)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"99a44784511dbf353c286cfc58e96c0c2b764e7a","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"8cde87f7_169011a5","updated":"2023-03-04 22:58:34.000000000","message":"umm, I have no idea what is going on there.\n\npip does not when repo is available under https...\n\nhttps://paste.openstack.org/show/b0VxAFrGEGcxbldvYUqC/\n\npip does not use the system certificate store but, instead, it uses a bundled CA certificate store from certifi.\nbut it does provide option to specify \u0027--trusted-host\u0027. Unfortunately it doesn\u0027t help.\n\nI didn\u0027t have more time before my vacation to look further into this.\n","commit_id":"695ca5b97e2418656053946d08cc65ed2d895094"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"25dc800237c6cb359ae5f80246ab8ae3e2d07caf","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"7816536b_bc178164","updated":"2023-03-14 22:40:18.000000000","message":"recheck - verify if  https://review.opendev.org/c/openstack/openstack-ansible-repo_server/+/877429 fixes the issue","commit_id":"4ba0546c638f2e995081f6595bcd7b3532987135"},{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"8e36a01c0a4b7debd1eb5dacbed55ba5b0407ebe","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"a0b5d1db_20940b84","updated":"2023-03-16 08:58:52.000000000","message":"we discussed in the openstack-ansible meeting making the changes to enable TLS in the backends as follow-up patches to those splitting the haproxy service config into the group_vars\n\nthis change is not part of the spec/blueprint so should be rebased on top of the separated-haproxy-service-config patches and ideally put in it\u0027s own topic.","commit_id":"f553421bf3abad6509801da1da2782e79e2fc89d"},{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"75f231d56a879374190b16b56231bcb4191ce57a","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"e17549a9_891358cf","in_reply_to":"300f5bb0_0d54030f","updated":"2023-03-16 10:30:20.000000000","message":"sorry my mistake - this is indeed for the frontend.\n\ni have taken the stepca patches out of the separated-haproxy-service-config topic but i believe they are necessary to have automated confidence that the changes in separated-haproxy-service-config are not breaking the current support for acme which had no test coverage at all. we can now test that before, and after any changes to the haproxy vars are made.","commit_id":"f553421bf3abad6509801da1da2782e79e2fc89d"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"d50f02876aaa2b5a8a3054bb8630a16870676ddb","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":5,"id":"300f5bb0_0d54030f","in_reply_to":"a0b5d1db_20940b84","updated":"2023-03-16 10:15:11.000000000","message":"but this patch does not enable TLS for backend as you said. It allows to enable TLS for frontend which wasn\u0027t possible before.\n\nadding a stepca is also not a part of spec/blueprint but you have placed it under \t\nseparated-haproxy-service-config tag and this chain.\n\nthis change is required to merge #876429 from tls-backend tag, that\u0027s why i thought it\u0027s reasonable to put it in this relation chain, especially because it changes inventory/group_vars/haproxy/haproxy.yml so you can easily avoid merge conflicts.\n\ndoes it make sense now or you still want me to kick it out of this relation chain?","commit_id":"f553421bf3abad6509801da1da2782e79e2fc89d"},{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"d6704cc91eaa137b4b2e8f065c0612d9de8ca452","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"7c17fe39_eba358f0","in_reply_to":"e17549a9_891358cf","updated":"2023-04-04 10:15:39.000000000","message":"Done","commit_id":"f553421bf3abad6509801da1da2782e79e2fc89d"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"9d42be5d4aabd7c0593c1d6e3faea28c21e59a94","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"f1e3a791_e8c3fe0a","updated":"2023-03-21 16:17:26.000000000","message":"recheck upgrade jobs","commit_id":"affea278dd23ef34afe818369c15f22540b36ea5"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"394e23eca759064a0110d148441c1712c433648c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":10,"id":"b146e621_13be787f","updated":"2023-04-03 20:29:08.000000000","message":"recheck - gating should be unblocked now","commit_id":"bfca7fa72d60b3cf21950f6913c11f1f30691190"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"708630b731684d002397e8102e2bb79f9b5198d6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":11,"id":"6abbd672_9fef81eb","updated":"2023-04-07 16:04:49.000000000","message":"recheck - gates should be working now","commit_id":"7b1a2b7c57731229540c8f883f92b89bbc162657"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"b9214ecb06cb235c1f303c1fcbf6cfde2c925f58","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":12,"id":"15ae917c_b9cac929","updated":"2023-04-10 08:46:33.000000000","message":"recheck ubuntu ceph scenario","commit_id":"f600f995e4105ff7ddfe4d9ca2d7984bb2d80cbb"}],"playbooks/defaults/source_install.yml":[{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"096535b96b317f29e4f760e5857fb0ee06e0df06","unresolved":true,"context_lines":[{"line_number":22,"context_line":"repo_release_path: \"{{ openstack_repo_url }}/os-releases/{{ openstack_release }}/{{ os_distro_version }}\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"## OpenStack source options"},{"line_number":25,"context_line":"openstack_repo_protocol: \"{{ haproxy_ssl_all_vips | default(False) | ternary(\u0027https\u0027, \u0027http\u0027) }}\""},{"line_number":26,"context_line":"openstack_repo_url: \"{{ openstack_repo_protocol }}://{{ internal_lb_vip_address }}:{{ repo_server_port }}\""},{"line_number":27,"context_line":"openstack_repo_git_url: \"git://{{ internal_lb_vip_address }}\""},{"line_number":28,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":10,"id":"824ecefd_2f3949b3","line":25,"range":{"start_line":25,"start_character":29,"end_line":25,"end_character":93},"updated":"2023-03-31 11:38:47.000000000","message":"let\u0027s maybe use `openstack_service_internaluri_proto` instead?","commit_id":"bfca7fa72d60b3cf21950f6913c11f1f30691190"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"a5b484fb5988bbafdeeb3aa02082b19271527759","unresolved":true,"context_lines":[{"line_number":22,"context_line":"repo_release_path: \"{{ openstack_repo_url }}/os-releases/{{ openstack_release }}/{{ os_distro_version }}\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"## OpenStack source options"},{"line_number":25,"context_line":"openstack_repo_protocol: \"{{ haproxy_ssl_all_vips | default(False) | ternary(\u0027https\u0027, \u0027http\u0027) }}\""},{"line_number":26,"context_line":"openstack_repo_url: \"{{ openstack_repo_protocol }}://{{ internal_lb_vip_address }}:{{ repo_server_port }}\""},{"line_number":27,"context_line":"openstack_repo_git_url: \"git://{{ internal_lb_vip_address }}\""},{"line_number":28,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":10,"id":"d912505a_356d0785","line":25,"range":{"start_line":25,"start_character":29,"end_line":25,"end_character":93},"in_reply_to":"0b87589c_92177f29","updated":"2023-04-04 14:06:44.000000000","message":"I think my biggest concern that its a bit weird to relate to `haproxy_ssl_all_vips` here, as this variable is intended to rely specifically to haproxy. So kind of same point you made for `openstack_service`.\n\nEventually `haproxy_ssl_all_vips` is a weird on it\u0027s own, it might be worth to be more specific what we mean under \"all\" and think on how we make config more clear about when to use and when not ssl... Or just always force to use tls :)","commit_id":"bfca7fa72d60b3cf21950f6913c11f1f30691190"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"394e23eca759064a0110d148441c1712c433648c","unresolved":true,"context_lines":[{"line_number":22,"context_line":"repo_release_path: \"{{ openstack_repo_url }}/os-releases/{{ openstack_release }}/{{ os_distro_version }}\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"## OpenStack source options"},{"line_number":25,"context_line":"openstack_repo_protocol: \"{{ haproxy_ssl_all_vips | default(False) | ternary(\u0027https\u0027, \u0027http\u0027) }}\""},{"line_number":26,"context_line":"openstack_repo_url: \"{{ openstack_repo_protocol }}://{{ internal_lb_vip_address }}:{{ repo_server_port }}\""},{"line_number":27,"context_line":"openstack_repo_git_url: \"git://{{ internal_lb_vip_address }}\""},{"line_number":28,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":10,"id":"841dc2a6_006d45e7","line":25,"range":{"start_line":25,"start_character":29,"end_line":25,"end_character":93},"in_reply_to":"824ecefd_2f3949b3","updated":"2023-04-03 20:29:08.000000000","message":"i was thinking about it, but `openstack_service_*` prefix is confusing to me as repo is not an \"openstack service\" itself(it\u0027s not in openstack catalog).\n\nIn general i think that `openstack_service_internaluri_proto` is about something different.\nFor ex. by default `openstack_service_internaluri_proto` is set to \u0027http\u0027 while `haproxy_ssl_all_vips` by default is set to \u0027true\u0027\n\nThat\u0027s why I think using `haproxy_ssl_all_vips` is more reasonable here.","commit_id":"bfca7fa72d60b3cf21950f6913c11f1f30691190"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"21d4d9a929c11aa89ac78468ec7c1c3aadc072ba","unresolved":true,"context_lines":[{"line_number":22,"context_line":"repo_release_path: \"{{ openstack_repo_url }}/os-releases/{{ openstack_release }}/{{ os_distro_version }}\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"## OpenStack source options"},{"line_number":25,"context_line":"openstack_repo_protocol: \"{{ haproxy_ssl_all_vips | default(False) | ternary(\u0027https\u0027, \u0027http\u0027) }}\""},{"line_number":26,"context_line":"openstack_repo_url: \"{{ openstack_repo_protocol }}://{{ internal_lb_vip_address }}:{{ repo_server_port }}\""},{"line_number":27,"context_line":"openstack_repo_git_url: \"git://{{ internal_lb_vip_address }}\""},{"line_number":28,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":10,"id":"0b87589c_92177f29","line":25,"range":{"start_line":25,"start_character":29,"end_line":25,"end_character":93},"in_reply_to":"841dc2a6_006d45e7","updated":"2023-04-03 23:07:53.000000000","message":"disregard second argument about default values, i wrote something stupid.\n\nHowever I think my first point about `openstack_service_*` prefix and service catalog still makes sense.\n\nAdditionally, I started to wonder why we don\u0027t define:\n`openstack_service_internaluri_proto: \"{{ haproxy_ssl_all_vips | default(False) | ternary(\u0027https\u0027, \u0027http\u0027) }}\"` by default since these variables strictly depend on each other. But maybe that\u0027s another topic.","commit_id":"bfca7fa72d60b3cf21950f6913c11f1f30691190"},{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"80a50c8f416c6c940a16a1ab88c17f4d0d8fa0d4","unresolved":true,"context_lines":[{"line_number":22,"context_line":"repo_release_path: \"{{ openstack_repo_url }}/os-releases/{{ openstack_release }}/{{ os_distro_version }}\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"## OpenStack source options"},{"line_number":25,"context_line":"openstack_repo_protocol: \"{{ haproxy_ssl_all_vips | default(False) | ternary(\u0027https\u0027, \u0027http\u0027) }}\""},{"line_number":26,"context_line":"openstack_repo_url: \"{{ openstack_repo_protocol }}://{{ internal_lb_vip_address }}:{{ repo_server_port }}\""},{"line_number":27,"context_line":"openstack_repo_git_url: \"git://{{ internal_lb_vip_address }}\""},{"line_number":28,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":10,"id":"dab9b357_dce5d3e7","line":25,"range":{"start_line":25,"start_character":29,"end_line":25,"end_character":93},"in_reply_to":"d912505a_356d0785","updated":"2023-04-05 05:40:09.000000000","message":"this is confusing as it\u0027s a variable defined in the haproxy role defaults - can we use something defined more globally?","commit_id":"bfca7fa72d60b3cf21950f6913c11f1f30691190"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"1691b76cd0b5d6b2dfc210bc873bd3c271355bc3","unresolved":true,"context_lines":[{"line_number":22,"context_line":"repo_release_path: \"{{ openstack_repo_url }}/os-releases/{{ openstack_release }}/{{ os_distro_version }}\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"## OpenStack source options"},{"line_number":25,"context_line":"openstack_repo_protocol: \"{{ haproxy_ssl_all_vips | default(False) | ternary(\u0027https\u0027, \u0027http\u0027) }}\""},{"line_number":26,"context_line":"openstack_repo_url: \"{{ openstack_repo_protocol }}://{{ internal_lb_vip_address }}:{{ repo_server_port }}\""},{"line_number":27,"context_line":"openstack_repo_git_url: \"git://{{ internal_lb_vip_address }}\""},{"line_number":28,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":10,"id":"da664cc5_32e04f28","line":25,"range":{"start_line":25,"start_character":29,"end_line":25,"end_character":93},"in_reply_to":"dab9b357_dce5d3e7","updated":"2023-04-06 21:26:27.000000000","message":"ok, i changed it to `openstack_service_internaluri_proto` if you think that\u0027s the better option.","commit_id":"bfca7fa72d60b3cf21950f6913c11f1f30691190"}]}