openstack/kolla-ansible.git/ansible/roles/loadbalancer/templates/haproxy/haproxy.json.j2, branch stable/2026.1

CI: Fix HAProxy template for new Jinja lint rules

2026-05-25T05:50:14+00:00

Change-Id: Ib82e708137679ae85f645c448cc8aa3cf583cf6d Signed-off-by: Bartosz Bezak (cherry picked from commit 6b2112f0bc8f99d31fb7f447728af8f55db3596d)

Fix for overly restrictive permissions on ca-certificates directory

2026-05-12T05:56:37+00:00

Closes-Bug: #2112280 Change-Id: I52499bdf2b7fc70f91a4c2920749bfef83a79850 Signed-off-by: Rafal Lewandowski Signed-off-by: Michal Nasiadka (cherry picked from commit e302bab31f30296f7d6f41c3d46e19cf5668b97a)

Fix for external-frontend-map file not being copied

2025-02-20T09:23:09+00:00

There was an ``if`` condition preventing the file from being copied into haproxy container when ``kolla_enable_tls_external`` is set to ``false``. Closes-Bug: #2098765 Change-Id: If87b5debcacdbc5001c869440397cd11605a5574

Don't notify handlers during copy-cert

2024-12-01T21:16:25+00:00

This is a prerequisite for patchset #745164 This fixes unwanted restarts during copying of certificates. By removing conditional statements from role handlers in #745164, copying certificates caused containers to restart, this is unwanted during the genconfig process. However, if we would remove handler notifiers from copying certificates, the container would never restart, since from #745164, containers will restart only if any of the files specified in config.json change. Certificates are now copied to intermediary location inside of the container, from which the script kolla_copy_cacerts will install them in the trust store. Depends-on: https://review.opendev.org/c/openstack/kolla/+/926882 Change-Id: Ib89048c7e0f250182c4bf57d8c8a1b5478e9b4ab Signed-off-by: Roman Krček

Fix TLS settings when letsencrypt turned on

2024-11-25T19:07:01+00:00

- Introduced `letsencrypt_managed_certs` variable to handle whether letsencrypt will generate internal, external or both certificates. - Updated certificate generation logic to use `letsencrypt_managed_certs` conditionally, replacing the previous `enable_letsencrypt` boolean. - Adjusted tasks and templates to support internal/external certificate management based on the new variable. - Enhanced Let's Encrypt script (`letsencrypt-lego-run.sh.j2`) to handle both internal and external certificates depending on VIP configurations. - Refined HAProxy configuration templates to correctly map certificates based on TLS settings and new management logic. Closes-bug: #2076331 Change-Id: Id80c7823fcc5d934b7369c7c0722cd78188e2ccf Co-Authored-By: Michal Arbet

Add support for LetsEncrypt-managed certs

2023-11-07T09:59:51+00:00

Add support for automatic provisioning and renewal of HTTPS certificates via LetsEncrypt. Spec is available at: https://etherpad.opendev.org/p/kolla-ansible-letsencrypt-https Depends-On: https://review.opendev.org/c/openstack/kolla/+/887347 Co-Authored-By: Michal Arbet Implements: blueprint letsencrypt-https Change-Id: I35317ea0343f0db74ddc0e587862e95408e9e106

haproxy: support single external frontend

2023-06-28T23:44:00+00:00

Use case: exposing single external https frontend and load balancing services using FQDNs. Support different ports for internal and external endpoints. Introduced kolla_url filter to normalize urls like: - https://magnum.external:443/v1 - http://magnum.external:80/v1 Change-Id: I9fb03fe1cebce5c7198d523e015280c69f139cd0 Co-Authored-By: Jakub Darmach

Rename role haproxy to loadbalancer

2021-08-19T19:20:33+00:00

For now role haproxy is maintaining haproxy and keepalived. In follow-up changes there is also proxysql added. This patch is *only* renaming/moving stuff to more prominent role loadbalancer, and moving also specific templates to subdirectory. This was done only to better diff in follow-up changes. Change-Id: I1d39d5bcaefc4016983bf267a2736b742cc3a555