)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"0daaaca3e3b1bd38d69072383076ef131a5664f6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"729f2d42_c46ce82a","updated":"2026-07-06 08:23:20.000000000","message":"recheck: network failure","commit_id":"c4933838d6e08efc9fb18d8d612cc6114ceda3f6"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"b28c31d570bbd8156062cec1be95efab7af4608c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"aeb64bb8_9e4294bb","updated":"2026-07-23 11:06:00.000000000","message":"@doug@stackhpc.com even if this is not a cherry-pick but please merge https://review.opendev.org/c/openstack/kolla-ansible/+/986381 too","commit_id":"6c16ce6442af52a22357da69e41968f99c69d300"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"f6449dc3a6672c0301ae8eb4591d65d9174b360f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"235a493d_ea8d279f","updated":"2026-07-23 10:06:07.000000000","message":"Yep","commit_id":"6c16ce6442af52a22357da69e41968f99c69d300"}],"ansible/roles/certificates/tasks/generate.yml":[{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"87ec3db935d68c41361d437ee52148968b0db62b","unresolved":true,"context_lines":[{"line_number":59,"context_line":"    - letsencrypt_managed_certs \u003d\u003d \u0027internal\u0027 or letsencrypt_managed_certs \u003d\u003d \u0027\u0027"},{"line_number":60,"context_line":"    - kolla_enable_tls_external | bool"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"# ProxySQL frontend TLS (database internal TLS) needs separate CA file"},{"line_number":63,"context_line":"- name: Copy CA certificate for ProxySQL"},{"line_number":64,"context_line":"  ansible.builtin.copy:"},{"line_number":65,"context_line":"    src: \"{{ certificates_root_dir }}/root.crt\""},{"line_number":66,"context_line":"    dest: \"{{ kolla_certificates_dir }}/proxysql-ca.pem\""},{"line_number":67,"context_line":"    mode: \"0660\""},{"line_number":68,"context_line":"  when: database_enable_tls_internal | bool"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"- name: Copy external certificates for ProxySQL"},{"line_number":71,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"a754ea20_ea1d259f","line":68,"range":{"start_line":62,"start_character":0,"end_line":68,"end_character":43},"updated":"2026-07-21 21:25:49.000000000","message":"Not needed since it\u0027s just a copy, not a separate file. The src is accessed from the other kolla-ansible tasks. See next comment.","commit_id":"b2a1c72c46a0582f894558dd41269c6aa14ca8e9"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"231c0a764d32f0a030fc46d48101b42a7c8bcae9","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    - letsencrypt_managed_certs \u003d\u003d \u0027internal\u0027 or letsencrypt_managed_certs \u003d\u003d \u0027\u0027"},{"line_number":60,"context_line":"    - kolla_enable_tls_external | bool"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"# ProxySQL frontend TLS (database internal TLS) needs separate CA file"},{"line_number":63,"context_line":"- name: Copy CA certificate for ProxySQL"},{"line_number":64,"context_line":"  ansible.builtin.copy:"},{"line_number":65,"context_line":"    src: \"{{ certificates_root_dir }}/root.crt\""},{"line_number":66,"context_line":"    dest: \"{{ kolla_certificates_dir }}/proxysql-ca.pem\""},{"line_number":67,"context_line":"    mode: \"0660\""},{"line_number":68,"context_line":"  when: database_enable_tls_internal | bool"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"- name: Copy external certificates for ProxySQL"},{"line_number":71,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"5938e72b_6c888dac","line":68,"range":{"start_line":62,"start_character":0,"end_line":68,"end_character":43},"in_reply_to":"0689226c_9c046802","updated":"2026-07-22 20:25:06.000000000","message":"The ansible/roles/certificates/tasks/generate.yml changed here adds a confusion.\nIt should be in the other change like \u0027add proxysql support to the certificates role\u0027 ;)\n\nBTW, you fixed only issue with proxysql, the same issue can in other cases, for example fronted uses one CA, backend second CA, proxysql third, etc.\n\nThe bug 2150449 should be fixed in the other way, we need support multiple CA files copied from ca-certificates folder to the containers.