Current Series Release Notes¶

19.0.0-27¶

The following options of the haproxy_amphora section have been removed.
- respawn_count
- respawn_interval

Hardened the local_cert_manager (LocalCertManager) against path traversal. Certificate and secret references are now validated to be plain filenames before being used to build filesystem paths, preventing a reference such as ../../etc/passwd or an absolute path from reading or deleting files outside of the configured [certificates] storage_path. Note that LocalCertManager is a development/testing backend only and is not used by the default (Barbican) configuration, so production deployments were not affected.

Bug #2015320 Fixed a leak of Neutron VIP ports when the creation of a fully-populated load balancer failed. The VIP port is created before the listeners and pools of the graph are validated and counted against the project quota, and a failure in any of those steps rolled back the database transaction without removing the port that had already been created. Repeated attempts, for instance by a client that retries the same request, could exhaust the addresses of the VIP subnet. Ports supplied by the user with vip_port_id are never deleted.

Fixed a bug in the revert function of the AllocateVIP task, an unrelated error message appeared when Octavia failed to create a load balancer.

octavia-db-manage now configures logging after the configuration file has been parsed. It previously set logging up at import time, when [DEFAULT] log_config_append was still unset, so the database migration commands ignored the configured logging setup and always emitted plain text.

Fixed the gunicorn syslog socket path in the amphora agent to use an absolute path (unix:///run/rsyslog/octavia/log#dgram). Previously, the relative path caused logging failures when the amphora agent was run with a non-root working directory.

Fixed an issue where some of the get_all_API_list calls were using inconsistent DB queries. This was likely due to ordering requirements in the response which are no longer relevant since pagination works. Updated to use the get_all_orm call to be consistent with other endpoints

Fixed a race condition in UDP/SCTP (keepalived-lvs) listeners where amphora-agent could report incorrect member and pool status (DOWN instead of a transitional state) when a heartbeat message was built between writing the new keepalived configuration file and completing the reload. A dedicated timestamp file is now used to detect this window and avoid false-positive error statuses.

Fixed an issue where creating a load balancer with vip_network_id would crash with an HTTP 500 error when the Octavia service user does not have access to the Neutron network-ip-availability API. The API will now return an HTTP 400 with a descriptive error message.

Fixed an error when creating a TLS-enabled pool with the fully populated load balancer API, the tls_ciphers, tls_versions and alpn_protocols parameters are now optional, as they already are in the pool API.

Fix using dash symbol on start/end of value for l7rule. Previously it broke haproxy config. Now templates uses leading “–” to path any value.

LocalCertManager now logs a warning when instantiated, stating that it is intended for development and testing purposes only and must not be used in production.