)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"26496dfd0830cf88a27de0576fc64eb9eab9f677","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"108bf4ef_15b38eca","updated":"2026-02-16 09:12:26.000000000","message":"recheck mariadb connection failures","commit_id":"5bdbdba1db9fe2354d7a21fdb9da40cb48533032"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"33bc93cfeb91ad98b4ecaa30f60aaacd9c0dc05e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":16,"id":"a7319bda_44545575","updated":"2026-05-01 10:51:22.000000000","message":"recheck galera-bootstrap-on-noble","commit_id":"0b70301fd70ad3610c11f14b87c00a7bb1383754"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"a610a65268cb684a277728b22288d9284a890149","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":29,"id":"1554439e_a5f1faac","updated":"2026-05-17 22:34:51.000000000","message":"recheck image-build-deps","commit_id":"07374367063dab0767376ef0636b8b33bcb10be4"},{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"061b33e793b99e3460ea58a3dcde12bd9752be14","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":32,"id":"d005e245_f5679709","updated":"2026-05-21 07:50:28.000000000","message":"recheck - rocky bug","commit_id":"e2541a90f8bf3664dafda7ae396393a7cb7813bb"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"efdc04aa77efec396910e5fad148de020f320a95","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":36,"id":"105e1d88_81627251","updated":"2026-06-08 05:45:27.000000000","message":"recheck dep updated and merged","commit_id":"6c89baf0b2c315dcabf2a345f296a844a0d0c8c3"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"3c1b475f1aae432e81cf98e071b99057f4954777","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":38,"id":"9967651b_565e6817","updated":"2026-06-22 19:20:16.000000000","message":"recheck needs-change-993067","commit_id":"973d202a3c96ce3cb0206caa3654bdce95b4aa3f"},{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"daaf1065fcb9f325f445f1382e9c4ea10b825499","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":43,"id":"15995572_03acc105","updated":"2026-08-05 20:29:52.000000000","message":"A few things net mentioned in review:\n\n- needs a globals.yml mention for the `enable_kerbside` variable\n- needs some documentation about it","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f2e8414bcbe6af55855cedab29e2a0a41396e7b3","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":43,"id":"96d5b384_8baf52e5","in_reply_to":"08467f73_3a88c26d","updated":"2026-09-18 07:33:48.000000000","message":"Done","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"5b0308137bd4d3b2fa4fc3c9d71fb17261f883f1","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":43,"id":"08467f73_3a88c26d","in_reply_to":"15995572_03acc105","updated":"2026-08-06 09:08:13.000000000","message":"I\u0027ve done the first one, but have run out of steam for the day. I will do the docs tomorrow.","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"b5dd1b0d8645f2c2ba3271931870e58f8f8814cb","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":45,"id":"ffc8c4d3_4a0ff449","updated":"2026-08-07 03:47:39.000000000","message":"Docs are now done too.","commit_id":"f9ca4981962c69f2962be2c16a84af1f6c086d3b"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"deee2fe316b1b1bdf650760e95aacf788f4f89ad","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":48,"id":"563a7105_1bf88aaa","updated":"2026-08-21 01:30:41.000000000","message":"recheck fluentd-timing","commit_id":"eb163df5210dd7eb5c153da8ce198ca960a0fea1"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"808f5003413b7500fcc8d2c77d345f6ba07ac6b9","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":48,"id":"9242d388_e3ae9ec1","updated":"2026-08-20 08:20:33.000000000","message":"recheck fluentd-timing","commit_id":"eb163df5210dd7eb5c153da8ce198ca960a0fea1"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"8db0682d99fd2cb1a683d54301259c7526e124af","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":50,"id":"d3e4e93d_c001c2fc","updated":"2026-08-25 19:16:44.000000000","message":"recheck","commit_id":"8cc9063f3381a40e84adf945c944278d98ed0051"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f795035870c28461deb80d8085197eb8ad3722a6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":53,"id":"dca149c8_77acb46b","updated":"2026-09-08 19:36:54.000000000","message":"recheck hung-node","commit_id":"557ca873da7e6fb03ab75fc0b47dc272d88436c7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"12869f7e61aa6ba1401a5f7d2e3d0f0835d68426","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":54,"id":"2b1bd3a5_f4b1d443","updated":"2026-09-13 02:21:53.000000000","message":"recheck infra-flake","commit_id":"08ca0db46c7c2f87cbc4984a8f95ab3327e15b98"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"5a220267746547eef116e34b627e587a7b8e5626","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":58,"id":"f1bc2f6c_ec68dbdc","updated":"2026-09-21 21:42:51.000000000","message":"recheck galaxy-outage","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"a0ff27499a7c51446cc9427df5790d73042ed911","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":61,"id":"b986be45_43acefae","updated":"2026-09-24 09:24:28.000000000","message":"feature freeze","commit_id":"d121f530a7a763e8eb2b4b859b6492c2bb93d35a"}],"ansible/certificates.yml":[{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"daaf1065fcb9f325f445f1382e9c4ea10b825499","unresolved":true,"context_lines":[{"line_number":5,"context_line":"    kolla_enable_tls_backend | default(false) | bool or"},{"line_number":6,"context_line":"    rabbitmq_enable_tls | default(false) | bool or"},{"line_number":7,"context_line":"    certificates_generate_libvirt | default(libvirt_tls) | default(false) | bool or"},{"line_number":8,"context_line":"    certificates_generate_kerbside | default(enable_kerbside) | default(false) | bool"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"- name: Apply role certificates"},{"line_number":11,"context_line":"  hosts: localhost"}],"source_content_type":"text/x-yaml","patch_set":43,"id":"461ed376_e83acae0","line":8,"range":{"start_line":8,"start_character":4,"end_line":8,"end_character":34},"updated":"2026-08-05 20:29:52.000000000","message":"This variable is no-op bewcause in certificate/tasks/main.yml, it\u0027s not used.\n\nAlso, this should be declared in certificates/defaults/main.ylm","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"5b0308137bd4d3b2fa4fc3c9d71fb17261f883f1","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    kolla_enable_tls_backend | default(false) | bool or"},{"line_number":6,"context_line":"    rabbitmq_enable_tls | default(false) | bool or"},{"line_number":7,"context_line":"    certificates_generate_libvirt | default(libvirt_tls) | default(false) | bool or"},{"line_number":8,"context_line":"    certificates_generate_kerbside | default(enable_kerbside) | default(false) | bool"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"- name: Apply role certificates"},{"line_number":11,"context_line":"  hosts: localhost"}],"source_content_type":"text/x-yaml","patch_set":43,"id":"a4ab1586_3941784f","line":8,"range":{"start_line":8,"start_character":4,"end_line":8,"end_character":34},"in_reply_to":"461ed376_e83acae0","updated":"2026-08-06 09:08:13.000000000","message":"Done","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"}],"ansible/group_vars/all/kerbside.yml":[{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":11,"context_line":"kerbside_vdi_insecure_listen_port: \"{{ kerbside_vdi_insecure_port }}\""},{"line_number":12,"context_line":"kerbside_vdi_secure_port: 5898"},{"line_number":13,"context_line":"kerbside_vdi_secure_listen_port: \"{{ kerbside_vdi_secure_port }}\""},{"line_number":14,"context_line":"kerbside_api_url: \"http://{{ kolla_external_fqdn }}:{{ kerbside_port }}\""},{"line_number":15,"context_line":"kerbside_external_fqdn: \"{{ kolla_external_fqdn }}\""},{"line_number":16,"context_line":"kerbside_spice_direct_proxy_base_url: \"{{ kerbside_external_fqdn | kolla_url(\u0027https\u0027, kerbside_api_public_port, \u0027/nova-console.vv\u0027) }}\""},{"line_number":17,"context_line":"kerbside_safety_upgrade: false"}],"source_content_type":"text/x-yaml","patch_set":58,"id":"5a32aec7_3e8d73d7","line":14,"range":{"start_line":14,"start_character":19,"end_line":14,"end_character":23},"updated":"2026-09-23 08:17:14.000000000","message":"static http?","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f216e8ab716190e7bee12130dee08a82c11f45be","unresolved":false,"context_lines":[{"line_number":11,"context_line":"kerbside_vdi_insecure_listen_port: \"{{ kerbside_vdi_insecure_port }}\""},{"line_number":12,"context_line":"kerbside_vdi_secure_port: 5898"},{"line_number":13,"context_line":"kerbside_vdi_secure_listen_port: \"{{ kerbside_vdi_secure_port }}\""},{"line_number":14,"context_line":"kerbside_api_url: \"http://{{ kolla_external_fqdn }}:{{ kerbside_port }}\""},{"line_number":15,"context_line":"kerbside_external_fqdn: \"{{ kolla_external_fqdn }}\""},{"line_number":16,"context_line":"kerbside_spice_direct_proxy_base_url: \"{{ kerbside_external_fqdn | kolla_url(\u0027https\u0027, kerbside_api_public_port, \u0027/nova-console.vv\u0027) }}\""},{"line_number":17,"context_line":"kerbside_safety_upgrade: false"}],"source_content_type":"text/x-yaml","patch_set":58,"id":"caf6cd79_c4a4cfc1","line":14,"range":{"start_line":14,"start_character":19,"end_line":14,"end_character":23},"in_reply_to":"5a32aec7_3e8d73d7","updated":"2026-09-23 10:37:30.000000000","message":"Fair.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"}],"ansible/inventory/all-in-one":[{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":18,"context_line":"[deployment]"},{"line_number":19,"context_line":"localhost       ansible_connection\u003dlocal"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"[vdiproxy]"},{"line_number":22,"context_line":"localhost       ansible_connection\u003dlocal"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"# You can explicitly specify which hosts run each project by updating the"},{"line_number":25,"context_line":"# groups in the sections below. Common services are grouped together."},{"line_number":26,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":58,"id":"9f736291_80bafd5b","line":23,"range":{"start_line":21,"start_character":0,"end_line":23,"end_character":0},"updated":"2026-09-23 08:17:14.000000000","message":"I don\u0027t get why we need dedicated group for that, can\u0027t that be done same as it\u0027s declared for multinode?","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f216e8ab716190e7bee12130dee08a82c11f45be","unresolved":false,"context_lines":[{"line_number":18,"context_line":"[deployment]"},{"line_number":19,"context_line":"localhost       ansible_connection\u003dlocal"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"[vdiproxy]"},{"line_number":22,"context_line":"localhost       ansible_connection\u003dlocal"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"# You can explicitly specify which hosts run each project by updating the"},{"line_number":25,"context_line":"# groups in the sections below. Common services are grouped together."