HAProxy检查端口443

Question

是否可以让HAProxy对SSL /端口443端点进行健康检查？

下面配置中的check port 443失败了健康检查

下面的HAProxy配置

global
    log         127.0.0.1 local2

    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     50000
    user        haproxy
    group       haproxy
    daemon

    # turn on stats unix socket
    stats socket /var/lib/haproxy/stats

defaults
    mode                    tcp
    log                     global
    option                  dontlognull
    retries                 3
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout check           5s
    maxconn                 15000


#---------------------------------------------------------------------
# status page.
#---------------------------------------------------------------------
listen stats 0.0.0.0:8000
    mode http
    stats enable
    stats uri /haproxy
    stats realm HAProxy

#---------------------------------------------------------------------
# Incoming HTTP -> Admin Redirect Proxy rule
#--------------------------------------------------------------------
listen RedirectToHttps
    mode http
    bind :80
    redirect location https://admin.example.com code 301

#---------------------------------------------------------------------
# Incoming HTTPS -> Admin Proxy rule
#---------------------------------------------------------------------
listen ToHttps
    mode tcp
    bind :443
    option ssl-hello-chk
    balance roundrobin
    option httpchk GET /heartbeat.php HTTP/1.1\r\nHost:\ admin.example.com
    server admin-no-check-test     ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 maxconn 5000
    server admin-150-checkport-80  ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 check port 80 maxconn 5000
    server admin-150-checkport-443 ec2-XXX-XXX-XXX-150.eu-west-1.compute.amazonaws.com:443 check port 443 maxconn 5000

Answer 1

我相信option ssl-hello-chk和option httpchk是两种不同的检查，但是HAProxy只允许一次使用一种。您应该选择ssl-hello-chk来检查SSL是否存在，或者使用httpchk来检查特定的URI，而不是同时检查两者。