是否可以让 HAProxy 对 SSL / 端口 443 端点进行健康检查?
以下check port 443
配置未通过健康检查
HAProxy 配置如下
global
log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 50000
user haproxy
group haproxy
daemon
# turn on stats unix socket
stats socket /var/lib/haproxy/stats
defaults
mode tcp
log global
option dontlognull
retries 3
timeout queue 1m
timeout connect 10s
timeout client 1m
timeout server 1m
timeout check 5s
maxconn 15000
#---------------------------------------------------------------------
# status page.
#---------------------------------------------------------------------
listen stats 0.0.0.0:8000
mode http
stats enable
stats uri /haproxy
stats realm HAProxy
#---------------------------------------------------------------------
# Incoming HTTP -> Admin Redirect Proxy rule
#--------------------------------------------------------------------
listen RedirectToHttps
mode http
bind :80
redirect location https://admin.example.com code 301
#---------------------------------------------------------------------
# Incoming HTTPS -> Admin Proxy rule
#---------------------------------------------------------------------
listen ToHttps
mode tcp
bind :443
option ssl-hello-chk
balance roundrobin
option httpchk GET /heartbeat.php HTTP/1.1\r\nHost:\ admin.example.com
server admin-no-check-test ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 maxconn 5000
server admin-150-checkport-80 ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 check port 80 maxconn 5000
server admin-150-checkport-443 ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 check port 443 maxconn 5000
答案1
我认为option ssl-hello-chk
和option httpchk
是两种不同的检查,但 HAProxy 只允许您一次使用其中一种。您应该选择ssl-hello-chk
仅检查 SSL 是否存在,或使用httpchk
检查特定 URI,但不能同时使用两者。