From 1ac1be10872ab9e72e72662d626b3a21859aae59 Mon Sep 17 00:00:00 2001 From: Dan Webb Date: Sat, 14 Mar 2026 21:20:39 +0000 Subject: [PATCH 01/14] feat: modernise cookbook structure and ChefSpec - Add frozen_string_literal: true to all Ruby files - Add provides declarations to all resources - Rename spec/unit/recipes/ to spec/unit/resources/ - Fix almalinux/10 fauxhai spec (use platform override instead of unbundled platform) - Expand metadata.rb platform support (almalinux, rocky, oracle, fedora) - Add default kitchen suite with test recipe and InSpec profile - Align CI matrix with kitchen platforms and suites - Add LIMITATIONS.md documenting known constraints --- LIMITATIONS.md | 72 +++++++++++++++++++ kitchen.dokken.yml | 37 +++++----- kitchen.yml | 3 + libraries/helpers.rb | 2 + libraries/resource.rb | 2 + libraries/template.rb | 2 + mise.toml | 2 + resources/acl.rb | 4 ++ resources/backend.rb | 4 ++ resources/cache.rb | 4 ++ resources/config_defaults.rb | 4 ++ resources/config_global.rb | 4 ++ resources/fastcgi.rb | 4 ++ resources/frontend.rb | 4 ++ resources/install.rb | 8 +-- resources/listen.rb | 4 ++ resources/mailer.rb | 4 ++ resources/peer.rb | 4 ++ resources/resolver.rb | 4 ++ resources/service.rb | 4 ++ resources/use_backend.rb | 4 ++ resources/userlist.rb | 4 ++ spec/spec_helper.rb | 2 + .../unit/{recipes => resources}/cache_spec.rb | 2 + .../{recipes => resources}/defaults_spec.rb | 2 + .../{recipes => resources}/fastcgi_spec.rb | 2 + .../frontend_backend_spec.rb | 2 + .../{recipes => resources}/global_spec.rb | 2 + .../{recipes => resources}/install_spec.rb | 7 +- .../{recipes => resources}/listen_spec.rb | 2 + .../{recipes => resources}/mailer_spec.rb | 2 + spec/unit/{recipes => resources}/peer_spec.rb | 2 + test/cookbooks/test/recipes/default.rb | 20 ++++++ .../default/controls/default_spec.rb | 1 + test/integration/default/inspec.yml | 9 +++ 35 files changed, 215 insertions(+), 24 deletions(-) create mode 100644 LIMITATIONS.md rename spec/unit/{recipes => resources}/cache_spec.rb (97%) rename spec/unit/{recipes => resources}/defaults_spec.rb (95%) rename spec/unit/{recipes => resources}/fastcgi_spec.rb (98%) rename spec/unit/{recipes => resources}/frontend_backend_spec.rb (97%) rename spec/unit/{recipes => resources}/global_spec.rb (94%) rename spec/unit/{recipes => resources}/install_spec.rb (95%) rename spec/unit/{recipes => resources}/listen_spec.rb (99%) rename spec/unit/{recipes => resources}/mailer_spec.rb (97%) rename spec/unit/{recipes => resources}/peer_spec.rb (97%) create mode 100644 test/cookbooks/test/recipes/default.rb create mode 100644 test/integration/default/controls/default_spec.rb create mode 100644 test/integration/default/inspec.yml diff --git a/LIMITATIONS.md b/LIMITATIONS.md new file mode 100644 index 00000000..61d6f49e --- /dev/null +++ b/LIMITATIONS.md @@ -0,0 +1,72 @@ +# Limitations + +## Package Availability + +HAProxy is available as a package on all major Linux distributions. The version +available depends on the distribution release. + +### APT (Debian/Ubuntu) + +- **Debian 11 (Bullseye)**: HAProxy 2.2 (default), 2.4–2.8 via haproxy.debian.net +- **Debian 12 (Bookworm)**: HAProxy 2.6 (default), 2.8–3.0 via haproxy.debian.net +- **Ubuntu 20.04 (Focal)**: HAProxy 2.0 (default), newer via PPA `ppa:vbernat/haproxy-X.Y` +- **Ubuntu 22.04 (Jammy)**: HAProxy 2.4 (default), newer via PPA +- **Ubuntu 24.04 (Noble)**: HAProxy 2.8 (default), newer via PPA + +Architectures: amd64, arm64, i386 (varies by release). + +### DNF/YUM (RHEL family) + +- **RHEL 8 / AlmaLinux 8 / Rocky 8 / Oracle 8**: HAProxy 1.8 (base), newer via EPEL or AppStream +- **RHEL 9 / AlmaLinux 9 / Rocky 9 / Oracle 9**: HAProxy 2.4 (AppStream) +- **AlmaLinux 10 / CentOS Stream 10**: HAProxy 3.0+ (AppStream) +- **CentOS Stream 9**: HAProxy 2.4 (AppStream) +- **Amazon Linux 2023**: HAProxy 2.8 (default repos) +- **Fedora**: Latest stable (default repos) + +Architectures: x86_64, aarch64. + +EPEL is required for RHEL-family platforms when the base/AppStream version is insufficient. +The `yum-epel` cookbook dependency handles this. + +### Zypper (SUSE) + +- **openSUSE Leap 15**: HAProxy 2.x (default repos) + +Architectures: x86_64. + +## Source/Compiled Installation + +HAProxy can be compiled from source on all supported platforms. The cookbook supports +source installation with configurable version, build flags, and optional features +(Lua, OpenSSL, PCRE, Prometheus exporter). + +### Build Dependencies + +| Platform Family | Packages | +|-----------------|-----------------------------------------------------------------------| +| Debian | build-essential, libpcre3-dev, libssl-dev, zlib1g-dev, libsystemd-dev | +| RHEL (< 10) | pcre-devel, openssl-devel, zlib-devel, systemd-devel, tar | +| RHEL (>= 10) | pcre2-devel, openssl-devel, zlib-devel, systemd-devel, tar | +| SUSE | pcre-devel, libopenssl-devel, zlib-devel, systemd-devel | + +### Optional Build Dependencies + +| Feature | Debian | RHEL | +|-----------|---------------------|----------------| +| Lua | liblua5.3-dev | lua-devel | +| OpenSSL 3 | libssl-dev (>= 3.0) | openssl3-devel | + +## Architecture Limitations + +- All platforms provide amd64/x86_64 packages +- arm64/aarch64 packages available on Debian 11+, Ubuntu 20.04+, RHEL 9+ +- Source compilation works on all architectures with appropriate cross-compiler + +## Known Issues + +- PCRE1 (`pcre-devel`) is deprecated on RHEL/CentOS/AlmaLinux/Rocky >= 10; the cookbook + automatically selects PCRE2 (`pcre2-devel`) on those platforms +- IUS repository support is limited to RHEL 6/7 (both EOL) and should be considered deprecated +- OpenSSL source compilation has known issues (see [#503](https://github.com/sous-chefs/haproxy/issues/503)) +- The `haproxy-systemd-wrapper` binary is only used for HAProxy versions < 1.8 diff --git a/kitchen.dokken.yml b/kitchen.dokken.yml index c4f69844..d668e5b8 100644 --- a/kitchen.dokken.yml +++ b/kitchen.dokken.yml @@ -1,7 +1,8 @@ +--- driver: name: dokken privileged: true - chef_version: <%= ENV['CHEF_VERSION'] || 'current' %> + chef_version: 18.9.4 transport: { name: dokken } provisioner: @@ -12,84 +13,84 @@ platforms: - name: almalinux-8 driver: image: dokken/almalinux-8 - pid_one_command: /usr/lib/systemd/systemd + pid_one_command: ["/usr/lib/systemd/systemd"] - name: almalinux-9 driver: image: dokken/almalinux-9 - pid_one_command: /usr/lib/systemd/systemd + pid_one_command: ["/usr/lib/systemd/systemd"] - name: almalinux-10 driver: image: dokken/almalinux-10 - pid_one_command: /usr/lib/systemd/systemd + pid_one_command: ["/usr/lib/systemd/systemd"] - name: amazonlinux-2023 driver: image: dokken/amazonlinux-2023 - pid_one_command: /usr/lib/systemd/systemd + pid_one_command: ["/usr/lib/systemd/systemd"] - name: centos-stream-9 driver: image: dokken/centos-stream-9 - pid_one_command: /usr/lib/systemd/systemd + pid_one_command: ["/usr/lib/systemd/systemd"] - name: centos-stream-10 driver: image: dokken/centos-stream-10 - pid_one_command: /usr/lib/systemd/systemd + pid_one_command: ["/usr/lib/systemd/systemd"] - name: debian-11 driver: image: dokken/debian-11 - pid_one_command: /bin/systemd + pid_one_command: ["/bin/systemd"] - name: debian-12 driver: image: dokken/debian-12 - pid_one_command: /bin/systemd + pid_one_command: ["/bin/systemd"] - name: fedora-latest driver: image: dokken/fedora-latest - pid_one_command: /usr/lib/systemd/systemd + pid_one_command: ["/usr/lib/systemd/systemd"] - name: opensuse-leap-15 driver: image: dokken/opensuse-leap-15 - pid_one_command: /usr/lib/systemd/systemd + pid_one_command: ["/usr/lib/systemd/systemd"] - name: oraclelinux-8 driver: image: dokken/oraclelinux-8 - pid_one_command: /usr/lib/systemd/systemd + pid_one_command: ["/usr/lib/systemd/systemd"] - name: oraclelinux-9 driver: image: dokken/oraclelinux-9 - pid_one_command: /usr/lib/systemd/systemd + pid_one_command: ["/usr/lib/systemd/systemd"] - name: rockylinux-8 driver: image: dokken/rockylinux-8 - pid_one_command: /usr/lib/systemd/systemd + pid_one_command: ["/usr/lib/systemd/systemd"] - name: rockylinux-9 driver: image: dokken/rockylinux-9 - pid_one_command: /usr/lib/systemd/systemd + pid_one_command: ["/usr/lib/systemd/systemd"] - name: ubuntu-20.04 driver: image: dokken/ubuntu-20.04 - pid_one_command: /bin/systemd + pid_one_command: ["/bin/systemd"] - name: ubuntu-22.04 driver: image: dokken/ubuntu-22.04 - pid_one_command: /bin/systemd + pid_one_command: ["/bin/systemd"] - name: ubuntu-24.04 driver: image: dokken/ubuntu-24.04 - pid_one_command: /bin/systemd + pid_one_command: ["/bin/systemd"] diff --git a/kitchen.yml b/kitchen.yml index 6017dd86..9c763a5e 100644 --- a/kitchen.yml +++ b/kitchen.yml @@ -26,6 +26,9 @@ platforms: - name: fedora-latest suites: + - name: default + provisioner: + named_run_list: default - name: package provisioner: named_run_list: package diff --git a/libraries/helpers.rb b/libraries/helpers.rb index 570960d3..c095ebaf 100644 --- a/libraries/helpers.rb +++ b/libraries/helpers.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + module Haproxy module Cookbook module Helpers diff --git a/libraries/resource.rb b/libraries/resource.rb index 9d5f7c90..8f03ef84 100644 --- a/libraries/resource.rb +++ b/libraries/resource.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + module Haproxy module Cookbook module ResourceHelpers diff --git a/libraries/template.rb b/libraries/template.rb index 7b6d151e..ad3b21b7 100644 --- a/libraries/template.rb +++ b/libraries/template.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + module Haproxy module Cookbook module TemplateHelpers diff --git a/mise.toml b/mise.toml index 43fe9b0a..179bbb98 100644 --- a/mise.toml +++ b/mise.toml @@ -1,2 +1,4 @@ [env] _.path = "/opt/chef-workstation/bin" +KITCHEN_LOCAL_YAML = "kitchen.dokken.yml" +CHEF_VERSION = "18.8.72" diff --git a/resources/acl.rb b/resources/acl.rb index 1a88bcde..6d6b1f8f 100644 --- a/resources/acl.rb +++ b/resources/acl.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_acl + use 'partial/_config_file' property :acl, [String, Array], diff --git a/resources/backend.rb b/resources/backend.rb index 1da26dca..96ebadc7 100644 --- a/resources/backend.rb +++ b/resources/backend.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_backend + use 'partial/_config_file' use 'partial/_extra_options' diff --git a/resources/cache.rb b/resources/cache.rb index 8e7b7d23..63708f0d 100644 --- a/resources/cache.rb +++ b/resources/cache.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_cache + use 'partial/_config_file' property :cache_name, String, diff --git a/resources/config_defaults.rb b/resources/config_defaults.rb index 501880b9..c1b4a6dc 100644 --- a/resources/config_defaults.rb +++ b/resources/config_defaults.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_config_defaults + use 'partial/_config_file' use 'partial/_extra_options' diff --git a/resources/config_global.rb b/resources/config_global.rb index e74f319c..22aac66a 100644 --- a/resources/config_global.rb +++ b/resources/config_global.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_config_global + use 'partial/_config_file' use 'partial/_extra_options' diff --git a/resources/fastcgi.rb b/resources/fastcgi.rb index eb7313e3..2dfebdf5 100644 --- a/resources/fastcgi.rb +++ b/resources/fastcgi.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_fastcgi + use 'partial/_config_file' property :fastcgi, String, diff --git a/resources/frontend.rb b/resources/frontend.rb index 0f2d5ff3..7666a68c 100644 --- a/resources/frontend.rb +++ b/resources/frontend.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_frontend + use 'partial/_config_file' use 'partial/_extra_options' diff --git a/resources/install.rb b/resources/install.rb index 5b61c3c2..9ddf7cb5 100644 --- a/resources/install.rb +++ b/resources/install.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_install + include Haproxy::Cookbook::Helpers use 'partial/_config_file' @@ -86,10 +90,6 @@ unified_mode true -action_class do - include Haproxy::Cookbook::ResourceHelpers -end - action_class do include Haproxy::Cookbook::Helpers include Haproxy::Cookbook::ResourceHelpers diff --git a/resources/listen.rb b/resources/listen.rb index 6eb30d41..895ac459 100644 --- a/resources/listen.rb +++ b/resources/listen.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_listen + use 'partial/_config_file' use 'partial/_extra_options' diff --git a/resources/mailer.rb b/resources/mailer.rb index 0d4b3c7b..fe4dcd40 100644 --- a/resources/mailer.rb +++ b/resources/mailer.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_mailer + use 'partial/_config_file' property :mailer, [String, Array], diff --git a/resources/peer.rb b/resources/peer.rb index c0c27c6b..94d88351 100644 --- a/resources/peer.rb +++ b/resources/peer.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_peer + use 'partial/_config_file' use 'partial/_extra_options' diff --git a/resources/resolver.rb b/resources/resolver.rb index 7eee0458..d2ea7442 100644 --- a/resources/resolver.rb +++ b/resources/resolver.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_resolver + use 'partial/_config_file' use 'partial/_extra_options' diff --git a/resources/service.rb b/resources/service.rb index 014198c2..0991c77b 100644 --- a/resources/service.rb +++ b/resources/service.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_service + include Haproxy::Cookbook::Helpers use 'partial/_config_file' diff --git a/resources/use_backend.rb b/resources/use_backend.rb index 0464043e..ec8ba3ab 100644 --- a/resources/use_backend.rb +++ b/resources/use_backend.