From 2c9ec3a86f8e9073d3e5e85cf6b34e5e3d7e424f Mon Sep 17 00:00:00 2001
From: Daniel Lawton <dlawton@redhat.com>
Date: Thu, 5 Nov 2026 11:25:44 +0000
Subject: [PATCH] Set verify on AZ host_aggregate tasks for the admin cloud

The Availability Zones scenario creates/removes Nova host aggregates with the
openstack.cloud.host_aggregate module against the admin cloud. Unlike the other
admin openstack operations in the suite (e.g. the project_info lookup in
prepare/tasks/clouds.yml and the cleanup tasks), these three tasks omit the
`verify: "{{ admin_verify_cacert }}"` parameter, so openstacksdk verifies the
admin cloud's self-signed TLS certificate against the system trust store and
fails during prepare:

  SSL: CERTIFICATE_VERIFY_FAILED: self-signed certificate in certificate chain

Add `verify: "{{ admin_verify_cacert }}"` to the host_aggregate calls in
configure_az.yml and remove_az.yml, consistent with every other admin cloud
operation in the collection.

Change-Id: I99fd747fddb188f93d08e9f1d2722ab0f076aec9
Signed-off-by: Daniel Lawton <dlawton@redhat.com>
---
 collection/stages/roles/cleanup/tasks/remove_az.yml    | 2 ++
 collection/stages/roles/prepare/tasks/configure_az.yml | 1 +
 2 files changed, 3 insertions(+)

diff --git a/collection/stages/roles/cleanup/tasks/remove_az.yml b/collection/stages/roles/cleanup/tasks/remove_az.yml
index 5eb471fe..b8e4252f 100644
--- a/collection/stages/roles/cleanup/tasks/remove_az.yml
+++ b/collection/stages/roles/cleanup/tasks/remove_az.yml
@@ -10,6 +10,7 @@
 - name: Remove hosts from existing aggregates
   openstack.cloud.host_aggregate:
     cloud: "{{ admin_cloud }}"
+    verify: "{{ admin_verify_cacert }}"
     state: present
     name: "{{ item }}"
     hosts: []
@@ -19,6 +20,7 @@
 - name: Delete existing host aggregates
   openstack.cloud.host_aggregate:
     cloud: "{{ admin_cloud }}"
+    verify: "{{ admin_verify_cacert }}"
     state: absent
     name: "{{ item }}"
   loop: "{{ az_existing_aggregates.stdout_lines }}"
diff --git a/collection/stages/roles/prepare/tasks/configure_az.yml b/collection/stages/roles/prepare/tasks/configure_az.yml
index a1e079d3..251000dc 100644
--- a/collection/stages/roles/prepare/tasks/configure_az.yml
+++ b/collection/stages/roles/prepare/tasks/configure_az.yml
@@ -33,6 +33,7 @@
 - name: Create one host aggregate per compute host and assign its AZ
   openstack.cloud.host_aggregate:
     cloud: "{{ admin_cloud }}"
+    verify: "{{ admin_verify_cacert }}"
     state: present
     name: "HA-{{ az_idx }}"
     availability_zone: "AZ-{{ az_idx }}"