There is an issue with current implementation of HAproxy configuration for OpenStack services/
At the moment per-service manifests contain hardcoded sets of options, for example
https://github.com/openstack/fuel-library/blob/master/deployment/puppet/openstack/manifests/ha/keystone.pp#L70
https://github.com/openstack/fuel-library/blob/master/deployment/puppet/openstack/manifests/ha/neutron.pp#L69
and so on.
Problem:
On environments with big number of users query to keystone service may take long time. HAProxy terminates connection to keystone after one minute. It's a default timeout and there is no way provided to modify this timeout in HAProxy.
Workaround
we're modifying haproxy_service manifest to read haproxy options for services from additional hiera hash and merge them with default hardcodes from upstream manifest
https://github.com/openstack/fuel-library/blob/master/deployment/puppet/openstack/manifests/ha/haproxy_service.pp
# Get additional haproxy configuration options from hiera
# Fetch configuration mathcing resource name from hiera
$settings_hash = hiera_hash('haproxy_config_options', {})
# Get haproxy_config_options hash
$hiera_haproxy_config_options = pick($settings_hash[$name], {})
# Merge hashes from hiera and one from upstream resource
$merged_config_options = merge($haproxy_config_options, $hiera_haproxy_config_options)
resulting hash then supplied to haproxy::listen
# Configure HAProxy to listen
haproxy::listen { $name:
order => $order,
bind => merge($public_bind, $internal_bind),
options => $merged_config_options,
mode => $mode,
use_include => true,
notify => Exec['haproxy-restart'],
}
an example of config yaml to get hiera hash from:
haproxy_config_options:
keystone-1:
'timeout server': '660s'
option:
- httpchk
- httplog
- httpclose
keystone-2:
'timeout server': '660s'
option:
- httpchk
- httplog
- httpclose
Impact: Fuel 9 and previous
We already implemented some enhancements in the:
1. https:/
2. https:/
and move some options to the global settings.
It is the good idea to use hiera for some options.
Also, this is actually not a bug but wishlist.