You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Stanislav Samek <st...@gmail.com> on 2024/09/24 06:25:37 UTC
[users@httpd] mod_proxy_hcheck with Istio
Hello,
we are trying to use apache in version 2.4.58 with modules
mod_proxy_balancer, mod_proxy_hcheck and mod_proxy. Goal is to dynamically
check the status of the application which is exposed by Istio gateway.
Problem is that from the Apache server we are able to connect to the
application endpoint but Apache register application to the error state. We
can't find anything in logs. We are trying to use hcmethod GET, GET11 but
nothing works. When we tried hcmethod TCP, that works but it's not final
solution for us.
Probably it will be a problem that Istio is exposing endpoints in HTTP/2
revision. Don't you have a problem with this?
Here is part of our configuration:
ProxyPassMatch ^/foobar/v1/(.*)$ balancer://application/api/$1
ProxyPassReverse ^/foobar/v1/(.*)$ balancer://application/api/$1
ProxyHCExpr checker {%{REQUEST_STATUS} =~ /^[234]/}
<Proxy balancer://application>
BalancerMember https://foobar-a.stage.cloud addressttl=3600
hcexpr=checker
BalancerMember https://foobar-b.stage.cloud addressttl=3600
hcexpr=checker
# Optional: Load balancing method
ProxySet lbmethod=byrequests
</Proxy>
Thank you
Re: [users@httpd] mod_proxy_hcheck with Istio
Posted by Daniel Ferradal Márquez <df...@apache.org>.
On 30/9/24 10:50, Stanislav Samek wrote:
> Hi,
>
> I don't think that there is an issue with ssl. We have SSLProxyEngine
> turned on and also a backend name match with CN. In attachment you can
> find output from the curl command.
>
> Thank you
>
What I would make sure in your case is SSLProtocols set up in the
configuration.
Worth to also try to see if it works without the mod_proxy_hcheck
related parameters.
In any case, if connection works without relevant hcheck parameters I
would place them again and use LogLevel with trace to see what is going on.
If it still does not work there should be something in the error log
either way I would start using Loglevel anyways, with proxy or ssl
accordingly.
--
-Daniel
Find help at #httpd in Libera.chat
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_proxy_hcheck with Istio
Posted by Stanislav Samek <st...@gmail.com>.
Hi,
I don't think that there is an issue with ssl. We have SSLProxyEngine
turned on and also a backend name match with CN. In attachment you can find
output from the curl command.
Thank you
so 28. 9. 2024 o 22:02 Daniel Ferradal Márquez <df...@apache.org>
napísal(a):
>
> On 24/9/24 8:25, Stanislav Samek wrote:
> > ...
> > Probably it will be a problem that Istio is exposing endpoints in
> > HTTP/2 revision. Don't you have a problem with this?
> >
> > Here is part of our configuration:
> >
> > ProxyPassMatch ^/foobar/v1/(.*)$ balancer://application/api/$1
> > ProxyPassReverse ^/foobar/v1/(.*)$ balancer://application/api/$1
> >
> > ProxyHCExpr checker {%{REQUEST_STATUS} =~ /^[234]/}
> >
> > <Proxy balancer://application>
> > BalancerMember https://foobar-a.stage.cloud addressttl=3600
> > hcexpr=checker
> > BalancerMember https://foobar-b.stage.cloud addressttl=3600
> > hcexpr=checker
> >
> > # Optional: Load balancing method
> > ProxySet lbmethod=byrequests
> >
> > </Proxy>
> >
> > Thank you
>
>
> SSLProxyEngine should be set to on. Make sure you have it.
>
> Also certificate provided by backend should match name in its CN or
> AltName to the FQDN you are pointing in your BalancerMember directives,
> otherwise you must set SSLProxyCheckPeerName off of fix certificates in
> backend.
>
> You could also try "curl --http1.1 -v https://foobar-a.stage.cloud" to
> check what you get exactly.
>
> --
> -Daniel
> Find help at #httpd in Libera.chat
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
Re: [users@httpd] mod_proxy_hcheck with Istio
Posted by Daniel Ferradal Márquez <df...@apache.org>.
On 24/9/24 8:25, Stanislav Samek wrote:
> ...
> Probably it will be a problem that Istio is exposing endpoints in
> HTTP/2 revision. Don't you have a problem with this?
>
> Here is part of our configuration:
>
> ProxyPassMatch ^/foobar/v1/(.*)$ balancer://application/api/$1
> ProxyPassReverse ^/foobar/v1/(.*)$ balancer://application/api/$1
>
> ProxyHCExpr checker {%{REQUEST_STATUS} =~ /^[234]/}
>
> <Proxy balancer://application>
> BalancerMember https://foobar-a.stage.cloud addressttl=3600
> hcexpr=checker
> BalancerMember https://foobar-b.stage.cloud addressttl=3600
> hcexpr=checker
>
> # Optional: Load balancing method
> ProxySet lbmethod=byrequests
>
> </Proxy>
>
> Thank you
SSLProxyEngine should be set to on. Make sure you have it.
Also certificate provided by backend should match name in its CN or
AltName to the FQDN you are pointing in your BalancerMember directives,
otherwise you must set SSLProxyCheckPeerName off of fix certificates in
backend.
You could also try "curl --http1.1 -v https://foobar-a.stage.cloud" to
check what you get exactly.
--
-Daniel
Find help at #httpd in Libera.chat
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org