)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"45096361d1452ff50e0e4fcb6ddd376d64776048","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":7,"id":"0780597a_e8aa2d49","updated":"2026-06-16 14:36:01.000000000","message":"Actually - should we have a precheck for this files existence? Do we have prechecks for other certificate aspects of proxysql?","commit_id":"fd188010d93a5fde9336471ba06bbb745eeef626"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"3237ae5db78e108fbc979fd3a055bc9fad32dfeb","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"0781d3e7_86ee1985","updated":"2026-04-30 07:20:51.000000000","message":"recheck: unrelated timeout","commit_id":"fd188010d93a5fde9336471ba06bbb745eeef626"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"4839ce333da16c0c00d6c6dbb51a3ef23167b90f","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":7,"id":"e01586d5_f0508ca5","in_reply_to":"0780597a_e8aa2d49","updated":"2026-06-17 20:05:05.000000000","message":"Sure, prechecks are actually needed.","commit_id":"fd188010d93a5fde9336471ba06bbb745eeef626"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"00cbeebd95efd9c51b3db2c84a67532094776b2b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":7,"id":"e61887c4_b17fcf65","in_reply_to":"e01586d5_f0508ca5","updated":"2026-06-30 14:12:25.000000000","message":"Done","commit_id":"fd188010d93a5fde9336471ba06bbb745eeef626"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"8b523c01f7b69fed8c95930fcbfc1378c65768fb","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":11,"id":"18f45281_03fd8b33","updated":"2026-07-02 13:59:25.000000000","message":"recheck: CI failed to pull logs","commit_id":"aad520bd91773283c5b7a20be662fe931f5b97ad"}],"ansible/roles/loadbalancer/tasks/precheck.yml":[{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"656f9ab9eb4fd180f2dc33c54955479ef0f722d1","unresolved":true,"context_lines":[{"line_number":99,"context_line":"- name: Check database internal TLS CA (ProxySQL CA) certificate existence"},{"line_number":100,"context_line":"  when:"},{"line_number":101,"context_line":"    - database_enable_tls_internal | bool"},{"line_number":102,"context_line":"    - enable_proxysql | bool"},{"line_number":103,"context_line":"  block:"},{"line_number":104,"context_line":"    - name: Checking if database internal TLS CA (ProxySQL CA) certificate exists"},{"line_number":105,"context_line":"      run_once: true"}],"source_content_type":"text/x-yaml","patch_set":12,"id":"56278974_667adf3d","line":102,"updated":"2026-07-23 11:17:25.000000000","message":"```suggestion\n    - enable_proxysql | bool\n    - not kolla_externally_managed_cert | bool\n```","commit_id":"bdb64bfc9a19c39f7e5ef071824a3b6ec73aca7c"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"2938d4b4cb54705bf5761c16cbe45fc523925580","unresolved":false,"context_lines":[{"line_number":99,"context_line":"- name: Check database internal TLS CA (ProxySQL CA) certificate existence"},{"line_number":100,"context_line":"  when:"},{"line_number":101,"context_line":"    - database_enable_tls_internal | bool"},{"line_number":102,"context_line":"    - enable_proxysql | bool"},{"line_number":103,"context_line":"  block:"},{"line_number":104,"context_line":"    - name: Checking if database internal TLS CA (ProxySQL CA) certificate exists"},{"line_number":105,"context_line":"      run_once: true"}],"source_content_type":"text/x-yaml","patch_set":12,"id":"dd910e74_25e2fa2f","line":102,"in_reply_to":"56278974_667adf3d","updated":"2026-07-23 14:26:54.000000000","message":"Done","commit_id":"bdb64bfc9a19c39f7e5ef071824a3b6ec73aca7c"}],"releasenotes/notes/fix-proxysql-database-internal-tls-df29b25c7b1081f6.yaml":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"45096361d1452ff50e0e4fcb6ddd376d64776048","unresolved":true,"context_lines":[{"line_number":4,"context_line":"    Fixes bug `LP#2150449 \u003chttps://bugs.launchpad.net/kolla-ansible/+bug/2150449\u003e`__"},{"line_number":5,"context_line":"    where ProxySQL\u0027s database internal TLS fails when users use chain of"},{"line_number":6,"context_line":"    certificates (e.g. use of intermediate certificates)."