fix default host as a ssl-passthrough

SSL passthrough domains are added in the same hostname maps used to route http requests. They share most of their configurations with a few exceptions. One of these exceptions weren't properly implemented - default host was always being configured in the http proxy. This update checks if the default host is an ssl passthrough, properly configuring it in the tcp proxy instead.
jcmoraisjr · Apr 13, 2021 · cddb746 · cddb746
1 parent 3229b3f
commit cddb746
Show file tree

Hide file tree

Showing 5 changed files with 60 additions and 1 deletion.
diff --git a/pkg/converters/ingress/ingress.go b/pkg/converters/ingress/ingress.go
@@ -175,6 +175,9 @@ func (c *converter) syncIngress(ing *extensions.Ingress) {
 
 func (c *converter) syncAnnotations() {
 	c.updater.UpdateGlobalConfig(c.haproxy.Global(), c.globalConfig)
+	if ann, found := c.hostAnnotations[c.haproxy.DefaultHost()]; found {
+		c.updater.UpdateHostConfig(c.haproxy.DefaultHost(), ann)
+	}
 	for _, host := range c.haproxy.Hosts() {
 		if ann, found := c.hostAnnotations[host]; found {
 			c.updater.UpdateHostConfig(host, ann)

diff --git a/pkg/converters/ingress/ingress_test.go b/pkg/converters/ingress/ingress_test.go
@@ -1076,6 +1076,12 @@ func TestSyncAnnPassthrough(t *testing.T) {
 				"ingress.kubernetes.io/ssl-passthrough":           "true",
 				"ingress.kubernetes.io/ssl-passthrough-http-port": "9000",
 			}),
+		c.createIng2Ann("default/echo4", "echo:8443",
+			map[string]string{
+				"ingress.kubernetes.io/app-root":                  "/login",
+				"ingress.kubernetes.io/ssl-passthrough":           "true",
+				"ingress.kubernetes.io/ssl-passthrough-http-port": "9090",
+			}),
 	)
 
 	c.compareConfigFront(`
@@ -1089,6 +1095,14 @@ func TestSyncAnnPassthrough(t *testing.T) {
     backend: default_echo_8443
 `)
 
+	c.compareConfigDefaultFront(`
+hostname: '*'
+paths:
+- path: /
+  backend: default_echo_8443
+rootredirect: /login
+`)
+
 	c.compareConfigBack(`
 - id: default_echo_8080
   endpoints:
@@ -1263,6 +1277,12 @@ spec:
     servicePort: ` + sservice[1]).(*extensions.Ingress)
 }
 
+func (c *testConfig) createIng2Ann(name, service string, ann map[string]string) *extensions.Ingress {
+	ing := c.createIng2(name, service)
+	ing.SetAnnotations(ann)
+	return ing
+}
+
 func (c *testConfig) createIng3(name string) *extensions.Ingress {
 	sname := strings.Split(name, "/")
 	return c.createObject(`

diff --git a/pkg/haproxy/config.go b/pkg/haproxy/config.go
@@ -230,7 +230,7 @@ func (c *config) BuildFrontendGroup() error {
 	fgroupMaps := hatypes.CreateMaps()
 	fgroup := &hatypes.FrontendGroup{
 		Frontends:         frontends,
-		HasSSLPassthrough: len(sslpassthrough) > 0,
+		HasSSLPassthrough: len(sslpassthrough) > 0 || (c.defaultHost != nil && c.defaultHost.SSLPassthrough),
 		DefaultBind:       defaultBind,
 		Maps:              fgroupMaps,
 		HTTPFrontsMap:     fgroupMaps.AddMap(c.mapsDir + "/_global_http_front.map"),

diff --git a/pkg/haproxy/instance_test.go b/pkg/haproxy/instance_test.go
@@ -1724,12 +1724,24 @@ func TestInstanceSSLPassthrough(t *testing.T) {
 	h = c.config.AcquireHost("d3.local")
 	h.AddPath(b, "/")
 	b.Endpoints = []*hatypes.Endpoint{endpointS41s}
+	b.ModeTCP = true
 	h.SSLPassthrough = true
 
 	b = c.config.AcquireBackend("d3", "app-http", "8080")
 	b.Endpoints = []*hatypes.Endpoint{endpointS41h}
 	h.HTTPPassthroughBackend = b.ID
 
+	b = c.config.AcquireBackend("d4", "app4-ssl", "8443")
+	h = c.config.AcquireHost("*")
+	h.AddPath(b, "/")
+	b.Endpoints = []*hatypes.Endpoint{endpointS41s}
+	b.ModeTCP = true
+	h.SSLPassthrough = true
+
+	b = c.config.AcquireBackend("d4", "app4-http", "8080")
+	b.Endpoints = []*hatypes.Endpoint{endpointS41h}
+	h.HTTPPassthroughBackend = b.ID
+
 	c.Update()
 	c.checkConfig(`
 <<global>>
@@ -1741,7 +1753,13 @@ backend d3_app-http_8080
     mode http
     server s41h 172.17.0.141:8080 weight 100
 backend d3_app-ssl_8443
+    mode tcp
+    server s41s 172.17.0.141:8443 weight 100
+backend d4_app4-http_8080
     mode http
+    server s41h 172.17.0.141:8080 weight 100
+backend d4_app4-ssl_8443
+    mode tcp
     server s41s 172.17.0.141:8443 weight 100
 <<backends-default>>
 listen _front__tls
@@ -1752,8 +1770,10 @@ listen _front__tls
     tcp-request content accept if { req.ssl_hello_type 1 }
     use_backend %[var(req.sslpassback)] unless { var(req.sslpassback) _nomatch }
     # default backend
+    use_backend d4_app4-ssl_8443
     server _default_server_socket001 unix@/var/run/_socket001.sock send-proxy-v2
 <<frontend-http>>
+    use_backend d4_app4-http_8080
     default_backend _error404
 frontend _front001
     mode http

diff --git a/rootfs/etc/haproxy/template/haproxy.tmpl b/rootfs/etc/haproxy/template/haproxy.tmpl
@@ -622,6 +622,15 @@ listen _front__tls
 
 {{- /*------------------------------------*/}}
     # default backend
+{{- if $cfg.DefaultHost }}
+{{- if $cfg.DefaultHost.SSLPassthrough }}
+{{- range $path := $cfg.DefaultHost.Paths }}
+{{- if eq $path.Path "/" }}
+    use_backend {{ $path.Backend.ID }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
     server _default_server{{ $fgroup.DefaultBind.Name }} {{ $fgroup.DefaultBind.Socket }} send-proxy-v2
 {{- end }}
 
@@ -740,6 +749,11 @@ frontend _front_http
 {{- /*------------------------------------*/}}
     use_backend %[var(req.backend)] unless { var(req.backend) _nomatch }
 
+{{- if $cfg.DefaultHost }}
+{{- if $cfg.DefaultHost.HTTPPassthroughBackend }}
+    use_backend {{ $cfg.DefaultHost.HTTPPassthroughBackend }}
+{{- end }}
+{{- end }}
 {{- template "defaultbackend" map $cfg }}
 
   # # # # # # # # # # # # # # # # # # #
@@ -942,11 +956,13 @@ frontend {{ $frontend.Name }}
 {{- define "defaultbackend" }}
 {{- $cfg := .p1 }}
 {{- if $cfg.DefaultHost }}
+{{- if not $cfg.DefaultHost.SSLPassthrough }}
 {{- range $path := $cfg.DefaultHost.Paths }}
     use_backend {{ $path.Backend.ID }}
         {{- if ne $path.Path "/" }} if { path_beg {{ $path.Path }} }{{ end }}
 {{- end }}
 {{- end }}
+{{- end }}
 {{- if $cfg.DefaultBackend }}
     default_backend {{ $cfg.DefaultBackend.ID }}
 {{- else }}