)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6962,"name":"Kashyap Chamarthy","email":"kchamart@redhat.com","username":"kashyapc"},"change_message_id":"792c976961a16621cf0e4a6b388f3b7331ec644d","unresolved":true,"context_lines":[{"line_number":4,"context_line":"Commit:     David Vallee Delisle \u003cdvd@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2021-04-08 11:59:18 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Missing client certificate"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Live migration fails if we don\u0027t have a client certificate"},{"line_number":10,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"f82e3bc2_ea0d7dff","line":7,"updated":"2021-04-08 16:29:46.000000000","message":"Thanks; the change itself looks good.  But let\u0027s expand the commit message.  Draft text:\n\n[quote]\n\nTLS client verification used to be accidentally disabled in libvirt.  This was fixed in libvirt-6.10.0-1[1].  Which means, once you\u0027re using libvirt-6.10.0-1 or higher, a client certificate is mandatory during live migration with TLS.\n\nIn this case, the server certificate generated by TripleO is valid for client _and_ server:\n\n                 Key Purpose (not critical):\n                         TLS WWW Server.\n                         TLS WWW Client.\n\nSo most deployments can re-use the same certificate for client and server.  Why?  Because if both migration ends points are located on the same infrastructure, it is reasonable to use the same certificate for both client and server roles.\n[/quote]\n\nThanks to DanPB for helping me debug this.\n\n[1] https://bugzilla.redhat.com/show_bug.cgi?id\u003d1879477#c3","commit_id":"4f192f02b63163a89826b743b24e3351b74b146b"},{"author":{"_account_id":27419,"name":"David Vallee Delisle","email":"me@dvd.dev","username":"dvd"},"change_message_id":"c8e3f7b389b9821fa16ed65f4d818ac957405f65","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     David Vallee Delisle \u003cdvd@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2021-04-08 11:59:18 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Missing client certificate"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Live migration fails if we don\u0027t have a client certificate"},{"line_number":10,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"cc6fec4a_b560098f","line":7,"in_reply_to":"f82e3bc2_ea0d7dff","updated":"2021-04-09 02:54:03.000000000","message":"Done","commit_id":"4f192f02b63163a89826b743b24e3351b74b146b"},{"author":{"_account_id":17216,"name":"Martin Schuppert","email":"mschuppert@redhat.com","username":"mcschupp"},"change_message_id":"53c12d0519fc6c8c5495ba48fed14000016a3bd9","unresolved":true,"context_lines":[{"line_number":9,"context_line":"TLS client verification used to be accidentally disabled in libvirt."},{"line_number":10,"context_line":"This was fixed in libvirt-6.10.0-1[1]."},{"line_number":11,"context_line":"Which means, once you\u0027re using libvirt-6.10.0-1 or higher, a client"},{"line_number":12,"context_line":"certificate is mandatory during live migration with TLS."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"In this case, the server certificate generated by TripleO is valid"},{"line_number":15,"context_line":"for client _and_ server:"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"67bdfc00_253b6f81","line":12,"updated":"2021-04-12 06:28:58.000000000","message":"This will break live migration for instances created pre 6.10 where the qemu processes created prio to this change won\u0027t have client certificates, correct? A instance stop/start would be required. Wondering if we need to add a parameter for nbd client cert verification and set it to disabled per default to not break live migration for no new deployments?","commit_id":"ff9d07952f046bc86aa5d62275d05eaa605e3f41"},{"author":{"_account_id":27419,"name":"David Vallee Delisle","email":"me@dvd.dev","username":"dvd"},"change_message_id":"11af083fbd8da1f30e06dd84cd731106bcf6a97f","unresolved":false,"context_lines":[{"line_number":9,"context_line":"TLS client verification used to be accidentally disabled in libvirt."},{"line_number":10,"context_line":"This was fixed in libvirt-6.10.0-1[1]."},{"line_number":11,"context_line":"Which means, once you\u0027re using libvirt-6.10.0-1 or higher, a client"},{"line_number":12,"context_line":"certificate is mandatory during live migration with TLS."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"In this case, the server certificate generated by TripleO is valid"},{"line_number":15,"context_line":"for client _and_ server:"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"770fb6ac_e5028ad0","line":12,"in_reply_to":"67bdfc00_253b6f81","updated":"2021-04-16 14:47:42.000000000","message":"That\u0027s a good assessment and I believe this should be addressed by this related change [1]. We\u0027ll default it to false when we hit the train branch.\n\n[1] https://review.opendev.org/c/openstack/tripleo-heat-templates/+/785962/2","commit_id":"ff9d07952f046bc86aa5d62275d05eaa605e3f41"}],"deployment/nova/nova-libvirt-container-puppet.yaml":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"7c5530cb7c4ecd54d0463667bacabebb6c938b5d","unresolved":true,"context_lines":[{"line_number":645,"context_line":"                      - /etc/pki/qemu/server-key.pem:/etc/pki/qemu/server-key.pem:ro"},{"line_number":646,"context_line":"                      - /etc/pki/qemu/server-cert.pem:/etc/pki/qemu/client-cert.pem:ro"},{"line_number":647,"context_line":"                      - /etc/pki/qemu/server-key.pem:/etc/pki/qemu/client-key.pem:ro"},{"line_number":648,"context_line":"                    - null"},{"line_number":649,"context_line":"                -"},{"line_number":650,"context_line":"                  if:"},{"line_number":651,"context_line":"                    - use_tls_for_vnc"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"5bcacbc1_63ed7215","line":648,"updated":"2021-04-08 16:36:14.000000000","message":"this should be all that needed?\nthat our you ment to change server for client on the left side ot use the ones copied below.","commit_id":"4f192f02b63163a89826b743b24e3351b74b146b"},{"author":{"_account_id":27419,"name":"David Vallee Delisle","email":"me@dvd.dev","username":"dvd"},"change_message_id":"c8e3f7b389b9821fa16ed65f4d818ac957405f65","unresolved":false,"context_lines":[{"line_number":645,"context_line":"                      - /etc/pki/qemu/server-key.pem:/etc/pki/qemu/server-key.pem:ro"},{"line_number":646,"context_line":"                      - /etc/pki/qemu/server-cert.pem:/etc/pki/qemu/client-cert.pem:ro"},{"line_number":647,"context_line":"                      - /etc/pki/qemu/server-key.pem:/etc/pki/qemu/client-key.pem:ro"},{"line_number":648,"context_line":"                    - null"},{"line_number":649,"context_line":"                -"},{"line_number":650,"context_line":"                  if:"},{"line_number":651,"context_line":"                    - use_tls_for_vnc"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"7616ddc8_58eed788","line":648,"in_reply_to":"5bcacbc1_63ed7215","updated":"2021-04-09 02:54:03.000000000","message":"Done","commit_id":"4f192f02b63163a89826b743b24e3351b74b146b"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"7c5530cb7c4ecd54d0463667bacabebb6c938b5d","unresolved":true,"context_lines":[{"line_number":799,"context_line":"                            cp /etc/pki/tls/certs/qemu-server-cert.crt /etc/pki/qemu/server-cert.pem"},{"line_number":800,"context_line":"                            cp /etc/pki/tls/private/qemu-server-cert.key /etc/pki/qemu/server-key.pem"},{"line_number":801,"context_line":"                            cp /etc/pki/tls/certs/qemu-server-cert.crt /etc/pki/qemu/client-cert.pem"},{"line_number":802,"context_line":"                            cp /etc/pki/tls/private/qemu-server-cert.key /etc/pki/qemu/client-key.pem"},{"line_number":803,"context_line":"                            systemctl reload libvirtd"},{"line_number":804,"context_line":"                          key_size:"},{"line_number":805,"context_line":"                            if:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"6012d120_0f677d98","line":802,"updated":"2021-04-08 16:36:14.000000000","message":"you not actully using these though right","commit_id":"4f192f02b63163a89826b743b24e3351b74b146b"},{"author":{"_account_id":27419,"name":"David Vallee Delisle","email":"me@dvd.dev","username":"dvd"},"change_message_id":"c8e3f7b389b9821fa16ed65f4d818ac957405f65","unresolved":true,"context_lines":[{"line_number":799,"context_line":"                            cp /etc/pki/tls/certs/qemu-server-cert.crt /etc/pki/qemu/server-cert.pem"},{"line_number":800,"context_line":"                            cp /etc/pki/tls/private/qemu-server-cert.key /etc/pki/qemu/server-key.pem"},{"line_number":801,"context_line":"                            cp /etc/pki/tls/certs/qemu-server-cert.crt /etc/pki/qemu/client-cert.pem"},{"line_number":802,"context_line":"                            cp /etc/pki/tls/private/qemu-server-cert.key /etc/pki/qemu/client-key.pem"},{"line_number":803,"context_line":"                            systemctl reload libvirtd"},{"line_number":804,"context_line":"                          key_size:"},{"line_number":805,"context_line":"                            if:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"55c64eae_2014017d","line":802,"in_reply_to":"6012d120_0f677d98","updated":"2021-04-09 02:54:03.000000000","message":"Now that I read it all, I realize that you\u0027re totally right. I\u0027ll drop this.","commit_id":"4f192f02b63163a89826b743b24e3351b74b146b"}]}