)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":33594,"name":"Thales Elero Cervi","display_name":"Thales Cervi","email":"thaleselero.cervi@windriver.com","username":"tcervi"},"change_message_id":"e872a2f51124a4f1e3c82bcbea0243e67e7019b2","unresolved":true,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This by itself was not sufficiente to solve the [2] issue. For that,"},{"line_number":26,"context_line":"the patch 0005 for openstack-helm [3] had to be udpated to include"},{"line_number":27,"context_line":"the public endpoint configuration for ALL endpoints. The way this patch"},{"line_number":28,"context_line":"was written, the admin endpoint would remain as HTTP even if HTTPS was"},{"line_number":29,"context_line":"configured."},{"line_number":30,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"51e17bcb_912559d0","line":27,"updated":"2024-09-26 15:22:59.000000000","message":"Just to understand better: \nThe patch is updating Keystone public endpoint, right?\nOther services public endpoints were already being properly configured with old code, correct?","commit_id":"f73fcbd083af6b09479c2849fee2b08c32e4133b"},{"author":{"_account_id":34455,"name":"Lucas de Ataides Barreto","display_name":"Lucas de Ataides","email":"lucas.deataidesbarreto@windriver.com","username":"lucasdeataides"},"change_message_id":"1b61e3b190824ac9c13f55adb1c15fdc86f3866c","unresolved":true,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This by itself was not sufficiente to solve the [2] issue. For that,"},{"line_number":26,"context_line":"the patch 0005 for openstack-helm [3] had to be udpated to include"},{"line_number":27,"context_line":"the public endpoint configuration for ALL endpoints. The way this patch"},{"line_number":28,"context_line":"was written, the admin endpoint would remain as HTTP even if HTTPS was"},{"line_number":29,"context_line":"configured."},{"line_number":30,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"8d9429fa_9694b429","line":27,"in_reply_to":"51e17bcb_912559d0","updated":"2024-09-26 15:37:44.000000000","message":"It\u0027s actually updating the admin endpoint of Keystone.\n\nI don\u0027t know the reason why this was done for this endpoint alone, as the patch doesn\u0027t have any explanation, but, when the application was configured with the certificates, all endpoints were configured as HTTPS, except for the Keystone admin one, which I see as a security flaw, since the user wants to use the certificates, doesn\u0027t make sense to have an HTTP endpoint.\n\nAll others endpoints were configured as HTTPS as intended.","commit_id":"f73fcbd083af6b09479c2849fee2b08c32e4133b"},{"author":{"_account_id":34455,"name":"Lucas de Ataides Barreto","display_name":"Lucas de Ataides","email":"lucas.deataidesbarreto@windriver.com","username":"lucasdeataides"},"change_message_id":"ac0019d7cbc44d6bb035193429ef8c17b137f948","unresolved":true,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This by itself was not sufficiente to solve the [2] issue. For that,"},{"line_number":26,"context_line":"the patch 0005 for openstack-helm [3] had to be udpated to include"},{"line_number":27,"context_line":"the public endpoint configuration for ALL endpoints. The way this patch"},{"line_number":28,"context_line":"was written, the admin endpoint would remain as HTTP even if HTTPS was"},{"line_number":29,"context_line":"configured."},{"line_number":30,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"76175615_b92a8e2d","line":27,"in_reply_to":"699cbe45_02d8f669","updated":"2024-09-26 16:31:44.000000000","message":"Reworded to make it clear that the change is specific to the Keystone admin endpoint. Also mentioned that it was a security issue leaving it the way it was.","commit_id":"f73fcbd083af6b09479c2849fee2b08c32e4133b"},{"author":{"_account_id":33594,"name":"Thales Elero Cervi","display_name":"Thales Cervi","email":"thaleselero.cervi@windriver.com","username":"tcervi"},"change_message_id":"2510ba4975f1e8c7cae2729ca8d862f54843917e","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This by itself was not sufficiente to solve the [2] issue. For that,"},{"line_number":26,"context_line":"the patch 0005 for openstack-helm [3] had to be udpated to include"},{"line_number":27,"context_line":"the public endpoint configuration for ALL endpoints. The way this patch"},{"line_number":28,"context_line":"was written, the admin endpoint would remain as HTTP even if HTTPS was"},{"line_number":29,"context_line":"configured."},{"line_number":30,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"29c2f70e_8e5b030a","line":27,"in_reply_to":"76175615_b92a8e2d","updated":"2024-09-26 16:47:55.000000000","message":"Done","commit_id":"f73fcbd083af6b09479c2849fee2b08c32e4133b"},{"author":{"_account_id":33594,"name":"Thales Elero Cervi","display_name":"Thales Cervi","email":"thaleselero.cervi@windriver.com","username":"tcervi"},"change_message_id":"ad268be2dd91e6c458cb73d9e6cea1813dc59eee","unresolved":true,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This by itself was not sufficiente to solve the [2] issue. For that,"},{"line_number":26,"context_line":"the patch 0005 for openstack-helm [3] had to be udpated to include"},{"line_number":27,"context_line":"the public endpoint configuration for ALL endpoints. The way this patch"},{"line_number":28,"context_line":"was written, the admin endpoint would remain as HTTP even if HTTPS was"},{"line_number":29,"context_line":"configured."},{"line_number":30,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"699cbe45_02d8f669","line":27,"in_reply_to":"8d9429fa_9694b429","updated":"2024-09-26 15:43:56.000000000","message":"Got it. The \"udpated to include the public endpoint configuration for ALL endpoints\" sentence made me think that the patch would update ALL public eps.\n\nMight worth a nit for re-wording?","commit_id":"f73fcbd083af6b09479c2849fee2b08c32e4133b"},{"author":{"_account_id":33594,"name":"Thales Elero Cervi","display_name":"Thales Cervi","email":"thaleselero.cervi@windriver.com","username":"tcervi"},"change_message_id":"e872a2f51124a4f1e3c82bcbea0243e67e7019b2","unresolved":true,"context_lines":[{"line_number":62,"context_line":""},{"line_number":63,"context_line":"  Applying the TLS / FQDN configuration after the first apply:"},{"line_number":64,"context_line":"    Using system commands:"},{"line_number":65,"context_line":"    - FAIL: Using the `system os-certificate-install` and"},{"line_number":66,"context_line":"            `system ca-certificate-install` commands, apply HTTPS and"},{"line_number":67,"context_line":"            reapply the STX-Openstack application. Verify all"},{"line_number":68,"context_line":"            communications are done via HTTPS"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"f44aa6f8_3d6e627e","line":65,"updated":"2024-09-26 15:22:59.000000000","message":"Stating FAIL here might lead to misunderstandings.\nReading what is documented in [4] I understand that the update of endpoints with new URLs takes some time, but it happens, right?\n\nIf so, I would change this to PASS and include an * or a note pointing to the documentation input and the scenario explanation.","commit_id":"f73fcbd083af6b09479c2849fee2b08c32e4133b"},{"author":{"_account_id":34455,"name":"Lucas de Ataides Barreto","display_name":"Lucas de Ataides","email":"lucas.deataidesbarreto@windriver.com","username":"lucasdeataides"},"change_message_id":"1b61e3b190824ac9c13f55adb1c15fdc86f3866c","unresolved":false,"context_lines":[{"line_number":62,"context_line":""},{"line_number":63,"context_line":"  Applying the TLS / FQDN configuration after the first apply:"},{"line_number":64,"context_line":"    Using system commands:"},{"line_number":65,"context_line":"    - FAIL: Using the `system os-certificate-install` and"},{"line_number":66,"context_line":"            `system ca-certificate-install` commands, apply HTTPS and"},{"line_number":67,"context_line":"            reapply the STX-Openstack application. Verify all"},{"line_number":68,"context_line":"            communications are done via HTTPS"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"e0470dbb_4e3d1cd5","line":65,"in_reply_to":"f44aa6f8_3d6e627e","updated":"2024-09-26 15:37:44.000000000","message":"Updated in latest patchset","commit_id":"f73fcbd083af6b09479c2849fee2b08c32e4133b"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":33594,"name":"Thales Elero Cervi","display_name":"Thales Cervi","email":"thaleselero.cervi@windriver.com","username":"tcervi"},"change_message_id":"e872a2f51124a4f1e3c82bcbea0243e67e7019b2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":13,"id":"59ae16ef_14a0cc5b","updated":"2024-09-26 15:22:59.000000000","message":"Thanks, Lucas!\nOverall looks good. Waiting on answers for my comments before bumping my CR+2","commit_id":"f73fcbd083af6b09479c2849fee2b08c32e4133b"},{"author":{"_account_id":33594,"name":"Thales Elero Cervi","display_name":"Thales Cervi","email":"thaleselero.cervi@windriver.com","username":"tcervi"},"change_message_id":"2510ba4975f1e8c7cae2729ca8d862f54843917e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":15,"id":"96b7884b_64fedda3","updated":"2024-09-26 16:47:55.000000000","message":"Thanks, Lucas!","commit_id":"4c79b9bc53f0e87f27f3f0ca216e2e68abb7f850"}],"python3-k8sapp-openstack/k8sapp_openstack/k8sapp_openstack/helm/openstack.py":[{"author":{"_account_id":33594,"name":"Thales Elero Cervi","display_name":"Thales Cervi","email":"thaleselero.cervi@windriver.com","username":"tcervi"},"change_message_id":"e872a2f51124a4f1e3c82bcbea0243e67e7019b2","unresolved":true,"context_lines":[{"line_number":299,"context_line":""},{"line_number":300,"context_line":"    def _get_endpoint_public_tls(self):"},{"line_number":301,"context_line":"        overrides \u003d {}"},{"line_number":302,"context_line":"        if (os.path.exists(constants.OPENSTACK_CERT_FILE) and"},{"line_number":303,"context_line":"                os.path.exists(constants.OPENSTACK_CERT_KEY_FILE)):"},{"line_number":304,"context_line":"            overrides.update({"},{"line_number":305,"context_line":"                \u0027crt\u0027: self._get_file_content(constants.OPENSTACK_CERT_FILE),"}],"source_content_type":"text/x-python","patch_set":13,"id":"dc51b646_b5507739","side":"PARENT","line":302,"updated":"2024-09-26 15:22:59.000000000","message":"Can these constants be safely removed from sysinv code now that our plugin does not use it anymore?","commit_id":"693bf136bd88c9b508a28572d22c0021fa06a52d"},{"author":{"_account_id":33594,"name":"Thales Elero Cervi","display_name":"Thales Cervi","email":"thaleselero.cervi@windriver.com","username":"tcervi"},"change_message_id":"ad268be2dd91e6c458cb73d9e6cea1813dc59eee","unresolved":false,"context_lines":[{"line_number":299,"context_line":""},{"line_number":300,"context_line":"    def _get_endpoint_public_tls(self):"},{"line_number":301,"context_line":"        overrides \u003d {}"},{"line_number":302,"context_line":"        if (os.path.exists(constants.OPENSTACK_CERT_FILE) and"},{"line_number":303,"context_line":"                os.path.exists(constants.OPENSTACK_CERT_KEY_FILE)):"},{"line_number":304,"context_line":"            overrides.update({"},{"line_number":305,"context_line":"                \u0027crt\u0027: self._get_file_content(constants.OPENSTACK_CERT_FILE),"}],"source_content_type":"text/x-python","patch_set":13,"id":"1d41e252_efbf676a","side":"PARENT","line":302,"in_reply_to":"3d866d3d_b34f785f","updated":"2024-09-26 15:43:56.000000000","message":"Well pointed! Sounds reasonable","commit_id":"693bf136bd88c9b508a28572d22c0021fa06a52d"},{"author":{"_account_id":34455,"name":"Lucas de Ataides Barreto","display_name":"Lucas de Ataides","email":"lucas.deataidesbarreto@windriver.com","username":"lucasdeataides"},"change_message_id":"1b61e3b190824ac9c13f55adb1c15fdc86f3866c","unresolved":true,"context_lines":[{"line_number":299,"context_line":""},{"line_number":300,"context_line":"    def _get_endpoint_public_tls(self):"},{"line_number":301,"context_line":"        overrides \u003d {}"},{"line_number":302,"context_line":"        if (os.path.exists(constants.OPENSTACK_CERT_FILE) and"},{"line_number":303,"context_line":"                os.path.exists(constants.OPENSTACK_CERT_KEY_FILE)):"},{"line_number":304,"context_line":"            overrides.update({"},{"line_number":305,"context_line":"                \u0027crt\u0027: self._get_file_content(constants.OPENSTACK_CERT_FILE),"}],"source_content_type":"text/x-python","patch_set":13,"id":"3d866d3d_b34f785f","side":"PARENT","line":302,"in_reply_to":"dc51b646_b5507739","updated":"2024-09-26 15:37:44.000000000","message":"They cannot. To maintain backwards compatibility with the current way the certificates are installed, these variables are still used in the utils.py file, in the get_openstack_certificate_files function.\n\nThese constants must still exist, as the user can still configure the certificates via the system commands. This, however, has a deprecation warning that is being documented in [this doc change](https://review.opendev.org/c/starlingx/docs/+/930392).\n\nWe can delete them from sysinv code once we completely deprecate this method.","commit_id":"693bf136bd88c9b508a28572d22c0021fa06a52d"}]}