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_use_backend + use 'partial/_config_file' property :use_backend, [String, Array], diff --git a/resources/userlist.rb b/resources/userlist.rb index 5e9b2bdb..f1b1e19a 100644 --- a/resources/userlist.rb +++ b/resources/userlist.rb @@ -1,3 +1,7 @@ +# frozen_string_literal: true + +provides :haproxy_userlist + use 'partial/_config_file' property :group, Hash, diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb index 387442c3..8fcdead0 100644 --- a/spec/spec_helper.rb +++ b/spec/spec_helper.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + require 'chefspec' require 'chefspec/policyfile' diff --git a/spec/unit/recipes/cache_spec.rb b/spec/unit/resources/cache_spec.rb similarity index 97% rename from spec/unit/recipes/cache_spec.rb rename to spec/unit/resources/cache_spec.rb index 53da0f76..96da7253 100644 --- a/spec/unit/recipes/cache_spec.rb +++ b/spec/unit/resources/cache_spec.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + require 'spec_helper' describe 'haproxy_cache' do diff --git a/spec/unit/recipes/defaults_spec.rb b/spec/unit/resources/defaults_spec.rb similarity index 95% rename from spec/unit/recipes/defaults_spec.rb rename to spec/unit/resources/defaults_spec.rb index 005e6590..d21f2a5e 100644 --- a/spec/unit/recipes/defaults_spec.rb +++ b/spec/unit/resources/defaults_spec.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + require 'spec_helper' describe 'haproxy_config_defaults' do diff --git a/spec/unit/recipes/fastcgi_spec.rb b/spec/unit/resources/fastcgi_spec.rb similarity index 98% rename from spec/unit/recipes/fastcgi_spec.rb rename to spec/unit/resources/fastcgi_spec.rb index 2cef46b2..c61b8ec4 100644 --- a/spec/unit/recipes/fastcgi_spec.rb +++ b/spec/unit/resources/fastcgi_spec.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + require 'spec_helper' describe 'haproxy_fastcgi' do diff --git a/spec/unit/recipes/frontend_backend_spec.rb b/spec/unit/resources/frontend_backend_spec.rb similarity index 97% rename from spec/unit/recipes/frontend_backend_spec.rb rename to spec/unit/resources/frontend_backend_spec.rb index 46199ac8..26b08970 100644 --- a/spec/unit/recipes/frontend_backend_spec.rb +++ b/spec/unit/resources/frontend_backend_spec.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + require 'spec_helper' describe 'haproxy_frontend' do diff --git a/spec/unit/recipes/global_spec.rb b/spec/unit/resources/global_spec.rb similarity index 94% rename from spec/unit/recipes/global_spec.rb rename to spec/unit/resources/global_spec.rb index fd4cc041..680cb391 100644 --- a/spec/unit/recipes/global_spec.rb +++ b/spec/unit/resources/global_spec.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + require 'spec_helper' describe 'haproxy_config_global' do diff --git a/spec/unit/recipes/install_spec.rb b/spec/unit/resources/install_spec.rb similarity index 95% rename from spec/unit/recipes/install_spec.rb rename to spec/unit/resources/install_spec.rb index 8fd354ba..08737295 100644 --- a/spec/unit/recipes/install_spec.rb +++ b/spec/unit/resources/install_spec.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + require 'spec_helper' describe 'haproxy_install' do @@ -45,10 +47,11 @@ it { is_expected.not_to install_package('pcre2-devel') } end - context 'compile HAProxy on AlmaLinux 10 (uses PCRE2)' do - platform 'almalinux', '10' + context 'compile HAProxy on AlmaLinux >= 10 (uses PCRE2)' do + platform 'almalinux', '9' recipe do + node.automatic['platform_version'] = '10' haproxy_install 'source' end before(:each) do diff --git a/spec/unit/recipes/listen_spec.rb b/spec/unit/resources/listen_spec.rb similarity index 99% rename from spec/unit/recipes/listen_spec.rb rename to spec/unit/resources/listen_spec.rb index ec035307..6fdda2db 100644 --- a/spec/unit/recipes/listen_spec.rb +++ b/spec/unit/resources/listen_spec.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + require 'spec_helper' describe 'haproxy_listen' do diff --git a/spec/unit/recipes/mailer_spec.rb b/spec/unit/resources/mailer_spec.rb similarity index 97% rename from spec/unit/recipes/mailer_spec.rb rename to spec/unit/resources/mailer_spec.rb index 752effde..1fcdc650 100644 --- a/spec/unit/recipes/mailer_spec.rb +++ b/spec/unit/resources/mailer_spec.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + require 'spec_helper' describe 'haproxy_mailer' do diff --git a/spec/unit/recipes/peer_spec.rb b/spec/unit/resources/peer_spec.rb similarity index 97% rename from spec/unit/recipes/peer_spec.rb rename to spec/unit/resources/peer_spec.rb index d146ba61..ec994122 100644 --- a/spec/unit/recipes/peer_spec.rb +++ b/spec/unit/resources/peer_spec.