Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

force_tlsv... configurations require DataPlane API restart to take effect #354

Open
cepitacio opened this issue Jan 13, 2025 · 0 comments
Open

Comments

@cepitacio
Copy link

cepitacio commented Jan 13, 2025

When adding or updating bind resources with any force_tlsv... configuration (e.g., force_tlsv12, force_tlsv13, etc.) through the HAProxy DataPlane API, the changes do not take effect unless the DataPlane API service is restarted.

Querying the configuration after committing the transaction and reloading HAProxy does not show the force_tlsv... fields as active. Restarting the DataPlane API service resolves the issue. This occurs consistently, regardless of whether the resource is created using POST or updated using PUT.

Reproduced on HAproxy Data Plane API version:

v2.9.2
v2.9.8

Steps to reproduce:

export VERSION=$(curl -X GET "http://ip:port/v2/services/haproxy/configuration/version" -u 'user:pass!')

export TRANSACTION=$(curl -X POST -u 'user:pass!' -H "Content-Type: application/json" "http://ip:port/v2/services/haproxy/transactions?version=$VERSION" | jq -r '.id')

curl -X PUT "http://ip:port/v2/services/haproxy/configuration/binds/bind_test?transaction_id=$TRANSACTION&parent_name=parent_test&parent_type=frontend" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "bind_test",
    "address": "ip",
    "port": 443,
    "parent_name": "parent_test",
    "parent_type": "frontend",
    "force_tlsv13": true,
    "force_tlsv12": true,
    "ssl": true,
    "ssl_certificate": "/path/to/certificate.pem",
    "transparent": true
  }' \
  -u 'user:pass'

curl -X PUT -u 'user:pass' -H "Content-Type: application/json" "http://ip:port/v2/services/haproxy/transactions/$TRANSACTION"

Result even after reload:

curl -X GET "http://ip:port/v2/services/haproxy/configuration/binds/bind_test?parent_name=parent_test&parent_type=frontend" -u 'user:pass'
{"_version":41,"data":{"name":"bind_test","ssl":true,"ssl_certificate":"/path/to/certificate.pem","address":"ip","port":443}}

Result after restart:

curl -X GET "http://ip:port/v2/services/haproxy/configuration/binds/bind_test?parent_name=parent_test&parent_type=frontend" -u 'user:pass'
{"_version":41,"data":{"force_tlsv12":true,"force_tlsv13":true,"name":"bind_test","ssl":true,"ssl_certificate":"/path/to/certificate.pem","address":"ip","port":443}}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant