}],"source_content_type":"text/x-yaml","patch_set":19,"id":"caab1c58_41be9cce","line":77,"range":{"start_line":77,"start_character":0,"end_line":77,"end_character":2},"updated":"2026-02-18 19:35:58.000000000","message":"Should it default to {{ libvirt_tls }} I feel like if you already configured libvirt for tls, this is a quick additional option that costs us nothing ?","commit_id":"d93142fad415021ddf0ea0f04a9d0ddbfaddaa95"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"bbc40f3ae6a08d9c5488b33acdcf33884f0e16ba","unresolved":false,"context_lines":[{"line_number":74,"context_line":"nova_spice_zlib_compression: \"auto\""},{"line_number":75,"context_line":"nova_spice_playback_compression: true"},{"line_number":76,"context_line":"nova_spice_streaming_mode: \"filter\""},{"line_number":77,"context_line":"nova_spice_require_secure: false"}],"source_content_type":"text/x-yaml","patch_set":19,"id":"5374f1a6_f223cd78","line":77,"range":{"start_line":77,"start_character":0,"end_line":77,"end_character":2},"in_reply_to":"8b78ba31_45130498","updated":"2026-03-25 10:53:25.000000000","message":"Acknowledged","commit_id":"d93142fad415021ddf0ea0f04a9d0ddbfaddaa95"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"a6f22457454a07ca4b4419ffce578258f56f9410","unresolved":true,"context_lines":[{"line_number":74,"context_line":"nova_spice_zlib_compression: \"auto\""},{"line_number":75,"context_line":"nova_spice_playback_compression: true"},{"line_number":76,"context_line":"nova_spice_streaming_mode: \"filter\""},{"line_number":77,"context_line":"nova_spice_require_secure: false"}],"source_content_type":"text/x-yaml","patch_set":19,"id":"8b78ba31_45130498","line":77,"range":{"start_line":77,"start_character":0,"end_line":77,"end_character":2},"in_reply_to":"caab1c58_41be9cce","updated":"2026-02-18 23:30:32.000000000","message":"Sadly no. The HTML5 SPICE client built into Horizon does not support secure SPICE sessions, so if we turned it on without the deployer opting in we might break Horizon. I have some background level of intent to have a go at fixing that HTML5 client, but haven\u0027t managed to find the time yet.","commit_id":"d93142fad415021ddf0ea0f04a9d0ddbfaddaa95"}],"ansible/roles/nova-cell/defaults/main.yml":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"640a63293aef5728cdac74696ebf37e425d74089","unresolved":true,"context_lines":[{"line_number":678,"context_line":"##################"},{"line_number":679,"context_line":"# Spice options"},{"line_number":680,"context_line":"##################"},{"line_number":681,"context_line":""},{"line_number":682,"context_line":"nova_spice_require_secure: false"},{"line_number":683,"context_line":""},{"line_number":684,"context_line":"###################"}],"source_content_type":"text/x-yaml","patch_set":26,"id":"f41ca801_f614089d","line":681,"updated":"2026-04-08 10:34:32.000000000","message":"nit: No need for that extra newline","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"62cd2e24318488cbedabad8e888e1a1cc1fbe273","unresolved":false,"context_lines":[{"line_number":678,"context_line":"##################"},{"line_number":679,"context_line":"# Spice options"},{"line_number":680,"context_line":"##################"},{"line_number":681,"context_line":""},{"line_number":682,"context_line":"nova_spice_require_secure: false"},{"line_number":683,"context_line":""},{"line_number":684,"context_line":"###################"}],"source_content_type":"text/x-yaml","patch_set":26,"id":"f3d1ee93_6b9b4374","line":681,"in_reply_to":"f41ca801_f614089d","updated":"2026-04-09 07:26:08.000000000","message":"Done","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"}],"ansible/roles/nova-cell/tasks/precheck.yml":[{"author":{"_account_id":17669,"name":"Doug Szumski","email":"doug@stackhpc.com","username":"DougSzumski"},"change_message_id":"4bcbcce617095c1b70797a8a193a174c9411284e","unresolved":true,"context_lines":[{"line_number":133,"context_line":"    - not nova_libvirt.enabled | bool"},{"line_number":134,"context_line":"    - inventory_hostname in groups[nova_libvirt.group]"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"- name: Checking certificate files exist for secure SPICE connections"},{"line_number":137,"context_line":"  vars:"},{"line_number":138,"context_line":"    nova_libvirt: \"{{ nova_cell_services[\u0027nova-libvirt\u0027] }}\""},{"line_number":139,"context_line":"  ansible.builtin.stat:"}],"source_content_type":"text/x-yaml","patch_set":28,"id":"29e55867_fff8ee35","line":136,"updated":"2026-04-09 10:45:45.000000000","message":"Instead of