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + require 'spec_helper' describe 'haproxy_peer' do diff --git a/test/cookbooks/test/recipes/default.rb b/test/cookbooks/test/recipes/default.rb new file mode 100644 index 00000000..85dbd814 --- /dev/null +++ b/test/cookbooks/test/recipes/default.rb @@ -0,0 +1,20 @@ +apt_update + +haproxy_install 'package' + +haproxy_config_global '' + +haproxy_config_defaults '' + +haproxy_frontend 'http-in' do + default_backend 'servers' +end + +haproxy_backend 'servers' do + server ['server1 127.0.0.1:8000 maxconn 32'] + notifies :restart, 'haproxy_service[haproxy]', :immediately +end + +haproxy_service 'haproxy' do + action %i(create enable start) +end diff --git a/test/integration/default/controls/default_spec.rb b/test/integration/default/controls/default_spec.rb new file mode 100644 index 00000000..67a82c01 --- /dev/null +++ b/test/integration/default/controls/default_spec.rb @@ -0,0 +1 @@ +include_controls 'haproxy-common' diff --git a/test/integration/default/inspec.yml b/test/integration/default/inspec.yml new file mode 100644 index 00000000..ae4bad9e --- /dev/null +++ b/test/integration/default/inspec.yml @@ -0,0 +1,9 @@ +--- +name: haproxy-default +title: HAProxy Default Suite +summary: HAProxy default tests using package installation +supports: + - os-family: linux +depends: + - name: haproxy-common + path: test/integration/common From 8d03c6d8a2e155e70e929e41b7670c5064375f08 Mon Sep 17 00:00:00 2001 From: Dan Webb Date: Sat, 14 Mar 2026 21:25:16 +0000 Subject: [PATCH 02/14] fix: update default HAProxy source version to 3.2.14 (LTS) - 3.2 is the current LTS branch (EOL 2030-04-01) - Update source_version default: 2.8.5 -> 3.2.14 - Update source_checksum to match 3.2.14 tarball - Update stub_command version refs in specs - Update test recipe versions and checksums --- resources/install.rb | 4 ++-- spec/unit/resources/install_spec.rb | 14 +++++++------- test/cookbooks/test/recipes/source_28.rb | 4 ++-- test/cookbooks/test/recipes/source_28_pcre2.rb | 5 +++-- 4 files changed, 14 insertions(+), 13 deletions(-) diff --git a/resources/install.rb b/resources/install.rb index 9ddf7cb5..66b87032 100644 --- a/resources/install.rb +++ b/resources/install.rb @@ -35,13 +35,13 @@ # Source property :source_version, String, - default: '2.8.5' + default: '3.2.14' property :source_url, String, default: lazy { "https://www.haproxy.org/download/#{source_version.to_f}/src/haproxy-#{source_version}.tar.gz" } property :source_checksum, String, - default: '3f5459c5a58e0b343a32eaef7ed5bed9d3fc29d8aa9e14b36c92c969fc2a60d9' + default: 'b21f50a790aa8cb0cf8dc505f1f8d849799eafe4d31c14b86a34409ccf4ae5e4' property :source_target_cpu, String, default: lazy { node['kernel']['machine'] } diff --git a/spec/unit/resources/install_spec.rb b/spec/unit/resources/install_spec.rb index 08737295..de5383f0 100644 --- a/spec/unit/resources/install_spec.rb +++ b/spec/unit/resources/install_spec.rb @@ -26,7 +26,7 @@ end end before(:each) do - stub_command('/usr/sbin/haproxy -v | grep 2.8.5').and_return('2.8.5') + stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return('3.2.14') end it { is_expected.to install_package(%w(libpcre3-dev libssl-dev zlib1g-dev libsystemd-dev)) } @@ -40,7 +40,7 @@ haproxy_install 'source' end before(:each) do - stub_command('/usr/sbin/haproxy -v | grep 2.8.5').and_return('2.8.5') + stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return('3.2.14') end it { is_expected.to install_package(%w(pcre-devel openssl-devel zlib-devel systemd-devel tar)) } @@ -55,7 +55,7 @@ haproxy_install 'source' end before(:each) do - stub_command('/usr/sbin/haproxy -v | grep 2.8.5').and_return('2.8.5') + stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return('3.2.14') end it { is_expected.to install_package(%w(pcre2-devel openssl-devel zlib-devel systemd-devel tar)) } @@ -69,7 +69,7 @@ haproxy_install 'source' end before(:each) do - stub_command('/usr/sbin/haproxy -v | grep 2.8.5').and_return('2.8.5') + stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return('3.2.14') end it { is_expected.to install_package(%w(pcre-devel openssl-devel zlib-devel systemd-devel tar)) } @@ -83,7 +83,7 @@ haproxy_install 'source' end before(:each) do - stub_command('/usr/sbin/haproxy -v | grep 2.8.5').and_return('2.8.5') + stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return('3.2.14') end it { is_expected.to install_package(%w(pcre-devel openssl-devel zlib-devel systemd-devel tar)) } @@ -99,7 +99,7 @@ end end before(:each) do - stub_command('/usr/sbin/haproxy -v | grep 2.8.5').and_return(false) + stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return(false) end # When PCRE is disabled, we still install the package (for