},{"line_number":26,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":58,"id":"dacc60f5_961c3220","line":23,"range":{"start_line":21,"start_character":0,"end_line":23,"end_character":0},"in_reply_to":"9f736291_80bafd5b","updated":"2026-09-23 10:37:30.000000000","message":"I simply forgot to change this one when I changed the multinode one.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"}],"ansible/inventory/multinode":[{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"daaf1065fcb9f325f445f1382e9c4ea10b825499","unresolved":true,"context_lines":[{"line_number":29,"context_line":"[storage]"},{"line_number":30,"context_line":"storage01"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"[vdiproxy]"},{"line_number":33,"context_line":"kerbside01"},{"line_number":34,"context_line":"kerbside02"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"[deployment]"},{"line_number":37,"context_line":"localhost       ansible_connection\u003dlocal"}],"source_content_type":"application/octet-stream","patch_set":43,"id":"05396ae9_73d34b31","line":34,"range":{"start_line":32,"start_character":0,"end_line":34,"end_character":10},"updated":"2026-08-05 20:29:52.000000000","message":"I\u0027m not sure we have a separate machine group just for vdi proxy ? or is it inherently unsafe to run on the control plane ?","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"5b0308137bd4d3b2fa4fc3c9d71fb17261f883f1","unresolved":true,"context_lines":[{"line_number":29,"context_line":"[storage]"},{"line_number":30,"context_line":"storage01"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"[vdiproxy]"},{"line_number":33,"context_line":"kerbside01"},{"line_number":34,"context_line":"kerbside02"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"[deployment]"},{"line_number":37,"context_line":"localhost       ansible_connection\u003dlocal"}],"source_content_type":"application/octet-stream","patch_set":43,"id":"cfb7f0ea_5b844e6a","line":34,"range":{"start_line":32,"start_character":0,"end_line":34,"end_character":10},"in_reply_to":"05396ae9_73d34b31","updated":"2026-08-06 09:08:13.000000000","message":"Its not unsafe as such, but there are a couple of factors that made me want to do it this way:\n\n * If I was deploying this in production I would have the VDI proxies have an interface on a dedicated \"VDI network\" which would also have connectivity to a dedicated \"VDI interface\" on each hypervisor. I would then configure nova to only expose the SPICE console TCP ports on that VDI interface. This would ensure that only the VDI proxies and other hypervisors could see console traffic, which is some deployments is not encrypted. Its not perfect, but its better than nothing.\n\n * The consoles are relatively high bandwidth if actively used. It various obviously depending on what you\u0027re displaying, but my measurements are around a megabit for text console sessions, and up to 35 megabit for high resolution streaming video. So in terms of mental model it is more like the neutron network nodes when deployed without DVR -- that is you could absolutely converge them down into shared control plain nodes, but they are a likely deployment tuning step.","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"09b7095ef2ba2bc59e63e3c3ebbcd672f181255d","unresolved":true,"context_lines":[{"line_number":29,"context_line":"[storage]"},{"line_number":30,"context_line":"storage01"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"[vdiproxy]"},{"line_number":33,"context_line":"kerbside01"},{"line_number":34,"context_line":"kerbside02"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"[deployment]"},{"line_number":37,"context_line":"localhost       ansible_connection\u003dlocal"}],"source_content_type":"application/octet-stream","patch_set":43,"id":"48662cb3_a43cacdc","line":34,"range":{"start_line":32,"start_character":0,"end_line":34,"end_character":10},"in_reply_to":"3dcca5e0_5ac935b1","updated":"2026-09-08 07:41:41.000000000","message":"Yeah that\u0027s fair. Fixed.","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f2e8414bcbe6af55855cedab29e2a0a41396e7b3","unresolved":false,"context_lines":[{"line_number":29,"context_line":"[storage]"},{"line_number":30,"context_line":"storage01"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"[vdiproxy]"},{"line_number":33,"context_line":"kerbside01"},{"line_number":34,"context_line":"kerbside02"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"[deployment]"},{"line_number":37,"context_line":"localhost       ansible_connection\u003dlocal"}],"source_content_type":"application/octet-stream","patch_set":43,"id":"1ff393c9_6e8e14ea","line":34,"range":{"start_line":32,"start_character":0,"end_line":34,"end_character":10},"in_reply_to":"48662cb3_a43cacdc","updated":"2026-09-18 07:33:48.000000000","message":"Done","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"5cf479fa4bd07426a9a30520b5635515b33a4769","unresolved":true,"context_lines":[{"line_number":29,"context_line":"[storage]"},{"line_number":30,"context_line":"storage01"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"[vdiproxy]"},{"line_number":33,"context_line":"kerbside01"},{"line_number":34,"context_line":"kerbside02"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"[deployment]"},{"line_number":37,"context_line":"localhost       ansible_connection\u003dlocal"}],"source_content_type":"application/octet-stream","patch_set":43,"id":"3dcca5e0_5ac935b1","line":34,"range":{"start_line":32,"start_character":0,"end_line":34,"end_character":10},"in_reply_to":"cfb7f0ea_5b844e6a","updated":"2026-09-07 08:28:35.000000000","message":"fair enough, tho I\u0027m not sure this should be the default setup ? People could decide to do this and we could document such a deployment, but as it is, I think it would change the deployment documentation too much from what it currently is ? I can see a documentation section about deploying this for production/heavy traffic setups, but I think the default should be on the control plane. \n\nTechnically any production deployment should also split like nova api out of the control plane, neutron api etc... but for the sake of simplicity, we just collocate them by default so that people arent required to have like 30 nodes to begin with ?","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":29,"context_line":"[storage]"},{"line_number":30,"context_line":"storage01"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"[vdiproxy:children]"},{"line_number":33,"context_line":"control"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"[deployment]"},{"line_number":36,"context_line":"localhost       ansible_connection\u003dlocal"}],"source_content_type":"application/octet-stream","patch_set":58,"id":"850da9e7_dc5ff453","line":33,"range":{"start_line":32,"start_character":0,"end_line":33,"end_character":7},"updated":"2026-09-23 08:17:14.000000000","message":"it should be in alphabetical order, so somewhere in the end of this file","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f216e8ab716190e7bee12130dee08a82c11f45be","unresolved":false,"context_lines":[{"line_number":29,"context_line":"[storage]"},{"line_number":30,"context_line":"storage01"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"[vdiproxy:children]"},{"line_number":33,"context_line":"control"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"[deployment]"},{"line_number":36,"context_line":"localhost       ansible_connection\u003dlocal"}],"source_content_type":"application/octet-stream","patch_set":58,"id":"030e2a36_5c332bcd","line":33,"range":{"start_line":32,"start_character":0,"end_line":33,"end_character":7},"in_reply_to":"850da9e7_dc5ff453","updated":"2026-09-23 10:37:30.000000000","message":"Done, and done in all-in-one as well.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"}],"ansible/nova.yml":[{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":180,"context_line":"  gather_facts: false"},{"line_number":181,"context_line":"  hosts:"},{"line_number":182,"context_line":"    - kerbside_api kerbside_proxy"},{"line_number":183,"context_line":"    - \u0027\u0026enable_kerbside_True\u0027"},{"line_number":184,"context_line":"  tags:"},{"line_number":185,"context_line":"    - kerbside"},{"line_number":186,"context_line":"  serial: \u0027{{ kolla_serial|default(\"0\") }}\u0027"}],"source_content_type":"text/x-yaml","patch_set":58,"id":"dce0f106_abc22cbb","line":183,"range":{"start_line":183,"start_character":6,"end_line":183,"end_character":29},"updated":"2026-09-23 08:17:14.000000000","message":"we\u0027re using double quotes in this reference type","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f216e8ab716190e7bee12130dee08a82c11f45be","unresolved":false,"context_lines":[{"line_number":180,"context_line":"  gather_facts: false"},{"line_number":181,"context_line":"  hosts:"},{"line_number":182,"context_line":"    - kerbside_api kerbside_proxy"},{"line_number":183,"context_line":"    - \u0027\u0026enable_kerbside_True\u0027"},{"line_number":184,"context_line":"  tags:"},{"line_number":185,"context_line":"    - kerbside"},{"line_number":186,"context_line":"  serial: \u0027{{ kolla_serial|default(\"0\") }}\u0027"}],"source_content_type":"text/x-yaml","patch_set":58,"id":"ddae4986_830fdfc1","line":183,"range":{"start_line":183,"start_character":6,"end_line":183,"end_character":29},"in_reply_to":"dce0f106_abc22cbb","updated":"2026-09-23 10:37:30.000000000","message":"Done","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":175,"context_line":"        - enable_nova | bool"},{"line_number":176,"context_line":"        - kolla_action in [\u0027deploy\u0027, \u0027reconfigure\u0027]"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"# Standard {{ kolla_action }}.yml for kerbside role."},{"line_number":179,"context_line":"- name: Apply role kerbside"},{"line_number":180,"context_line":"  gather_facts: false"},{"line_number":181,"context_line":"  hosts:"},{"line_number":182,"context_line":"    - kerbside_api kerbside_proxy"},{"line_number":183,"context_line":"    - \u0027\u0026enable_kerbside_True\u0027"},{"line_number":184,"context_line":"  tags:"},{"line_number":185,"context_line":"    - kerbside"},{"line_number":186,"context_line":"  serial: \u0027{{ kolla_serial|default(\"0\") }}\u0027"},{"line_number":187,"context_line":"  max_fail_percentage: \u003e-"},{"line_number":188,"context_line":"    {{ nova_max_fail_percentage |"},{"line_number":189,"context_line":"       default(kolla_max_fail_percentage) |"},{"line_number":190,"context_line":"       default(100) }}"},{"line_number":191,"context_line":"  roles:"},{"line_number":192,"context_line":"    - role: kerbside"},{"line_number":193,"context_line":"      when: enable_kerbside | bool"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"# Following an upgrade, Nova services must be restarted once all compute"},{"line_number":196,"context_line":"# services have registered themselves, to remove the RPC version pin."