\n\nAnyway LGTM.","commit_id":"b2a1c72c46a0582f894558dd41269c6aa14ca8e9"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"5bfddf4e12b3ad19e2a1738850f2159b743dcdec","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    - letsencrypt_managed_certs \u003d\u003d \u0027internal\u0027 or letsencrypt_managed_certs \u003d\u003d \u0027\u0027"},{"line_number":60,"context_line":"    - kolla_enable_tls_external | bool"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"# ProxySQL frontend TLS (database internal TLS) needs separate CA file"},{"line_number":63,"context_line":"- name: Copy CA certificate for ProxySQL"},{"line_number":64,"context_line":"  ansible.builtin.copy:"},{"line_number":65,"context_line":"    src: \"{{ certificates_root_dir }}/root.crt\""},{"line_number":66,"context_line":"    dest: \"{{ kolla_certificates_dir }}/proxysql-ca.pem\""},{"line_number":67,"context_line":"    mode: \"0660\""},{"line_number":68,"context_line":"  when: database_enable_tls_internal | bool"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"- name: Copy external certificates for ProxySQL"},{"line_number":71,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"521a81ce_626cc7eb","line":68,"range":{"start_line":62,"start_character":0,"end_line":68,"end_character":43},"in_reply_to":"5938e72b_6c888dac","updated":"2026-07-23 09:48:21.000000000","message":"Other services deployed by K-A works fine with just having root CA. It was just the ProxySQL that refused to do so...\nSo, at this time, this should be enough.","commit_id":"b2a1c72c46a0582f894558dd41269c6aa14ca8e9"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"f6a9b9a346919c238da5322f5f4886a5ee1f6fd8","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    - letsencrypt_managed_certs \u003d\u003d \u0027internal\u0027 or letsencrypt_managed_certs \u003d\u003d \u0027\u0027"},{"line_number":60,"context_line":"    - kolla_enable_tls_external | bool"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"# ProxySQL frontend TLS (database internal TLS) needs separate CA file"},{"line_number":63,"context_line":"- name: Copy CA certificate for ProxySQL"},{"line_number":64,"context_line":"  ansible.builtin.copy:"},{"line_number":65,"context_line":"    src: \"{{ certificates_root_dir }}/root.crt\""},{"line_number":66,"context_line":"    dest: \"{{ kolla_certificates_dir }}/proxysql-ca.pem\""},{"line_number":67,"context_line":"    mode: \"0660\""},{"line_number":68,"context_line":"  when: database_enable_tls_internal | bool"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"- name: Copy external certificates for ProxySQL"},{"line_number":71,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"0689226c_9c046802","line":68,"range":{"start_line":62,"start_character":0,"end_line":68,"end_character":43},"in_reply_to":"a754ea20_ea1d259f","updated":"2026-07-22 12:56:35.000000000","message":"It can be just a copy of root.crt IF an user is NOT affected by the bug https://bugs.launchpad.net/kolla-ansible/+bug/2150449.\nMy commit message explains the case we need a separate proxysql-ca.pem.\nIf users are not affected, we don\u0027t want them to do anything, hence all the checks and conditional templating.\nPerhaps, this gives me the reason to add release note. I\u0027ll add one.","commit_id":"b2a1c72c46a0582f894558dd41269c6aa14ca8e9"}],"ansible/roles/loadbalancer/tasks/copy-certs.yml":[{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"6cdfcf3e60914d24e01d186068760837d9795e07","unresolved":true,"context_lines":[{"line_number":42,"context_line":"  when:"},{"line_number":43,"context_line":"    - database_enable_tls_internal | bool"},{"line_number":44,"context_line":"    - service | service_enabled_and_mapped_to_host"},{"line_number":45,"context_line":"    - proxysql_ca_file.stat.exists"},{"line_number":46,"context_line":"    - not kolla_externally_managed_cert | bool"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- name: Copying over proxysql-cert.pem"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"33dadf4f_63858bee","line":45,"range":{"start_line":45,"start_character":6,"end_line":45,"end_character":22},"updated":"2026-07-13 09:05:02.000000000","message":"can\u0027t see this var. leftover?","commit_id":"c4933838d6e08efc9fb18d8d612cc6114ceda3f6"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"08c8f595d187ced47dec7db84cd87a616f740526","unresolved":false,"context_lines":[{"line_number":42,"context_line":"  when:"},{"line_number":43,"context_line":"    - database_enable_tls_internal | bool"},{"line_number":44,"context_line":"    - service | service_enabled_and_mapped_to_host"},{"line_number":45,"context_line":"    - proxysql_ca_file.stat.exists"},{"line_number":46,"context_line":"    - not kolla_externally_managed_cert | bool"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- name: Copying over proxysql-cert.pem"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"a4d6116d_17c72a3f","line":45,"range":{"start_line":45,"start_character":6,"end_line":45,"end_character":22},"in_reply_to":"33dadf4f_63858bee","updated":"2026-07-21 09:24:19.000000000","message":"The new task at config.yml checks for the proxysql_ca_file but I\u0027ll move that task to here for better readability.","commit_id":"c4933838d6e08efc9fb18d8d612cc6114ceda3f6"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"b0cb8a1100210884f500a67f6a7af121555d35e9","unresolved":false,"context_lines":[{"line_number":42,"context_line":"  when:"},{"line_number":43,"context_line":"    - database_enable_tls_internal | bool"},{"line_number":44,"context_line":"    - service | service_enabled_and_mapped_to_host"},{"line_number":45,"context_line":"    - proxysql_ca_file.stat.exists"},{"line_number":46,"context_line":"    - not kolla_externally_managed_cert | bool"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- name: Copying over proxysql-cert.pem"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"e2e843e6_13427732","line":45,"range":{"start_line":45,"start_character":6,"end_line":45,"end_character":22},"in_reply_to":"a4d6116d_17c72a3f","updated":"2026-07-21 14:59:31.000000000","message":"I forgot that the stat task needs to be in config.yml because proxysql.json.j2 is templated with the variable proxysql_ca_file. Reverting to patchset 3.","commit_id":"c4933838d6e08efc9fb18d8d612cc6114ceda3f6"},{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"87ec3db935d68c41361d437ee52148968b0db62b","unresolved":true,"context_lines":[{"line_number":35,"context_line":"  vars:"},{"line_number":36,"context_line":"    service: \"{{ loadbalancer_services[\u0027proxysql\u0027] }}\""},{"line_number":37,"context_line":"  ansible.builtin.copy:"},{"line_number":38,"context_line":"    src: \"{{ kolla_certificates_dir }}/proxysql-ca.pem\""},{"line_number":39,"context_line":"    dest: \"{{ node_config_directory }}/proxysql/proxysql-ca.pem\""},{"line_number":40,"context_line":"    mode: \"0660\""},{"line_number":41,"context_line":"  become: true"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"a7a2bdff_8d520c90","line":38,"range":{"start_line":38,"start_character":4,"end_line":38,"end_character":55},"updated":"2026-07-21 21:25:49.000000000","message":"why do we need the intermediate task in the config.yml since we can use simple\n`{{ certificates_root_dir }}/root.crt` here ? without extra tasks and extra checks?\nJFYI this copy-certs.yml is included in config.yml already when some checks are passed.\nAlso it would be great to have a kind of the override default (root.crt) if needed for example with custom (proxysql-ca.pem) file, this can be done with `first found` Ansible loop.","commit_id":"b2a1c72c46a0582f894558dd41269c6aa14ca8e9"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"f6a9b9a346919c238da5322f5f4886a5ee1f6fd8","unresolved":false,"context_lines":[{"line_number":35,"context_line":"  vars:"},{"line_number":36,"context_line":"    service: \"{{ loadbalancer_services[\u0027proxysql\u0027] }}\""},{"line_number":37,"context_line":"  ansible.builtin.copy:"},{"line_number":38,"context_line":"    src: \"{{ kolla_certificates_dir }}/proxysql-ca.pem\""},{"line_number":39,"context_line":"    dest: \"{{ node_config_directory }}/proxysql/proxysql-ca.pem\""},{"line_number":40,"context_line":"    mode: \"0660\""},{"line_number":41,"context_line":"  become: true"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"9ded4ae5_64009bfd","line":38,"range":{"start_line":38,"start_character":4,"end_line":38,"end_character":55},"in_reply_to":"a7a2bdff_8d520c90","updated":"2026-07-22 12:56:35.000000000","message":"Explained at the first comment.","commit_id":"b2a1c72c46a0582f894558dd41269c6aa14ca8e9"}],"ansible/roles/loadbalancer/templates/proxysql/proxysql.json.j2":[{"author":{"_account_id":14200,"name":"Maksim