this task, I think we could simply fail the play with a helpful error message if `libvirt_tls` is false when nova_spice_require_secure is true?","commit_id":"836fa71faa1b9a9e43eee36b6c276270cc592626"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"ce399ef13ab4823916f84ccf262194a17051e7d0","unresolved":false,"context_lines":[{"line_number":133,"context_line":"    - not nova_libvirt.enabled | bool"},{"line_number":134,"context_line":"    - inventory_hostname in groups[nova_libvirt.group]"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"- name: Checking certificate files exist for secure SPICE connections"},{"line_number":137,"context_line":"  vars:"},{"line_number":138,"context_line":"    nova_libvirt: \"{{ nova_cell_services[\u0027nova-libvirt\u0027] }}\""},{"line_number":139,"context_line":"  ansible.builtin.stat:"}],"source_content_type":"text/x-yaml","patch_set":28,"id":"406d3cb8_d27abaa1","line":136,"in_reply_to":"29e55867_fff8ee35","updated":"2026-04-09 17:13:28.000000000","message":"@mnasiadka@gmail.com explicitly asked for a precheck check, so this looks right to me","commit_id":"836fa71faa1b9a9e43eee36b6c276270cc592626"},{"author":{"_account_id":17669,"name":"Doug Szumski","email":"doug@stackhpc.com","username":"DougSzumski"},"change_message_id":"862203a432a22fcd835b275cd12ca4cc7a4698bd","unresolved":false,"context_lines":[{"line_number":133,"context_line":"    - not nova_libvirt.enabled | bool"},{"line_number":134,"context_line":"    - inventory_hostname in groups[nova_libvirt.group]"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"- name: Checking certificate files exist for secure SPICE connections"},{"line_number":137,"context_line":"  vars:"},{"line_number":138,"context_line":"    nova_libvirt: \"{{ nova_cell_services[\u0027nova-libvirt\u0027] }}\""},{"line_number":139,"context_line":"  ansible.builtin.stat:"}],"source_content_type":"text/x-yaml","patch_set":28,"id":"6454acec_afd11208","line":136,"in_reply_to":"2aa9938b_dcca2e43","updated":"2026-05-08 08:20:55.000000000","message":"Many thanks for updating, looks good to me.","commit_id":"836fa71faa1b9a9e43eee36b6c276270cc592626"},{"author":{"_account_id":17669,"name":"Doug Szumski","email":"doug@stackhpc.com","username":"DougSzumski"},"change_message_id":"39c48d38711bbf7145ceb8f124787584e8a6e8da","unresolved":true,"context_lines":[{"line_number":133,"context_line":"    - not nova_libvirt.enabled | bool"},{"line_number":134,"context_line":"    - inventory_hostname in groups[nova_libvirt.group]"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"- name: Checking certificate files exist for secure SPICE connections"},{"line_number":137,"context_line":"  vars:"},{"line_number":138,"context_line":"    nova_libvirt: \"{{ nova_cell_services[\u0027nova-libvirt\u0027] }}\""},{"line_number":139,"context_line":"  ansible.builtin.stat:"}],"source_content_type":"text/x-yaml","patch_set":28,"id":"da456e3f_7a7238ce","line":136,"in_reply_to":"406d3cb8_d27abaa1","updated":"2026-04-15 10:38:53.000000000","message":"Hmm, we are relying on the libvirt_tls certs right? \n\nAnd those are copied via:\n\n``tasks/config-libvirt-tls.yml``\n\nAnd configured via:\n\n```\n    paths:\n      - \"{{ node_custom_config }}/nova/nova-libvirt/{{ inventory_hostname }}/{{ filename }}\"\n      - \"{{ node_custom_config }}/nova/nova-libvirt/{{ filename }}\"\n```\n\nNote the multiple paths, not covered by this pre-check.\n\nIn my opinion:\n\n- The pre-check should be for libvirt-tls, and is out of scope here\n- Since this feature depends on libvirt-tls being enabled, it would be helpful to assert that\n\nPerhaps I\u0027ve misunderstood something?","commit_id":"836fa71faa1b9a9e43eee36b6c276270cc592626"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"d8def57447359707e0a148f622757d134570670d","unresolved":false,"context_lines":[{"line_number":133,"context_line":"    - not nova_libvirt.enabled | bool"},{"line_number":134,"context_line":"    - inventory_hostname in groups[nova_libvirt.group]"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"- name: Checking certificate files exist for secure SPICE connections"},{"line_number":137,"context_line":"  vars:"},{"line_number":138,"context_line":"    nova_libvirt: \"{{ nova_cell_services[\u0027nova-libvirt\u0027] }}\""},{"line_number":139,"context_line":"  ansible.builtin.stat:"}],"source_content_type":"text/x-yaml","patch_set":28,"id":"2aa9938b_dcca2e43","line":136,"in_reply_to":"da456e3f_7a7238ce","updated":"2026-04-30 23:00:31.000000000","message":"Sorry, I needed some time to understand this