AWS EC2 discovery service without setting port

[maximemoreillon]

Hello

Thanks so much for the HA Proxy Data Plane API, it's a great tool that really helps automating HAProxy.

I am currently using HAproxy in front of an EKS Kubernetes cluster, where servers (AWS EC2s) get created and removed frequently. To automate HAProxy, I using the AWS EC2 discovery service as per here and can get everything working on single port configurations. Here is an example back-end created by the service:

backend aws-ap-northeast-1-test-test-30000-32767 from unnamed_defaults_1
  server SRV_GvirR 10.115.2.134:80 check weight 128
  server SRV_uXKF0 127.0.0.1:80 disabled weight 128
  server SRV_VmDV3 127.0.0.1:80 disabled weight 128
# ...

However, the configuration I am hoping for should be like this, i.e. without the port being set so that I can forward the whole Kubernetes NodePort range:

backend eks from unnamed_defaults_1
  server ip-10-115-2-134 10.115.2.134 check port 32767
  server ip-10-115-1-80 10.115.1.80 check port 32767
  server ip-10-115-1-62 10.115.1.62 check port 32767
  
# ...

I tried various approaches such as setting either the HAProxy:Service:Port or HAProxy:Instance:Port EC2 tags to an empty string or * but it doesn't seem to work.

Is there a way to not set the server port when using AWS EC2 discovery service?

[smeroth]

Checking internally what can be done.

If i well understand your request you're asking for 2 features at the same time on the server line

• the destination port: none
• the health check port : xxx

Do you need the check port: xxx ?

[maximemoreillon]

Thanks a lot for your reply!
check port would also be very nice to have indeed!

[smeroth]

Hello

The 2 features will be added to the roadmap.
They will be available in a future DPAPI release.

[maximemoreillon]

That's great to hear, thanks a lot!
I'm looking forward to it!

[mjuraga]

@maximemoreillon as a workaround for your issue, your backend inherits stuff from unnamed_defaults_1 section. You could add the following line there:

default-server check port 32767

This way all your servers in the backend will use this version.

[maximemoreillon]

@mjuraga Thanks a lot for this suggestion! This would address the check port.
However, my issue is about the port of the target backend server. I would like to follow this approach to target a whole port range: https://discourse.haproxy.org/t/binding-tcp-port-ranges-to-backend-port-ranges/6893

[mjuraga]

I see, we could add this to the roadmap, and hopefully add it shortly. Thanks for the report.

[prometherion]

@maximemoreillon we just get merged ab74d45 which addressed what you're looking for, I've personally tested the integration, even tho some prerequisites are still mandatory.

As @mjuraga suggested, you need a default-server parameter in the unnamed_defaults_1 default section since the Service Discovery doesn't provide a way to configure such a parameter: we can evaluate with the future releases how to provide a more comfy way to personalize advanced parameters.

global
  master-worker
  maxconn 50000
  stats socket /var/run/hapee-lb.sock level admin mode 660
  stats timeout 30000

defaults unnamed_defaults_1
  mode http
  log global
  option httplog clf
  timeout connect 10000
  timeout client 10000
  timeout server 10000
  default-server check port 32767

I had this EC2 instance in AWS tagged as this, please, notice the 0 value for the port: this is required since otherwise discovery based on tags wouldn't work.

Once Discovery is started, the backend server is populated with its IP

# _md5hash=9bf3f174b5c83c14bb873387d966ae92
# _version=869
# Dataplaneapi managed File
# changing file directly can cause a conflict if dataplaneapi is running

global
  master-worker
  maxconn 50000
  stats socket /var/run/hapee-lb.sock level admin mode 660
  stats timeout 30000

defaults unnamed_defaults_1
  mode http
  log global
  option httplog clf
  timeout connect 10000
  timeout client 10000
  timeout server 10000
  default-server check port 32767

backend aws-us-east-1-test-GPE-0
  server SRV_8oHKa 172.31.25.191 check weight 128
  server SRV_kQQAb 127.0.0.1:80 disabled weight 128
  server SRV_3lqV7 127.0.0.1:80 disabled weight 128
  server SRV_ZibEf 127.0.0.1:80 disabled weight 128
  server SRV_cgjHW 127.0.0.1:80 disabled weight 128
  server SRV_yAuw9 127.0.0.1:80 disabled weight 128
  server SRV_35lim 127.0.0.1:80 disabled weight 128
  server SRV_2tcSf 127.0.0.1:80 disabled weight 128
  server SRV_NSFpa 127.0.0.1:80 disabled weight 128
  server SRV_mbNg9 127.0.0.1:80 disabled weight 128

Hope this can fit your use case!

[maximemoreillon]

Thanks a lot for the update! I will try ASAP and report back!