2026.1 Series Release Notes

18.0.1-14

Security Issues

  • Fixed an issue where the L7 Policy ID wasn’t being checked for PUT/DELETE requests for L7 Rules. This allowed a user to update or delete the L7 Rules for another user provided they knew that user’s L7 Rule ID

  • Fixed Bug 2171383 where Pool POST requests that supplied both loadbalancer_id and listener_id never loaded or validated the listener UUID was owned by the caller. The API now validates that a supplied listener_id belongs to the named (or implied) loadbalancer_id and returns 404 otherwise. Two related defense-in-depth issues in the database layer were also fixed: a missing join in the pool/load balancer sanity check that could accept a pool from an unrelated load balancer, and a provisioning status update that could lock an unrelated listener.

  • Fixed a gap in the validation of member subnets. When creating a fully populated load balancer, or when updating the subnet of an existing member with the batch member update API, Octavia did not check that the user had access to the member subnet. A user who knew the ID of a subnet they could not access could make Octavia plug an amphora into it. These requests are now rejected if the subnet is not visible to the user.

Bug Fixes

  • Bug #2015320 Fixed a leak of Neutron VIP ports when the creation of a fully-populated load balancer failed. The VIP port is created before the listeners and pools of the graph are validated and counted against the project quota, and a failure in any of those steps rolled back the database transaction without removing the port that had already been created. Repeated attempts, for instance by a client that retries the same request, could exhaust the addresses of the VIP subnet. Ports supplied by the user with vip_port_id are never deleted.

  • Fixed the gunicorn syslog socket path in the amphora agent to use an absolute path (unix:///run/rsyslog/octavia/log#dgram). Previously, the relative path caused logging failures when the amphora agent was run with a non-root working directory.

  • Fixed a race condition in UDP/SCTP (keepalived-lvs) listeners where amphora-agent could report incorrect member and pool status (DOWN instead of a transitional state) when a heartbeat message was built between writing the new keepalived configuration file and completing the reload. A dedicated timestamp file is now used to detect this window and avoid false-positive error statuses.

  • Fixed the amphora member port being created without a fixed IP request. When a member network had more than one subnet, the port could get an address from a subnet other than the member subnet, leaving an extra fixed IP on the port. The member subnet is now passed to the port creation request.

  • Fixed an issue where creating a load balancer with vip_network_id would crash with an HTTP 500 error when the Octavia service user does not have access to the Neutron network-ip-availability API. The API will now return an HTTP 400 with a descriptive error message.

  • Fixed an error when creating a TLS-enabled pool with the fully populated load balancer API, the tls_ciphers, tls_versions and alpn_protocols parameters are now optional, as they already are in the pool API.

  • Fixed handling of cipher suites for TLSv1.3 in the generated HAProxy configuration in Amphorae. HAProxy uses a specific bind option ciphersuites for TLSv1.3. The new configuration option api_settings.tls1_3_supported_ciphers allows to adjust the list of ciphers that are only supported in TLS version 1.3 and later. Octavia will make sure the ciphers that are in this list will get moved to the ciphersuites option of the generated HAProxy configuration file if used.

  • Fixed a leak of base (VRRP) ports when allowed address pair or security group configuration fails while plugging the VIP to an amphora. Ports created by the failed operation are now detached and deleted.

  • Octavia worker after losing the session with ZooKeeper could not take jobs and the LB stayed in the pending state. Reusing the kazoo client caused a thread leak as each time the jobboard was called new listeners were added to the client, and taskflow does not remove them for the clients it does not own. The fix reverts the changes that added reusing of the client for ZooKeeper. The jobboard is accessible in the conductor, and there is no need to create a new client or reuse it. The jobboard is now reused from the conductor (bug #2170749).

  • Fix using dash symbol on start/end of value for l7rule. Previously it broke haproxy config. Now templates uses leading “–” to path any value.

18.0.1

Upgrade Notes

  • Existing amphorae with certificates missing the SKI and AKI extensions will need certificate rotation (handled by octavia-housekeeping) or failover to obtain new compliant certificates.

Security Issues

  • Fixed QoS policy validation to use the user’s request context when checking if a QoS policy exists. Previously, the validation used service credentials instead of the user’s context, which could allow a user to assign a QoS policy belonging to another tenant to their load balancer.

  • Fixed a HAProxy configuration injection vulnerability via the redirect_url and redirect_prefix fields on L7 policies. The rfc3986 URL validator encodes control characters before validation, so newlines and spaces passed structural checks but were stored raw and written directly into the HAProxy configuration. The URL validator now rejects URLs containing control characters (U+0000-U+001F, U+007F-U+009F) and spaces before passing them to rfc3986. Existing invalid values in the database are detected at config generation time and cleared.

