[serve][test] Skip HTTPS proxy tests under HAProxy (HTTP-only ingress)#64260
Merged
eicherseiji merged 5 commits intoJun 23, 2026
Merged
Conversation
HAProxy ingress does not terminate TLS: the HAProxy frontend binds plain HTTP and health-checks replicas over plain HTTP, while direct-ingress replicas serve HTTPS. The backends never pass the health check, the proxy never becomes ready, and serve.run() blocks until timeout. That is why test_https_websocket_with_fastapi hung under HAProxy in CI, not the websocket itself; the whole HTTPS-serving path is affected. Skip the TLS-serving classes (TestHTTPSProxy, TestHTTPSIntegration) under RAY_SERVE_ENABLE_HA_PROXY. The config-only validation classes still run. Supporting HTTPS through HAProxy requires plumbing TLS into the frontend bind and backend health checks, which is a separate feature. Signed-off-by: Seiji Eicher <seiji@anyscale.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces a pytest skip decorator, skip_https_under_haproxy, to skip HTTPS-related tests when HAProxy is enabled (RAY_SERVE_ENABLE_HA_PROXY). This is because HAProxy ingress does not terminate TLS, causing HTTPS/wss tests to fail or timeout. The decorator is applied to the TestHTTPSProxy and TestHTTPSIntegration test classes. I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
… feature HAProxy ingress serves plain HTTP only and intentionally does not terminate TLS. HTTPS is served by direct-ingress mode (replicas terminate TLS) or by terminating TLS at a proxy in front of HAProxy. Reword the skip reason and comment to state HTTPS/wss is unsupported under HAProxy by design, rather than implying TLS termination is planned work. Signed-off-by: Seiji Eicher <seiji@anyscale.com>
eicherseiji
changed the title
State the scope plainly: HAProxy ingress serves HTTP only and does not terminate TLS; TLS is handled by direct-ingress mode or an upstream proxy. Signed-off-by: Seiji Eicher <seiji@anyscale.com>
eicherseiji
changed the title
The comment block and the skipif reason restated the same fact. Keep the mechanism note in the comment and let the reason string carry the rest. Signed-off-by: Seiji Eicher <seiji@anyscale.com>
eicherseiji
marked this pull request as ready for review
June 22, 2026 21:56
Add the target to the HAProxy allowlist so the HTTP-only skip markers added in this PR are exercised on master. The HTTPS-serving classes skip and the config-only classes still run. Signed-off-by: Seiji Eicher <seiji@anyscale.com>
akyang-anyscale
approved these changes
Jun 22, 2026
| from ray.serve.config import HTTPOptions | ||
|
|
||
| # HAProxy ingress is HTTP-only and does not terminate TLS, so HTTPS and wss |
Contributor
There was a problem hiding this comment.
should this be a TODO?
Contributor
Author
There was a problem hiding this comment.
