Skip to content

Commit c4ad8ce

Browse files
hdurand0710oktalz
hdurand0710
authored and
oktalz
committed
DOC/MEDIUM: add example for HTTPS offload
1 parent 9513fdf commit c4ad8ce

File tree

7 files changed

+241
-0
lines changed

7 files changed

+241
-0
lines changed

‎.aspell.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ allowed:
2828
- huggate
2929
- hugconf
3030
- httproute
31+
- https
3132
- init
3233
- json
3334
- keymap

‎example/http-route/hello-world-https-offload/README.md‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
# curl --header "Host: offload.haproxy.local" --resolve "offload.haproxy.local":31443:172.18.0.2 https://offload.haproxy.local:31443/hostname -k -v
2+
3+
# Hello World HTTPRoute with HTTPS offload Example
4+
5+
This example demonstrates how to use an HTTPRoute to expose simple "hello world" applications through the HAProxy Kubernetes Gateway, with HTTPS offload.
6+
7+
8+
9+
## What is being deployed
10+
11+
This example deploys the following resources:
12+
13+
* A **GatewayClass** named `haproxy` that defines a class of Gateways that can be provisioned by the HAProxy Kubernetes Gateway.
14+
* A **Gateway** named `hug-gateway` that requests a listener on port `31080` for HTTP traffic.
15+
* An **HTTPRoute** that directs traffic for `offload.haproxy.local` to the service `hello-world-offload`
16+
* One **Deployment** and **Service** for the echo applications:
17+
* `hello-world-offload`: A simple echo server
18+
* A **Secret** `offload`
19+
20+
## How to deploy in a `test` namepace
21+
22+
```bash
23+
kubectl create ns test
24+
kubectl apply -f -n test .
25+
```
26+
27+
## How to check if the result is correct
28+
29+
### POD
30+
31+
```sh
32+
$ cat /usr/local/hug/maps/link1_test_hug-gateway_https/path_prefix.map
33+
https.haproxy.local/ link1_test_hello-world-offload_443__
34+
```
35+
36+
### curl
37+
38+
### From the Hug pod
39+
Use `curl` to send a request to the services through the Gateway.
40+
41+
```sh
42+
curl --header "Host: offload.haproxy.local" --resolve "offload.haproxy.local":31443:127.0.0.1 https://offload.haproxy.local:31443/hostname -k
43+
```
44+
45+
You should see a response from the services, confirming that the traffic was routed correctly.
46+
47+
```sh
48+
hello-world-offload-c6b56955d-4hjld
49+
```
50+
51+
### From outside the cluster
52+
53+
Assuming that a NodePort Service like
54+
55+
```yaml
56+
apiVersion: v1
57+
kind: Service
58+
metadata:
59+
name: haproxy-unified-gateway
60+
namespace: haproxy-unified-gateway
61+
spec:
62+
selector:
63+
run: haproxy-unified-gateway
64+
type: NodePort
65+
ports:
66+
- name: http
67+
port: 31080
68+
targetPort: 31080
69+
# nodePort is needed for NodePort service type
70+
nodePort: 31080
71+
protocol: TCP
72+
- name: https
73+
port: 31443
74+
targetPort: 31443
75+
# nodePort is needed for NodePort service type
76+
nodePort: 31443
77+
protocol: TCP
78+
- name: stat
79+
port: 31024
80+
targetPort: 31024
81+
```
82+
83+
Use `curl` to send a request to the services through the Gateway.
84+
85+
```sh
86+
curl --header "Host: offload.haproxy.local" --resolve "offload.haproxy.local":31443:<node IP> https://offload.haproxy.local:31443/hostname -k
87+
```
88+
89+
You should see a response from the services, confirming that the traffic was routed correctly.
90+
91+
```sh
92+
hello-world-offload-c6b56955d-4hjld
93+
```
94+
95+
### haproxy.cfg
96+
You can also check the generated `haproxy.cfg`.
97+
98+
```
99+
cat /usr/local/hug/haproxy.cfg
100+
```
101+
102+
```sh
103+
frontend link1_test_hug-gateway_https from haproxytech # {"hug":{"Gateway":{"test/hug-gateway":{"Generation":1,"LinkID":"link1"}}}}
104+
mode http
105+
bind 0.0.0.0:31443 name v4 ssl crt-list /usr/local/hug/certlists/test_hug-gateway_https.list
106+
bind [::]:31443 name v6 ssl crt-list /usr/local/hug/certlists/test_hug-gateway_https.list
107+
acl route_is_json var(txn.route),bytes(0,1) -m str { # {"hug":"for lua routing"}
108+
http-request set-var(txn.base) base
109+
http-request set-var(txn.path) path
110+
http-request set-var(txn.host) req.hdr(Host),host_only
111+
http-request set-var(txn.route) base,map(/usr/local/hug/maps/link1_test_hug-gateway_https/path_exact.map) # {"hug":"exact domain + exact path"}
112+
http-request set-var(txn.route,ifnotexists) path,map(/usr/local/hug/maps/link1_test_hug-gateway_https/path_exact.map) # {"hug":"any domain + exact path"}
113+
http-request set-var(txn.route,ifnotexists) base,map_beg(/usr/local/hug/maps/link1_test_hug-gateway_https/path_prefix.map) # {"hug":"exact domain + path prefix"}
114+
http-request set-var(txn.route,ifnotexists) path,map_beg(/usr/local/hug/maps/link1_test_hug-gateway_https/path_prefix.map) # {"hug":"exact domain + path prefix"}
115+
http-request set-var(txn.route,ifnotexists) base,map_end(/usr/local/hug/maps/link1_test_hug-gateway_https/domain_wildcard_path_exact.map) # {"hug":"domain wildcard + exact path"}
116+
http-request set-var(txn.route,ifnotexists) path,map_reg(/usr/local/hug/maps/link1_test_hug-gateway_https/path_regex.map) # {"hug":"any domain + path regex"}
117+
http-request set-var(txn.route,ifnotexists) base,map_reg(/usr/local/hug/maps/link1_test_hug-gateway_https/path_regex.map) # {"hug":"domain wildcard + path prefix or regex, exact domain + path regex"}
118+
http-request lua.route if route_is_json # {"hug":"lua routing"}
119+
use_backend %[var(txn.backend)] if route_is_json
120+
use_backend %[var(txn.route)]
121+
default_backend backend_not_found
122+
```
123+
Note the `bind` doing HTTPS termination.
124+
125+
```sh
126+
backend link1_test_hello-world-offload_80__ from haproxytech # {"hug":{"HTTPRoute":{"test/route-hello-world-offload":{"Generation":2,"LinkID":"link1"}}}}
127+
mode http
128+
balance roundrobin
129+
option forwardfor
130+
no option abortonclose
131+
timeout server 50000
132+
default-server check
133+
server SRV_8f3e9904fc22b571a9e21e8b158c09f79153cb9b 10.244.0.7:8888 enabled
134+
```

