8 ms·

Haproxy 2.2

132 points by dragonsh 6y ago

jontro 6y ago
Here is the announcement blogpost https://www.haproxy.com/blog/announcing-haproxy-2-2/ https://www.haproxy.com/blog/announcing-haproxy-2-2/
js4ever 6y ago
Finally full SSL certs management at runtime through the API is here! No need to restart Haproxy anymore to add or update a cert! Brilliant, thanks!
- kitotik 6y ago
  FWIW the ability to send a SIGUSR2 to reload certs has been there for awhile.
aduitsis 6y ago
Haproxy is such a nice piece of software, sensible configuration, very stable and versatile. And, one thing that is highly appreciated, I've never seen it do something I wasn't expecting it to. This quality of minimal surprises in its operation isn't going unnoticed by any measure.
- closeparen 6y ago
  Has it solved the reloading problem yet?
  - rbjorklin 6y ago
    Yup, https://www.haproxy.com/blog/hitless-reloads-with-haproxy-howto/ https://www.haproxy.com/blog/hitless-reloads-with-haproxy-ho...
- kqr 6y ago
  There are some edges that were still a bit rough at least in 1.8. In particular, the way it handles reloading state from the state file, and the interactions with that state and the configuration file. I don't remember the exact details, but the allowed formats of some identifiers were different, and it didn't do "the obvious thing" when the configuration and state file contained a different set of definitions, IIRC. This was consistent, but not very well documented. It works fine for us now, so we like it, of course, but it took some production incidents to figure out how it all worked. (We did test before shipping, of course, but these were hard-to-predict edge cases.)
sillysaurusx 6y ago
Haproxy isn’t quite as fast as iptables (we switched because of this) but it was delightful to configure. The tradeoff is definitely worth it in most cases.
- enitihas 6y ago
  Just curious, what were you doing where you needed the performance of iptables over haproxy?
  - sillysaurusx 6y ago
    We forward a cluster of 2,560 TPU pod cores from our GCE project to other GCE projects in europe-west4-a. Originally it was because we had a separate GCE project with a bunch of credits, but that project had no access to TPUs. The question was, could we still take advantage of the credits? It turns out, we could; the solution involved VPC Network Peering, which I later learned is how the TPUs themselves work. Some configuration details are here: https://www.shawwn.com/swarm#iptables https://www.shawwn.com/swarm#iptables Nowadays we forward the TPU pods to pretty much anyone who wants to try them out, in hopes of getting more people involved in the TPU programming scene. The TPUs are managed via a website (https://www.tensorfork.com/tpus https://www.tensorfork.com/tpus) and we coordinate TPU access via spreadsheet. Each researcher has their own GCE project, and we simply flip a switch to give them access. If anyone reading this happens to be into ML and into programming for big hardware rigs, feel free to hop into the Tensorfork discord server and we can show you the ropes. https://github.com/shawwn/tpunicorn#ml-community https://github.com/shawwn/tpunicorn#ml-community
  - toast0 6y ago
    I've done some dead simple forwarding/load balancing work, and if you can do it with nat instead of a proxy application it'll use a lot less memory, in addition to less cpu. That means fewer load balancers needed, or smaller machines (or both). So I'd say that means anytime you run out of capacity on your proxy machines would be an opportunity to look for other techniques. Haproxy is probably easier to use though, and would tend to need less work to get the features you want, though. So there's an opex/capex vs development time argument. Hyperscaling Haproxy is a lot of fun too, though. There's a huge difference in connections/second between a normal config and a totally tuned config with haproxy and kernel patching on the table.
snvzz 6y ago
It's amazing how much better the .org site is over the .com.
- rumanator 6y ago
  Isn't it the other way around? Haproxy.org is not responsive and looks like it was designed in the 90s.
  - zokier 6y ago
    > looks like it was designed in the 90s. I think plenty of HNers will see that as a positive aspect.
    - rumanator 6y ago
      I understand the nostalgia or liking the retro look, but the site is completely unreadable in mobile. There is absolutely no redeeming quality in that. Claiming that an unreadable version of a site is better than a readable one is simply wrong.
      - fgonzag 6y ago
        Maybe they're not using it on mobile?
      - vbezhenar 6y ago
        Some people are using phones to call and computers to browse the Internet.
        rumanator 6y ago
        What's your point? Are you trying to argue that just because you imagine someone does not have a smartphone then it's ok to fool ourselves to believe that no one has a smartphone? Because mobile has been a basic requirement and competency for, say, the last decade.
lukeqsee 6y ago