},{"line_number":7,"context_line":"    Users are now required to prepare certificate file named"},{"line_number":8,"context_line":"    ``proxysql-ca.pem`` at ``certificates_internal_dir`` if ProxySQL and"},{"line_number":9,"context_line":"    database internal TLS are enabled."},{"line_number":10,"context_line":"    This file can be a copy of root CA of database internal TLS if intermediate"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"0d4ab8bd_844d7371","line":7,"updated":"2026-06-16 14:36:01.000000000","message":"That is not backwards compatible - so are you fine with not backporting this?","commit_id":"fd188010d93a5fde9336471ba06bbb745eeef626"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"5e8ae9f0a7c11ba1662a6e1fe24985a81a57a151","unresolved":true,"context_lines":[{"line_number":4,"context_line":"    Fixes bug `LP#2150449 \u003chttps://bugs.launchpad.net/kolla-ansible/+bug/2150449\u003e`__"},{"line_number":5,"context_line":"    where ProxySQL\u0027s database internal TLS fails when users use chain of"},{"line_number":6,"context_line":"    certificates (e.g. use of intermediate certificates)."},{"line_number":7,"context_line":"    Users are now required to prepare certificate file named"},{"line_number":8,"context_line":"    ``proxysql-ca.pem`` at ``certificates_internal_dir`` if ProxySQL and"},{"line_number":9,"context_line":"    database internal TLS are enabled."},{"line_number":10,"context_line":"    This file can be a copy of root CA of database internal TLS if intermediate"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"65ab3e76_b96c1520","line":7,"in_reply_to":"0d4ab8bd_844d7371","updated":"2026-06-16 15:56:50.000000000","message":"It looks like it needs to be backported. @seunghun@stackhpc.com, isn\u0027t it?","commit_id":"fd188010d93a5fde9336471ba06bbb745eeef626"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"76c8fc031150780bea2ea3ad7bac641740eac535","unresolved":true,"context_lines":[{"line_number":4,"context_line":"    Fixes bug `LP#2150449 \u003chttps://bugs.launchpad.net/kolla-ansible/+bug/2150449\u003e`__"},{"line_number":5,"context_line":"    where ProxySQL\u0027s database internal TLS fails when users use chain of"},{"line_number":6,"context_line":"    certificates (e.g. use of intermediate certificates)."},{"line_number":7,"context_line":"    Users are now required to prepare certificate file named"},{"line_number":8,"context_line":"    ``proxysql-ca.pem`` at ``certificates_internal_dir`` if ProxySQL and"},{"line_number":9,"context_line":"    database internal TLS are enabled."},{"line_number":10,"context_line":"    This file can be a copy of root CA of database internal TLS if intermediate"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"7a368818_a1f7ab49","line":7,"in_reply_to":"65ab3e76_b96c1520","updated":"2026-06-17 13:25:09.000000000","message":"I want this to be backported to all the way to Epoxy since that\u0027s the release we forced loadbalancing of DB to use ProxySQL. However, that\u0027s correct. This is not backward compatible. I\u0027m not sure how to make this backward compatible.\n\nCurrently it will break everyone without proxysql-ca.pem file ready. For most of users who does not use intermediate cert, proxysql-ca.pem can simply be the copy of root CA cert. But the reason for asking separate file proxysql-ca.pem was to make only the ProxySQL to get the intermediate CA cert copied into it.\n\nFrom Michal\u0027s other comment, some prechecks of checking cert files existence would be good but strictly speaking that doesn\u0027t make this backward compatible.