search

kubernetes-sigs / cluster-api-provider-openstack

Cluster API implementation for OpenStack
https://cluster-api-openstack.sigs.k8s.io/
Apache License 2.0
297 stars 255 forks source link

HTTPS for Loadbalancer Health Monitor #1748

Open MPV opened 12 months ago

MPV commented 12 months ago

/kind feature

Describe the solution you'd like

Be able to use HTTPS as type for the load balancer's health monitor (on the /readyz path).

Anything else you would like to add:

Hopefully this would solve problems such as:

Related issues:

  1. Most-recent improvement (to avoid incidents seen in #1221 and #1374):
  2. Making load balancer health checks configurable overall (though only TCP settings discussed yet):
MPV commented 12 months ago

Here's for example how OpenShift documents how to configure the load balancer health checks in this manner (and why not to use TCP port probe, but instead the /readyz endpoint):

MPV commented 12 months ago

Though on the topic of setting/syncing the monitor's values with the api server's --shutdown-delay-duration setting, while searching for shutdown-delay-duration in CAPI repo, I found issues like these:

MPV commented 12 months ago

I think we should also take into account what @mnaser said over in #1374:

I would have liked to change the following too:

  • type: HTTPS
  • url_path: /healthz

This will give us actual health checks that involve the API endpoint telling us that it's happy, and it should be OK to accept the unknown cert since openstack/octavia@8c793f2/octavia/common/jinja/haproxy/split_listeners/templates/macros.j2#L178-L182 is OK with it however OVN doesnt support this so we can keep TCP for now.

MPV commented 12 months ago

For example, here's one current monitor:

Skärmavbild 2023-11-15 kl 11 16 24

And here's a manually drafted one which I'd like to be able to use instead:

Skärmavbild 2023-11-15 kl 11 17 59
mdbooth commented 12 months ago

@dulek What do you think about using HTTPS health monitors here? There's a question about how to support the OVN provider. Does it support HTTPS?

dulek commented 11 months ago

@dulek What do you think about using HTTPS health monitors here? There's a question about how to support the OVN provider. Does it support HTTPS?

It makes perfect sense from my perspective as long as it's opt-in. The OVN provider does not support HTTP or HTTPS health monitors and most likely never will as it lives in layers below. That shouldn't block us from trying to improve things for Amphora.

k8s-triage-robot commented 8 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

dulek commented 8 months ago

/remove-lifecycle stale

k8s-triage-robot commented 5 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 4 months ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

EmilienM commented 4 months ago

/remove-lifecycle rotten

k8s-triage-robot commented 1 month ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 2 weeks ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten