openstack/kolla-ansible.git/ansible/roles/loadbalancer, branch stable/2026.1

Fix ProxySQL not using backup writer node for reads

2026-09-17T06:38:11+00:00

Set writer_is_also_reader to 2 in the Galera hostgroup configuration so that the backup writer node also serves reads, instead of sitting idle while all read traffic went to the single remaining reader node. The writer node is never added to the reader hostgroup regardless of this setting, only the backup writer is affected. See bug report for performance difference details. Closes-Bug: #2167037 Change-Id: Ib5145c200c3cd70f861824abd967748faf61e1cf Signed-off-by: fprzewozn (cherry picked from commit 42eec877ff572fd724af8a1c0fa64acf5e824c7b)

[stable-only] Split CA of ProxySQL internal TLS and backend TLS

2026-07-22T13:15:30+00:00

ProxySQL frontend TLS (database internal TLS) and backend TLS (database backend TLS) expects different CA if users use chain of certificates (e.g. use of intermediate certificates). Frontend TLS expects the intermediate certificate that signed the leaf certificate as a CA file, whereas backend TLS expects root CA. To fix, users are now required to create a file named ``proxysql-ca.pem`` at ``kolla_certificates_dir``, which is a copy of the intermediate certificate. If your system is not affected by this bug, you're not required to create the new file ``proxysql-ca.pem``. Closes-bug: #2150449 Change-Id: I88911badb0d0801f79317df6681c571cc1c8cfee Signed-off-by: Seunghun Lee

proxysql: fix keepalived healthcheck to use MySQL protocol

2026-06-09T07:30:22+00:00

The check_alive_proxysql.sh script piped raw ASCII text ("show info\n") directly into the admin socket via socat, bypassing the MySQL handshake. ProxySQL's MySQL_Data_Stream interprets the first 3 bytes of "show" as a little-endian packet length (7301235), which has always been semantically wrong - the check only appeared to work because socat received ProxySQL's binary handshake greeting back and exited 0. ProxySQL 3.0.9 introduced a pre-authentication bounds check (GHSA-58ww-865x-grpr) that explicitly rejects first packets whose declared length exceeds the 32 KB input queue capacity and closes the connection. This causes socat to exit non-zero, making keepalived mark ProxySQL as unhealthy on every check interval. Replace the raw socat probe with a mariadb client connection that speaks proper MySQL protocol against the admin socket. Closes-Bug: #2155865 Depends-On: https://review.opendev.org/c/openstack/kolla/+/992394 Change-Id: Ic090916509cbb1bd98c96e8beb32ec9e90bfc6aa Signed-off-by: Michal Nasiadka (cherry picked from commit 1e0fa6c62bbb6129f29f01605a00ce3e0f50e27a)

CI: Fix HAProxy template for new Jinja lint rules

2026-05-25T05:50:14+00:00

Change-Id: Ib82e708137679ae85f645c448cc8aa3cf583cf6d Signed-off-by: Bartosz Bezak (cherry picked from commit 6b2112f0bc8f99d31fb7f447728af8f55db3596d)

Fix for overly restrictive permissions on ca-certificates directory

2026-05-12T05:56:37+00:00

Closes-Bug: #2112280 Change-Id: I52499bdf2b7fc70f91a4c2920749bfef83a79850 Signed-off-by: Rafal Lewandowski Signed-off-by: Michal Nasiadka (cherry picked from commit e302bab31f30296f7d6f41c3d46e19cf5668b97a)

Drop zun and kuryr

2026-04-27T05:18:03+00:00

Zun is broken in 2026.1, it has been released broken and there are no reviews on the patch to fix it [1]. [1]: https://review.opendev.org/c/openstack/zun/+/982362 Depends-On: https://review.opendev.org/c/openstack/ansible-collection-kolla/+/986150 Change-Id: I8ced621754d03c44b7672dd94fc3d7d2173ac734 Signed-off-by: Michal Nasiadka

release: Retarget removal of ironic-inspector

2026-04-07T07:06:02+00:00

Some tasks have been mistakenly marked as to be removed in Gazpacho instead of after Gazpacho/in Hibiscus. Change-Id: I6b6f98371546ab4fa316c53effb2be1954c3a84b Signed-off-by: Michal Nasiadka

Add additional SPICE configuration options

2026-04-02T20:05:13+00:00

Recent changes to OpenStack Compute have added a number of new configuration options for SPICE VDI consoles. Additionally, it is not always desirable to enable the HTML5 transcoding proxy for SPICE consoles in Horizon. This patch adds configuration to globals.yml for most of these new options. Specifically: * nova_spice_html5: whether to enable the HTML5 transcoding proxy or not. Defaults to the previous behaviour of enabling the proxy. Notably, nova_spice_require_secure is not exposed here as it implies that qemu is configured to support TLS, and that TLS certificates have been configured in the nova_libvirt container. These changes are large, and are included in a separate patch for clarity. Additionally, OpenStack Compute added these configuration options in 2023.1, and they are exposed as well: * nova_spice_image_compression: "auto_glz" * nova_spice_jpeg_compression: "auto" * nova_spice_zlib_compression: "auto" * nova_spice_playback_compression: true * nova_spice_streaming_mode: "filter" All configuration options and their various values are documented by OpenStack Compute in their documentation. Partial-Bug: #2131793 (spice-direct consoles) Change-Id: I07f6890f1c7c4e543667d3cbd7b3e82bd9ec83e3 Signed-off-by: Michael Still

ansible-lint: Fix fqcn[actions-core] for loadbalancer

2026-03-20T16:21:09+00:00

Change-Id: Ieda9de2716b0f4da48d9cf218fa9f3d6b92c6a7c Signed-off-by: Michal Nasiadka

ansible-lint: fix yaml[line-length] in roles

2026-01-15T16:57:14+00:00

role: loadbalancer Change-Id: I90282cab8e4688e963603bc1bb969c6f8c5d82f8 Signed-off-by: Bertrand Lanson