Ensure root.crt cert exists for proxysql

[Alex-Welsh]

Without this, proxysql upgrade to Gazpacho will fail saying
ERROR MissingRequiredSource: /var/lib/kolla/config_files/ca-certificates/root.crt file is not found etc/kayobe/ansible/secret-store/secret-store-generate-internal-tls.yml

[seunghun1ee]

Thanks for catching this

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c87e9142-98f8-44d6-8adf-947745b35936

📥 Commits

Reviewing files that changed from the base of the PR and between 4fd9e9b and c930839.

📒 Files selected for processing (2)

• doc/source/operations/upgrading-openstack.rst
• etc/kayobe/ansible/secret-store/secret-store-generate-internal-tls.yml

📜 Recent review details

🧰 Additional context used

🧠 Learnings (2)

📚 Learning: 2026-08-03T13:37:36.733Z

Learnt from: seunghun1ee
Repo: stackhpc/stackhpc-kayobe-config PR: 2477
File: etc/kayobe/ansible/secret-store/get-current-raft-leader.yml:30-42
Timestamp: 2026-08-03T13:37:36.733Z
Learning: For OpenBao-related Ansible playbooks under etc/kayobe/ansible/secret-store/, do not require task-local use_proxy settings or proxy environment overrides when Kayobe configures proxy behavior elsewhere. Only flag missing local proxy overrides when the playbook has an explicit requirement to bypass the configured proxy.

Applied to files:

• etc/kayobe/ansible/secret-store/secret-store-generate-internal-tls.yml

📚 Learning: 2026-08-03T13:37:39.350Z

Learnt from: seunghun1ee
Repo: stackhpc/stackhpc-kayobe-config PR: 2477
File: etc/kayobe/ansible/secret-store/get-current-raft-leader.yml:30-42
Timestamp: 2026-08-03T13:37:39.350Z
Learning: For OpenBao-related Ansible playbooks in `etc/kayobe/ansible/secret-store/`, Kayobe configures proxy behavior elsewhere. Do not require task-local `use_proxy` or proxy environment overrides unless the playbook has a specific requirement to bypass the configured proxy.

Applied to files:

• doc/source/operations/upgrading-openstack.rst

🔇 Additional comments (2)

etc/kayobe/ansible/secret-store/secret-store-generate-internal-tls.yml (1)

54-58: LGTM!

doc/source/operations/upgrading-openstack.rst (1)

75-75: LGTM!

Also applies to: 82-82

---

📝 Walkthrough

Add the required root.crt certificate to ProxySQL’s certificate verification list. Copy the root CA to both Kayobe secret-store paths so ProxySQL upgrades to Gazpacho can complete successfully.

Walkthrough

The internal TLS task now writes the root CA certificate to two paths. The OpenStack upgrade documentation checks the new root.crt path in both Kayobe certificate locations.

Changes

Root CA certificate availability

Layer / File(s)	Summary
Write root CA certificate copies etc/kayobe/ansible/secret-store/secret-store-generate-internal-tls.yml	The task writes the root CA certificate to the existing secret-store path and root.crt. The file mode remains 0600.
Document root CA checks doc/source/operations/upgrading-openstack.rst	The upgrade procedure checks ca/root.crt in the standard and environment-specific Kayobe certificate directories.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}