Current Series Release Notes¶

19.0.0-29¶

The following options of the haproxy_amphora section have been removed.
- respawn_count
- respawn_interval

Hardened the local_cert_manager (LocalCertManager) against path traversal. Certificate and secret references are now validated to be plain filenames before being used to build filesystem paths, preventing a reference such as ../../etc/passwd or an absolute path from reading or deleting files outside of the configured [certificates] storage_path. Note that LocalCertManager is a development/testing backend only and is not used by the default (Barbican) configuration, so production deployments were not affected.

Bug #2015320 Fixed a leak of Neutron VIP ports when the creation of a fully-populated load balancer failed. The VIP port is created before the listeners and pools of the graph are validated and counted against the project quota, and a failure in any of those steps rolled back the database transaction without removing the port that had already been created. Repeated attempts, for instance by a client that retries the same request, could exhaust the addresses of the VIP subnet. Ports supplied by the user with vip_port_id are never deleted.

Fixed a bug in the revert function of the AllocateVIP task, an unrelated error message appeared when Octavia failed to create a load balancer.

octavia-db-manage now configures logging after the configuration file has been parsed. It previously set logging up at import time, when [DEFAULT] log_config_append was still unset, so the database migration commands ignored the configured logging setup and always emitted plain text.

Fixed driver-agent request handlers spinning indefinitely when a client disconnects before sending a complete message. Incomplete message headers and payloads are now rejected, allowing the handler process to exit instead of consuming CPU and occupying a worker slot. This affects the status, statistics and get listeners.

Fixed the gunicorn syslog socket path in the amphora agent to use an absolute path (unix:///run/rsyslog/octavia/log#dgram). Previously, the relative path caused logging failures when the amphora agent was run with a non-root working directory.

Fixed an issue where some of the get_all_API_list calls were using inconsistent DB queries. This was likely due to ordering requirements in the response which are no longer relevant since pagination works. Updated to use the get_all_orm call to be consistent with other endpoints

Fixed a race condition in UDP/SCTP (keepalived-lvs) listeners where amphora-agent could report incorrect member and pool status (DOWN instead of a transitional state) when a heartbeat message was built between writing the new keepalived configuration file and completing the reload. A dedicated timestamp file is now used to detect this window and avoid false-positive error statuses.

Fixed an issue where creating a load balancer with vip_network_id would crash with an HTTP 500 error when the Octavia service user does not have access to the Neutron network-ip-availability API. The API will now return an HTTP 400 with a descriptive error message.

Fixed an error when creating a TLS-enabled pool with the fully populated load balancer API, the tls_ciphers, tls_versions and alpn_protocols parameters are now optional, as they already are in the pool API.

Fix using dash symbol on start/end of value for l7rule. Previously it broke haproxy config. Now templates uses leading “–” to path any value.

LocalCertManager now logs a warning when instantiated, stating that it is intended for development and testing purposes only and must not be used in production.