one and then got distracted by adding rocky containers to the kolla part of the Kerbside stack. I hope this is now addressed.","commit_id":"836fa71faa1b9a9e43eee36b6c276270cc592626"}],"ansible/roles/nova-cell/templates/nova-libvirt.json.j2":[{"author":{"_account_id":35264,"name":"Alex Welsh","email":"alex@stackhpc.com","username":"alex-welsh"},"change_message_id":"af867c7916f2467bb4cedf2095fcb07596e1f8bc","unresolved":true,"context_lines":[{"line_number":73,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","},{"line_number":74,"context_line":"            \"owner\": \"root\","},{"line_number":75,"context_line":"            \"perm\": \"0600\""},{"line_number":76,"context_line":"        }{% endif %}{% if nova_spice_require_secure | bool %},"},{"line_number":77,"context_line":"        {"},{"line_number":78,"context_line":"            \"source\": \"{{ container_config_directory }}/serverkey.pem\","},{"line_number":79,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-key.pem\","}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"0b50ce2d_a48363eb","line":76,"updated":"2025-11-20 09:25:15.000000000","message":"nova_spice_require_secure appears to be undefined.\nMissing a default in ansible/roles/nova-cell/defaults/main.yml?","commit_id":"e6fa3f630112f8074e3787f51b5c10d9e917af66"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"b0d284b828b350abead10831c57f57ae8899977c","unresolved":true,"context_lines":[{"line_number":73,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","},{"line_number":74,"context_line":"            \"owner\": \"root\","},{"line_number":75,"context_line":"            \"perm\": \"0600\""},{"line_number":76,"context_line":"        }{% endif %}{% if nova_spice_require_secure | bool %},"},{"line_number":77,"context_line":"        {"},{"line_number":78,"context_line":"            \"source\": \"{{ container_config_directory }}/serverkey.pem\","},{"line_number":79,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-key.pem\","}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"a8dae5b9_f2b14dfb","line":76,"in_reply_to":"0b50ce2d_a48363eb","updated":"2025-11-21 19:49:14.000000000","message":"As an example, nova_spice_html5 is also undefined in nsible/roles/nova-cell/defaults/main.yml. That is because these variables have their default in ansible/group_vars/all/nova.yml.\n\nPerhaps this is wrong, and if so I am happy to change it, but I just modelled pre-existing variables here and I don\u0027t see the distinction between nova_spice_html5 and nova_spice_require_secure?","commit_id":"e6fa3f630112f8074e3787f51b5c10d9e917af66"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"9e50220534070a78523f4301e4efb035ca8c0071","unresolved":false,"context_lines":[{"line_number":73,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","},{"line_number":74,"context_line":"            \"owner\": \"root\","},{"line_number":75,"context_line":"            \"perm\": \"0600\""},{"line_number":76,"context_line":"        }{% endif %}{% if nova_spice_require_secure | bool %},"},{"line_number":77,"context_line":"        {"},{"line_number":78,"context_line":"            \"source\": \"{{ container_config_directory }}/serverkey.pem\","},{"line_number":79,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-key.pem\","}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"93e80b60_72db8824","line":76,"in_reply_to":"24dc6c30_18dfc227","updated":"2026-04-03 06:57:34.000000000","message":"Done","commit_id":"e6fa3f630112f8074e3787f51b5c10d9e917af66"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"849adb503e2a8bad081c4addbe3d35b2ba9e6dc8","unresolved":true,"context_lines":[{"line_number":73,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","},{"line_number":74,"context_line":"            \"owner\": \"root\","},{"line_number":75,"context_line":"            \"perm\": \"0600\""},{"line_number":76,"context_line":"        }{% endif %}{% if nova_spice_require_secure | bool %},"},{"line_number":77,"context_line":"        {"},{"line_number":78,"context_line":"            \"source\": \"{{ container_config_directory }}/serverkey.pem\","},{"line_number":79,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-key.pem\","}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"24dc6c30_18dfc227","line":76,"in_reply_to":"a8dae5b9_f2b14dfb","updated":"2026-04-03 05:19:34.000000000","message":"So, if variables need to be shared with other roles - we put them in group_vars, if not - role defaults is enough - can you move that to role defaults?","commit_id":"e6fa3f630112f8074e3787f51b5c10d9e917af66"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"640a63293aef5728cdac74696ebf37e425d74089","unresolved":true,"context_lines":[{"line_number":73,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","},{"line_number":74,"context_line":"            \"owner\": \"root\","},{"line_number":75,"context_line":"            \"perm\": \"0600\""},{"line_number":76,"context_line":"        }{% endif %}{% if nova_spice_require_secure | bool %},"},{"line_number":77,"context_line":"        {"},{"line_number":78,"context_line":"            \"source\": \"{{ container_config_directory }}/serverkey.pem\","},{"line_number":79,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-key.pem\","}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"aee8c81d_18073f0e","line":76,"updated":"2026-04-08 10:34:32.000000000","message":"Do we need a precheck to validate if the certs are there?","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"62cd2e24318488cbedabad8e888e1a1cc1fbe273","unresolved":false,"context_lines":[{"line_number":73,"context_line":"            \"dest\": \"/var/lib/kolla/share/ca-certificates\","},{"line_number":74,"context_line":"            \"owner\": \"root\","},{"line_number":75,"context_line":"            \"perm\": \"0600\""},{"line_number":76,"context_line":"        }{% endif %}{% if nova_spice_require_secure | bool %},"},{"line_number":77,"context_line":"        {"},{"line_number":78,"context_line":"            \"source\": \"{{ container_config_directory }}/serverkey.pem\","},{"line_number":79,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-key.pem\","}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"8380d4b8_4623965a","line":76,"in_reply_to":"aee8c81d_18073f0e","updated":"2026-04-09 07:26:08.000000000","message":"Done","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"b84f1251b20b1ef2728e6b93817c7beff79adf3b","unresolved":true,"context_lines":[{"line_number":76,"context_line":"        }{% endif %}{% if nova_spice_require_secure | bool %},"},{"line_number":77,"context_line":"        {"},{"line_number":78,"context_line":"            \"source\": \"{{ container_config_directory }}/serverkey.pem\","},{"line_number":79,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-key.pem\","},{"line_number":80,"context_line":"            \"owner\": \"root\","},{"line_number":81,"context_line":"            \"perm\": \"0444\""},{"line_number":82,"context_line":"        },"}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"87e90ee6_0162fd07","line":79,"range":{"start_line":79,"start_character":21,"end_line":79,"end_character":30},"updated":"2026-04-03 11:36:04.000000000","message":"RedHat systems only, need support Debian systems too","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"b633867d646f36e73b819bd3c32a4e6cffb4ebd7","unresolved":true,"context_lines":[{"line_number":76,"context_line":"        }{% endif %}{% if nova_spice_require_secure | bool %},"},{"line_number":77,"context_line":"        {"},{"line_number":78,"context_line":"            \"source\": \"{{ container_config_directory }}/serverkey.pem\","},{"line_number":79,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-key.pem\","},{"line_number":80,"context_line":"            \"owner\": \"root\","},{"line_number":81,"context_line":"            \"perm\": \"0444\""},{"line_number":82,"context_line":"        },"}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"5cb94a34_841f4bb9","line":79,"range":{"start_line":79,"start_character":21,"end_line":79,"end_character":30},"in_reply_to":"17cd6bcb_f869a557","updated":"2026-04-03 21:16:16.000000000","message":"this is not \u0027my preferred path\u0027, this is all about privilege separation and where certificate private key (at least) should be placed on the filesystem. in the Linux systems OpenSSL manages certificates and already have pre-created directories. on the Debian systems there is a /etc/ssl/.... is a root instead of /etc/pki/.... in the RedHat systems. lets see what other reviewers think.