}],"source_content_type":"text/x-yaml","patch_set":58,"id":"d8c24524_b70b9008","line":193,"range":{"start_line":178,"start_character":0,"end_line":193,"end_character":34},"updated":"2026-09-23 08:17:14.000000000","message":"If kerbside is controlled just with enable_kerbside, and it has own tag without any reference to nova, why is declared in this file and not site.yml?","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f216e8ab716190e7bee12130dee08a82c11f45be","unresolved":true,"context_lines":[{"line_number":175,"context_line":"        - enable_nova | bool"},{"line_number":176,"context_line":"        - kolla_action in [\u0027deploy\u0027, \u0027reconfigure\u0027]"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"# Standard {{ kolla_action }}.yml for kerbside role."},{"line_number":179,"context_line":"- name: Apply role kerbside"},{"line_number":180,"context_line":"  gather_facts: false"},{"line_number":181,"context_line":"  hosts:"},{"line_number":182,"context_line":"    - kerbside_api kerbside_proxy"},{"line_number":183,"context_line":"    - \u0027\u0026enable_kerbside_True\u0027"},{"line_number":184,"context_line":"  tags:"},{"line_number":185,"context_line":"    - kerbside"},{"line_number":186,"context_line":"  serial: \u0027{{ kolla_serial|default(\"0\") }}\u0027"},{"line_number":187,"context_line":"  max_fail_percentage: \u003e-"},{"line_number":188,"context_line":"    {{ nova_max_fail_percentage |"},{"line_number":189,"context_line":"       default(kolla_max_fail_percentage) |"},{"line_number":190,"context_line":"       default(100) }}"},{"line_number":191,"context_line":"  roles:"},{"line_number":192,"context_line":"    - role: kerbside"},{"line_number":193,"context_line":"      when: enable_kerbside | bool"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"# Following an upgrade, Nova services must be restarted once all compute"},{"line_number":196,"context_line":"# services have registered themselves, to remove the RPC version pin."}],"source_content_type":"text/x-yaml","patch_set":58,"id":"e84013d3_bffb39ca","line":193,"range":{"start_line":178,"start_character":0,"end_line":193,"end_character":34},"in_reply_to":"d8c24524_b70b9008","updated":"2026-09-23 10:37:30.000000000","message":"Kerbside doesn\u0027t make a lot of sense without nova, as it serves a similar role to the HTML5 transcoding SPICE proxy -- it\u0027s proxy nova content. I could express that with logic in site.yml, but I thought this was less confusing. Happy to discuss more.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"80b4507087d058750734808ec484cd8eaa64e10c","unresolved":false,"context_lines":[{"line_number":175,"context_line":"        - enable_nova | bool"},{"line_number":176,"context_line":"        - kolla_action in [\u0027deploy\u0027, \u0027reconfigure\u0027]"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"# Standard {{ kolla_action }}.yml for kerbside role."},{"line_number":179,"context_line":"- name: Apply role kerbside"},{"line_number":180,"context_line":"  gather_facts: false"},{"line_number":181,"context_line":"  hosts:"},{"line_number":182,"context_line":"    - kerbside_api kerbside_proxy"},{"line_number":183,"context_line":"    - \u0027\u0026enable_kerbside_True\u0027"},{"line_number":184,"context_line":"  tags:"},{"line_number":185,"context_line":"    - kerbside"},{"line_number":186,"context_line":"  serial: \u0027{{ kolla_serial|default(\"0\") }}\u0027"},{"line_number":187,"context_line":"  max_fail_percentage: \u003e-"},{"line_number":188,"context_line":"    {{ nova_max_fail_percentage |"},{"line_number":189,"context_line":"       default(kolla_max_fail_percentage) |"},{"line_number":190,"context_line":"       default(100) }}"},{"line_number":191,"context_line":"  roles:"},{"line_number":192,"context_line":"    - role: kerbside"},{"line_number":193,"context_line":"      when: enable_kerbside | bool"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"# Following an upgrade, Nova services must be restarted once all compute"},{"line_number":196,"context_line":"# services have registered themselves, to remove the RPC version pin."}],"source_content_type":"text/x-yaml","patch_set":58,"id":"04f31975_f7de8122","line":193,"range":{"start_line":178,"start_character":0,"end_line":193,"end_character":34},"in_reply_to":"de366767_701d1e5f","updated":"2026-09-23 11:14:12.000000000","message":"If I am understanding the question, then yes there is a binding with nova in the sense that nova needs to have the `spice-direct` console type configured for kerbside to work. On reflection that seems like a missing precheck to me at the moment -- kerbside should abort the install if it knows nova isn\u0027t configured to work.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"3922d5b50185b8dcfa058e6fad0b4d5ccc8a09cd","unresolved":false,"context_lines":[{"line_number":175,"context_line":"        - enable_nova | bool"},{"line_number":176,"context_line":"        - kolla_action in [\u0027deploy\u0027, \u0027reconfigure\u0027]"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"# Standard {{ kolla_action }}.yml for kerbside role."},{"line_number":179,"context_line":"- name: Apply role kerbside"},{"line_number":180,"context_line":"  gather_facts: false"},{"line_number":181,"context_line":"  hosts:"},{"line_number":182,"context_line":"    - kerbside_api kerbside_proxy"},{"line_number":183,"context_line":"    - \u0027\u0026enable_kerbside_True\u0027"},{"line_number":184,"context_line":"  tags:"},{"line_number":185,"context_line":"    - kerbside"},{"line_number":186,"context_line":"  serial: \u0027{{ kolla_serial|default(\"0\") }}\u0027"},{"line_number":187,"context_line":"  max_fail_percentage: \u003e-"},{"line_number":188,"context_line":"    {{ nova_max_fail_percentage |"},{"line_number":189,"context_line":"       default(kolla_max_fail_percentage) |"},{"line_number":190,"context_line":"       default(100) }}"},{"line_number":191,"context_line":"  roles:"},{"line_number":192,"context_line":"    - role: kerbside"},{"line_number":193,"context_line":"      when: enable_kerbside | bool"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"# Following an upgrade, Nova services must be restarted once all compute"},{"line_number":196,"context_line":"# services have registered themselves, to remove the RPC version pin."}],"source_content_type":"text/x-yaml","patch_set":58,"id":"de366767_701d1e5f","line":193,"range":{"start_line":178,"start_character":0,"end_line":193,"end_character":34},"in_reply_to":"e84013d3_bffb39ca","updated":"2026-09-23 10:56:34.000000000","message":"Okey, since it\u0027s so tightly coupled with nova, maybe it\u0027s good to keep it here, no strong opinion about that. Have you considered using some nova related tags here? Are there nova changes that needs to be reflected in Kerbside (and maybe bounding it to nova tag would make it easier to manage)?","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":276,"context_line":"        - enable_nova | bool"},{"line_number":277,"context_line":"        - kolla_action \u003d\u003d \u0027upgrade\u0027"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"- name: Reload kerbside services"},{"line_number":280,"context_line":"  gather_facts: false"},{"line_number":281,"context_line":"  hosts:"},{"line_number":282,"context_line":"    - kerbside_api kerbside_proxy"},{"line_number":283,"context_line":"    - \u0027\u0026enable_kerbside_True\u0027"},{"line_number":284,"context_line":"  tags:"},{"line_number":285,"context_line":"    - kerbside"},{"line_number":286,"context_line":"  serial: \u0027{{ kolla_serial|default(\"0\") }}\u0027"},{"line_number":287,"context_line":"  max_fail_percentage: \u003e-"},{"line_number":288,"context_line":"    {{ nova_max_fail_percentage |"},{"line_number":289,"context_line":"       default(kolla_max_fail_percentage) |"},{"line_number":290,"context_line":"       default(100) }}"},{"line_number":291,"context_line":"  tasks:"},{"line_number":292,"context_line":"    - name: Reload kerbside services"},{"line_number":293,"context_line":"      ansible.builtin.import_role:"},{"line_number":294,"context_line":"        name: kerbside"},{"line_number":295,"context_line":"        tasks_from: reload"},{"line_number":296,"context_line":"      when:"},{"line_number":297,"context_line":"        - enable_kerbside | bool"},{"line_number":298,"context_line":"        - kolla_action \u003d\u003d \u0027upgrade\u0027"},{"line_number":299,"context_line":""},{"line_number":300,"context_line":"# Following an upgrade, data migrations should be performed for the API"},{"line_number":301,"context_line":"# database.  This should be done once all cells have been upgraded."},{"line_number":302,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":58,"id":"ef6a12f5_ec3b0296","line":299,"range":{"start_line":279,"start_character":0,"end_line":299,"end_character":0},"updated":"2026-09-23 08:17:14.000000000","message":"same as above","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"}],"ansible/roles/certificates/defaults/main.yml":[{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"daaf1065fcb9f325f445f1382e9c4ea10b825499","unresolved":true,"context_lines":[{"line_number":4,"context_line":"certificates_internal_dir: \"{{ kolla_certificates_dir }}/private/internal\""},{"line_number":5,"context_line":"certificates_backend_dir: \"{{ kolla_certificates_dir }}/private/backend\""},{"line_number":6,"context_line":"certificates_libvirt_dir: \"{{ kolla_certificates_dir }}/private/libvirt\""},{"line_number":7,"context_line":"certificates_kerbside_dir: \"{{ kolla_certificates_dir }}/private/kerbside\""},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"# Whether to generate certificates for libvirt TLS."},{"line_number":10,"context_line":"certificates_generate_libvirt: \"{{ libvirt_tls | default(false) | bool }}\""}],"source_content_type":"text/x-yaml","patch_set":43,"id":"9781f6bc_bc091f2a","line":7,"range":{"start_line":7,"start_character":0,"end_line":7,"end_character":74},"updated":"2026-08-05 20:29:52.000000000","message":"This is never used ? The generate_kerbside task probbly was meant to create certificates under here ?","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"5b0308137bd4d3b2fa4fc3c9d71fb17261f883f1","unresolved":true,"context_lines":[{"line_number":4,"context_line":"certificates_internal_dir: \"{{ kolla_certificates_dir }}/private/internal\""},{"line_number":5,"context_line":"certificates_backend_dir: \"{{ kolla_certificates_dir }}/private/backend\""},{"line_number":6,"context_line":"certificates_libvirt_dir: \"{{ kolla_certificates_dir }}/private/libvirt\""},{"line_number":7,"context_line":"certificates_kerbside_dir: \"{{ kolla_certificates_dir }}/private/kerbside\""},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"# Whether to generate certificates for libvirt TLS."