[ideaship]

The loadbalancer configuration guide does not mention the files ProxySQL needs once internal TLS is on, and its TLS procedure leaves some of the files it has the operator create uncommitted. Two commits:

1. Commit everything the procedures add. Step 4 of the general procedure committed an explicit list of three files. The self-signed procedure, which ends by running the general procedure, also adds the custom CA under environments/kolla/certificates/ca/, certificates_ca in environments/configuration.yml and, up to OSISM 11.0.1, the REQUESTS_CA_BUNDLE override in environments/manager/configuration.yml. None of them was committed, so the next configuration sync on the manager reset them. Step 4 now stages the whole certificates directory, and the self-signed procedure names the two extra files.
2. ProxySQL and internal TLS. database_enable_tls_internal defaults to kolla_enable_tls_internal and enable_proxysql, and osism/defaults enables ProxySQL for every OpenStack series after 2025.1. From OSISM 11 on, any deployment with internal TLS therefore needs ProxySQL's own certificate, key and CA, or osism apply loadbalancer fails at Copying over proxysql-cert.pem. A new subsection gives the two options: supply the files (certificate and key separately, only the key vault-encrypted), or set database_enable_tls_internal: "no".
   • It describes how the CA is looked up. From OSISM 11 on, proxysql-ca.pem is used when it exists; otherwise, and always on OSISM 10, ProxySQL reads certificates/ca/root.crt under that fixed name. That fallback only works with kolla_copy_ca_into_containers: "yes", which is off by default. The self-signed section gets a matching warning.
   • It covers the comment-only placeholders that cfg-cookiecutter generates for all three files. A proxysql-ca.pem placeholder left in place is handed to ProxySQL as its CA.
   • Step 2 of the general procedure points to the subsection, and the ProxySQL section says it is the default from OSISM 11 on.

🤖 Generated with Claude Code

[github-actions]

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
✅ ACTION	actionlint	5		0		0	0.04s
✅ JSON	jsonlint	4		0		0	0.07s
✅ JSON	prettier	4		0		0	0.31s
✅ JSON	v8r	4		0		0	8.36s
✅ MARKDOWN	markdownlint	183		0		0	1.74s
✅ MARKDOWN	markdown-table-formatter	183		0		0	0.2s
✅ REPOSITORY	betterleaks	yes		no		no	0.53s
✅ REPOSITORY	checkov	yes		no		no	13.88s
✅ REPOSITORY	git_diff	yes		no		no	0.05s
✅ REPOSITORY	secretlint	yes		no		no	0.91s
✅ REPOSITORY	trufflehog	yes		no		no	2.67s
✅ SPELL	codespell	193		0		0	0.31s
⚠️ SPELL	lychee	193		5		0	18.11s
✅ YAML	prettier	6		0		0	0.21s
✅ YAML	v8r	6		0		0	4.41s
✅ YAML	yamllint	6		0		0	0.26s

Detailed Issues

⚠️ SPELL / lychee - 5 errors

📝 Summary
---------------------
🔍 Total.........1253
🔗 Unique.........928
✅ Successful....1139
⏳ Timeouts.........0
🔀 Redirected.......9
👻 Excluded.......109
❓ Unknown..........0
🚫 Errors...........5
⛔ Unsupported......5

Errors in .claude/skills/security-advisory/reference/style.md
[ERROR] file://.claude/skills/guides/operations-guide/openstack/security-updates.md (at 189:3) | File not found. Check if file exists and path is correct

Errors in .claude/skills/security-advisory/SKILL.md
[400] https://cveawg.mitre.org/api/cve/ (at 16:18) | Rejected status code: 400 Bad Request
[404] https://raw.githubusercontent.com/osism/ (at 17:18) | Rejected status code: 404 Not Found
[400] https://registry.osism.tech/service/token (at 18:19) | Rejected status code: 400 Bad Request

Errors in docs/guides/developer-guide/style-guide.md
[ERROR] https://wiki.openstack.org/wiki/GitCommitMessages (at 79:1) | Network unreachable. Check internet connection or VPN settings

Hint: Followed 9 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@10.1.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_SECRETLINT,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,SPELL_CODESPELL,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository