openstack/kolla-ansible.git/ansible/roles/loadbalancer/tasks/config.yml, branch stable/2026.1

[stable-only] Split CA of ProxySQL internal TLS and backend TLS

2026-07-22T13:15:30+00:00

ProxySQL frontend TLS (database internal TLS) and backend TLS (database backend TLS) expects different CA if users use chain of certificates (e.g. use of intermediate certificates). Frontend TLS expects the intermediate certificate that signed the leaf certificate as a CA file, whereas backend TLS expects root CA. To fix, users are now required to create a file named ``proxysql-ca.pem`` at ``kolla_certificates_dir``, which is a copy of the intermediate certificate. If your system is not affected by this bug, you're not required to create the new file ``proxysql-ca.pem``. Closes-bug: #2150449 Change-Id: I88911badb0d0801f79317df6681c571cc1c8cfee Signed-off-by: Seunghun Lee

ansible-lint: Fix fqcn[actions-core] for loadbalancer

2026-03-20T16:21:09+00:00

Change-Id: Ieda9de2716b0f4da48d9cf218fa9f3d6b92c6a7c Signed-off-by: Michal Nasiadka

ansible-lint: fix unnamed-task in loadbalancer

2025-12-10T21:19:48+00:00

Change-Id: I30d263e4ce21e02b654b3364a1b9f99fac78c553 Signed-off-by: Bertrand Lanson

Add TLS support for MariaDB Connections

2025-07-09T11:41:04+00:00

Since Kolla-Ansible now supports TLS for MariaDB, this patch adds support for services that can use this feature. This feature can be used only when ProxySQL is used as LB. Signed-off-by: Michal Arbet Change-Id: I052c763073c5da29cb8e78004a01a22217dde5da

Performance: Don't notify handlers during config

2024-12-01T21:16:38+00:00

This patch builds upon genconfig optimisation and it takes it further by not having genconfig ever touch the handlers! Calling the handlers and skipping them created an unnecessary slow down if only config was ran. It also depends on the config checking fix. This gets us closer to the single responsibility principle - config only generates the config, container checks only validate whether container restart is needed. And this also means that we will have single place were containers are restarted, were we can fix the ansible quirk of it restarting the whole group even when one container changed in the following patches. The only exception is the loadbalance role. As the loadbalancer services have their config altered by other roles registering their services using loadbalancer-config. This is in contrast to typical roles, which do config in one step and can then run check-containers in the next step. Fixes some handlers that were missing the necessary guard, making genconfig actually able to restart some containers. Future work: - optimise config by doing local generation and mass rsync - support for reloads - unconditional restart/reload (separate action) - make 'reconfigure' act like 'genconfig' + 'deploy-containers' - this would avoid calling bootstrapping each time but might be tricky as it would break current compatibility - could call this 'reconfigure-containers' and deprecate 'reconfigure' - fix the ansible quirk that notifies more handlers then intended Change-Id: I0ce24043ae5486b2b55489ba40abe2b96b0991a6 Partially-Implements: blueprint performance-improvements Co-Authored-By: Roman Krček

Fix TLS settings when letsencrypt turned on

2024-11-25T19:07:01+00:00

- Introduced `letsencrypt_managed_certs` variable to handle whether letsencrypt will generate internal, external or both certificates. - Updated certificate generation logic to use `letsencrypt_managed_certs` conditionally, replacing the previous `enable_letsencrypt` boolean. - Adjusted tasks and templates to support internal/external certificate management based on the new variable. - Enhanced Let's Encrypt script (`letsencrypt-lego-run.sh.j2`) to handle both internal and external certificates depending on VIP configurations. - Refined HAProxy configuration templates to correctly map certificates based on TLS settings and new management logic. Closes-bug: #2076331 Change-Id: Id80c7823fcc5d934b7369c7c0722cd78188e2ccf Co-Authored-By: Michal Arbet

Add backend TLS between MariaDB and ProxySQL

2024-10-25T14:38:39+00:00

This commit adds TLS connection between ProxySQL and MariaDB. Frontend TLS ( between services and ProxySQL) will be added in another commit. Parialy Implements: mariadb-ssl-support Change-Id: I154cbb096469c5515c9d8156c2c1c5dd07b95849 Signed-off-by: Matus Jenca

Performance: use filters for service dicts

2024-06-28T07:04:43+00:00

Most roles are not leveraging the jinja filters available. According to [1] filtering the list of services makes the execution faster than skipping the tasks. This patchset also includes some cosmetic changes to genconfig. Individual services are now also using a jinja filter. This has no impact on performance, just makes the tasks look cleaner. Naming of some vars in genconfig was changed to "service" to make the tasks more uniform as some were previously using the service name and some were using "service". Three metrics from the deployment were taken and those were - overall deployment time [s] - time spent on the specific role [s] - CPU usage (measured with perf) [-] Overall genconfig time went down on avg. from 209s to 195s Time spent on the loadbalancer role went down on avg. from 27s to 23s Time spent on the neutron role went down on avg from 102s to 95s Time spent on the nova-cell role went down on avg. from 54s to 52s Also the average CPUs utilized reported by perf went down from 3.31 to 3.15. For details of how this was measured see the comments in gerrit. [1] - https://github.com/stackhpc/ansible-scaling/blob/master/doc/skip.md Change-Id: Ib0f00aadb6c7022de6e8b455ac4b9b8cd6be5b1b Signed-off-by: Roman Krček

Add support for LetsEncrypt-managed certs

2023-11-07T09:59:51+00:00

Add support for automatic provisioning and renewal of HTTPS certificates via LetsEncrypt. Spec is available at: https://etherpad.opendev.org/p/kolla-ansible-letsencrypt-https Depends-On: https://review.opendev.org/c/openstack/kolla/+/887347 Co-Authored-By: Michal Arbet Implements: blueprint letsencrypt-https Change-Id: I35317ea0343f0db74ddc0e587862e95408e9e106

haproxy: support single external frontend

2023-06-28T23:44:00+00:00

Use case: exposing single external https frontend and load balancing services using FQDNs. Support different ports for internal and external endpoints. Introduced kolla_url filter to normalize urls like: - https://magnum.external:443/v1 - http://magnum.external:80/v1 Change-Id: I9fb03fe1cebce5c7198d523e015280c69f139cd0 Co-Authored-By: Jakub Darmach