Skip to content

Bind health-check listeners on binding_ip and v4v6 #904

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
peanball merged 1 commit into from
May 7, 2026
Merged

Bind health-check listeners on binding_ip and v4v6 #904

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions jobs/haproxy/templates/haproxy.config.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -378,7 +378,7 @@ listen stats

<% if p("ha_proxy.enable_health_check_http") %>
listen health_check_http_url
bind :<%= p("ha_proxy.health_check_port") %>
bind <%= p("ha_proxy.binding_ip") %>:<%= p("ha_proxy.health_check_port") %> <%= v4v6 %>
mode http
option httpclose
monitor-uri /health
Expand All @@ -391,7 +391,7 @@ listen health_check_http_url

<%- if enable_additional_health_check_proxy -%>
listen health_check_http_url_proxy_protocol
bind :<%= p("ha_proxy.health_check_port") + 1 %> accept-proxy
bind <%= p("ha_proxy.binding_ip") %>:<%= p("ha_proxy.health_check_port") + 1 %> accept-proxy <%= v4v6 %>
mode http
option httpclose
monitor-uri /health
Expand Down Expand Up @@ -1100,7 +1100,7 @@ backend tcp-<%= tcp_proxy["name"] %>

<%- if tcp_proxy["health_check_http"] -%>
listen health_check_http_tcp-<%= tcp_proxy["name"] %>
bind :<%= tcp_proxy["health_check_http"] %>
bind <%= p("ha_proxy.binding_ip") %>:<%= tcp_proxy["health_check_http"] %> <%= v4v6 %>
mode http
monitor-uri /health
<%- if p("ha_proxy.accept_proxy") && !p("ha_proxy.disable_health_check_proxy") -%>
Expand All @@ -1111,7 +1111,7 @@ listen health_check_http_tcp-<%= tcp_proxy["name"] %>

<%- if enable_additional_health_check_proxy -%>
listen health_check_http_tcp-<%= tcp_proxy["name"] %>_proxy_protocol
bind :<%= tcp_proxy["health_check_http"] + 1 %> accept-proxy
bind <%= p("ha_proxy.binding_ip") %>:<%= tcp_proxy["health_check_http"] + 1 %> accept-proxy <%= v4v6 %>
Copy link
Copy Markdown
Contributor

@peanball peanball May 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

v4v6 somewhat negates the binding IP I think. It's only used with the default address (i.e. when it's not explicitly given). Binding to 1.2.3.4:8080 v4v6 will not magically bind an IPv6 socket if I understand the HAProxy docs correctly.

Can you test whether those settings might be mutually exclusive on a real setup, or rather if they have the effect you desire?

Nevermind, the v4v6 flag is only set if the binding ip is :: (i.e. IPv6 default address) and the v4v6 config property is set:

haproxy-boshrelease/jobs/haproxy/templates/haproxy.config.erb

Lines 171 to 178 in f072fbf

# IPv4 and IPv6 binding (v4v6) Option {{{
v4v6 = ""
if_p("ha_proxy.v4v6") do
if p("ha_proxy.binding_ip") == "::"
v4v6 = "v4v6"
end
end
# }}}

This is just an extension of what we have in other locations that was just never applied to health checks.

mode http
monitor-uri /health
acl tcp-<%= tcp_proxy["name"] %>-routers_down nbsrv(tcp-<%= tcp_proxy["name"] %>) eq 0
Expand Down
50 changes: 50 additions & 0 deletions spec/haproxy/templates/haproxy_config/frontend_tcp_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,4 +152,54 @@
expect(haproxy_conf).not_to have_key(/frontend tcp/)
end
end

context 'when a tcp proxy has health_check_http configured' do
let(:default_properties) do
{
'tcp_link_port' => 5432,
'tcp' => [{
'name' => 'potatoedb',
'port' => 6379,
'backend_servers' => ['10.0.0.1', '10.0.0.2'],
'health_check_http' => 9095
}]
}
end

let(:healthcheck_listener) { haproxy_conf['listen health_check_http_tcp-potatoedb'] }
let(:healthcheck_listener_proxy_protocol) { haproxy_conf['listen health_check_http_tcp-potatoedb_proxy_protocol'] }

it 'binds the tcp health check listener to all interfaces by default' do
expect(healthcheck_listener).to include('bind :9095')
end

context 'when ha_proxy.binding_ip is provided' do
let(:properties) do
default_properties.merge({
'binding_ip' => '1.2.3.4',
'enable_additional_health_check_proxy' => true
})
end

it 'binds the tcp health check listeners to the provided ip' do
expect(healthcheck_listener).to include('bind 1.2.3.4:9095')
expect(healthcheck_listener_proxy_protocol).to include('bind 1.2.3.4:9096 accept-proxy')
end

context 'when ha_proxy.v4v6 is true and binding_ip is ::' do
let(:properties) do
default_properties.merge({
'v4v6' => true,
'binding_ip' => '::',
'enable_additional_health_check_proxy' => true
})
end

it 'enables ipv6 dual-stack on the tcp health check listeners' do
expect(healthcheck_listener).to include('bind :::9095 v4v6')
expect(healthcheck_listener_proxy_protocol).to include('bind :::9096 accept-proxy v4v6')
end
end
end
end
end
31 changes: 31 additions & 0 deletions spec/haproxy/templates/haproxy_config/healthcheck_listener_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,5 +130,36 @@
end
end
end

context 'when ha_proxy.binding_ip is provided' do
let(:properties) do
{
'enable_health_check_http' => true,
'enable_additional_health_check_proxy' => true,
'binding_ip' => '1.2.3.4'
}
end

it 'binds the health check listeners to the provided ip' do
expect(healthcheck_listener).to include('bind 1.2.3.4:8080')
expect(healthcheck_listener_proxy_protocol).to include('bind 1.2.3.4:8081 accept-proxy')
end

context 'when ha_proxy.v4v6 is true and binding_ip is ::' do
let(:properties) do
{
'enable_health_check_http' => true,
'enable_additional_health_check_proxy' => true,
'v4v6' => true,
'binding_ip' => '::'
}
end

it 'enables ipv6 dual-stack on the health check listeners' do
expect(healthcheck_listener).to include('bind :::8080 v4v6')
expect(healthcheck_listener_proxy_protocol).to include('bind :::8081 accept-proxy v4v6')
end
end
end
end
end