---
features:
  - |
    Self-signed TLS certificates can be used to test TLS in a
    development OpenStack environment. The ``kolla-ansible certificates``
    command will generate the required self-signed TLS certificates. This
    command has been updated to first create a self-signed root certificate
    authority. The command then generates the internal and external facing
    certificates and signs them using the root CA. If backend TLS is enabled,
    the command will generate the backend certificate and sign it with the
    root CA.
upgrade:
  - |
    Replaced ``kolla_external_fqdn_cacert`` and ``kolla_internal_fqdn_cacert``
    with ``kolla_admin_openrc_cacert``, which by default is not set.
    ``OS_CACERT`` is now set to the value of ``kolla_admin_openrc_cacert`` in
    the generated ``admin-openrc.sh`` file.