},{"line_number":10,"context_line":"certificates_generate_libvirt: \"{{ libvirt_tls | default(false) | bool }}\""}],"source_content_type":"text/x-yaml","patch_set":43,"id":"e5165ac5_e0d4d252","line":7,"range":{"start_line":7,"start_character":0,"end_line":7,"end_character":74},"in_reply_to":"9781f6bc_bc091f2a","updated":"2026-08-06 09:08:13.000000000","message":"Good catch, I think this is vestial from a previous iteration. I will remove it.","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"582817754cdacf5246e1377a2a5c429e9e9a1d59","unresolved":false,"context_lines":[{"line_number":4,"context_line":"certificates_internal_dir: \"{{ kolla_certificates_dir }}/private/internal\""},{"line_number":5,"context_line":"certificates_backend_dir: \"{{ kolla_certificates_dir }}/private/backend\""},{"line_number":6,"context_line":"certificates_libvirt_dir: \"{{ kolla_certificates_dir }}/private/libvirt\""},{"line_number":7,"context_line":"certificates_kerbside_dir: \"{{ kolla_certificates_dir }}/private/kerbside\""},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"# Whether to generate certificates for libvirt TLS."},{"line_number":10,"context_line":"certificates_generate_libvirt: \"{{ libvirt_tls | default(false) | bool }}\""}],"source_content_type":"text/x-yaml","patch_set":43,"id":"3f36364a_0f69becf","line":7,"range":{"start_line":7,"start_character":0,"end_line":7,"end_character":74},"in_reply_to":"e5165ac5_e0d4d252","updated":"2026-09-07 08:31:39.000000000","message":"Done","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"}],"ansible/roles/certificates/tasks/main.yml":[{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"daaf1065fcb9f325f445f1382e9c4ea10b825499","unresolved":true,"context_lines":[{"line_number":10,"context_line":"- name: Generate kerbside certificates"},{"line_number":11,"context_line":"  ansible.builtin.include_tasks: generate-kerbside.yml"},{"line_number":12,"context_line":"  when:"},{"line_number":13,"context_line":"    - enable_kerbside | bool"},{"line_number":14,"context_line":"- name: Generate libvirt certificates"},{"line_number":15,"context_line":"  ansible.builtin.include_tasks: generate-libvirt.yml"},{"line_number":16,"context_line":"  when: certificates_generate_libvirt | bool"}],"source_content_type":"text/x-yaml","patch_set":43,"id":"cc7ec55a_9007d58b","line":13,"range":{"start_line":13,"start_character":6,"end_line":13,"end_character":28},"updated":"2026-08-05 20:29:52.000000000","message":"certificates_generate_kerbside | bool","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"5b0308137bd4d3b2fa4fc3c9d71fb17261f883f1","unresolved":false,"context_lines":[{"line_number":10,"context_line":"- name: Generate kerbside certificates"},{"line_number":11,"context_line":"  ansible.builtin.include_tasks: generate-kerbside.yml"},{"line_number":12,"context_line":"  when:"},{"line_number":13,"context_line":"    - enable_kerbside | bool"},{"line_number":14,"context_line":"- name: Generate libvirt certificates"},{"line_number":15,"context_line":"  ansible.builtin.include_tasks: generate-libvirt.yml"},{"line_number":16,"context_line":"  when: certificates_generate_libvirt | bool"}],"source_content_type":"text/x-yaml","patch_set":43,"id":"aed4717b_caae40b3","line":13,"range":{"start_line":13,"start_character":6,"end_line":13,"end_character":28},"in_reply_to":"cc7ec55a_9007d58b","updated":"2026-08-06 09:08:13.000000000","message":"Done","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"}],"ansible/roles/certificates/templates/openssl-kolla-kerbside.cnf.j2":[{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":1,"context_line":"[req]"},{"line_number":2,"context_line":"prompt \u003d no"},{"line_number":3,"context_line":"distinguished_name \u003d req_distinguished_name"},{"line_number":4,"context_line":"req_extensions \u003d v3_req"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"[req_distinguished_name]"},{"line_number":7,"context_line":"countryName \u003d US"},{"line_number":8,"context_line":"stateOrProvinceName \u003d NC"},{"line_number":9,"context_line":"localityName \u003d RTP"},{"line_number":10,"context_line":"organizationalUnitName \u003d kolla"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"[v3_req]"},{"line_number":13,"context_line":"subjectAltName \u003d @alt_names"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"[alt_names]"},{"line_number":16,"context_line":"DNS.1 \u003d {{ kolla_internal_fqdn }}"},{"line_number":17,"context_line":"DNS.2 \u003d {{ kolla_external_fqdn }}"},{"line_number":18,"context_line":"IP.1 \u003d {{ kolla_internal_vip_address }}"},{"line_number":19,"context_line":"IP.2 \u003d {{ kolla_external_vip_address }}"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"f29df1b8_f5a273ef","line":19,"range":{"start_line":1,"start_character":0,"end_line":19,"end_character":39},"updated":"2026-09-23 08:17:14.000000000","message":"do we really need separate certificate for kerbside? and if we can\u0027t cover that with existing ones, is there any reason behind running it via template and now how it\u0027s done for other certificates?","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"80b4507087d058750734808ec484cd8eaa64e10c","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[req]"},{"line_number":2,"context_line":"prompt \u003d no"},{"line_number":3,"context_line":"distinguished_name \u003d req_distinguished_name"},{"line_number":4,"context_line":"req_extensions \u003d v3_req"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"[req_distinguished_name]"},{"line_number":7,"context_line":"countryName \u003d US"},{"line_number":8,"context_line":"stateOrProvinceName \u003d NC"},{"line_number":9,"context_line":"localityName \u003d RTP"},{"line_number":10,"context_line":"organizationalUnitName \u003d kolla"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"[v3_req]"},{"line_number":13,"context_line":"subjectAltName \u003d @alt_names"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"[alt_names]"},{"line_number":16,"context_line":"DNS.1 \u003d {{ kolla_internal_fqdn }}"},{"line_number":17,"context_line":"DNS.2 \u003d {{ kolla_external_fqdn }}"},{"line_number":18,"context_line":"IP.1 \u003d {{ kolla_internal_vip_address }}"},{"line_number":19,"context_line":"IP.2 \u003d {{ kolla_external_vip_address }}"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"6664fcfc_54ccd542","line":19,"range":{"start_line":1,"start_character":0,"end_line":19,"end_character":39},"in_reply_to":"30432a2c_459ce846","updated":"2026-09-23 11:14:12.000000000","message":"My previous reply moved to the new way of creating certs, so I am resolving this one.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"3922d5b50185b8dcfa058e6fad0b4d5ccc8a09cd","unresolved":true,"context_lines":[{"line_number":1,"context_line":"[req]"},{"line_number":2,"context_line":"prompt \u003d no"},{"line_number":3,"context_line":"distinguished_name \u003d req_distinguished_name"},{"line_number":4,"context_line":"req_extensions \u003d v3_req"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"[req_distinguished_name]"},{"line_number":7,"context_line":"countryName \u003d US"},{"line_number":8,"context_line":"stateOrProvinceName \u003d NC"},{"line_number":9,"context_line":"localityName \u003d RTP"},{"line_number":10,"context_line":"organizationalUnitName \u003d kolla"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"[v3_req]"},{"line_number":13,"context_line":"subjectAltName \u003d @alt_names"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"[alt_names]"},{"line_number":16,"context_line":"DNS.1 \u003d {{ kolla_internal_fqdn }}"},{"line_number":17,"context_line":"DNS.2 \u003d {{ kolla_external_fqdn }}"},{"line_number":18,"context_line":"IP.1 \u003d {{ kolla_internal_vip_address }}"},{"line_number":19,"context_line":"IP.2 \u003d {{ kolla_external_vip_address }}"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"30432a2c_459ce846","line":19,"range":{"start_line":1,"start_character":0,"end_line":19,"end_character":39},"in_reply_to":"eb2a0d0a_ee97e145","updated":"2026-09-23 10:56:34.000000000","message":"Okey, so to be aligned with the current way of defining certs.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f216e8ab716190e7bee12130dee08a82c11f45be","unresolved":true,"context_lines":[{"line_number":1,"context_line":"[req]"},{"line_number":2,"context_line":"prompt \u003d no"},{"line_number":3,"context_line":"distinguished_name \u003d req_distinguished_name"},{"line_number":4,"context_line":"req_extensions \u003d v3_req"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"[req_distinguished_name]"},{"line_number":7,"context_line":"countryName \u003d US"},{"line_number":8,"context_line":"stateOrProvinceName \u003d NC"},{"line_number":9,"context_line":"localityName \u003d RTP"},{"line_number":10,"context_line":"organizationalUnitName \u003d kolla"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"[v3_req]"},{"line_number":13,"context_line":"subjectAltName \u003d @alt_names"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"[alt_names]"},{"line_number":16,"context_line":"DNS.1 \u003d {{ kolla_internal_fqdn }}"},{"line_number":17,"context_line":"DNS.2 \u003d {{ kolla_external_fqdn }}"},{"line_number":18,"context_line":"IP.1 \u003d {{ kolla_internal_vip_address }}"},{"line_number":19,"context_line":"IP.2 \u003d {{ kolla_external_vip_address }}"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"eb2a0d0a_ee97e145","line":19,"range":{"start_line":1,"start_character":0,"end_line":19,"end_character":39},"in_reply_to":"f29df1b8_f5a273ef","updated":"2026-09-23 10:37:30.000000000","message":"The big difference here is that the TLS certificate for Kerbside exists in containers other than the haproxy layer, so it\u0027s \"surface area\" is different. The template thing is just because this patch is really old and I hadn\u0027t noticed that the way this is done had changed.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"}],"ansible/roles/fluentd/templates/conf/input/15-kerbside.conf.j2":[{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"# The uWSGI log excluded above is plain uWSGI output rather than Kerbside\u0027s"},{"line_number":18,"context_line":"# JSON, so it gets the same handling as every other service\u0027s uWSGI log."},{"line_number":19,"context_line":"# Kerbside is not in fluentd_input_openstack_services, so 13-uwsgi.conf.j2"},{"line_number":20,"context_line":"# does not cover it."},{"line_number":21,"context_line":"\u003csource\u003e"},{"line_number":22,"context_line":"  @type tail"},{"line_number":23,"context_line":"  path /var/log/kolla/kerbside/*-uwsgi.log"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"1f5dbfbb_18e1a5d4","line":20,"range":{"start_line":19,"start_character":0,"end_line":20,"end_character":20},"updated":"2026-09-23 08:17:14.000000000","message":"adding it to `fluentd_input_openstack_services` doesn\u0027t cover it?","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f216e8ab716190e7bee12130dee08a82c11f45be","unresolved":true,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"# The uWSGI log excluded above is plain uWSGI output rather than Kerbside\u0027s"},{"line_number":18,"context_line":"# JSON, so it gets the same handling as every other service\u0027s uWSGI log."