No way to disable haproxy backends

[Imran Hussain]

Hi,

From an operator perspective it would be great if one haproxy backend server needed rebooting or other such maintenance to be able to disable it inside of haproxy so no new traffic goes to it.

This would be done by sending "set server backend/serv state drain" to the haproxy socket. But the current socket doesn't get created with the right permissions.

So to completely take out a node I'd want to do something like:

docker exec -it haproxy bash -c 'for backend in $(echo "show backend" | sudo socat stdio /var/lib/kolla/haproxy/haproxy.sock); do echo "set server $backend/my-node-01 state drain" | sudo socat stdio /var/lib/kolla/haproxy/haproxy.sock; done'

This would need us to set `level admin` on the socket.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/kolla-ansible/+/828107

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/kolla-ansible/+/828107
Committed: https://opendev.org/openstack/kolla-ansible/commit/f4bfab57bda95d02efe0bef5a19625cba99c4742
Submitter: "Zuul (22348)"
Branch: master

commit f4bfab57bda95d02efe0bef5a19625cba99c4742
Author: Imran Hussain <email address hidden>
Date: Mon Feb 7 10:31:50 2022 +0000

    [haproxy] optionally set socket to allow admin commands

    Allow operators to set haproxy socket to admin level.
    This is done via the flag haproxy_socket_level_admin which
    is set to "no" by default.

    Closes-Bug: 1960215

    Signed-off-by: Imran Hussain <email address hidden>
    Change-Id: Ia0da89288d68f5803ace1934c013053f12343195

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 14.0.0.0rc1 release candidate.