\nBTW: the directory /etc/pki/libvirt-spice also doesn\u0027t exist in the RedHat systems with correct permissions.","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"46a938d7006f1063292ebc0c545c343dc677b4d9","unresolved":false,"context_lines":[{"line_number":76,"context_line":"        }{% endif %}{% if nova_spice_require_secure | bool %},"},{"line_number":77,"context_line":"        {"},{"line_number":78,"context_line":"            \"source\": \"{{ container_config_directory }}/serverkey.pem\","},{"line_number":79,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-key.pem\","},{"line_number":80,"context_line":"            \"owner\": \"root\","},{"line_number":81,"context_line":"            \"perm\": \"0444\""},{"line_number":82,"context_line":"        },"}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"c4fffe1b_bc79dce5","line":79,"range":{"start_line":79,"start_character":21,"end_line":79,"end_character":30},"in_reply_to":"5cb94a34_841f4bb9","updated":"2026-04-08 10:29:20.000000000","message":"We use /etc/pki/libvirt all over this file, so I don\u0027t see a problem with continuing.","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"d7b2192054ff693839e4dcc46a30508e2810fc9f","unresolved":true,"context_lines":[{"line_number":76,"context_line":"        }{% endif %}{% if nova_spice_require_secure | bool %},"},{"line_number":77,"context_line":"        {"},{"line_number":78,"context_line":"            \"source\": \"{{ container_config_directory }}/serverkey.pem\","},{"line_number":79,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-key.pem\","},{"line_number":80,"context_line":"            \"owner\": \"root\","},{"line_number":81,"context_line":"            \"perm\": \"0444\""},{"line_number":82,"context_line":"        },"}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"17cd6bcb_f869a557","line":79,"range":{"start_line":79,"start_character":21,"end_line":79,"end_character":30},"in_reply_to":"87e90ee6_0162fd07","updated":"2026-04-03 19:49:53.000000000","message":"/etc/pki/ is the documented path for these certificates in the SPICE documentation -- https://people.freedesktop.org/~teuf/spice-doc/html/ch02s08.html or https://wiki.libvirt.org/TLSCreateServerCerts.html#ownership-permissions-and-selinux-labels for example.\n\nNow this might be because the authors were all RedHat-centric, but this configuration definitely works on Debian as that\u0027s where I\u0027ve done all of my testing because of the poor SPICE support in most modern RedHat-derived distributions.\n\nI cannot find any documentation that recommends a different path for TLS certificates for SPICE on Debian.\n\nOn the other hand, this is configurable and I could put it pretty much anywhere. What is your preferred path?","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"b84f1251b20b1ef2728e6b93817c7beff79adf3b","unresolved":true,"context_lines":[{"line_number":82,"context_line":"        },"},{"line_number":83,"context_line":"        {"},{"line_number":84,"context_line":"            \"source\": \"{{ container_config_directory }}/servercert.pem\","},{"line_number":85,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-cert.pem\","},{"line_number":86,"context_line":"            \"owner\": \"root\","},{"line_number":87,"context_line":"            \"perm\": \"0444\""},{"line_number":88,"context_line":"        },"}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"542d9923_d6996bae","line":85,"range":{"start_line":85,"start_character":21,"end_line":85,"end_character":30},"updated":"2026-04-03 11:36:04.000000000","message":"ditto","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"46a938d7006f1063292ebc0c545c343dc677b4d9","unresolved":false,"context_lines":[{"line_number":82,"context_line":"        },"},{"line_number":83,"context_line":"        {"},{"line_number":84,"context_line":"            \"source\": \"{{ container_config_directory }}/servercert.pem\","},{"line_number":85,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-cert.pem\","},{"line_number":86,"context_line":"            \"owner\": \"root\","},{"line_number":87,"context_line":"            \"perm\": \"0444\""},{"line_number":88,"context_line":"        },"}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"6c8713e8_4886f763","line":85,"range":{"start_line":85,"start_character":21,"end_line":85,"end_character":30},"in_reply_to":"542d9923_d6996bae","updated":"2026-04-08 10:29:20.000000000","message":"Done","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"b84f1251b20b1ef2728e6b93817c7beff79adf3b","unresolved":true,"context_lines":[{"line_number":88,"context_line":"        },"},{"line_number":89,"context_line":"        {"},{"line_number":90,"context_line":"            \"source\": \"{{ container_config_directory }}/cacert.pem\","},{"line_number":91,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/ca-cert.pem\","},{"line_number":92,"context_line":"            \"owner\": \"root\","},{"line_number":93,"context_line":"            \"perm\": \"0444\""},{"line_number":94,"context_line":"        }{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"4125c9c7_4fb70a46","line":91,"range":{"start_line":91,"start_character":21,"end_line":91,"end_character":30},"updated":"2026-04-03 