)]}'
{"etc/openstack_deploy/user_group_vars.yml":[{"author":{"_account_id":7219,"name":"git-harry","email":"git-harry@live.co.uk","username":"git-harry"},"change_message_id":"01e446bd07a5c0d613249794a1e397967adf0bc4","unresolved":false,"context_lines":[{"line_number":144,"context_line":"keystone_cache_backend_argument: \"url:{% for host in groups[\u0027memcached\u0027] %}{{ hostvars[host][\u0027container_address\u0027] }}{% if not loop.last %},{% endif %}{% endfor %}:{{ memcached_port }}\""},{"line_number":145,"context_line":"keystone_memcached_servers: \"{% for host in groups[\u0027keystone_all\u0027] %}{{ hostvars[host][\u0027container_address\u0027] }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %}\""},{"line_number":146,"context_line":"keystone_service_region: \"{{ service_region }}\""},{"line_number":147,"context_line":"keystone_service_adminuri_insecure: \"{% if keystone_service_adminuri_proto \u003d\u003d \u0027https\u0027 and keystone_user_ssl_cert is not defined %}yes{% else %}no{% endif %}\""},{"line_number":148,"context_line":"keystone_service_internaluri_insecure: \"{% if keystone_service_internaluri_proto \u003d\u003d \u0027https\u0027 and keystone_user_ssl_cert is not defined %}yes{% else %}no{% endif %}\""},{"line_number":149,"context_line":""},{"line_number":150,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":8,"id":"ba3cc151_ab10d64e","line":147,"updated":"2015-07-09 15:16:14.000000000","message":"I think these should be set explicitly instead of calculated to guard against this being used by mistake.","commit_id":"b0fdbc039f575108fad1cd58c893f4c9abce6c47"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"d194f14a8492539958212d42264cc4b8cced771c","unresolved":false,"context_lines":[{"line_number":144,"context_line":"keystone_cache_backend_argument: \"url:{% for host in groups[\u0027memcached\u0027] %}{{ hostvars[host][\u0027container_address\u0027] }}{% if not loop.last %},{% endif %}{% endfor %}:{{ memcached_port }}\""},{"line_number":145,"context_line":"keystone_memcached_servers: \"{% for host in groups[\u0027keystone_all\u0027] %}{{ hostvars[host][\u0027container_address\u0027] }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %}\""},{"line_number":146,"context_line":"keystone_service_region: \"{{ service_region }}\""},{"line_number":147,"context_line":"keystone_service_adminuri_insecure: \"{% if keystone_service_adminuri_proto \u003d\u003d \u0027https\u0027 and keystone_user_ssl_cert is not defined %}yes{% else %}no{% endif %}\""},{"line_number":148,"context_line":"keystone_service_internaluri_insecure: \"{% if keystone_service_internaluri_proto \u003d\u003d \u0027https\u0027 and keystone_user_ssl_cert is not defined %}yes{% else %}no{% endif %}\""},{"line_number":149,"context_line":""},{"line_number":150,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":8,"id":"ba3cc151_90fad573","line":147,"in_reply_to":"ba3cc151_ab10d64e","updated":"2015-07-09 18:22:00.000000000","message":"I\u0027m inclined to agree, as have some others in #openstack-ansible, so I\u0027ll change this up.","commit_id":"b0fdbc039f575108fad1cd58c893f4c9abce6c47"}],"playbooks/library/glance":[{"author":{"_account_id":7217,"name":"Hugh Saunders","email":"hugh@wherenow.org","username":"hughsaunders"},"change_message_id":"75e7f1c0a99714ab83bac6b66055041a7484095e","unresolved":false,"context_lines":[{"line_number":59,"context_line":"        description:"},{"line_number":60,"context_line":"            - Explicitly allow client to perform \"insecure\" TLS"},{"line_number":61,"context_line":"        choices:"},{"line_number":62,"context_line":"            - no (default)"},{"line_number":63,"context_line":"            - yes"},{"line_number":64,"context_line":"author: Hugh Saunders"},{"line_number":65,"context_line":"\"\"\""}],"source_content_type":"application/octet-stream","patch_set":11,"id":"ba3cc151_61fac245","line":62,"updated":"2015-07-10 11:27:32.000000000","message":"The default should be specified in the default key. Same for the changes to the other libraries.","commit_id":"e2b485e14e0db0908530b280d414acb72b23fe65"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"c0cd3b4504ce41f4ca3eabc5a2e38dfa834f3955","unresolved":false,"context_lines":[{"line_number":59,"context_line":"        description:"},{"line_number":60,"context_line":"            - Explicitly allow client to perform \"insecure\" TLS"},{"line_number":61,"context_line":"        choices:"},{"line_number":62,"context_line":"            - no (default)"},{"line_number":63,"context_line":"            - yes"},{"line_number":64,"context_line":"author: Hugh Saunders"},{"line_number":65,"context_line":"\"\"\""}],"source_content_type":"application/octet-stream","patch_set":11,"id":"ba3cc151_af9af06c","line":62,"in_reply_to":"ba3cc151_61fac245","updated":"2015-07-10 12:53:58.000000000","message":"While \u0027yes\u0027, \u00271\u0027, \u0027true\u0027 are equivalent for Ansible as a boolean choice - I\u0027ve corrected this.","commit_id":"e2b485e14e0db0908530b280d414acb72b23fe65"}],"playbooks/roles/openstack_openrc/defaults/main.yml":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"ecc202fcd667a2a0956202b328ea2b0203259a2a","unresolved":false,"context_lines":[{"line_number":19,"context_line":"openrc_os_endpoint_type: internalURL"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"## Deliberately allow access to SSL endpoints with bad certificates"},{"line_number":22,"context_line":"openrc_insecure: \"{{ keystone_service_internaluri_insecure | default(\u0027no\u0027) }}\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"## Default credentials"},{"line_number":25,"context_line":"openrc_os_username: admin"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"ba3cc151_0c3118ed","line":22,"updated":"2015-07-08 16:56:12.000000000","message":"Is there any reason why we need both keystone_server_internaluri_insecure and keystone_server_adminuri_insecure? Can they be different? And if they are what does that mean for this setting?","commit_id":"c75456b2fa919123ac8b13844ea80a62f81457db"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"dba97874d05c635772a8e9cd556bbac78bd2e7b4","unresolved":false,"context_lines":[{"line_number":19,"context_line":"openrc_os_endpoint_type: internalURL"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"## Deliberately allow access to SSL endpoints with bad certificates"},{"line_number":22,"context_line":"openrc_insecure: \"{{ keystone_service_internaluri_insecure | default(\u0027no\u0027) }}\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"## Default credentials"},{"line_number":25,"context_line":"openrc_os_username: admin"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"ba3cc151_47005902","line":22,"in_reply_to":"ba3cc151_0c3118ed","updated":"2015-07-08 17:28:07.000000000","message":"They can be different. The internal/public endpoint on port 5000 could be https while the admin endpoint on port 35357 can be http (and probably blocked from external access at the perimeter). That\u0027s why we\u0027re differentiating with two variables.\n\nIn the openrc file we\u0027re specifying that the internalURL is to be used as an endpoint, so I\u0027ve continued the convention.\n\nI suppose it may be worth doing something like this to be inclusionary?:\n\nkeystone_service_internaluri_insecure or keystone_service_internaluri_insecure | default(\u0027no\u0027)","commit_id":"c75456b2fa919123ac8b13844ea80a62f81457db"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"a0fa9ad2835d8bb7a86d7a7fe03651b258db944b","unresolved":false,"context_lines":[{"line_number":19,"context_line":"openrc_os_endpoint_type: internalURL"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"## Deliberately allow access to SSL endpoints with bad certificates"},{"line_number":22,"context_line":"openrc_insecure: \"{{ keystone_service_internaluri_insecure | default(\u0027no\u0027) }}\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"## Default credentials"},{"line_number":25,"context_line":"openrc_os_username: admin"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"ba3cc151_4fa367b2","line":22,"in_reply_to":"ba3cc151_14b4927f","updated":"2015-07-09 11:16:51.000000000","message":"Actually, I changed it again. If we only key off of openrc_os_auth_url then we\u0027ll be allowing insecure connectivity for the clients for any SSL endpoints (including those with proper certs), resulting in the possibility that the client could be interacting with a bogus endpoint unknowingly. This is not a security risk I wish to introduce.","commit_id":"c75456b2fa919123ac8b13844ea80a62f81457db"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"51009e3287ecf902aa161a84ffa0a6ac73de2f92","unresolved":false,"context_lines":[{"line_number":19,"context_line":"openrc_os_endpoint_type: internalURL"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"## Deliberately allow access to SSL endpoints with bad certificates"},{"line_number":22,"context_line":"openrc_insecure: \"{{ keystone_service_internaluri_insecure | default(\u0027no\u0027) }}\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"## Default credentials"},{"line_number":25,"context_line":"openrc_os_username: admin"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"ba3cc151_14b4927f","line":22,"in_reply_to":"ba3cc151_1dd8601d","updated":"2015-07-09 10:08:36.000000000","message":"I\u0027ve adjusted it to do exactly that now. :)","commit_id":"c75456b2fa919123ac8b13844ea80a62f81457db"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"1b1677ee642f9566d22451785b0abd4374239731","unresolved":false,"context_lines":[{"line_number":19,"context_line":"openrc_os_endpoint_type: internalURL"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"## Deliberately allow access to SSL endpoints with bad certificates"},{"line_number":22,"context_line":"openrc_insecure: \"{{ keystone_service_internaluri_insecure | default(\u0027no\u0027) }}\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"## Default credentials"},{"line_number":25,"context_line":"openrc_os_username: admin"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"ba3cc151_1dd8601d","line":22,"in_reply_to":"ba3cc151_47005902","updated":"2015-07-08 18:03:37.000000000","message":"OK. I think I get it now. This is used to generate the openrc aliases that need to exist if the openrc_os_auth_url is secure. Should that be driver off of the Keystone internal URL or should this variable be based on openrc_os_auth_url?","commit_id":"c75456b2fa919123ac8b13844ea80a62f81457db"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"9ba57494053187c1f3696d0f39561aac85ea5915","unresolved":false,"context_lines":[{"line_number":24,"context_line":"openrc_os_auth_url: \"http://127.0.0.1:5000\""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"## Deliberately allow access to SSL endpoints with bad certificates"},{"line_number":27,"context_line":"openrc_insecure: \"{{ keystone_service_internaluri_insecure or keystone_service_internaluri_insecure | default(\u0027no\u0027) }}\""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"## Create file"},{"line_number":30,"context_line":"openrc_file_dest: \"{{ ansible_env.HOME }}/openrc\""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"ba3cc151_e4237656","line":27,"updated":"2015-07-09 13:11:57.000000000","message":"one of these should be \u0027keystone_service_adminuri_insecure\u0027","commit_id":"6fd7a6db05c7dd22b8e0aae8f0b7e03087bc2b30"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"05bb5d4d542ec070e63f74893369a4dcc12b1628","unresolved":false,"context_lines":[{"line_number":24,"context_line":"openrc_os_auth_url: \"http://127.0.0.1:5000\""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"## Deliberately allow access to SSL endpoints with bad certificates"},{"line_number":27,"context_line":"openrc_insecure: \"{{ keystone_service_internaluri_insecure or keystone_service_internaluri_insecure | default(\u0027no\u0027) }}\""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"## Create file"},{"line_number":30,"context_line":"openrc_file_dest: \"{{ ansible_env.HOME }}/openrc\""}],"source_content_type":"text/x-yaml","patch_set":7,"id":"ba3cc151_6a608fcf","line":27,"in_reply_to":"ba3cc151_e4237656","updated":"2015-07-09 13:36:59.000000000","message":"Done","commit_id":"6fd7a6db05c7dd22b8e0aae8f0b7e03087bc2b30"},{"author":{"_account_id":7219,"name":"git-harry","email":"git-harry@live.co.uk","username":"git-harry"},"change_message_id":"01e446bd07a5c0d613249794a1e397967adf0bc4","unresolved":false,"context_lines":[{"line_number":24,"context_line":"openrc_os_auth_url: \"http://127.0.0.1:5000\""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"## Deliberately allow access to SSL endpoints with bad certificates"},{"line_number":27,"context_line":"openrc_insecure: \"{{ (keystone_service_internaluri_insecure | bool or keystone_service_internaluri_insecure | bool) | default(\u0027no\u0027) }}\""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"## Create file"},{"line_number":30,"context_line":"openrc_file_dest: \"{{ ansible_env.HOME }}/openrc\""}],"source_content_type":"text/x-yaml","patch_set":8,"id":"ba3cc151_f332565d","line":27,"range":{"start_line":27,"start_character":127,"end_line":27,"end_character":129},"updated":"2015-07-09 15:16:14.000000000","message":"Maybe change no to false?  