After Upgrade to 1.16 HAProxy SNI stops working

cloudlady911 · May 14, 2018, 4:19pm

After Upgrade to 1.16 HAProxy SNI stops working.

This is the message in the HAProxy log:
5/14/2018 10:29:48 AMtime="2018-05-14T15:29:48Z" level=info msg=" -- starting haproxy\n * Starting haproxy haproxy\n[WARNING] 133/152947 (34) : config : 'option forwardfor' ignored for proxy 'default' as it requires HTTP mode.\n[WARNING] 133/152947 (34) : config : 'option forwardfor' ignored for frontend '443' as it requires HTTP mode.\n[WARNING] 133/152947 (34) : parsing [/etc/haproxy/haproxy.cfg:63] : HTTP log/header format not usable with backend '443_service1_domian_name_com_' (needs 'mode http').\n[WARNING] 133/152947 (34) : config : 'http-request' rules ignored for backend '443_service1_domian_name_com_' as they require HTTP mode.\n[WARNING] 133/152947 (34) : config : 'option forwardfor' ignored for backend '443_service1_domian_name_com_' as it requires HTTP mode.\n[WARNING] 133/152947 (34) : parsing [/etc/haproxy/haproxy.cfg:71] : HTTP log/header format not usable with backend '443_service3_domian_name_com_' (needs 'mode http').\n[WARNING] 133/152947 (34) : config : 'http-request' rules ignored for backend '443_service3_domian_name_com_' as they require HTTP mode.\n[WARNING] 133/152947 (34) : config : 'option forwardfor' ignored for backend '443_service3_domian_name_com_' as it requires HTTP mode.\n[WARNING] 133/152947 (34) : parsing [/etc/haproxy/haproxy.cfg:79] : HTTP log/header format not usable with backend '443_testservice3_domian_name_com_' (needs 'mode http').\n[WARNING] 133/152947 (34) : config : 'http-request' rules ignored for backend '443_testservice3_domian_name_com_' as they require HTTP mode.\n[WARNING] 133/152947 (34) : config : 'option forwardfor' ignored for backend '443_testservice3_domian_name_com_' as it requires HTTP mode.\n[WARNING] 133/152947 (34) : parsing [/etc/haproxy/haproxy.cfg:87] : HTTP log/header format not usable with backend '443_service2_domian_name_com_' (needs 'mode http').\n[WARNING] 133/152947 (34) : config : 'http-request' rules ignored for backend '443_service2_domian_name_com_' as they require HTTP mode.\n[WARNING] 133/152947 (34) : config : 'option forwardfor' ignored for backend '443_service2_domian_name_com_' as it requires HTTP mode.\n[WARNING] 133/152947 (34) : parsing [/etc/haproxy/haproxy.cfg:95] : HTTP log/header format not usable with backend '443_testservice2_domian_name_com_' (needs 'mode http').\n[WARNING] 133/152947 (34) : config : 'http-request' rules ignored for backend '443_testservice2_domian_name_com_' as they require HTTP mode.\n[WARNING] 133/152947 (34) : config : 'option forwardfor' ignored for backend '443_testservice2_domian_name_com_' as it requires HTTP mode.\n[WARNING] 133/152947 (35) : config : 'option forwardfor' ignored for proxy 'default' as it requires HTTP mode.\n[WARNING] 133/152947 (35) : config : 'option forwardfor' ignored for frontend '443' as it requires HTTP mode.\n[WARNING] 133/152947 (35) : parsing [/etc/haproxy/haproxy.cfg:63] : HTTP log/header format not usable with backend '443_service1_domian_name_com_' (needs 'mode http').\n[WARNING] 133/152947 (35) : config : 'http-request' rules ignored for backend '443_service1_domian_name_com_' as they require HTTP mode.\n[WARNING] 133/152947 (35) : config : 'option forwardfor' ignored for backend '443_service1_domian_name_com_' as it requires HTTP mode.\n[WARNING] 133/152947 (35) : parsing [/etc/haproxy/haproxy.cfg:71] : HTTP log/header format not usable with backend '443_service3_domian_name_com_' (needs 'mode http').\n[WARNING] 133/152947 (35) : config : 'http-request' rules ignored for backend '443_service3_domian_name_com_' as they require HTTP mode.\n[WARNING] 133/152947 (35) : config : 'option forwardfor' ignored for backend '443_service3_domian_name_com_' as it requires HTTP mode.\n[WARNING] 133/152947 (35) : parsing [/etc/haproxy/haproxy.cfg:79] : HTTP log/header format not usable with backend '443_testservice3_domian_name_com_' (needs 'mode http').\n[WARNING] 133/152947 (35) : config : 'http-request' rules ignored for backend '443_testservice3_domian_name_com_' as they require HTTP mode.\n[WARNING] 133/152947 (35) : config : 'option forwardfor' ignored for backend '443_testservice3_domian_name_com_' as it requires HTTP mode.\n[WARNING] 133/152947 (35) : parsing [/etc/haproxy/haproxy.cfg:87] : HTTP log/header format not usable with backend '443_service2_domian_name_com_' (needs 'mode http').\n[WARNING] 133/152947 (35) : config : 'http-request' rules ignored for backend '443_service2_domian_name_com_' as they require HTTP mode.\n[WARNING] 133/152947 (35) : config : 'option forwardfor' ignored for backend '443_service2_domian_name_com_' as it requires HTTP mode.\n[WARNING] 133/152947 (35) : parsing [/etc/haproxy/haproxy.cfg:95] : HTTP log/header format not usable with backend '443_testservice2_domian_name_com_' (needs 'mode http').\n[WARNING] 133/152947 (35) : config : 'http-request' rules ignored for backend '443_testservice2_domian_name_com_' as they require HTTP mode.\n[WARNING] 133/152947 (35) : config : 'option forwardfor' ignored for backend '443_testservice2_domian_name_com_' as it requires HTTP mode.\n ...done.\n"

