Open Stack

We are ecstatic to announce the release of:

octavia 4.1.1: OpenStack Octavia Scalable Load Balancer as a Service

This release is part of the stein stable release series.

The source is available from:

    https://opendev.org/openstack/octavia

Download the package from:

    https://pypi.org/project/octavia

Please report issues through:

    https://storyboard.openstack.org/#!/project/908

For more details, please see below.

4.1.1
^^^^^


Upgrade Notes
*************

* A new amphora image is required to fix the potential certs-ramfs
  race condition.


Security Issues
***************

* A race condition between the certs-ramfs and the amphora agent may
  lead to tenant TLS content being stored on the amphora filesystem
  instead of in the encrypted RAM filesystem.


Bug Fixes
*********

* Fixes an issue where load balancers with more than one TLS enabled
  listener, one or more SNI enabled, may load certificates from other
  TLS enabled listeners for SNI use.

* Fixed a potential race condition with the certs-ramfs and amphora
  agent services.

* Fixes the ability to filter on the provider flavor capabilities
  API.

* Fixes an issue in the selection of vip-subnet-id on multi-subnet
  networks by checking the IP availability of the subnets, ensuring
  enough IPs are available for loadbalancer when creating loadbalancer
  specifying vip-network-id.

* Fix a bug that could interrupt resource creation when performing a
  graceful shutdown of the controller worker and leave resources in a
  PENDING_CREATE/PENDING_UPDATE/PENDING_DELETE provisioning status. If
  the duration of an Octavia flow is greater than the
  'graceful_shutdown_timeout' configuration value, stopping the
  Octavia worker can still interrupt the creation of resources.

Changes in octavia 4.1.0..4.1.1
-------------------------------

567a388b Fix filtering with API tags
0f4b5ca2 Fix controller worker graceful shutdown
7c1e1a6d Fix filtering for provider capabilities list API
c3f95915 Fix a potential race condition with certs-ramfs
91bcbc84 Fix listeners with SNI certificates
f652a7d1 ipvsadm '--exact' arg to ensure outputs are ints
bfa55392 Fix issues with unavailable secrets
9f05c2f9 loadbalancer vip-network-id IP availability check
a501714a Improve the error message for bad pkcs12 bundles


Diffstat (except docs and test files)
-------------------------------------

devstack/plugin.sh                                 |   5 +
.../amphora-agent.conf                             |   2 +-
.../amphora-agent.init                             |   2 +-
.../amphora-agent.service                          |   3 +-
.../init-scripts/systemd/certs-ramfs.service       |   1 +
etc/octavia.conf                                   |   3 +
octavia/amphorae/backends/agent/api_server/util.py |   2 +-
.../amphorae/backends/utils/keepalivedlvs_query.py |   3 +-
.../amphorae/drivers/haproxy/rest_api_driver.py    |  21 ++-
octavia/api/common/pagination.py                   |  53 ++++---
octavia/api/drivers/utils.py                       |  81 +++++++----
octavia/api/v2/controllers/base.py                 |   2 +
octavia/api/v2/controllers/listener.py             |   3 +-
octavia/api/v2/controllers/load_balancer.py        |  33 +++--
octavia/api/v2/controllers/pool.py                 |   3 +-
octavia/api/v2/controllers/provider.py             |  19 +++
octavia/certificates/common/pkcs12.py              |   6 +-
octavia/certificates/manager/barbican.py           |   2 +
octavia/common/constants.py                        |   2 +
octavia/common/exceptions.py                       |   7 +
.../jinja/haproxy/combined_listeners/jinja_cfg.py  |  39 ++---
.../haproxy/combined_listeners/templates/macros.j2 |  13 +-
.../jinja/haproxy/split_listeners/jinja_cfg.py     |  49 +++----
.../haproxy/split_listeners/templates/macros.j2    |  13 +-
octavia/common/tls_utils/cert_parser.py            |  31 ++--
octavia/common/utils.py                            |   7 +
octavia/controller/queue/consumer.py               |  10 +-
octavia/network/base.py                            |   9 ++
octavia/network/data_models.py                     |  14 ++
octavia/network/drivers/neutron/base.py            |   3 +
octavia/network/drivers/neutron/utils.py           |   9 ++
octavia/network/drivers/noop_driver/driver.py      |  18 +++
.../backends/agent/api_server/test_util.py         |  35 ++---
.../drivers/haproxy/test_rest_api_driver_0_5.py    |   4 +-
.../drivers/haproxy/test_rest_api_driver_1_0.py    |   4 +-
.../unit/certificates/manager/test_barbican.py     |  17 +++
.../haproxy/combined_listeners/test_jinja_cfg.py   |  56 ++++----
.../haproxy/split_listeners/test_jinja_cfg.py      |  54 +++----
.../unit/common/tls_utils/test_cert_parser.py      |  23 +++
.../unit/network/drivers/neutron/test_base.py      |  15 ++
.../unit/network/drivers/neutron/test_utils.py     |  16 +++
.../fix-SNI-single-process-879ffce5eaa6c1c3.yaml   |   6 +
.../fix-certs-ramfs-race-561f355d13fc6d14.yaml     |  14 ++
...er-capabilities-filtering-8bd12b2cf7b37a84.yaml |   4 +
...p-network-ip-availability-2e924f32abf01052.yaml |   7 +
...-worker-graceful-shutdown-c44b6797637aa1b3.yaml |   9 ++
tox.ini                                            |   3 +-
55 files changed, 861 insertions(+), 246 deletions(-)