Seems a bit strange for the options to be true or no.","commit_id":"b0fdbc039f575108fad1cd58c893f4c9abce6c47"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"d194f14a8492539958212d42264cc4b8cced771c","unresolved":false,"context_lines":[{"line_number":24,"context_line":"openrc_os_auth_url: \"http://127.0.0.1:5000\""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"## Deliberately allow access to SSL endpoints with bad certificates"},{"line_number":27,"context_line":"openrc_insecure: \"{{ (keystone_service_internaluri_insecure | bool or keystone_service_internaluri_insecure | bool) | default(\u0027no\u0027) }}\""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"## Create file"},{"line_number":30,"context_line":"openrc_file_dest: \"{{ ansible_env.HOME }}/openrc\""}],"source_content_type":"text/x-yaml","patch_set":8,"id":"ba3cc151_f64b1a85","line":27,"in_reply_to":"ba3cc151_df9cf00f","updated":"2015-07-09 18:22:00.000000000","message":"Unfortunately Ansible doesn\u0027t allow this sort of logic in the vars without the quotes and the braces.","commit_id":"b0fdbc039f575108fad1cd58c893f4c9abce6c47"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"0f9f5156194ca8a967e1474cc93af85b16e24a0e","unresolved":false,"context_lines":[{"line_number":24,"context_line":"openrc_os_auth_url: \"http://127.0.0.1:5000\""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"## Deliberately allow access to SSL endpoints with bad certificates"},{"line_number":27,"context_line":"openrc_insecure: \"{{ (keystone_service_internaluri_insecure | bool or keystone_service_internaluri_insecure | bool) | default(\u0027no\u0027) }}\""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"## Create file"},{"line_number":30,"context_line":"openrc_file_dest: \"{{ ansible_env.HOME }}/openrc\""}],"source_content_type":"text/x-yaml","patch_set":8,"id":"ba3cc151_df9cf00f","line":27,"in_reply_to":"ba3cc151_f332565d","updated":"2015-07-09 16:15:43.000000000","message":"Agreed. Further, if we avoid putting this in \"\"s, then do we need to cast to bool again in the openrc template?","commit_id":"b0fdbc039f575108fad1cd58c893f4c9abce6c47"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"d194f14a8492539958212d42264cc4b8cced771c","unresolved":false,"context_lines":[{"line_number":24,"context_line":"openrc_os_auth_url: \"http://127.0.0.1:5000\""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"## Deliberately allow access to SSL endpoints with bad certificates"},{"line_number":27,"context_line":"openrc_insecure: \"{{ (keystone_service_internaluri_insecure | bool or keystone_service_internaluri_insecure | bool) | default(\u0027no\u0027) }}\""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"## Create file"},{"line_number":30,"context_line":"openrc_file_dest: \"{{ ansible_env.HOME }}/openrc\""}],"source_content_type":"text/x-yaml","patch_set":8,"id":"ba3cc151_f696baee","line":27,"range":{"start_line":27,"start_character":127,"end_line":27,"end_character":129},"in_reply_to":"ba3cc151_f332565d","updated":"2015-07-09 18:22:00.000000000","message":"Done","commit_id":"b0fdbc039f575108fad1cd58c893f4c9abce6c47"}],"playbooks/roles/os_cinder/tasks/cinder_service_add.yml":[{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"3b64009bb3bc06427c37dc5b10890f1dc53e5945","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    service_name: \"{{ service_name }}\""},{"line_number":23,"context_line":"    service_type: \"{{ service_type }}\""},{"line_number":24,"context_line":"    description: \"{{ service_description }}\""},{"line_number":25,"context_line":"    insecure: \"{% if \u0027https\u0027 in keystone_service_adminurl and keystone_user_ssl_cert is not defined %}yes{% else %}no{% endif %}\""},{"line_number":26,"context_line":"  register: add_service"},{"line_number":27,"context_line":"  until: add_service|success"},{"line_number":28,"context_line":"  retries: 5"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ba3cc151_a1f7d8d1","line":25,"updated":"2015-07-08 15:46:51.000000000","message":"+1 to David\u0027s suggestion.","commit_id":"5fe15a73435f90c7426e0d0a947990919a1ab002"},{"author":{"_account_id":12606,"name":"Miguel Grinberg","email":"miguel.grinberg@gmail.com","username":"miguelgrinberg"},"change_message_id":"f8d11634576b641ec8a2817187c98d5a9c13db94","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    service_name: \"{{ service_name }}\""},{"line_number":23,"context_line":"    service_type: \"{{ service_type }}\""},{"line_number":24,"context_line":"    description: \"{{ service_description }}\""},{"line_number":25,"context_line":"    insecure: \"{% if \u0027https\u0027 in keystone_service_adminurl and keystone_user_ssl_cert is not defined %}yes{% else %}no{% endif %}\""},{"line_number":26,"context_line":"  register: add_service"},{"line_number":27,"context_line":"  until: add_service|success"},{"line_number":28,"context_line":"  retries: 5"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ba3cc151_76bc58bb","line":25,"range":{"start_line":25,"start_character":22,"end_line":25,"end_character":27},"updated":"2015-07-08 01:25:15.000000000","message":"These checks for \"https\" in some_variable are error prone. It\u0027s unlikely, but I could have something like:\n\n    http://httpsucks.com:35357/v2\n\nand this would do the wrong thing. What do you think about checking the \"proto\" variable instead:\n\n    if keystone_service_adminuri_proto \u003d\u003d \"https\" ...","commit_id":"5fe15a73435f90c7426e0d0a947990919a1ab002"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"79c3b62c5bb51309854db330bf1081a4b7e250f0","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    service_name: \"{{ service_name }}\""},{"line_number":23,"context_line":"    service_type: \"{{ service_type }}\""},{"line_number":24,"context_line":"    description: \"{{ service_description }}\""},{"line_number":25,"context_line":"    insecure: \"{% if \u0027https\u0027 in keystone_service_adminurl and keystone_user_ssl_cert is not defined %}yes{% else %}no{% endif %}\""},{"line_number":26,"context_line":"  register: add_service"},{"line_number":27,"context_line":"  until: add_service|success"},{"line_number":28,"context_line":"  retries: 5"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ba3cc151_a9833e02","line":25,"range":{"start_line":25,"start_character":22,"end_line":25,"end_character":27},"in_reply_to":"ba3cc151_76bc58bb","updated":"2015-07-08 16:38:25.000000000","message":"Done","commit_id":"5fe15a73435f90c7426e0d0a947990919a1ab002"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"51cc8d7a67506bb23e9e5786099f4a3a2b7ccbbb","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    service_name: \"{{ service_name }}\""},{"line_number":23,"context_line":"    service_type: \"{{ service_type }}\""},{"line_number":24,"context_line":"    description: \"{{ service_description }}\""},{"line_number":25,"context_line":"    insecure: \"{% if \u0027https\u0027 in keystone_service_adminurl and keystone_user_ssl_cert is not defined %}yes{% else %}no{% endif %}\""},{"line_number":26,"context_line":"  register: add_service"},{"line_number":27,"context_line":"  until: add_service|success"},{"line_number":28,"context_line":"  retries: 5"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ba3cc151_d87a1888","line":25,"in_reply_to":"ba3cc151_76bc58bb","updated":"2015-07-08 13:26:20.000000000","message":"Would it also be possible to put this logic in one of the variables files so that it only lives in one place? Right now this \u0027if\u0027 statement is copied all over the place (or variants using different URIs). We could do something simple like this in a vars file:\n\n  keystone_insecure_admin: \"{% if keystone_service_adminuri_proto \u003d\u003d \"https\" and keystone_user_ssl_cert is not defined %}yes{% else %}no{% endif %}\"","commit_id":"5fe15a73435f90c7426e0d0a947990919a1ab002"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"79c3b62c5bb51309854db330bf1081a4b7e250f0","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    service_name: \"{{ service_name }}\""},{"line_number":23,"context_line":"    service_type: \"{{ service_type }}\""},{"line_number":24,"context_line":"    description: \"{{ service_description }}\""},{"line_number":25,"context_line":"    insecure: \"{% if \u0027https\u0027 in keystone_service_adminurl and keystone_user_ssl_cert is not defined %}yes{% else %}no{% endif %}\""},{"line_number":26,"context_line":"  register: add_service"},{"line_number":27,"context_line":"  until: add_service|success"},{"line_number":28,"context_line":"  retries: 5"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ba3cc151_29708e3f","line":25,"in_reply_to":"ba3cc151_d87a1888","updated":"2015-07-08 16:38:25.000000000","message":"Done","commit_id":"5fe15a73435f90c7426e0d0a947990919a1ab002"}],"playbooks/roles/os_glance/templates/glance-api.conf.j2":[{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"0f9f5156194ca8a967e1474cc93af85b16e24a0e","unresolved":false,"context_lines":[{"line_number":52,"context_line":""},{"line_number":53,"context_line":"[keystone_authtoken]"},{"line_number":54,"context_line":"{% if keystone_service_internaluri_insecure | bool %}"},{"line_number":55,"context_line":"insecure \u003d True"},{"line_number":56,"context_line":"{% endif %}"},{"line_number":57,"context_line":"auth_plugin \u003d {{ glance_keystone_auth_plugin }}"},{"line_number":58,"context_line":"signing_dir \u003d {{ glance_system_user_home }}/cache/api"}],"source_content_type":"text/x-jinja2","patch_set":8,"id":"ba3cc151_7f51242f","line":55,"updated":"2015-07-09 16:15:43.000000000","message":"What if we just do \n\n    insecure \u003d \"{{ keystone_service_internaluri_insecure |bool }}\"","commit_id":"b0fdbc039f575108fad1cd58c893f4c9abce6c47"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"bb717a5af506b543d15c95539e94ea74a5898135","unresolved":false,"context_lines":[{"line_number":52,"context_line":""},{"line_number":53,"context_line":"[keystone_authtoken]"},{"line_number":54,"context_line":"{% if keystone_service_internaluri_insecure | bool %}"},{"line_number":55,"context_line":"insecure \u003d True"},{"line_number":56,"context_line":"{% endif %}"},{"line_number":57,"context_line":"auth_plugin \u003d {{ glance_keystone_auth_plugin }}"},{"line_number":58,"context_line":"signing_dir \u003d {{ glance_system_user_home }}/cache/api"}],"source_content_type":"text/x-jinja2","patch_set":8,"id":"ba3cc151_3f74f533","line":55,"in_reply_to":"ba3cc151_7f51242f","updated":"2015-07-09 18:22:47.000000000","message":"Great suggestion. Done.","commit_id":"b0fdbc039f575108fad1cd58c893f4c9abce6c47"}],"playbooks/roles/os_keystone/tasks/keystone_service_setup.yml":[{"author":{"_account_id":12892,"name":"Nolan Brubaker","email":"nolan.brubaker@rackspace.com","username":"nrb"},"change_message_id":"9d786964ed3693529e8ab0b48d07f8efe2f5a8d0","unresolved":false,"context_lines":[{"line_number":101,"context_line":"    token: \"{{ keystone_auth_admin_token }}\""},{"line_number":102,"context_line":"    endpoint: \"{{ keystone_service_adminurl }}\""},{"line_number":103,"context_line":"    role_name: \"{{ keystone_role_name }}\""},{"line_number":104,"context_line":"    insecure: \"{% if \u0027https\u0027 in keystone_service_adminurl and keystone_user_ssl_cert is not defined %}yes{% else %}no{% endif %}\""},{"line_number":105,"context_line":"  register: add_service"},{"line_number":106,"context_line":"  until: add_service|success"},{"line_number":107,"context_line":"  retries: 5"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ba3cc151_c4700e43","line":104,"updated":"2015-07-08 02:09:31.000000000","message":"This same line is repeated a lot of places; might it be possible to set this once and re-use that value?\n\nI notice it\u0027s already relying on keystone variables being defined, so I\u0027m not sure that simply moving this to an assignment somewhere is necessarily coupling roles too tightly.","commit_id":"5fe15a73435f90c7426e0d0a947990919a1ab002"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"79c3b62c5bb51309854db330bf1081a4b7e250f0","unresolved":false,"context_lines":[{"line_number":101,"context_line":"    token: \"{{ keystone_auth_admin_token }}\""},{"line_number":102,"context_line":"    endpoint: \"{{ keystone_service_adminurl }}\""},{"line_number":103,"context_line":"    role_name: \"{{ keystone_role_name }}\""},{"line_number":104,"context_line":"    insecure: \"{% if \u0027https\u0027 in keystone_service_adminurl and keystone_user_ssl_cert is not defined %}yes{% else %}no{% endif %}\""},{"line_number":105,"context_line":"  register: add_service"},{"line_number":106,"context_line":"  until: add_service|success"},{"line_number":107,"context_line":"  retries: 5"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ba3cc151_a99a5e60","line":104,"in_reply_to":"ba3cc151_c4700e43","updated":"2015-07-08 16:38:25.000000000","message":"Done","commit_id":"5fe15a73435f90c7426e0d0a947990919a1ab002"}]}