Add basic DDoS protection mechanisms with option to disable them #300
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
swetha1654
changed the title
swetha1654
force-pushed
the
ISD-4835-timeout-and-ddos-disable
branch
from
b132c09 to
c0d65fd
Compare
swetha1654
force-pushed
the
ISD-4835-timeout-and-ddos-disable
branch
from
c0d65fd to
d217890
Compare
seb4stien
reviewed
Dec 18, 2025
seb4stien
reviewed
Dec 18, 2025
seb4stien
reviewed
Dec 18, 2025
seb4stien
reviewed
Dec 18, 2025
seb4stien
reviewed
Dec 18, 2025
seb4stien
reviewed
Dec 18, 2025
Contributor
seb4stien
left a comment
seb4stien
left a comment
There was a problem hiding this comment.
Main requested change is to rename "disable-ddos-protection" to "ddos-protection" with a default value to "true".
Thanhphan1147
approved these changes
Dec 18, 2025
Collaborator
|
Approved, main comment is also changing the name of the config option |
Co-authored-by: Sébastien Georget <sebastien.georget@canonical.com>
seb4stien
approved these changes
Dec 19, 2025
…m/canonical/haproxy-operator into ISD-4835-timeout-and-ddos-disable
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
license-eye has checked 298 files.
| Valid | Invalid | Ignored | Fixed |
|---|---|---|---|
| 0 | 106 | 192 | 0 |
Click to see the invalid file list
- .vale.ini
- Makefile
- Makefile.docs
- haproxy-ddos-protection-configurator/charmcraft.yaml
- haproxy-ddos-protection-configurator/src/charm.py
- haproxy-ddos-protection-configurator/tests/conftest.py
- haproxy-ddos-protection-configurator/tests/integration/init.py
- haproxy-ddos-protection-configurator/tests/integration/conftest.py
- haproxy-ddos-protection-configurator/tests/integration/test_charm.py
- haproxy-ddos-protection-configurator/tests/unit/init.py
- haproxy-ddos-protection-configurator/tests/unit/test_charm.py
- haproxy-ddos-protection-configurator/tox.toml
- haproxy-operator/charmcraft.yaml
- haproxy-operator/src/charm.py
- haproxy-operator/src/haproxy.py
- haproxy-operator/src/http_interface.py
- haproxy-operator/src/legacy.py
- haproxy-operator/src/state/charm_state.py
- haproxy-operator/src/state/exception.py
- haproxy-operator/src/state/ha.py
- haproxy-operator/src/state/haproxy_route.py
- haproxy-operator/src/state/haproxy_route_tcp.py
- haproxy-operator/src/state/ingress.py
- haproxy-operator/src/state/ingress_per_unit.py
- haproxy-operator/src/state/spoe_auth.py
- haproxy-operator/src/state/tls.py
- haproxy-operator/src/state/validation.py
- haproxy-operator/src/tls_relation.py
- haproxy-operator/tests/conftest.py
- haproxy-operator/tests/integration/init.py
- haproxy-operator/tests/integration/conftest.py
- haproxy-operator/tests/integration/grpc_server/Makefile
- haproxy-operator/tests/integration/grpc_server/main.py
- haproxy-operator/tests/integration/grpc_server/echo.proto
- haproxy-operator/tests/integration/haproxy_route_requirer.py
- haproxy-operator/tests/integration/haproxy_route_tcp_requirer.py
- haproxy-operator/tests/integration/helper.py
- haproxy-operator/tests/integration/ingress_per_unit_requirer.py
- haproxy-operator/tests/integration/legacy/init.py
- haproxy-operator/tests/integration/legacy/conftest.py
- haproxy-operator/tests/integration/legacy/haproxy_route_requirer.py
- haproxy-operator/tests/integration/legacy/helper.py
- haproxy-operator/tests/integration/legacy/test_action.py
- haproxy-operator/tests/integration/legacy/test_charm.py
- haproxy-operator/tests/integration/legacy/test_config.py
- haproxy-operator/tests/integration/legacy/test_cos.py
- haproxy-operator/tests/integration/legacy/test_ha.py
- haproxy-operator/tests/integration/legacy/test_haproxy_route.py
- haproxy-operator/tests/integration/legacy/test_http_interface.py
- haproxy-operator/tests/integration/legacy/test_ingress.py
- haproxy-operator/tests/integration/legacy/test_website.py
- haproxy-operator/tests/integration/test_actions.py
