Fix proxy protocol for Health Check frontend & Set stick-table size to IPv6 #633
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
a18e
force-pushed
the
fix-accept-proxy-feature-for-aws
branch
from
6fb9121
to
3c4cede
Compare
peanball
reviewed
Mar 18, 2024
a18e
force-pushed
the
fix-accept-proxy-feature-for-aws
branch
2 times, most recently
from
8b953fb
to
66ba663
Compare
a18e
changed the title
a18e
force-pushed
the
fix-accept-proxy-feature-for-aws
branch
from
367aab3
to
34195df
Compare
peanball
previously approved these changes
Mar 20, 2024
a18e
force-pushed
the
fix-accept-proxy-feature-for-aws
branch
from
34195df
to
fc77930
Compare
a18e
force-pushed
the
fix-accept-proxy-feature-for-aws
branch
from
fc77930
to
6acb0ac
Compare
b1tamara
added
run-ci
b1tamara
force-pushed
the
fix-accept-proxy-feature-for-aws
branch
from
7066930
to
a2d313f
Compare
a18e
force-pushed
the
fix-accept-proxy-feature-for-aws
branch
from
7e52dc0
to
c921f3f
Compare
peanball
force-pushed
the
fix-accept-proxy-feature-for-aws
branch
2 times, most recently
from
a6907fe
to
de6f849
Compare
a18e
force-pushed
the
fix-accept-proxy-feature-for-aws
branch
2 times, most recently
from
31549be
to
f9e30b4
Compare
(bpm, bosh-stemcells)
a18e
force-pushed
the
fix-accept-proxy-feature-for-aws
branch
from
f9e30b4
to
82bf964
Compare
plowin
reviewed
May 6, 2024
Mrizwanshaik
pushed a commit
to sap-contributions/haproxy-boshrelease
that referenced
this pull request
May 6, 2024
…o IPv6 (cloudfoundry#633) * fix(proxy-protocol): fix proxy protocol for Health Check frontend * docs: Adjust spec description for accept_proxy * test: Add spec test * feat: Set stick tables to type ipv6 * test: fix linter error in test case * fix: Check the value of accept_proxy for http health checks * feat: Add check for required files to run-local.sh (bpm, bosh-stemcells) * feat: (WIP) Proxy Protocol Check for Traffic Endpoint * test: add auto-download of stemcells for local test * fix(test): fix auto-download method for when all files are present * fix: Finish proxy_protocol acceptance test * fix: Linter fixes, remove unneeded changes * fix: remove go toolchain * fix: typo in docstring --------- Co-authored-by: Tamara Boehm <tamara.boehm@sap.com> Co-authored-by: Alexander Lais <alexander.lais@sap.com>
Mrizwanshaik
pushed a commit
to sap-contributions/haproxy-boshrelease
that referenced
this pull request
May 6, 2024
…o IPv6 (cloudfoundry#633) * fix(proxy-protocol): fix proxy protocol for Health Check frontend * docs: Adjust spec description for accept_proxy * test: Add spec test * feat: Set stick tables to type ipv6 * test: fix linter error in test case * fix: Check the value of accept_proxy for http health checks * feat: Add check for required files to run-local.sh (bpm, bosh-stemcells) * feat: (WIP) Proxy Protocol Check for Traffic Endpoint * test: add auto-download of stemcells for local test * fix(test): fix auto-download method for when all files are present * fix: Finish proxy_protocol acceptance test * fix: Linter fixes, remove unneeded changes * fix: remove go toolchain * fix: typo in docstring --------- Co-authored-by: Tamara Boehm <tamara.boehm@sap.com> Co-authored-by: Alexander Lais <alexander.lais@sap.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This Pull Request introduces two changes to enhance the IPv6 support of
haproxy-boshrelease:1. Proxy Protocol Adjustment for Health Check Frontend
AWS Network Load Balancers (NLBs) utilize the same Proxy Protocol setting for both forwarded traffic and health checks, as outlined in the AWS documentation.
The existing
accept_proxyconfiguration property only applies theaccept-proxysetting (refer to the HAProxy documentation) to thehttpandhttpsfrontends, excluding the health check frontend. This exclusion leads to the HAProxies being perceived as unhealthy by the load balancer once the feature is activated.It is not feasible to globally enable
accept-proxyfor the health check frontend becausemonitalso utilizes this frontend for the Remote host Service check, and it does not support the Proxy Protocol. Therefore, we are employing theexpect-proxyfeature to avoid expecting the proxy protocol for requests originating from localhost (i.e.,monit).2. Stick-Table Size Adjustment for IPv6
Currently, requests from IPv6 source addresses (either via Proxy Protocol or when HAProxy operates in dualstack/
v4v6enabled-mode) cannot be rate-limited. This limitation is due to the stick tables used for rate limiting being of theiptype, which cannot store the longer IPv6 addresses. This PR modifies the type toipv6, enabling the storage of both IPv4 and IPv6 addresses (see HAProxy documentation). The additional memory overhead is negligible.