haproxy 2.0 dataplaneapi rest api 试用

Posted 2022-09-20 rongfengliang

我们可以基于haproxy 提供的dataplaneapi 动态进行haproxy 配置的修改，增强haproxy的可编程能力，以下是一个简单
的测试，基于docker-compose运行

环境准备

• docker-compose文件

version: "3"

services:

    grafana:

     image: grafana/grafana

     ports:

     - "3000:3000"

    prometheus:

     image: prom/prometheus

     volumes:

     - "./prometheus.yml:/etc/prometheus/prometheus.yml"

     ports:

     - "9090:9090"

    haproxy:

     image: dalongrong/haproxy-dataplaneapi:2.0.5

     build: ./

     volumes:

     - "./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg"

     ports:

     - "80:80"

     - "5555:5555"

     - "8404:8404"

     - "8080:8080"

     - "9000:9000"

     - "9001:9001"

     - "9002:9002"

     - "1000-1005:1000-1005"

     - "10080:10080"

    nginx1:

     image: nginx

     ports:

     - "8090:80"

    nginx2:

     image: nginx

     ports:

     - "8091:80"

 

 

• haproxy 配置

#

# This is the ultimate HAProxy 2.0 "Getting Started" config

# It demonstrates many of the features available which are now available 

# While you may not need all of these things, this can serve

# as a reference for your own configurations.

#

# Have questions? Check out our community Slack:

# https://slack.haproxy.org/

#

?

global

    # master-worker required for `program` section

    # enable here or start with -Ws

    master-worker

    mworker-max-reloads 3

    # enable core dumps

    set-dumpable

    user root

    group root

    log stdout local0

?

defaults

    mode http

    log global

    timeout client 5s

    timeout server 5s

    timeout connect 5s

    option redispatch

    option httplog

?

resolvers dns

    parse-resolv-conf

    resolve_retries 3

    timeout resolve 1s

    timeout retry 1s

    hold other 30s

    hold refused 30s

    hold nx 30s

    hold timeout 30s

    hold valid 10s

    hold obsolete 30s

program dataplane-api

    command /usr/local/sbin/dataplaneapi --host 0.0.0.0 --port 5555 --haproxy-bin /usr/local/sbin/haproxy --config-file /usr/local/etc/haproxy/haproxy.cfg --reload-cmd "kill -SIGUSR2 1" --reload-delay 5 --userlist api

    no option start-on-reload

userlist api 

   # user admin password $5$aVnIFECJ$2QYP64eTTXZ1grSjwwdoQxK/AP8kcOflEO1Q5fc.5aA

    user admin insecure-password dalong

frontend stats

    bind *:8404

    # Enable Prometheus Exporter

    http-request use-service prometheus-exporter if  path /metrics 

    stats enable

    stats uri /stats

    stats refresh 10s

?

frontend fe_main

    bind *:8080

    # Enable log sampling

    # One out of 10 requests would be logged to this source

    log 127.0.0.1:10001 sample 1:10 local0

    # For every 11 requests, log requests 2, 3, and 8-11

    log 127.0.0.1:10002 sample 2-3,8-11:11 local0

?

    # Log profiling data

    log-format "%ci:%cp [%tr] %ft %b/%s %TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %+Qr cpu_calls:%[cpu_calls] cpu_ns_tot:%[cpu_ns_tot] cpu_ns_avg:%[cpu_ns_avg] lat_ns_tot:%[lat_ns_tot] lat_ns_avg:%[lat_ns_avg]"

?

    # gRPC path matching

    acl is_grpc_codename path /CodenameCreator/KeepGettingCodenames 

    # Dynamic ‘do-resolve‘ trusted hosts

    acl dynamic_hosts req.hdr(Host) api.local admin.local haproxy.com

?

    # Activate Traffic Mirror

    # Redirect if not SSL

    # http-request redirect scheme https unless  ssl_fc 

?

    # Enable src tracking

    # http-request track-sc0 src table mypeers/src_tracking

?

    # Enable rate limiting

    # Return 429 Too Many Requests if client averages more than

    # 10 requests in 10 seconds.

    # (duration defined in stick table in peers section)

    http-request deny deny_status 429 if  sc_http_req_rate(0) gt 10 

?

    # Enable local resolving of Host if within dynamic_hosts ACL

    # Allows connecting to dynamic IP address specified in Host header

    # Useful for DNS split view or split horizon

    http-request do-resolve(txn.dstip,dns) hdr(Host),lower if dynamic_hosts

    http-request capture var(txn.dstip) len 40 if dynamic_hosts

?

    # return 503 when dynamic_hosts matches but the variable 

    # txn.dstip is not set which mean DNS resolution error

    # otherwise route to be_dynamic

    use_backend be_503 if dynamic_hosts ! var(txn.dstip) -m found 

    use_backend be_dynamic if dynamic_hosts

?

    # route to gRPC path

    use_backend be_grpc if is_grpc_codename 

?

    default_backend be_main

?

backend be_main

    # Enable Power of Two Random Choices Algorithm

    balance random(2)

    # Enable Layer 7 retries

    retry-on all-retryable-errors

    retries 3 

    # retrying POST requests can be dangerous

    # make sure you understand the implications before removing

    http-request disable-l7-retry if METH_POST

    server server1 nginx1:80 check inter 3s

    server server2 nginx2:80 check inter 3s

backend be_grpc

    default-server ssl verify none alpn h2 check maxconn 50

    server grpc1 10.1.0.11:3000 

    server grpc2 10.1.0.12:3000 

?

backend be_dynamic

    default-server ssl verify none check maxconn 50

?

