Misconfigured health check for Barbican with haproxy

[James Denton]

DISTRIB_ID="OSA"
DISTRIB_RELEASE="15.1.6"
DISTRIB_CODENAME="Ocata"
DISTRIB_DESCRIPTION="OpenStack-Ansible"

When deploying the os_barbican role, the backend health check fails. Upon investigation, haproxy is configured for:

backend barbican-back
    mode http
    balance leastconn
    stick store-request src
    stick-table type ip size 256k expire 30m
    option forwardfor
    option httplog
    option httpchk HEAD /
    http-check expect status 401

However, HEAD does not appear to be an allowed method:

# curl -I http://172.29.237.53:9311/

HTTP/1.1 405 Method Not Allowed
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Allow: GET
Connection: close

A GET returns a 300 with data:

# curl -G http://172.29.237.53:9311/

{"versions": {"values": [{"status": "stable", "updated": "2015-04-28T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.key-manager-v1+json"}], "id": "v1", "links": [{"href": "https://10.50.0.6:9311/v1/", "rel": "self"}, {"href": "http://docs.openstack.org/", "type": "text/html", "rel": "describedby"}]}]}}

It may just be that the path is incorrect, as 'curl -I http://172.29.237.53:9311/v1' does return a 401.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/494583

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/494583
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible/commit/?id=bb48a1ab14480c88a922ecd3687c5d194f6bb8e8
Submitter: Jenkins
Branch: master

commit bb48a1ab14480c88a922ecd3687c5d194f6bb8e8
Author: Jean-Philippe Evrard <email address hidden>
Date: Thu Aug 17 14:23:28 2017 +0000

    Fix Barbican's health checks

    HAProxy healthchecks for Barbican are currently testing by sending
    a HEAD request method, where it should be only using a GET.
    The GET method only should test the /, because /healthcheck
    was not implemented into barbican [1].

    The expected result should be in 2xx/3xx range, which doesn't
    require any special config in haproxy.

    [1] See spec for /healthcheck
    https://review.openstack.org/#/c/207317/5/specs/mitaka/healthcheck-endpoint.rst@117

    Change-Id: I221ff0ad68de77d72a9c45db969ce2084a005774
    Closes-Bug: 1702962

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/pike
Review: https://review.openstack.org/496336

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/496336
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible/commit/?id=b013dec25bc4dd3b923ab0ada5948698e360cac7
Submitter: Jenkins
Branch: stable/pike

commit b013dec25bc4dd3b923ab0ada5948698e360cac7
Author: Jean-Philippe Evrard <email address hidden>
Date: Thu Aug 17 14:23:28 2017 +0000

    Fix Barbican's health checks

    HAProxy healthchecks for Barbican are currently testing by sending
    a HEAD request method, where it should be only using a GET.
    The GET method only should test the /, because /healthcheck
    was not implemented into barbican [1].

    The expected result should be in 2xx/3xx range, which doesn't
    require any special config in haproxy.

    [1] See spec for /healthcheck
    https://review.openstack.org/#/c/207317/5/specs/mitaka/healthcheck-endpoint.rst@117

    Change-Id: I221ff0ad68de77d72a9c45db969ce2084a005774
    Closes-Bug: 1702962
    (cherry picked from commit bb48a1ab14480c88a922ecd3687c5d194f6bb8e8)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-ansible 16.0.0.0rc2 release candidate.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/507057

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/507057
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible/commit/?id=031317a83c00b07394e6002659827ef20e9dda24
Submitter: Jenkins
Branch: stable/ocata

commit 031317a83c00b07394e6002659827ef20e9dda24
Author: Daniel Marks <email address hidden>
Date: Mon Sep 25 12:57:03 2017 +0200

    Fix Barbican's health checks

    HAProxy healthchecks for Barbican are currently testing by sending
    a HEAD request method, where it should be only using a GET.
    The GET method only should test the /, because /healthcheck
    was not implemented into barbican [1].

    The expected result should be in 2xx/3xx range, which doesn't
    require any special config in haproxy.

    [1] See spec for /healthcheck
    https://review.openstack.org/#/c/207317/5/specs/mitaka/healthcheck-endpoint.rst@117

    Change-Id: I221ff0ad68de77d72a9c45db969ce2084a005774
    Closes-Bug: 1702962

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-ansible 15.1.9 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-ansible 17.0.0.0b1 development milestone.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-ansible 17.0.0.0b2 development milestone.