\n\nAny ideas? If we can\u0027t find the better approach, then we\u0027d need to only merged to master I assume.","commit_id":"fd188010d93a5fde9336471ba06bbb745eeef626"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"d03793c6723d0bf48ceda464396d556fb58b72ea","unresolved":true,"context_lines":[{"line_number":4,"context_line":"    Fixes bug `LP#2150449 \u003chttps://bugs.launchpad.net/kolla-ansible/+bug/2150449\u003e`__"},{"line_number":5,"context_line":"    where ProxySQL\u0027s database internal TLS fails when users use chain of"},{"line_number":6,"context_line":"    certificates (e.g. use of intermediate certificates)."},{"line_number":7,"context_line":"    Users are now required to prepare certificate file named"},{"line_number":8,"context_line":"    ``proxysql-ca.pem`` at ``certificates_internal_dir`` if ProxySQL and"},{"line_number":9,"context_line":"    database internal TLS are enabled."},{"line_number":10,"context_line":"    This file can be a copy of root CA of database internal TLS if intermediate"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"aa61aa79_cacedcec","line":7,"in_reply_to":"7a368818_a1f7ab49","updated":"2026-06-17 20:04:23.000000000","message":"For this case, the upgrade section of the reno is enough, IMHO. Every operator who uses the upgrade should read renos, isn\u0027t it?","commit_id":"fd188010d93a5fde9336471ba06bbb745eeef626"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"162e2dd87713469ce28f0eca304977cc3ae377de","unresolved":false,"context_lines":[{"line_number":4,"context_line":"    Fixes bug `LP#2150449 \u003chttps://bugs.launchpad.net/kolla-ansible/+bug/2150449\u003e`__"},{"line_number":5,"context_line":"    where ProxySQL\u0027s database internal TLS fails when users use chain of"},{"line_number":6,"context_line":"    certificates (e.g. use of intermediate certificates)."},{"line_number":7,"context_line":"    Users are now required to prepare certificate file named"},{"line_number":8,"context_line":"    ``proxysql-ca.pem`` at ``certificates_internal_dir`` if ProxySQL and"},{"line_number":9,"context_line":"    database internal TLS are enabled."},{"line_number":10,"context_line":"    This file can be a copy of root CA of database internal TLS if intermediate"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"b6dcf47d_acbe7f27","line":7,"in_reply_to":"aa61aa79_cacedcec","updated":"2026-06-22 10:41:33.000000000","message":"I\u0027ll prepare a stable-only patch which will have a fall-back for users who does not have proxysql-ca.pem.","commit_id":"fd188010d93a5fde9336471ba06bbb745eeef626"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"dcf880a098f01e7ec7209678651d216f9526436f","unresolved":false,"context_lines":[{"line_number":4,"context_line":"    Fixes bug `LP#2150449 \u003chttps://bugs.launchpad.net/kolla-ansible/+bug/2150449\u003e`__"},{"line_number":5,"context_line":"    where ProxySQL\u0027s database internal TLS fails when users use chain of"},{"line_number":6,"context_line":"    certificates (e.g. use of intermediate certificates)."},{"line_number":7,"context_line":"    Users are now required to prepare certificate file named"},{"line_number":8,"context_line":"    ``proxysql-ca.pem`` at ``certificates_internal_dir`` if ProxySQL and"},{"line_number":9,"context_line":"    database internal TLS are enabled."},{"line_number":10,"context_line":"    This file can be a copy of root CA of database internal TLS if intermediate"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"2619318a_f6fdcdd3","line":7,"in_reply_to":"b6dcf47d_acbe7f27","updated":"2026-06-30 14:12:14.000000000","message":"Backward compatible stable-only patch: https://review.opendev.org/c/openstack/kolla-ansible/+/994258","commit_id":"fd188010d93a5fde9336471ba06bbb745eeef626"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"113ff35a7c1a539b281708be059c23618f1109e0","unresolved":true,"context_lines":[{"line_number":4,"context_line":"    Fixes bug `LP#2150449 \u003chttps://bugs.launchpad.net/kolla-ansible/+bug/2150449\u003e`__"},{"line_number":5,"context_line":"    where ProxySQL\u0027s database internal TLS fails when users use chain of"},{"line_number":6,"context_line":"    certificates (e.g. use of intermediate certificates)."},{"line_number":7,"context_line":"    Users are now required to prepare certificate file named"},{"line_number":8,"context_line":"    ``proxysql-ca.pem`` at ``certificates_internal_dir`` if ProxySQL and"},{"line_number":9,"context_line":"    database internal TLS are enabled."},{"line_number":10,"context_line":"    This file can be a copy of root CA of database internal TLS if intermediate"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"49280dcf_7ea8b487","line":7,"updated":"2026-07-23 09:56:47.000000000","message":"I\u0027d say we need this also in the upgrade part of the reno","commit_id":"aad520bd91773283c5b7a20be662fe931f5b97ad"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"978bdc39fd5fd3ae22757e02145de6f2e104918a","unresolved":false,"context_lines":[{"line_number":4,"context_line":"    Fixes bug `LP#2150449 \u003chttps://bugs.launchpad.net/kolla-ansible/+bug/2150449\u003e`__"},{"line_number":5,"context_line":"    where ProxySQL\u0027s database internal TLS fails when users use chain of"},{"line_number":6,"context_line":"    certificates (e.g. use of intermediate certificates)."},{"line_number":7,"context_line":"    Users are now required to prepare certificate file named"},{"line_number":8,"context_line":"    ``proxysql-ca.pem`` at ``certificates_internal_dir`` if ProxySQL and"},{"line_number":9,"context_line":"    database internal TLS are enabled."},{"line_number":10,"context_line":"    This file can be a copy of root CA of database internal TLS if intermediate"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"e7e45d25_369940fd","line":7,"in_reply_to":"49280dcf_7ea8b487","updated":"2026-07-23 09:58:20.000000000","message":"Good point","commit_id":"aad520bd91773283c5b7a20be662fe931f5b97ad"},{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"656f9ab9eb4fd180f2dc33c54955479ef0f722d1","unresolved":true,"context_lines":[{"line_number":6,"context_line":"    certificates (e.g. use of intermediate certificates)."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"    Users are now required to prepare certificate file named"},{"line_number":9,"context_line":"    ``proxysql-ca.pem`` at ``certificates_internal_dir`` if ProxySQL and"},{"line_number":10,"context_line":"    database internal TLS are enabled."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"    This file can be a copy of root CA of database internal TLS if intermediate"}],"source_content_type":"text/x-yaml","patch_set":12,"id":"34f3a0dd_b8e7f7e0","line":9,"updated":"2026-07-23 11:17:25.000000000","message":"precheck is checking in kolla_certificates_dir, not in certificates_internal_dir","commit_id":"bdb64bfc9a19c39f7e5ef071824a3b6ec73aca7c"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"2938d4b4cb54705bf5761c16cbe45fc523925580","unresolved":false,"context_lines":[{"line_number":6,"context_line":"    certificates (e.g. use of intermediate certificates)."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"    Users are now required to prepare certificate file named"},{"line_number":9,"context_line":"    ``proxysql-ca.pem`` at ``certificates_internal_dir`` if ProxySQL and"},{"line_number":10,"context_line":"    database internal TLS are enabled."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"    This file can be a copy of root CA of database internal TLS if intermediate"}],"source_content_type":"text/x-yaml","patch_set":12,"id":"dd9a164e_f5ad604e","line":9,"in_reply_to":"34f3a0dd_b8e7f7e0","updated":"2026-07-23 14:26:54.000000000","message":"Done","commit_id":"bdb64bfc9a19c39f7e5ef071824a3b6ec73aca7c"}]}