haproxytech / haproxy-consul-connect

HaProxy Connector for Consul Connect. Enables Service Mesh with Consul and HaProxy using TLS and Consul Discovery
Apache License 2.0
95 stars 20 forks source link

Avoid relying on non-guaranteed proxy naming conventions #7

Open banks opened 4 years ago

banks commented 4 years ago

https://github.com/haproxytech/haproxy-consul-connect/blob/55bff42d10d53e3d5942a84ec6d704802d0b4317/main.go#L57-L59

This is a naming convention only and there is nothing in Consul stopping users from naming proxies differently if they don't use the sidecar_service helper.

The canonical way to tell if something is a Proxy in Connect's data model is if service.Kind == "connect-proxy". If it's important that it's specifically a sidecar proxy (not say an ingress loadbalancer) which is true in this case you need to also check for service.Proxy.DestinationServiceID != "" - The thing that canonically makes a Proxy service a sidecar is that field indicating that it is has exactly one app (destination) instance behind it.

So to correctly skip sidecar proxies in this loop the following should work:

  // Skip all sidecar proxy registrations
  if s.Service.Kind == api.ServiceKindConnectProxy && s.Service.Proxy.DestinationServiceID != "" {
      continue
    }

NOTE: In fact this whole loop might need to change making this issue moot. I'll explain more in the issue that I'll link below, but this was important to note to make sure the guarantees are understood here.