aboutsummaryrefslogtreecommitdiff
path: root/ansible/roles/haproxy-config
AgeCommit message (Collapse)AuthorFilesLines
2026-09-16Update enable_letsencrypt to boolean validationjayjahns1-1/+1
Fixes the enable_letsencrypt to properly use boolean instead of a string. Currently breaks acme in its current state. Co-Authored-By: Bartosz Bezak <bartosz@stackhpc.com> Closes-bug: #2164956 Change-Id: Iae8770438ba63717030cc4ec8662f5ca0f6c9168 Signed-off-by: jayjahns@gmail.com Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com> (cherry picked from commit e372288577a189d8798e326c3ff2bd104b4a84a0)
2026-03-24ansible-lint: Fix fqcn[actions]Michal Nasiadka1-1/+1
Change-Id: I3f9e5aada1059d882d2013e0721c10708f43d1cf Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-03-20ansible-lint: Fix fqcn[actions-core] for haproxy-configMichal Nasiadka1-2/+2
Change-Id: I418a0e3f712697a3181c95e0e80433052bc31b9d Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-02-20Allow SNI frontend when using a single haproxy VIPBertrand Lanson1-3/+14
Currently, if there is only one VIP defined, the external backends for haproxy are not defined in the configuration. If haproxy_single_external_frontend is enabled, this causes issues because the map for external frontends points to those external backends. This fixes restore the rendering of external backends if haproxy_single_external_frontend is enabled to make public interfaces work in this scenario. Change-Id: Ie41d001671cde41e6574ff18d1d06c9d8966a4a3 Signed-off-by: Bertrand Lanson <bertrand.lanson@infomaniak.com>
2026-01-09ansible-lint: Rework validate-all-file into custom rulesMichal Nasiadka1-2/+2
Test roles/ subdirectories as well (used by Zuul) In addition to that container_exec_become will also fail when "docker exec" or "podman exec" will be used instead of "{{ kolla_container_engine }} exec" Generated-By: Claude Change-Id: I75c1e48c36bb0284e2927b1cb354ce9ec47967d7 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-12-30Switch to pypi version of j2lint and fix linting errorsMichal Nasiadka1-124/+124
Since ipwrap filter is getting moved another time inside ansible code - let's switch to j2lint that is actively maintained and it's rules will help in readability of jinja2 templates Change-Id: I6762b691b927de31fa1abd83c4c14e87226fe5e2 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-12-01Merge "Add two unused variables to haproxy-config template file"Zuul1-2/+2
2025-12-01Add two unused variables to haproxy-config template fileMohsen Sepandar1-2/+2
To add extra configuration lines to the backend section of the haproxy config files (tcp and http) for each service, the 'haproxy_backend_http_extra' and 'haproxy_backend_tcp_extra' variables were added to its jinja2 template file. Change-Id: I9e0e4b07af16463064e709896b83b6c86a799340 Signed-off-by: Mohsen Sepandar <msepandar32@gmail.com> Closes-Bug: #1914393
2025-11-22ansible-lint: Fix yaml[truthy] in haproxy-config roleMichal Nasiadka1-1/+1
Change-Id: Ie83e990414aa19973b26185b47e1a575f52db288 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-08-28Merge "Letsencrypt disabled redundant entries in configs"Zuul1-0/+4
2025-04-29Remove notifiers from loadbalancer configRoman Krček1-4/+0
No handlers should be triggered during config. Container will be restarted automatically when check-containers is ran for the loadbalancer containers if config has changed. Change-Id: I05b587364ad174d8944c95e54e6e6853d34ec83c Signed-off-by: Roman Krček <roman.krcek@tietoevry.com>
2025-02-05Letsencrypt disabled redundant entries in configsPiotr Milewski1-0/+4
Configuration with letsencrypt disabled generates in haproxy unnecessary backend 'acme_client_back' and 'path_reg ^/.well-known/acme-challenge/.+'. Backend 'acme_client' change enabled from 'enable_horizon' to 'enable_letsencrypt' seems right Closes-Bug: #2097452 Change-Id: I035d1c06ac4076b4a9de9a0bf31c09e65a9bbbe4
2024-08-21Merge "Apply public firewalld rules immediately"Zuul1-4/+3
2023-11-07Add support for LetsEncrypt-managed certsJames Kirsch2-5/+10
