Fix for overly restrictive permissions on ca-certificates directory

Closes-Bug: #2112280
Change-Id: I52499bdf2b7fc70f91a4c2920749bfef83a79850
Signed-off-by: Rafal Lewandowski <rafal@stackhpc.com>
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
(cherry picked from commit e302bab31f30296f7d6f41c3d46e19cf5668b97a)

135 files changed, 135 insertions, 135 deletions

diff --git a/ansible/roles/aodh/templates/aodh-api.json.j2 b/ansible/roles/aodh/templates/aodh-api.json.j2
index 77fd4604b..1ee6567d8 100644
--- a/ansible/roles/aodh/templates/aodh-api.json.j2
+++ b/ansible/roles/aodh/templates/aodh-api.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/aodh/templates/aodh-evaluator.json.j2 b/ansible/roles/aodh/templates/aodh-evaluator.json.j2
index 24dda5250..307c08be9 100644
--- a/ansible/roles/aodh/templates/aodh-evaluator.json.j2
+++ b/ansible/roles/aodh/templates/aodh-evaluator.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/aodh/templates/aodh-listener.json.j2 b/ansible/roles/aodh/templates/aodh-listener.json.j2
index 44f74cea9..5f3fbf982 100644
--- a/ansible/roles/aodh/templates/aodh-listener.json.j2
+++ b/ansible/roles/aodh/templates/aodh-listener.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/aodh/templates/aodh-notifier.json.j2 b/ansible/roles/aodh/templates/aodh-notifier.json.j2
index dcf23d1eb..e8974c4fb 100644
--- a/ansible/roles/aodh/templates/aodh-notifier.json.j2
+++ b/ansible/roles/aodh/templates/aodh-notifier.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/barbican/templates/barbican-api.json.j2 b/ansible/roles/barbican/templates/barbican-api.json.j2
index ba526f755..d13d6416d 100644
--- a/ansible/roles/barbican/templates/barbican-api.json.j2
+++ b/ansible/roles/barbican/templates/barbican-api.json.j2
@@ -42,7 +42,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/barbican/templates/barbican-keystone-listener.json.j2 b/ansible/roles/barbican/templates/barbican-keystone-listener.json.j2
index 14545da03..6cb8df957 100644
--- a/ansible/roles/barbican/templates/barbican-keystone-listener.json.j2
+++ b/ansible/roles/barbican/templates/barbican-keystone-listener.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/barbican/templates/barbican-worker.json.j2 b/ansible/roles/barbican/templates/barbican-worker.json.j2
index cd540262f..9ff0e9996 100644
--- a/ansible/roles/barbican/templates/barbican-worker.json.j2
+++ b/ansible/roles/barbican/templates/barbican-worker.json.j2
@@ -18,7 +18,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/blazar/templates/blazar-api.json.j2 b/ansible/roles/blazar/templates/blazar-api.json.j2
index 4b120cc13..6509623e2 100644
--- a/ansible/roles/blazar/templates/blazar-api.json.j2
+++ b/ansible/roles/blazar/templates/blazar-api.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/blazar/templates/blazar-manager.json.j2 b/ansible/roles/blazar/templates/blazar-manager.json.j2
index de550dc52..fe71672ed 100644
--- a/ansible/roles/blazar/templates/blazar-manager.json.j2
+++ b/ansible/roles/blazar/templates/blazar-manager.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/ceilometer/templates/ceilometer-central.json.j2 b/ansible/roles/ceilometer/templates/ceilometer-central.json.j2
index dbb2e2dc0..7eddfe606 100644
--- a/ansible/roles/ceilometer/templates/ceilometer-central.json.j2
+++ b/ansible/roles/ceilometer/templates/ceilometer-central.json.j2
@@ -47,7 +47,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/ceilometer/templates/ceilometer-compute.json.j2 b/ansible/roles/ceilometer/templates/ceilometer-compute.json.j2
index b652f7b0b..f98cdfe6e 100644
--- a/ansible/roles/ceilometer/templates/ceilometer-compute.json.j2
+++ b/ansible/roles/ceilometer/templates/ceilometer-compute.json.j2
@@ -41,7 +41,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/ceilometer/templates/ceilometer-ipmi.json.j2 b/ansible/roles/ceilometer/templates/ceilometer-ipmi.json.j2
index fca9dbc48..a187505c8 100644
--- a/ansible/roles/ceilometer/templates/ceilometer-ipmi.json.j2
+++ b/ansible/roles/ceilometer/templates/ceilometer-ipmi.json.j2
@@ -35,7 +35,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/ceilometer/templates/ceilometer-notification.json.j2 b/ansible/roles/ceilometer/templates/ceilometer-notification.json.j2
index 828fcfbe6..9dcffb311 100644
--- a/ansible/roles/ceilometer/templates/ceilometer-notification.json.j2
+++ b/ansible/roles/ceilometer/templates/ceilometer-notification.json.j2
@@ -47,7 +47,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/cinder/templates/cinder-api.json.j2 b/ansible/roles/cinder/templates/cinder-api.json.j2
index 161597c6d..6857ef167 100644
--- a/ansible/roles/cinder/templates/cinder-api.json.j2
+++ b/ansible/roles/cinder/templates/cinder-api.json.j2
@@ -35,7 +35,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/cinder/templates/cinder-backup.json.j2 b/ansible/roles/cinder/templates/cinder-backup.json.j2
index 3022838ef..7e7f551a4 100644
--- a/ansible/roles/cinder/templates/cinder-backup.json.j2
+++ b/ansible/roles/cinder/templates/cinder-backup.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/cinder/templates/cinder-scheduler.json.j2 b/ansible/roles/cinder/templates/cinder-scheduler.json.j2
index dcc5b7fc3..ca02e9d04 100644
--- a/ansible/roles/cinder/templates/cinder-scheduler.json.j2
+++ b/ansible/roles/cinder/templates/cinder-scheduler.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/cinder/templates/cinder-volume.json.j2 b/ansible/roles/cinder/templates/cinder-volume.json.j2
index db17a736e..815458bd8 100644
--- a/ansible/roles/cinder/templates/cinder-volume.json.j2
