2025.2 Series Release Notes

17.0.1-9

Bug Fixes

  • Bug #2015320 Fixed a leak of Neutron VIP ports when the creation of a fully-populated load balancer failed. The VIP port is created before the listeners and pools of the graph are validated and counted against the project quota, and a failure in any of those steps rolled back the database transaction without removing the port that had already been created. Repeated attempts, for instance by a client that retries the same request, could exhaust the addresses of the VIP subnet. Ports supplied by the user with vip_port_id are never deleted.

  • Improving assignment of network interfaces in the amphora image to the correct namespace on reboot by ignoring alternative names and relying on the brief output of ip instead of transforming it in the pipe output.

  • Fixed a race condition in UDP/SCTP (keepalived-lvs) listeners where amphora-agent could report incorrect member and pool status (DOWN instead of a transitional state) when a heartbeat message was built between writing the new keepalived configuration file and completing the reload. A dedicated timestamp file is now used to detect this window and avoid false-positive error statuses.

  • Fixed the amphora member port being created without a fixed IP request. When a member network had more than one subnet, the port could get an address from a subnet other than the member subnet, leaving an extra fixed IP on the port. The member subnet is now passed to the port creation request.

  • Fixed an issue where creating a load balancer with vip_network_id would crash with an HTTP 500 error when the Octavia service user does not have access to the Neutron network-ip-availability API. The API will now return an HTTP 400 with a descriptive error message.

  • Fixed an error when creating a TLS-enabled pool with the fully populated load balancer API, the tls_ciphers, tls_versions and alpn_protocols parameters are now optional, as they already are in the pool API.

  • Fixed handling of cipher suites for TLSv1.3 in the generated HAProxy configuration in Amphorae. HAProxy uses a specific bind option ciphersuites for TLSv1.3. The new configuration option api_settings.tls1_3_supported_ciphers allows to adjust the list of ciphers that are only supported in TLS version 1.3 and later. Octavia will make sure the ciphers that are in this list will get moved to the ciphersuites option of the generated HAProxy configuration file if used.

  • Octavia worker after losing the session with ZooKeeper could not take jobs and the LB stayed in the pending state. Reusing the kazoo client caused a thread leak as each time the jobboard was called new listeners were added to the client, and taskflow does not remove them for the clients it does not own. The fix reverts the changes that added reusing of the client for ZooKeeper. The jobboard is accessible in the conductor, and there is no need to create a new client or reuse it. The jobboard is now reused from the conductor (bug #2170749).

  • Fix using dash symbol on start/end of value for l7rule. Previously it broke haproxy config. Now templates uses leading “–” to path any value.

17.0.1

Upgrade Notes

  • Existing amphorae with certificates missing the SKI and AKI extensions will need certificate rotation (handled by octavia-housekeeping) or failover to obtain new compliant certificates.

Security Issues

  • Fixed QoS policy validation to use the user’s request context when checking if a QoS policy exists. Previously, the validation used service credentials instead of the user’s context, which could allow a user to assign a QoS policy belonging to another tenant to their load balancer.

  • Fixed a HAProxy configuration injection vulnerability via the redirect_url and redirect_prefix fields on L7 policies. The rfc3986 URL validator encodes control characters before validation, so newlines and spaces passed structural checks but were stored raw and written directly into the HAProxy configuration. The URL validator now rejects URLs containing control characters (U+0000-U+001F, U+007F-U+009F) and spaces before passing them to rfc3986. Existing invalid values in the database are detected at config generation time and cleared.

  • Fixed a HAProxy configuration injection vulnerability via the tls_ciphers field on listeners and pools. The field was not validated for control characters, allowing an attacker to inject arbitrary HAProxy configuration directives by embedding newlines in the cipher string. The API now rejects cipher strings containing characters outside the set allowed by OpenSSL (alphanumeric, -, +, !, :, @, =, _, .). Existing invalid values in the database are detected at config generation time and replaced with the configured defaults.

Bug Fixes

  • Fixed an issue where amphora certificates generated by the local certificate generator were missing the Subject Key Identifier (SKI) and Authority Key Identifier (AKI) X.509 extensions. This caused TLS handshake failures when using Python 3.13+ or OpenSSL with strict X.509 verification enabled, as these environments now enforce RFC 5280 compliance by default.

  • Fixes infinite database connection retry loop in Octavia Health Worker. LP#2129562

  • Fixed HAProxy config generation when both cpu-map (multi vCPU amphora) and external-check (PING health monitor) are enabled. A missing newline in the Jinja2 template caused external-check to be appended to the cpu-map line, resulting in a fatal HAProxy configuration error.

  • Drivers which fail to initialize are now properly removed from the list of enabled drivers. A previous patch updated octavia-api so that drivers which fail to initialize are skipped instead of causing the whole API process to error out. The intention was to remove these failed drivers from the list of enabled drivers dynamically, but this removal was being overridden by other configuration code. The removal of these failing drivers should now persist until service restart.