Add support for automatic provisioning and renewal of HTTPS certificates via LetsEncrypt. Spec is available at: https://etherpad.opendev.org/p/kolla-ansible-letsencrypt-https Depends-On: https://review.opendev.org/c/openstack/kolla/+/887347 Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io> Implements: blueprint letsencrypt-https Change-Id: I35317ea0343f0db74ddc0e587862e95408e9e106
2023-09-27Fix http/2 support for internal endpointsMaksim Malchuk1-1/+1
Followup on I2e00d3e9193a3052d43a228915ea249794490afe. Fixes an issue with wrong copy/paste. Related-Bug: #1850924 Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com> Change-Id: I979a4e5b534f105a2e81f88f9675feddc883490a
2023-09-25[haproxy] Adds http/2 support to HAProxyDincer Celik1-0/+2
This change introduces haproxy_enable_http2 to let operators enable http/2 on HAProxy frontends when kolla_enable_tls_external is enabled. Change-Id: I2e00d3e9193a3052d43a228915ea249794490afe Closes-Bug: #1850924
2023-08-10Deny access to public /server-status in http Openstack servicesMaksim Malchuk1-0/+3
This change block access to the public /server-status url on all http services exposed by HAProxy, also fixes an issue with Horizon where 'Require all granted' open access to the /server-status in the HAProxy-less configurations. Without this change the issue affects only Ubuntu/Debian installations where mod_status in Apache2 enabled by default. Closes-Bug: #1996913 Change-Id: I3ec1af6353c3ecc64589599abe375b0ae9b14d5c Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com>
2023-06-29haproxy: support single external frontendMichal Nasiadka2-0/+32
Use case: exposing single external https frontend and load balancing services using FQDNs. Support different ports for internal and external endpoints. Introduced kolla_url filter to normalize urls like: - https://magnum.external:443/v1 - http://magnum.external:80/v1 Change-Id: I9fb03fe1cebce5c7198d523e015280c69f139cd0 Co-Authored-By: Jakub Darmach <jakub@stackhpc.com>
2023-05-25Apply public firewalld rules immediatelyMark Goddard1-4/+3
Previously, firewalld rules were applied to configuration, then firewalld reloaded to pick up all the new rules. Reloading firewalld can be disruptive because it sets all chains to a DROP policy while building up its firewall rules, breaking open connections. This change switches to applying rules both permanently (to config) and immediately, such that no reload is required. Change-Id: I8e48b7827b33bdd2061d0e89c905bea8e29f60e8
2023-01-11Stop firewalld config during kolla genconfigJack Hodgkiss1-0/+1
Prevent the haproxy-config role from attempting to modify firewalld when running kolla-ansible genconfig. Closes-Bug: #2002522 Change-Id: Ie8a524cc944aa8cb9cf0999b1b8da79f30b40092
2022-08-29Support configuring HAProxy services as active/passivePierre Riteau1-3/+5
Instead of specifying a custom member list for each service that should be configured as active/passive, a new `active_passive` parameter can be set to true. This only works if `custom_member_list` is not used. Change-Id: I3758bc2377c25a277a29f02ebc20c946c7499093
2022-07-29Merge "haproxy-config: move firewalld reload handler to haproxy role"Zuul1-6/+0
2022-07-29haproxy-config: move firewalld reload handler to haproxy roleMark Goddard1-6/+0
With the handler in the haproxy-config role, it gets triggered once for every service that changes the firewall config. This happens because the role is included dynamically. If we move the handler to the haproxy role, which is only included once, the handler will trigger at most once. This is a follow up for Iea3680142711873984efff2b701347b6a56dd355. Change-Id: Iad9ed241026435085bc9a0f5802818010b47830f
2022-07-29haproxy-config: Drop project_name variableMark Goddard1-2/+0
This variable shadows the name of the actual project that calls this role, so we end up with the following nonsense: TASK [haproxy-config : Copying over haproxy-config haproxy config] Change-Id: Id60046e0ddc7ec843f2e4ce7ddee7683470a88b2
2022-07-27adds firewalld configuration based on enabled servicesk-s-dean2-0/+24
This change introduces automated configuration of firewalld and adds a new filter for extracting services from the project_services dict. the filter selects any enabled services and their haproxy element and returns them so they can be iterated over. This commit also enables automated configuration of firewalld from enabled openstack services and adds them to the defined zone and reloads the system firewall. Change-Id: Iea3680142711873984efff2b701347b6a56dd355
2022-06-30Remove unused variable haproxy_enable_federation_openidMark Goddard1-2/+0
Change-Id: Ia735f0f8c12acf6b89fcb8e31a3e290a4def96ab
2021-12-31Move project_name and kolla_role_name to role varsPierre Riteau2-2/+2
Role vars have a higher precedence than role defaults. This allows to import default vars from another role via vars_files without overriding project_name (see related bug for details). Change-Id: I3d919736e53d6f3e1a70d1267cf42c8d2c0ad221 Related-Bug: #1951785
2021-10-11Trivial but necessary fix - loadbalancer weightMichal Arbet1-1/+1
Weight for haproxy backend was merged in [1] with tiny bug, there is need to convert to int to check conditional <= 256. Otherwise, it's not working as expected. [1] https://review.opendev.org/c/openstack/kolla-ansible/+/775627 Change-Id: Icb6f5147ebd2a0be52ba4ef6ba4a00bbd0242d3d
2021-09-28Merge "Add way to change weight of haproxy backend per service"Zuul1-1/+6
2021-09-26Add way to change weight of haproxy backend per serviceMichal Arbet1-1/+6
This patch adding option to control weight of haproxy backends per service via host variable. Example: [control] server1 haproxy_nova_api_weight=10 server2 haproxy_nova_api_weight=2 haproxy_keystone_internal_weight=10 server3 haproxy_keystone_admin_weight=50 If weight is not defined, everything is working as before. Change-Id: Ie8cc228198651c57f8ffe3eb060875e45d1f0700
2021-07-28Delete haproxy_single_service_listen.cfg.j2 templateLinPeiWen2-112/+0
Delete the "haproxy_single_service_listen.cfg.j2" template, which has been replaced by "haproxy_single_service_split.cfg.j2" and deprecated in the Victoria version Change-Id: I3599f85afe9d3045820ea1ea70481ea2500e49ac
2021-06-23Use ansible_facts to reference factsMark Goddard2-2/+2
By default, Ansible injects a variable for every fact, prefixed with ansible_. This can result in a large number of variables for each host, which at scale can incur a performance penalty. Ansible provides a configuration option [0] that can be set to False to prevent this injection of facts. In this case, facts should be referenced via ansible_facts.<fact>. This change updates all references to Ansible facts within Kolla Ansible from using individual fact variables to using the items in the ansible_facts dictionary. This allows users to disable fact variable injection in their Ansible configuration, which may provide some performance improvement. This change disables fact variable injection in the ansible configuration used in CI, to catch any attempts to use the injected variables. [0] https://docs.ansible.com/ansible/latest/reference_appendices/config.html#inject-facts-as-vars Change-Id: I7e9d5c9b8b9164d4aee3abb4e37c8f28d98ff5d1 Partially-Implements: blueprint performance-improvements
2021-02-15Add support to OpenID Connect Authentication flowPedro Henrique1-0/+2
This pull request adds support for the OpenID Connect authentication flow in Keystone and enables both ID and access token authentication flows. The ID token configuration is designed to allow users to authenticate via Horizon using an identity federation; whereas the Access token is used to allow users to authenticate in the OpenStack CLI using a federated user. Without this PR, if one wants to configure OpenStack to use identity federation, he/she needs to do a lot of configurations in the keystone, Horizon, and register quite a good number of different parameters using the CLI such as mappings, identity providers, federated protocols, and so on. Therefore, with this PR, we propose a method for operators to introduce/present the IdP's metadata to Kolla-ansible, and based on the presented metadata, Kolla-ansible takes care of all of the configurations to prepare OpenStack to work in a federated environment. Implements: blueprint add-openid-support Co-Authored-By: Jason Anderson <jasonanderson@uchicago.edu> Change-Id: I0203a3470d7f8f2a54d5e126d947f540d93b8210
2020-11-10Add service specific custom haproxy config overrideIsaac Prior1-0/+2
Change-Id: If6c50606fa3da353728ae4d916df20fcc95b8927
2020-09-22Add support for with_frontend and with_backendRadosław Piliszek1-1/+7
This allows for more config flexibility - e.g. running multiple backends with a common frontend. Note this is a building block for future work on letsencrypt validator (which should offer backend and share frontend with any service running off 80/443 - which would be only horizon in the current default config), as well as any work towards single port (that is single frontend) and multiple services anchored at paths of it (which is the new recommended default). Change-Id: Ie088fcf575e4b5e8775f1f89dd705a275725e26d Partially-Implements: blueprint letsencrypt-https
2020-09-22Change the default haproxy template to split variantRadosław Piliszek1-1/+2
This allows for more config flexibility - e.g. running multiple backends with a common frontend. It is not possible with the 'listen' approach (which enforces frontend). Additionally, it does not really make sense to support two ways to do the exact same thing as the process is automated and 'listen' is really meant for humans not willing to write separate sections. Hence this deprecates 'listen' variant. At the moment both templates work exactly the same. The real flexibility comes in following patches. Note this is a building block for future work on letsencrypt validator (which should offer backend and share frontend with any service running off 80/443 - which would be only horizon in the current default config), as well as any work towards single port (that is single frontend) and multiple services anchored at paths of it (which is the new recommended default). Change-Id: I2362aaa3e8069fe146d42947b8dddf49376174b5 Partially-Implements: blueprint letsencrypt-https
2020-09-22Fix default mode in haproxy_single_service_splitRadosław Piliszek1-1/+1
haproxy_single_service_listen (the default template) was already fine. Closes-Bug: #1896591 TrivialFix Change-Id: Id68fe19ea87565aa36fb74f2a2ca66cb951169f6
2020-04-26Merge "Avoid multiple haproxy restarts after reconfiguration"Zuul1-17/+0
2020-04-21Avoid multiple haproxy restarts after reconfigurationChristian Berendt1-17/+0
The haproxy role and the site.yml file calls the haproxy-config role to provide configuration for individual services. If the configuration within a service changes, the haproxy container is restarted. If the configuration in n services changes, there will be n restarts. This is not necessary, a restart at the end is sufficient. By removing the handler from the haproxy-config role and using the listen parameter in the handler of the haproxy role, the handler is executed only once. Change-Id: I535fe67579fb748093bb4b30a6bd31b81e021a1b Closes-Bug: #1864810
2020-04-14[haproxy-config] Fix missing servers in split cfgJason Anderson1-1/+1
When using the split config style, all backends would be empty, which meant that HAProxy was unable to serve any traffic. This turned out to be due to a bad default in the split config template. Closes-Bug: #1872545 Change-Id: I952e526e735e1d31445963f04d41d66bbdbfdee4
2020-04-09Add support for encrypting backend Keystone HAProxy trafficJames Kirsch3-6/+31
This patch introduces an optional backend encryption for Keystone service. When used in conjunction with enabling TLS for service API endpoints, network communcation will be encrypted end to end, from client through HAProxy to the Keystone service. Change-Id: I6351147ddaff8b2ae629179a9bc3bae2ebac9519 Partially-Implements: blueprint add-ssl-internal-network
2019-11-05Fix indentation of HAProxy internal http-request configMark Goddard1-1/+1
Related: blueprint add-ssl-internal-network Co-Authored-By: generalfuzz <generalfuzz@gmail.com> Change-Id: Ib79796d49c415d8314ea5661a16bd2dac8ba7188
2019-10-16Implement IPv6 support in the control planeRadosław Piliszek2-4/+2