+++ b/ansible/roles/cinder/templates/cinder-volume.json.j2
@@ -43,7 +43,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/cloudkitty/templates/cloudkitty-api.json.j2 b/ansible/roles/cloudkitty/templates/cloudkitty-api.json.j2
index 2bf756d20..614ee1077 100644
--- a/ansible/roles/cloudkitty/templates/cloudkitty-api.json.j2
+++ b/ansible/roles/cloudkitty/templates/cloudkitty-api.json.j2
@@ -29,7 +29,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/cloudkitty/templates/cloudkitty-processor.json.j2 b/ansible/roles/cloudkitty/templates/cloudkitty-processor.json.j2
index 5366b917b..3d71d0d0f 100644
--- a/ansible/roles/cloudkitty/templates/cloudkitty-processor.json.j2
+++ b/ansible/roles/cloudkitty/templates/cloudkitty-processor.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/common/templates/kolla-toolbox.json.j2 b/ansible/roles/common/templates/kolla-toolbox.json.j2
index bc766febe..366e3586b 100644
--- a/ansible/roles/common/templates/kolla-toolbox.json.j2
+++ b/ansible/roles/common/templates/kolla-toolbox.json.j2
@@ -29,7 +29,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/cron/templates/cron.json.j2 b/ansible/roles/cron/templates/cron.json.j2
index 3c712e8d4..963a41e94 100644
--- a/ansible/roles/cron/templates/cron.json.j2
+++ b/ansible/roles/cron/templates/cron.json.j2
@@ -12,7 +12,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/cyborg/templates/cyborg-agent.json.j2 b/ansible/roles/cyborg/templates/cyborg-agent.json.j2
index 285c61b41..474396311 100644
--- a/ansible/roles/cyborg/templates/cyborg-agent.json.j2
+++ b/ansible/roles/cyborg/templates/cyborg-agent.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/cyborg/templates/cyborg-api.json.j2 b/ansible/roles/cyborg/templates/cyborg-api.json.j2
index cfd8bd56e..34ae85916 100644
--- a/ansible/roles/cyborg/templates/cyborg-api.json.j2
+++ b/ansible/roles/cyborg/templates/cyborg-api.json.j2
@@ -29,7 +29,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/cyborg/templates/cyborg-conductor.json.j2 b/ansible/roles/cyborg/templates/cyborg-conductor.json.j2
index a50a4e699..f205b864f 100644
--- a/ansible/roles/cyborg/templates/cyborg-conductor.json.j2
+++ b/ansible/roles/cyborg/templates/cyborg-conductor.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/designate/templates/designate-api.json.j2 b/ansible/roles/designate/templates/designate-api.json.j2
index a7a45a509..447b61817 100644
--- a/ansible/roles/designate/templates/designate-api.json.j2
+++ b/ansible/roles/designate/templates/designate-api.json.j2
@@ -35,7 +35,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/designate/templates/designate-backend-bind9.json.j2 b/ansible/roles/designate/templates/designate-backend-bind9.json.j2
index bbfad04ae..0e5963220 100644
--- a/ansible/roles/designate/templates/designate-backend-bind9.json.j2
+++ b/ansible/roles/designate/templates/designate-backend-bind9.json.j2
@@ -28,7 +28,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/designate/templates/designate-central.json.j2 b/ansible/roles/designate/templates/designate-central.json.j2
index 3f4f8bd03..a09e4a251 100644
--- a/ansible/roles/designate/templates/designate-central.json.j2
+++ b/ansible/roles/designate/templates/designate-central.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/designate/templates/designate-mdns.json.j2 b/ansible/roles/designate/templates/designate-mdns.json.j2
index 28907c9a0..29bf14f37 100644
--- a/ansible/roles/designate/templates/designate-mdns.json.j2
+++ b/ansible/roles/designate/templates/designate-mdns.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/designate/templates/designate-producer.json.j2 b/ansible/roles/designate/templates/designate-producer.json.j2
index e496a9d65..00f9a6130 100644
--- a/ansible/roles/designate/templates/designate-producer.json.j2
+++ b/ansible/roles/designate/templates/designate-producer.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/designate/templates/designate-sink.json.j2 b/ansible/roles/designate/templates/designate-sink.json.j2
index 39273e00a..427732a1e 100644
--- a/ansible/roles/designate/templates/designate-sink.json.j2
+++ b/ansible/roles/designate/templates/designate-sink.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/designate/templates/designate-worker.json.j2 b/ansible/roles/designate/templates/designate-worker.json.j2
index 4b4ee2dcb..c5500f795 100644
--- a/ansible/roles/designate/templates/designate-worker.json.j2
+++ b/ansible/roles/designate/templates/designate-worker.json.j2
@@ -38,7 +38,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/etcd/templates/etcd.json.j2 b/ansible/roles/etcd/templates/etcd.json.j2
index 47af83cda..d488045d3 100644
--- a/ansible/roles/etcd/templates/etcd.json.j2
+++ b/ansible/roles/etcd/templates/etcd.json.j2
@@ -18,7 +18,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/fluentd/templates/fluentd.json.j2 b/ansible/roles/fluentd/templates/fluentd.json.j2
index 906978f43..a593177a8 100644
--- a/ansible/roles/fluentd/templates/fluentd.json.j2
+++ b/ansible/roles/fluentd/templates/fluentd.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/glance/templates/glance-api.json.j2 b/ansible/roles/glance/templates/glance-api.json.j2
index 41f5f2164..6ca397e7f 100644
--- a/ansible/roles/glance/templates/glance-api.json.j2
+++ b/ansible/roles/glance/templates/glance-api.json.j2
@@ -59,7 +59,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/gnocchi/templates/gnocchi-api.json.j2 b/ansible/roles/gnocchi/templates/gnocchi-api.json.j2
index 0880285ef..bbf282683 100644