Malchuk","email":"maksim.malchuk@gmail.com","username":"mmalchuk"},"change_message_id":"87ec3db935d68c41361d437ee52148968b0db62b","unresolved":true,"context_lines":[{"line_number":52,"context_line":"        }{% endif %}"},{"line_number":53,"context_line":"        {% if database_enable_tls_internal | bool %},"},{"line_number":54,"context_line":"        {"},{"line_number":55,"context_line":"            \"source\": \"{{ container_config_directory }}/{% if proxysql_ca_file.stat.exists %}proxysql-ca.pem{% else %}ca-certificates/root.crt{% endif %}\","},{"line_number":56,"context_line":"            \"dest\": \"/var/lib/proxysql/proxysql-ca.pem\","},{"line_number":57,"context_line":"            \"owner\": \"proxysql\","},{"line_number":58,"context_line":"            \"perm\": \"0600\""}],"source_content_type":"text/x-jinja2","patch_set":6,"id":"feac7e0f_2a95e3e1","line":55,"range":{"start_line":55,"start_character":56,"end_line":55,"end_character":118},"updated":"2026-07-21 21:25:49.000000000","message":"this also not needed in case of the previous comments","commit_id":"b2a1c72c46a0582f894558dd41269c6aa14ca8e9"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"f6a9b9a346919c238da5322f5f4886a5ee1f6fd8","unresolved":false,"context_lines":[{"line_number":52,"context_line":"        }{% endif %}"},{"line_number":53,"context_line":"        {% if database_enable_tls_internal | bool %},"},{"line_number":54,"context_line":"        {"},{"line_number":55,"context_line":"            \"source\": \"{{ container_config_directory }}/{% if proxysql_ca_file.stat.exists %}proxysql-ca.pem{% else %}ca-certificates/root.crt{% endif %}\","},{"line_number":56,"context_line":"            \"dest\": \"/var/lib/proxysql/proxysql-ca.pem\","},{"line_number":57,"context_line":"            \"owner\": \"proxysql\","},{"line_number":58,"context_line":"            \"perm\": \"0600\""}],"source_content_type":"text/x-jinja2","patch_set":6,"id":"bd525485_cdfb4a64","line":55,"range":{"start_line":55,"start_character":56,"end_line":55,"end_character":118},"in_reply_to":"feac7e0f_2a95e3e1","updated":"2026-07-22 12:56:35.000000000","message":"Explained at the first comment.","commit_id":"b2a1c72c46a0582f894558dd41269c6aa14ca8e9"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"e24bb7fa7e849e45d67a19264ee134df55f0a368","unresolved":true,"context_lines":[{"line_number":52,"context_line":"        }{% endif %}"},{"line_number":53,"context_line":"        {% if database_enable_tls_internal | bool %},"},{"line_number":54,"context_line":"        {"},{"line_number":55,"context_line":"            \"source\": \"{{ container_config_directory }}/{% if proxysql_ca_file.stat.exists %}proxysql-ca.pem{% else %}ca-certificates/root.crt{% endif %}\","},{"line_number":56,"context_line":"            \"dest\": \"/var/lib/proxysql/proxysql-ca.pem\","},{"line_number":57,"context_line":"            \"owner\": \"proxysql\","},{"line_number":58,"context_line":"            \"perm\": \"0600\""}],"source_content_type":"text/x-jinja2","patch_set":7,"id":"e26ee444_b5c6b837","line":55,"updated":"2026-07-22 13:11:08.000000000","message":"Can we not mix jinja2 and {{ }} in one line? Just use the python syntax in {{ }}","commit_id":"25f7649e204213bb602e63daa18af7272b576188"},{"author":{"_account_id":36765,"name":"Seunghun Lee","display_name":"Seunghun Lee","email":"seunghun@stackhpc.com","username":"seunghun1ee","status":"Cloud Engineer at StackHPC"},"change_message_id":"2afccabd7e21b9bab621572d4e64adf5b0321b4d","unresolved":false,"context_lines":[{"line_number":52,"context_line":"        }{% endif %}"},{"line_number":53,"context_line":"        {% if database_enable_tls_internal | bool %},"},{"line_number":54,"context_line":"        {"},{"line_number":55,"context_line":"            \"source\": \"{{ container_config_directory }}/{% if proxysql_ca_file.stat.exists %}proxysql-ca.pem{% else %}ca-certificates/root.crt{% endif %}\","},{"line_number":56,"context_line":"            \"dest\": \"/var/lib/proxysql/proxysql-ca.pem\","},{"line_number":57,"context_line":"            \"owner\": \"proxysql\","},{"line_number":58,"context_line":"            \"perm\": \"0600\""}],"source_content_type":"text/x-jinja2","patch_set":7,"id":"9647edf4_e415d082","line":55,"in_reply_to":"e26ee444_b5c6b837","updated":"2026-07-22 13:15:51.000000000","message":"Done","commit_id":"25f7649e204213bb602e63daa18af7272b576188"}]}