From 2ad59e7d1bdfbf18b4a7656c42fbc7bcfb599280 Mon Sep 17 00:00:00 2001 From: Michal Nasiadka Date: Mon, 8 Jun 2026 06:00:05 +0100 Subject: proxysql: fix keepalived healthcheck to use MySQL protocol The check_alive_proxysql.sh script piped raw ASCII text ("show info\n") directly into the admin socket via socat, bypassing the MySQL handshake. ProxySQL's MySQL_Data_Stream interprets the first 3 bytes of "show" as a little-endian packet length (7301235), which has always been semantically wrong - the check only appeared to work because socat received ProxySQL's binary handshake greeting back and exited 0. ProxySQL 3.0.9 introduced a pre-authentication bounds check (GHSA-58ww-865x-grpr) that explicitly rejects first packets whose declared length exceeds the 32 KB input queue capacity and closes the connection. This causes socat to exit non-zero, making keepalived mark ProxySQL as unhealthy on every check interval. Replace the raw socat probe with a mariadb client connection that speaks proper MySQL protocol against the admin socket. Closes-Bug: #2155865 Depends-On: https://review.opendev.org/c/openstack/kolla/+/992394 Change-Id: Ic090916509cbb1bd98c96e8beb32ec9e90bfc6aa Signed-off-by: Michal Nasiadka (cherry picked from commit 1e0fa6c62bbb6129f29f01605a00ce3e0f50e27a) --- .../loadbalancer/templates/keepalived/check_alive_proxysql.sh.j2 | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/ansible/roles/loadbalancer/templates/keepalived/check_alive_proxysql.sh.j2 b/ansible/roles/loadbalancer/templates/keepalived/check_alive_proxysql.sh.j2 index a3e3dd78d..a3f221c02 100644 --- a/ansible/roles/loadbalancer/templates/keepalived/check_alive_proxysql.sh.j2 +++ b/ansible/roles/loadbalancer/templates/keepalived/check_alive_proxysql.sh.j2 @@ -3,4 +3,10 @@ # This will return 0 when it successfully talks to the ProxySQL daemon via localhost # Failures return 1 -echo "show info" | socat unix-connect:/var/lib/kolla/proxysql/admin.sock stdio > /dev/null +mariadb --no-defaults \ + --protocol socket \ + --socket=/var/lib/kolla/proxysql/admin.sock \ + --user={{ proxysql_admin_user }} \ + --password={{ proxysql_admin_password }} \ + --skip-ssl \ + -e "SELECT 1" 2>/dev/null -- cgit v1.2.3