Introduce kolla_address filter. Introduce put_address_in_context filter. Add AF config to vars. Address contexts: - raw (default): <ADDR> - memcache: inet6:[<ADDR>] - url: [<ADDR>] Other changes: globals.yml - mention just IP in comment prechecks/port_checks (api_intf) - kolla_address handles validation 3x interface conditional (swift configs: replication/storage) 2x interface variable definition with hostname (haproxy listens; api intf) 1x interface variable definition with hostname with bifrost exclusion (baremetal pre-install /etc/hosts; api intf) neutron's ml2 'overlay_ip_version' set to 6 for IPv6 on tunnel network basic multinode source CI job for IPv6 prechecks for rabbitmq and qdrouterd use proper NSS database now MariaDB Galera Cluster WSREP SST mariabackup workaround (socat and IPv6) Ceph naming workaround in CI TODO: probably needs documenting RabbitMQ IPv6-only proto_dist Ceph ms switch to IPv6 mode Remove neutron-server ml2_type_vxlan/vxlan_group setting as it is not used (let's avoid any confusion) and could break setups without proper multicast routing if it started working (also IPv4-only) haproxy upgrade checks for slaves based on ipv6 addresses TODO: ovs-dpdk grabs ipv4 network address (w/ prefix len / submask) not supported, invalid by default because neutron_external has no address No idea whether ovs-dpdk works at all atm. ml2 for xenapi Xen is not supported too well. This would require working with XenAPI facts. rp_filter setting This would require meddling with ip6tables (there is no sysctl param). By default nothing is dropped. Unlikely we really need it. ironic dnsmasq is configured IPv4-only dnsmasq needs DHCPv6 options and testing in vivo. KNOWN ISSUES (beyond us): One cannot use IPv6 address to reference the image for docker like we currently do, see: https://github.com/moby/moby/issues/39033 (docker_registry; docker API 400 - invalid reference format) workaround: use hostname/FQDN RabbitMQ may fail to bind to IPv6 if hostname resolves also to IPv4. This is due to old RabbitMQ versions available in images. IPv4 is preferred by default and may fail in the IPv6-only scenario. This should be no problem in real life as IPv6-only is indeed IPv6-only. Also, when new RabbitMQ (3.7.16/3.8+) makes it into images, this will no longer be relevant as we supply all the necessary config. See: https://github.com/rabbitmq/rabbitmq-server/pull/1982 For reliable runs, at least Ansible 2.8 is required (2.8.5 confirmed to work well). Older Ansible versions are known to miss IPv6 addresses in interface facts. This may affect redeploys, reconfigures and upgrades which run after VIP address is assigned. See: https://github.com/ansible/ansible/issues/63227 Bifrost Train does not support IPv6 deployments. See: https://storyboard.openstack.org/#!/story/2006689 Change-Id: Ia34e6916ea4f99e9522cd2ddde03a0a4776f7e2c Implements: blueprint ipv6-control-plane Signed-off-by: Radosław Piliszek <radoslaw.piliszek@gmail.com>
2019-08-22Implement TLS encryption for internal endpointsKrzysztof Klimonda2-4/+16
This review is the first one in a series of patches and it introduces an optional encryption for internal openstack endpoints, implementing part of the add-ssl-internal-network spec. Change-Id: I6589751626486279bf24725f22e71da8cd7f0a43
2018-12-27Allow separate listen port in haproxy-config templatesJim Rollenhagen2-8/+13
This allows a service to pass in a different listening port than haproxy listens on for the service. This allows haproxy to live on the same network interface as the services, and will be used by services in subsequent changes. Change-Id: Id1d2429a4c800628cb43e0fb7d2b69131e71ee1c Implements: blueprint service-hostnames
2018-10-24Add missing project_name variablesChristian Berendt1-0/+2
Change-Id: I0cbc51eedb218f6b2f7d5c50372ad7a8be9bdcc0
2018-09-26Refactor haproxy config (split by service) V2.0Adam Harwell5-0/+260
Having all services in one giant haproxy file makes altering configuration for a service both painful and dangerous. Each service should be configured with a simple set of variables and rendered with a single unified template. Available are two new templates: * haproxy_single_service_listen.cfg.j2: close to the original style, but only one service per file * haproxy_single_service_split.cfg.j2: using the newer haproxy syntax for separated frontend and backend For now the default will be the single listen block, for ease of transition. Change-Id: I6e237438fbc0aa3c89a3c8bd706a53b74e71904b
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 17:44:43 +0000