canonical / canonical/stsstack-bundles
Octavia cannot create load balancers
- Dominant language
- Shell
- Stars
- 10
- Forks
- 37
- Avg merge
- 7d 16h
- Merged PRs (30d)
- 1
Description
Octavia deployed with stsstack-bundles is now no-longer able to sucessfully create load balancers.
Attempting to deploy a loadbalancer with `openstack loadbalancer create --name lb --vip-subnet-id private_subnet` leads to the amphora getting stuck in `BOOTING` status and the loadbalancer in `PENDING_CREATE` status until it eventually flips to `ERROR`.
Checking the octavia logs in `/var/log/octavia/octavia-worker.log` on the `octavia/0` unit I see the following error repeated
```
2026-03-09 21:51:02.399 66214 WARNING octavia.amphorae.drivers.haproxy.rest_api_driver [-] Could not connect to instance. Retrying.: requests.exceptions.SSLError: HTTPSConnectionPool(host='fc00:db1b:10d3:f55:f816:3eff:fe89:b49f', port=9443): Max retries exceeded with url: // (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1007)')))
```
Attempting to reach the endpoint directly shows
```
curl -X GET http://[fc00:db1b:10d3:f55:f816:3eff:fe89:b49f]:9443
Internal Server Error
Internal Server Error
```
## Reproduction
I have been able to reproduce the issue on noble-epoxy, noble-caracal, and jammy-caracal using the following setup.
From within the openstack directory
1. `./generate-bundle.sh -n octavia-doesnt-work --octavia -r caracal -s jammy --run`
2. When blocked in needing to unseal vault `./tools/vault-unseal-and-authorise.sh`
3. Once everything but octavia has unsettled `./configure && tools/upload_octavia_amphora_image.sh&&tools/configure_octavia.sh`
4. `source novarc`
5. Attempt to create a loadbalancer with `openstack loadbalancer create --name lb --vip-subnet-id private_subnet`
6. Absorb the errors and behavior defined above
## Root cause
I haven't yet been able to track down exactly what is causing the error, but bisecting shows that it was introduced in 9995d9a943d402e82315b88ab82b8b2a54d5b3ee. My guess is that `octavia-diskimage-retrofit` is not trying to build amphorae from noble images and there is some incompatability that keeps amphorae from working on noble. This matches my testing where I was unable to build a functioning amphora on noble by using ubuntu packages and only succeeded when building directly from the the upstream source.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.