How to create a PEM file for HAProxy Configure SSL Certificate

1)
Generate a unique private key (KEY)
$sudo openssl genrsa -out mydomain.key 2048

Note:
Content in this file start with -----BEGIN RSA PRIVATE KEY-----

2)
Generating a Certificate Signing Request (CSR)
$sudo openssl req -new -key mydomain.key -out mydomain.csr

Note:
Content in this file start with -----BEGIN CERTIFICATE REQUEST-----



3)
Creating a Self-Signed Certificate (CRT)
$openssl x509 -req -days 365 -in mydomain.csr -signkey mydomain.key -out mydomain.crt

Note:
Content in this file start with -----BEGIN CERTIFICATE-----

4)
Append KEY and CRT to mydomain.pem
$sudo bash -c 'cat mydomain.key mydomain.crt >> /etc/ssl/private/mydomain.pem'

Note:
This pem file contains 2 sections (certificates), one start with -----BEGIN RSA PRIVATE KEY----- and  another one start with -----BEGIN CERTIFICATE-----

5)
Specify PEM in haproxy config
$ sudo vim /etc/haproxy/haproxy.cfg
listen haproxy
  bind 0.0.0.0:443 ssl crt /etc/ssl/private/mydomain.pem
  mode  http
  option http-server-close
  option forwardfor
  reqadd X-Forwarded-Proto:\ https
  reqadd X-Forwarded-Port:\ 443
  option forwardfor if-none
  balance  roundrobin
  option  abortonclose
  server 192.168.100.224 192.168.100.224:1443 check inter 10s rise 2 fall 3 ssl verify none

6)
Restart haproxy
$ sudo service haproxy restart

Ref:
https://gist.github.com/sethwebster/b48d7c872fe397c1db11
https://help.ubuntu.com/lts/serverguide/certificates-and-security.html

OpenStack how haproxy redirect CLI/API request contrail api server

http://fosshelp.blogspot.com/2014/11/openstack-haproxy-redirect-cliapi.html

OpenStack how haproxy redirect CLI/API request to neutron server

1)
Neutron CLI will send request to haproxy running in port "9696"

You can find the haproxy setting in /etc/nova/nova.conf

#sudo vim /etc/nova/nova.conf
quantum_url = http://localhost:9696/
neutron_url = http://127.0.0.1:9696/

2)
Find ID of process which running on port 9696

#sudo netstat -tuplen | grep 9696
tcp        0      0 0.0.0.0:9696            0.0.0.0:*               LISTEN      0          10659       1800/haproxy

Note:
------
Process ID : 1800/haproxy

3)
Find the process by Process ID 1800

#ps -aux | grep 1800
Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html
haproxy   1800  0.2  0.0  21568  2148 ?        Ss   13:12   0:37 /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -D -p /var/run/haproxy.pid

Note:
------
Location of haproxy binary: /usr/sbin/haproxy
haproxy config file: /etc/haproxy/haproxy.cfg

4)
Open haproxy config file /etc/haproxy/haproxy.cfg

#sudo vim /etc/haproxy/haproxy.cfg

#contrail-config-marker-start
listen contrail-config-stats :5937
   mode http
   stats enable
   stats uri /
   stats auth haproxy:contrail123

frontend quantum-server *:9696
    default_backend    quantum-server-backend

frontend  contrail-api *:8082
    default_backend    contrail-api-backend

frontend  contrail-discovery *:5998
    default_backend    contrail-discovery-backend

backend quantum-server-backend
    option nolinger
    balance     roundrobin
    server 127.0.0.1 127.0.0.1:9697 check inter 2000 rise 2 fall 3

    #server  10.84.14.2 10.84.14.2:9697 check

backend contrail-api-backend
    option nolinger
    balance     roundrobin
    server 127.0.0.1 127.0.0.1:9100 check inter 2000 rise 2 fall 3

    #server  10.84.14.2 10.84.14.2:9100 check
    #server  10.84.14.2 10.84.14.2:9101 check

backend contrail-discovery-backend
    option nolinger
    balance     roundrobin
    server 127.0.0.1 127.0.0.1:9110 check inter 2000 rise 2 fall 3

Note:
--------
Please note the Settings of quantum/neutron and contrail

4,a)

frontend quantum-server *:9696
    default_backend    quantum-server-backend

backend quantum-server-backend
    option nolinger
    balance     roundrobin
    server 127.0.0.1 127.0.0.1:9697 check inter 2000 rise 2 fall 3

* Means, haproxy will redirect all trafic flowing to port 9696 to 9697 (where neutron-server is running)

4,a1)
Find ID of process which running on port 9696

#sudo netstat -tuplen | grep 9696
tcp        0      0 0.0.0.0:9696            0.0.0.0:*               LISTEN      0          10659       1800/haproxy

4,a2)
Find name of the process which has ID:1800, it is haproxy.

#ps -aux | grep 1800
Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html
haproxy   1800  0.2  0.0  21568  2136 ?        Ss   13:12   0:42 /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -D -p /var/run/haproxy.pid

4,a3)
Find ID of process which running on port 9697

#sudo netstat -tuplen | grep 9697
tcp        0      0 0.0.0.0:9697            0.0.0.0:*               LISTEN      120        428165      323/python

4,a4)
Find name of the process which has ID:323, it is neutron-server.

#ps -aux | grep 323
neutron    323  0.1  0.9 113236 46356 ?        Ss   16:56   0:02 /usr/bin/python /usr/bin/neutron-server --config-file /etc/neutron/neutron.conf --log-file /var/log/neutron/server.log --config-file /etc/neutron/plugins/opencontrail/ContrailPlugin.ini


4,b)

frontend  contrail-api *:8082
    default_backend    contrail-api-backend

backend contrail-api-backend
    option nolinger
    balance     roundrobin
    server 127.0.0.1 127.0.0.1:9100 check inter 2000 rise 2 fall 3

* Means, haproxy will redirect all trafic flowing to port 8082 to 9100 (where contrail-api is running)

4,b1)
Find ID of process which running on port 8082

#sudo netstat -tuplen | grep 8082
tcp        0      0 0.0.0.0:8082            0.0.0.0:*               LISTEN      0          10660       1800/haproxy

4,b2)
Find name of the process which has ID:1800, it is haproxy.

#ps -aux | grep 1800
Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html
haproxy   1800  0.2  0.0  21568  2136 ?        Ss   13:12   0:42 /usr/sbin/haproxy -f /etc/haproxy/haproxy.cfg -D -p /var/run/haproxy.pid

4,b3)
Find ID of process which running on port 9100

#sudo netstat -tuplen | grep 9100
tcp        0      0 0.0.0.0:9100            0.0.0.0:*               LISTEN      0          31764       1918/python

4,b4)
Find name of the process which has ID:1918, it is contrail-api.

#ps -aux | grep 1918
root      1918  0.6  1.1 324340 56180 ?        Sl   13:13   1:43 /usr/bin/python /usr/bin/contrail-api --conf_file /etc/contrail/contrail-api.conf --listen_port 9100 --worker_id 0