Hi, I want to configure a HAProxy in front of other 2 load balancers which serve 2 k8s clusters. My issue seems to be the fact that HAProxy tries to use relative paths from backend. I would like to have absolute paths used, so instead of “/” I need https://fqdn/
For example, I have to use this check where an absolute path is set:
option httpchk GET https://as-infra-gtm.unicorn.infra/orchestrator_/api/status HTTP/1.1
using only this relative /orchestrator_/api/status, it doesn’t work.
my haproxy is 1.8
HA-Proxy version 1.8.27-493ce0b 2020/11/06
Copyright 2000-2020 Willy Tarreau willy@haproxy.org
Build options :
TARGET = linux2628
CPU = generic
CC = gcc
CFLAGS = -O2 -g -fno-strict-aliasing -Wdeclaration-after-statement -fwrapv -Wno-null-dereference -Wno-unused-label -Wno-stringop-overflow
OPTIONS = USE_LINUX_TPROXY=1 USE_CRYPT_H=1 USE_GETADDRINFO=1 USE_ZLIB=1 USE_REGPARM=1 USE_OPENSSL=1 USE_LUA=1 USE_SYSTEMD=1 USE_PCRE=1
Default settings :
maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200
Built with OpenSSL version : OpenSSL 1.1.1k FIPS 25 Mar 2021
Running on OpenSSL version : OpenSSL 1.1.1k FIPS 25 Mar 2021
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3
Built with Lua version : Lua 5.3.4
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND
Encrypted password support via crypt(3): yes
Built with multi-threading support.
Built with PCRE version : 8.42 2018-03-20
Running on PCRE version : 8.42 2018-03-20
PCRE library supports JIT : no (USE_PCRE_JIT not set)
Built with zlib version : 1.2.11
Running on zlib version : 1.2.11
Compression algorithms supported : identity(“identity”), deflate(“deflate”), raw-deflate(“deflate”), gzip(“gzip”)
Built with network namespace support.
Available polling systems :
epoll : pref=300, test result OK
poll : pref=200, test result OK
select : pref=150, test result OK
Total: 3 (3 usable), will use epoll.
Available filters :
[SPOE] spoe
[COMP] compression
[TRACE] trace
And here is my haproxy config:
#---------------------------------------------------------------------
Example configuration for a possible web application. See the
full configuration options online.
https://www.haproxy.org/download/1.8/doc/configuration.txt
#---------------------------------------------------------------------
#---------------------------------------------------------------------
Global settings
#---------------------------------------------------------------------
global
# to have these messages end up in /var/log/haproxy.log you will
# need to:
#
# 1) configure syslog to accept network log events. This is done
# by adding the ‘-r’ option to the SYSLOGD_OPTIONS in
# /etc/sysconfig/syslog
#
# 2) configure local2 events to go to the /var/log/haproxy.log
# file. A line like the following can be added to
# /etc/sysconfig/syslog
#
# local2.* /var/log/haproxy.log
#
log 127.0.0.1 local2 debug
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon
# turn on stats unix socket
stats socket /var/lib/haproxy/stats mode 600 level admin
ca-base /etc/haproxy/ca
crt-base /etc/haproxy/crt
ssl-default-bind-options no-sslv3 prefer-client-ciphers
# utilize system-wide crypto-policies
#---------------------------------------------------------------------
common defaults that all the ‘listen’ and ‘backend’ sections will
use if not designated in their block
#---------------------------------------------------------------------
defaults
mode http
log global
option httplog
option dontlognull
option http-server-close
option forwardfor except 127.0.0.0/8
option redispatch
retries 3
timeout http-request 10s
timeout queue 1m
timeout connect 10s
timeout client 1m
timeout server 1m
timeout http-keep-alive 10s
timeout check 10s
maxconn 3000
#---------------------------------------------------------------------
main frontend which proxys to the backends
#---------------------------------------------------------------------
frontend main
bind *:443 ssl crt /etc/haproxy/all.pem
reqadd X-Forwarded-Proto:\ https
default_backend app
backend app
mode http
balance roundrobin
option httpchk GET https://as-infra-gtm.unicorn.infra/orchestrator_/api/status HTTP/1.1
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
server as-infra.unicorn.infra 10.10.25.21:443 check check-ssl ssl check-sni as-infra-gtm.unicorn.infra ca-file /etc/haproxy/ca/CACert.crt port 443 ssl-max-ver TLSv1.2
server as-infra2.unicorn.infra 10.10.25.22:443 check check-ssl ssl check-sni as-infra-gtm.unicorn.infra ca-file /etc/haproxy/ca/CACert.crt port 443 ssl-max-ver TLSv1.2
[root@as-haproxy policies]# curl -I --http1.1 -X GET https://as-infra-gtm.unicorn.infra/
HTTP/1.0 503 Service Unavailable
Cache-Control: no-cache
Connection: close
Content-Type: text/html
[root@as-haproxy policies]# curl -I --http1.1 -X GET https://as-infra-gtm.unicorn.infra/ --resolve as-infra-gtm.unicorn.infra:443:10.10.25.21
HTTP/1.1 200 OK
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
set-cookie: UiPathBrowserId=85a449f1-7025-4f32-b9cc-5ff86b9ba073; Path=/; Expires=Tue, 19 Dec 2023 15:07:22 GMT; HttpOnly
set-cookie: .uipath.sso=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT
surrogate-control: no-store
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
akamai-cache-control: max-age=0
pragma: no-cache
expires: 0
content-type: text/html; charset=utf-8
content-length: 11146
etag: W/“2b8a-4nQSnxo4G0YG1WNikvn8vMQIZaY”
date: Wed, 28 Dec 2022 15:07:22 GMT
x-envoy-upstream-service-time: 37
server: istio-envoy
