)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":23811,"name":"Oliver Walsh","email":"owalsh@redhat.com","username":"owalsh"},"change_message_id":"f0d22e81d72f36044966f4146136cef9f9dce6fd","unresolved":true,"context_lines":[{"line_number":4,"context_line":"Commit:     Martin Schuppert \u003cmschuppert@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2021-06-06 11:18:19 +0200"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"[victoria/ussuri/train] Change nbd, vnc and qemu default cacert file"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"InternalTLSNbdCAFile, InternalTLSVncCAFile and InternalTLSQemuCAFile"},{"line_number":10,"context_line":"do not point to the default IPA ca.crt file and instead are requested"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"14f909a6_052aafa7","line":7,"range":{"start_line":7,"start_character":24,"end_line":7,"end_character":68},"updated":"2021-06-11 10:16:56.000000000","message":"Is that going to cause problems during update/upgrade?","commit_id":"58fffd51b38f0445fadf0d8736ba2218e0b5dd87"},{"author":{"_account_id":17216,"name":"Martin Schuppert","email":"mschuppert@redhat.com","username":"mcschupp"},"change_message_id":"e92d2b3c3dda411c2e7ddef45ec6df1b272d2ed4","unresolved":true,"context_lines":[{"line_number":4,"context_line":"Commit:     Martin Schuppert \u003cmschuppert@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2021-06-06 11:18:19 +0200"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"[victoria/ussuri/train] Change nbd, vnc and qemu default cacert file"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"InternalTLSNbdCAFile, InternalTLSVncCAFile and InternalTLSQemuCAFile"},{"line_number":10,"context_line":"do not point to the default IPA ca.crt file and instead are requested"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"3de8de1e_e9b258e9","line":7,"range":{"start_line":7,"start_character":24,"end_line":7,"end_character":68},"in_reply_to":"14f909a6_052aafa7","updated":"2021-06-11 10:40:29.000000000","message":"the ca itself won\u0027t change. it is just a different CA file location which gets bind mounted into the containers. if someone for whatever reason has specified a custom InternalTLSNbdCAFile, InternalTLSVncCAFile or InternalTLSQemuCAFile location we\u0027d still use it. so it should not break updates.","commit_id":"58fffd51b38f0445fadf0d8736ba2218e0b5dd87"}],"deployment/nova/nova-vnc-proxy-container-puppet.yaml":[{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"ef982fd254d3c2ce4e160c2025e5faeb0fe19422","unresolved":true,"context_lines":[{"line_number":117,"context_line":"      - {get_param: UseTLSTransportForVnc}"},{"line_number":118,"context_line":"      - true"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"  libvirt_vnc_specific_ca_unset:"},{"line_number":121,"context_line":"    equals:"},{"line_number":122,"context_line":"      - {get_param: LibvirtVncCACert}"},{"line_number":123,"context_line":"      - \u0027\u0027"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"  libvirt_vnc_ca_non_default: {not: {equals: [{get_param: InternalTLSVncProxyCAFile}, \u0027/etc/ipa/ca.crt\u0027]}}"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"  proxy_ssl_ciphers_unset:"},{"line_number":128,"context_line":"    equals:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3b407507_ac20acc9","line":125,"range":{"start_line":120,"start_character":2,"end_line":125,"end_character":1},"updated":"2021-06-11 15:59:51.000000000","message":"So, I understand what you\u0027re doing here in that we can avoid passing the cacert parameter to certmonger if we\u0027re using the default in any case - and avoid the problem altogether.\n\nBut I wonder if we can simplify further.  Is there a need for two different parameters - LibvirtVncCACert and InternalTLSVncProxyCAFile ?  Does the deployment make sense when these are different, given that LibvirtVncCACert defaults to InternalTLSVncProxyCAFile when not set?\n\nIs it the case that LibvirtVncCACert is supposed to be used for the public interfaces and InternalTLSVncProxyCAFile for internal ones?","commit_id":"d54d63285db71cdca4da943094b219bc560286ab"},{"author":{"_account_id":17216,"name":"Martin Schuppert","email":"mschuppert@redhat.com","username":"mcschupp"},"change_message_id":"fb47245555dc5ee8298e3041404a9f851ada23cd","unresolved":true,"context_lines":[{"line_number":117,"context_line":"      - {get_param: UseTLSTransportForVnc}"},{"line_number":118,"context_line":"      - true"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"  libvirt_vnc_specific_ca_unset:"},{"line_number":121,"context_line":"    equals:"},{"line_number":122,"context_line":"      - {get_param: LibvirtVncCACert}"},{"line_number":123,"context_line":"      - \u0027\u0027"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"  libvirt_vnc_ca_non_default: {not: {equals: [{get_param: InternalTLSVncProxyCAFile}, \u0027/etc/ipa/ca.crt\u0027]}}"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"  proxy_ssl_ciphers_unset:"},{"line_number":128,"context_line":"    equals:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"80204517_afcb68f8","line":125,"range":{"start_line":120,"start_character":2,"end_line":125,"end_character":1},"in_reply_to":"3b407507_ac20acc9","updated":"2021-06-14 05:41:56.000000000","message":"This patch is to address the default CA change for the existing releases where we manage the certs via puppet. Therefore my idea was to only do the necessary changes to have the new default and keep the other parameters as we likely can not just remove them?\n\nTo simplify the qemu/libvirt certs for the releases where we manage them in ansible I submitted\nhttps://review.opendev.org/c/openstack/tripleo-heat-templates/+/789718 . If we agree that we can backport a version of this to the previous releases with removing parameters I can work on that, what do you think?","commit_id":"d54d63285db71cdca4da943094b219bc560286ab"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"0d3543f927f2a0bbb4d4f527d0e015cfc7a8da1d","unresolved":true,"context_lines":[{"line_number":117,"context_line":"      - {get_param: UseTLSTransportForVnc}"},{"line_number":118,"context_line":"      - true"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"  libvirt_vnc_specific_ca_unset:"},{"line_number":121,"context_line":"    equals:"},{"line_number":122,"context_line":"      - {get_param: LibvirtVncCACert}"},{"line_number":123,"context_line":"      - \u0027\u0027"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"  libvirt_vnc_ca_non_default: {not: {equals: [{get_param: InternalTLSVncProxyCAFile}, \u0027/etc/ipa/ca.crt\u0027]}}"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"  proxy_ssl_ciphers_unset:"},{"line_number":128,"context_line":"    equals:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"f69c5265_9f32fa19","line":125,"range":{"start_line":120,"start_character":2,"end_line":125,"end_character":1},"in_reply_to":"80204517_afcb68f8","updated":"2021-06-14 17:22:17.000000000","message":"Ok, sounds reasonable to do any the necessary for old releases just in case.  I think we definitely should consider removing parameters for wallaby.","commit_id":"d54d63285db71cdca4da943094b219bc560286ab"},{"author":{"_account_id":17216,"name":"Martin Schuppert","email":"mschuppert@redhat.com","username":"mcschupp"},"change_message_id":"33daa6395f13d443008fff89207ff491dcbb6fcf","unresolved":true,"context_lines":[{"line_number":117,"context_line":"      - {get_param: UseTLSTransportForVnc}"},{"line_number":118,"context_line":"      - true"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"  libvirt_vnc_specific_ca_unset:"},{"line_number":121,"context_line":"    equals:"},{"line_number":122,"context_line":"      - {get_param: LibvirtVncCACert}"},{"line_number":123,"context_line":"      - \u0027\u0027"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"  libvirt_vnc_ca_non_default: {not: {equals: [{get_param: InternalTLSVncProxyCAFile}, \u0027/etc/ipa/ca.crt\u0027]}}"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"  proxy_ssl_ciphers_unset:"},{"line_number":128,"context_line":"    equals:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"f0837347_c89d495c","line":125,"range":{"start_line":120,"start_character":2,"end_line":125,"end_character":1},"in_reply_to":"f69c5265_9f32fa19","updated":"2021-06-15 07:02:10.000000000","message":"thanks, sure, if you have time, please have a look at https://review.opendev.org/c/openstack/tripleo-heat-templates/+/789718","commit_id":"d54d63285db71cdca4da943094b219bc560286ab"}],"releasenotes/notes/nova_libvirt_default_ca_cert-d1a7acaa5cbc9293.yaml":[{"author":{"_account_id":23811,"name":"Oliver Walsh","email":"owalsh@redhat.com","username":"owalsh"},"change_message_id":"f0d22e81d72f36044966f4146136cef9f9dce6fd","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    InternalTLSNbdCAFile, InternalTLSVncCAFile and InternalTLSQemuCAFile"},{"line_number":5,"context_line":"    do not point to the default IPA ca.crt file and instead are requested"},{"line_number":6,"context_line":"    to be loaded to component specific CA files (even if they are the same)."},{"line_number":7,"context_line":"    This can lead to a race where the CA cert is not being written by"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"661d74f8_4abfad78","line":4,"updated":"2021-06-11 10:16:56.000000000","message":"Does the reno need all that detail? A sentence/paragraph explaining that the param defaults are changing to workaround the certmonger issue would be fine I think.","commit_id":"58fffd51b38f0445fadf0d8736ba2218e0b5dd87"},{"author":{"_account_id":17216,"name":"Martin Schuppert","email":"mschuppert@redhat.com","username":"mcschupp"},"change_message_id":"e92d2b3c3dda411c2e7ddef45ec6df1b272d2ed4","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    InternalTLSNbdCAFile, InternalTLSVncCAFile and InternalTLSQemuCAFile"},{"line_number":5,"context_line":"    do not point to the default IPA ca.crt file and instead are requested"},{"line_number":6,"context_line":"    to be loaded to component specific CA files (even if they are the same)."},{"line_number":7,"context_line":"    This can lead to a race where the CA cert is not being written by"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"abef442e_f469701b","line":4,"in_reply_to":"661d74f8_4abfad78","updated":"2021-06-11 10:40:29.000000000","message":"ack, removed most of the details","commit_id":"58fffd51b38f0445fadf0d8736ba2218e0b5dd87"}]}