)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"b3d01f3b6a5e7c2250035b3e525f13c49af1bef8","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Travis Truman \u003ctravis_truman@cable.comcast.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-03-04 15:26:33 -0500"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Enable SSL termination for all services"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This change makes it so that all services are expecting SSL termination"},{"line_number":10,"context_line":"at the load balancer by default. This is more indicative of how a real"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"7af24918_3e787e2b","line":7,"updated":"2016-03-04 20:49:25.000000000","message":"All? I only see nova, keystone, horizon and heat instrumented here. Also, it seems that only keystone and horizon are actually instrumented. I think this this is a false promise which could be more clearly made.\n\nWe should do horizon \u0026 keystone now, as that\u0027s the low hanging fruit. The others should also be done, but there be dragons.","commit_id":"572745850656a0af57c8c1b9836857200b80b26a"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"c2656fcd2d7b3c0278fc1e333db931835033db87","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Travis Truman \u003ctravis_truman@cable.comcast.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-03-04 15:26:33 -0500"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Enable SSL termination for all services"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This change makes it so that all services are expecting SSL termination"},{"line_number":10,"context_line":"at the load balancer by default. This is more indicative of how a real"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"7af24918_1e9e6207","line":7,"in_reply_to":"7af24918_3e787e2b","updated":"2016-03-04 21:01:28.000000000","message":"all of the services have SSL on the public endpoints which is terminated at the LB. nova, keystone, horizon and heat are the only ones that have SSL proto handling.","commit_id":"572745850656a0af57c8c1b9836857200b80b26a"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"f8df7d621ae536e48fa29f2c256d947f048b300c","unresolved":false,"context_lines":[{"line_number":11,"context_line":"world deployment will be setup and is being added such that we can test"},{"line_number":12,"context_line":"a more production like deployment system by default."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The AIO will now terminate SSL in HAProxy using a self-signed cert."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Depends-On: I913b4140e258b56d56f5323d55fd633288b3ef6a"},{"line_number":17,"context_line":"Depends-On: I6273ffa453b4e5eb8a33767974d390a126296c47"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"7af24918_fe38d63f","line":14,"updated":"2016-03-04 20:54:43.000000000","message":"This absolutely needs a release note to make it clear that the default has changed.","commit_id":"572745850656a0af57c8c1b9836857200b80b26a"},{"author":{"_account_id":19814,"name":"Travis Truman (automagically)","email":"travis_truman@cable.comcast.com","username":"trumant"},"change_message_id":"a7d64219b9eee216e0895e45669ac30284845e37","unresolved":false,"context_lines":[{"line_number":11,"context_line":"world deployment will be setup and is being added such that we can test"},{"line_number":12,"context_line":"a more production like deployment system by default."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The AIO will now terminate SSL in HAProxy using a self-signed cert."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Depends-On: I913b4140e258b56d56f5323d55fd633288b3ef6a"},{"line_number":17,"context_line":"Depends-On: I6273ffa453b4e5eb8a33767974d390a126296c47"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"5aef4532_10c63667","line":14,"in_reply_to":"7af24918_fe38d63f","updated":"2016-03-07 18:24:16.000000000","message":"Done","commit_id":"572745850656a0af57c8c1b9836857200b80b26a"}],"doc/source/install-guide/configure-haproxy.rst":[{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"b3d01f3b6a5e7c2250035b3e525f13c49af1bef8","unresolved":false,"context_lines":[{"line_number":3,"context_line":"Configuring HAProxy (optional)"},{"line_number":4,"context_line":"------------------------------"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"For evaluation, testing, and development, HAProxy can temporarily"},{"line_number":7,"context_line":"provide load balancing services and SSL termination in lieu of hardware"},{"line_number":8,"context_line":"load balancers. The default HAProxy configuration does not provide"},{"line_number":9,"context_line":"highly-available load balancing services. For production deployments, deploy a"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7af24918_be3ace96","line":6,"updated":"2016-03-04 20:49:25.000000000","message":"This is no longer true. The old version of this doc file is more true.\n\nI think if we\u0027re going to do this we need to add a blurb to more explicitly state that by defatul we\u0027re expecting a load balancer and we\u0027re expecting SSL endpoints that are handled by the load balancer.","commit_id":"572745850656a0af57c8c1b9836857200b80b26a"},{"author":{"_account_id":19814,"name":"Travis Truman (automagically)","email":"travis_truman@cable.comcast.com","username":"trumant"},"change_message_id":"a7d64219b9eee216e0895e45669ac30284845e37","unresolved":false,"context_lines":[{"line_number":3,"context_line":"Configuring HAProxy (optional)"},{"line_number":4,"context_line":"------------------------------"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"For evaluation, testing, and development, HAProxy can temporarily"},{"line_number":7,"context_line":"provide load balancing services and SSL termination in lieu of hardware"},{"line_number":8,"context_line":"load balancers. The default HAProxy configuration does not provide"},{"line_number":9,"context_line":"highly-available load balancing services. For production deployments, deploy a"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5aef4532_70a17aa9","line":6,"in_reply_to":"7af24918_be3ace96","updated":"2016-03-07 18:24:16.000000000","message":"Done","commit_id":"572745850656a0af57c8c1b9836857200b80b26a"},{"author":{"_account_id":12402,"name":"Robb Romans","email":"robb.romans@rackspace.com","username":"rromans"},"change_message_id":"ef8bd4353c7efd771f90e3fced5b6f8184fc312f","unresolved":false,"context_lines":[{"line_number":3,"context_line":"Configuring HAProxy (optional)"},{"line_number":4,"context_line":"------------------------------"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"HAProxy provides load balancing services and SSL termination in lieu of"},{"line_number":7,"context_line":"hardware load balancers for high availability architectures deployed by"},{"line_number":8,"context_line":"OpenStack-Ansible. The default HAProxy configuration provides highly-"},{"line_number":9,"context_line":"available load balancing services via keepalived if there are more than one"}],"source_content_type":"text/x-rst","patch_set":18,"id":"ba0121b8_7d5ac851","line":6,"updated":"2016-03-29 20:23:54.000000000","message":"suggestion: rephrase \"in lieu of\" to be more clear","commit_id":"5d987d9d25e28eef1713f8e59d7397ca3e817932"},{"author":{"_account_id":12402,"name":"Robb Romans","email":"robb.romans@rackspace.com","username":"rromans"},"change_message_id":"ef8bd4353c7efd771f90e3fced5b6f8184fc312f","unresolved":false,"context_lines":[{"line_number":7,"context_line":"hardware load balancers for high availability architectures deployed by"},{"line_number":8,"context_line":"OpenStack-Ansible. The default HAProxy configuration provides highly-"},{"line_number":9,"context_line":"available load balancing services via keepalived if there are more than one"},{"line_number":10,"context_line":"hosts in the ``haproxy_hosts`` group."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":".. note::"},{"line_number":13,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"ba0121b8_7d73e8e7","line":10,"updated":"2016-03-29 20:23:54.000000000","message":"...if there is more than one host in the...","commit_id":"5d987d9d25e28eef1713f8e59d7397ca3e817932"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"23ba6173b10eefa77670ba1ea15b151bf097c601","unresolved":false,"context_lines":[{"line_number":7,"context_line":"load balancers are not available for high availability architectures deployed"},{"line_number":8,"context_line":"by OpenStack-Ansible. The default HAProxy configuration provides highly-"},{"line_number":9,"context_line":"available load balancing services via keepalived if there is more than one"},{"line_number":10,"context_line":"hosts in the ``haproxy_hosts`` group."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":".. note::"},{"line_number":13,"context_line":""}],"source_content_type":"text/x-rst","patch_set":20,"id":"5a18252c_645274df","line":10,"range":{"start_line":10,"start_character":0,"end_line":10,"end_character":5},"updated":"2016-04-12 00:41:51.000000000","message":"should be host no s.","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"21842139c2d951cf25e88b90d8dc76c8cc1a958a","unresolved":false,"context_lines":[{"line_number":7,"context_line":"load balancers are not available for high availability architectures deployed"},{"line_number":8,"context_line":"by OpenStack-Ansible. The default HAProxy configuration provides highly-"},{"line_number":9,"context_line":"available load balancing services via keepalived if there is more than one"},{"line_number":10,"context_line":"hosts in the ``haproxy_hosts`` group."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":".. note::"},{"line_number":13,"context_line":""}],"source_content_type":"text/x-rst","patch_set":20,"id":"5a18252c_c4b548d1","line":10,"range":{"start_line":10,"start_character":0,"end_line":10,"end_character":5},"in_reply_to":"5a18252c_645274df","updated":"2016-04-12 00:51:56.000000000","message":"Done","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"}],"etc/openstack_deploy/user_variables.yml":[{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"1780364ddbd27159dafe1b3e8ac4c3b65414fcff","unresolved":false,"context_lines":[{"line_number":106,"context_line":"## SSL: Keystone"},{"line_number":107,"context_line":"# These do not need to be configured unless you\u0027re creating certificates for"},{"line_number":108,"context_line":"# services running behind Apache (currently, Horizon and Keystone)."},{"line_number":109,"context_line":"ssl_protocol: \"ALL -SSLv2 -SSLv3\""},{"line_number":110,"context_line":"# Cipher suite string from https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/"},{"line_number":111,"context_line":"ssl_cipher_suite: \"ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS\""},{"line_number":112,"context_line":"# To override for Keystone only:"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"fa0719c6_054c38c6","line":109,"range":{"start_line":109,"start_character":0,"end_line":109,"end_character":33},"updated":"2016-03-21 14:58:38.000000000","message":"These should not be defaulted here. In the user_vars these are provided as examples and are commented out. Please do not uncomment them - they are set for cross-role purposes in group_vars.","commit_id":"8198f7f65296fc451f35ebcbc0d4c677713a8585"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"1780364ddbd27159dafe1b3e8ac4c3b65414fcff","unresolved":false,"context_lines":[{"line_number":108,"context_line":"# services running behind Apache (currently, Horizon and Keystone)."