From 45f5c283e32e4753360c4e4c9627043b20a30e24 Mon Sep 17 00:00:00 2001 From: Michele Baldessari Date: Sat, 18 May 2019 21:18:48 +0200 Subject: [PATCH] Fix haproxy stats network binding a) The haproxy.stats stanza in haproxy config file has pretty much remained the same since newton: listen haproxy.stats bind 192.168.24.8:1993 transparent mode http stats enable stats uri / stats auth admin:tRJre6PnQuN4ZwqKYUygTJArB b) what we do today with the haproxy stats makes little sense: - we bind it to the VIP running on the control-plane network on all controller nodes - de facto we allow to look at the haproxy stat info via web only on the node holding the ctlplane VIP - since haproxy does not share stats across nodes, we're effectively limited at looking at the stats info on a single node. Now imagine ctrl-0 holding the internal_api VIP and ctrl-1 holding the ctlplane VIP. Basically now the only stats you will be able to see are the ones relative to keystone_admin (which for other silly reasons has been moved to ctlplane by default) and very little else. Tested this and am able to bind the haproxy stat to another network and to have it listen to the IP of the node on said network (in addition to the ctrlplane vip which we do not remove as it might break stuff): listen haproxy.stats bind fd00:fd00:fd00:2000::16:1993 transparent bind 192.168.24.15:1993 transparent mode http stats enable stats uri / stats auth admin:password Closes-Bug: #1830334 Depends-On: Iab5f11c3065ff34a3543621554e7f05161d069f2 Change-Id: If2ee15f1e0fcf6d077cba524fad75dec7e1144b6 --- deployment/haproxy/haproxy-container-puppet.yaml | 6 ++++++ network/service_net_map.j2.yaml | 2 ++ 2 files changed, 8 insertions(+) diff --git a/deployment/haproxy/haproxy-container-puppet.yaml b/deployment/haproxy/haproxy-container-puppet.yaml index b9c1f3b174..5aff54d37b 100644 --- a/deployment/haproxy/haproxy-container-puppet.yaml +++ b/deployment/haproxy/haproxy-container-puppet.yaml @@ -168,6 +168,12 @@ outputs: tripleo::haproxy::haproxy_log_facility: {get_param: HAProxySyslogFacility} tripleo::haproxy::haproxy_stats_user: {get_param: HAProxyStatsUser} tripleo::haproxy::haproxy_stats_password: {get_param: HAProxyStatsPassword} + tripleo::haproxy::haproxy_stats_bind_address: + str_replace: + template: + "%{hiera('$NETWORK')}" + params: + $NETWORK: {get_param: [ServiceNetMap, HaproxyNetwork]} tripleo::haproxy::redis_password: {get_param: RedisPassword} tripleo::haproxy::crl_file: {get_param: InternalTLSCRLPEMFile} tripleo::haproxy::haproxy_stats: {get_param: HAProxyStatsEnabled} diff --git a/network/service_net_map.j2.yaml b/network/service_net_map.j2.yaml index a4ab4f3876..e824cc9dc8 100644 --- a/network/service_net_map.j2.yaml +++ b/network/service_net_map.j2.yaml @@ -94,6 +94,8 @@ parameters: EtcdNetwork: {{ _service_nets.get('internal_api', 'ctlplane') }} OpenshiftMasterNetwork: {{ _service_nets.get('internal_api', 'ctlplane') }} OpenshiftInfraNetwork: {{ _service_nets.get('internal_api', 'ctlplane') }} + # HaproxyNetwork currently only controls the haproxy.stats network binding + HaproxyNetwork: ctlplane # We special-case the default ResolveNetwork for the Ceph roles # for backwards compatibility, all other roles default to internal_api {%- for role in roles if role.name.startswith('Ceph') %}