cloudlady911 · May 14, 2018, 4:20pm

I should note that this was working fine before the upgrade.

cloudlady911 · May 14, 2018, 4:22pm

Version: image: rancher/lb-service-haproxy:v0.9.1

cjellick · May 14, 2018, 4:47pm

I opened the following github issue for this. It will get tracked and investigated better there:

github.com/rancher/rancher

After Upgrade to 1.16 HAProxy SNI stops working

opened 04:46PM - 14 May 18 UTC

closed 04:44PM - 15 May 18 UTC

cjellick

kind/bug area/loadbalancer

**Rancher versions:** rancher/server or rancher/rancher: v1.6.16 LB Version: i…mage: rancher/lb-service-haproxy:v0.9.1 https://forums.rancher.com/t/after-upgrade-to-1-16-haproxy-sni-stops-working/10412 After Upgrade to 1.16 HAProxy SNI stops working. This is the message in the HAProxy log: ``` 5/14/2018 10:29:48 AMtime="2018-05-14T15:29:48Z" level=info msg=" -- starting haproxy * Starting haproxy haproxy [WARNING] 133/152947 (34) : config : 'option forwardfor' ignored for proxy 'default' as it requires HTTP mode. [WARNING] 133/152947 (34) : config : 'option forwardfor' ignored for frontend '443' as it requires HTTP mode. [WARNING] 133/152947 (34) : parsing [/etc/haproxy/haproxy.cfg:63] : HTTP log/header format not usable with backend '443_service1_domian_name_com_' (needs 'mode http'). [WARNING] 133/152947 (34) : config : 'http-request' rules ignored for backend '443_service1_domian_name_com_' as they require HTTP mode. [WARNING] 133/152947 (34) : config : 'option forwardfor' ignored for backend '443_service1_domian_name_com_' as it requires HTTP mode. [WARNING] 133/152947 (34) : parsing [/etc/haproxy/haproxy.cfg:71] : HTTP log/header format not usable with backend '443_service3_domian_name_com_' (needs 'mode http'). [WARNING] 133/152947 (34) : config : 'http-request' rules ignored for backend '443_service3_domian_name_com_' as they require HTTP mode. [WARNING] 133/152947 (34) : config : 'option forwardfor' ignored for backend '443_service3_domian_name_com_' as it requires HTTP mode. [WARNING] 133/152947 (34) : parsing [/etc/haproxy/haproxy.cfg:79] : HTTP log/header format not usable with backend '443_testservice3_domian_name_com_' (needs 'mode http'). [WARNING] 133/152947 (34) : config : 'http-request' rules ignored for backend '443_testservice3_domian_name_com_' as they require HTTP mode. [WARNING] 133/152947 (34) : config : 'option forwardfor' ignored for backend '443_testservice3_domian_name_com_' as it requires HTTP mode. [WARNING] 133/152947 (34) : parsing [/etc/haproxy/haproxy.cfg:87] : HTTP log/header format not usable with backend '443_service2_domian_name_com_' (needs 'mode http'). [WARNING] 133/152947 (34) : config : 'http-request' rules ignored for backend '443_service2_domian_name_com_' as they require HTTP mode. [WARNING] 133/152947 (34) : config : 'option forwardfor' ignored for backend '443_service2_domian_name_com_' as it requires HTTP mode. [WARNING] 133/152947 (34) : parsing [/etc/haproxy/haproxy.cfg:95] : HTTP log/header format not usable with backend '443_testservice2_domian_name_com_' (needs 'mode http'). [WARNING] 133/152947 (34) : config : 'http-request' rules ignored for backend '443_testservice2_domian_name_com_' as they require HTTP mode. [WARNING] 133/152947 (34) : config : 'option forwardfor' ignored for backend '443_testservice2_domian_name_com_' as it requires HTTP mode. [WARNING] 133/152947 (35) : config : 'option forwardfor' ignored for proxy 'default' as it requires HTTP mode. [WARNING] 133/152947 (35) : config : 'option forwardfor' ignored for frontend '443' as it requires HTTP mode. [WARNING] 133/152947 (35) : parsing [/etc/haproxy/haproxy.cfg:63] : HTTP log/header format not usable with backend '443_service1_domian_name_com_' (needs 'mode http'). [WARNING] 133/152947 (35) : config : 'http-request' rules ignored for backend '443_service1_domian_name_com_' as they require HTTP mode. [WARNING] 133/152947 (35) : config : 'option forwardfor' ignored for backend '443_service1_domian_name_com_' as it requires HTTP mode. [WARNING] 133/152947 (35) : parsing [/etc/haproxy/haproxy.cfg:71] : HTTP log/header format not usable with backend '443_service3_domian_name_com_' (needs 'mode http'). [WARNING] 133/152947 (35) : config : 'http-request' rules ignored for backend '443_service3_domian_name_com_' as they require HTTP mode. [WARNING] 133/152947 (35) : config : 'option forwardfor' ignored for backend '443_service3_domian_name_com_' as it requires HTTP mode. [WARNING] 133/152947 (35) : parsing [/etc/haproxy/haproxy.cfg:79] : HTTP log/header format not usable with backend '443_testservice3_domian_name_com_' (needs 'mode http'). [WARNING] 133/152947 (35) : config : 'http-request' rules ignored for backend '443_testservice3_domian_name_com_' as they require HTTP mode. [WARNING] 133/152947 (35) : config : 'option forwardfor' ignored for backend '443_testservice3_domian_name_com_' as it requires HTTP mode. [WARNING] 133/152947 (35) : parsing [/etc/haproxy/haproxy.cfg:87] : HTTP log/header format not usable with backend '443_service2_domian_name_com_' (needs 'mode http'). [WARNING] 133/152947 (35) : config : 'http-request' rules ignored for backend '443_service2_domian_name_com_' as they require HTTP mode. [WARNING] 133/152947 (35) : config : 'option forwardfor' ignored for backend '443_service2_domian_name_com_' as it requires HTTP mode. [WARNING] 133/152947 (35) : parsing [/etc/haproxy/haproxy.cfg:95] : HTTP log/header format not usable with backend '443_testservice2_domian_name_com_' (needs 'mode http'). [WARNING] 133/152947 (35) : config : 'http-request' rules ignored for backend '443_testservice2_domian_name_com_' as they require HTTP mode. [WARNING] 133/152947 (35) : config : 'option forwardfor' ignored for backend '443_testservice2_domian_name_com_' as it requires HTTP mode. ...done. ```

Topic		Replies	Views
Sample haproxy.cfg for whitelist Rancher 1.x	0	1852	March 31, 2017
HA Proxies restart events Rancher 1.x	0	690	October 17, 2018
HAProxy -> Apache X-Forwarded-For not working Rancher 1.x	1	5068	April 12, 2018
URGENT: Can't get Load Balancer to work after 0.59 upgrade Rancher 1.x	10	1603	February 26, 2016
HAProxy.cfg with SNI support misses ACL Rancher 1.x	3	2536	April 28, 2016

After Upgrade to 1.16 HAProxy SNI stops working

Related Topics