    # rule to prevent HAProxy from reconnecting to services

    # on the local network (forged DNS name used to scan the network)

    http-request deny if  var(txn.dstip) -m ip 127.0.0.0/8 10.0.0.0/8 

    http-request set-dst var(txn.dstip)

    server dynamic 0.0.0.0:0

?

backend spoe-traffic-mirror

    mode tcp

    balance roundrobin

    timeout connect 5s

    timeout server 1m

    server spoa1 127.0.0.1:12345

    server spoa2 10.1.0.20:12345

?

backend be_503

    # dummy backend used to return 503.

    # You can use the ‘errorfile‘ directive to send a nice

    # 503 error page to end users.

    errorfile 503 /usr/local/etc/haproxy/errors/503.http

 

 

• 启动

docker-compose up -d

• 效果

 

 

动态添加代理配置

dataplaneapi 有一个事物的概念，我们可以基于次模型进行动态haproxy 的操作，以下是一个简单的演示

• 创建代理的流程
  首选创建backend
  添加server到backend
  创建frontend
  添加bind 到frontend
• 一个简单的操作
  初始化事物：

curl -X POST --user admin:dalong \\

-H "Content-Type: application/json" \\

http://localhost:5555/v1/services/haproxy/transactions?version=1

效果：

"_version":1,"id":"1f9630d9-665d-43f8-8ad9-f15652fbfbbe","status":"in_progress"

查询事物：

curl -X GET --user admin:dalong \\

-H "Content-Type: application/json" \\

"http://localhost:5555/v1/services/haproxy/transactions"

效果：

["_version":1,"id":"1f9630d9-665d-43f8-8ad9-f15652fbfbbe","status":"in_progress"]

创建backend 服务：

curl -X POST --user admin:dalong \\

-H "Content-Type: application/json" \\

-d ‘"name": "test_backend", "mode":"http", "balance": "algorithm":"roundrobin", "httpchk": "method": "HEAD", "uri": "/", "version": "HTTP/1.1"‘ \\

"http://localhost:5555/v1/services/haproxy/configuration/backends?transaction_id=1f9630d9-665d-43f8-8ad9-f15652fbfbbe" 

效果：

"balance":"algorithm":"roundrobin","arguments":null,"httpchk":"method":"HEAD","uri":"/","version":"HTTP/1.1","mode":"http","name":"test_backend"

添加server 到backend 服务：

curl -X POST --user admin:dalong \\

-H "Content-Type: application/json" \\

-d ‘"name": "server1", "address": "192.168.0.104", "port":8888, "check": "enabled", "maxconn": 30, "weight": 100‘ \\

"http://localhost:5555/v1/services/haproxy/configuration/servers?backend=test_backend&transaction_id=1f9630d9-665d-43f8-8ad9-f15652fbfbbe"

效果：

"address":"192.168.0.104","check":"enabled","maxconn":30,"name":"server1","port":8888,"weight":100

创建frontend 服务：

curl -X POST --user admin:dalong \\

-H "Content-Type: application/json" \\

-d ‘"name": "test_frontend", "mode": "http", "default_backend": "test_backend", "maxconn": 2000‘ \\

"http://localhost:5555/v1/services/haproxy/configuration/frontends?transaction_id=1f9630d9-665d-43f8-8ad9-f15652fbfbbe"

效果：

"default_backend":"test_backend","maxconn":2000,"mode":"http","name":"test_frontend"

创建bind 服务：

curl -X POST --user admin:dalong \\

-H "Content-Type: application/json" \\

-d ‘"name": "http", "address": "*", "port": 10080‘ \\

"http://localhost:5555/v1/services/haproxy/configuration/binds?frontend=test_frontend&transaction_id=1f9630d9-665d-43f8-8ad9-f15652fbfbbe"

效果：

"address":"*","name":"http","port":10080

应用变更：

curl -X PUT --user admin:dalong \\

-H "Content-Type: application/json" \\

"http://localhost:5555/v1/services/haproxy/transactions/1f9630d9-665d-43f8-8ad9-f15652fbfbbe"

效果：

"_version":1,"id":"1f9630d9-665d-43f8-8ad9-f15652fbfbbe","status":"success"

• 修改的haproxy 配置文件

实际上我们应用变更之后，会生成新的配置文件
内容如下：

 

 

 

 

• 启动demo backend 服务

 

live-server  --port=8888

• 效果

live-server 服务：

haproxy 代理服务：

 

 

haproxy 监控服务：

 

 

prometheus metrics服务：

说明

以上是一个简单的操作，官方文档提供了比较全的说明，很值得看看，同时基于dataplaneapi 我们可以方便的 扩展haproxy

参考资料

https://www.haproxy.com/documentation/hapee/1-9r1/configuration/dataplaneapi/
https://www.haproxy.com/documentation/dataplaneapi/latest/
https://github.com/rongfengliang/haproxy2.0-prometheus