haproxy: T9097: add ssl checks-only for TLS health checks

When load balancing TLS backends in TCP passthrough mode there is
currently no way to perform an HTTPS health check: http-check sends
the request in plaintext, and the only TLS option (backend ssl
no-verify/ca-certificate) renders the 'ssl' keyword on the server
lines, which re-encrypts the forwarded traffic and breaks passthrough
of clients that already speak TLS end-to-end (e.g. kube-apiserver
clients authenticating with TLS client certificates).

Add 'set load-balancing haproxy backend <name> ssl checks-only'
(valueless). When set, the existing backend ssl options apply to
health checks only: server lines get 'check-ssl verify none' or
'check-ssl ca-file <ca>.pem' instead of 'ssl ...', leaving forwarded
traffic untouched. Commit validation rejects checks-only when no
server in the backend has check enabled, or when neither no-verify
nor ca-certificate is set, since either case would otherwise be
inert. Existing configurations render unchanged.

0 files changed, 0 insertions, 0 deletions