  • Fixed a HAProxy configuration injection vulnerability via the tls_ciphers field on listeners and pools. The field was not validated for control characters, allowing an attacker to inject arbitrary HAProxy configuration directives by embedding newlines in the cipher string. The API now rejects cipher strings containing characters outside the set allowed by OpenSSL (alphanumeric, -, +, !, :, @, =, _, .). Existing invalid values in the database are detected at config generation time and replaced with the configured defaults.

Bug Fixes

  • Fixed amphora certificate generation when the issuing CA’s Subject Key Identifier (SKI) was not derived using SHA-1. The amphora certificate’s Authority Key Identifier (AKI) is now copied from the CA certificate’s SKI, with public-key derivation retained as a fallback for CAs without an SKI. This restores compatibility with CAs generated by cert-manager 1.20 and other issuers using a different SKI derivation algorithm.

  • Fixed an issue where amphora certificates generated by the local certificate generator were missing the Subject Key Identifier (SKI) and Authority Key Identifier (AKI) X.509 extensions. This caused TLS handshake failures when using Python 3.13+ or OpenSSL with strict X.509 verification enabled, as these environments now enforce RFC 5280 compliance by default.

  • Fixed HAProxy config generation when both cpu-map (multi vCPU amphora) and external-check (PING health monitor) are enabled. A missing newline in the Jinja2 template caused external-check to be appended to the cpu-map line, resulting in a fatal HAProxy configuration error.

  • Improving assignment of network interfaces in the amphora image to the correct namespace on reboot by ignoring alternative names and relying on the brief output of ip instead of transforming it in the pipe output.

  • Fixed a crash in octavia-worker under Python 3.14. Python 3.14 changed the default multiprocessing start method from fork to forkserver on Linux. The forkserver method requires pickling all arguments passed to child processes, which fails for oslo_config.ConfigOpts due to an unpicklable lambda inside _ConfigFileOpt.__init__. cotyledon.ServiceManager is now created with an explicit fork context to preserve the previous behaviour. (see https://bugs.launchpad.net/octavia/+bug/2156391)

  • Fixed the octavia-health-manager, octavia-driver-agent and amphora-agent daemons under Python 3.14. Python 3.14 changed the default multiprocessing start method from fork to forkserver on Linux. With forkserver the child processes no longer inherit the parsed configuration from the parent process and fell back to the default SQLite database instead of the configured one. These daemons now spawn their child processes with an explicit fork start method, like it was done before Python 3.14. (see https://bugs.launchpad.net/octavia/+bug/2156391)

  • Fixed continuous ZooKeeper session churn in ZookeeperTaskFlowDriver where a new KazooClient was created and immediately closed on every _extend_jobs() cycle (~every 8 seconds), causing kazoo.exceptions.ConnectionLoss errors in the Octavia worker log during load balancer operations (bug #2144800).

18.0.0

New Features

  • Add support for Centos 10 Stream and Rocky 10.

Bug Fixes

  • Fixed a bug where the Amphora configuration update would only update the Amphora agent configuration, but the health sender would not be updated with the new controller IP list.

  • Fixed a bug with the Amphora Delete API call, the call was ignored by the Amphora driver to due misconfiguration of the RPC.

  • Fixes infinite database connection retry loop in Octavia Health Worker. LP#2129562

  • Drivers which fail to initialize are now properly removed from the list of enabled drivers. A previous patch updated octavia-api so that drivers which fail to initialize are skipped instead of causing the whole API process to error out. The intention was to remove these failed drivers from the list of enabled drivers dynamically, but this removal was being overridden by other configuration code. The removal of these failing drivers should now persist until service restart.

  • Fix an issue that prevents the Octavia API service to be correctly initialized when it fails to load a provider driver. It will now fail gracefully and remove the driver from the enabled list.

  • Fixed an issue in the amphora-agent API where it would generate spurious log messages when tuned isn’t installed and the profile file doesn’t exist

  • The [cinder] volume_size option no longer accepts 0 or a negative value and octavia services may fail to start when these values are used. These were accepted previously but caused an internal error when a volume is actually created.

  • Now the following options accept values which are actually supported, and usage of an unsupported value may cause octavia services to fail to start. Previously unsupported values were accepted and caused failures in actual resource creation.

    • [api_settings] default_listener_tls_versions

    • [api_settings] default_pool_tls_versions

    • [api_settings] default_listener_alpn_protocols

    • [api_settings] default_pool_alpn_protocols

    See octavia.conf file generated by the oslo-config-generator tool to find supported values.

Other Notes

  • Removed unused amphora-related code including the get_create_amphora_flow function, MarkAmphoraReadyInDB task class, MARK_AMPHORA_READY_INDB constant, and AMPHORA_READY status constant. Updated amphora deletion logic to only allow deletion when amphora status is ERROR, which is the correct behavior since AMPHORA_ALLOCATED amphorae should not be deletable.