  • Fix an issue that prevents the Octavia API service to be correctly initialized when it fails to load a provider driver. It will now fail gracefully and remove the driver from the enabled list.

  • Fixed continuous ZooKeeper session churn in ZookeeperTaskFlowDriver where a new KazooClient was created and immediately closed on every _extend_jobs() cycle (~every 8 seconds), causing kazoo.exceptions.ConnectionLoss errors in the Octavia worker log during load balancer operations (bug #2144800).

17.0.0

New Features

  • Added volume zone to availability zone profile for amphorae backend for creating loadbalancer with specific volume availability zone

  • The service role now has access to list members in a pool, this is needed by Aodh to evaluate unhealthy members in a pool when doing evaluations.

  • A new module, octavia.wsgi, has been added as a place to gather WSGI application objects. This is intended to ease deployment by providing a consistent location for these objects. For example, if using uWSGI then instead of:

    [uwsgi]
wsgi-file = /bin/octavia-wsgi

    You can now use:

    [uwsgi]
module = octavia.wsgi.api:application

    This also simplifies deployment with other WSGI servers that expect module paths such as gunicorn.

  • Added support for multiple Fernet keys in the [certificates]/server_certs_key_passphrase configuration option by changing it to a ListOpt. The first key is used for encryption and other keys is used for decryption adding support for rotating the passphrase.

Upgrade Notes

  • UDP load balancers will require a failover to fix the UDP rebalance issue once the control plane is updated.

  • The default TLS cipher suite list has been updated to the current ‘intermediate’ recommendations. Load balancers will need to be failed over to use the new default list if the operator and user opted for the Octavia default cipher list.

  • The WSGI script octavia-wsgi has been removed. Deployment tooling should instead reference the Python module path for the wsgi module in Octavia, octavia.wsgi.api:application if their chosen WSGI server supports this (gunicorn, uWSGI, etc.) or implement a .wsgi script themselves if not (mod_wsgi).

  • The [certificates]/server_certs_key_passphrase configuration option is now a ListOpt so multiple keys can be specified, the first key is used for encryption and other keys is used for decryption adding support for rotating the passphrase.

  • diskimage-create.sh has been updated to build Ubuntu Noble (24.04) amphora images per default.

Security Issues

  • Updated the default TLS cipher suites based on current OWASP/Mozilla.org recommendations for Intermediate compatibility. The new default list is:

    • TLS_AES_128_GCM_SHA256

    • TLS_AES_256_GCM_SHA384

    • TLS_CHACHA20_POLY1305_SHA256

    • ECDHE-ECDSA-AES128-GCM-SHA256

    • ECDHE-RSA-AES128-GCM-SHA256

    • ECDHE-ECDSA-AES256-GCM-SHA384

    • ECDHE-RSA-AES256-GCM-SHA384

    • ECDHE-ECDSA-CHACHA20-POLY1305

    • ECDHE-RSA-CHACHA20-POLY1305

    • DHE-RSA-AES128-GCM-SHA256

    • DHE-RSA-AES256-GCM-SHA384

    • DHE-RSA-CHACHA20-POLY1305

Bug Fixes

  • Fixed a bug where the Amphora configuration update would only update the Amphora agent configuration, but the health sender would not be updated with the new controller IP list.

  • Fixed an issue where UDP listeners may not rebalance failed member servers in a timely fashion. It may have been up to five minutes for a failed member server to be removed from existing flows.

  • Fixed a bug that caused SSH to not be diabled in amphora images created with the “-n” flag.

  • Fixes the error reporting when a user requests a VIP IP address that is already in use.

  • Ignore serialization loadbalancer class in GetAmphoraNetworkConfigs tasks. It allows to avoid storing full graph in jobboard details. It fixes cases with enabled jobboard for huge LBs with ~2000+ resources in graph.

  • Fixes an error message translation in the controller worker to support the i18n translate before adding dynamic values.

  • Reduce the value of tune.ssl.cachesize for HTTPS termination listeners to prevent OOM during haproxy reload (LP: #2119987).

  • Fixed an issue with HAProxy configuration files when using http_version or domain_name attributes in healthmonitor. The generated configuration files used deprecated/removed features from HAProxy, the fix updates the HAProxy templates to support recent releases.

  • Fixed a bug when using a L7Rule with FILE_TYPE and EQUAL_TO comparison, it never matched due to an issue with the generated HAProxy configuration.

  • Fixed missing port_id element when getting the additional_vips parameter of a load balancer.

  • Fix a potential race condition during the cascade deletion of load balancers. When deleting a load balancer with multiple listeners, the security groups of the VIP port may have been updated many times concurrently, creating a race condition.

  • Make [task_flow].persistence_connection configuration setting secret, so it is not displayed when starting the Octavia applications in debug mode.