cockroachdb / cockroachdb/cockroach

cli: gen haproxy can ignore --http-addr after --advertise-http-addr

Open
#172,968 2 comments 0 reactions 0 assignees View on GitHub
O-community T-db-server
Dominant language
Go
Stars
32.5k
Forks
4.1k
PR merge metrics
PR metrics pending

Description

**Describe the problem**

`cockroach gen haproxy` can generate an HAProxy health check for the default HTTP port (`8080`) instead of the HTTP port configured on a node.

The generator obtains each node's startup arguments through the status API. In `nodeStatusesToNodeInfos`, it uses a substring match to find `http-addr` or `http-port`. Consequently, the valid `--advertise-http-addr` flag is mistaken for `--http-addr`. The local parser does not register the advertised-address flag; its error is discarded, and the generator stops examining subsequent arguments. A later real `--http-addr` is ignored.

**To Reproduce**

1. Start a node with the advertised HTTP address before the listening HTTP address:

```text
cockroach start \
--advertise-http-addr=node.example:9999 \
--http-addr=node.example:5678
```

2. Run `cockroach gen haproxy` against the cluster.
3. Inspect the generated backend health-check port for that node.

A direct unit-level reproduction is a `statuspb.NodeStatus` with:

```go
Args: []string{
"--advertise-http-addr=node.example:9999",
"--http-addr=node.example:5678",
}
```

**Expected behavior**

The generated HAProxy configuration uses port `5678` for that node's health check, matching `--http-addr`.

**Observed behavior**

The generator uses `base.DefaultHTTPPort` (`8080`) because parsing starts at `--advertise-http-addr`, returns an ignored unknown-flag error, and the scan terminates before it reaches `--http-addr`.

**Additional data / screenshots**

No logs or screenshots are required. The incorrect port follows deterministically from the status argument slice and the current parsing logic.

**Environment:**

- CockroachDB version: current `master` source tree (commit `98b5afc2b`)
- Server OS: any supported OS; this is CLI argument parsing
- Client app: `cockroach gen haproxy`

**Additional context**

A valid and common configuration that specifies both advertised and listening HTTP addresses can produce a configuration that health-checks the wrong port, potentially causing HAProxy to mark healthy nodes unavailable.

Suggested resolution: configure the local `pflag.FlagSet` to ignore unknown flags and parse the complete `status.Args` slice, rather than matching a substring and parsing only the remaining suffix. Add regressions for an advertised HTTP address preceding `--http-addr`, unrelated flags between recognized flags, and unrelated flag names that contain `http-addr` or `http-port`.

Contributor guide

Open the contributing guide

Research direction

Start at the `cockroach gen haproxy` entry point and trace `nodeStatusesToNodeInfos`, using the `statuspb.NodeStatus.Args` example as a focused reproduction. Check the local `pflag.FlagSet` handling and add regressions for advertised HTTP addresses before `--http-addr`, unrelated flags between recognized flags, and names containing `http-addr` or `http-port`. Done means the generated health check uses port 5678 and the listed argument-order cases pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.