[Stats Question] Possible to configure as backend instead of frontend?

[mecampbellsoup]

We would like to call stats enable and the other stats-related configuration inside of an HAProxy backend.

It seems like the IC always generates a frontend configuration however:

frontend stats
  mode http
  bind *:1024 name stats
  bind :::1024 name v6
  stats enable
  stats uri /
  stats refresh 10s
  http-request set-var(txn.base) base
  http-request use-service prometheus-exporter if { path /metrics }

Is there a reason it's always injected as a frontend configuration?

In our case, we use HAProxy IC as an API Gateway within our shared k8s cluster, and so we'd like to use the same authorization patterns that we use for other downstream (upstream?) applications that sit behind the gateway, namely lua.cached-auth (our custom Lua auth script/program).

[mecampbellsoup]

@Mo3m3n additionally would it be possible to disable the default frontend stats? Then I could just use my own backend as normal (via an Ingress).

[ivanmatmati]

Hi @mecampbellsoup , the stats frontend can't be disabled. If you want to create your backend, you can. By default our script creates a service pointing to the controller. Your ingress only has to refer to it.

[mecampbellsoup]

Hi @mecampbellsoup , the stats frontend can't be disabled. If you want to create your backend, you can. By default our script creates a service pointing to the controller. Your ingress only has to refer to it.

Yea, I ended up making an ingress that points to the metric service since, when enablePorts.stats = false, that port 1024 seems to be exposed by the metrics/Prometheus service.

In a perfect world, this particular ingress would NOT have a public IP, but since our IC is public generally I'm not sure how to accomplish that. Any ideas?

[ivanmatmati]

You have several options. Among them, you can secure the ingress with authentication or with allow and deny lists of IPs or CIDRs.

[mecampbellsoup]

You have several options. Among them, you can secure the ingress with authentication or with allow and deny lists of IPs or CIDRs.

Cool, haven't used allow/deny lists yet! Thanks for the tip.

Is it possible to generate those dynamically to express something like "only people (IPs) with access to our private internal network can access the stats backend"?

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.