canonical / canonical/haproxy-operator

Allow http-check health checks for backends with HTTPS

Open
#574 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
4
Forks
12
Avg merge
1d 8h
Merged PRs (30d)
22

Description

### Enhancement Proposal

Currently, http-check health checks are disabled when backends use HTTPS:

https://github.com/canonical/haproxy-operator/blob/04450c357057c3e5bc69924885367e4956530937/haproxy-operator/src/state/haproxy_route.py#L284-L291

From a cursory look, it seems like it should be possible to use http-check with https backends:

https://www.haproxy.com/documentation/haproxy-configuration-tutorials/reliability/health-checks/#customize-connect-arguments
> Use the connect directive to enable SNI, connect over SSL/TLS, perform health checks over SOCKS4, and choose the protocol, such as HTTP/2 or FastCGI. Here’s an example where health checks are performed using HTTP/2 and SSL:
```
backend servers
option httpchk
http-check connect ssl alpn h2
http-check send meth HEAD uri /health ver HTTP/2 hdr Host www.test.local
server srv1 192.168.1.5:443 check
```

### Impact

High (The feature has short-term technical value)

### Impact Rationale

Will allow `http-check` health checks for services that use https to the backend e.g. PS7 Vault, IS Jenkins-aaS, etc.

Contributor guide

Open the contributing guide

Research direction

Start in haproxy-operator/src/state/haproxy_route.py around lines 284-291, then review the linked HAProxy documentation for http-check connect with SSL/TLS. Trace how HTTPS backends currently disable http-check and determine the configuration needed to permit these checks. Done means HTTPS backends can use http-check health checks without breaking existing backend configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, networking
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.