It was aligned as won't do in Ray Serve Stability Tracker
eicherseiji
enabled auto-merge (squash)
June 22, 2026 22:49
rayhhome
pushed a commit
to rayhhome/ray
that referenced
this pull request
Jun 23, 2026
ray-project#64260) ## Why Under HAProxy ingress (`RAY_SERVE_ENABLE_HA_PROXY=1`), `test_https_websocket_with_fastapi` hangs until SIGKILL. The cause is not websockets. HAProxy ingress serves plain HTTP and does not terminate TLS. The frontend binds plain HTTP and health-checks replicas over plain HTTP, while direct-ingress replicas serve HTTPS, so backends never pass the health check, the proxy never becomes ready, and `serve.run()` blocks. The whole HTTPS-serving path is affected, not only the websocket test. ## Scope HAProxy ingress is HTTP-only. TLS is terminated by direct-ingress mode (replicas terminate TLS) or by an upstream TLS-terminating proxy in front of HAProxy, so HTTPS is not a path HAProxy serves. Same shape as gRPC, which is served by direct-ingress mode rather than HAProxy. ## What Skip the TLS-serving test classes (`TestHTTPSProxy`, `TestHTTPSIntegration`) under `RAY_SERVE_ENABLE_HA_PROXY`. The config-only validation classes (`TestSSLConfiguration`, `TestHTTPSErrorHandling`) still run. Add `//python/ray/serve/tests:test_https_proxy` to the HAProxy CI allowlist (`ci/ray_ci/serve_hap_test_names.txt`) so the file runs under `RAY_SERVE_ENABLE_HA_PROXY=1`. ## Notes - Unblocks the "run all serve tests under HAProxy" effort (ray-project#64210), where these tests otherwise hang. - The allowlist is deleted wholesale by ray-project#64210. Until that lands, this entry runs the file under HAProxy on master, so the skips are exercised in CI rather than dormant. --------- Signed-off-by: Seiji Eicher <seiji@anyscale.com>
1 task
limarkdcunha
pushed a commit
to limarkdcunha/ray
that referenced
this pull request
Jun 30, 2026
ray-project#64260) ## Why Under HAProxy ingress (`RAY_SERVE_ENABLE_HA_PROXY=1`), `test_https_websocket_with_fastapi` hangs until SIGKILL. The cause is not websockets. HAProxy ingress serves plain HTTP and does not terminate TLS. The frontend binds plain HTTP and health-checks replicas over plain HTTP, while direct-ingress replicas serve HTTPS, so backends never pass the health check, the proxy never becomes ready, and `serve.run()` blocks. The whole HTTPS-serving path is affected, not only the websocket test. ## Scope HAProxy ingress is HTTP-only. TLS is terminated by direct-ingress mode (replicas terminate TLS) or by an upstream TLS-terminating proxy in front of HAProxy, so HTTPS is not a path HAProxy serves. Same shape as gRPC, which is served by direct-ingress mode rather than HAProxy. ## What Skip the TLS-serving test classes (`TestHTTPSProxy`, `TestHTTPSIntegration`) under `RAY_SERVE_ENABLE_HA_PROXY`. The config-only validation classes (`TestSSLConfiguration`, `TestHTTPSErrorHandling`) still run. Add `//python/ray/serve/tests:test_https_proxy` to the HAProxy CI allowlist (`ci/ray_ci/serve_hap_test_names.txt`) so the file runs under `RAY_SERVE_ENABLE_HA_PROXY=1`. ## Notes - Unblocks the "run all serve tests under HAProxy" effort (ray-project#64210), where these tests otherwise hang. - The allowlist is deleted wholesale by ray-project#64210. Until that lands, this entry runs the file under HAProxy on master, so the skips are exercised in CI rather than dormant. --------- Signed-off-by: Seiji Eicher <seiji@anyscale.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Under HAProxy ingress (
RAY_SERVE_ENABLE_HA_PROXY=1),test_https_websocket_with_fastapihangs until SIGKILL. The cause is not websockets. HAProxy ingress serves plain HTTP and does not terminate TLS. The frontend binds plain HTTP and health-checks replicas over plain HTTP, while direct-ingress replicas serve HTTPS, so backends never pass the health check, the proxy never becomes ready, andserve.run()blocks. The whole HTTPS-serving path is affected, not only the websocket test.Scope
HAProxy ingress is HTTP-only. TLS is terminated by direct-ingress mode (replicas terminate TLS) or by an upstream TLS-terminating proxy in front of HAProxy, so HTTPS is not a path HAProxy serves. Same shape as gRPC, which is served by direct-ingress mode rather than HAProxy.
What
Skip the TLS-serving test classes (
TestHTTPSProxy,TestHTTPSIntegration) underRAY_SERVE_ENABLE_HA_PROXY. The config-only validation classes (TestSSLConfiguration,TestHTTPSErrorHandling) still run.Add
//python/ray/serve/tests:test_https_proxyto the HAProxy CI allowlist (ci/ray_ci/serve_hap_test_names.txt) so the file runs underRAY_SERVE_ENABLE_HA_PROXY=1.Notes