Merge ~hloeung/content-cache-charm:haproxy-config into content-cache-charm:master

[Haw Loeung]

Fix to use backend-path for backend checks if defined

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[James Simpson (jsimpso)]

LGTM

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 2d4a14b89bcc54f23f067b95a5dd53f084f6ff46

diff --git a/lib/haproxy.py b/lib/haproxy.py
index 8a7a637..be91db4 100644
--- a/lib/haproxy.py
+++ b/lib/haproxy.py
@@ -261,6 +261,9 @@ backend backend-{name}
                 maxconn = loc_conf.get('backend-maxconn', 200)
                 method = loc_conf.get('backend-check-method', 'HEAD')
                 path = loc_conf.get('backend-check-path', '/')
+                if path.startswith('/'):
+                    path = path[1:]
+                path = os.path.join(loc_conf.get('backend-path', '/'), path)
                 signed_url_hmac_key = loc_conf.get('signed-url-hmac-key')
                 if signed_url_hmac_key:
                     expiry_time = utils.never_expires_time()
diff --git a/reactive/content_cache.py b/reactive/content_cache.py
index 4516e5a..4a81b89 100644
--- a/reactive/content_cache.py
+++ b/reactive/content_cache.py
@@ -359,7 +359,7 @@ def configure_haproxy():  # NOQA: C901 LP#1825084
 
             new_cached_loc_conf['signed-url-hmac-key'] = loc_conf.get('signed-url-hmac-key')
             # Pass through selected backend location configs, if defined.
-            for key in ('site-name', 'backend-inter-time', 'backend-site-name', 'backend-tls'):
+            for key in ('site-name', 'backend-inter-time', 'backend-path', 'backend-site-name', 'backend-tls'):
                 if key in loc_conf:
                     new_loc_conf[key] = loc_conf[key]
             # No 'backend-tls' provided so let's try work out automatically.
@@ -475,6 +475,10 @@ def configure_nagios():
                 # Backend proxy layer check; no token needs to be passed here as it's
                 # stripped by the cache layer.
                 check_name = utils.generate_nagios_check_name(nagios_name, 'site', 'backend_proxy')
+                # We also need to use the backend-path if present.
+                if path.startswith('/'):
+                    path = path[1:]
+                path = os.path.join(loc_conf.get('backend-path', '/'), path)
                 cmd = (
                     '/usr/lib/nagios/plugins/check_http -I 127.0.0.1 -H {site_name} -p {backend_port}'
                     ' -j {method} -u {path}'.format(
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
index e27c5f5..1cd9a4c 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output.txt
@@ -240,7 +240,7 @@ backend backend-site5
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200
 
 backend backend-site5-2
-    option httpchk HEAD / HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
+    option httpchk HEAD /auth-check/ HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site5.local
     option redispatch 1
     balance leastconn
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt
index 3a7c3ee..f35b48a 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_auto_maxconns.txt
@@ -240,7 +240,7 @@ backend backend-site5
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200
 
 backend backend-site5-2
-    option httpchk HEAD / HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
+    option httpchk HEAD /auth-check/ HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site5.local
     option redispatch 1
     balance leastconn
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_load_balancing_algorithm.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_load_balancing_algorithm.txt
index 4c5d2c6..5542295 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output_load_balancing_algorithm.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_load_balancing_algorithm.txt
@@ -240,7 +240,7 @@ backend backend-site5
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200
 
 backend backend-site5-2
-    option httpchk HEAD / HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
+    option httpchk HEAD /auth-check/ HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site5.local
     option redispatch 1
     balance roundrobin
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_override_backend_site.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_override_backend_site.txt
index 7120c9f..2d4cf0b 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output_override_backend_site.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_override_backend_site.txt
@@ -1,6 +1,6 @@
 global
     nbthread 4
-    maxconn 16384
+    maxconn 24576
     log /dev/log local0
     log /dev/log local1 notice
     chroot /var/lib/haproxy
@@ -36,7 +36,7 @@ global
     # requires ~200 bytes so on a host with say 32 CPUs, 10 sites,
     # each with 2000 max conns will only consume around 122 Mbytes
     # (32 * 10 * 2000 * 200), which is not much.
-    tune.ssl.cachesize 16384
+    tune.ssl.cachesize 24576
 
 defaults
     log global
@@ -78,17 +78,23 @@ listen  stats
     stats refresh 3
 
 
-listen cached-site1-local
+listen combined-443
     bind 0.0.0.0:443 ssl crt /var/lib/haproxy/certs alpn h2,http/1.1
     bind :::443 ssl crt /var/lib/haproxy/certs alpn h2,http/1.1
     capture request header X-Cache-Request-ID len 60
-    default_backend backend-cached-site1-local
+    use_backend backend-cached-site1-local if { hdr(Host) -i site1.local }
+    use_backend backend-cached-site2-local if { hdr(Host) -i site2.local }
 
 listen site1-local
     bind 127.0.0.1:8080
     capture request header X-Cache-Request-ID len 60
     default_backend backend-site1-local
 
+listen site2-local
+    bind 127.0.0.1:8081
+    capture request header X-Cache-Request-ID len 60
+    default_backend backend-site2-local
+
 backend backend-cached-site1-local
     option httpchk GET /_status/content-cache-check HTTP/1.1\r\nHost:\ site1.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site1.local
@@ -102,3 +108,17 @@ backend backend-site1-local
     option redispatch 1
     balance leastconn
     server server_1 10.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(objectstorage.ps5.internal) check-sni objectstorage.ps5.internal verify required ca-file ca-certificates.crt
+
+backend backend-cached-site2-local
+    option httpchk GET /_status/content-cache-check HTTP/1.1\r\nHost:\ site2.local\r\nUser-Agent:\ haproxy/httpchk
+    http-request set-header Host site2.local
+    http-request set-header X-Forwarded-For %[src]
+    balance leastconn
+    server server_1 127.0.0.1:6081 check inter 2s rise 2 fall 60 maxconn 200
+
+backend backend-site2-local
+    option httpchk HEAD /swift/v1/AUTH_aabbccdd001122/mybucket/index.html HTTP/1.1\r\nHost:\ objectstorage.ps5.internal\r\nUser-Agent:\ haproxy/httpchk
+    http-request set-header Host objectstorage.ps5.internal
+    option redispatch 1
+    balance leastconn
+    server server_1 10.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(objectstorage.ps5.internal) check-sni objectstorage.ps5.internal verify required ca-file ca-certificates.crt
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads.txt
index edcf968..6a51f8a 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads.txt
@@ -241,7 +241,7 @@ backend backend-site5
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200
 
 backend backend-site5-2
-    option httpchk HEAD / HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
+    option httpchk HEAD /auth-check/ HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site5.local
     option redispatch 1
     balance leastconn
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads_haproxy2.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads_haproxy2.txt
index f9e5f97..e1735fc 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads_haproxy2.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads_haproxy2.txt
@@ -244,7 +244,7 @@ backend backend-site5
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200
 
 backend backend-site5-2
-    option httpchk HEAD / HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
+    option httpchk HEAD /auth-check/ HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site5.local
     retry-on all-retryable-errors
     option redispatch 1
diff --git a/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output.txt b/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output.txt
index dd90319..ace8cc4 100644
--- a/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output.txt
+++ b/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output.txt
@@ -32,7 +32,7 @@ backend backend-site5
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200
 
 backend backend-site5-2
-    option httpchk HEAD / HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
+    option httpchk HEAD /auth-check/ HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site5.local
     balance leastconn
     server server_1 127.0.1.11:80 check inter 5s rise 2 fall 5 maxconn 200
diff --git a/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output3.txt b/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output3.txt
index c50f39e..fa5df40 100644
--- a/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output3.txt
+++ b/tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output3.txt
@@ -4,3 +4,9 @@ backend backend-site1-local
     http-request set-header Host objectstorage.ps5.internal
     balance leastconn
     server server_1 10.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(objectstorage.ps5.internal) check-sni objectstorage.ps5.internal verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn http/1.1
+
+backend backend-site2-local
+    option httpchk HEAD /swift/v1/AUTH_aabbccdd001122/mybucket/index.html HTTP/1.1\r\nHost:\ objectstorage.ps5.internal\r\nUser-Agent:\ haproxy/httpchk
+    http-request set-header Host objectstorage.ps5.internal
+    balance leastconn
+    server server_1 10.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(objectstorage.ps5.internal) check-sni objectstorage.ps5.internal verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn http/1.1
diff --git a/tests/unit/files/haproxy_config_rendered_test_output.txt b/tests/unit/files/haproxy_config_rendered_test_output.txt
index ce982ea..a101eb0 100644
--- a/tests/unit/files/haproxy_config_rendered_test_output.txt
+++ b/tests/unit/files/haproxy_config_rendered_test_output.txt
@@ -141,7 +141,7 @@ backend backend-site5
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200
 
 backend backend-site5-2
-    option httpchk HEAD / HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
+    option httpchk HEAD /auth-check/ HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site5.local
     balance leastconn
     server server_1 127.0.1.11:80 check inter 5s rise 2 fall 5 maxconn 200
diff --git a/tests/unit/files/haproxy_config_rendered_test_output2.txt b/tests/unit/files/haproxy_config_rendered_test_output2.txt
index 1149b85..a8f0cb6 100644
--- a/tests/unit/files/haproxy_config_rendered_test_output2.txt
+++ b/tests/unit/files/haproxy_config_rendered_test_output2.txt
@@ -141,7 +141,7 @@ backend backend-site5
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200
 
 backend backend-site5-2
-    option httpchk HEAD / HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
+    option httpchk HEAD /auth-check/ HTTP/1.1\r\nHost:\ site5.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site5.local
     balance leastconn
     server server_1 127.0.1.11:80 check inter 5s rise 2 fall 5 maxconn 200
diff --git a/tests/unit/test_content_cache.py b/tests/unit/test_content_cache.py
index 9dd21b7..feba416 100644
--- a/tests/unit/test_content_cache.py
+++ b/tests/unit/test_content_cache.py
@@ -491,6 +491,15 @@ site1.local:
       backend-tls: true
       backends: ['10.0.1.10:443']
   tls-cert-bundle-path: /var/lib/haproxy/certs
+site2.local:
+  locations:
+    /:
+      backend-check-path: '/index.html'
+      backend-path: '/swift/v1/AUTH_aabbccdd001122/mybucket/'
+      backend-site-name: 'objectstorage.ps5.internal'
+      backend-tls: true
+      backends: ['10.0.1.10:443']
+  tls-cert-bundle-path: /var/lib/haproxy/certs
 '''
         self.mock_config.return_value = {'haproxy_hard_stop_after': '15m', 'max_connections': 8192, 'sites': config}
         with mock.patch('lib.haproxy.HAProxyConf.conf_file', new_callable=mock.PropertyMock) as mock_conf_file:
@@ -864,7 +873,7 @@ site1.local:
             mock.call(
                 shortname='site_site5_auth_backend_proxy',
                 description='site5 backend proxy check',
-                check_cmd='/usr/lib/nagios/plugins/check_http -I 127.0.0.1 -H site5.local -p 8084 -j HEAD -u /auth',
+                check_cmd='/usr/lib/nagios/plugins/check_http -I 127.0.0.1 -H site5.local -p 8084 -j HEAD -u /auth-check/auth',  # NOQA: E501
             ),
         ]
         nrpe_instance_mock.add_check.assert_has_calls(want, any_order=True)
diff --git a/tests/unit/test_haproxy.py b/tests/unit/test_haproxy.py
index 66ba6e7..e690f2d 100644
--- a/tests/unit/test_haproxy.py
+++ b/tests/unit/test_haproxy.py
@@ -174,7 +174,18 @@ class TestLibHAProxy(unittest.TestCase):
                         'backends': ['10.0.1.10:443'],
                     }
                 }
-            }
+            },
+            'site2.local': {
+                'locations': {
+                    '/': {
+                        'backend-check-path': '/index.html',
+                        'backend-path': '/swift/v1/AUTH_aabbccdd001122/mybucket/',
+                        'backend-site-name': 'objectstorage.ps5.internal',
+                        'backend-tls': True,
+                        'backends': ['10.0.1.10:443'],
+                    }
+                }
+            },
         }
         output = 'tests/unit/files/haproxy_config_rendered_backends_stanzas_test_output3.txt'
         with open(output, 'r', encoding='utf-8') as f: