Skip to content

loadbalancer: Fix the kolla CA step - #1116

Merged
berendt merged 2 commits into
mainfrom
loadbalancer-custom-ca-kolla
Oct 18, 2026
Merged

berendt merged 2 commits into
mainfrom
loadbalancer-custom-ca-kolla

Conversation

@ideaship

Copy link
Copy Markdown
Contributor

Step 3 of the custom CA procedure in the loadbalancer configuration guide has two problems, fixed in one commit each:

  1. Wrong file: it puts kolla_copy_ca_into_containers and openstack_cacert into environments/manager/configuration.yml. Both are kolla-ansible variables, and kolla runs only load environments/configuration.yml and the kolla environment's own files, so following the step has no effect: the CA is not copied into the OpenStack containers. The step now names environments/kolla/configuration.yml, as the example further down the same page already does.
  2. Restated default: openstack_cacert: /etc/ssl/certs/ca-certificates.crt is what osism/defaults has set since OSISM 7 (kolla: add openstack_cacert parameter defaults#172), so the line suggests a step that isn't needed. It is dropped; kolla_copy_ca_into_containers (default false) stays.

This doesn't conflict with #1115, which changes step 2 of the same procedure, and neither depends on the other.

🤖 Generated with Claude Code

Step 3 of the custom CA procedure puts kolla_copy_ca_into_containers
and openstack_cacert into environments/manager/configuration.yml. Both
are kolla-ansible variables, and the manager environment's
configuration is not loaded by the kolla plays, so following the step
has no effect: the CA is not copied into the OpenStack containers.

Name environments/kolla/configuration.yml instead, where the example
further down the same page already sets kolla_copy_ca_into_containers.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Roger Luethi <luethi@osism.tech>
Step 3 of the custom CA procedure sets openstack_cacert to
/etc/ssl/certs/ca-certificates.crt. osism/defaults has set exactly
that value since OSISM 7 (osism/defaults#172, noted in the OSISM 7
release notes), so the line only restates the default and suggests
that it is needed.

Drop it and keep kolla_copy_ca_into_containers, which defaults to
false and is what copies the custom CA into the containers.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Roger Luethi <luethi@osism.tech>
@github-actions

Copy link
Copy Markdown

✅⚠️MegaLinter analysis: Success with warnings

Descriptor Linter Files Fixed Errors Max errors Warnings Elapsed time
✅ ACTION actionlint 5 0 0 0.04s
✅ JSON jsonlint 4 0 0 0.07s
✅ JSON prettier 4 0 0 0.23s
✅ JSON v8r 4 0 0 8.74s
✅ MARKDOWN markdownlint 180 0 0 1.73s
✅ MARKDOWN markdown-table-formatter 180 0 0 0.23s
✅ REPOSITORY betterleaks yes no no 0.47s
✅ REPOSITORY checkov yes no no 15.25s
✅ REPOSITORY git_diff yes no no 0.04s
✅ REPOSITORY secretlint yes no no 1.1s
✅ REPOSITORY trufflehog yes no no 3.27s
✅ SPELL codespell 190 0 0 0.51s
⚠️ SPELL lychee 190 3 0 16.06s
✅ YAML prettier 6 0 0 0.31s
✅ YAML v8r 6 0 0 5.96s
✅ YAML yamllint 6 0 0 0.69s

Detailed Issues

⚠️ SPELL / lychee - 3 errors
📝 Summary
---------------------
🔍 Total.........1214
🔗 Unique.........907
✅ Successful....1107
⏳ Timeouts.........0
🔀 Redirected.......9
👻 Excluded.......104
❓ Unknown..........0
🚫 Errors...........3
⛔ Unsupported......3

Errors in .claude/skills/security-advisory/SKILL.md
[400] https://cveawg.mitre.org/api/cve/ (at 16:18) | Rejected status code: 400 Bad Request
[404] https://raw.githubusercontent.com/osism/ (at 17:18) | Rejected status code: 404 Not Found
[400] https://registry.osism.tech/service/token (at 18:19) | Rejected status code: 400 Bad Request

Hint: Followed 9 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@10.1.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_SECRETLINT,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,SPELL_CODESPELL,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

@ideaship
ideaship marked this pull request as ready for review October 18, 2026 15:13
@ideaship
ideaship requested a review from berendt October 18, 2026 15:13
@berendt
berendt merged commit 03cdd92 into main Oct 18, 2026
6 checks passed
@berendt
berendt deleted the loadbalancer-custom-ca-kolla branch October 18, 2026 16:02
@github-project-automation github-project-automation Bot moved this from New to Done in Human Board Oct 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

3 participants