11:36:04.000000000","message":"ditto","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"46a938d7006f1063292ebc0c545c343dc677b4d9","unresolved":false,"context_lines":[{"line_number":88,"context_line":"        },"},{"line_number":89,"context_line":"        {"},{"line_number":90,"context_line":"            \"source\": \"{{ container_config_directory }}/cacert.pem\","},{"line_number":91,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/ca-cert.pem\","},{"line_number":92,"context_line":"            \"owner\": \"root\","},{"line_number":93,"context_line":"            \"perm\": \"0444\""},{"line_number":94,"context_line":"        }{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"b293cfb8_ddcf37e3","line":91,"range":{"start_line":91,"start_character":21,"end_line":91,"end_character":30},"in_reply_to":"4125c9c7_4fb70a46","updated":"2026-04-08 10:29:20.000000000","message":"Done","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"},{"author":{"_account_id":17669,"name":"Doug Szumski","email":"doug@stackhpc.com","username":"DougSzumski"},"change_message_id":"4bcbcce617095c1b70797a8a193a174c9411284e","unresolved":true,"context_lines":[{"line_number":78,"context_line":"            \"source\": \"{{ container_config_directory }}/serverkey.pem\","},{"line_number":79,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-key.pem\","},{"line_number":80,"context_line":"            \"owner\": \"root\","},{"line_number":81,"context_line":"            \"perm\": \"0444\""},{"line_number":82,"context_line":"        },"},{"line_number":83,"context_line":"        {"},{"line_number":84,"context_line":"            \"source\": \"{{ container_config_directory }}/servercert.pem\","}],"source_content_type":"text/x-jinja2","patch_set":28,"id":"ed78044f_d24e2d15","line":81,"updated":"2026-04-09 10:45:45.000000000","message":"Why not 0400?","commit_id":"836fa71faa1b9a9e43eee36b6c276270cc592626"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"7259baa8fb580cdd1888b8bdeee0905988d00567","unresolved":false,"context_lines":[{"line_number":78,"context_line":"            \"source\": \"{{ container_config_directory }}/serverkey.pem\","},{"line_number":79,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-key.pem\","},{"line_number":80,"context_line":"            \"owner\": \"root\","},{"line_number":81,"context_line":"            \"perm\": \"0444\""},{"line_number":82,"context_line":"        },"},{"line_number":83,"context_line":"        {"},{"line_number":84,"context_line":"            \"source\": \"{{ container_config_directory }}/servercert.pem\","}],"source_content_type":"text/x-jinja2","patch_set":28,"id":"1e02f427_ece19741","line":81,"in_reply_to":"c4c9761c_16070c34","updated":"2026-04-09 23:27:54.000000000","message":"Done","commit_id":"836fa71faa1b9a9e43eee36b6c276270cc592626"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"ce399ef13ab4823916f84ccf262194a17051e7d0","unresolved":true,"context_lines":[{"line_number":78,"context_line":"            \"source\": \"{{ container_config_directory }}/serverkey.pem\","},{"line_number":79,"context_line":"            \"dest\": \"/etc/pki/libvirt-spice/server-key.pem\","},{"line_number":80,"context_line":"            \"owner\": \"root\","},{"line_number":81,"context_line":"            \"perm\": \"0444\""},{"line_number":82,"context_line":"        },"},{"line_number":83,"context_line":"        {"},{"line_number":84,"context_line":"            \"source\": \"{{ container_config_directory }}/servercert.pem\","}],"source_content_type":"text/x-jinja2","patch_set":28,"id":"c4c9761c_16070c34","line":81,"in_reply_to":"ed78044f_d24e2d15","updated":"2026-04-09 17:13:28.000000000","message":"hmm, good catch. other certs above use `0600`, maybe best stay consistent with that?","commit_id":"836fa71faa1b9a9e43eee36b6c276270cc592626"}],"ansible/roles/nova-cell/templates/nova.conf.j2":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"9ed3c91fadacfb6ca07166148b6e12f054922bb7","unresolved":true,"context_lines":[{"line_number":61,"context_line":"enabled \u003d false"},{"line_number":62,"context_line":"[spice]"},{"line_number":63,"context_line":"enabled \u003d true"},{"line_number":64,"context_line":"require_secure \u003d {{ nova_spice_require_secure | bool | lower }}"},{"line_number":65,"context_line":"server_listen \u003d {{ api_interface_address }}"},{"line_number":66,"context_line":"image_compression \u003d {{ nova_spice_image_compression }}"},{"line_number":67,"context_line":"jpeg_compression \u003d {{ nova_spice_jpeg_compression }}"}],"source_content_type":"text/x-jinja2","patch_set":8,"id":"574c32f5_723b2fb8","line":64,"updated":"2025-12-10 11:09:28.000000000","message":"Why lower?","commit_id":"b4641c90af57cb1d72cd6fdca45b015b81f65334"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"bbc40f3ae6a08d9c5488b33acdcf33884f0e16ba","unresolved":false,"context_lines":[{"line_number":61,"context_line":"enabled \u003d false"},{"line_number":62,"context_line":"[spice]"},{"line_number":63,"context_line":"enabled \u003d true"},{"line_number":64,"context_line":"require_secure \u003d {{ nova_spice_require_secure | bool | lower }}"},{"line_number":65,"context_line":"server_listen \u003d {{ api_interface_address }}"},{"line_number":66,"context_line":"image_compression \u003d {{ nova_spice_image_compression }}"},{"line_number":67,"context_line":"jpeg_compression \u003d {{ nova_spice_jpeg_compression }}"}],"source_content_type":"text/x-jinja2","patch_set":8,"id":"4d524e70_47b41209","line":64,"in_reply_to":"14f485fa_26d0c4e1","updated":"2026-03-25 10:53:25.000000000","message":"Done","commit_id":"b4641c90af57cb1d72cd6fdca45b015b81f65334"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"3cf5a596719581f2eaf41dfdb426efc00d517f69","unresolved":true,"context_lines":[{"line_number":61,"context_line":"enabled \u003d false"},{"line_number":62,"context_line":"[spice]"},{"line_number":63,"context_line":"enabled \u003d true"},{"line_number":64,"context_line":"require_secure \u003d {{ nova_spice_require_secure | bool | lower }}"},{"line_number":65,"context_line":"server_listen \u003d {{ api_interface_address }}"},{"line_number":66,"context_line":"image_compression \u003d {{ nova_spice_image_compression }}"},{"line_number":67,"context_line":"jpeg_compression \u003d {{ nova_spice_jpeg_compression }}"}],"source_content_type":"text/x-jinja2","patch_set":8,"id":"14f485fa_26d0c4e1","line":64,"in_reply_to":"574c32f5_723b2fb8","updated":"2026-01-22 21:23:56.000000000","message":"I\u0027ve removed this.","commit_id":"b4641c90af57cb1d72cd6fdca45b015b81f65334"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"640a63293aef5728cdac74696ebf37e425d74089","unresolved":true,"context_lines":[{"line_number":61,"context_line":"enabled \u003d false"},{"line_number":62,"context_line":"[spice]"},{"line_number":63,"context_line":"enabled \u003d true"},{"line_number":64,"context_line":"require_secure \u003d {{ nova_spice_require_secure }}"},{"line_number":65,"context_line":"server_listen \u003d {{ api_interface_address }}"},{"line_number":66,"context_line":"image_compression \u003d {{ nova_spice_image_compression }}"},{"line_number":67,"context_line":"jpeg_compression \u003d {{ nova_spice_jpeg_compression }}"}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"5f0ddaac_2d471ff4","line":64,"updated":"2026-04-08 10:34:32.000000000","message":"```suggestion\nrequire_secure \u003d {{ nova_spice_require_secure | bool }}\n```","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"62cd2e24318488cbedabad8e888e1a1cc1fbe273","unresolved":false,"context_lines":[{"line_number":61,"context_line":"enabled \u003d false"},{"line_number":62,"context_line":"[spice]"},{"line_number":63,"context_line":"enabled \u003d true"},{"line_number":64,"context_line":"require_secure \u003d {{ nova_spice_require_secure }}"},{"line_number":65,"context_line":"server_listen \u003d {{ api_interface_address }}"},{"line_number":66,"context_line":"image_compression \u003d {{ nova_spice_image_compression }}"},{"line_number":67,"context_line":"jpeg_compression \u003d {{ nova_spice_jpeg_compression }}"}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"81f42f55_3ccdb6a0","line":64,"in_reply_to":"5f0ddaac_2d471ff4","updated":"2026-04-09 07:26:08.000000000","message":"Done","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"}],"ansible/roles/nova-cell/templates/qemu.conf.j2":[{"author":{"_account_id":35264,"name":"Alex Welsh","email":"alex@stackhpc.com","username":"alex-welsh"},"change_message_id":"af867c7916f2467bb4cedf2095fcb07596e1f8bc","unresolved":true,"context_lines":[{"line_number":6,"context_line":"max_files \u003d  {{ qemu_max_files }}"},{"line_number":7,"context_line":"max_processes \u003d  {{ qemu_max_processes }}"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"{% if nova_spice_require_secure \u003d\u003d \u0027yes\u0027 %}"},{"line_number":10,"context_line":"spice_tls \u003d 1"},{"line_number":11,"context_line":"spice_tls_x509_cert_dir \u003d \"/etc/pki/libvirt-spice\""},{"line_number":12,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"d2bc1a54_9da442f0","line":9,"updated":"2025-11-20 09:25:15.000000000","message":"```suggestion\n{% if nova_spice_require_secure | bool %}\n```","commit_id":"e6fa3f630112f8074e3787f51b5c10d9e917af66"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"b0d284b828b350abead10831c57f57ae8899977c","unresolved":false,"context_lines":[{"line_number":6,"context_line":"max_files \u003d  {{ qemu_max_files }}"},{"line_number":7,"context_line":"max_processes \u003d  {{ qemu_max_processes }}"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"{% if nova_spice_require_secure \u003d\u003d \u0027yes\u0027 %}"},{"line_number":10,"context_line":"spice_tls \u003d 1"},{"line_number":11,"context_line":"spice_tls_x509_cert_dir \u003d \"/etc/pki/libvirt-spice\""},{"line_number":12,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"37cc15c2_5eb0caf6","line":9,"in_reply_to":"d2bc1a54_9da442f0","updated":"2025-11-21 19:49:14.000000000","message":"Acknowledged","commit_id":"e6fa3f630112f8074e3787f51b5c10d9e917af66"},{"author":{"_account_id":35264,"name":"Alex Welsh","email":"alex@stackhpc.com","username":"alex-welsh"},"change_message_id":"af867c7916f2467bb4cedf2095fcb07596e1f8bc","unresolved":true,"context_lines":[{"line_number":9,"context_line":"{% if nova_spice_require_secure \u003d\u003d \u0027yes\u0027 %}"},{"line_number":10,"context_line":"spice_tls \u003d 1"},{"line_number":11,"context_line":"spice_tls_x509_cert_dir \u003d \"/etc/pki/libvirt-spice\""},{"line_number":12,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"437fa6ea_bfeb0e0d","line":12,"updated":"2025-11-20 09:25:15.000000000","message":"Linter is complaining, no EOF newline","commit_id":"e6fa3f630112f8074e3787f51b5c10d9e917af66"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"b0d284b828b350abead10831c57f57ae8899977c","unresolved":true,"context_lines":[{"line_number":9,"context_line":"{% if nova_spice_require_secure \u003d\u003d \u0027yes\u0027 %}"},{"line_number":10,"context_line":"spice_tls \u003d 1"},{"line_number":11,"context_line":"spice_tls_x509_cert_dir \u003d \"/etc/pki/libvirt-spice\""},{"line_number":12,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"e64bb31d_d0f0df2a","line":12,"in_reply_to":"437fa6ea_bfeb0e0d","updated":"2025-11-21 19:49:14.000000000","message":"This one was already fixed before I saw your comment, but thank you.","commit_id":"e6fa3f630112f8074e3787f51b5c10d9e917af66"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"bbc40f3ae6a08d9c5488b33acdcf33884f0e16ba","unresolved":false,"context_lines":[{"line_number":9,"context_line":"{% if nova_spice_require_secure \u003d\u003d \u0027yes\u0027 %}"},{"line_number":10,"context_line":"spice_tls \u003d 1"},{"line_number":11,"context_line":"spice_tls_x509_cert_dir \u003d \"/etc/pki/libvirt-spice\""},{"line_number":12,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"22dd1b0a_c0dacf5e","line":12,"in_reply_to":"e64bb31d_d0f0df2a","updated":"2026-03-25 10:53:25.000000000","message":"Done","commit_id":"e6fa3f630112f8074e3787f51b5c10d9e917af66"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"b84f1251b20b1ef2728e6b93817c7beff79adf3b","unresolved":true,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"{% if nova_spice_require_secure | bool %}"},{"line_number":10,"context_line":"spice_tls \u003d 1"},{"line_number":11,"context_line":"spice_tls_x509_cert_dir \u003d \"/etc/pki/libvirt-spice\""},{"line_number":12,"context_line":"{% endif %}"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"{% if enable_nova_swtpm | bool %}"}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"d13d57ba_9bff299f","line":11,"range":{"start_line":11,"start_character":28,"end_line":11,"end_character":36},"updated":"2026-04-03 11:36:04.000000000","message":"ditto","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"8b52d0c7561363c3ccc829b2a91480658522823a","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"{% if nova_spice_require_secure | bool %}"},{"line_number":10,"context_line":"spice_tls \u003d 1"},{"line_number":11,"context_line":"spice_tls_x509_cert_dir \u003d \"/etc/pki/libvirt-spice\""},{"line_number":12,"context_line":"{% endif %}"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"{% if enable_nova_swtpm | bool %}"}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"1f28125f_0d5340bf","line":11,"range":{"start_line":11,"start_character":28,"end_line":11,"end_character":36},"in_reply_to":"d13d57ba_9bff299f","updated":"2026-04-08 10:32:33.000000000","message":"Done","commit_id":"81f8a2bb5c18b19102f05bd0d3421c1a4c3c073a"}]}