--- a/ansible/roles/gnocchi/templates/gnocchi-api.json.j2
+++ b/ansible/roles/gnocchi/templates/gnocchi-api.json.j2
@@ -29,7 +29,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/gnocchi/templates/gnocchi-metricd.json.j2 b/ansible/roles/gnocchi/templates/gnocchi-metricd.json.j2
index f9b4c6a53..8c81df9a6 100644
--- a/ansible/roles/gnocchi/templates/gnocchi-metricd.json.j2
+++ b/ansible/roles/gnocchi/templates/gnocchi-metricd.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/gnocchi/templates/gnocchi-statsd.json.j2 b/ansible/roles/gnocchi/templates/gnocchi-statsd.json.j2
index 0024b5405..04dd18386 100644
--- a/ansible/roles/gnocchi/templates/gnocchi-statsd.json.j2
+++ b/ansible/roles/gnocchi/templates/gnocchi-statsd.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/grafana/templates/grafana.json.j2 b/ansible/roles/grafana/templates/grafana.json.j2
index a9d6445bf..63311f766 100644
--- a/ansible/roles/grafana/templates/grafana.json.j2
+++ b/ansible/roles/grafana/templates/grafana.json.j2
@@ -54,7 +54,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/heat/templates/heat-api-cfn.json.j2 b/ansible/roles/heat/templates/heat-api-cfn.json.j2
index 1a308dfd8..a903217b0 100644
--- a/ansible/roles/heat/templates/heat-api-cfn.json.j2
+++ b/ansible/roles/heat/templates/heat-api-cfn.json.j2
@@ -36,7 +36,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/heat/templates/heat-api.json.j2 b/ansible/roles/heat/templates/heat-api.json.j2
index 079267847..5edd0df49 100644
--- a/ansible/roles/heat/templates/heat-api.json.j2
+++ b/ansible/roles/heat/templates/heat-api.json.j2
@@ -36,7 +36,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/heat/templates/heat-engine.json.j2 b/ansible/roles/heat/templates/heat-engine.json.j2
index cea7c5b50..d43bccab9 100644
--- a/ansible/roles/heat/templates/heat-engine.json.j2
+++ b/ansible/roles/heat/templates/heat-engine.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/horizon/templates/horizon.json.j2 b/ansible/roles/horizon/templates/horizon.json.j2
index f7859194a..621e84805 100644
--- a/ansible/roles/horizon/templates/horizon.json.j2
+++ b/ansible/roles/horizon/templates/horizon.json.j2
@@ -50,7 +50,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/ironic/templates/ironic-api.json.j2 b/ansible/roles/ironic/templates/ironic-api.json.j2
index d9c5d5f8b..d3242f8f7 100644
--- a/ansible/roles/ironic/templates/ironic-api.json.j2
+++ b/ansible/roles/ironic/templates/ironic-api.json.j2
@@ -35,7 +35,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/ironic/templates/ironic-conductor.json.j2 b/ansible/roles/ironic/templates/ironic-conductor.json.j2
index 7e109d8ea..e66ccc03b 100644
--- a/ansible/roles/ironic/templates/ironic-conductor.json.j2
+++ b/ansible/roles/ironic/templates/ironic-conductor.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/ironic/templates/ironic-dnsmasq.json.j2 b/ansible/roles/ironic/templates/ironic-dnsmasq.json.j2
index 379a4b701..df4302c73 100644
--- a/ansible/roles/ironic/templates/ironic-dnsmasq.json.j2
+++ b/ansible/roles/ironic/templates/ironic-dnsmasq.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/ironic/templates/ironic-http.json.j2 b/ansible/roles/ironic/templates/ironic-http.json.j2
index d726cd201..447115119 100644
--- a/ansible/roles/ironic/templates/ironic-http.json.j2
+++ b/ansible/roles/ironic/templates/ironic-http.json.j2
@@ -33,7 +33,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/ironic/templates/ironic-prometheus-exporter.json.j2 b/ansible/roles/ironic/templates/ironic-prometheus-exporter.json.j2
index a4d931eff..7051cb10d 100644
--- a/ansible/roles/ironic/templates/ironic-prometheus-exporter.json.j2
+++ b/ansible/roles/ironic/templates/ironic-prometheus-exporter.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/keystone/templates/keystone-fernet.json.j2 b/ansible/roles/keystone/templates/keystone-fernet.json.j2
index 7fc4c24f0..c7fd710ef 100644
--- a/ansible/roles/keystone/templates/keystone-fernet.json.j2
+++ b/ansible/roles/keystone/templates/keystone-fernet.json.j2
@@ -60,7 +60,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/keystone/templates/keystone-httpd.json.j2 b/ansible/roles/keystone/templates/keystone-httpd.json.j2
index e16cf98be..b6701871a 100644
--- a/ansible/roles/keystone/templates/keystone-httpd.json.j2
+++ b/ansible/roles/keystone/templates/keystone-httpd.json.j2
@@ -47,7 +47,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/keystone/templates/keystone-ssh.json.j2 b/ansible/roles/keystone/templates/keystone-ssh.json.j2
index 8defdaeee..cadf81697 100644
--- a/ansible/roles/keystone/templates/keystone-ssh.json.j2
+++ b/ansible/roles/keystone/templates/keystone-ssh.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/keystone/templates/keystone.json.j2 b/ansible/roles/keystone/templates/keystone.json.j2
index 4ebfdce8e..86ff244cf 100644
--- a/ansible/roles/keystone/templates/keystone.json.j2
+++ b/ansible/roles/keystone/templates/keystone.json.j2
@@ -55,7 +55,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/kolla_toolbox/templates/kolla-toolbox.json.j2 b/ansible/roles/kolla_toolbox/templates/kolla-toolbox.json.j2
index 712a4782e..2c0fc6882 100644
--- a/ansible/roles/kolla_toolbox/templates/kolla-toolbox.json.j2
+++ b/ansible/roles/kolla_toolbox/templates/kolla-toolbox.json.j2
@@ -35,7 +35,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/letsencrypt/templates/letsencrypt-lego.json.j2 b/ansible/roles/letsencrypt/templates/letsencrypt-lego.json.j2
index 0791f49c9..6a29ef0c8 100644
--- a/ansible/roles/letsencrypt/templates/letsencrypt-lego.json.j2
+++ b/ansible/roles/letsencrypt/templates/letsencrypt-lego.json.j2
@@ -25,7 +25,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/letsencrypt/templates/letsencrypt-webserver.json.j2 b/ansible/roles/letsencrypt/templates/letsencrypt-webserver.json.j2
index 57ad35b88..eb8785857 100644
--- a/ansible/roles/letsencrypt/templates/letsencrypt-webserver.json.j2
+++ b/ansible/roles/letsencrypt/templates/letsencrypt-webserver.json.j2
@@ -15,7 +15,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "directories": [
diff --git a/ansible/roles/loadbalancer/templates/haproxy-ssh/haproxy-ssh.json.j2 b/ansible/roles/loadbalancer/templates/haproxy-ssh/haproxy-ssh.json.j2
index bf5f18de0..c61fc44d8 100644
--- a/ansible/roles/loadbalancer/templates/haproxy-ssh/haproxy-ssh.json.j2
+++ b/ansible/roles/loadbalancer/templates/haproxy-ssh/haproxy-ssh.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/loadbalancer/templates/haproxy/haproxy.json.j2 b/ansible/roles/loadbalancer/templates/haproxy/haproxy.json.j2
index 0850e15c7..ab19dee27 100644
--- a/ansible/roles/loadbalancer/templates/haproxy/haproxy.json.j2
+++ b/ansible/roles/loadbalancer/templates/haproxy/haproxy.json.j2
@@ -45,7 +45,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/loadbalancer/templates/keepalived/keepalived.json.j2 b/ansible/roles/loadbalancer/templates/keepalived/keepalived.json.j2
index e2c7c89da..77fa1826f 100644
--- a/ansible/roles/loadbalancer/templates/keepalived/keepalived.json.j2
+++ b/ansible/roles/loadbalancer/templates/keepalived/keepalived.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/loadbalancer/templates/proxysql/proxysql.json.j2 b/ansible/roles/loadbalancer/templates/proxysql/proxysql.json.j2
index ae1e90856..f720f18e0 100644
--- a/ansible/roles/loadbalancer/templates/proxysql/proxysql.json.j2
+++ b/ansible/roles/loadbalancer/templates/proxysql/proxysql.json.j2
@@ -29,7 +29,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
         {% if database_enable_tls_backend | bool %},
         {
diff --git a/ansible/roles/magnum/templates/magnum-api.json.j2 b/ansible/roles/magnum/templates/magnum-api.json.j2
index 9e7b2a248..21930e6ff 100644
--- a/ansible/roles/magnum/templates/magnum-api.json.j2
+++ b/ansible/roles/magnum/templates/magnum-api.json.j2
@@ -42,7 +42,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/magnum/templates/magnum-conductor.json.j2 b/ansible/roles/magnum/templates/magnum-conductor.json.j2
index 8d077396e..dda2902f4 100644
--- a/ansible/roles/magnum/templates/magnum-conductor.json.j2
+++ b/ansible/roles/magnum/templates/magnum-conductor.json.j2
@@ -24,7 +24,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/manila/templates/manila-api.json.j2 b/ansible/roles/manila/templates/manila-api.json.j2
index a5128eb93..f3d114069 100644
--- a/ansible/roles/manila/templates/manila-api.json.j2
+++ b/ansible/roles/manila/templates/manila-api.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/manila/templates/manila-data.json.j2 b/ansible/roles/manila/templates/manila-data.json.j2
index 6dbd175ef..45bf65de8 100644
--- a/ansible/roles/manila/templates/manila-data.json.j2
+++ b/ansible/roles/manila/templates/manila-data.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/manila/templates/manila-scheduler.json.j2 b/ansible/roles/manila/templates/manila-scheduler.json.j2
index 4f7c7b5af..cbae07b7f 100644
--- a/ansible/roles/manila/templates/manila-scheduler.json.j2
+++ b/ansible/roles/manila/templates/manila-scheduler.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/manila/templates/manila-share.json.j2 b/ansible/roles/manila/templates/manila-share.json.j2
index b304665fd..d2f469bc4 100644
--- a/ansible/roles/manila/templates/manila-share.json.j2
+++ b/ansible/roles/manila/templates/manila-share.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/masakari/templates/masakari-api.json.j2 b/ansible/roles/masakari/templates/masakari-api.json.j2
index 55d1c103d..5a6822aba 100644
--- a/ansible/roles/masakari/templates/masakari-api.json.j2
+++ b/ansible/roles/masakari/templates/masakari-api.json.j2
@@ -29,7 +29,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/masakari/templates/masakari-engine.json.j2 b/ansible/roles/masakari/templates/masakari-engine.json.j2
index 681b3bf9a..5bc11fdf6 100644
--- a/ansible/roles/masakari/templates/masakari-engine.json.j2
+++ b/ansible/roles/masakari/templates/masakari-engine.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/masakari/templates/masakari-hostmonitor.json.j2 b/ansible/roles/masakari/templates/masakari-hostmonitor.json.j2
index f2c6015b4..e8e0f334a 100644
--- a/ansible/roles/masakari/templates/masakari-hostmonitor.json.j2
+++ b/ansible/roles/masakari/templates/masakari-hostmonitor.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/masakari/templates/masakari-instancemonitor.json.j2 b/ansible/roles/masakari/templates/masakari-instancemonitor.json.j2
index d4be66f59..20ad90ba1 100644
--- a/ansible/roles/masakari/templates/masakari-instancemonitor.json.j2
+++ b/ansible/roles/masakari/templates/masakari-instancemonitor.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/mistral/templates/mistral-api.json.j2 b/ansible/roles/mistral/templates/mistral-api.json.j2
index c057acdca..919ef1eb2 100644
--- a/ansible/roles/mistral/templates/mistral-api.json.j2
+++ b/ansible/roles/mistral/templates/mistral-api.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/mistral/templates/mistral-engine.json.j2 b/ansible/roles/mistral/templates/mistral-engine.json.j2
index bab45348f..e8fd904f9 100644
--- a/ansible/roles/mistral/templates/mistral-engine.json.j2
+++ b/ansible/roles/mistral/templates/mistral-engine.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/mistral/templates/mistral-event-engine.json.j2 b/ansible/roles/mistral/templates/mistral-event-engine.json.j2
index 67e8dc516..70426ade2 100644
--- a/ansible/roles/mistral/templates/mistral-event-engine.json.j2
+++ b/ansible/roles/mistral/templates/mistral-event-engine.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/mistral/templates/mistral-executor.json.j2 b/ansible/roles/mistral/templates/mistral-executor.json.j2
index e409bdab6..77d97deb5 100644
--- a/ansible/roles/mistral/templates/mistral-executor.json.j2
+++ b/ansible/roles/mistral/templates/mistral-executor.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/ironic-neutron-agent.json.j2 b/ansible/roles/neutron/templates/ironic-neutron-agent.json.j2
index bcec1d788..28bce9440 100644
--- a/ansible/roles/neutron/templates/ironic-neutron-agent.json.j2
+++ b/ansible/roles/neutron/templates/ironic-neutron-agent.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-bgp-dragent.json.j2 b/ansible/roles/neutron/templates/neutron-bgp-dragent.json.j2
index 8d25944b0..48a35bf9a 100644
--- a/ansible/roles/neutron/templates/neutron-bgp-dragent.json.j2
+++ b/ansible/roles/neutron/templates/neutron-bgp-dragent.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-dhcp-agent.json.j2 b/ansible/roles/neutron/templates/neutron-dhcp-agent.json.j2
index 116585298..3148c0597 100644
--- a/ansible/roles/neutron/templates/neutron-dhcp-agent.json.j2
+++ b/ansible/roles/neutron/templates/neutron-dhcp-agent.json.j2
@@ -29,7 +29,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-eswitchd.json.j2 b/ansible/roles/neutron/templates/neutron-eswitchd.json.j2
index 1fba527b1..41d8b879d 100644
--- a/ansible/roles/neutron/templates/neutron-eswitchd.json.j2
+++ b/ansible/roles/neutron/templates/neutron-eswitchd.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-infoblox-ipam-agent.json.j2 b/ansible/roles/neutron/templates/neutron-infoblox-ipam-agent.json.j2
index b66d78a11..34efa2d43 100644
--- a/ansible/roles/neutron/templates/neutron-infoblox-ipam-agent.json.j2
+++ b/ansible/roles/neutron/templates/neutron-infoblox-ipam-agent.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-l3-agent.json.j2 b/ansible/roles/neutron/templates/neutron-l3-agent.json.j2
index 2f9e2ab89..8f76e602d 100644
--- a/ansible/roles/neutron/templates/neutron-l3-agent.json.j2
+++ b/ansible/roles/neutron/templates/neutron-l3-agent.json.j2
@@ -41,7 +41,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-metadata-agent.json.j2 b/ansible/roles/neutron/templates/neutron-metadata-agent.json.j2
index 4eaef800f..e178996f4 100644
--- a/ansible/roles/neutron/templates/neutron-metadata-agent.json.j2
+++ b/ansible/roles/neutron/templates/neutron-metadata-agent.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-metering-agent.json.j2 b/ansible/roles/neutron/templates/neutron-metering-agent.json.j2
index a2921d0c2..198ca6575 100644
--- a/ansible/roles/neutron/templates/neutron-metering-agent.json.j2
+++ b/ansible/roles/neutron/templates/neutron-metering-agent.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-mlnx-agent.json.j2 b/ansible/roles/neutron/templates/neutron-mlnx-agent.json.j2
index c7e78ee69..a88c44190 100644
--- a/ansible/roles/neutron/templates/neutron-mlnx-agent.json.j2
+++ b/ansible/roles/neutron/templates/neutron-mlnx-agent.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-openvswitch-agent-xenapi.json.j2 b/ansible/roles/neutron/templates/neutron-openvswitch-agent-xenapi.json.j2
index 3bb327f0f..1ea668f4d 100644
--- a/ansible/roles/neutron/templates/neutron-openvswitch-agent-xenapi.json.j2
+++ b/ansible/roles/neutron/templates/neutron-openvswitch-agent-xenapi.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-openvswitch-agent.json.j2 b/ansible/roles/neutron/templates/neutron-openvswitch-agent.json.j2
index 880d8aa44..5f4f011c5 100644
--- a/ansible/roles/neutron/templates/neutron-openvswitch-agent.json.j2
+++ b/ansible/roles/neutron/templates/neutron-openvswitch-agent.json.j2
@@ -41,7 +41,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-ovn-agent.json.j2 b/ansible/roles/neutron/templates/neutron-ovn-agent.json.j2
index a7534e40a..a5b5bd029 100644
--- a/ansible/roles/neutron/templates/neutron-ovn-agent.json.j2
+++ b/ansible/roles/neutron/templates/neutron-ovn-agent.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-ovn-maintenance-worker.json.j2 b/ansible/roles/neutron/templates/neutron-ovn-maintenance-worker.json.j2
index a91620a00..c07256391 100644
--- a/ansible/roles/neutron/templates/neutron-ovn-maintenance-worker.json.j2
+++ b/ansible/roles/neutron/templates/neutron-ovn-maintenance-worker.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-ovn-metadata-agent.json.j2 b/ansible/roles/neutron/templates/neutron-ovn-metadata-agent.json.j2
index 73d584691..1a987f6af 100644
--- a/ansible/roles/neutron/templates/neutron-ovn-metadata-agent.json.j2
+++ b/ansible/roles/neutron/templates/neutron-ovn-metadata-agent.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-ovn-vpn-agent.json.j2 b/ansible/roles/neutron/templates/neutron-ovn-vpn-agent.json.j2
index 4814642ee..d044cc173 100644
--- a/ansible/roles/neutron/templates/neutron-ovn-vpn-agent.json.j2
+++ b/ansible/roles/neutron/templates/neutron-ovn-vpn-agent.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-periodic-worker.json.j2 b/ansible/roles/neutron/templates/neutron-periodic-worker.json.j2
index f123bc6b2..52872ac72 100644
--- a/ansible/roles/neutron/templates/neutron-periodic-worker.json.j2
+++ b/ansible/roles/neutron/templates/neutron-periodic-worker.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-rpc-server.json.j2 b/ansible/roles/neutron/templates/neutron-rpc-server.json.j2
index c90eacb31..b8721cc85 100644
--- a/ansible/roles/neutron/templates/neutron-rpc-server.json.j2
+++ b/ansible/roles/neutron/templates/neutron-rpc-server.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-server.json.j2 b/ansible/roles/neutron/templates/neutron-server.json.j2
index a04e9e0ce..8d27d7d69 100644
--- a/ansible/roles/neutron/templates/neutron-server.json.j2
+++ b/ansible/roles/neutron/templates/neutron-server.json.j2
@@ -80,7 +80,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/neutron/templates/neutron-sriov-agent.json.j2 b/ansible/roles/neutron/templates/neutron-sriov-agent.json.j2
index 204249e13..38322559b 100644
--- a/ansible/roles/neutron/templates/neutron-sriov-agent.json.j2
+++ b/ansible/roles/neutron/templates/neutron-sriov-agent.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/nova-cell/templates/nova-cell-bootstrap.json.j2 b/ansible/roles/nova-cell/templates/nova-cell-bootstrap.json.j2
index 2d22a2d45..89b76d852 100644
--- a/ansible/roles/nova-cell/templates/nova-cell-bootstrap.json.j2
+++ b/ansible/roles/nova-cell/templates/nova-cell-bootstrap.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/nova-cell/templates/nova-compute-ironic.json.j2 b/ansible/roles/nova-cell/templates/nova-compute-ironic.json.j2
index 2385e402d..a9832e6bd 100644
--- a/ansible/roles/nova-cell/templates/nova-compute-ironic.json.j2
+++ b/ansible/roles/nova-cell/templates/nova-compute-ironic.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/nova-cell/templates/nova-compute.json.j2 b/ansible/roles/nova-cell/templates/nova-compute.json.j2
index 97bd5235e..400301d21 100644
--- a/ansible/roles/nova-cell/templates/nova-compute.json.j2
+++ b/ansible/roles/nova-cell/templates/nova-compute.json.j2
@@ -78,7 +78,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}{% if enable_multipathd | bool %},
         {
             "source": "{{ container_config_directory }}/multipath.conf",
diff --git a/ansible/roles/nova-cell/templates/nova-conductor.json.j2 b/ansible/roles/nova-cell/templates/nova-conductor.json.j2
index 92925888f..9a4dbda1a 100644
--- a/ansible/roles/nova-cell/templates/nova-conductor.json.j2
+++ b/ansible/roles/nova-cell/templates/nova-conductor.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/nova-cell/templates/nova-libvirt.json.j2 b/ansible/roles/nova-cell/templates/nova-libvirt.json.j2
index e81413b35..f64098707 100644
--- a/ansible/roles/nova-cell/templates/nova-libvirt.json.j2
+++ b/ansible/roles/nova-cell/templates/nova-libvirt.json.j2
@@ -72,7 +72,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/nova-cell/templates/nova-novncproxy.json.j2 b/ansible/roles/nova-cell/templates/nova-novncproxy.json.j2
index 8ff5b39e6..37a7caf8a 100644
--- a/ansible/roles/nova-cell/templates/nova-novncproxy.json.j2
+++ b/ansible/roles/nova-cell/templates/nova-novncproxy.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/nova-cell/templates/nova-serialproxy.json.j2 b/ansible/roles/nova-cell/templates/nova-serialproxy.json.j2
index 867f9615f..64819c092 100644
--- a/ansible/roles/nova-cell/templates/nova-serialproxy.json.j2
+++ b/ansible/roles/nova-cell/templates/nova-serialproxy.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/nova-cell/templates/nova-spicehtml5proxy.json.j2 b/ansible/roles/nova-cell/templates/nova-spicehtml5proxy.json.j2
index 5585803fe..85977667c 100644
--- a/ansible/roles/nova-cell/templates/nova-spicehtml5proxy.json.j2
+++ b/ansible/roles/nova-cell/templates/nova-spicehtml5proxy.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/nova-cell/templates/nova-ssh.json.j2 b/ansible/roles/nova-cell/templates/nova-ssh.json.j2
index be378238c..de5483bc1 100644
--- a/ansible/roles/nova-cell/templates/nova-ssh.json.j2
+++ b/ansible/roles/nova-cell/templates/nova-ssh.json.j2
@@ -29,7 +29,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/nova/templates/nova-api-bootstrap.json.j2 b/ansible/roles/nova/templates/nova-api-bootstrap.json.j2
index 2d22a2d45..89b76d852 100644
--- a/ansible/roles/nova/templates/nova-api-bootstrap.json.j2
+++ b/ansible/roles/nova/templates/nova-api-bootstrap.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/nova/templates/nova-api.json.j2 b/ansible/roles/nova/templates/nova-api.json.j2
index 71947010e..9a5c187af 100644
--- a/ansible/roles/nova/templates/nova-api.json.j2
+++ b/ansible/roles/nova/templates/nova-api.json.j2
@@ -41,7 +41,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/nova/templates/nova-scheduler.json.j2 b/ansible/roles/nova/templates/nova-scheduler.json.j2
index 9027fb7c0..3de580634 100644
--- a/ansible/roles/nova/templates/nova-scheduler.json.j2
+++ b/ansible/roles/nova/templates/nova-scheduler.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/nova/templates/nova-super-conductor.json.j2 b/ansible/roles/nova/templates/nova-super-conductor.json.j2
index 92925888f..9a4dbda1a 100644
--- a/ansible/roles/nova/templates/nova-super-conductor.json.j2
+++ b/ansible/roles/nova/templates/nova-super-conductor.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/octavia/templates/octavia-api.json.j2 b/ansible/roles/octavia/templates/octavia-api.json.j2
index 7304e9150..9813602c8 100644
--- a/ansible/roles/octavia/templates/octavia-api.json.j2
+++ b/ansible/roles/octavia/templates/octavia-api.json.j2
@@ -35,7 +35,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/octavia/templates/octavia-driver-agent.json.j2 b/ansible/roles/octavia/templates/octavia-driver-agent.json.j2
index bb5e1145a..582ea2010 100644
--- a/ansible/roles/octavia/templates/octavia-driver-agent.json.j2
+++ b/ansible/roles/octavia/templates/octavia-driver-agent.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/octavia/templates/octavia-health-manager.json.j2 b/ansible/roles/octavia/templates/octavia-health-manager.json.j2
index a7efd9279..335b5b6ca 100644
--- a/ansible/roles/octavia/templates/octavia-health-manager.json.j2
+++ b/ansible/roles/octavia/templates/octavia-health-manager.json.j2
@@ -35,7 +35,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/octavia/templates/octavia-housekeeping.json.j2 b/ansible/roles/octavia/templates/octavia-housekeeping.json.j2
index 8f80b73a9..0b4360a90 100644
--- a/ansible/roles/octavia/templates/octavia-housekeeping.json.j2
+++ b/ansible/roles/octavia/templates/octavia-housekeeping.json.j2
@@ -35,7 +35,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/octavia/templates/octavia-worker.json.j2 b/ansible/roles/octavia/templates/octavia-worker.json.j2
index 02fa3be1e..9b8c5cdd8 100644
--- a/ansible/roles/octavia/templates/octavia-worker.json.j2
+++ b/ansible/roles/octavia/templates/octavia-worker.json.j2
@@ -35,7 +35,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/opensearch/templates/opensearch-dashboards.json.j2 b/ansible/roles/opensearch/templates/opensearch-dashboards.json.j2
index 6cb96cb4a..a23ce317a 100644
--- a/ansible/roles/opensearch/templates/opensearch-dashboards.json.j2
+++ b/ansible/roles/opensearch/templates/opensearch-dashboards.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/opensearch/templates/opensearch.json.j2 b/ansible/roles/opensearch/templates/opensearch.json.j2
index 25bb7b770..bd64d0f46 100644
--- a/ansible/roles/opensearch/templates/opensearch.json.j2
+++ b/ansible/roles/opensearch/templates/opensearch.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/placement/templates/placement-api.json.j2 b/ansible/roles/placement/templates/placement-api.json.j2
index 9333e1459..21c0e41aa 100644
--- a/ansible/roles/placement/templates/placement-api.json.j2
+++ b/ansible/roles/placement/templates/placement-api.json.j2
@@ -41,7 +41,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/prometheus-node-exporters/templates/prometheus-cadvisor.json.j2 b/ansible/roles/prometheus-node-exporters/templates/prometheus-cadvisor.json.j2
index 7b00cfa5a..c4e5b3d91 100644
--- a/ansible/roles/prometheus-node-exporters/templates/prometheus-cadvisor.json.j2
+++ b/ansible/roles/prometheus-node-exporters/templates/prometheus-cadvisor.json.j2
@@ -6,7 +6,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }
 {% endif %}
     ],
diff --git a/ansible/roles/prometheus-node-exporters/templates/prometheus-node-exporter.json.j2 b/ansible/roles/prometheus-node-exporters/templates/prometheus-node-exporter.json.j2
index 41e8e8fea..9cf30f1b7 100644
--- a/ansible/roles/prometheus-node-exporters/templates/prometheus-node-exporter.json.j2
+++ b/ansible/roles/prometheus-node-exporters/templates/prometheus-node-exporter.json.j2
@@ -6,7 +6,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }
 {% endif %}
     ],
diff --git a/ansible/roles/prometheus/templates/prometheus-alertmanager.json.j2 b/ansible/roles/prometheus/templates/prometheus-alertmanager.json.j2
index 93c2767db..dcbd38706 100644
--- a/ansible/roles/prometheus/templates/prometheus-alertmanager.json.j2
+++ b/ansible/roles/prometheus/templates/prometheus-alertmanager.json.j2
@@ -18,7 +18,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/prometheus/templates/prometheus-blackbox-exporter.json.j2 b/ansible/roles/prometheus/templates/prometheus-blackbox-exporter.json.j2
index 924b49550..cd6c2e0de 100644
--- a/ansible/roles/prometheus/templates/prometheus-blackbox-exporter.json.j2
+++ b/ansible/roles/prometheus/templates/prometheus-blackbox-exporter.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/prometheus/templates/prometheus-elasticsearch-exporter.json.j2 b/ansible/roles/prometheus/templates/prometheus-elasticsearch-exporter.json.j2
index 330743a0f..2a484d205 100644
--- a/ansible/roles/prometheus/templates/prometheus-elasticsearch-exporter.json.j2
+++ b/ansible/roles/prometheus/templates/prometheus-elasticsearch-exporter.json.j2
@@ -6,7 +6,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }
 {% endif %}
     ],
diff --git a/ansible/roles/prometheus/templates/prometheus-libvirt-exporter.json.j2 b/ansible/roles/prometheus/templates/prometheus-libvirt-exporter.json.j2
index 47bf22571..b4bd1cb31 100644
--- a/ansible/roles/prometheus/templates/prometheus-libvirt-exporter.json.j2
+++ b/ansible/roles/prometheus/templates/prometheus-libvirt-exporter.json.j2
@@ -6,7 +6,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/prometheus/templates/prometheus-memcached-exporter.json.j2 b/ansible/roles/prometheus/templates/prometheus-memcached-exporter.json.j2
index f75fbcccb..fb3143e1f 100644
--- a/ansible/roles/prometheus/templates/prometheus-memcached-exporter.json.j2
+++ b/ansible/roles/prometheus/templates/prometheus-memcached-exporter.json.j2
@@ -6,7 +6,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }
 {% endif %}
     ],
diff --git a/ansible/roles/prometheus/templates/prometheus-mysqld-exporter.json.j2 b/ansible/roles/prometheus/templates/prometheus-mysqld-exporter.json.j2
index 0ab96dd6a..4a923702f 100644
--- a/ansible/roles/prometheus/templates/prometheus-mysqld-exporter.json.j2
+++ b/ansible/roles/prometheus/templates/prometheus-mysqld-exporter.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/prometheus/templates/prometheus-openstack-exporter.json.j2 b/ansible/roles/prometheus/templates/prometheus-openstack-exporter.json.j2
index 48bec881d..f05488c4f 100644
--- a/ansible/roles/prometheus/templates/prometheus-openstack-exporter.json.j2
+++ b/ansible/roles/prometheus/templates/prometheus-openstack-exporter.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/prometheus/templates/prometheus-openstack-network-exporter.json.j2 b/ansible/roles/prometheus/templates/prometheus-openstack-network-exporter.json.j2
index fe27ee57c..caa98cbbe 100644
--- a/ansible/roles/prometheus/templates/prometheus-openstack-network-exporter.json.j2
+++ b/ansible/roles/prometheus/templates/prometheus-openstack-network-exporter.json.j2
@@ -11,7 +11,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/prometheus/templates/prometheus-server.json.j2 b/ansible/roles/prometheus/templates/prometheus-server.json.j2
index 4f875bf3b..394dd21c5 100644
--- a/ansible/roles/prometheus/templates/prometheus-server.json.j2
+++ b/ansible/roles/prometheus/templates/prometheus-server.json.j2
@@ -31,7 +31,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/prometheus/templates/prometheus-valkey-exporter.json.j2 b/ansible/roles/prometheus/templates/prometheus-valkey-exporter.json.j2
index e3d3f45b0..5cce028a9 100644
--- a/ansible/roles/prometheus/templates/prometheus-valkey-exporter.json.j2
+++ b/ansible/roles/prometheus/templates/prometheus-valkey-exporter.json.j2
@@ -6,7 +6,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ]
 }
diff --git a/ansible/roles/rabbitmq/templates/rabbitmq.json.j2 b/ansible/roles/rabbitmq/templates/rabbitmq.json.j2
index 8b7aa65b6..94d3105b8 100644
--- a/ansible/roles/rabbitmq/templates/rabbitmq.json.j2
+++ b/ansible/roles/rabbitmq/templates/rabbitmq.json.j2
@@ -53,7 +53,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/skyline/templates/skyline-apiserver.json.j2 b/ansible/roles/skyline/templates/skyline-apiserver.json.j2
index f914d48b8..485c243b5 100644
--- a/ansible/roles/skyline/templates/skyline-apiserver.json.j2
+++ b/ansible/roles/skyline/templates/skyline-apiserver.json.j2
@@ -29,7 +29,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
         ],
     "permissions": [
diff --git a/ansible/roles/skyline/templates/skyline-console.json.j2 b/ansible/roles/skyline/templates/skyline-console.json.j2
index ee64205b7..8031b9bfd 100644
--- a/ansible/roles/skyline/templates/skyline-console.json.j2
+++ b/ansible/roles/skyline/templates/skyline-console.json.j2
@@ -36,7 +36,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
         ],
     "permissions": [
diff --git a/ansible/roles/tacker/templates/tacker-conductor.json.j2 b/ansible/roles/tacker/templates/tacker-conductor.json.j2
index 02cc0ef09..a103bdc80 100644
--- a/ansible/roles/tacker/templates/tacker-conductor.json.j2
+++ b/ansible/roles/tacker/templates/tacker-conductor.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/tacker/templates/tacker-server.json.j2 b/ansible/roles/tacker/templates/tacker-server.json.j2
index 950d63dc2..346c1879e 100644
--- a/ansible/roles/tacker/templates/tacker-server.json.j2
+++ b/ansible/roles/tacker/templates/tacker-server.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/trove/templates/trove-api.json.j2 b/ansible/roles/trove/templates/trove-api.json.j2
index a44c927de..c448ea1b0 100644
--- a/ansible/roles/trove/templates/trove-api.json.j2
+++ b/ansible/roles/trove/templates/trove-api.json.j2
@@ -35,7 +35,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     {% endif %}],
     "permissions": [
diff --git a/ansible/roles/trove/templates/trove-conductor.json.j2 b/ansible/roles/trove/templates/trove-conductor.json.j2
index f935a4bc3..0f76dcfc5 100644
--- a/ansible/roles/trove/templates/trove-conductor.json.j2
+++ b/ansible/roles/trove/templates/trove-conductor.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/trove/templates/trove-taskmanager.json.j2 b/ansible/roles/trove/templates/trove-taskmanager.json.j2
index 06e377173..bda194a5e 100644
--- a/ansible/roles/trove/templates/trove-taskmanager.json.j2
+++ b/ansible/roles/trove/templates/trove-taskmanager.json.j2
@@ -23,7 +23,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/watcher/templates/watcher-api.json.j2 b/ansible/roles/watcher/templates/watcher-api.json.j2
index c80bb842e..03c581318 100644
--- a/ansible/roles/watcher/templates/watcher-api.json.j2
+++ b/ansible/roles/watcher/templates/watcher-api.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/watcher/templates/watcher-applier.json.j2 b/ansible/roles/watcher/templates/watcher-applier.json.j2
index 2c5fc7268..a0d154ca7 100644
--- a/ansible/roles/watcher/templates/watcher-applier.json.j2
+++ b/ansible/roles/watcher/templates/watcher-applier.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [
diff --git a/ansible/roles/watcher/templates/watcher-engine.json.j2 b/ansible/roles/watcher/templates/watcher-engine.json.j2
index ee8e20e00..a53c6bfef 100644
--- a/ansible/roles/watcher/templates/watcher-engine.json.j2
+++ b/ansible/roles/watcher/templates/watcher-engine.json.j2
@@ -17,7 +17,7 @@
             "source": "{{ container_config_directory }}/ca-certificates",
             "dest": "/var/lib/kolla/share/ca-certificates",
             "owner": "root",
-            "perm": "0600"
+            "perm": "0644"
         }{% endif %}
     ],
     "permissions": [