Enable UDS support on varnish
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Vgutierrez
	Jun 23 2021, 8:38 AM

Description

Enable incoming traffic on varnish using a Unix Domain Socket (UDS)

Details

Subject	Repo	Branch	Lines +/-
varnish: Handle UDS traffic properly	operations/puppet	production	+38 -1
varnish: Allow configuring UDS owner/group/perms	operations/puppet	production	+11 -2
varnish: Do not assume that UDS implies PROXY protocol	operations/puppet	production	+20 -3
varnish: Add listen on UDS support	operations/puppet	production	+101 -0
vcl: Use VCL 4.1 instead of 4.0	operations/puppet	production	+1 -1

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved		Vgutierrez	T271421 Test envoyproxy as a WMF's CDN TLS terminator with real traffic
		Resolved		Vgutierrez	T285374 Enable UDS support on varnish

Event Timeline

Vgutierrez created this task.Jun 23 2021, 8:38 AM

Change 701056 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] varnish: Add listen on UDS support

https://gerrit.wikimedia.org/r/701056

gerritbot added a project: Patch-For-Review.Jun 23 2021, 8:42 AM

this seemed an innocent change but it effectively forces the update from VCL 4.0 to 4.1:
From varnish documentation:

When UDS listeners are in use, VCL >= 4.1 will be required for all VCL programs loaded by Varnish. If you attempt to load a VCL source with vcl 4.0;, the load will fail with a message that the version is not supported.

Change 701073 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] vcl: Use VCL 4.1 instead of 4.0

https://gerrit.wikimedia.org/r/701073

Initial testing in our labs environment shows that curl doesn't play well with PROXY protocol and unix domain sockets:

root@traffic-cache-atsupload-buster:~# curl --haproxy-protocol --unix-socket /run/varnish-frontend.socket -k -v -H "X-Forwarded-Proto: https" http://127.0.0.1:80/
* Expire in 0 ms for 6 (transfer 0x55a23e318fb0)
*   Trying /run/varnish-frontend.socket...
* Expire in 200 ms for 4 (transfer 0x55a23e318fb0)
* Connected to 127.0.0.1 (/run/varnish-frontend.socket) port 80 (#0)
> PROXY TCP4  /run/varnish-frontend.socket 0 0
* Send failure: Broken pipe
* Failed sending HTTP request
* Connection #0 to host 127.0.0.1 left intact
curl: (55) Send failure: Broken pipe

bug reported to upstream on https://github.com/curl/curl/issues/7290

Change 701073 merged by Vgutierrez:

[operations/puppet@production] vcl: Use VCL 4.1 instead of 4.0

https://gerrit.wikimedia.org/r/701073

Change 701056 merged by Vgutierrez:

[operations/puppet@production] varnish: Add listen on UDS support

https://gerrit.wikimedia.org/r/701056

Maintenance_bot removed a project: Patch-For-Review.Jul 12 2021, 10:11 AM

Vgutierrez closed this task as Resolved.Jul 12 2021, 11:24 AM

Change 713482 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] varnish: Handle UDS traffic properly

https://gerrit.wikimedia.org/r/713482