canonical / canonical/haproxy-operator
haproxy configures invalid frontend against lego charm
- Dominant language
- Python
- Stars
- 4
- Forks
- 12
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 22
Description
### Bug Description
When haproxy is connected to lego, it immediately attempts to set up a 443 listener before it has a certificate issued to generate a valid config. This results in the charms going into this state:
```
App Version Status Scale Charm Channel Rev Exposed Message
haproxy waiting 1 haproxy 2.8/stable 414 no Failed validating the HAProxy config.
lego blocked 1 lego 4/beta 162 no ingress URL not available; waiting for provider
```
This requires manual haproxy.cfg modification to get cert issuance to work. Which, as you can imagine, is entirely ephemeral since Juju will assert its own config very shortly thereafter. The error it ultimately is throwing:
```
[ALERT] (253302) : config : Proxy 'ingress': no SSL certificate specified for bind '[::]:443' at [/etc/haproxy/haproxy.cfg:43] (use 'crt')
```
### Impact
Medium (functionality degraded, workaround exists)
### Impact Rationale
_No response_
### To Reproduce
1. `juju deploy lego --channel 4/beta`
2. `juju deploy haproxy --channel 2.8/stable`
3. `juju integrate lego:certificates haproxy:certificates`
### Environment
```
:~$ snap list juju
Name Version Rev Tracking Publisher Notes
juju 3.6.25 35378 3/stable canonical✓ -
```
Backing a microcloud cluster:
```
Clouds available on the controller:
Cloud Regions Default Type
my-controller 1 default lxd
```
```
App Version Status Scale Charm Channel Rev Exposed Message
haproxy active 1 haproxy 2.8/stable 414 no
lego active 1 lego 4/beta 162 no 1/1 certificate requests are fulfilled
```
### Relevant log output
```shell
juju debug-log --include haproxy/0
unit-haproxy-0: 07:56:29 ERROR unit.haproxy/0.juju-log Failed validating the HAProxy config
unit-haproxy-0: 07:56:29 ERROR unit.haproxy/0.juju-log Validation of the HAproxy config failed.It is likely that some information are missingwaiting to reconcile: Failed validating the HAProxy config..
Traceback (most recent call last):
File "/var/lib/juju/agents/unit-haproxy-0/charm/src/haproxy.py", line 281, in _validate_haproxy_config
subprocess.run(validate_config_command, capture_output=True, check=True) # nosec B603
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/subprocess.py", line 571, in run
raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['/usr/sbin/haproxy', '-f', '/etc/haproxy/haproxy.cfg', '-c']' returned non-zero exit status 1.
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "/var/lib/juju/agents/unit-haproxy-0/charm/src/state/validation.py", line 63, in wrapper
return method(instance, *args)
^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/juju/agents/unit-haproxy-0/charm/src/charm.py", line 540, in _on_ingress_data_provided
self._reconcile()
File "/var/lib/juju/agents/unit-haproxy-0/charm/src/charm.py", line 287, in _reconcile
self._configure_ingress(charm_state, IngressRequirersInformation)
File "/var/lib/juju/agents/unit-haproxy-0/charm/src/charm.py", line 323, in _configure_ingress
self.haproxy_service.reconcile_ingress(
File "/var/lib/juju/agents/unit-haproxy-0/charm/src/haproxy.py", line 155, in reconcile_ingress
self._validate_haproxy_config()
File "/var/lib/juju/agents/unit-haproxy-0/charm/src/haproxy.py", line 284, in _validate_haproxy_config
raise HaproxyValidateConfigError("Failed validating the HAProxy config.") from exc
haproxy.HaproxyValidateConfigError: Failed validating the HAProxy config.
unit-haproxy-0: 07:56:29 INFO juju.worker.uniter.operation ran "update-status" hook (via hook dispatching script: dispatch)
```
### Additional context
This is a companion bug to one I filed with the lego charm (https://github.com/canonical/lego-operator/issues/276).
Contributor guide
Research direction
Start with src/haproxy.py, especially reconcile_ingress and _validate_haproxy_config, then follow the _configure_ingress call in src/charm.py. Reproduce the issue with the listed Juju deploy and integration commands, and inspect existing tests if available. Done means the HAProxy configuration validates during the pre-certificate state and lego can complete certificate issuance without manual edits.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100