)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"3d74f6a3715741544df483c7ebf247238e3b4609","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"54c6ad15_9c495900","updated":"2023-11-07 14:36:17.000000000","message":"I think issue here, is that while template is kinda the same - behavior will differ when it\u0027s installed on a member of galera cluster (as then socket will be used for communication) and if it\u0027s remote connection (ie utility host/container).\n\nAs in second case, it seems that CA won\u0027t be present - we don\u0027t install `galera_ssl_ca_cert` for clients:\nhttps://opendev.org/openstack/openstack-ansible-galera_server/src/branch/master/tasks/galera_client_main.yml#L28-L37\n\nSo probably you\u0027d need to add variable to defaults, like:\n\n```\ngalera_pki_install_client_ca:\n  - src: \"{{ galera_user_ssl_ca_cert | default(galera_pki_intermediate_cert_path) }}\"\n    dest: \"{{ galera_ssl_ca_cert }}\"\n    owner: \"root\"\n    group: \"root\"\n    mode: \"0644\"\n```\n\nAnd then in the galera_client_main.yml add: `pki_install_certificates: \"{{ galera_pki_install_client_ca }}\"` or smth.","commit_id":"7a81e6e0d3e4102861b0d2482c67b64cbe5196a7"}]}