TCP services and SSL certificates

[phanxen]

Hi, I'm trying to configure HAproxy Ingress Controller to work TCP services.

After some trying and error, and reading this post I could get something similar to what I expected. To be honest, I'm new to HAproxy Ingress Controller and have been using up to now HAproxy as HTTP/TCP proxy. Given some needs of our clients, we have to get our product running in Kubernetes.

So, the thing is, I cat get a TCP frontend to work without SSL, but I'm unable to get it working with SSL. The configmap for TCP services is like this (it's just a fragment of the YAML I have):

apiVersion: v1
kind: ConfigMap
metadata:
  name: haproxy-tcp-services
  namespace: haproxy-controller
data:
  "5003": "default/service1:35003"
  "7003": "default/service2:37003:::default/service2-ssl-cert"

When I apply the YAML file everything seems to work, but the pod running the controller gets filled with the following log messages:

2020/02/12 12:35:34 controller-monitor.go:120: 14: ERR transactionId=6a6f83c0-29ae-4a25-a025-a79072e88a2e 
msg="Proxy 'tcp-frontend-default-service2-37003---default-service2-ssl-cert-7003': unable to find required default_backend: 'default-service1-37003---default-service2-ssl-cert

From the point of view of HAproxy the error messages seems consistency, it can't create a frontend if its default backend doesn't exist. On the other hand, given both declarations of TCP services that I, I'd say something is about the secret I'm using. Te secret default/service2-ssl-cert. I already tested creating this secret in haproxy-controllernamespace, but I got the error.

Any advice?

[Mo3m3n]

Hi

"7003": "default/service2:37003:::default/service2-ssl-cert"

The service name does not seem to be correct, shouldn't this be just
"7003": "default/service2:37003 ?

[phanxen]

The service name does not seem to be correct, shouldn't this be just
"7003": "default/service2:37003 ?

If I set only "7003": "default/service2:37003 it works just like the other TCP service I set up. Unfortunately, this way I do not have SSL support.

To be honest, I found this syntax in one another HAproxy ingress controller webpage. I already bookmarked three different repos and tested that some configurations are not recognized globally.

[Mo3m3n]

Ah I see what you mean.
You want HAProxy to decrypt SSL then route TCP traffic to the TCP backend. Correct ?
If that's the case, this is unfortunately not possible yet, currently the controller makes HAProxy decrypt SSL only for HTTPS traffic.
But all the building blocks are already there so we can add this

[phanxen]

Ah I see what you mean.
You want HAProxy to decrypt SSL then route TCP traffic to the TCP backend. Correct ?
If that's the case, this is unfortunately not possible yet, currently the controller makes HAProxy decrypt SSL only for HTTPS traffic.
But all the building blocks are already there so we can add this

Exactly, I don't want to move SSL decription to the service behind the controller.

Thank you very much.

[Mo3m3n]

--configmap-tcp-services should support this now