2025.1 Series Release Notes

16.0.0-4

Bug Fixes

  • Ignore serialization loadbalancer class in GetAmphoraNetworkConfigs tasks. It allows to avoid storing full graph in jobboard details. It fixes cases with enabled jobboard for huge LBs with ~2000+ resources in graph.

  • Reduce the value of tune.ssl.cachesize for HTTPS termination listeners to prevent OOM during haproxy reload (LP: #2119987).

Other Notes

  • Added a “octavia-wsgi” script for backward compatibility now that pbr’s wsgi_scripts no longer functions with the latest setuptools.

16.0.0

New Features

  • Octavia Amphora based load balancers now support using SR-IOV virtual functions (VF) on the member ports.

  • Add the vip_sg_ids parameter to the load-balancer POST API. It allows to set a list of user-defined Neutron Security Groups on the VIP port of the Load Balancer.

  • Add the vip_sg_ids parameter to the Amphora driver, a list of Neutron Security Groups. When set, the Amphora driver applies the Security Groups to the VIP port of the Load Balancer. It also doesn’t set any Security Group Rules related to the Listeners on this ports, however it adds Security Groups Rules for VRRP and haproxy peers when needed. This feature does not work with SR-IOV ports as Neutron does not support Security Groups on these ports.

  • Added support for the Jobboard Etcd backend in Taskflow.

  • The new [task_flow] jobboard_redis_backend_db option has been added. This option allows using non default database in redis as backend.

Upgrade Notes

  • You must update the amphora image to support the SR-IOV member port feature.

  • When upgrading, the default RBAC rules will switch from Octavia Advanced RBAC to the keystone default roles. This means the load_balancer_* roles will not longer have access to the load balancer API. To continue to use the Octavia Advanced RBAC rules, please use the octavia-advanced-rbac-policy.yaml override file provided.

Critical Issues

  • When upgrading, the default RBAC rules will switch from Octavia Advanced RBAC to the keystone default roles. This means the load_balancer_* roles will not longer have access to the load balancer API. To continue to use the Octavia Advanced RBAC rules, please use the octavia-advanced-rbac-policy.yaml override file provided.

Security Issues

  • When upgrading, the default RBAC rules will switch from Octavia Advanced RBAC to the keystone default roles. This means the load_balancer_* roles will not longer have access to the load balancer API. To continue to use the Octavia Advanced RBAC rules, please use the octavia-advanced-rbac-policy.yaml override file provided. Note: the keystone default roles are less restrictive than the Octavia Advanced RBAC rules and you will no longer have global observer or quota specific roles.

Bug Fixes

  • Remove record in amphora_health table on revert. It’s necessary, because record in amphora table for corresponding amphora also deleted. It allows to avoid false positive react of failover threshold due to orphan records in amphora_health table.

  • Fixed potential AttributeError during listener update when security group rule had no protocol defined (ie. it was null).

  • Fixed an issue with SINGLE topology load balancer with UDP listeners, the Amphora now sends a Gratuitous ARP packet when a UDP pool is added, it makes the VIP address more quickly reachable after a failover or when reusing a previously allocated IP address.

  • Fix verification of certificates signed by a private CA when using Neutron endpoints.

  • Fix error on revert PlugVIPAmphora task, when db_lb is not defined and get_subnet raises NotFound error. It could happen when Amphora creation failed by timeout and before it VIP network was removed. As result revert failed with exception.