canonical / canonical/haproxy-operator
Allow http-check health checks for backends with HTTPS
- Dominant language
- Python
- Stars
- 4
- Forks
- 12
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 22
Description
### Enhancement Proposal
Currently, http-check health checks are disabled when backends use HTTPS:
https://github.com/canonical/haproxy-operator/blob/04450c357057c3e5bc69924885367e4956530937/haproxy-operator/src/state/haproxy_route.py#L284-L291
From a cursory look, it seems like it should be possible to use http-check with https backends:
https://www.haproxy.com/documentation/haproxy-configuration-tutorials/reliability/health-checks/#customize-connect-arguments
> Use the connect directive to enable SNI, connect over SSL/TLS, perform health checks over SOCKS4, and choose the protocol, such as HTTP/2 or FastCGI. Here’s an example where health checks are performed using HTTP/2 and SSL:
```
backend servers
option httpchk
http-check connect ssl alpn h2
http-check send meth HEAD uri /health ver HTTP/2 hdr Host www.test.local
server srv1 192.168.1.5:443 check
```
### Impact
High (The feature has short-term technical value)
### Impact Rationale
Will allow `http-check` health checks for services that use https to the backend e.g. PS7 Vault, IS Jenkins-aaS, etc.
Contributor guide
Research direction
Start in haproxy-operator/src/state/haproxy_route.py around lines 284-291, then review the linked HAProxy documentation for http-check connect with SSL/TLS. Trace how HTTPS backends currently disable http-check and determine the configuration needed to permit these checks. Done means HTTPS backends can use http-check health checks without breaking existing backend configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, networking
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100