neutron-lbaas health monitor timeout and delay values interpreted as milliseconds

[Dustin Lundquist]

The timeout and delay values on the health monitor objects in Neutron LBaaS are purportedly in units of seconds, but the numeric value is passed all the the way down to the HAProxy configuration[1] file (in both the HAProxy namespace driver and Octavia) where it is interpreted in milliseconds:

* https://cbonte.github.io/haproxy-dconv/configuration-1.5.html#4.2-timeout%20check
* https://cbonte.github.io/haproxy-dconv/configuration-1.5.html#5.2-inter

Due to this unit mismatch, a user may configure a pool with a reasonable 10 second timeout, and the service may appear to function normally until even a small load causes the backend servers to exceed a 10 millisecond timeout and then they are removed from the pool.

A timeout value less than one second is useful some settings, such as monitoring a pool of backend servers serving static content, let the database field stores this value as an integer.

1: https://github.com/openstack/neutron-lbaas/blob/b322615e4869eb42ed7888a3492eae4a52f3b4db/neutron_lbaas/services/loadbalancer/drivers/haproxy/templates/haproxy_proxies.j2#L72

[Dustin Lundquist (dlundquist)]

Updating template to use value as seconds was discussed in https://review.openstack.org/#/c/339260/, but favored updating documentation instead so not to alter behavior of existing deployed load balancers.

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/heat 7.0.0.0b2 development milestone.

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/python-neutronclient 5.0.0 release.

[Tristan Cacqueray (tristan-cacqueray)]

Is there a reason why this is reported as a security issue ?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/380658

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/380660

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/380660
Committed: https://git.openstack.org/cgit/openstack/octavia/commit/?id=ef11747a56ed210d9ae59e7c08b08fb6b6dc604b
Submitter: Jenkins
Branch: master

commit ef11747a56ed210d9ae59e7c08b08fb6b6dc604b
Author: Paul Glass <email address hidden>
Date: Fri Sep 30 21:39:52 2016 +0000

    Switch HAProxy health check timeout to seconds

    Change-Id: If8166b8e76ca6c1b15963ef99bec07ff2a6fb118
    Closes-Bug: #1600326

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/380658
Committed: https://git.openstack.org/cgit/openstack/neutron-lbaas/commit/?id=75faa63ee40a7de8eaa7c8f2b2f95038c0e92158
Submitter: Jenkins
Branch: master

commit 75faa63ee40a7de8eaa7c8f2b2f95038c0e92158
Author: Paul Glass <email address hidden>
Date: Fri Sep 30 21:35:56 2016 +0000

    Switch HAProxy health check timeout to seconds

    Change-Id: I6e3c68be26cdf9ed3e09b7f0bd92a52491b5e866
    Closes-Bug: #1600326

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron-lbaas 10.0.0.0b1 development milestone.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/409917

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/409917
Committed: https://git.openstack.org/cgit/openstack/neutron-lbaas/commit/?id=ebae55c633d8bb0fd53d4c2dd8999893ce17f953
Submitter: Jenkins
Branch: stable/newton

commit ebae55c633d8bb0fd53d4c2dd8999893ce17f953
Author: Paul Glass <email address hidden>
Date: Fri Sep 30 21:35:56 2016 +0000

    Switch HAProxy health check timeout to seconds

    Change-Id: I6e3c68be26cdf9ed3e09b7f0bd92a52491b5e866
    Closes-Bug: #1600326
    (cherry picked from commit 75faa63ee40a7de8eaa7c8f2b2f95038c0e92158)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/octavia 0.10.0 release.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/451564

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/451564
Committed: https://git.openstack.org/cgit/openstack/octavia/commit/?id=bb79b3df3333ac4d7778753e343b1ae9631227a7
Submitter: Jenkins
Branch: stable/newton

commit bb79b3df3333ac4d7778753e343b1ae9631227a7
Author: Paul Glass <email address hidden>
Date: Fri Sep 30 21:39:52 2016 +0000

    Switch HAProxy health check timeout to seconds

    Change-Id: If8166b8e76ca6c1b15963ef99bec07ff2a6fb118
    Closes-Bug: #1600326
    (cherry picked from commit ef11747a56ed210d9ae59e7c08b08fb6b6dc604b)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron-lbaas 9.2.1 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/octavia 0.9.2 release.