openstack/kolla-ansible.git/ansible/roles/certificates, branch stable/2026.1

[stable-only] Split CA of ProxySQL internal TLS and backend TLS

2026-07-22T13:15:30+00:00

ProxySQL frontend TLS (database internal TLS) and backend TLS (database backend TLS) expects different CA if users use chain of certificates (e.g. use of intermediate certificates). Frontend TLS expects the intermediate certificate that signed the leaf certificate as a CA file, whereas backend TLS expects root CA. To fix, users are now required to create a file named ``proxysql-ca.pem`` at ``kolla_certificates_dir``, which is a copy of the intermediate certificate. If your system is not affected by this bug, you're not required to create the new file ``proxysql-ca.pem``. Closes-bug: #2150449 Change-Id: I88911badb0d0801f79317df6681c571cc1c8cfee Signed-off-by: Seunghun Lee

ansible-lint: Fix fqcn[actions-core] for certificates

2026-03-20T06:43:13+00:00

Change-Id: Ic6898059cb87d76ca5834ca4d3716fff85ca3955 Signed-off-by: Michal Nasiadka

certificates: rework to use Ansible modules

2025-12-19T12:31:40+00:00

Add keyCertSign and digitalSignature key_usage required by Python 3.13 [1] [1]: https://github.com/canonical/microk8s/issues/4864 Change-Id: Ia0c55ed6137b0ccd16815f9f7a49b3b30a982154 Signed-off-by: Michal Nasiadka

ansible-lint: fix unnamed-task in certificates

2025-12-10T21:19:48+00:00

Change-Id: Ia2788b115dc28d842e6a4cd31eec098913d29805 Signed-off-by: Bertrand Lanson

ansible-lint: Fix risky-*

2025-12-04T08:19:16+00:00

Change-Id: I3914252b2d884349b9744d229406cf49d691ebec Signed-off-by: Michal Nasiadka

ansible-lint: Fix yaml[truthy] in certificates role

2025-11-22T06:07:56+00:00

Change-Id: I360c570ba9dc1a7c8324dc53145e3da8c818c738 Signed-off-by: Michal Nasiadka

ansible-lint: Remove key-order[task] exclude

2025-11-17T10:53:10+00:00

Change-Id: I77cce57f3f2b05455e8bd4e7093081ef4ed25d59 Signed-off-by: Michal Nasiadka

Fix TLS settings when letsencrypt turned on

2024-11-25T19:07:01+00:00

- Introduced `letsencrypt_managed_certs` variable to handle whether letsencrypt will generate internal, external or both certificates. - Updated certificate generation logic to use `letsencrypt_managed_certs` conditionally, replacing the previous `enable_letsencrypt` boolean. - Adjusted tasks and templates to support internal/external certificate management based on the new variable. - Enhanced Let's Encrypt script (`letsencrypt-lego-run.sh.j2`) to handle both internal and external certificates depending on VIP configurations. - Refined HAProxy configuration templates to correctly map certificates based on TLS settings and new management logic. Closes-bug: #2076331 Change-Id: Id80c7823fcc5d934b7369c7c0722cd78188e2ccf Co-Authored-By: Michal Arbet

Add frontend TLS ability to ProxySQL

2024-10-25T19:42:50+00:00

This patch ads an ability to receive TLS connections to ProxySQL. Certificates and variable lookups are added in order for TLS to be enabled by _database_internal_tls_enable. Note that in order for this to work, mysql connection strings need to have TLS enabled, which can be added in separate per-service patches Change-Id: I2c06ce5e138f52259c1725dae37f25c1b00d1e6b

Add backend TLS between MariaDB and ProxySQL

2024-10-25T14:38:39+00:00

This commit adds TLS connection between ProxySQL and MariaDB. Frontend TLS ( between services and ProxySQL) will be added in another commit. Parialy Implements: mariadb-ssl-support Change-Id: I154cbb096469c5515c9d8156c2c1c5dd07b95849 Signed-off-by: Matus Jenca