},{"line_number":19,"context_line":"# Kerbside is not in fluentd_input_openstack_services, so 13-uwsgi.conf.j2"},{"line_number":20,"context_line":"# does not cover it."},{"line_number":21,"context_line":"\u003csource\u003e"},{"line_number":22,"context_line":"  @type tail"},{"line_number":23,"context_line":"  path /var/log/kolla/kerbside/*-uwsgi.log"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"ff2af9a3_3dacd5e5","line":20,"range":{"start_line":19,"start_character":0,"end_line":20,"end_character":20},"in_reply_to":"1f5dbfbb_18e1a5d4","updated":"2026-09-23 10:37:30.000000000","message":"Adding Kerbside to that list would fix the uWSGI log, but it would also put Kerbside\u0027s JSON logs under the oslo text parser, which can\u0027t parse them. check-logs.sh treats \"pattern not matched\" as critical, so CI would fail. Hence the duplicate the uWSGI source.\n\nComponents that log in JSON are handled later in the patch series.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"3922d5b50185b8dcfa058e6fad0b4d5ccc8a09cd","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"# The uWSGI log excluded above is plain uWSGI output rather than Kerbside\u0027s"},{"line_number":18,"context_line":"# JSON, so it gets the same handling as every other service\u0027s uWSGI log."},{"line_number":19,"context_line":"# Kerbside is not in fluentd_input_openstack_services, so 13-uwsgi.conf.j2"},{"line_number":20,"context_line":"# does not cover it."},{"line_number":21,"context_line":"\u003csource\u003e"},{"line_number":22,"context_line":"  @type tail"},{"line_number":23,"context_line":"  path /var/log/kolla/kerbside/*-uwsgi.log"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"ee3817c8_49a47737","line":20,"range":{"start_line":19,"start_character":0,"end_line":20,"end_character":20},"in_reply_to":"ff2af9a3_3dacd5e5","updated":"2026-09-23 10:56:34.000000000","message":"Okey, not pushing further here.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"}],"ansible/roles/kerbside/defaults/main.yml":[{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":38,"context_line":"    dimensions: \"{{ kerbside_dimensions }}\""},{"line_number":39,"context_line":"    healthcheck: \"{{ kerbside_healthcheck_proxy }}\""},{"line_number":40,"context_line":"    haproxy:"},{"line_number":41,"context_line":"      kerbside_proxy_insecure:"},{"line_number":42,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":43,"context_line":"        mode: \"tcp\""},{"line_number":44,"context_line":"        external: false"},{"line_number":45,"context_line":"        port: \"{{ kerbside_vdi_insecure_port }}\""},{"line_number":46,"context_line":"        listen_port: \"{{ kerbside_vdi_insecure_listen_port }}\""},{"line_number":47,"context_line":"        tls_backend: false"},{"line_number":48,"context_line":"      kerbside_proxy_insecure_external:"},{"line_number":49,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":50,"context_line":"        mode: \"tcp\""},{"line_number":51,"context_line":"        external: true"},{"line_number":52,"context_line":"        external_fqdn: \"{{ kolla_external_fqdn }}\""},{"line_number":53,"context_line":"        port: \"{{ kerbside_vdi_insecure_port }}\""},{"line_number":54,"context_line":"        listen_port: \"{{ kerbside_vdi_insecure_listen_port }}\""},{"line_number":55,"context_line":"        tls_backend: false"},{"line_number":56,"context_line":"      kerbside_proxy_secure:"},{"line_number":57,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":58,"context_line":"        mode: \"tcp\""},{"line_number":59,"context_line":"        external: false"},{"line_number":60,"context_line":"        port: \"{{ kerbside_vdi_secure_port }}\""},{"line_number":61,"context_line":"        listen_port: \"{{ kerbside_vdi_secure_listen_port }}\""},{"line_number":62,"context_line":"        tls_backend: false"},{"line_number":63,"context_line":"      kerbside_proxy_secure_external:"},{"line_number":64,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":65,"context_line":"        mode: \"tcp\""},{"line_number":66,"context_line":"        external: true"},{"line_number":67,"context_line":"        external_fqdn: \"{{ kolla_external_fqdn }}\""},{"line_number":68,"context_line":"        port: \"{{ kerbside_vdi_secure_port }}\""},{"line_number":69,"context_line":"        listen_port: \"{{ kerbside_vdi_secure_listen_port }}\""},{"line_number":70,"context_line":"        tls_backend: false"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"####################"}],"source_content_type":"text/x-yaml","patch_set":58,"id":"131501e6_e609af38","line":70,"range":{"start_line":41,"start_character":0,"end_line":70,"end_character":26},"updated":"2026-09-23 08:17:14.000000000","message":"why isn\u0027t it just a single service with param based config? those all are `enabled: enable_kerbside`, so once kerbside is enabled we\u0027re deploying all 4 types","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f216e8ab716190e7bee12130dee08a82c11f45be","unresolved":true,"context_lines":[{"line_number":38,"context_line":"    dimensions: \"{{ kerbside_dimensions }}\""},{"line_number":39,"context_line":"    healthcheck: \"{{ kerbside_healthcheck_proxy }}\""},{"line_number":40,"context_line":"    haproxy:"},{"line_number":41,"context_line":"      kerbside_proxy_insecure:"},{"line_number":42,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":43,"context_line":"        mode: \"tcp\""},{"line_number":44,"context_line":"        external: false"},{"line_number":45,"context_line":"        port: \"{{ kerbside_vdi_insecure_port }}\""},{"line_number":46,"context_line":"        listen_port: \"{{ kerbside_vdi_insecure_listen_port }}\""},{"line_number":47,"context_line":"        tls_backend: false"},{"line_number":48,"context_line":"      kerbside_proxy_insecure_external:"},{"line_number":49,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":50,"context_line":"        mode: \"tcp\""},{"line_number":51,"context_line":"        external: true"},{"line_number":52,"context_line":"        external_fqdn: \"{{ kolla_external_fqdn }}\""},{"line_number":53,"context_line":"        port: \"{{ kerbside_vdi_insecure_port }}\""},{"line_number":54,"context_line":"        listen_port: \"{{ kerbside_vdi_insecure_listen_port }}\""},{"line_number":55,"context_line":"        tls_backend: false"},{"line_number":56,"context_line":"      kerbside_proxy_secure:"},{"line_number":57,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":58,"context_line":"        mode: \"tcp\""},{"line_number":59,"context_line":"        external: false"},{"line_number":60,"context_line":"        port: \"{{ kerbside_vdi_secure_port }}\""},{"line_number":61,"context_line":"        listen_port: \"{{ kerbside_vdi_secure_listen_port }}\""},{"line_number":62,"context_line":"        tls_backend: false"},{"line_number":63,"context_line":"      kerbside_proxy_secure_external:"},{"line_number":64,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":65,"context_line":"        mode: \"tcp\""},{"line_number":66,"context_line":"        external: true"},{"line_number":67,"context_line":"        external_fqdn: \"{{ kolla_external_fqdn }}\""},{"line_number":68,"context_line":"        port: \"{{ kerbside_vdi_secure_port }}\""},{"line_number":69,"context_line":"        listen_port: \"{{ kerbside_vdi_secure_listen_port }}\""},{"line_number":70,"context_line":"        tls_backend: false"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"####################"}],"source_content_type":"text/x-yaml","patch_set":58,"id":"70898731_5c557662","line":70,"range":{"start_line":41,"start_character":0,"end_line":70,"end_character":26},"in_reply_to":"131501e6_e609af38","updated":"2026-09-23 10:37:30.000000000","message":"So first off, Kerbside needs both a secure and an insecure port exposed. That\u0027s just how SPICE works -- clients can choose to connect to the insecure service and then Kerbside redirects them to the secure one. That\u0027s what drives the _number_ of entries here. To my reading they\u0027re all one service though -- kerbside_proxy, which has four frontends. I don\u0027t think that\u0027s expressable with haproxy-config parameters? This also mimics how nova_spicehtml5proxy does this.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"3922d5b50185b8dcfa058e6fad0b4d5ccc8a09cd","unresolved":true,"context_lines":[{"line_number":38,"context_line":"    dimensions: \"{{ kerbside_dimensions }}\""},{"line_number":39,"context_line":"    healthcheck: \"{{ kerbside_healthcheck_proxy }}\""},{"line_number":40,"context_line":"    haproxy:"},{"line_number":41,"context_line":"      kerbside_proxy_insecure:"},{"line_number":42,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":43,"context_line":"        mode: \"tcp\""},{"line_number":44,"context_line":"        external: false"},{"line_number":45,"context_line":"        port: \"{{ kerbside_vdi_insecure_port }}\""},{"line_number":46,"context_line":"        listen_port: \"{{ kerbside_vdi_insecure_listen_port }}\""},{"line_number":47,"context_line":"        tls_backend: false"},{"line_number":48,"context_line":"      kerbside_proxy_insecure_external:"},{"line_number":49,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":50,"context_line":"        mode: \"tcp\""},{"line_number":51,"context_line":"        external: true"},{"line_number":52,"context_line":"        external_fqdn: \"{{ kolla_external_fqdn }}\""},{"line_number":53,"context_line":"        port: \"{{ kerbside_vdi_insecure_port }}\""},{"line_number":54,"context_line":"        listen_port: \"{{ kerbside_vdi_insecure_listen_port }}\""},{"line_number":55,"context_line":"        tls_backend: false"},{"line_number":56,"context_line":"      kerbside_proxy_secure:"},{"line_number":57,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":58,"context_line":"        mode: \"tcp\""},{"line_number":59,"context_line":"        external: false"},{"line_number":60,"context_line":"        port: \"{{ kerbside_vdi_secure_port }}\""},{"line_number":61,"context_line":"        listen_port: \"{{ kerbside_vdi_secure_listen_port }}\""},{"line_number":62,"context_line":"        tls_backend: false"},{"line_number":63,"context_line":"      kerbside_proxy_secure_external:"},{"line_number":64,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":65,"context_line":"        mode: \"tcp\""},{"line_number":66,"context_line":"        external: true"},{"line_number":67,"context_line":"        external_fqdn: \"{{ kolla_external_fqdn }}\""},{"line_number":68,"context_line":"        port: \"{{ kerbside_vdi_secure_port }}\""},{"line_number":69,"context_line":"        listen_port: \"{{ kerbside_vdi_secure_listen_port }}\""},{"line_number":70,"context_line":"        tls_backend: false"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"####################"}],"source_content_type":"text/x-yaml","patch_set":58,"id":"fd266008_e348a9b1","line":70,"range":{"start_line":41,"start_character":0,"end_line":70,"end_character":26},"in_reply_to":"70898731_5c557662","updated":"2026-09-23 