‎example/http-route/hello-world-https-offload/echo-https.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
kind: Deployment
2+
apiVersion: apps/v1
3+
metadata:
4+
name: hello-world-offload
5+
spec:
6+
replicas: 1
7+
selector:
8+
matchLabels:
9+
app: hello-world-offload
10+
template:
11+
metadata:
12+
labels:
13+
app: hello-world-offload
14+
spec:
15+
containers:
16+
- name: http-echo
17+
image: "haproxytech/http-echo:latest"
18+
imagePullPolicy: Never
19+
ports:
20+
- name: http
21+
containerPort: 8888
22+
protocol: TCP
23+
- name: https
24+
containerPort: 8443
25+
protocol: TCP
26+
---
27+
kind: Service
28+
apiVersion: v1
29+
metadata:
30+
name: hello-world-offload
31+
spec:
32+
ports:
33+
- name: http
34+
protocol: TCP
35+
port: 80
36+
targetPort: http
37+
- name: https
38+
protocol: TCP
39+
port: 443
40+
targetPort: https
41+
selector:
42+
app: hello-world-offload

‎example/http-route/hello-world-https-offload/gateway.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
apiVersion: gateway.networking.k8s.io/v1
2+
kind: Gateway
3+
metadata:
4+
name: hug-gateway
5+
spec:
6+
gatewayClassName: haproxy
7+
listeners:
8+
- name: http
9+
port: 31080
10+
protocol: HTTP
11+
allowedRoutes:
12+
kinds:
13+
- group: gateway.networking.k8s.io
14+
kind: HTTPRoute
15+
hostname: "*.haproxy.local"
16+
- name: https
17+
protocol: HTTPS
18+
port: 31443
19+
tls:
20+
certificateRefs:
21+
- kind: Secret
22+
group: ""
23+
name: offload
24+
allowedRoutes:
25+
kinds:
26+
- group: gateway.networking.k8s.io
27+
kind: HTTPRoute
28+
hostname: "*.haproxy.local"

‎example/http-route/hello-world-https-offload/gatewayclass.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: gateway.networking.k8s.io/v1
2+
kind: GatewayClass
3+
metadata:
4+
name: haproxy
5+
spec:
6+
controllerName: gate.haproxy.org/hug

