Current Series Release Notes¶

19.0.0-45¶

Added a new [api_settings] default_availability_zone configuration option that allows operators to set a default Octavia availability zone for new load balancers. When a load balancer is created without specifying an availability zone, this configured default will be used if the referenced availability zone exists and is enabled in Octavia.

HTTP 500 responses from the Amphora agent now include additional exception details, improving error visibility from the controller worker logs (fixes bug #2085090).

To benefit from this change, the Amphora image must be rebuilt and rotated.

The following options of the haproxy_amphora section have been removed.
- respawn_count
- respawn_interval

Fixed an issue where the L7 Policy ID wasn’t being checked for PUT/DELETE requests for L7 Rules. This allowed a user to update or delete the L7 Rules for another user provided they knew that user’s L7 Rule ID

Fixed Bug 2171383 where Pool POST requests that supplied both loadbalancer_id and listener_id never loaded or validated the listener UUID was owned by the caller. The API now validates that a supplied listener_id belongs to the named (or implied) loadbalancer_id and returns 404 otherwise. Two related defense-in-depth issues in the database layer were also fixed: a missing join in the pool/load balancer sanity check that could accept a pool from an unrelated load balancer, and a provisioning status update that could lock an unrelated listener.

Hardened the local_cert_manager (LocalCertManager) against path traversal. Certificate and secret references are now validated to be plain filenames before being used to build filesystem paths, preventing a reference such as ../../etc/passwd or an absolute path from reading or deleting files outside of the configured [certificates] storage_path. Note that LocalCertManager is a development/testing backend only and is not used by the default (Barbican) configuration, so production deployments were not affected.

Fixed a gap in the validation of member subnets. When creating a fully populated load balancer, or when updating the subnet of an existing member with the batch member update API, Octavia did not check that the user had access to the member subnet. A user who knew the ID of a subnet they could not access could make Octavia plug an amphora into it. These requests are now rejected if the subnet is not visible to the user.

Fixes bug #2085090 by enhancing HTTP 500 responses from the Amphora agent. On failure, responses now include exception details sent to the controller worker instead of an empty HTTP 500, making it easier for operators to understand and diagnose errors.

Bug #2015320 Fixed a leak of Neutron VIP ports when the creation of a fully-populated load balancer failed. The VIP port is created before the listeners and pools of the graph are validated and counted against the project quota, and a failure in any of those steps rolled back the database transaction without removing the port that had already been created. Repeated attempts, for instance by a client that retries the same request, could exhaust the addresses of the VIP subnet. Ports supplied by the user with vip_port_id are never deleted.

Fixed a bug in the revert function of the AllocateVIP task, an unrelated error message appeared when Octavia failed to create a load balancer.

octavia-db-manage now configures logging after the configuration file has been parsed. It previously set logging up at import time, when [DEFAULT] log_config_append was still unset, so the database migration commands ignored the configured logging setup and always emitted plain text.

Fixed an issue where the load balancer’s availability_zone field was always set to None when no availability zone was explicitly specified during creation, even when a default was intended. (bug 2113812)

Fixed driver-agent request handlers spinning indefinitely when a client disconnects before sending a complete message. Incomplete message headers and payloads are now rejected, allowing the handler process to exit instead of consuming CPU and occupying a worker slot. This affects the status, statistics and get listeners.

Fixed the gunicorn syslog socket path in the amphora agent to use an absolute path (unix:///run/rsyslog/octavia/log#dgram). Previously, the relative path caused logging failures when the amphora agent was run with a non-root working directory.

Fixed an issue where some of the get_all_API_list calls were using inconsistent DB queries. This was likely due to ordering requirements in the response which are no longer relevant since pagination works. Updated to use the get_all_orm call to be consistent with other endpoints

Fixed a race condition in UDP/SCTP (keepalived-lvs) listeners where amphora-agent could report incorrect member and pool status (DOWN instead of a transitional state) when a heartbeat message was built between writing the new keepalived configuration file and completing the reload. A dedicated timestamp file is now used to detect this window and avoid false-positive error statuses.

Fixed an issue where creating a load balancer with vip_network_id would crash with an HTTP 500 error when the Octavia service user does not have access to the Neutron network-ip-availability API. The API will now return an HTTP 400 with a descriptive error message.

Fixed ComputeRetry and AmpRetry discarding the configured retry budget when taskflow presents a failed attempt with no recorded outcomes. Both controllers placed every retry decision inside the loop over the attempt’s outcomes, so an empty mapping fell through to REVERT_ALL on the first attempt, regardless of [controller_worker] amp_active_retries or [haproxy_amphora] connection_max_retries. During amphora creation this abandoned an instance that was already booting and left it allocated. The retry budget is now the authority, matching SleepingRetryTimesController.

Fixed an error when creating a TLS-enabled pool with the fully populated load balancer API, the tls_ciphers, tls_versions and alpn_protocols parameters are now optional, as they already are in the pool API.

Fixed a leak of base (VRRP) ports when allowed address pair or security group configuration fails while plugging the VIP to an amphora. Ports created by the failed operation are now detached and deleted.

Octavia worker after losing the session with ZooKeeper could not take jobs and the LB stayed in the pending state. Reusing the kazoo client caused a thread leak as each time the jobboard was called new listeners were added to the client, and taskflow does not remove them for the clients it does not own. The fix reverts the changes that added reusing of the client for ZooKeeper. The jobboard is accessible in the conductor, and there is no need to create a new client or reuse it. The jobboard is now reused from the conductor (bug #2170749).

Fix using dash symbol on start/end of value for l7rule. Previously it broke haproxy config. Now templates uses leading “–” to path any value.

LocalCertManager now logs a warning when instantiated, stating that it is intended for development and testing purposes only and must not be used in production.