Dear Maintainer,

When enabling the extension metadata in ovn_agent [1], there is an error indicating that haproxy is missing in neutron-ovn-agent.log because haproxy is not installed as depends for neutron-ovn-agent. After installing haproxy the extension worked like intended. Probably haproxy is also missing as depends in neutron-ovn-metadata-agent, but I didn't test it. I will create a MR within salsa.debian.org for this bug.

Error message in /var/log/neutron/neutron-ovn-agent.log:

while starting process in namespace ovnmeta-ee8248b4-d571-4d93-a039-e0df479662a1: neutron_lib.exceptions.ProcessExecutionError: Exit code: 99; Cmd: ['ip', 'netns', 'exec', 'ovnmeta-ee8248b4-d571-4d93-a039-e0df479662a1', 'env', 'PROCESS_TAG=haproxy-ee8248b4-d571-4d93-a039-e0df479662a1', 'haproxy', '-f', '/var/lib/neutron/ovn-metadata-proxy/ee8248b4-d571-4d93-a039-e0df479662a1.conf']; Stdin: ; Stdout: ; Stderr: /usr/bin/neutron-rootwrap: Unauthorized command: ip netns exec ovnmeta-ee8248b4-d571-4d93-a039-e0df479662a1 env PROCESS_TAG=haproxy-ee8248b4-d571-4d93-a039-e0df479662a1 haproxy -f /var/lib/neutron/ovn-metadata-proxy/ee8248b4-d571-4d93-a039-e0df479662a1.conf (no filter matched)

sudo ip netns exec ovnmeta-ee8248b4-d571-4d93-a039-e0df479662a1 haproxy -v

exec of "haproxy" failed: No such file or directory

2026-03-21 12:24:53.322 252705 ERROR neutron.agent.linux.external_process [-] metadata-proxy for metadata with uuid 407a0819-8cc7-4d13-9506-cd314f5a0ac6 not found. The process should not have died
2026-03-21 12:24:53.322 252705 WARNING neutron.agent.linux.external_process [-] Respawning metadata-proxy for uuid 407a0819-8cc7-4d13-9506-cd314f5a0ac6
2026-03-21 12:24:53.322 252705 DEBUG neutron.agent.linux.utils [-] Unable to access /var/lib/neutron/external/pids/407a0819-8cc7-4d13-9506-cd314f5a0ac6.pid.haproxy; Error: [Errno 2] No such file or directory: '/usr/lib/python3/dist-packages/neutron/agent/linux/utils.py:269
2026-03-21 12:24:53.324 252705 DEBUG neutron.agent.metadata.driver_base [-] haproxy_cfg =
global
    log         /dev/log local0 debug
    log-tag     haproxy-metadata-proxy-407a0819-8cc7-4d13-9506-cd314f5a0ac6
    user        neutron
    group       neutron
    maxconn     1024
    pidfile     /var/lib/neutron/external/pids/407a0819-8cc7-4d13-9506-cd314f5a0ac6.pid.haproxy
    daemon

defaults
    log global
    mode http
    option httplog
    option dontlognull
    option http-server-close
    option forwardfor
    retries                 3
    timeout http-request    30s
    timeout connect         30s
    timeout client          32s
    timeout server          32s
    timeout http-keep-alive 30s

listen listener
    bind 169.254.169.254:80
    bind fe80::a9fe:a9fe:80 interface tap407a0819-81
    server metadata /var/lib/neutron/metadata_proxy

    http-request add-header X-OVN-Network-ID 407a0819-8cc7-4d13-9506-cd314f5a0ac6
 create_config_file /usr/lib/python3/dist-packages/neutron/agent/metadata/driver_base.py:155

[1] /etc/neutron/agent.conf.d/ovn_agent.conf:

[DEFAULT]
ovn_metadata_enabled = True
[agent]
extensions = metadata

Cheers
Saki

Hello,

Bug #1135272 in neutron reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/neutron/-/commit/df4415fe603210df15a63763747047fd958dffce
------------------------------------------------------------------------
* Add haproxy as runtime depends of neutron-ovn-agent. Thanks to Sakirnth
    Nagarasa for the report (Closes: #1135272).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1135272

Hello,

Bug #1135272 in neutron reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/neutron/-/commit/2c8e55f60e5001712418750e5a6628a43b157d61
------------------------------------------------------------------------
* Add haproxy as runtime depends of neutron-ovn-agent. Thanks to Sakirnth
    Nagarasa for the report (Closes: #1135272).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1135272

We believe that the bug you reported is fixed in the latest version of
neutron, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1135272@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated neutron package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 07 May 2026 14:31:21 +0200
Source: neutron
Architecture: source
Version: 2:28.0.0-2
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1135272
Changes:
 neutron (2:28.0.0-2) unstable; urgency=medium
 .
   * Add haproxy as runtime depends of neutron-ovn-agent. Thanks to Sakirnth
     Nagarasa for the report (Closes: #1135272).
Checksums-Sha1:
 f3cabc1ecf65ff2b81d623870eb47ba35603e043 4929 neutron_28.0.0-2.dsc
 a1bf695216f7f0b0fee5afc7a2441817e8856cfd 43308 neutron_28.0.0-2.debian.tar.xz
 26126d96976f1a8caec7cd82cbbfe31a0c94a8c6 22440 neutron_28.0.0-2_amd64.buildinfo
Checksums-Sha256:
 79a9679f6e633316e9230e645a5b36ebb93da2ed9d2e631f21130f46c62bb651 4929 neutron_28.0.0-2.dsc
 b5a36c5cca8b6fd387477b33d3feaf8f761d26c1f4ef8511cc24c36f63684079 43308 neutron_28.0.0-2.debian.tar.xz
 0977de5d4e946bf490ebd5ebf9143da58a9f75f77623029ef26a132b8fa6587b 22440 neutron_28.0.0-2_amd64.buildinfo
Files:
 33c686b7d72c851815d4ffacd142c6a3 4929 net optional neutron_28.0.0-2.dsc
 8731d227241993ed57d9d1a64c767130 43308 net optional neutron_28.0.0-2.debian.tar.xz
 a823326bae2f7ae8179b947e2bfe509a 22440 net optional neutron_28.0.0-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmn8ibYACgkQ1BatFaxr
Q/7F9w//SaxulVy85ajuhxRgz2q5/K6+alURFis+ISgVnLBwM6JNhlqqaXV4l3K6
pkTqt47jLsafJslZsxcsZ8zGo7amkrqR5ETZJ9Zk7RwpeK19eoxH4YKq+qjU+TDQ
tB4lLOewHDZemTZY4qYfPXi45ioT8rF11eVMvT0yvACn76CGhokBJZ0SIEaptA+j
kdBdCDI/8yOkIry3y7T8/lKOxxHtPo6ch1LthSOrNc8juddcrLAJw7iZqN5eNcCr
cQ60EcCaUFjzsNi7FDY2zAVxIoKRhGSn0wHRypj/MhtRj6393JGWzM8BpACXvRCn
zZfbFD2Vae/iZnHPqRKlTu+0wJS1pLp6lDJwsYz3sJFYJL4J6T+VYP+2ZxjHEDa4
0hzKCfphfNPjJbA7pR/rc22nPp8NLEjzyG+CcYX5YbMCy2sk5thd4ySfWh8Dqo+Z
iDbPSHr7jRcVdko7TCLNKrHY+RDMWgDk37P5ZZnfLFqVCB7NWChl5S/lH5oYVC6M
HqAp0IKReFvwe1hVwq/C/P+xDRZGW4tBm1xuXrKNH/XqLGFxbK//Z4o1ZzXfzeIO
azUmEVL9kuF0foK6Qd0bslvtZ430bwvfSPdVhZkK5pqPFY+Hhir/KzKbwE/QmOH5
MOQp6flCaWy5+kH42lG1IvgabVTpwidij0s83/fZQvgyX+068HI=
=xP1k
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
neutron, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1135272@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated neutron package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 05 Jun 2026 11:00:14 +0200
Source: neutron
Architecture: source
Version: 2:26.0.3-0+deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1135272 1138844
Changes:
 neutron (2:26.0.3-0+deb13u2) trixie-security; urgency=medium
 .
   * New upstream point release.
   * Removed patches applied upstream:
     - Add_state_reporting_back_to_metadata_agents.patch
     - Fix_LoopingCallBase_argument_issue.patch
   * Add start-time=%t in neutron-api-uwsgi.ini.
   * Add haproxy as runtime depends of neutron-ovn-agent. Thanks to Sakirnth
     Nagarasa for the report (Closes: #1135272).
   * CVE-2026-50266 / OSSA-2026-021: Neutron port RBAC policy bypass allows
     project managers to set trusted device owners on shared networks. Added
     upstream patch: Fix port RBAC policies to require network ownership
     (Closes: #1138844).
Checksums-Sha1:
 07942b56d312f39f43dc72b334042f0f6bcdd3b4 5086 neutron_26.0.3-0+deb13u2.dsc
 153a29dc30b55187ea6bb052e94cb48d012dc500 10241136 neutron_26.0.3.orig.tar.xz
 053543953d67b6774104fa0a98496994369ceea0 47164 neutron_26.0.3-0+deb13u2.debian.tar.xz
 406b88ce61cdaca46373745f1a008a848202e1d4 23146 neutron_26.0.3-0+deb13u2_amd64.buildinfo
Checksums-Sha256:
 dec5eea268039fd604d47036d14cb84f8014d26ff71a29503791679b296a9ad2 5086 neutron_26.0.3-0+deb13u2.dsc
 611e8b2e2aab1f6585bd426bcb91b94c3f88215d2913aa1158f6a604d448c1be 10241136 neutron_26.0.3.orig.tar.xz
 767089c90a06b06b2fa22b32895236a1ef0926343983d8d038d0527e899e2fbb 47164 neutron_26.0.3-0+deb13u2.debian.tar.xz
 7de63a7d206fa1259cd49ad6ac799354c00914c03e7a921891f896408e94c4be 23146 neutron_26.0.3-0+deb13u2_amd64.buildinfo
Files:
 323dfc5e716b4eebb614f0640d771ad0 5086 net optional neutron_26.0.3-0+deb13u2.dsc
 605a4f7f503a30e367b766d6a903f853 10241136 net optional neutron_26.0.3.orig.tar.xz
 7eae47cec7cc4f63ef5664d91ba2eb38 47164 net optional neutron_26.0.3-0+deb13u2.debian.tar.xz
 e2019df24eaff587ca246ab53c7381d9 23146 net optional neutron_26.0.3-0+deb13u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmopEbEACgkQ1BatFaxr
Q/5meQ/+O9QVuuLdXXmBYFQskN4YqKTRr8Qlybz5EaIg96ZiIY6tezlPKKn54nW3
xrQ5m0WpG/A/FavCE4CTRZnL19Rnh9z38z4WisCasIOt1XPfRH+9gy06o8kMdVKy
3yCl84riK3kqKamJUwumHhLellyJA6qzqt4BbAgQkQBgWj5liw3AlWYl+iHbZZbg
AqnPcY9houwAocdWS5G/H3VkbTNIN61yi9n7KaKlwJe/vjRjZ21UzdSmkEXX3dqM
+Eh+YIZVFhgpTp4BKuizXH0XVOTYeqABYjmIcm/Xfh71Io4KP5JfLt96u5NbrBGa
7wB5EinCT6facN6ayRWdsIWfOtuwObme7fDS0QDKSwmmT0emmo+R49d+tj9co6o1
23YQwzR7pYqhq0jotw+PbX4PsVPhIRaAnxaRoAsqHNv/L5v3QL8r0D5SPxyBYjFH
4R92IpKOEru0uoSbGr2nD3oqzqZDeI6bltZQLvkWYuZQlp8eBtWCS0vNsVqUXg1M
jYL61ub4LrXxQViOpL1186xWNGDX6FKrGFPLEi8ajuMdppWLxigw48puwIkcLdm9
zkiManztCieWmv356e4+2XTm5zRePk0v6l0h5yS14e54JyfKPrfKaYbzKpxC8eFb
YXSVFolg4WW2ijrD4wP79KGzuZd7RmUXPkprbQzO3PwHMZSnKSM=
=WRUy
-----END PGP SIGNATURE-----