‎example/http-route/hello-world-https-offload/route-https.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: gateway.networking.k8s.io/v1
2+
kind: HTTPRoute
3+
metadata:
4+
name: route-hello-world-offload
5+
spec:
6+
parentRefs:
7+
- name: hug-gateway
8+
sectionName: https
9+
hostnames:
10+
- "offload.haproxy.local"
11+
rules:
12+
- matches:
13+
- path:
14+
type: PathPrefix
15+
value: /
16+
backendRefs:
17+
- name: hello-world-offload
18+
port: 80
19+
---

‎example/http-route/hello-world-https-offload/secret-offload.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v1
2+
data:
3+
tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGVENDQWYyZ0F3SUJBZ0lVWVhhTVN4QXAyVFVUY1FzVFBjVHFWUW1kNmpZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0dqRVlNQllHQTFVRUF3d1BiMlptYkc5aFpDNW9ZWEJ5YjNoNU1CNFhEVEkxTURneU1URTFNamMxTjFvWApEVEkyTURneU1URTFNamMxTjFvd0dqRVlNQllHQTFVRUF3d1BiMlptYkc5aFpDNW9ZWEJ5YjNoNU1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXlLRHloS1BlTjh6V2pKdTFUdkhDcDA5ZzBDc1gKVWNvYzAyd0tKOVZqdW9VN0djRmRnWUx3UitRU1JJUWhrZEFYV25jdHpES25zNVVhblBEM0Y3SG5DM1krandNTgpZNFFOV0k0a0Z1Uk55RlRhTzV0cTRYSDk3WXRObmtFa1dOWGdUd0I5WFY0Y1duUWc3NmkrbDZkSDFBczI5aWtQClZVMzZqMVdVS3lINFlhbzlWNDZBWklCbE1IenltdW1HUzYyRVIrY0M4TTdsMlNwS1NHajl4TzROd0hzU1U5Z3AKQmhPTjFOY0NmSXN0elNHRFRBTjdxa2p0U0RpTjZXWGFobHRVM1RvYjZvZkI4Ukc0bVA3UGt1YzZIOHl4R3JwbQpLSUhRQkdsVHVUeHNSd3NiaktDSTY3dG1DY2VkYWlKemllS0JPbStaUExhQ002M2lpSVh6bTVlazR3SURBUUFCCm8xTXdVVEFkQmdOVkhRNEVGZ1FVY2NSNmtRMEJmc3NVUVUxdXFtS2x0eVdjVkRnd0h3WURWUjBqQkJnd0ZvQVUKY2NSNmtRMEJmc3NVUVUxdXFtS2x0eVdjVkRnd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBTkJna3Foa2lHOXcwQgpBUXNGQUFPQ0FRRUF4T3lCdUk1ZGxNdUZqQ2NIa2VySzZjcUY1T2NaY2p4eTRqM0J6NmtBZnV0Um1EYkNqU25rCjEvZUpISllhZWVmbnpYbWZXVXdyYzlFVWNWWVp3UDVWUXhnM3BEMklPbEE1RTNtZFc4OWkvM2tGUER6MUZOc2oKN0NVZUoyR3o3ZHBIbzh6UGcvcVV0bE9pbkdSV1BsN1lldTlHQjUxTTZYOEFRci9JVGxEa2dnRDF1T3pmakEvcgo0aE0rdG9KN2gvejd2ZnNjWWYvN2dlQWFFUVNRMVFiOVNDSjRFOGxsb1RiRnI3ZFZWMGFxV2J2b1ZSN3g0bUJyCkdDSTVSSmxFUGZZTDNyM21uSHFJZnJHdFBvN2lIa20xcisyRUQ4cnZvU3JhUGJSbmpSSStvcEhLSHBwTlpSMmkKMDQ0U01xcWZDMGNienRmVndRV1NIcnpqcmVaL1JHWmxZUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
4+
tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2d0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktrd2dnU2xBZ0VBQW9JQkFRRElvUEtFbzk0M3pOYU0KbTdWTzhjS25UMkRRS3hkUnloelRiQW9uMVdPNmhUc1p3VjJCZ3ZCSDVCSkVoQ0dSMEJkYWR5M01NcWV6bFJxYwo4UGNYc2VjTGRqNlBBdzFqaEExWWppUVc1RTNJVk5vN20ycmhjZjN0aTAyZVFTUlkxZUJQQUgxZFhoeGFkQ0R2CnFMNlhwMGZVQ3piMktROVZUZnFQVlpRcklmaGhxajFYam9Ca2dHVXdmUEthNllaTHJZUkg1d0x3enVYWktrcEkKYVAzRTdnM0FleEpUMkNrR0U0M1Uxd0o4aXkzTklZTk1BM3VxU08xSU9JM3BaZHFHVzFUZE9odnFoOEh4RWJpWQovcytTNXpvZnpMRWF1bVlvZ2RBRWFWTzVQR3hIQ3h1TW9JanJ1MllKeDUxcUluT0o0b0U2YjVrOHRvSXpyZUtJCmhmT2JsNlRqQWdNQkFBRUNnZ0VBT3VQcmEvM0J5N1ZId093dnN5V0owcHlkT1YxOHNkaFd6OFJsMHIxelVadXIKOW1wbzdRd25SYUx2cmNidko2TGlSLzYxcGJ1MHVDVHJNK2dUVDVRNzBvUjU1bmFwNW0wcmtiUGZhZ3pIdkNjVQpDKzBaMldVaGVTbXJ0ZWsvSndoWW1EZjNsSUY4Wnh5eFVrZkE4amo2LzRYdk15Qm9UTXpmNEZUcGNpTzlpY1R0CjRxbVZzRUY1VDdzaGZEOThYTEdwOUttYmdsczlWekI0aVBOcFF4ckgwakMzYmYvK3lyS1BHZStIa3dVR1BmdEMKQVRUTkpLQWF1QURScStHK1NWMDYrOXNheWgzYTNIS2d6dTRGaDM0RmRxTTZRTmkwSktwd04rM0JtQm1YUmRIMwpxYXB5Vmo0V2o5ZlJmNHpSSVB5RVkyV3oxZ2NyVm4yWTUrMlhPeFprMlFLQmdRRCtKMEZ5N2J2Z1BqUW00ZUpaCmxQNWM4bHptVHo2OE1Dc2M3QVJJUVU2VlBXb1JDV3NqR1JPYVIzckZrejNJdVp1ekNvN2ZUbldHVjkxTXRGeWwKR2gxYVFxQXlCcFNoUmhoaFFNOTlSblFNRVlTdjNidG9SQnBtNVdQeTJWM2Y1V3lPOXpJVUdlS0xqYUFVdnM4cQpicWZvTUdNenptb3VyNEtXLzZLckExeHFOd0tCZ1FES0ZpRytwUVhrZDE1Z3c0cWVzUXFZYm96cTM4ZW82blcyClluTDQyQnpsampsendRRkpjSlRoWVcvQTV5cEZ1U2duZDlWVGoxbVF6YTdLbVllMWxuWGtxSXZueFlVUFhTVGsKMHdzdlcrN0lSUks0NlBWbHBiZU5FdHV0c0Rtd0VTdlJNSkl2KzdHeENFNVNQR05rWThZWTZmbkdrVGVxOXpPZQowZzlvNVkzVXRRS0JnUURFVHhRSnJzRm9nd09MYVB5S0QwQ3VFSEpiWHFocGVaZERmcllNRFkyaVRzNm5uQ3ZKCjcydXB4ajU1YjdMUVlUVjNoTmM0ZXdUaUlPb0pmbUwxRUFmT0dScGRxYUdTTkc5T1oxNGRPSmNZWDB1cS84enEKeTNmTk5MQVArMys4R2h6UkRQVDhlOFgxM3czZ0dFWXlVMGlVV3hPMUIySVM3M1FpS0JEQW9SYjMzd0tCZ1FDbwppQUtHV2x0cXFENFdGcDFCTU1aMFR5WElMdTMwcWV1WE9jMUdSL3o1V0Q0RGtmOC92dHI2aHViTENqM1B2ZFdGCjdNTUVsN1VMTk8xRFd2eTViSXhQTUZ6VTRuM1FUVTZhWW9LZWNWM1d1UHdmSjNDWDM3Y091SjVwNEdDTHZCWTkKcy9NR2Z6STJRSVlJd1FIbTArcCtGb3JPbFliR1ZyZy9DRkgvbWdsSlRRS0JnUURRc2NtN0ZQVGo3RFh2QzYraQpxQVNadUZNcWQxVjlYVFBtdDFxZmlDekgrODFqTVZnOHE2eE5lQVhMTVhCV0pjSjRKcXJMTnlBSUx4M1ZZeWUzCmtWcDJsVFUzUFVyZUZBL0UvbWxLZk45cUszblVUZDhibjF1aExSZFRkYmZpOE9URzArQ2ZxSTN1WjUrWnJwWjMKU3BSRys3Mnc5TWV2cFdNcU90UFVObWpBWWc9PQotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tCg==
5+
kind: Secret
6+
metadata:
7+
name: offload
8+
type: kubernetes.io/tls
9+
10+
11+
## CN offload.haproxy

0 commit comments

Comments
 (0)