},{"line_number":109,"context_line":"ssl_protocol: \"ALL -SSLv2 -SSLv3\""},{"line_number":110,"context_line":"# Cipher suite string from https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/"},{"line_number":111,"context_line":"ssl_cipher_suite: \"ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS\""},{"line_number":112,"context_line":"# To override for Keystone only:"},{"line_number":113,"context_line":"#   - keystone_ssl_protocol"},{"line_number":114,"context_line":"#   - keystone_ssl_cipher_suite"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"fa0719c6_a5d10cd0","line":111,"range":{"start_line":111,"start_character":0,"end_line":111,"end_character":145},"updated":"2016-03-21 14:58:38.000000000","message":"These should not be defaulted here. In the user_vars these are provided as examples and are commented out. Please do not uncomment them - they are set for cross-role purposes in group_vars.","commit_id":"8198f7f65296fc451f35ebcbc0d4c677713a8585"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"1780364ddbd27159dafe1b3e8ac4c3b65414fcff","unresolved":false,"context_lines":[{"line_number":109,"context_line":"ssl_protocol: \"ALL -SSLv2 -SSLv3\""},{"line_number":110,"context_line":"# Cipher suite string from https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/"},{"line_number":111,"context_line":"ssl_cipher_suite: \"ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS\""},{"line_number":112,"context_line":"# To override for Keystone only:"},{"line_number":113,"context_line":"#   - keystone_ssl_protocol"},{"line_number":114,"context_line":"#   - keystone_ssl_cipher_suite"},{"line_number":115,"context_line":"# To override for Horizon only:"},{"line_number":116,"context_line":"#   - horizon_ssl_protocol"},{"line_number":117,"context_line":"#   - horizon_ssl_cipher_suite"},{"line_number":118,"context_line":"#"},{"line_number":119,"context_line":"## SSL: RabbitMQ"},{"line_number":120,"context_line":"# Set these variables if you prefer to use existing SSL certificates, keys and"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"fa0719c6_a5e8ec7d","line":117,"range":{"start_line":112,"start_character":0,"end_line":117,"end_character":30},"updated":"2016-03-21 14:58:38.000000000","message":"This looks like a rebase from an old version of the example user_vars file. This stuff is in the docs so no need to repeat it.","commit_id":"8198f7f65296fc451f35ebcbc0d4c677713a8585"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"1780364ddbd27159dafe1b3e8ac4c3b65414fcff","unresolved":false,"context_lines":[{"line_number":116,"context_line":"#   - horizon_ssl_protocol"},{"line_number":117,"context_line":"#   - horizon_ssl_cipher_suite"},{"line_number":118,"context_line":"#"},{"line_number":119,"context_line":"## SSL: RabbitMQ"},{"line_number":120,"context_line":"# Set these variables if you prefer to use existing SSL certificates, keys and"},{"line_number":121,"context_line":"# CA certificates with the RabbitMQ SSL/TLS Listener"},{"line_number":122,"context_line":"#"},{"line_number":123,"context_line":"#rabbitmq_user_ssl_cert: \u003cpath to cert on ansible deployment host\u003e"},{"line_number":124,"context_line":"#rabbitmq_user_ssl_key: \u003cpath to cert on ansible deployment host\u003e"},{"line_number":125,"context_line":"#rabbitmq_user_ssl_ca_cert: \u003cpath to cert on ansible deployment host\u003e"},{"line_number":126,"context_line":"#"},{"line_number":127,"context_line":"# By default, openstack-ansible configures all OpenStack services to talk to"},{"line_number":128,"context_line":"# RabbitMQ over encrypted connections on port 5671. To opt-out of this default,"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"fa0719c6_05e398a4","line":125,"range":{"start_line":119,"start_character":0,"end_line":125,"end_character":69},"updated":"2016-03-21 14:58:38.000000000","message":"This looks like a rebase from an old version of the example user_vars file. This stuff is in the docs so no need to repeat it.","commit_id":"8198f7f65296fc451f35ebcbc0d4c677713a8585"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"8ea4b8771667edae66bdea39a98272d92928bfe7","unresolved":false,"context_lines":[{"line_number":173,"context_line":"# default, but an option to opt-in is available by setting the following"},{"line_number":174,"context_line":"# variable to \u0027true\u0027."},{"line_number":175,"context_line":"# Docs: http://docs.openstack.org/developer/openstack-ansible-security/"},{"line_number":176,"context_line":"# apply_security_hardening: true"}],"source_content_type":"text/x-yaml","patch_set":18,"id":"ba0121b8_226592b4","line":176,"range":{"start_line":176,"start_character":0,"end_line":176,"end_character":32},"updated":"2016-03-30 16:38:51.000000000","message":"I have no idea what was changed here, but it doesn\u0027t seem like it belongs in this change.","commit_id":"5d987d9d25e28eef1713f8e59d7397ca3e817932"}],"playbooks/inventory/group_vars/hosts.yml":[{"author":{"_account_id":17799,"name":"Logan V","email":"logan2211@gmail.com","username":"Logan2211"},"change_message_id":"31bcdd4aebb5c2f5f6665613b42074bea177dee0","unresolved":false,"context_lines":[{"line_number":43,"context_line":"nova_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":44,"context_line":"keystone_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":45,"context_line":"horizon_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":46,"context_line":"heat_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"## LXC options"},{"line_number":49,"context_line":"lxc_container_caches:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"5aef4532_77d39904","line":46,"updated":"2016-03-10 02:02:57.000000000","message":"This can be removed after https://review.openstack.org/#/c/289620/ merges","commit_id":"d2d130a56b1ff37aad828e9cda30b21553054f16"},{"author":{"_account_id":19814,"name":"Travis Truman (automagically)","email":"travis_truman@cable.comcast.com","username":"trumant"},"change_message_id":"32374541dad9972ffcabdad16b34c714f0374774","unresolved":false,"context_lines":[{"line_number":43,"context_line":"nova_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":44,"context_line":"keystone_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":45,"context_line":"horizon_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":46,"context_line":"heat_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"## LXC options"},{"line_number":49,"context_line":"lxc_container_caches:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"5aef4532_146bf31e","line":46,"in_reply_to":"5aef4532_77d39904","updated":"2016-03-11 01:38:47.000000000","message":"Done","commit_id":"d2d130a56b1ff37aad828e9cda30b21553054f16"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"23ba6173b10eefa77670ba1ea15b151bf097c601","unresolved":false,"context_lines":[{"line_number":78,"context_line":"memcached_port: 11211"},{"line_number":79,"context_line":"memcached_servers: \"{% for host in groups[\u0027memcached\u0027] %}{{ hostvars[host][\u0027ansible_ssh_host\u0027] }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %}\""},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"## Host security hardening"},{"line_number":82,"context_line":"# The openstack-ansible-security role provides security hardening for hosts"},{"line_number":83,"context_line":"# by applying security configurations from the STIG. Hardening is enabled by"},{"line_number":84,"context_line":"# default, but an option to opt out is available by setting the following"},{"line_number":85,"context_line":"# variable to \u0027false\u0027."},{"line_number":86,"context_line":"# Docs: http://docs.openstack.org/developer/openstack-ansible-security/"},{"line_number":87,"context_line":"apply_security_hardening: true"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"## Region Name"},{"line_number":90,"context_line":"service_region: RegionOne"}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_840350b8","line":87,"range":{"start_line":81,"start_character":0,"end_line":87,"end_character":30},"updated":"2016-04-12 00:41:51.000000000","message":"Unless I\u0027m reading this wrong, this contradicts what is said in the user_variables.yml in regards to security hardening. If I am reading these 2 comments correctly but one is default true and the other defaults false the comments should be more clear.","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"21842139c2d951cf25e88b90d8dc76c8cc1a958a","unresolved":false,"context_lines":[{"line_number":78,"context_line":"memcached_port: 11211"},{"line_number":79,"context_line":"memcached_servers: \"{% for host in groups[\u0027memcached\u0027] %}{{ hostvars[host][\u0027ansible_ssh_host\u0027] }}:{{ memcached_port }}{% if not loop.last %},{% endif %}{% endfor %}\""},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"## Host security hardening"},{"line_number":82,"context_line":"# The openstack-ansible-security role provides security hardening for hosts"},{"line_number":83,"context_line":"# by applying security configurations from the STIG. Hardening is enabled by"},{"line_number":84,"context_line":"# default, but an option to opt out is available by setting the following"},{"line_number":85,"context_line":"# variable to \u0027false\u0027."},{"line_number":86,"context_line":"# Docs: http://docs.openstack.org/developer/openstack-ansible-security/"},{"line_number":87,"context_line":"apply_security_hardening: true"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"## Region Name"},{"line_number":90,"context_line":"service_region: RegionOne"}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_c4dc281b","line":87,"range":{"start_line":81,"start_character":0,"end_line":87,"end_character":30},"in_reply_to":"5a18252c_840350b8","updated":"2016-04-12 00:51:56.000000000","message":"this option is only set to run the Ansible security role. which has a default of true.","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"94624c2bd106707e19917606bbc5c396ca7db30e","unresolved":false,"context_lines":[{"line_number":38,"context_line":"openstack_repo_url: \"http://{{ internal_lb_vip_address }}:{{ repo_server_port }}\""},{"line_number":39,"context_line":"openstack_repo_git_url: \"http://{{ internal_lb_vip_address }}:{{ repo_server_port }}/openstackgit\""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"## Enable external SSL handling for general OpenStack services"},{"line_number":42,"context_line":"openstack_external_ssl: true"},{"line_number":43,"context_line":"nova_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":44,"context_line":"keystone_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":45,"context_line":"horizon_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"## LXC options"},{"line_number":48,"context_line":"lxc_container_caches:"}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_19796b30","line":45,"range":{"start_line":41,"start_character":0,"end_line":45,"end_character":52},"updated":"2016-04-15 10:12:24.000000000","message":"Some services recognise the external SSL header by default as I understand it. Is there any harm in this being the default in each role (not even needing a var, in fact), regardless of whether SSL is terminated at the LB?","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"84ac14774217b85967fc8865f3c951b46ce05402","unresolved":false,"context_lines":[{"line_number":38,"context_line":"openstack_repo_url: \"http://{{ internal_lb_vip_address }}:{{ repo_server_port }}\""},{"line_number":39,"context_line":"openstack_repo_git_url: \"http://{{ internal_lb_vip_address }}:{{ repo_server_port }}/openstackgit\""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"## Enable external SSL handling for general OpenStack services"},{"line_number":42,"context_line":"openstack_external_ssl: true"},{"line_number":43,"context_line":"nova_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":44,"context_line":"keystone_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":45,"context_line":"horizon_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"## LXC options"},{"line_number":48,"context_line":"lxc_container_caches:"}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_ab06141e","line":45,"range":{"start_line":41,"start_character":0,"end_line":45,"end_character":52},"in_reply_to":"1a122d0e_19796b30","updated":"2016-04-15 14:12:17.000000000","message":"For the core project I think this should be the default however making it the default in every role will create some difficulties for users looking to deploy the role standalone (developers) so I think it should a var and default to false within the roles.","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"60dd96a9a996fecc52fadc6bf65d8b79ed4c84f0","unresolved":false,"context_lines":[{"line_number":38,"context_line":"openstack_repo_url: \"http://{{ internal_lb_vip_address }}:{{ repo_server_port }}\""},{"line_number":39,"context_line":"openstack_repo_git_url: \"http://{{ internal_lb_vip_address }}:{{ repo_server_port }}/openstackgit\""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"## Enable external SSL handling for general OpenStack services"},{"line_number":42,"context_line":"openstack_external_ssl: true"},{"line_number":43,"context_line":"nova_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":44,"context_line":"keystone_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":45,"context_line":"horizon_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"## LXC options"},{"line_number":48,"context_line":"lxc_container_caches:"}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_4eaae4d5","line":45,"range":{"start_line":41,"start_character":0,"end_line":45,"end_character":52},"in_reply_to":"1a122d0e_4b581bfb","updated":"2016-04-15 17:06:41.000000000","message":"Well, in that case why don\u0027t we set the recognition by default in the .conf templates in each role, get rid of the extra var, skip the above vars and be happy? :)\n\nI\u0027d prefer that the upstream defaults actually recognise the headers by default, but we can drive that in the Newton cycle where it\u0027s not already done and hopefully be rid of our extra conf entries too.","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":19814,"name":"Travis Truman (automagically)","email":"travis_truman@cable.comcast.com","username":"trumant"},"change_message_id":"5b5a2eefd9994ec9c0481a53aa73e5274c235285","unresolved":false,"context_lines":[{"line_number":38,"context_line":"openstack_repo_url: \"http://{{ internal_lb_vip_address }}:{{ repo_server_port }}\""},{"line_number":39,"context_line":"openstack_repo_git_url: \"http://{{ internal_lb_vip_address }}:{{ repo_server_port }}/openstackgit\""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"## Enable external SSL handling for general OpenStack services"},{"line_number":42,"context_line":"openstack_external_ssl: true"},{"line_number":43,"context_line":"nova_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":44,"context_line":"keystone_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":45,"context_line":"horizon_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"## LXC options"},{"line_number":48,"context_line":"lxc_container_caches:"}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_d15fb50c","line":45,"range":{"start_line":41,"start_character":0,"end_line":45,"end_character":52},"in_reply_to":"1a122d0e_4eaae4d5","updated":"2016-04-15 17:26:47.000000000","message":"Sounds like a good cross-project topic.. ;)","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"13e867b39224d901c4a2ce50b566365ec389351b","unresolved":false,"context_lines":[{"line_number":38,"context_line":"openstack_repo_url: \"http://{{ internal_lb_vip_address }}:{{ repo_server_port }}\""},{"line_number":39,"context_line":"openstack_repo_git_url: \"http://{{ internal_lb_vip_address }}:{{ repo_server_port }}/openstackgit\""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"## Enable external SSL handling for general OpenStack services"},{"line_number":42,"context_line":"openstack_external_ssl: true"},{"line_number":43,"context_line":"nova_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":44,"context_line":"keystone_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":45,"context_line":"horizon_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"## LXC options"},{"line_number":48,"context_line":"lxc_container_caches:"}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_4b581bfb","line":45,"range":{"start_line":41,"start_character":0,"end_line":45,"end_character":52},"in_reply_to":"1a122d0e_8103390f","updated":"2016-04-15 15:16:30.000000000","message":"ah. no it has not in my testing thus far.","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"6329e8a46d20c0280c3339607c171fc03eeae217","unresolved":false,"context_lines":[{"line_number":38,"context_line":"openstack_repo_url: \"http://{{ internal_lb_vip_address }}:{{ repo_server_port }}\""},{"line_number":39,"context_line":"openstack_repo_git_url: \"http://{{ internal_lb_vip_address }}:{{ repo_server_port }}/openstackgit\""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"## Enable external SSL handling for general OpenStack services"},{"line_number":42,"context_line":"openstack_external_ssl: true"},{"line_number":43,"context_line":"nova_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":44,"context_line":"keystone_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":45,"context_line":"horizon_external_ssl: \"{{ openstack_external_ssl }}\""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"## LXC options"},{"line_number":48,"context_line":"lxc_container_caches:"}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_8103390f","line":45,"range":{"start_line":41,"start_character":0,"end_line":45,"end_character":52},"in_reply_to":"1a122d0e_ab06141e","updated":"2016-04-15 14:41:34.000000000","message":"I think you\u0027re misunderstanding me. I\u0027m asking whether having the recognition of the ssl header permanently set in the template breaks the non-ssl endpoint use-case?","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"}],"playbooks/roles/haproxy_server/defaults/main.yml":[{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"b3d01f3b6a5e7c2250035b3e525f13c49af1bef8","unresolved":false,"context_lines":[{"line_number":49,"context_line":"haproxy_interval: 12000"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"## Haproxy Stats"},{"line_number":52,"context_line":"haproxy_stats_enabled: true"},{"line_number":53,"context_line":"haproxy_stats_bind_address: 127.0.0.1"},{"line_number":54,"context_line":"haproxy_stats_port: 1936"},{"line_number":55,"context_line":"haproxy_username: admin"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"7af24918_de5cfaf2","line":52,"updated":"2016-03-04 20:49:25.000000000","message":"This is a weird change to include with this patch?","commit_id":"572745850656a0af57c8c1b9836857200b80b26a"},{"author":{"_account_id":19814,"name":"Travis Truman (automagically)","email":"travis_truman@cable.comcast.com","username":"trumant"},"change_message_id":"a7d64219b9eee216e0895e45669ac30284845e37","unresolved":false,"context_lines":[{"line_number":49,"context_line":"haproxy_interval: 12000"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"## Haproxy Stats"},{"line_number":52,"context_line":"haproxy_stats_enabled: true"},{"line_number":53,"context_line":"haproxy_stats_bind_address: 127.0.0.1"},{"line_number":54,"context_line":"haproxy_stats_port: 1936"},{"line_number":55,"context_line":"haproxy_username: admin"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"5aef4532_d0920e57","line":52,"in_reply_to":"7af24918_2c94c6e6","updated":"2016-03-07 18:24:16.000000000","message":"Done","commit_id":"572745850656a0af57c8c1b9836857200b80b26a"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"87494f4c8b3b98814d2712fe8234f115e96f5771","unresolved":false,"context_lines":[{"line_number":49,"context_line":"haproxy_interval: 12000"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"## Haproxy Stats"},{"line_number":52,"context_line":"haproxy_stats_enabled: true"},{"line_number":53,"context_line":"haproxy_stats_bind_address: 127.0.0.1"},{"line_number":54,"context_line":"haproxy_stats_port: 1936"},{"line_number":55,"context_line":"haproxy_username: admin"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"7af24918_2c94c6e6","line":52,"in_reply_to":"7af24918_7ea68654","updated":"2016-03-05 13:07:27.000000000","message":"That may be a good thing to do, but it isn\u0027t the focal point of this patch which is to do SSL termination. Each review should solve one problem.","commit_id":"572745850656a0af57c8c1b9836857200b80b26a"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"c2656fcd2d7b3c0278fc1e333db931835033db87","unresolved":false,"context_lines":[{"line_number":49,"context_line":"haproxy_interval: 12000"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"## Haproxy Stats"},{"line_number":52,"context_line":"haproxy_stats_enabled: true"},{"line_number":53,"context_line":"haproxy_stats_bind_address: 127.0.0.1"},{"line_number":54,"context_line":"haproxy_stats_port: 1936"},{"line_number":55,"context_line":"haproxy_username: admin"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"7af24918_7ea68654","line":52,"in_reply_to":"7af24918_de5cfaf2","updated":"2016-03-04 21:01:28.000000000","message":"this is here so that the deployer can monitor HAP and better debug issues. That said we can disable it by default if we think that\u0027s best.","commit_id":"572745850656a0af57c8c1b9836857200b80b26a"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"1780364ddbd27159dafe1b3e8ac4c3b65414fcff","unresolved":false,"context_lines":[{"line_number":49,"context_line":"haproxy_interval: 12000"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"## Haproxy Stats"},{"line_number":52,"context_line":"haproxy_stats_enabled: false"},{"line_number":53,"context_line":"haproxy_stats_bind_address: 127.0.0.1"},{"line_number":54,"context_line":"haproxy_stats_port: 1936"},{"line_number":55,"context_line":"haproxy_username: admin"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"fa0719c6_6531b40b","line":52,"updated":"2016-03-21 14:58:38.000000000","message":"Unnecessary change.","commit_id":"8198f7f65296fc451f35ebcbc0d4c677713a8585"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"83533740bcbf219248d429741bd5211d0212c557","unresolved":false,"context_lines":[{"line_number":82,"context_line":"haproxy_ssl_key: /etc/ssl/private/haproxy.key"},{"line_number":83,"context_line":"haproxy_ssl_pem: /etc/ssl/private/haproxy.pem"},{"line_number":84,"context_line":"haproxy_ssl_ca_cert: /etc/ssl/certs/haproxy-ca.pem"},{"line_number":85,"context_line":"haproxy_ssl_self_signed_subject: \"/C\u003dUS/ST\u003dTexas/L\u003dSan Antonio/O\u003dIT/CN\u003d{{ internal_lb_vip_address }}/subjectAltName\u003dIP.1\u003d{{ external_lb_vip_address }}\""},{"line_number":86,"context_line":"haproxy_ssl_cipher_suite: \"{{ ssl_cipher_suite }}\""}],"source_content_type":"text/x-yaml","patch_set":29,"id":"1a122d0e_60f01b68","line":85,"range":{"start_line":85,"start_character":71,"end_line":85,"end_character":150},"updated":"2016-04-19 14:52:52.000000000","message":"This should not be used in a secure deployment. We should only expose the public address. It makes sense for this change to me included in this review.","commit_id":"971fd35c66fefc29ec4a671e3a2b75335b9cd463"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"6f7e34a5bca3c5a0222aa7c0b49aa9ee668dd021","unresolved":false,"context_lines":[{"line_number":82,"context_line":"haproxy_ssl_key: /etc/ssl/private/haproxy.key"},{"line_number":83,"context_line":"haproxy_ssl_pem: /etc/ssl/private/haproxy.pem"},{"line_number":84,"context_line":"haproxy_ssl_ca_cert: /etc/ssl/certs/haproxy-ca.pem"},{"line_number":85,"context_line":"haproxy_ssl_self_signed_subject: \"/C\u003dUS/ST\u003dTexas/L\u003dSan Antonio/O\u003dIT/CN\u003d{{ internal_lb_vip_address }}/subjectAltName\u003dIP.1\u003d{{ external_lb_vip_address }}\""},{"line_number":86,"context_line":"haproxy_ssl_cipher_suite: \"{{ ssl_cipher_suite }}\""}],"source_content_type":"text/x-yaml","patch_set":29,"id":"1a122d0e_6332d360","line":85,"range":{"start_line":85,"start_character":71,"end_line":85,"end_character":150},"in_reply_to":"1a122d0e_60f01b68","updated":"2016-04-19 21:24:24.000000000","message":"Done","commit_id":"971fd35c66fefc29ec4a671e3a2b75335b9cd463"}],"playbooks/roles/haproxy_server/templates/service.j2":[{"author":{"_account_id":17068,"name":"Jean-Philippe Evrard","email":"openstack@a.spamming.party","username":"evrardjp"},"change_message_id":"7f7f2906b10be69d8c68afcd4ac3079db582193a","unresolved":false,"context_lines":[{"line_number":36,"context_line":"{% endif %}"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"frontend {{ item.service.haproxy_service_name }}-front-{{ loop.index }}"},{"line_number":39,"context_line":"bind {{ vip_bind }}:{{ item.service.haproxy_port }} {% if (item.service.haproxy_ssl | default(false) | bool) and (loop.index \u003d\u003d 1 or item.service.haproxy_ssl_all_vips | default(false) | bool) %}ssl crt {{ haproxy_ssl_pem }} ciphers {{ haproxy_ssl_cipher_suite }}{% endif %}"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"{% if request_option \u003d\u003d \"http\" %}"},{"line_number":42,"context_line":"    option httplog"}],"source_content_type":"text/x-jinja2","patch_set":33,"id":"1a122d0e_aa1b77c9","line":39,"range":{"start_line":39,"start_character":0,"end_line":39,"end_character":4},"updated":"2016-04-22 16:43:26.000000000","message":"Could you add spaces here?","commit_id":"e1bbb2dd6b9fdc552e446f100388f9a04c4b95a1"},{"author":{"_account_id":17068,"name":"Jean-Philippe Evrard","email":"openstack@a.spamming.party","username":"evrardjp"},"change_message_id":"7f7f2906b10be69d8c68afcd4ac3079db582193a","unresolved":false,"context_lines":[{"line_number":36,"context_line":"{% endif %}"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"frontend {{ item.service.haproxy_service_name }}-front-{{ loop.index }}"},{"line_number":39,"context_line":"bind {{ vip_bind }}:{{ item.service.haproxy_port }} {% if (item.service.haproxy_ssl | default(false) | bool) and (loop.index \u003d\u003d 1 or item.service.haproxy_ssl_all_vips | default(false) | bool) %}ssl crt {{ haproxy_ssl_pem }} ciphers {{ haproxy_ssl_cipher_suite }}{% endif %}"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"{% if request_option \u003d\u003d \"http\" %}"},{"line_number":42,"context_line":"    option httplog"}],"source_content_type":"text/x-jinja2","patch_set":33,"id":"1a122d0e_8a54bb54","line":39,"range":{"start_line":39,"start_character":232,"end_line":39,"end_character":262},"updated":"2016-04-22 16:43:26.000000000","message":"Should we add verify none conditionally?","commit_id":"e1bbb2dd6b9fdc552e446f100388f9a04c4b95a1"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"36bd6a16ace864d5da490b071bf1c5a4cd616039","unresolved":false,"context_lines":[{"line_number":36,"context_line":"{% endif %}"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"frontend {{ item.service.haproxy_service_name }}-front-{{ loop.index }}"},{"line_number":39,"context_line":"bind {{ vip_bind }}:{{ item.service.haproxy_port }} {% if (item.service.haproxy_ssl | default(false) | bool) and (loop.index \u003d\u003d 1 or item.service.haproxy_ssl_all_vips | default(false) | bool) %}ssl crt {{ haproxy_ssl_pem }} ciphers {{ haproxy_ssl_cipher_suite }}{% endif %}"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"{% if request_option \u003d\u003d \"http\" %}"},{"line_number":42,"context_line":"    option httplog"}],"source_content_type":"text/x-jinja2","patch_set":33,"id":"1a122d0e_2fb6428a","line":39,"range":{"start_line":39,"start_character":232,"end_line":39,"end_character":262},"in_reply_to":"1a122d0e_8a54bb54","updated":"2016-04-23 15:52:28.000000000","message":"Done - the conditional service template render is being done in the haproxy_service_config.yml task file.","commit_id":"e1bbb2dd6b9fdc552e446f100388f9a04c4b95a1"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"36bd6a16ace864d5da490b071bf1c5a4cd616039","unresolved":false,"context_lines":[{"line_number":36,"context_line":"{% endif %}"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"frontend {{ item.service.haproxy_service_name }}-front-{{ loop.index }}"},{"line_number":39,"context_line":"bind {{ vip_bind }}:{{ item.service.haproxy_port }} {% if (item.service.haproxy_ssl | default(false) | bool) and (loop.index \u003d\u003d 1 or item.service.haproxy_ssl_all_vips | default(false) | bool) %}ssl crt {{ haproxy_ssl_pem }} ciphers {{ haproxy_ssl_cipher_suite }}{% endif %}"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"{% if request_option \u003d\u003d \"http\" %}"},{"line_number":42,"context_line":"    option httplog"}],"source_content_type":"text/x-jinja2","patch_set":33,"id":"1a122d0e_8f8e76ce","line":39,"range":{"start_line":39,"start_character":0,"end_line":39,"end_character":4},"in_reply_to":"1a122d0e_aa1b77c9","updated":"2016-04-23 15:52:28.000000000","message":"Done","commit_id":"e1bbb2dd6b9fdc552e446f100388f9a04c4b95a1"}],"playbooks/vars/configs/haproxy_config.yml":[{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"e9240478d0fda3eac261a6a5340afe9b85a1fb05","unresolved":false,"context_lines":[{"line_number":35,"context_line":"      haproxy_timeout_server: 5000s"},{"line_number":36,"context_line":"      haproxy_backend_options:"},{"line_number":37,"context_line":"        - \"mysql-check user {{ galera_monitoring_user }}\""},{"line_number":38,"context_line":"  - service:"},{"line_number":39,"context_line":"      haproxy_service_name: glance_api"},{"line_number":40,"context_line":"      haproxy_backend_nodes: \"{{ groups[\u0027glance_api\u0027] | default([]) }}\""},{"line_number":41,"context_line":"      haproxy_port: 9292"}],"source_content_type":"text/x-yaml","patch_set":21,"id":"5a18252c_da479375","line":38,"range":{"start_line":38,"start_character":2,"end_line":38,"end_character":12},"updated":"2016-04-13 11:12:47.000000000","message":"This service (and all the other openstack services) need an haproxy_ssl var which should be a boolean value based on the protocol set.\n\nAlso, the protocol will need to be set in a way similar to keystone\u0027s - we need to only set SSL listening on the public endpoint if the public endpoint\u0027s protocol is set to be SSL. However, if the internal and external IP of the LB are the same, then there\u0027s no choice - all endpoints must either use SSL or not use SSL.","commit_id":"cb9ed9392fdb5ce817b70ffe49352684673c6b9d"}],"releasenotes/notes/aio_ssl-cdf0092a5bfa34b5.yaml":[{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"1780364ddbd27159dafe1b3e8ac4c3b65414fcff","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - The AIO build now terminates SSL in HAProxy using a self-signed"},{"line_number":4,"context_line":"    certificate."},{"line_number":5,"context_line":"security:"},{"line_number":6,"context_line":"  - The AIO build now terminates SSL in HAProxy using a self-signed"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"fa0719c6_d037a0e1","line":3,"range":{"start_line":3,"start_character":4,"end_line":3,"end_character":12},"updated":"2016-03-21 14:58:38.000000000","message":"This is not true. The change as it is now forces any builds using haproxy to use SSL for endpoints.","commit_id":"8198f7f65296fc451f35ebcbc0d4c677713a8585"}],"releasenotes/notes/haproxy_ssl_terminiation-cdf0092a5bfa34b5.yaml":[{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"8ea4b8771667edae66bdea39a98272d92928bfe7","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":18,"id":"ba0121b8_e2727a10","updated":"2016-03-30 16:38:51.000000000","message":"This release note is significantly bare for the changes made in this patch.\n\nThis patch is forcing all deployments to use SSL for all keystone endpoints and is forcing SSL termination at the load balancer. This should be noted.\n\nThe previous behaviour was only to have Horizon use SSL and that that is done at the Horizon server. This is changing that to be at the Load Balancer and that should be noted.\n\nThese are key notes for someone coming from a previous version, so there should be upgrade notes which describe how to let things happen like they previously did.\n\nI also think that we need to update documentation to make it clear that this is a default. The current change in documentation is a little too subtle - perhaps there should be a note?","commit_id":"5d987d9d25e28eef1713f8e59d7397ca3e817932"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"6b8a852611f5d139cd05de2255dba1fbb8deb702","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - HAProxy now terminates SSL using a self-signed certificate by default."},{"line_number":4,"context_line":"security:"},{"line_number":5,"context_line":"  - HAProxy now terminates SSL using a self-signed certificate by default."},{"line_number":6,"context_line":"    if the user provides an SSL certificate to the role it will use that"},{"line_number":7,"context_line":"    instead. This change ensures that all traffic to the Load Balancer is"},{"line_number":8,"context_line":"    encrypted."}],"source_content_type":"text/x-yaml","patch_set":18,"id":"ba0121b8_8104a77e","line":6,"range":{"start_line":6,"start_character":4,"end_line":6,"end_character":6},"updated":"2016-03-29 15:46:29.000000000","message":"If","commit_id":"5d987d9d25e28eef1713f8e59d7397ca3e817932"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"23ba6173b10eefa77670ba1ea15b151bf097c601","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - The HAProxy role provided by OpenStack Ansible now terminates SSL"},{"line_number":4,"context_line":"    using a self-signed certificate by default. While this can be"},{"line_number":5,"context_line":"    disabled the inclusion of SSL services on all public enpoints as"},{"line_number":6,"context_line":"    a default will help make deployments more sceure without any"},{"line_number":7,"context_line":"    additional user interaction. While the system can generate the"},{"line_number":8,"context_line":"    self signed certificate without requiring additional user input"},{"line_number":9,"context_line":"    the available certificate options are availble to tune as the deployer"}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_e42a042c","line":6,"range":{"start_line":6,"start_character":46,"end_line":6,"end_character":52},"updated":"2016-04-12 00:41:51.000000000","message":"secure","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"21842139c2d951cf25e88b90d8dc76c8cc1a958a","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - The HAProxy role provided by OpenStack Ansible now terminates SSL"},{"line_number":4,"context_line":"    using a self-signed certificate by default. While this can be"},{"line_number":5,"context_line":"    disabled the inclusion of SSL services on all public enpoints as"},{"line_number":6,"context_line":"    a default will help make deployments more sceure without any"},{"line_number":7,"context_line":"    additional user interaction. While the system can generate the"},{"line_number":8,"context_line":"    self signed certificate without requiring additional user input"},{"line_number":9,"context_line":"    the available certificate options are availble to tune as the deployer"}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_44d138fb","line":6,"range":{"start_line":6,"start_character":46,"end_line":6,"end_character":52},"in_reply_to":"5a18252c_e42a042c","updated":"2016-04-12 00:51:56.000000000","message":"Done","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"23ba6173b10eefa77670ba1ea15b151bf097c601","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    disabled the inclusion of SSL services on all public enpoints as"},{"line_number":6,"context_line":"    a default will help make deployments more sceure without any"},{"line_number":7,"context_line":"    additional user interaction. While the system can generate the"},{"line_number":8,"context_line":"    self signed certificate without requiring additional user input"},{"line_number":9,"context_line":"    the available certificate options are availble to tune as the deployer"},{"line_number":10,"context_line":"    sees fit. If the deployer has a signed certificate the system will"},{"line_number":11,"context_line":"    put a provided certificate and its accompanying files inplace once"}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_c4d26834","line":8,"range":{"start_line":8,"start_character":62,"end_line":8,"end_character":67},"updated":"2016-04-12 00:41:51.000000000","message":"input,","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"21842139c2d951cf25e88b90d8dc76c8cc1a958a","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    disabled the inclusion of SSL services on all public enpoints as"},{"line_number":6,"context_line":"    a default will help make deployments more sceure without any"},{"line_number":7,"context_line":"    additional user interaction. While the system can generate the"},{"line_number":8,"context_line":"    self signed certificate without requiring additional user input"},{"line_number":9,"context_line":"    the available certificate options are availble to tune as the deployer"},{"line_number":10,"context_line":"    sees fit. If the deployer has a signed certificate the system will"},{"line_number":11,"context_line":"    put a provided certificate and its accompanying files inplace once"}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_a4080c93","line":8,"range":{"start_line":8,"start_character":62,"end_line":8,"end_character":67},"in_reply_to":"5a18252c_c4d26834","updated":"2016-04-12 00:51:56.000000000","message":"Done","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"23ba6173b10eefa77670ba1ea15b151bf097c601","unresolved":false,"context_lines":[{"line_number":8,"context_line":"    self signed certificate without requiring additional user input"},{"line_number":9,"context_line":"    the available certificate options are availble to tune as the deployer"},{"line_number":10,"context_line":"    sees fit. If the deployer has a signed certificate the system will"},{"line_number":11,"context_line":"    put a provided certificate and its accompanying files inplace once"},{"line_number":12,"context_line":"    loaded into the deployers variables."},{"line_number":13,"context_line":"upgrade:"},{"line_number":14,"context_line":"  - SSL terminiation is enabled on all public endpoints by default. If"}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_44e77812","line":11,"range":{"start_line":11,"start_character":58,"end_line":11,"end_character":65},"updated":"2016-04-12 00:41:51.000000000","message":"in place","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"21842139c2d951cf25e88b90d8dc76c8cc1a958a","unresolved":false,"context_lines":[{"line_number":8,"context_line":"    self signed certificate without requiring additional user input"},{"line_number":9,"context_line":"    the available certificate options are availble to tune as the deployer"},{"line_number":10,"context_line":"    sees fit. If the deployer has a signed certificate the system will"},{"line_number":11,"context_line":"    put a provided certificate and its accompanying files inplace once"},{"line_number":12,"context_line":"    loaded into the deployers variables."},{"line_number":13,"context_line":"upgrade:"},{"line_number":14,"context_line":"  - SSL terminiation is enabled on all public endpoints by default. If"}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_04fe206b","line":11,"range":{"start_line":11,"start_character":58,"end_line":11,"end_character":65},"in_reply_to":"5a18252c_44e77812","updated":"2016-04-12 00:51:56.000000000","message":"Done","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"23ba6173b10eefa77670ba1ea15b151bf097c601","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    loaded into the deployers variables."},{"line_number":13,"context_line":"upgrade:"},{"line_number":14,"context_line":"  - SSL terminiation is enabled on all public endpoints by default. If"},{"line_number":15,"context_line":"    this not something needed or wanted in a deplpoyment when using"},{"line_number":16,"context_line":"    HAProxy SSL can be disabled by setting the"},{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."},{"line_number":18,"context_line":"  - In previous releases connections to Horizon originally terminted SSL"}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_24e4fc0b","line":15,"range":{"start_line":15,"start_character":4,"end_line":15,"end_character":12},"updated":"2016-04-12 00:41:51.000000000","message":"this is not","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"21842139c2d951cf25e88b90d8dc76c8cc1a958a","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    loaded into the deployers variables."},{"line_number":13,"context_line":"upgrade:"},{"line_number":14,"context_line":"  - SSL terminiation is enabled on all public endpoints by default. If"},{"line_number":15,"context_line":"    this not something needed or wanted in a deplpoyment when using"},{"line_number":16,"context_line":"    HAProxy SSL can be disabled by setting the"},{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."},{"line_number":18,"context_line":"  - In previous releases connections to Horizon originally terminted SSL"}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_e402046f","line":15,"range":{"start_line":15,"start_character":4,"end_line":15,"end_character":12},"in_reply_to":"5a18252c_24e4fc0b","updated":"2016-04-12 00:51:56.000000000","message":"Done","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"23ba6173b10eefa77670ba1ea15b151bf097c601","unresolved":false,"context_lines":[{"line_number":13,"context_line":"upgrade:"},{"line_number":14,"context_line":"  - SSL terminiation is enabled on all public endpoints by default. If"},{"line_number":15,"context_line":"    this not something needed or wanted in a deplpoyment when using"},{"line_number":16,"context_line":"    HAProxy SSL can be disabled by setting the"},{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."},{"line_number":18,"context_line":"  - In previous releases connections to Horizon originally terminted SSL"},{"line_number":19,"context_line":"    at the horizon container. While that is still an option, SSL is now"}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_c4b9c8ee","line":16,"range":{"start_line":16,"start_character":15,"end_line":16,"end_character":19},"updated":"2016-04-12 00:41:51.000000000","message":"it can","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"21842139c2d951cf25e88b90d8dc76c8cc1a958a","unresolved":false,"context_lines":[{"line_number":13,"context_line":"upgrade:"},{"line_number":14,"context_line":"  - SSL terminiation is enabled on all public endpoints by default. If"},{"line_number":15,"context_line":"    this not something needed or wanted in a deplpoyment when using"},{"line_number":16,"context_line":"    HAProxy SSL can be disabled by setting the"},{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."},{"line_number":18,"context_line":"  - In previous releases connections to Horizon originally terminted SSL"},{"line_number":19,"context_line":"    at the horizon container. While that is still an option, SSL is now"}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_64ef14b1","line":16,"range":{"start_line":16,"start_character":15,"end_line":16,"end_character":19},"in_reply_to":"5a18252c_c4b9c8ee","updated":"2016-04-12 00:51:56.000000000","message":"Done","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"23ba6173b10eefa77670ba1ea15b151bf097c601","unresolved":false,"context_lines":[{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."},{"line_number":18,"context_line":"  - In previous releases connections to Horizon originally terminted SSL"},{"line_number":19,"context_line":"    at the horizon container. While that is still an option, SSL is now"},{"line_number":20,"context_line":"    aassumed to be terminated at the load blancer. If you wish to terminate"},{"line_number":21,"context_line":"    SSL at the horizon node change the ``horizon_external_ssl`` option to"},{"line_number":22,"context_line":"    **false**."},{"line_number":23,"context_line":"security:"}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_04b460f0","line":20,"range":{"start_line":20,"start_character":42,"end_line":20,"end_character":49},"updated":"2016-04-12 00:41:51.000000000","message":"balancer","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"21842139c2d951cf25e88b90d8dc76c8cc1a958a","unresolved":false,"context_lines":[{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."},{"line_number":18,"context_line":"  - In previous releases connections to Horizon originally terminted SSL"},{"line_number":19,"context_line":"    at the horizon container. While that is still an option, SSL is now"},{"line_number":20,"context_line":"    aassumed to be terminated at the load blancer. If you wish to terminate"},{"line_number":21,"context_line":"    SSL at the horizon node change the ``horizon_external_ssl`` option to"},{"line_number":22,"context_line":"    **false**."},{"line_number":23,"context_line":"security:"}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_c42a68e7","line":20,"range":{"start_line":20,"start_character":42,"end_line":20,"end_character":49},"in_reply_to":"5a18252c_04b460f0","updated":"2016-04-12 00:51:56.000000000","message":"Done","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"23ba6173b10eefa77670ba1ea15b151bf097c601","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    SSL at the horizon node change the ``horizon_external_ssl`` option to"},{"line_number":22,"context_line":"    **false**."},{"line_number":23,"context_line":"security:"},{"line_number":24,"context_line":"  - An SSL certificate will now be generated and self signed by default."},{"line_number":25,"context_line":"    This will assist in the general security posture of the OpenStack"},{"line_number":26,"context_line":"    deployment."}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_64c5545a","line":24,"range":{"start_line":24,"start_character":4,"end_line":24,"end_character":72},"updated":"2016-04-12 00:41:51.000000000","message":"A self signed certificate will now be generated by default.","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"21842139c2d951cf25e88b90d8dc76c8cc1a958a","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    SSL at the horizon node change the ``horizon_external_ssl`` option to"},{"line_number":22,"context_line":"    **false**."},{"line_number":23,"context_line":"security:"},{"line_number":24,"context_line":"  - An SSL certificate will now be generated and self signed by default."},{"line_number":25,"context_line":"    This will assist in the general security posture of the OpenStack"},{"line_number":26,"context_line":"    deployment."}],"source_content_type":"text/x-yaml","patch_set":20,"id":"5a18252c_04358045","line":24,"range":{"start_line":24,"start_character":4,"end_line":24,"end_character":72},"in_reply_to":"5a18252c_64c5545a","updated":"2016-04-12 00:51:56.000000000","message":"Done","commit_id":"323bd03e929d9e62509a14e705b50551f1473955"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"5f5a92ab6d849455a2a5984d6e7a233957e6ca10","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - The HAProxy role provided by OpenStack Ansible now terminates SSL"},{"line_number":4,"context_line":"    using a self-signed certificate by default. While this can be"},{"line_number":5,"context_line":"    disabled the inclusion of SSL services on all public enpoints as"},{"line_number":6,"context_line":"    a default will help make deployments more secure without any"}],"source_content_type":"text/x-yaml","patch_set":21,"id":"5a18252c_eb21e8fc","line":3,"range":{"start_line":3,"start_character":33,"end_line":3,"end_character":50},"updated":"2016-04-13 09:37:18.000000000","message":"OpenStack-Ansible","commit_id":"cb9ed9392fdb5ce817b70ffe49352684673c6b9d"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"5f5a92ab6d849455a2a5984d6e7a233957e6ca10","unresolved":false,"context_lines":[{"line_number":6,"context_line":"    a default will help make deployments more secure without any"},{"line_number":7,"context_line":"    additional user interaction. While the system can generate the"},{"line_number":8,"context_line":"    self signed certificate without requiring additional user input."},{"line_number":9,"context_line":"    Certificate options are availble to tune as the deployer sees fit."},{"line_number":10,"context_line":"    If the deployer has a signed certificate the system will"},{"line_number":11,"context_line":"    put a provided certificate and its accompanying files in place"},{"line_number":12,"context_line":"    once loaded into the deployers variables."}],"source_content_type":"text/x-yaml","patch_set":21,"id":"5a18252c_aba410a6","line":9,"range":{"start_line":9,"start_character":28,"end_line":9,"end_character":36},"updated":"2016-04-13 09:37:18.000000000","message":"available","commit_id":"cb9ed9392fdb5ce817b70ffe49352684673c6b9d"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"5f5a92ab6d849455a2a5984d6e7a233957e6ca10","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    put a provided certificate and its accompanying files in place"},{"line_number":12,"context_line":"    once loaded into the deployers variables."},{"line_number":13,"context_line":"upgrade:"},{"line_number":14,"context_line":"  - SSL terminiation is enabled on all public endpoints by default. If"},{"line_number":15,"context_line":"    this is not something needed or wanted in a deplpoyment when using"},{"line_number":16,"context_line":"    HAProxy+SSL it can be disabled by setting the"},{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."}],"source_content_type":"text/x-yaml","patch_set":21,"id":"5a18252c_8b3b1438","line":14,"range":{"start_line":14,"start_character":8,"end_line":14,"end_character":20},"updated":"2016-04-13 09:37:18.000000000","message":"termination","commit_id":"cb9ed9392fdb5ce817b70ffe49352684673c6b9d"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"5f5a92ab6d849455a2a5984d6e7a233957e6ca10","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    once loaded into the deployers variables."},{"line_number":13,"context_line":"upgrade:"},{"line_number":14,"context_line":"  - SSL terminiation is enabled on all public endpoints by default. If"},{"line_number":15,"context_line":"    this is not something needed or wanted in a deplpoyment when using"},{"line_number":16,"context_line":"    HAProxy+SSL it can be disabled by setting the"},{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."},{"line_number":18,"context_line":"  - In previous releases connections to Horizon originally terminted SSL"}],"source_content_type":"text/x-yaml","patch_set":21,"id":"5a18252c_2bb760d9","line":15,"range":{"start_line":15,"start_character":48,"end_line":15,"end_character":59},"updated":"2016-04-13 09:37:18.000000000","message":"deployment","commit_id":"cb9ed9392fdb5ce817b70ffe49352684673c6b9d"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"5f5a92ab6d849455a2a5984d6e7a233957e6ca10","unresolved":false,"context_lines":[{"line_number":15,"context_line":"    this is not something needed or wanted in a deplpoyment when using"},{"line_number":16,"context_line":"    HAProxy+SSL it can be disabled by setting the"},{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."},{"line_number":18,"context_line":"  - In previous releases connections to Horizon originally terminted SSL"},{"line_number":19,"context_line":"    at the horizon container. While that is still an option, SSL is now"},{"line_number":20,"context_line":"    aassumed to be terminated at the load balancer. If you wish to terminate"},{"line_number":21,"context_line":"    SSL at the horizon node change the ``horizon_external_ssl`` option to"}],"source_content_type":"text/x-yaml","patch_set":21,"id":"5a18252c_cbc06c2d","line":18,"range":{"start_line":18,"start_character":59,"end_line":18,"end_character":68},"updated":"2016-04-13 09:37:18.000000000","message":"terminated","commit_id":"cb9ed9392fdb5ce817b70ffe49352684673c6b9d"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"5f5a92ab6d849455a2a5984d6e7a233957e6ca10","unresolved":false,"context_lines":[{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."},{"line_number":18,"context_line":"  - In previous releases connections to Horizon originally terminted SSL"},{"line_number":19,"context_line":"    at the horizon container. While that is still an option, SSL is now"},{"line_number":20,"context_line":"    aassumed to be terminated at the load balancer. If you wish to terminate"},{"line_number":21,"context_line":"    SSL at the horizon node change the ``horizon_external_ssl`` option to"},{"line_number":22,"context_line":"    **false**."},{"line_number":23,"context_line":"security:"}],"source_content_type":"text/x-yaml","patch_set":21,"id":"5a18252c_2b2c8001","line":20,"range":{"start_line":20,"start_character":4,"end_line":20,"end_character":12},"updated":"2016-04-13 09:37:18.000000000","message":"assumed","commit_id":"cb9ed9392fdb5ce817b70ffe49352684673c6b9d"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"5f5a92ab6d849455a2a5984d6e7a233957e6ca10","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    SSL at the horizon node change the ``horizon_external_ssl`` option to"},{"line_number":22,"context_line":"    **false**."},{"line_number":23,"context_line":"security:"},{"line_number":24,"context_line":"  - A self signed certificate will now be generated by default. This will"},{"line_number":25,"context_line":"    assist with the general security posture of the OpenStack deployment."}],"source_content_type":"text/x-yaml","patch_set":21,"id":"5a18252c_8bcdd45f","line":24,"range":{"start_line":24,"start_character":4,"end_line":24,"end_character":63},"updated":"2016-04-13 09:37:18.000000000","message":"Where, for what? This sentence read outside of the context of the patch makes no sense.","commit_id":"cb9ed9392fdb5ce817b70ffe49352684673c6b9d"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"021e2f90f16d9579b087c554567646bfd1abd6a8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - The HAProxy role provided by OpenStack Ansible now terminates SSL"},{"line_number":4,"context_line":"    using a self-signed certificate by default. While this can be"},{"line_number":5,"context_line":"    disabled the inclusion of SSL services on all public enpoints as"},{"line_number":6,"context_line":"    a default will help make deployments more secure without any"}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_b97317b4","line":3,"range":{"start_line":3,"start_character":33,"end_line":3,"end_character":50},"updated":"2016-04-15 10:10:15.000000000","message":"OpenStack-Ansible","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"021e2f90f16d9579b087c554567646bfd1abd6a8","unresolved":false,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - The HAProxy role provided by OpenStack Ansible now terminates SSL"},{"line_number":4,"context_line":"    using a self-signed certificate by default. While this can be"},{"line_number":5,"context_line":"    disabled the inclusion of SSL services on all public enpoints as"},{"line_number":6,"context_line":"    a default will help make deployments more secure without any"},{"line_number":7,"context_line":"    additional user interaction. While the system can generate the"},{"line_number":8,"context_line":"    self signed certificate without requiring additional user input."}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_b92b1733","line":5,"range":{"start_line":5,"start_character":57,"end_line":5,"end_character":65},"updated":"2016-04-15 10:10:15.000000000","message":"endpoints","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"021e2f90f16d9579b087c554567646bfd1abd6a8","unresolved":false,"context_lines":[{"line_number":6,"context_line":"    a default will help make deployments more secure without any"},{"line_number":7,"context_line":"    additional user interaction. While the system can generate the"},{"line_number":8,"context_line":"    self signed certificate without requiring additional user input."},{"line_number":9,"context_line":"    Certificate options are availble to tune as the deployer sees fit."},{"line_number":10,"context_line":"    If the deployer has a signed certificate the system will"},{"line_number":11,"context_line":"    put a provided certificate and its accompanying files in place"},{"line_number":12,"context_line":"    once loaded into the deployers variables."}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_595f630e","line":9,"range":{"start_line":9,"start_character":28,"end_line":9,"end_character":36},"updated":"2016-04-15 10:10:15.000000000","message":"available","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"021e2f90f16d9579b087c554567646bfd1abd6a8","unresolved":false,"context_lines":[{"line_number":4,"context_line":"    using a self-signed certificate by default. While this can be"},{"line_number":5,"context_line":"    disabled the inclusion of SSL services on all public enpoints as"},{"line_number":6,"context_line":"    a default will help make deployments more secure without any"},{"line_number":7,"context_line":"    additional user interaction. While the system can generate the"},{"line_number":8,"context_line":"    self signed certificate without requiring additional user input."},{"line_number":9,"context_line":"    Certificate options are availble to tune as the deployer sees fit."},{"line_number":10,"context_line":"    If the deployer has a signed certificate the system will"},{"line_number":11,"context_line":"    put a provided certificate and its accompanying files in place"},{"line_number":12,"context_line":"    once loaded into the deployers variables."},{"line_number":13,"context_line":"upgrade:"},{"line_number":14,"context_line":"  - SSL terminiation is enabled on all public endpoints by default. If"},{"line_number":15,"context_line":"    this is not something needed or wanted in a deplpoyment when using"}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_79b97f2e","line":12,"range":{"start_line":7,"start_character":32,"end_line":12,"end_character":45},"updated":"2016-04-15 10:10:15.000000000","message":"I think it\u0027s best to skip all this and simply point to http://docs.openstack.org/developer/openstack-ansible/install-guide/configure-haproxy.html#securing-haproxy-communication-with-ssl-certificates for further details about how to use a custom cert instead of the self-signed cert.","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"021e2f90f16d9579b087c554567646bfd1abd6a8","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    put a provided certificate and its accompanying files in place"},{"line_number":12,"context_line":"    once loaded into the deployers variables."},{"line_number":13,"context_line":"upgrade:"},{"line_number":14,"context_line":"  - SSL terminiation is enabled on all public endpoints by default. If"},{"line_number":15,"context_line":"    this is not something needed or wanted in a deplpoyment when using"},{"line_number":16,"context_line":"    HAProxy+SSL it can be disabled by setting the"},{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_b9815750","line":14,"range":{"start_line":14,"start_character":8,"end_line":14,"end_character":20},"updated":"2016-04-15 10:10:15.000000000","message":"termination","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"021e2f90f16d9579b087c554567646bfd1abd6a8","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    once loaded into the deployers variables."},{"line_number":13,"context_line":"upgrade:"},{"line_number":14,"context_line":"  - SSL terminiation is enabled on all public endpoints by default. If"},{"line_number":15,"context_line":"    this is not something needed or wanted in a deplpoyment when using"},{"line_number":16,"context_line":"    HAProxy+SSL it can be disabled by setting the"},{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."},{"line_number":18,"context_line":"  - In previous releases connections to Horizon originally terminted SSL"}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_d9809349","line":15,"range":{"start_line":15,"start_character":48,"end_line":15,"end_character":59},"updated":"2016-04-15 10:10:15.000000000","message":"deployment","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"021e2f90f16d9579b087c554567646bfd1abd6a8","unresolved":false,"context_lines":[{"line_number":13,"context_line":"upgrade:"},{"line_number":14,"context_line":"  - SSL terminiation is enabled on all public endpoints by default. If"},{"line_number":15,"context_line":"    this is not something needed or wanted in a deplpoyment when using"},{"line_number":16,"context_line":"    HAProxy+SSL it can be disabled by setting the"},{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."},{"line_number":18,"context_line":"  - In previous releases connections to Horizon originally terminted SSL"},{"line_number":19,"context_line":"    at the horizon container. While that is still an option, SSL is now"},{"line_number":20,"context_line":"    aassumed to be terminated at the load balancer. If you wish to terminate"}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_d9453318","line":17,"range":{"start_line":16,"start_character":0,"end_line":17,"end_character":51},"updated":"2016-04-15 10:10:15.000000000","message":"I think more than this is required - you have to also change the public_proto. In fact I would guess that openstack_external_ssl isn\u0027t even needed? Is there any harm in just having all services recognise the header by default, then just key off whether or not the protocol is set?","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"021e2f90f16d9579b087c554567646bfd1abd6a8","unresolved":false,"context_lines":[{"line_number":15,"context_line":"    this is not something needed or wanted in a deplpoyment when using"},{"line_number":16,"context_line":"    HAProxy+SSL it can be disabled by setting the"},{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."},{"line_number":18,"context_line":"  - In previous releases connections to Horizon originally terminted SSL"},{"line_number":19,"context_line":"    at the horizon container. While that is still an option, SSL is now"},{"line_number":20,"context_line":"    aassumed to be terminated at the load balancer. If you wish to terminate"},{"line_number":21,"context_line":"    SSL at the horizon node change the ``horizon_external_ssl`` option to"}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_19484b2d","line":18,"range":{"start_line":18,"start_character":59,"end_line":18,"end_character":68},"updated":"2016-04-15 10:10:15.000000000","message":"terminated","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"021e2f90f16d9579b087c554567646bfd1abd6a8","unresolved":false,"context_lines":[{"line_number":16,"context_line":"    HAProxy+SSL it can be disabled by setting the"},{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."},{"line_number":18,"context_line":"  - In previous releases connections to Horizon originally terminted SSL"},{"line_number":19,"context_line":"    at the horizon container. While that is still an option, SSL is now"},{"line_number":20,"context_line":"    aassumed to be terminated at the load balancer. If you wish to terminate"},{"line_number":21,"context_line":"    SSL at the horizon node change the ``horizon_external_ssl`` option to"},{"line_number":22,"context_line":"    **false**."}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_f9574fc8","line":19,"range":{"start_line":19,"start_character":11,"end_line":19,"end_character":18},"updated":"2016-04-15 10:10:15.000000000","message":"Horizon","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"021e2f90f16d9579b087c554567646bfd1abd6a8","unresolved":false,"context_lines":[{"line_number":17,"context_line":"    ``openstack_external_ssl`` option to **false**."},{"line_number":18,"context_line":"  - In previous releases connections to Horizon originally terminted SSL"},{"line_number":19,"context_line":"    at the horizon container. While that is still an option, SSL is now"},{"line_number":20,"context_line":"    aassumed to be terminated at the load balancer. If you wish to terminate"},{"line_number":21,"context_line":"    SSL at the horizon node change the ``horizon_external_ssl`` option to"},{"line_number":22,"context_line":"    **false**."},{"line_number":23,"context_line":"security:"}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_3972677d","line":20,"range":{"start_line":20,"start_character":4,"end_line":20,"end_character":12},"updated":"2016-04-15 10:10:15.000000000","message":"assumed","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"021e2f90f16d9579b087c554567646bfd1abd6a8","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    SSL at the horizon node change the ``horizon_external_ssl`` option to"},{"line_number":22,"context_line":"    **false**."},{"line_number":23,"context_line":"security:"},{"line_number":24,"context_line":"  - A self signed certificate will now be generated by default. This will"},{"line_number":25,"context_line":"    assist with the general security posture of the OpenStack deployment."}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_79033fb9","line":24,"range":{"start_line":24,"start_character":42,"end_line":24,"end_character":62},"updated":"2016-04-15 10:10:15.000000000","message":"generated by default when HAproxy is used as a load balancer. This certificate is used to terminate the public endpoint for Horizon and all OpenStack API services.","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"021e2f90f16d9579b087c554567646bfd1abd6a8","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    SSL at the horizon node change the ``horizon_external_ssl`` option to"},{"line_number":22,"context_line":"    **false**."},{"line_number":23,"context_line":"security:"},{"line_number":24,"context_line":"  - A self signed certificate will now be generated by default. This will"},{"line_number":25,"context_line":"    assist with the general security posture of the OpenStack deployment."}],"source_content_type":"text/x-yaml","patch_set":26,"id":"1a122d0e_5969238b","line":24,"range":{"start_line":24,"start_character":6,"end_line":24,"end_character":17},"updated":"2016-04-15 10:10:15.000000000","message":"self-signed","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"236a53f90ce296d429ef9e7271713506a14acc3b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":28,"id":"1a122d0e_0f5c26ec","updated":"2016-04-18 16:23:12.000000000","message":"See all my comments in PS26 which have not yet been addressed.","commit_id":"551cb3a804599ab75308dedd1b22c9dab9d9b3ed"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"83533740bcbf219248d429741bd5211d0212c557","unresolved":false,"context_lines":[{"line_number":8,"context_line":"    generation can be `found here \u003chttp://docs.openstack.org/developer/openstack-ansible/install-guide/configure-haproxy.html#securing-haproxy-communication-with-ssl-certificates\u003e`_."},{"line_number":9,"context_line":"upgrade:"},{"line_number":10,"context_line":"  - SSL termination is assumed enabled for all public endpoints by default."},{"line_number":11,"context_line":"    If this is not something needed or wanted it can be disabled by setting"},{"line_number":12,"context_line":"    the ``openstack_external_ssl`` option to **false** and the"},{"line_number":13,"context_line":"    ``openstack_service_publicuri_proto`` to **http**."},{"line_number":14,"context_line":"  - If HAProxy is used as the loadbalancer for a deployment it will generate"}],"source_content_type":"text/x-yaml","patch_set":29,"id":"1a122d0e_40519f35","line":11,"range":{"start_line":11,"start_character":4,"end_line":11,"end_character":64},"updated":"2016-04-19 14:52:52.000000000","message":"\"This default can be disabled...\"\n\nI don\u0027t think we wish to discuss the deployers needs and wants. ;)","commit_id":"971fd35c66fefc29ec4a671e3a2b75335b9cd463"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"6f7e34a5bca3c5a0222aa7c0b49aa9ee668dd021","unresolved":false,"context_lines":[{"line_number":8,"context_line":"    generation can be `found here \u003chttp://docs.openstack.org/developer/openstack-ansible/install-guide/configure-haproxy.html#securing-haproxy-communication-with-ssl-certificates\u003e`_."},{"line_number":9,"context_line":"upgrade:"},{"line_number":10,"context_line":"  - SSL termination is assumed enabled for all public endpoints by default."},{"line_number":11,"context_line":"    If this is not something needed or wanted it can be disabled by setting"},{"line_number":12,"context_line":"    the ``openstack_external_ssl`` option to **false** and the"},{"line_number":13,"context_line":"    ``openstack_service_publicuri_proto`` to **http**."},{"line_number":14,"context_line":"  - If HAProxy is used as the loadbalancer for a deployment it will generate"}],"source_content_type":"text/x-yaml","patch_set":29,"id":"1a122d0e_434877cc","line":11,"range":{"start_line":11,"start_character":4,"end_line":11,"end_character":64},"in_reply_to":"1a122d0e_40519f35","updated":"2016-04-19 21:24:24.000000000","message":"Done","commit_id":"971fd35c66fefc29ec4a671e3a2b75335b9cd463"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"83533740bcbf219248d429741bd5211d0212c557","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    If this is not something needed or wanted it can be disabled by setting"},{"line_number":12,"context_line":"    the ``openstack_external_ssl`` option to **false** and the"},{"line_number":13,"context_line":"    ``openstack_service_publicuri_proto`` to **http**."},{"line_number":14,"context_line":"  - If HAProxy is used as the loadbalancer for a deployment it will generate"},{"line_number":15,"context_line":"    a self-signed certificate by default. If HAProxy is NOT used, an SSL"},{"line_number":16,"context_line":"    certificate should be installed on the external loadbalancer. The"},{"line_number":17,"context_line":"    installation of an SSL certificate on an external loadbalancer is not"}],"source_content_type":"text/x-yaml","patch_set":29,"id":"1a122d0e_bb40a235","line":14,"range":{"start_line":14,"start_character":30,"end_line":14,"end_character":42},"updated":"2016-04-19 14:52:52.000000000","message":"load balancer (two words)","commit_id":"971fd35c66fefc29ec4a671e3a2b75335b9cd463"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"6f7e34a5bca3c5a0222aa7c0b49aa9ee668dd021","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    If this is not something needed or wanted it can be disabled by setting"},{"line_number":12,"context_line":"    the ``openstack_external_ssl`` option to **false** and the"},{"line_number":13,"context_line":"    ``openstack_service_publicuri_proto`` to **http**."},{"line_number":14,"context_line":"  - If HAProxy is used as the loadbalancer for a deployment it will generate"},{"line_number":15,"context_line":"    a self-signed certificate by default. If HAProxy is NOT used, an SSL"},{"line_number":16,"context_line":"    certificate should be installed on the external loadbalancer. The"},{"line_number":17,"context_line":"    installation of an SSL certificate on an external loadbalancer is not"}],"source_content_type":"text/x-yaml","patch_set":29,"id":"1a122d0e_23457bb2","line":14,"range":{"start_line":14,"start_character":30,"end_line":14,"end_character":42},"in_reply_to":"1a122d0e_bb40a235","updated":"2016-04-19 21:24:24.000000000","message":"Done","commit_id":"971fd35c66fefc29ec4a671e3a2b75335b9cd463"},{"author":{"_account_id":17068,"name":"Jean-Philippe Evrard","email":"openstack@a.spamming.party","username":"evrardjp"},"change_message_id":"fa2d61c9285f96771b686f1cef386edac1801a27","unresolved":false,"context_lines":[{"line_number":6,"context_line":"    a default will help make deployments more secure without any"},{"line_number":7,"context_line":"    additional user interaction. More information on SSL and certificate"},{"line_number":8,"context_line":"    generation can be `found here \u003chttp://docs.openstack.org/developer/openstack-ansible/install-guide/configure-haproxy.html#securing-haproxy-communication-with-ssl-certificates\u003e`_."},{"line_number":9,"context_line":"upgrade:"},{"line_number":10,"context_line":"  - SSL termination is assumed enabled for all public endpoints by default."},{"line_number":11,"context_line":"    If this is not needed it can be disabled by setting"},{"line_number":12,"context_line":"    the ``openstack_external_ssl`` option to **false** and the"}],"source_content_type":"text/x-yaml","patch_set":33,"id":"1a122d0e_2a15a748","line":9,"range":{"start_line":9,"start_character":0,"end_line":9,"end_character":7},"updated":"2016-04-22 16:50:44.000000000","message":"Is there no impact on upgrade about endpoints change?","commit_id":"e1bbb2dd6b9fdc552e446f100388f9a04c4b95a1"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"46c3a8d53f53545f80502816fcca72bdea7f6e26","unresolved":false,"context_lines":[{"line_number":6,"context_line":"    a default will help make deployments more secure without any"},{"line_number":7,"context_line":"    additional user interaction. More information on SSL and certificate"},{"line_number":8,"context_line":"    generation can be `found here \u003chttp://docs.openstack.org/developer/openstack-ansible/install-guide/configure-haproxy.html#securing-haproxy-communication-with-ssl-certificates\u003e`_."},{"line_number":9,"context_line":"upgrade:"},{"line_number":10,"context_line":"  - SSL termination is assumed enabled for all public endpoints by default."},{"line_number":11,"context_line":"    If this is not needed it can be disabled by setting"},{"line_number":12,"context_line":"    the ``openstack_external_ssl`` option to **false** and the"}],"source_content_type":"text/x-yaml","patch_set":33,"id":"1a122d0e_645a3385","line":9,"range":{"start_line":9,"start_character":0,"end_line":9,"end_character":7},"in_reply_to":"1a122d0e_2a15a748","updated":"2016-04-22 17:57:25.000000000","message":"Isn\u0027t that covered by the first point below?\n\nThere is an issue though - the new endpoints will not be registered during an upgrade, so the whole environment will break without extra tooling.\n\nI wonder if we shouldn\u0027t leave the non-HTTPS setup as a default for the normal install but have it as a default for the AIO and ensure that we have nice docs describing how to setup HTTPS endpoints.\n\nThat would maintain upgrade compatibility. It\u0027s either that or we need to make a special upgrade task to change the endpoints, or disable the default. Or we need to change the keystone module to be capable of updating the endpoints.","commit_id":"e1bbb2dd6b9fdc552e446f100388f9a04c4b95a1"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"36bd6a16ace864d5da490b071bf1c5a4cd616039","unresolved":false,"context_lines":[{"line_number":6,"context_line":"    a default will help make deployments more secure without any"},{"line_number":7,"context_line":"    additional user interaction. More information on SSL and certificate"},{"line_number":8,"context_line":"    generation can be `found here \u003chttp://docs.openstack.org/developer/openstack-ansible/install-guide/configure-haproxy.html#securing-haproxy-communication-with-ssl-certificates\u003e`_."},{"line_number":9,"context_line":"upgrade:"},{"line_number":10,"context_line":"  - SSL termination is assumed enabled for all public endpoints by default."},{"line_number":11,"context_line":"    If this is not needed it can be disabled by setting"},{"line_number":12,"context_line":"    the ``openstack_external_ssl`` option to **false** and the"}],"source_content_type":"text/x-yaml","patch_set":33,"id":"1a122d0e_c444e7b8","line":9,"range":{"start_line":9,"start_character":0,"end_line":9,"end_character":7},"in_reply_to":"1a122d0e_2a15a748","updated":"2016-04-23 15:52:28.000000000","message":"endpoint generation is not statefull. I can add a note about that.","commit_id":"e1bbb2dd6b9fdc552e446f100388f9a04c4b95a1"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"f9d429b56acb7c2cdba4e9daa645b185ad195167","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    SSL at the horizon node change the ``horizon_external_ssl`` option to"},{"line_number":23,"context_line":"    **false**."},{"line_number":24,"context_line":"  - Public endpoints will need to be updated using the Keystone admin API to"},{"line_number":25,"context_line":"    support secure endpoints. The Keystone ansible module will not recreate "},{"line_number":26,"context_line":"    the endpoints automatically. Documentation on the `Keystone service "},{"line_number":27,"context_line":"    catalog can be found here \u003chttp://docs.openstack.org/developer/keystone/configuration.html#service-catalog\u003e`_."},{"line_number":28,"context_line":"security:"}],"source_content_type":"text/x-yaml","patch_set":38,"id":"1a122d0e_59f7ff58","line":25,"range":{"start_line":25,"start_character":75,"end_line":25,"end_character":76},"updated":"2016-05-04 11:56:16.000000000","message":"whitespace","commit_id":"92eb98e1d2f367609640f9207b30038565a22339"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"f9d429b56acb7c2cdba4e9daa645b185ad195167","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    **false**."},{"line_number":24,"context_line":"  - Public endpoints will need to be updated using the Keystone admin API to"},{"line_number":25,"context_line":"    support secure endpoints. The Keystone ansible module will not recreate "},{"line_number":26,"context_line":"    the endpoints automatically. Documentation on the `Keystone service "},{"line_number":27,"context_line":"    catalog can be found here \u003chttp://docs.openstack.org/developer/keystone/configuration.html#service-catalog\u003e`_."},{"line_number":28,"context_line":"security:"},{"line_number":29,"context_line":"  - A self-signed certificate will now be generated by default when HAproxy"}],"source_content_type":"text/x-yaml","patch_set":38,"id":"1a122d0e_3902033f","line":26,"range":{"start_line":26,"start_character":71,"end_line":26,"end_character":72},"updated":"2016-05-04 11:56:16.000000000","message":"whitespace","commit_id":"92eb98e1d2f367609640f9207b30038565a22339"}],"tests/roles/bootstrap-host/templates/user_variables.aio.yml.j2":[{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"8ea4b8771667edae66bdea39a98272d92928bfe7","unresolved":false,"context_lines":[{"line_number":41,"context_line":"glance_default_store: file"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"## SSL Settings"},{"line_number":44,"context_line":"keystone_service_adminuri_proto: \"https\""},{"line_number":45,"context_line":"keystone_service_internaluri_proto: \"https\""},{"line_number":46,"context_line":"keystone_service_publicuri_proto: \"https\""},{"line_number":47,"context_line":"keystone_service_adminuri_insecure: true"}],"source_content_type":"text/x-jinja2","patch_set":18,"id":"ba0121b8_228f522b","line":44,"updated":"2016-03-30 16:38:51.000000000","message":"Why is this being forced for the Admin/Internal URI\u0027s too?","commit_id":"5d987d9d25e28eef1713f8e59d7397ca3e817932"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"5f5a92ab6d849455a2a5984d6e7a233957e6ca10","unresolved":false,"context_lines":[{"line_number":37,"context_line":"glance_default_store: swift"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"## SSL Settings"},{"line_number":40,"context_line":"keystone_service_publicuri_proto: \"https\""},{"line_number":41,"context_line":"ssl_protocol: \"ALL -SSLv2 -SSLv3\""},{"line_number":42,"context_line":"# Cipher suite string from https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/"},{"line_number":43,"context_line":"ssl_cipher_suite: \"ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS\""}],"source_content_type":"text/x-jinja2","patch_set":21,"id":"5a18252c_6be31734","line":40,"range":{"start_line":40,"start_character":0,"end_line":40,"end_character":41},"updated":"2016-04-13 09:37:18.000000000","message":"This only enabled https for Keystone. None of the other services have been enabled for SSL.\n\nAll service protocols are supposed to key off from https://github.com/openstack/openstack-ansible/blob/master/playbooks/inventory/group_vars/hosts.yml#L97-L100 - but inspection of the the use of those vars shows that we have inconsistencies and they won\u0027t be appropriately applied to all endpoints.\n\nIf this patch wants to set the public endpoints for all services to be HTTPS by default, then there is quite a bit missing.","commit_id":"cb9ed9392fdb5ce817b70ffe49352684673c6b9d"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"94624c2bd106707e19917606bbc5c396ca7db30e","unresolved":false,"context_lines":[{"line_number":37,"context_line":"glance_default_store: swift"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"## SSL Settings"},{"line_number":40,"context_line":"keystone_service_publicuri_proto: \"https\""},{"line_number":41,"context_line":"ssl_protocol: \"ALL -SSLv2 -SSLv3\""},{"line_number":42,"context_line":"# Cipher suite string from https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/"},{"line_number":43,"context_line":"ssl_cipher_suite: \"ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS\""}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"1a122d0e_b9a037a7","line":40,"range":{"start_line":40,"start_character":0,"end_line":40,"end_character":41},"updated":"2016-04-15 10:12:24.000000000","message":"I think that this is now redundant based on the group_vars change.","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"050a994cc1d0a30ecf1183f2d50ac93f9828891b","unresolved":false,"context_lines":[{"line_number":37,"context_line":"glance_default_store: swift"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"## SSL Settings"},{"line_number":40,"context_line":"keystone_service_publicuri_proto: \"https\""},{"line_number":41,"context_line":"ssl_protocol: \"ALL -SSLv2 -SSLv3\""},{"line_number":42,"context_line":"# Cipher suite string from https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/"},{"line_number":43,"context_line":"ssl_cipher_suite: \"ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS\""}],"source_content_type":"text/x-jinja2","patch_set":26,"id":"1a122d0e_86318fef","line":40,"range":{"start_line":40,"start_character":0,"end_line":40,"end_character":41},"in_reply_to":"1a122d0e_b9a037a7","updated":"2016-04-15 14:41:37.000000000","message":"yes this should be removed.","commit_id":"67017d9f55f210403cade5494b07a53d9bc24dce"}]}