Bug 1124068

Summary:	haproxy update to 1.5 in F20 is not safe
Product:	[Fedora] Fedora	Reporter:	David Strauss <david>
Component:	haproxy	Assignee:	Ryan O'Hara <rohara>
Status:	CLOSED WONTFIX	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	20	CC:	bperkins, cheese, robinlee.sysu, rohara
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-08-04 15:10:51 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description David Strauss 2014-07-28 22:32:10 UTC

Syntax changes to haproxy 1.5 render valid 1.4 configurations unusable. This sort of package update should not happen in stable Fedora releases.

Comment 1 Ryan O'Hara 2014-08-01 15:57:00 UTC

Just curious, what exactly makes the configuration unusable?

If you want to stay on haproxy 1.4, could you use 'yum downgrade' and yum-versionlock to avoid updates to 1.5?

Comment 2 David Strauss 2014-08-01 17:43:10 UTC

> Just curious, what exactly makes the configuration unusable?

There were two issues we noticed:
 * Two frontend/listen blocks with the same name but on different interfaces breaks 1.5. This is probably understandable as a bug fix, but it does make configuration stricter.
 * acl too_many avg_queue(<backend>) gt (and other options) used to have the backend as an optional argument, but it's now required in 1.5, even for listen blockss with a single backend.

> If you want to stay on haproxy 1.4, could you use 'yum downgrade' and yum-versionlock to avoid updates to 1.5?

We've already updated our configuration to be 1.5-compatible. Even if we didn't, "yum downgrade" would only be a stopgap, as we wouldn't be able to get security updates.

Comment 3 David Strauss 2014-08-01 17:45:41 UTC

As a side note, 1.5 has been a major release *four years* in the making. Don't you think it would be reasonable to wait for that to go into the next Fedora release and not spring it on current users?