Hide Forgot
Description of problem: In OSP 7, haproxy does not redirect from http to https for SSL enabled configurations. I created this RFE in case that this is not yet fixed in more recent versions. Version-Release number of selected component (if applicable): OSP 7 (RFE is for more recent versions, >= 10) Steps to reproduce: I just deployed a 1 controller + 1 compute lab with SSL and RHEL OSP 7.3. This is the relevant section of haproxy.cfg about horizon: ~~~ [root@overcloud-controller-0 ~]# cat /etc/haproxy/haproxy.cfg | grep horizon -A10 listen horizon bind 10.0.0.4:443 transparent ssl crt /etc/pki/tls/private/overcloud_endpoint.pem bind 172.16.2.4:80 transparent mode http cookie SERVERID insert indirect nocache rsprep ^Location:\ http://(.*) Location:\ https://\1 server overcloud-controller-0 172.16.2.7:80 check fall 5 inter 2000 rise 2 ~~~ How to make this work manually" ~~~ + bind 10.0.0.4:80 transparent + redirect scheme https code 301 if !{ ssl_fc } ~~~ So the final result: ~~~ listen horizon bind 10.0.0.4:443 transparent ssl crt /etc/pki/tls/private/overcloud_endpoint.pem bind 172.16.2.4:80 transparent bind 10.0.0.4:80 transparent redirect scheme https code 301 if !{ ssl_fc } mode http cookie SERVERID insert indirect nocache rsprep ^Location:\ http://(.*) Location:\ https://\1 server overcloud-controller-0 172.16.2.7:80 check fall 5 inter 2000 rise 2 ~~~ and restart haproxy. We need to modify tripleo so that it adds this redirect (if the customer wishes to add it)
If you deploy today an osp10 environment with ssl you get this config: listen horizon bind 172.16.2.11:443 transparent ssl crt /etc/pki/tls/private/overcloud_endpoint.pem bind 172.16.2.11:80 transparent bind 172.16.99.5:443 transparent ssl crt /etc/pki/tls/private/overcloud_endpoint.pem bind 172.16.99.5:80 transparent mode http cookie SERVERID insert indirect nocache http-request set-header X-Forwarded-Proto https if { ssl_fc } http-request set-header X-Forwarded-Proto http if !{ ssl_fc } option forwardfor redirect scheme https code 301 if !{ ssl_fc } rsprep ^Location:\ http://(.*) Location:\ https://\1 server overcloud-controller-0.internalapi.localdomain 172.16.2.16:80 check cookie overcloud-controller-0 fall 5 inter 2000 rise 2 server overcloud-controller-1.internalapi.localdomain 172.16.2.5:80 check cookie overcloud-controller-0 fall 5 inter 2000 rise 2 server overcloud-controller-2.internalapi.localdomain 172.16.2.14:80 check cookie overcloud-controller-0 fall 5 inter 2000 rise 2 So the redirect is present and working.