Thalassa Aqueduct
Overview
Aqueduct is a part of the Thalassa system of components. Thalassa is primarily geared to enable continuous deployment scenarios through dynamic configuration of HAProxy load balancers and seamless, no connection drop A/B deploys. Aqueduct is the node.js service that manages and controls an HAProxy server.
Aqueduct exposes a REST API for configuring HAProxy and can dyanmically set HAProxy backends members based on the name and version of Thalassa registered services. Aqueduct leverages HAProxy's ability to gracefully reload config without any interruption to user, in other words, without dropping any connections.
The Thalassa version of Aqueduct has been updated to use @3rd-Eden's haproxy module to manage and control the HAProxy process.
HAProxy Fundamentals
Aqueduct does not try to obfuscate HAProxy, and it's important to know the fundamentals of how HAProxy works to understand Aqueduct. The API mirrors HAProxy's semantics. The HAProxy documentation contains a wealth of detailed information.
-
Frontends - A "frontend" section describes a set of listening sockets accepting client connections.
-
Backends - A "backend" section describes a set of servers to which the proxy will connect to forward incoming connections.
-
Members/Servers - Aqueduct calls the servers that backends route to "members". In other words, members of a backend pool of servers.
-
Config file - At startup, HAProxy loads a configuration file and never looks at that file again. Aqueduct manages this by re-templating a new config file and gracefully restarting the HAProxy process.
-
Stats Socket - a UNIX socket in stream mode that will return various statistics outputs and even allows some basic configuration tweaking like enabling and disabling existing backend members, setting weights, etc. Aqueduct connects to this socket and provides realtime streaming stats over a web socket stream.
Installation
npm install thalassa-aqueduct
Running
The easiest way to run Aqueduct at this point is with the bin script from the command line. Aqueduct is exposed as a module and can be used as such in your own application but you should have a close look at how the Hapi server and web socket stream is configured.
./node_modules/.bin/thalassa-aqueduct
Options
./node_modules/.bin/thalassa-aqueduct --help
Options:
--host host to bind to [default: "0.0.0.0"]
--port port to bind to [default: 10000]
--label logical label for this aqueduct
--thalassaHost host of the Thalassa server [default: "127.0.0.1"]
--thalassaPort socket port of the Thalassa server [default: 5001]
--thalassaApiPort http API port of the Thalassa server [default: 9000]
--haproxySocketPath path to Haproxy socket file [default: "/tmp/haproxy.status.sock"]
--haproxyPidPath path to Haproxy pid file [default: "/var/run/haproxy.pid"]
--haproxyCfgPath generated Haproxy config location [default: "/etc/haproxy/haproxy.cfg"]
--templateFile template used to generate Haproxy config [default: "default.haproxycfg.tmpl"]
--persistence directory to save configuration
--sudo use sudo when starting haproxy
--debug enabled debug logging
--dbPath filesystem path for leveldb [default: "./node_modules/thalassa-crowsnest/bin/db"]
For example the command to run might look something like this (typically how I run locally):
./node_modules/.bin/thalassa-aqueduct --haproxyCfgPath /tmp/haproxy.cfg --debug --persistence \
'/tmp/aqueduct.json' --templateFile dev.haproxycfg.tmpl --haproxyPidPath /tmp/haproxy.pid \
--label 'myapp-dev'
Web UI
Aqueduct provides a web UI that allows users to get a visual representation of the frontends/backends/member data related to their haproxy instance (via the 'overview' page), as well as some insight into the activity (haproxy config changes, online/offline events) occuring within Aqueduct (via the 'activity' page).
The UI can be accessed on the port specified by the --port parameter (by default port 10000).
e.g. http://127.0.0.1:10000 would access the web UI on localhost at the default port of 10000
HTTP API
GET /frontends
Returns Array of frontend objects for all of the frontends configured for this Aqueduct server.
For example:
[{
"id": "frontend/myapp",
"_type": "frontend",
"key": "myapp",
"bind": "*:8080,*:80",
"backend": "live",
"mode": "http",
"keepalive": "default",
"rules": [{
"type": "header",
"header": "host",
"operation": "hdr_dom",
"value": "staged.myapp.com",
"backend": "staged"
}],
"natives": []
}]
GET /frontends/{key}
Gets a specific frontend by key. Expect a response status code of 200 otherwise 404.
PUT /frontends/{key}
Create or update a frontend by key. PUT with a Content-Type of application/json and a body like:
{
"bind": "10.2.2.2:80,*:8080" // IP and ports to bind to, comma separated, host may be *
, "backend": "foo" // the default backend to route to, it must be defined already
, "mode": "tcp" // default: http, expects tcp|http
, "keepalive": "close" // default: "default", expects default|close|server-close
, "rules": [] // array of rules, see next section
, "natives": [] // array of strings of raw config USE SPARINGLY!!
};
Routing Rules
There are currently 3 types of rules that can be applied to frontends: path, url, and header.
