From e18992ca19b64561e873957a4c2590487601f4f5 Mon Sep 17 00:00:00 2001 From: ch4nn0n Date: Wed, 15 Jul 2026 21:41:22 +0800 Subject: haproxy: T9097: add ssl checks-only for TLS health checks When load balancing TLS backends in TCP passthrough mode there is currently no way to perform an HTTPS health check: http-check sends the request in plaintext, and the only TLS option (backend ssl no-verify/ca-certificate) renders the 'ssl' keyword on the server lines, which re-encrypts the forwarded traffic and breaks passthrough of clients that already speak TLS end-to-end (e.g. kube-apiserver clients authenticating with TLS client certificates). Add 'set load-balancing haproxy backend ssl checks-only' (valueless). When set, the existing backend ssl options apply to health checks only: server lines get 'check-ssl verify none' or 'check-ssl ca-file .pem' instead of 'ssl ...', leaving forwarded traffic untouched. Commit validation rejects checks-only when no server in the backend has check enabled, or when neither no-verify nor ca-certificate is set, since either case would otherwise be inert. Existing configurations render unchanged. --- src/conf_mode/load-balancing_haproxy.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'src') diff --git a/src/conf_mode/load-balancing_haproxy.py b/src/conf_mode/load-balancing_haproxy.py index 3a7fa7f01..cd43d47fc 100644 --- a/src/conf_mode/load-balancing_haproxy.py +++ b/src/conf_mode/load-balancing_haproxy.py @@ -142,6 +142,18 @@ def verify(lb): if {'no_verify', 'ca_certificate'} <= set(back_config['ssl']): raise ConfigError(f'backend {back} cannot have both ssl options no-verify and ca-certificate set!') + if 'checks_only' in back_config['ssl']: + if not {'no_verify', 'ca_certificate'} & set(back_config['ssl']): + raise ConfigError( + f'backend {back} ssl option checks-only requires no-verify or ca-certificate!' + ) + if not any( + 'check' in server for server in back_config['server'].values() + ): + raise ConfigError( + f'backend {back} ssl option checks-only requires at least one server with check enabled!' + ) + tmp = dict_search('ssl.ca_certificate', back_config) if tmp: verify_pki_ca_certificate(lb, tmp) -- cgit v1.2.3