10:56:34.000000000","message":"Ouh right, it\u0027s under kerbside_proxy. I still don\u0027t have good feelings about exposing all 4 types when Kerbside is enabled. I\u0027m not familiar with Kerbside itself so sorry for entry level questions, but is it possible for client to enforce communication over TLS, or it always requires the ability to use non-encrypted communication? If client can be set to use TLS only, then maybe the `enabled` could be parametrised?","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"80b4507087d058750734808ec484cd8eaa64e10c","unresolved":true,"context_lines":[{"line_number":38,"context_line":"    dimensions: \"{{ kerbside_dimensions }}\""},{"line_number":39,"context_line":"    healthcheck: \"{{ kerbside_healthcheck_proxy }}\""},{"line_number":40,"context_line":"    haproxy:"},{"line_number":41,"context_line":"      kerbside_proxy_insecure:"},{"line_number":42,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":43,"context_line":"        mode: \"tcp\""},{"line_number":44,"context_line":"        external: false"},{"line_number":45,"context_line":"        port: \"{{ kerbside_vdi_insecure_port }}\""},{"line_number":46,"context_line":"        listen_port: \"{{ kerbside_vdi_insecure_listen_port }}\""},{"line_number":47,"context_line":"        tls_backend: false"},{"line_number":48,"context_line":"      kerbside_proxy_insecure_external:"},{"line_number":49,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":50,"context_line":"        mode: \"tcp\""},{"line_number":51,"context_line":"        external: true"},{"line_number":52,"context_line":"        external_fqdn: \"{{ kolla_external_fqdn }}\""},{"line_number":53,"context_line":"        port: \"{{ kerbside_vdi_insecure_port }}\""},{"line_number":54,"context_line":"        listen_port: \"{{ kerbside_vdi_insecure_listen_port }}\""},{"line_number":55,"context_line":"        tls_backend: false"},{"line_number":56,"context_line":"      kerbside_proxy_secure:"},{"line_number":57,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":58,"context_line":"        mode: \"tcp\""},{"line_number":59,"context_line":"        external: false"},{"line_number":60,"context_line":"        port: \"{{ kerbside_vdi_secure_port }}\""},{"line_number":61,"context_line":"        listen_port: \"{{ kerbside_vdi_secure_listen_port }}\""},{"line_number":62,"context_line":"        tls_backend: false"},{"line_number":63,"context_line":"      kerbside_proxy_secure_external:"},{"line_number":64,"context_line":"        enabled: \"{{ enable_kerbside | bool }}\""},{"line_number":65,"context_line":"        mode: \"tcp\""},{"line_number":66,"context_line":"        external: true"},{"line_number":67,"context_line":"        external_fqdn: \"{{ kolla_external_fqdn }}\""},{"line_number":68,"context_line":"        port: \"{{ kerbside_vdi_secure_port }}\""},{"line_number":69,"context_line":"        listen_port: \"{{ kerbside_vdi_secure_listen_port }}\""},{"line_number":70,"context_line":"        tls_backend: false"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"####################"}],"source_content_type":"text/x-yaml","patch_set":58,"id":"d883b6f2_c2ba76db","line":70,"range":{"start_line":41,"start_character":0,"end_line":70,"end_character":26},"in_reply_to":"fd266008_e348a9b1","updated":"2026-09-23 11:14:12.000000000","message":"No worries.\n\nSo first off there are only two types -- insecure and secure. The four entries is because there is an internal and an external endpoint for each.\n\nSadly, the SPICE protocol expects both ports to be exposed to clients. Literally the only thing Kerbside does on the insecure port is to instruct the client to connect to the secure port instead, but clients will be confused if that insecure port isn\u0027t there to redirect.\n\nSpecifically this is that implementation (at the time of writing, the line numbers might move over time): https://github.com/shakenfist/kerbside/blob/develop/rust/kerbside-proxy/src/listen.rs#L63","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"}],"ansible/roles/kerbside/tasks/config.yml":[{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"daaf1065fcb9f325f445f1382e9c4ea10b825499","unresolved":true,"context_lines":[{"line_number":137,"context_line":"  become: true"},{"line_number":138,"context_line":"  ansible.builtin.template:"},{"line_number":139,"context_line":"    src: \"{{ item }}\""},{"line_number":140,"context_line":"    dest: \"{{ node_config_directory }}/kerbside/kerbside-wsgi.conf\""},{"line_number":141,"context_line":"    mode: \"0660\""},{"line_number":142,"context_line":"  with_first_found:"},{"line_number":143,"context_line":"    - \"{{ node_custom_config }}/kerbside/{{ inventory_hostname }}/kerbside-wsgi.conf\""}],"source_content_type":"text/x-yaml","patch_set":43,"id":"15832605_51db64ec","line":140,"range":{"start_line":140,"start_character":4,"end_line":140,"end_character":67},"updated":"2026-08-05 20:29:52.000000000","message":"Shouldn\u0027t it be {{ node_config_directory }}/kerbside_api/kerbside-wsgi.conf ?","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"5b0308137bd4d3b2fa4fc3c9d71fb17261f883f1","unresolved":false,"context_lines":[{"line_number":137,"context_line":"  become: true"},{"line_number":138,"context_line":"  ansible.builtin.template:"},{"line_number":139,"context_line":"    src: \"{{ item }}\""},{"line_number":140,"context_line":"    dest: \"{{ node_config_directory }}/kerbside/kerbside-wsgi.conf\""},{"line_number":141,"context_line":"    mode: \"0660\""},{"line_number":142,"context_line":"  with_first_found:"},{"line_number":143,"context_line":"    - \"{{ node_custom_config }}/kerbside/{{ inventory_hostname }}/kerbside-wsgi.conf\""}],"source_content_type":"text/x-yaml","patch_set":43,"id":"efc07947_ca4bca46","line":140,"range":{"start_line":140,"start_character":4,"end_line":140,"end_character":67},"in_reply_to":"15832605_51db64ec","updated":"2026-08-06 09:08:13.000000000","message":"Done","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"}],"ansible/roles/kerbside/tasks/precheck.yml":[{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"- name: Ensure there are hosts in the kerbside_api group"},{"line_number":10,"context_line":"  ansible.builtin.fail:"},{"line_number":11,"context_line":"    msg: There are no nodes in the kerbside_api group"},{"line_number":12,"context_line":"  when:"},{"line_number":13,"context_line":"    - enable_kerbside | bool"},{"line_number":14,"context_line":"    - groups[\u0027kerbside_api\u0027] | length \u003d\u003d 0"}],"source_content_type":"text/x-yaml","patch_set":58,"id":"92331011_9b803810","line":11,"range":{"start_line":11,"start_character":4,"end_line":11,"end_character":53},"updated":"2026-09-23 08:17:14.000000000","message":"missing double quotes","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f216e8ab716190e7bee12130dee08a82c11f45be","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"- name: Ensure there are hosts in the kerbside_api group"},{"line_number":10,"context_line":"  ansible.builtin.fail:"},{"line_number":11,"context_line":"    msg: There are no nodes in the kerbside_api group"},{"line_number":12,"context_line":"  when:"},{"line_number":13,"context_line":"    - enable_kerbside | bool"},{"line_number":14,"context_line":"    - groups[\u0027kerbside_api\u0027] | length \u003d\u003d 0"}],"source_content_type":"text/x-yaml","patch_set":58,"id":"9405f175_b9798956","line":11,"range":{"start_line":11,"start_character":4,"end_line":11,"end_character":53},"in_reply_to":"92331011_9b803810","updated":"2026-09-23 10:37:30.000000000","message":"Done","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"- name: Ensure there are hosts in the kerbside_proxy group"},{"line_number":17,"context_line":"  ansible.builtin.fail:"},{"line_number":18,"context_line":"    msg: There are no nodes in the kerbside_proxy group"},{"line_number":19,"context_line":"  when:"},{"line_number":20,"context_line":"    - enable_kerbside | bool"},{"line_number":21,"context_line":"    - groups[\u0027kerbside_proxy\u0027] | length \u003d\u003d 0"}],"source_content_type":"text/x-yaml","patch_set":58,"id":"3a797c5f_2d020c92","line":18,"range":{"start_line":18,"start_character":4,"end_line":18,"end_character":55},"updated":"2026-09-23 08:17:14.000000000","message":"ditto","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f216e8ab716190e7bee12130dee08a82c11f45be","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"- name: Ensure there are hosts in the kerbside_proxy group"},{"line_number":17,"context_line":"  ansible.builtin.fail:"},{"line_number":18,"context_line":"    msg: There are no nodes in the kerbside_proxy group"},{"line_number":19,"context_line":"  when:"},{"line_number":20,"context_line":"    - enable_kerbside | bool"},{"line_number":21,"context_line":"    - groups[\u0027kerbside_proxy\u0027] | length \u003d\u003d 0"}],"source_content_type":"text/x-yaml","patch_set":58,"id":"12cb526a_72b90bf4","line":18,"range":{"start_line":18,"start_character":4,"end_line":18,"end_character":55},"in_reply_to":"3a797c5f_2d020c92","updated":"2026-09-23 10:37:30.000000000","message":"Done","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"}],"ansible/roles/kerbside/templates/kerbside.ini.j2":[{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"daaf1065fcb9f325f445f1382e9c4ea10b825499","unresolved":true,"context_lines":[{"line_number":23,"context_line":"auth_secret_seed \u003d {{ kerbside_auth_secret_seed }}"},{"line_number":24,"context_line":"keystone_auth_url \u003d {{ keystone_internal_url }}"},{"line_number":25,"context_line":"keystone_auth_verify \u003d false"},{"line_number":26,"context_line":"keystone_service_auth_user \u003d {{ keystone_admin_user }}"},{"line_number":27,"context_line":"keystone_service_auth_password \u003d {{ keystone_admin_password }}"},{"line_number":28,"context_line":"keystone_service_auth_project \u003d {{ keystone_admin_project }}"},{"line_number":29,"context_line":"keystone_service_auth_user_domain_id \u003d {{ default_user_domain_id }}"},{"line_number":30,"context_line":"keystone_service_auth_project_domain_id \u003d {{ default_project_domain_id }}"},{"line_number":31,"context_line":"keystone_access_group \u003d kerbside"}],"source_content_type":"text/x-jinja2","patch_set":43,"id":"b3e3c5bb_a104e77e","line":28,"range":{"start_line":26,"start_character":0,"end_line":28,"end_character":60},"updated":"2026-08-05 20:29:52.000000000","message":"We should use a dedicated user here.","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"5b0308137bd4d3b2fa4fc3c9d71fb17261f883f1","unresolved":false,"context_lines":[{"line_number":23,"context_line":"auth_secret_seed \u003d {{ kerbside_auth_secret_seed }}"},{"line_number":24,"context_line":"keystone_auth_url \u003d {{ keystone_internal_url }}"},{"line_number":25,"context_line":"keystone_auth_verify \u003d false"},{"line_number":26,"context_line":"keystone_service_auth_user \u003d {{ keystone_admin_user }}"},{"line_number":27,"context_line":"keystone_service_auth_password \u003d {{ keystone_admin_password }}"},{"line_number":28,"context_line":"keystone_service_auth_project \u003d {{ keystone_admin_project }}"},{"line_number":29,"context_line":"keystone_service_auth_user_domain_id \u003d {{ default_user_domain_id }}"},{"line_number":30,"context_line":"keystone_service_auth_project_domain_id \u003d {{ default_project_domain_id }}"},{"line_number":31,"context_line":"keystone_access_group \u003d kerbside"}],"source_content_type":"text/x-jinja2","patch_set":43,"id":"4687dc82_52d5333c","line":28,"range":{"start_line":26,"start_character":0,"end_line":28,"end_character":60},"in_reply_to":"b3e3c5bb_a104e77e","updated":"2026-08-06 09:08:13.000000000","message":"Done","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":7,"context_line":"cacert_path \u003d /etc/pki/kerbside/kerbside-ca.pem"},{"line_number":8,"context_line":"proxy_host_cert_path \u003d /etc/pki/kerbside/kerbside-cert.pem"},{"line_number":9,"context_line":"proxy_host_cert_key_path \u003d /etc/pki/kerbside/kerbside-key.pem"},{"line_number":10,"context_line":"proxy_host_subject \u003d "},{"line_number":11,"context_line":"sql_url \u003d mysql+pymysql://{{ kerbside_database_user }}:{{ kerbside_database_password }}@{{ kerbside_database_address }}/{{ kerbside_database_name }}"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"api_port \u003d {{ kerbside_api_listen_port }}"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"e6c7bf46_2d9ad0eb","line":10,"range":{"start_line":10,"start_character":0,"end_line":10,"end_character":21},"updated":"2026-09-23 08:17:14.000000000","message":"empty variable","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"80b4507087d058750734808ec484cd8eaa64e10c","unresolved":true,"context_lines":[{"line_number":7,"context_line":"cacert_path \u003d /etc/pki/kerbside/kerbside-ca.pem"},{"line_number":8,"context_line":"proxy_host_cert_path \u003d /etc/pki/kerbside/kerbside-cert.pem"},{"line_number":9,"context_line":"proxy_host_cert_key_path \u003d /etc/pki/kerbside/kerbside-key.pem"},{"line_number":10,"context_line":"proxy_host_subject \u003d "},{"line_number":11,"context_line":"sql_url \u003d mysql+pymysql://{{ kerbside_database_user }}:{{ kerbside_database_password }}@{{ kerbside_database_address }}/{{ kerbside_database_name }}"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"api_port \u003d {{ kerbside_api_listen_port }}"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"cc08f751_d3875367","line":10,"range":{"start_line":10,"start_character":0,"end_line":10,"end_character":21},"in_reply_to":"4a335a55_4683f4ad","updated":"2026-09-23 11:14:12.000000000","message":"Note that this is the template for Kerbside\u0027s config file, not a template for a certificate. It definitely works in CI right now, there are tempest tests later in this series as well as private CI I run as the maintainer of Kerbside.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"3922d5b50185b8dcfa058e6fad0b4d5ccc8a09cd","unresolved":true,"context_lines":[{"line_number":7,"context_line":"cacert_path \u003d /etc/pki/kerbside/kerbside-ca.pem"},{"line_number":8,"context_line":"proxy_host_cert_path \u003d /etc/pki/kerbside/kerbside-cert.pem"},{"line_number":9,"context_line":"proxy_host_cert_key_path \u003d /etc/pki/kerbside/kerbside-key.pem"},{"line_number":10,"context_line":"proxy_host_subject \u003d "},{"line_number":11,"context_line":"sql_url \u003d mysql+pymysql://{{ kerbside_database_user }}:{{ kerbside_database_password }}@{{ kerbside_database_address }}/{{ kerbside_database_name }}"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"api_port \u003d {{ kerbside_api_listen_port }}"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"4a335a55_4683f4ad","line":10,"range":{"start_line":10,"start_character":0,"end_line":10,"end_character":21},"in_reply_to":"8b2f4808_c117bfa7","updated":"2026-09-23 10:56:34.000000000","message":"Won\u0027t that fail in CI? Would empty double quotes work here?","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f216e8ab716190e7bee12130dee08a82c11f45be","unresolved":true,"context_lines":[{"line_number":7,"context_line":"cacert_path \u003d /etc/pki/kerbside/kerbside-ca.pem"},{"line_number":8,"context_line":"proxy_host_cert_path \u003d /etc/pki/kerbside/kerbside-cert.pem"},{"line_number":9,"context_line":"proxy_host_cert_key_path \u003d /etc/pki/kerbside/kerbside-key.pem"},{"line_number":10,"context_line":"proxy_host_subject \u003d "},{"line_number":11,"context_line":"sql_url \u003d mysql+pymysql://{{ kerbside_database_user }}:{{ kerbside_database_password }}@{{ kerbside_database_address }}/{{ kerbside_database_name }}"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"api_port \u003d {{ kerbside_api_listen_port }}"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"8b2f4808_c117bfa7","line":10,"range":{"start_line":10,"start_character":0,"end_line":10,"end_character":21},"in_reply_to":"e6c7bf46_2d9ad0eb","updated":"2026-09-23 10:37:30.000000000","message":"This is deliberate -- it means that `remote-viewer` (the most common SPICE client) can verify the proxy certificate by hostname / SAN instead of subject.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"auth_secret_seed \u003d {{ kerbside_auth_secret_seed }}"},{"line_number":21,"context_line":"keystone_auth_url \u003d {{ keystone_internal_url }}"},{"line_number":22,"context_line":"keystone_auth_verify \u003d false"},{"line_number":23,"context_line":"keystone_service_auth_user \u003d {{ kerbside_keystone_user }}"},{"line_number":24,"context_line":"keystone_service_auth_password \u003d {{ kerbside_keystone_password }}"},{"line_number":25,"context_line":"keystone_service_auth_project \u003d service"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"c1ce0fc8_4a24c5ef","line":22,"range":{"start_line":22,"start_character":0,"end_line":22,"end_character":28},"updated":"2026-09-23 08:17:14.000000000","message":"why is it hardcoded to disable auth verify?","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f216e8ab716190e7bee12130dee08a82c11f45be","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"auth_secret_seed \u003d {{ kerbside_auth_secret_seed }}"},{"line_number":21,"context_line":"keystone_auth_url \u003d {{ keystone_internal_url }}"},{"line_number":22,"context_line":"keystone_auth_verify \u003d false"},{"line_number":23,"context_line":"keystone_service_auth_user \u003d {{ kerbside_keystone_user }}"},{"line_number":24,"context_line":"keystone_service_auth_password \u003d {{ kerbside_keystone_password }}"},{"line_number":25,"context_line":"keystone_service_auth_project \u003d service"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"6f34e36e_c3fde26f","line":22,"range":{"start_line":22,"start_character":0,"end_line":22,"end_character":28},"in_reply_to":"c1ce0fc8_4a24c5ef","updated":"2026-09-23 10:37:30.000000000","message":"Done","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"}],"ansible/roles/kerbside/templates/kerbside_api.json.j2":[{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"daaf1065fcb9f325f445f1382e9c4ea10b825499","unresolved":true,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"command\": \"uwsgi /etc/kerbside/kerbside-uwsgi.ini\","},{"line_number":3,"context_line":"    \"config_files\": ["},{"line_number":4,"context_line":"        {"}],"source_content_type":"text/x-jinja2","patch_set":43,"id":"1cb37182_98cf9817","line":1,"updated":"2026-08-05 20:29:52.000000000","message":"uses the old convention for permissions and directories. needs to be switched for the new format.","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"5b0308137bd4d3b2fa4fc3c9d71fb17261f883f1","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"command\": \"uwsgi /etc/kerbside/kerbside-uwsgi.ini\","},{"line_number":3,"context_line":"    \"config_files\": ["},{"line_number":4,"context_line":"        {"}],"source_content_type":"text/x-jinja2","patch_set":43,"id":"4a4e29e4_10db363f","line":1,"in_reply_to":"1cb37182_98cf9817","updated":"2026-08-06 09:08:13.000000000","message":"Done","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"}],"ansible/roles/kerbside/templates/kerbside_bootstrap.json.j2":[{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"daaf1065fcb9f325f445f1382e9c4ea10b825499","unresolved":true,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"command\": \"/etc/kerbside/kerbside_alembic_wrapper\","},{"line_number":3,"context_line":"    \"config_files\": ["},{"line_number":4,"context_line":"        {"}],"source_content_type":"text/x-jinja2","patch_set":43,"id":"282c762a_9346518c","line":1,"updated":"2026-08-05 20:29:52.000000000","message":"uses the old convention for permissions and directories. needs to be switched for the new format.","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"5b0308137bd4d3b2fa4fc3c9d71fb17261f883f1","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"command\": \"/etc/kerbside/kerbside_alembic_wrapper\","},{"line_number":3,"context_line":"    \"config_files\": ["},{"line_number":4,"context_line":"        {"}],"source_content_type":"text/x-jinja2","patch_set":43,"id":"e2551472_0f7bac70","line":1,"in_reply_to":"282c762a_9346518c","updated":"2026-08-06 09:08:13.000000000","message":"Done","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"}],"ansible/roles/kerbside/templates/kerbside_proxy.json.j2":[{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"daaf1065fcb9f325f445f1382e9c4ea10b825499","unresolved":true,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"command\": \"kerbside daemon run\","},{"line_number":3,"context_line":"    \"config_files\": ["},{"line_number":4,"context_line":"        {"}],"source_content_type":"text/x-jinja2","patch_set":43,"id":"44bcc752_872bfbd2","line":1,"updated":"2026-08-05 20:29:52.000000000","message":"uses the old convention for permissions and directories. needs to be switched for the new format.","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"5b0308137bd4d3b2fa4fc3c9d71fb17261f883f1","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{"},{"line_number":2,"context_line":"    \"command\": \"kerbside daemon run\","},{"line_number":3,"context_line":"    \"config_files\": ["},{"line_number":4,"context_line":"        {"}],"source_content_type":"text/x-jinja2","patch_set":43,"id":"f5617964_17728d0e","line":1,"in_reply_to":"44bcc752_872bfbd2","updated":"2026-08-06 09:08:13.000000000","message":"Done","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"}],"ansible/roles/kerbside/templates/kerbside_sources.yaml.j2":[{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"daaf1065fcb9f325f445f1382e9c4ea10b825499","unresolved":true,"context_lines":[{"line_number":5,"context_line":"  type: openstack"},{"line_number":6,"context_line":"  url: {{ keystone_internal_url }}"},{"line_number":7,"context_line":"  verify: false"},{"line_number":8,"context_line":"  username: {{ keystone_admin_user }}"},{"line_number":9,"context_line":"  password: {{ keystone_admin_password }}"},{"line_number":10,"context_line":"  project_name: {{ keystone_admin_project }}"},{"line_number":11,"context_line":"  user_domain_id: {{ default_user_domain_id }}"},{"line_number":12,"context_line":"  project_domain_id: {{ default_project_domain_id }}"},{"line_number":13,"context_line":"{% if nova_spice_require_secure | bool %}"}],"source_content_type":"text/x-jinja2","patch_set":43,"id":"d26defb0_0bb348de","line":10,"range":{"start_line":8,"start_character":2,"end_line":10,"end_character":44},"updated":"2026-08-05 20:29:52.000000000","message":"Use kerbside dedicated credentials ?","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"fb88a572b0889cdfc4e760248431e7f31b5470a4","unresolved":false,"context_lines":[{"line_number":5,"context_line":"  type: openstack"},{"line_number":6,"context_line":"  url: {{ keystone_internal_url }}"},{"line_number":7,"context_line":"  verify: false"},{"line_number":8,"context_line":"  username: {{ keystone_admin_user }}"},{"line_number":9,"context_line":"  password: {{ keystone_admin_password }}"},{"line_number":10,"context_line":"  project_name: {{ keystone_admin_project }}"},{"line_number":11,"context_line":"  user_domain_id: {{ default_user_domain_id }}"},{"line_number":12,"context_line":"  project_domain_id: {{ default_project_domain_id }}"},{"line_number":13,"context_line":"{% if nova_spice_require_secure | bool %}"}],"source_content_type":"text/x-jinja2","patch_set":43,"id":"77990875_199fef6f","line":10,"range":{"start_line":8,"start_character":2,"end_line":10,"end_character":44},"in_reply_to":"bc33e65c_00862a4b","updated":"2026-09-07 08:30:01.000000000","message":"Done","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"5b0308137bd4d3b2fa4fc3c9d71fb17261f883f1","unresolved":true,"context_lines":[{"line_number":5,"context_line":"  type: openstack"},{"line_number":6,"context_line":"  url: {{ keystone_internal_url }}"},{"line_number":7,"context_line":"  verify: false"},{"line_number":8,"context_line":"  username: {{ keystone_admin_user }}"},{"line_number":9,"context_line":"  password: {{ keystone_admin_password }}"},{"line_number":10,"context_line":"  project_name: {{ keystone_admin_project }}"},{"line_number":11,"context_line":"  user_domain_id: {{ default_user_domain_id }}"},{"line_number":12,"context_line":"  project_domain_id: {{ default_project_domain_id }}"},{"line_number":13,"context_line":"{% if nova_spice_require_secure | bool %}"}],"source_content_type":"text/x-jinja2","patch_set":43,"id":"bc33e65c_00862a4b","line":10,"range":{"start_line":8,"start_character":2,"end_line":10,"end_character":44},"in_reply_to":"d26defb0_0bb348de","updated":"2026-08-06 09:08:13.000000000","message":"I have followed the masakari bouncing ball for this, hopefully that\u0027s approximately correct.","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":2,"context_line":"- source: {{ openstack_region_name }}"},{"line_number":3,"context_line":"  type: openstack"},{"line_number":4,"context_line":"  url: {{ keystone_internal_url }}"},{"line_number":5,"context_line":"  verify: false"},{"line_number":6,"context_line":"  username: {{ kerbside_keystone_user }}"},{"line_number":7,"context_line":"  password: {{ kerbside_keystone_password }}"},{"line_number":8,"context_line":"  project_name: service"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"dedff769_076a85a0","line":5,"range":{"start_line":5,"start_character":0,"end_line":5,"end_character":15},"updated":"2026-09-23 08:17:14.000000000","message":"can\u0027t that be set to true when `nova_spice_require_secure` is?","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f216e8ab716190e7bee12130dee08a82c11f45be","unresolved":false,"context_lines":[{"line_number":2,"context_line":"- source: {{ openstack_region_name }}"},{"line_number":3,"context_line":"  type: openstack"},{"line_number":4,"context_line":"  url: {{ keystone_internal_url }}"},{"line_number":5,"context_line":"  verify: false"},{"line_number":6,"context_line":"  username: {{ kerbside_keystone_user }}"},{"line_number":7,"context_line":"  password: {{ kerbside_keystone_password }}"},{"line_number":8,"context_line":"  project_name: service"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"95efaccb_12b8b798","line":5,"range":{"start_line":5,"start_character":0,"end_line":5,"end_character":15},"in_reply_to":"dedff769_076a85a0","updated":"2026-09-23 10:37:30.000000000","message":"This is actually for the Keystone connection that Kerbside needs, but it is still a bug. Thank you.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"}],"ansible/roles/nova-cell/templates/nova.conf.j2":[{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"daaf1065fcb9f325f445f1382e9c4ea10b825499","unresolved":true,"context_lines":[{"line_number":87,"context_line":"playback_compression \u003d {{ nova_spice_playback_compression }}"},{"line_number":88,"context_line":"streaming_mode \u003d {{ nova_spice_streaming_mode }}"},{"line_number":89,"context_line":"{%     if enable_kerbside | bool %}"},{"line_number":90,"context_line":"spice_direct_proxy_base_url \u003d \"https://{{ kolla_external_fqdn }}:13002/nova-console.vv\""},{"line_number":91,"context_line":"{%     endif %}"},{"line_number":92,"context_line":"{%     if nova_spice_html5 | bool %}"},{"line_number":93,"context_line":"server_proxyclient_address \u003d {{ api_interface_address }}"}],"source_content_type":"text/x-jinja2","patch_set":43,"id":"662e03b8_79eecea9","line":90,"range":{"start_line":90,"start_character":65,"end_line":90,"end_character":70},"updated":"2026-08-05 20:29:52.000000000","message":"I feel like this should be configurable ?","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":37203,"name":"Bertrand Lanson","display_name":"Bertrand Lanson","email":"bertrand.lanson@infomaniak.com","username":"lanson","status":"Infomaniak Network SA"},"change_message_id":"641fd1a78beda2c023cd01d98fc1e4aeea1306a8","unresolved":false,"context_lines":[{"line_number":87,"context_line":"playback_compression \u003d {{ nova_spice_playback_compression }}"},{"line_number":88,"context_line":"streaming_mode \u003d {{ nova_spice_streaming_mode }}"},{"line_number":89,"context_line":"{%     if enable_kerbside | bool %}"},{"line_number":90,"context_line":"spice_direct_proxy_base_url \u003d \"https://{{ kolla_external_fqdn }}:13002/nova-console.vv\""},{"line_number":91,"context_line":"{%     endif %}"},{"line_number":92,"context_line":"{%     if nova_spice_html5 | bool %}"},{"line_number":93,"context_line":"server_proxyclient_address \u003d {{ api_interface_address }}"}],"source_content_type":"text/x-jinja2","patch_set":43,"id":"7eab8c6d_59ffd57c","line":90,"range":{"start_line":90,"start_character":65,"end_line":90,"end_character":70},"in_reply_to":"1feadab9_e467af85","updated":"2026-09-07 08:32:02.000000000","message":"Done","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"5b0308137bd4d3b2fa4fc3c9d71fb17261f883f1","unresolved":true,"context_lines":[{"line_number":87,"context_line":"playback_compression \u003d {{ nova_spice_playback_compression }}"},{"line_number":88,"context_line":"streaming_mode \u003d {{ nova_spice_streaming_mode }}"},{"line_number":89,"context_line":"{%     if enable_kerbside | bool %}"},{"line_number":90,"context_line":"spice_direct_proxy_base_url \u003d \"https://{{ kolla_external_fqdn }}:13002/nova-console.vv\""},{"line_number":91,"context_line":"{%     endif %}"},{"line_number":92,"context_line":"{%     if nova_spice_html5 | bool %}"},{"line_number":93,"context_line":"server_proxyclient_address \u003d {{ api_interface_address }}"}],"source_content_type":"text/x-jinja2","patch_set":43,"id":"1feadab9_e467af85","line":90,"range":{"start_line":90,"start_character":65,"end_line":90,"end_character":70},"in_reply_to":"662e03b8_79eecea9","updated":"2026-08-06 09:08:13.000000000","message":"That is a good idea.","commit_id":"a013037bd8b678eac1a07b6af5c1f29cc7967cc7"}],"ansible/templates/admin-openrc.sh.j2":[{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"5c6baa50264b6bd9587805e86f28cb50a0c19cc9","unresolved":true,"context_lines":[{"line_number":23,"context_line":"{% if kolla_admin_openrc_cacert is not none and kolla_admin_openrc_cacert | length \u003e 0 %}"},{"line_number":24,"context_line":"export OS_CACERT\u003d\u0027{{ kolla_admin_openrc_cacert }}\u0027"},{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":"{% if enable_kerbside | bool %}"},{"line_number":27,"context_line":"export KERBSIDE_API_URL\u003d\u0027{{ kerbside_api_url }}\u0027"},{"line_number":28,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"cd8c6166_465493e2","line":28,"range":{"start_line":26,"start_character":0,"end_line":28,"end_character":11},"updated":"2026-09-23 08:17:14.000000000","message":"does it mean that kerbside is not registered as an endpoint in service catalogue?","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":34034,"name":"Franciszek Przewoźny","display_name":"Franciszek Przewozny","email":"przewozny.franciszek@gmail.com","username":"fprzewozn","status":"OpenStack Engineer / SRE @ Opera Software"},"change_message_id":"3922d5b50185b8dcfa058e6fad0b4d5ccc8a09cd","unresolved":false,"context_lines":[{"line_number":23,"context_line":"{% if kolla_admin_openrc_cacert is not none and kolla_admin_openrc_cacert | length \u003e 0 %}"},{"line_number":24,"context_line":"export OS_CACERT\u003d\u0027{{ kolla_admin_openrc_cacert }}\u0027"},{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":"{% if enable_kerbside | bool %}"},{"line_number":27,"context_line":"export KERBSIDE_API_URL\u003d\u0027{{ kerbside_api_url }}\u0027"},{"line_number":28,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"334920d2_d8f995a8","line":28,"range":{"start_line":26,"start_character":0,"end_line":28,"end_character":11},"in_reply_to":"13938f89_5ae905dd","updated":"2026-09-23 10:56:34.000000000","message":"It might be useful, no opinion here, as it\u0027s not being registered as an endpoint this really could be beneficial.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"f216e8ab716190e7bee12130dee08a82c11f45be","unresolved":true,"context_lines":[{"line_number":23,"context_line":"{% if kolla_admin_openrc_cacert is not none and kolla_admin_openrc_cacert | length \u003e 0 %}"},{"line_number":24,"context_line":"export OS_CACERT\u003d\u0027{{ kolla_admin_openrc_cacert }}\u0027"},{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":"{% if enable_kerbside | bool %}"},{"line_number":27,"context_line":"export KERBSIDE_API_URL\u003d\u0027{{ kerbside_api_url }}\u0027"},{"line_number":28,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":58,"id":"13938f89_5ae905dd","line":28,"range":{"start_line":26,"start_character":0,"end_line":28,"end_character":11},"in_reply_to":"cd8c6166_465493e2","updated":"2026-09-23 10:37:30.000000000","message":"Correct. Kerbside is not an OpenStack project and therefore does not register itself in Keystone. Honestly this is only useful to admins who can use kerbside-client and this environment variable to do things like enumerating current SPICE sessions as well as terminating them, so perhaps it should be dropped. It seemed useful at the time though.","commit_id":"6f65c775b2cd9605ae9b0ad7fd3eacbd6565d9cb"}]}