Path rules support path, path_beg, and path_reg HAProxy operations
{
"type": "path"
, "operation": "path|path_beg|path_reg"
, "value": "favicon.ico|/ecxd/|^/article/[^/]*$"
, "backend": "foo" // if rule is met, the backend to route the request to
}
Url rules support url, url_beg, and url_reg HAProxy operations
{
"type": "url"
, "operation": "url|url_beg|url_reg"
, "value": "/bar" // value for the operation
, "backend": "bar" // if rule is met, the backend to route the request to
}
Header rules support hdr_dom with a entire value at this point
{
"type": "header"
, "header": "host" // the name of the HTTP header
, "operation": "hdr_dom"
, "value": "baz.com"
, "backend": "baz" // if rule is met, the backend to route the request to
}
Natives
The natives property is an end around way to insert raw lines of config for front ends and backends. Use them sparingly but use them if you need them.
DELETE /frontends/{key}
Delete a specific frontend by key. Expect 200 or 404
GET /backends
Returns Array of backend objects for all of the backends configured for this Aqueduct server.
For example:
[{
"id": "backend/live",
"_type": "backend",
"key": "live",
"type": "dynamic",
"name": "classroom-ui",
"version": "1.0.0",
"balance": "roundrobin",
"host": null,
"mode": "http",
"members": [{
"name": "myapp",
"version": "1.0.0",
"host": "10.10.240.121",
"port": 8080,
"lastKnown": 1378762056885,
"meta": {
"hostname": "dev-use1b-pr-01-myapp-01x00x00-01",
"pid": 17941,
"registered": 1378740834616
},
"id": "/myapp/1.0.0/10.10.240.121/8080"
},
{
"name": "myapp",
"version": "1.0.0",
"host": "10.10.240.80",
"port": 8080,
"lastKnown": 1378762060226,
"meta": {
"hostname": "dev-use1b-pr-01-myapp-01x00x00-02",
"pid": 18020,
"registered": 1378762079883
},
"id": "/myapp/1.0.0/10.10.240.80/8080"
}],
"natives": []
}]
PUT /backends/{key}
Create or update a backend by key. PUT with a Content-Type of application/json and a body like:
{
"type" : "dynamic|static"
, "name" : "foo" // only required if type = dynamic
, "version" : "1.0.0" // only required if type = dynamic
, "balance" : "roundrobin|source" // defaults to roundrobin
, "host" : "myapp.com" // default: undefined, if specified request to member will contain this host header
, "health" : { // optional health check
"method": "GET" // HTTP method
, "uri": "/checkity-check" // URI to call
, "httpVersion": "HTTP/1.1" // HTTP/1.0 or HTTP/1.1 `host` required if HTTP/1.1
, "interval": 5000 // period to check, milliseconds
}
, "mode" : "http|tcp" // default: http
, "natives": [] // array of strings of raw config USE SPARINGLY!!
, "members" : [] // if type = dynamic this is dynamically populated based on role/version subscription
// otherwise expects { host: '10.10.10.10', port: 8080}
}
GET /backends/{key}
Gets a specific backend by key. Expect 200 else 404.
DELETE /backends/{key}
Delete a specific backend by key. Expect 200 or 404
POST /backends/{key}
Update a backends role and version Subscription with a Content-Type of application/json and a body like:
{
"name": "myapp" // app name registered to thalassa
, "version": "1.1.0" // version to route to
}
name is actually optional. You may also just send the version:
{
"version": "1.1.0"
}
GET /haproxy/config
Return the last know generated HAProxy config file contents that were written to the location of opts.haproxyCfgPath.
global
log 127.0.0.1 local0
log 127.0.0.1 local1 notice
daemon
maxconn 4096
user haproxy
group haproxy
stats socket /tmp/haproxy.status.sock user appuser level admin
defaults
log global
option dontlognull
option redispatch
retries 3
maxconn 2000
timeout connect 5000ms
timeout client 50000ms
timeout server 50000ms
listen stats :1988
mode http
stats enable
stats uri /
stats refresh 2s
stats realm Haproxy\ Stats
stats auth showme:showme
frontend myapp
bind *:8080,*:80
mode http
default_backend live
option httplog
option http-server-close
option http-pretend-keepalive
acl header_uv7vi hdr_dom(host) myapp-staged.com
use_backend staged if header_uv7vi
backend live
mode http
balance roundrobin
server live_10.10.240.121:8080 10.10.240.121:8080 check inter 2000
server live_10.10.240.80:8080 10.10.240.80:8080 check inter 2000
backend staged
mode http
balance roundrobin
server staged_10.10.240.174:8080 10.10.240.174:8080 check inter 2000
server staged_10.10.240.206:8080 10.10.240.206:8080 check inter 2000
Known Limitations and Roadmap
Thalassa currently doesn't implement any type of authentication or authorization and at this point expects to be running on a trusted private network. This will be addressed in the future. Ultimately auth should be extensible and customizable. Suggestions and pull requests welcome!
License
Licensed under Apache 2.0. See LICENSE file.