Make HAProxy better at knowing when to pull kubernetes controller nodes from load balancing #654
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
I'm about to add a third kind of haproxy server, and making a third almost identical set of tests seemed bad.
daaang
commented
Jan 26, 2024
| balance roundrobin | ||
| option httpchk HEAD / | ||
| http-check expect status 403 |
There was a problem hiding this comment.
I'm not especially happy running essentially curl -k and considering 403 Forbidden to be "success," but the aim here is not to test our PKI but rather to check that a server is ready to receive requests, and if not, remove it from load balancing. Assuming that we don't have valid certs, 403 is in fact the expected behavior.
If some later version of kubernetes decides to switch to 401 or something, I believe it will be impossible not to notice in the test cluster.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
HAProxy's TCP check must be essentially no more than
nc -v, which was succeeding on a controller node that was very much unavailable.curl -k(andssh) was timing out, so this pull request aims to make HAProxy do something closer tocurl -k. When controller nodes are up and working, as of writing,curl -k https://addr:6443/without any attempt at valid client certs yields a prompt403status.