- haproxy-operator/tests/integration/test_haproxy_route.py
- haproxy-operator/tests/integration/test_haproxy_route_tcp.py
- haproxy-operator/tests/integration/test_ingress_per_unit.py
- haproxy-operator/tests/unit/init.py
- haproxy-operator/tests/unit/conftest.py
- haproxy-operator/tests/unit/helper.py
- haproxy-operator/tests/unit/legacy/conftest.py
- haproxy-operator/tests/unit/legacy/test_ha.py
- haproxy-operator/tests/unit/legacy/test_haproxy_route_lib.py
- haproxy-operator/tests/unit/legacy/test_tls_relation.py
- haproxy-operator/tests/unit/test_charm.py
- haproxy-operator/tests/unit/test_ddos_protection.py
- haproxy-operator/tests/unit/test_haproxy_route_lib.py
- haproxy-operator/tests/unit/test_haproxy_route_options.py
- haproxy-operator/tests/unit/test_haproxy_route_tcp_lib.py
- haproxy-operator/tests/unit/test_haproxy_service.py
- haproxy-operator/tests/unit/test_hsts.py
- haproxy-operator/tests/unit/test_spoe_auth_lib.py
- haproxy-operator/tests/unit/test_state.py
- haproxy-operator/tox.toml
- haproxy-spoe-auth-operator/charmcraft.yaml
- haproxy-spoe-auth-operator/src/charm.py
- haproxy-spoe-auth-operator/src/haproxy_spoe_auth_service.py
- haproxy-spoe-auth-operator/src/state.py
- haproxy-spoe-auth-operator/tests/conftest.py
- haproxy-spoe-auth-operator/tests/integration/init.py
- haproxy-spoe-auth-operator/tests/integration/conftest.py
- haproxy-spoe-auth-operator/tests/integration/test_charm.py
- haproxy-spoe-auth-operator/tests/unit/init.py
- haproxy-spoe-auth-operator/tests/unit/conftest.py
- haproxy-spoe-auth-operator/tests/unit/test_charm.py
- haproxy-spoe-auth-operator/tox.toml
- haproxy-spoe-auth-snap/hooks/bin/configure
- haproxy-spoe-auth-snap/hooks/bin/default-configure
- haproxy-spoe-auth-snap/snapcraft.yaml
- terraform/charm/main.tf
- terraform/charm/outputs.tf
- terraform/charm/variables.tf
- terraform/product/main.tf
- terraform/product/outputs.tf
- terraform/product/variables.tf
- terraform/product/versions.tf
- terraform/tests/.tflint.hcl
- terraform/tests/main.tf
- terraform/tests/main.tftest.hcl
- tests/init.py
- tests/conftest.py
- tests/integration/init.py
- tests/integration/conftest.py
- tests/integration/haproxy_route_requirer.py
- tests/integration/helper.py
- tests/integration/setup-integration-tests.sh
- tests/integration/test_oauth_spoe.py
- tox.toml
Use this command to fix any missing license headers
```bash
docker run -it --rm -v $(pwd):/github/workspace apache/skywalking-eyes header fix
</details>
Contributor
Test results for commit d2f7a3eTest coverage for d2f7a3e Static code analysis report |
Contributor
Test results for commit d2f7a3eTest coverage for d2f7a3e Static code analysis report |
Contributor
Test results for commit d2f7a3eTest coverage for d2f7a3e Static code analysis report |
Thanhphan1147
pushed a commit
that referenced
this pull request
Jan 5, 2026
* Add ddos defaults * add release artifact * fix lint and unit tests * fix template * add unit instead of integration tests * Remove test_haproxy_config.py from integration tests * Apply suggestions from code review Co-authored-by: Sébastien Georget <sebastien.georget@canonical.com> * Address review comments * lint fix * fix uv lock file * fix license CI by adding pattern --------- Co-authored-by: Sébastien Georget <sebastien.georget@canonical.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
Add sensible security defaults to prevent basic DDoS attacks. By default, basic DDoS protection mechanisms are enabled, including http-request, http-keep-alive and client timeouts, automatic dropping of connections with invalid, empty, or missing host headers. A new config option
disable-ddos-protectionhas been added to disable these protections if needed.Rationale
Juju Events Changes
Module Changes
Library Changes
Checklist
docs/release-notes/artifacts. If this PR does not require a change artifact, the PR has been tagged withno-release-note.urgent,trivial,complex)