[Feature] HAProxy http mode support

[felipeero]

Hi,

Currently the only HAProxy mode supported by the operator is tcp mode (layer 4 proxy) for frontends and backends, but there are many cases where http mode (layer 7 proxy) is rather desirable, like when you need the load balancer to provide TLS termination and more complex stuff. It would be nice if there was a configurable option in the ExternalLoadBalancer CR for HAProxy provider for choosing the mode.

[carlosedp]

The idea for the operator is to configure the load balancers in layer 4 mode so all configuration for the certificate termination could happen on the Kubernetes/OpenShift ingress. Currently this is the behavior for all backends.

Could you provide a sample configuration and/or API calls on how to make the HAProxy work in L7 and also how to provide it the certificate to it?

[felipeero]

The idea for the operator is to configure the load balancers in layer 4 mode so all configuration for the certificate termination could happen on the Kubernetes/OpenShift ingress. Currently this is the behavior for all backends.

Hmmm okay, got the point now!

Could you provide a sample configuration and/or API calls on how to make the HAProxy work in L7 and also how to provide it the certificate to it?

Well, the very simple way (far from the being the best) I imagine it, is to have the certificates already existing somewhere in the haproxy server, and the operator could just indicate their paths. So just 2 endpoints would be needed in this case:

• Add frontend for configuring the mode: https://www.haproxy.com/documentation/dataplaneapi/community/?v=v2#post-/services/haproxy/configuration/frontends
• Add bind for the frontend for configuring the certificate path: https://www.haproxy.com/documentation/dataplaneapi/community/?v=v2#post-/services/haproxy/configuration/binds

In the bind endpoint there is the 'crt_list' field, which is a list of relative or absolute paths to cert/pem files. So the operator CR would just need 2 new fields, one for selecting the mode option (tcp or http), and another for a dictionary (or list) for the mode specific options, like crl_list, etc.

PS: If the idea of having the certs as a prerequisite in the server is not good, I think the endpoint https://www.haproxy.com/documentation/dataplaneapi/community/?v=v2#post-/services/haproxy/storage/ssl_certificates could be used to pass the certificate itself directly from the operator to the haproxy.