HAProxy is a unique piece of software. I’ve had the privilege to interact directly with Willy (the main developer for many years, still the project lead) on the mailing list, in person at the conference, and even though I’ve never paid a dime, the interaction has been the best open-source experience I’ve ever had. Willy routinely writes multi-paragraph responses on the mailing list to my hair-brained suggestions for how HAProxy could be better for my company’s rather unique needs. I often feel bad that I cannot do more for the project, because it is so well thought-through and delivered. The software cuts no corners and delivers at fractions of the TCO of competition (limited by my opinion and experience, of course). For instance, just last week, I spun a rate limiting solution in half a morning, that mitigated some annoying proxy bots instantly (and is flexible enough to automatically block offenders without affecting legitimate users). The stats, DNS support, and integrations and many other featured are second to none among other load balancers. It’s an impressive and refreshing project. We could all learn something from HAProxy and the team.
- topspin 6y ago
  I asked for a feature on GitHub (fetching SHA-2 fingerprint of client certificates, as opposed to SHA-1) and it was handled in one day. That was the feature that pulled me away from nginx (which still only provides SHA-1 via $ssl_client_fingerprint btw.)
  - lukeqsee 6y ago
    Sounds like par for the course. I compiled it from source on our edge servers for a long time (as opposed to packaged), simply so I could apply these real time patches as needed.
  - TimWolla 6y ago
    Oh hi! That was me [1]. I'm a community contributor, but I'm equally impressed by the speed patches get merged on the mailing list. [1] https://github.com/haproxy/haproxy/issues/123#issuecomment-502632102 https://github.com/haproxy/haproxy/issues/123#issuecomment-5...
- apple4ever 6y ago
netcraft 6y ago
Slightly OT, we have several different kinds of services that need rate limiting, written in different stacks. We would like to have one solution for rate limiting, ideally that we could put in front of any service, that was light weight, but also could work with AWS target groups that are already splitting traffic across nodes inside a service - so I believe that means some sort of clustered solution or at least communication. Is haproxy a good fit for this? Maybe nginx (paid)?
- social_quotient 6y ago
  We use HAproxy for similar reasons you describe if I’m understanding correctly. As one of the other posts kinda suggested you can get a ton done with a few hours, it might be worth just standing up a box real quick and trying it out. As a note when we try stuff like this we put behind a AWS LB so we can push partial traffic to our experiment and aren’t betting the farm whilst testing in prod. Good luck!
- nine_k 6y ago
  I wonder why Envoy is not mentioned.
leehampton 6y ago
I love HA Proxy, but one thing I'm confused about is why the http-tunnel feature was removed in this release (and deprecated in earlier 2.x releases). http-tunnel allowed you to start a session with an HTTP request/response, then keep the socket to the backend alive without further inspection of the protocol. This is useful for things like RTSP where you kick things off with HTTP but then stream lower level TCP content over the same socket. There are also lots of other custom protocols that benefit from this type of set up, including one that I'm working on wrangling HA Proxy to work with now. Does anyone know if there's some replacement way to handle this in HA Proxy that I'm overlooking?
- thayne 6y ago
  > why the http-tunnel feature was removed in this release From the haproxy 2.0 documentation: > This mode should not be used as it creates lots of trouble with logging and HTTP processing. And because it cannot work in HTTP/2, this option is deprecated and it is only supported on legacy HTTP frontends. In HTX, it is ignored and a warning is emitted during HAProxy startup. As for a way to handle this, I believe if you are using an HTTP CONNECT or a websocket (Connection: Upgrade), then haproxy will detect that it is a tunnel, and handle that correctly. If that's not the case, you might be able to use haproxy in tcp mode.
  - thedanbob 6y ago
    There is a bug in 2.2 which prevents websockets (and other tunneling protocols?) from working[0]. Maybe what the OP is running into. [0] https://github.com/haproxy/haproxy/issues/737 https://github.com/haproxy/haproxy/issues/737
arrty88 6y ago
The only open source software better than Haproxy is redis IMHO.
- stephenr 6y ago
  I agree that Redis is "good", I wouldn't put it at the level of HAProxy - particularly when it comes to "what stuff is deliberately kept out of the open source version". If I had to choose a project/tool to put at a similar 'level' as HAProxy in terms of: doing one thing well; a working open source project with a private company backing it; and a well run project, I'd say it's Varnish, which just happens to pair very well with HAProxy.
therockspush 6y ago
Seeing a lot of love for Willy, the main developer for years, on here. I've dabbled in HAProxy, definitely a lovable product. Looked up Willy on LinkedIn,"DO NOT SEND ME FCKING INVITES IF WE HAVE NOT WORKED TOGETHER! " No Fcking around with this guy.
warmfusion 6y ago
Haproxy is brilliant, we've used it for years as a simple mesh on all our services, but we're considering moving to envoy as we need opentracing support to help understand how requests flow between services. Anyone managed to make this work on haproxy?
- rogerdonut 6y ago
  There's an opentracing integration coming very soon! We were hoping to have it available with the 2.2 release but there were still a few things to finalize.

132 points by dragonsh 6y ago

Here is the announcement blogpost https://www.haproxy.com/blog/announcing-haproxy-2-2/ https://www.haproxy.com/blog/announcing-haproxy-2-2/

js4ever 6y ago

Finally full SSL certs management at runtime through the API is here! No need to restart Haproxy anymore to add or update a cert! Brilliant, thanks!

kitotik 6y ago
FWIW the ability to send a SIGUSR2 to reload certs has been there for awhile.

aduitsis 6y ago

Haproxy is such a nice piece of software, sensible configuration, very stable and versatile. And, one thing that is highly appreciated, I've never seen it do something I wasn't expecting it to. This quality of minimal surprises in its operation isn't going unnoticed by any measure.

closeparen 6y ago
Has it solved the reloading problem yet?
- rbjorklin 6y ago
  Yup, https://www.haproxy.com/blog/hitless-reloads-with-haproxy-howto/ https://www.haproxy.com/blog/hitless-reloads-with-haproxy-ho...
kqr 6y ago
There are some edges that were still a bit rough at least in 1.8. In particular, the way it handles reloading state from the state file, and the interactions with that state and the configuration file. I don't remember the exact details, but the allowed formats of some identifiers were different, and it didn't do "the obvious thing" when the configuration and state file contained a different set of definitions, IIRC. This was consistent, but not very well documented. It works fine for us now, so we like it, of course, but it took some production incidents to figure out how it all worked. (We did test before shipping, of course, but these were hard-to-predict edge cases.)

sillysaurusx 6y ago

Haproxy isn’t quite as fast as iptables (we switched because of this) but it was delightful to configure. The tradeoff is definitely worth it in most cases.

enitihas 6y ago
Just curious, what were you doing where you needed the performance of iptables over haproxy?
- sillysaurusx 6y ago
  We forward a cluster of 2,560 TPU pod cores from our GCE project to other GCE projects in europe-west4-a. Originally it was because we had a separate GCE project with a bunch of credits, but that project had no access to TPUs. The question was, could we still take advantage of the credits? It turns out, we could; the solution involved VPC Network Peering, which I later learned is how the TPUs themselves work. Some configuration details are here: https://www.shawwn.com/swarm#iptables https://www.shawwn.com/swarm#iptables Nowadays we forward the TPU pods to pretty much anyone who wants to try them out, in hopes of getting more people involved in the TPU programming scene. The TPUs are managed via a website (https://www.tensorfork.com/tpus https://www.tensorfork.com/tpus) and we coordinate TPU access via spreadsheet. Each researcher has their own GCE project, and we simply flip a switch to give them access. If anyone reading this happens to be into ML and into programming for big hardware rigs, feel free to hop into the Tensorfork discord server and we can show you the ropes. https://github.com/shawwn/tpunicorn#ml-community https://github.com/shawwn/tpunicorn#ml-community
- toast0 6y ago
  I've done some dead simple forwarding/load balancing work, and if you can do it with nat instead of a proxy application it'll use a lot less memory, in addition to less cpu. That means fewer load balancers needed, or smaller machines (or both). So I'd say that means anytime you run out of capacity on your proxy machines would be an opportunity to look for other techniques. Haproxy is probably easier to use though, and would tend to need less work to get the features you want, though. So there's an opex/capex vs development time argument. Hyperscaling Haproxy is a lot of fun too, though. There's a huge difference in connections/second between a normal config and a totally tuned config with haproxy and kernel patching on the table.

snvzz 6y ago

It's amazing how much better the .org site is over the .com.

rumanator 6y ago
Isn't it the other way around? Haproxy.org is not responsive and looks like it was designed in the 90s.
- zokier 6y ago
  > looks like it was designed in the 90s. I think plenty of HNers will see that as a positive aspect.
  - rumanator 6y ago
    I understand the nostalgia or liking the retro look, but the site is completely unreadable in mobile. There is absolutely no redeeming quality in that. Claiming that an unreadable version of a site is better than a readable one is simply wrong.
    - fgonzag 6y ago
      Maybe they're not using it on mobile?
    - vbezhenar 6y ago
      Some people are using phones to call and computers to browse the Internet.
      - rumanator 6y ago
        What's your point? Are you trying to argue that just because you imagine someone does not have a smartphone then it's ok to fool ourselves to believe that no one has a smartphone? Because mobile has been a basic requirement and competency for, say, the last decade.

lukeqsee 6y ago

HAProxy is a unique piece of software. I’ve had the privilege to interact directly with Willy (the main developer for many years, still the project lead) on the mailing list, in person at the conference, and even though I’ve never paid a dime, the interaction has been the best open-source experience I’ve ever had. Willy routinely writes multi-paragraph responses on the mailing list to my hair-brained suggestions for how HAProxy could be better for my company’s rather unique needs. I often feel bad that I cannot do more for the project, because it is so well thought-through and delivered. The software cuts no corners and delivers at fractions of the TCO of competition (limited by my opinion and experience, of course). For instance, just last week, I spun a rate limiting solution in half a morning, that mitigated some annoying proxy bots instantly (and is flexible enough to automatically block offenders without affecting legitimate users). The stats, DNS support, and integrations and many other featured are second to none among other load balancers. It’s an impressive and refreshing project. We could all learn something from HAProxy and the team.

topspin 6y ago
I asked for a feature on GitHub (fetching SHA-2 fingerprint of client certificates, as opposed to SHA-1) and it was handled in one day. That was the feature that pulled me away from nginx (which still only provides SHA-1 via $ssl_client_fingerprint btw.)
- lukeqsee 6y ago
  Sounds like par for the course. I compiled it from source on our edge servers for a long time (as opposed to packaged), simply so I could apply these real time patches as needed.
- TimWolla 6y ago
  Oh hi! That was me [1]. I'm a community contributor, but I'm equally impressed by the speed patches get merged on the mailing list. [1] https://github.com/haproxy/haproxy/issues/123#issuecomment-502632102 https://github.com/haproxy/haproxy/issues/123#issuecomment-5...
apple4ever 6y ago

netcraft 6y ago

Slightly OT, we have several different kinds of services that need rate limiting, written in different stacks. We would like to have one solution for rate limiting, ideally that we could put in front of any service, that was light weight, but also could work with AWS target groups that are already splitting traffic across nodes inside a service - so I believe that means some sort of clustered solution or at least communication. Is haproxy a good fit for this? Maybe nginx (paid)?

social_quotient 6y ago
We use HAproxy for similar reasons you describe if I’m understanding correctly. As one of the other posts kinda suggested you can get a ton done with a few hours, it might be worth just standing up a box real quick and trying it out. As a note when we try stuff like this we put behind a AWS LB so we can push partial traffic to our experiment and aren’t betting the farm whilst testing in prod. Good luck!
nine_k 6y ago
I wonder why Envoy is not mentioned.

leehampton 6y ago

I love HA Proxy, but one thing I'm confused about is why the http-tunnel feature was removed in this release (and deprecated in earlier 2.x releases). http-tunnel allowed you to start a session with an HTTP request/response, then keep the socket to the backend alive without further inspection of the protocol. This is useful for things like RTSP where you kick things off with HTTP but then stream lower level TCP content over the same socket. There are also lots of other custom protocols that benefit from this type of set up, including one that I'm working on wrangling HA Proxy to work with now. Does anyone know if there's some replacement way to handle this in HA Proxy that I'm overlooking?

thayne 6y ago
> why the http-tunnel feature was removed in this release From the haproxy 2.0 documentation: > This mode should not be used as it creates lots of trouble with logging and HTTP processing. And because it cannot work in HTTP/2, this option is deprecated and it is only supported on legacy HTTP frontends. In HTX, it is ignored and a warning is emitted during HAProxy startup. As for a way to handle this, I believe if you are using an HTTP CONNECT or a websocket (Connection: Upgrade), then haproxy will detect that it is a tunnel, and handle that correctly. If that's not the case, you might be able to use haproxy in tcp mode.
- thedanbob 6y ago
  There is a bug in 2.2 which prevents websockets (and other tunneling protocols?) from working[0]. Maybe what the OP is running into. [0] https://github.com/haproxy/haproxy/issues/737 https://github.com/haproxy/haproxy/issues/737

arrty88 6y ago

The only open source software better than Haproxy is redis IMHO.

stephenr 6y ago
I agree that Redis is "good", I wouldn't put it at the level of HAProxy - particularly when it comes to "what stuff is deliberately kept out of the open source version". If I had to choose a project/tool to put at a similar 'level' as HAProxy in terms of: doing one thing well; a working open source project with a private company backing it; and a well run project, I'd say it's Varnish, which just happens to pair very well with HAProxy.

therockspush 6y ago

Seeing a lot of love for Willy, the main developer for years, on here. I've dabbled in HAProxy, definitely a lovable product. Looked up Willy on LinkedIn,"DO NOT SEND ME FCKING INVITES IF WE HAVE NOT WORKED TOGETHER! " No Fcking around with this guy.

warmfusion 6y ago

Haproxy is brilliant, we've used it for years as a simple mesh on all our services, but we're considering moving to envoy as we need opentracing support to help understand how requests flow between services. Anyone managed to make this work on haproxy?

rogerdonut 6y ago
There's an opentracing integration coming very soon! We were hoping to have it available with the 2.2 release but there were still a few things to finalize.