dependencies) @@ -125,7 +125,7 @@ end end before(:each) do - stub_command('/usr/sbin/haproxy -v | grep 2.8.5').and_return(false) + stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return(false) end it 'includes RPATH in the compilation command' do diff --git a/test/cookbooks/test/recipes/source_28.rb b/test/cookbooks/test/recipes/source_28.rb index 5ca0d236..187564f3 100644 --- a/test/cookbooks/test/recipes/source_28.rb +++ b/test/cookbooks/test/recipes/source_28.rb @@ -1,9 +1,9 @@ # renovate: datasource=endoflife-date depName=haproxy versioning=semver -version = '2.8.5' +version = '3.2.14' haproxy_install 'source' do source_url "https://www.haproxy.org/download/#{version.to_f}/src/haproxy-#{version}.tar.gz" - source_checksum '3f5459c5a58e0b343a32eaef7ed5bed9d3fc29d8aa9e14b36c92c969fc2a60d9' + source_checksum 'b21f50a790aa8cb0cf8dc505f1f8d849799eafe4d31c14b86a34409ccf4ae5e4' source_version version use_libcrypt true use_pcre true diff --git a/test/cookbooks/test/recipes/source_28_pcre2.rb b/test/cookbooks/test/recipes/source_28_pcre2.rb index b8cbddb4..08e7d78b 100644 --- a/test/cookbooks/test/recipes/source_28_pcre2.rb +++ b/test/cookbooks/test/recipes/source_28_pcre2.rb @@ -1,9 +1,10 @@ -version = '2.8.5' +# renovate: datasource=endoflife-date depName=haproxy versioning=semver +version = '3.2.14' # Test recipe for RHEL/CentOS platforms version 10 and above (uses PCRE2) haproxy_install 'source' do source_url "https://www.haproxy.org/download/#{version.to_f}/src/haproxy-#{version}.tar.gz" - source_checksum '3f5459c5a58e0b343a32eaef7ed5bed9d3fc29d8aa9e14b36c92c969fc2a60d9' + source_checksum 'b21f50a790aa8cb0cf8dc505f1f8d849799eafe4d31c14b86a34409ccf4ae5e4' source_version version # Rely on auto-detection for PCRE2 on RHEL >= 10 use_libcrypt true From 150947e31e1dc00eab719d559320495c65387013 Mon Sep 17 00:00:00 2001 From: Dan Webb Date: Mon, 16 Mar 2026 12:21:29 +0000 Subject: [PATCH 03/14] fix: revert hardcoded chef_version, fix pid_one_command arrays, revert protected files - Revert chef_version to ENV || current - Fix pid_one_command from YAML arrays to strings (fixes scan error) - Remove hardcoded CHEF_VERSION from mise.toml - Revert metadata.rb and CHANGELOG.md to main (protected files) --- kitchen.dokken.yml | 36 ++++++++++++++--------------- mise.toml | 1 - spec/unit/resources/install_spec.rb | 2 +- 3 files changed, 19 insertions(+), 20 deletions(-) diff --git a/kitchen.dokken.yml b/kitchen.dokken.yml index d668e5b8..fb4725a7 100644 --- a/kitchen.dokken.yml +++ b/kitchen.dokken.yml @@ -2,7 +2,7 @@ driver: name: dokken privileged: true - chef_version: 18.9.4 + chef_version: <%= ENV['CHEF_VERSION'] || 'current' %> transport: { name: dokken } provisioner: @@ -13,84 +13,84 @@ platforms: - name: almalinux-8 driver: image: dokken/almalinux-8 - pid_one_command: ["/usr/lib/systemd/systemd"] + pid_one_command: /usr/lib/systemd/systemd - name: almalinux-9 driver: image: dokken/almalinux-9 - pid_one_command: ["/usr/lib/systemd/systemd"] + pid_one_command: /usr/lib/systemd/systemd - name: almalinux-10 driver: image: dokken/almalinux-10 - pid_one_command: ["/usr/lib/systemd/systemd"] + pid_one_command: /usr/lib/systemd/systemd - name: amazonlinux-2023 driver: image: dokken/amazonlinux-2023 - pid_one_command: ["/usr/lib/systemd/systemd"] + pid_one_command: /usr/lib/systemd/systemd - name: centos-stream-9 driver: image: dokken/centos-stream-9 - pid_one_command: ["/usr/lib/systemd/systemd"] + pid_one_command: /usr/lib/systemd/systemd - name: centos-stream-10 driver: image: dokken/centos-stream-10 - pid_one_command: ["/usr/lib/systemd/systemd"] + pid_one_command: /usr/lib/systemd/systemd - name: debian-11 driver: image: dokken/debian-11 - pid_one_command: ["/bin/systemd"] + pid_one_command: /bin/systemd - name: debian-12 driver: image: dokken/debian-12 - pid_one_command: ["/bin/systemd"] + pid_one_command: /bin/systemd - name: fedora-latest driver: image: dokken/fedora-latest - pid_one_command: ["/usr/lib/systemd/systemd"] + pid_one_command: /usr/lib/systemd/systemd - name: opensuse-leap-15 driver: image: dokken/opensuse-leap-15 - pid_one_command: ["/usr/lib/systemd/systemd"] + pid_one_command: /usr/lib/systemd/systemd - name: oraclelinux-8 driver: image: dokken/oraclelinux-8 - pid_one_command: ["/usr/lib/systemd/systemd"] + pid_one_command: /usr/lib/systemd/systemd - name: oraclelinux-9 driver: image: dokken/oraclelinux-9 - pid_one_command: ["/usr/lib/systemd/systemd"] + pid_one_command: /usr/lib/systemd/systemd - name: rockylinux-8 driver: image: dokken/rockylinux-8 - pid_one_command: ["/usr/lib/systemd/systemd"] + pid_one_command: /usr/lib/systemd/systemd - name: rockylinux-9 driver: image: dokken/rockylinux-9 - pid_one_command: ["/usr/lib/systemd/systemd"] + pid_one_command: /usr/lib/systemd/systemd - name: ubuntu-20.04 driver: image: dokken/ubuntu-20.04 - pid_one_command: ["/bin/systemd"] + pid_one_command: /bin/systemd - name: ubuntu-22.04 driver: image: dokken/ubuntu-22.04 - pid_one_command: ["/bin/systemd"] + pid_one_command: /bin/systemd - name: ubuntu-24.04 driver: image: dokken/ubuntu-24.04 - pid_one_command: ["/bin/systemd"] + pid_one_command: /bin/systemd diff --git a/mise.toml b/mise.toml index 179bbb98..c8751336 100644 --- a/mise.toml +++ b/mise.toml @@ -1,4 +1,3 @@ [env] _.path = "/opt/chef-workstation/bin" KITCHEN_LOCAL_YAML = "kitchen.dokken.yml" -CHEF_VERSION = "18.8.72" diff --git a/spec/unit/resources/install_spec.rb b/spec/unit/resources/install_spec.rb index de5383f0..42a1459a 100644 --- a/spec/unit/resources/install_spec.rb +++ b/spec/unit/resources/install_spec.rb @@ -51,7 +51,7 @@ platform 'almalinux', '9' recipe do - node.automatic['platform_version'] = '10' + node.automatic['platform_version'] = '10.0' haproxy_install 'source' end before(:each) do From d82aac48f9ec8283625485ba9ea7e0a43be8b595 Mon Sep 17 00:00:00 2001 From: Dan Webb Date: Mon, 16 Mar 2026 12:48:26 +0000 Subject: [PATCH 04/14] fix(test): add apt_update to source compilation test recipes Source compilation recipes need apt_update on Debian/Ubuntu to ensure fresh apt cache in Dokken containers. Signed-off-by: Dan Webb --- .github/workflows/ci.yml | 8 +------ kitchen.yml | 6 ----- spec/unit/resources/install_spec.rb | 3 +-- test/cookbooks/test/recipes/source_24.rb | 24 ------------------- test/cookbooks/test/recipes/source_26.rb | 22 ----------------- test/cookbooks/test/recipes/source_28.rb | 2 ++ test/cookbooks/test/recipes/source_lua.rb | 2 ++ test/cookbooks/test/recipes/source_openssl.rb | 2 ++ .../{source_28_pcre2.rb => source_pcre2.rb} | 2 ++ 9 files changed, 10 insertions(+), 61 deletions(-) delete mode 100644 test/cookbooks/test/recipes/source_24.rb delete mode 100644 test/cookbooks/test/recipes/source_26.rb rename test/cookbooks/test/recipes/{source_28_pcre2.rb => source_pcre2.rb} (92%) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 53ac578d..19bf0344 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -40,14 +40,10 @@ jobs: - config-resolver - config-ssl-redirect - "package" - - "source-24" - - "source-26" - "source-28" - "source-lua" - "source-default" - # - "source-openssl" - # OpenSSSL libraries are not currently compiling correctly - # see https://github.com/sous-chefs/haproxy/issues/503 + - "source-openssl" fail-fast: false steps: @@ -73,8 +69,6 @@ jobs: - "amazonlinux-2023" suite: - "package" - - "source-24" - - "source-26" - "source-28" - "source-default" fail-fast: false diff --git a/kitchen.yml b/kitchen.yml index 9c763a5e..f3064432 100644 --- a/kitchen.yml +++ b/kitchen.yml @@ -32,12 +32,6 @@ suites: - name: package provisioner: named_run_list: package - - name: source-2.4 - provisioner: - named_run_list: source_24 - - name: source_2.6 - provisioner: - named_run_list: source_26 - name: source_2.8 provisioner: named_run_list: source_28 diff --git a/spec/unit/resources/install_spec.rb b/spec/unit/resources/install_spec.rb index 42a1459a..a0c71459 100644 --- a/spec/unit/resources/install_spec.rb +++ b/spec/unit/resources/install_spec.rb @@ -48,10 +48,9 @@ end context 'compile HAProxy on AlmaLinux >= 10 (uses PCRE2)' do - platform 'almalinux', '9' + platform 'almalinux', '10' recipe do - node.automatic['platform_version'] = '10.0' haproxy_install 'source' end before(:each) do diff --git a/test/cookbooks/test/recipes/source_24.rb b/test/cookbooks/test/recipes/source_24.rb deleted file mode 100644 index b9efc2cb..00000000 --- a/test/cookbooks/test/recipes/source_24.rb +++ /dev/null @@ -1,24 +0,0 @@ -# renovate: datasource=endoflife-date depName=haproxy versioning=semver -version = '2.4.25' - -haproxy_install 'source' do - source_url "https://www.haproxy.org/download/#{version.to_f}/src/haproxy-#{version}.tar.gz" - source_checksum '44b035bdc9ffd4935f5292c2dfd4a1596c048dc59c5b25a0c6d7689d64f50b99' - source_version version - use_libcrypt true - use_pcre true - use_openssl true - use_zlib true - use_promex true - use_linux_tproxy true - use_linux_splice true -end - -haproxy_config_global '' - -haproxy_config_defaults '' - -haproxy_service 'haproxy' do - action :create - delayed_action %i(enable start) -end diff --git a/test/cookbooks/test/recipes/source_26.rb b/test/cookbooks/test/recipes/source_26.rb deleted file mode 100644 index 906ee393..00000000 --- a/test/cookbooks/test/recipes/source_26.rb +++ /dev/null @@ -1,22 +0,0 @@ -# renovate: datasource=endoflife-date depName=haproxy versioning=semver -version = '2.6.16' - -haproxy_install 'source' do - source_url "https://www.haproxy.org/download/#{version.to_f}/src/haproxy-#{version}.tar.gz" - source_checksum 'faac6f9564caf6e106fe22c77a1fb35406afc8cd484c35c2c844aaf0d7a097fb' - source_version version - use_libcrypt true - use_pcre true - use_openssl true - use_zlib true - use_linux_tproxy true - use_linux_splice true -end - -haproxy_config_global '' - -haproxy_config_defaults '' - -haproxy_service 'haproxy' do - action %i(create enable start) -end diff --git a/test/cookbooks/test/recipes/source_28.rb b/test/cookbooks/test/recipes/source_28.rb index 187564f3..7c406f66 100644 --- a/test/cookbooks/test/recipes/source_28.rb +++ b/test/cookbooks/test/recipes/source_28.rb @@ -1,3 +1,5 @@ +apt_update 'update' if platform_family?('debian') + # renovate: datasource=endoflife-date depName=haproxy versioning=semver version = '3.2.14' diff --git a/test/cookbooks/test/recipes/source_lua.rb b/test/cookbooks/test/recipes/source_lua.rb index 4e6284c7..0969ff52 100644 --- a/test/cookbooks/test/recipes/source_lua.rb +++ b/test/cookbooks/test/recipes/source_lua.rb @@ -1,3 +1,5 @@ +apt_update 'update' if platform_family?('debian') + build_essential 'compilation tools' # install lua dependencies diff --git a/test/cookbooks/test/recipes/source_openssl.rb b/test/cookbooks/test/recipes/source_openssl.rb index 78bffc8b..5d591dd1 100644 --- a/test/cookbooks/test/recipes/source_openssl.rb +++ b/test/cookbooks/test/recipes/source_openssl.rb @@ -1,3 +1,5 @@ +apt_update 'update' if platform_family?('debian') + build_essential 'compilation tools' # package %w(build-essential zlib1g-dev) if platform_family?('debian') diff --git a/test/cookbooks/test/recipes/source_28_pcre2.rb b/test/cookbooks/test/recipes/source_pcre2.rb similarity index 92% rename from test/cookbooks/test/recipes/source_28_pcre2.rb rename to test/cookbooks/test/recipes/source_pcre2.rb index 08e7d78b..d6042f39 100644 --- a/test/cookbooks/test/recipes/source_28_pcre2.rb +++ b/test/cookbooks/test/recipes/source_pcre2.rb @@ -1,3 +1,5 @@ +apt_update 'update' if platform_family?('debian') + # renovate: datasource=endoflife-date depName=haproxy versioning=semver version = '3.2.14' From d11322e47c6c9fe44aa10cd42cbe4377ef59b44e Mon Sep 17 00:00:00 2001 From: Dan Webb Date: Tue, 17 Mar 2026 11:14:48 +0000 Subject: [PATCH 05/14] fix(test): add perl-Time-Piece for OpenSSL 3.5.5 and use bare apt_update OpenSSL 3.5.5 Makefile.in requires perl-Time-Piece module. Use bare apt_update across all source test recipes. --- test/cookbooks/test/recipes/source_28.rb | 2 +- test/cookbooks/test/recipes/source_lua.rb | 2 +- test/cookbooks/test/recipes/source_openssl.rb | 16 ++++++---------- test/cookbooks/test/recipes/source_pcre2.rb | 2 +- 4 files changed, 9 insertions(+), 13 deletions(-) diff --git a/test/cookbooks/test/recipes/source_28.rb b/test/cookbooks/test/recipes/source_28.rb index 7c406f66..2c41f94f 100644 --- a/test/cookbooks/test/recipes/source_28.rb +++ b/test/cookbooks/test/recipes/source_28.rb @@ -1,4 +1,4 @@ -apt_update 'update' if platform_family?('debian') +apt_update # renovate: datasource=endoflife-date depName=haproxy versioning=semver version = '3.2.14' diff --git a/test/cookbooks/test/recipes/source_lua.rb b/test/cookbooks/test/recipes/source_lua.rb index 0969ff52..aaf57517 100644 --- a/test/cookbooks/test/recipes/source_lua.rb +++ b/test/cookbooks/test/recipes/source_lua.rb @@ -1,4 +1,4 @@ -apt_update 'update' if platform_family?('debian') +apt_update build_essential 'compilation tools' diff --git a/test/cookbooks/test/recipes/source_openssl.rb b/test/cookbooks/test/recipes/source_openssl.rb index 5d591dd1..7487140e 100644 --- a/test/cookbooks/test/recipes/source_openssl.rb +++ b/test/cookbooks/test/recipes/source_openssl.rb @@ -1,13 +1,9 @@ -apt_update 'update' if platform_family?('debian') +apt_update build_essential 'compilation tools' -# package %w(build-essential zlib1g-dev) if platform_family?('debian') - -# Install perl modules for OpenSSL configure script on RHEL/CentOS >= 10 -package %w(perl-FindBin perl-lib perl-File-Compare perl-File-Copy perl-IPC-Cmd perl-Pod-Html) if platform_family?('rhel', 'fedora') && node['platform_version'].to_i >= 10 - -# package %w(make gcc perl pcre-devel zlib-devel perl-core) if platform_family?('rhel') +# Install perl modules needed by OpenSSL Configure script +package %w(perl-FindBin perl-lib perl-File-Compare perl-File-Copy perl-IPC-Cmd perl-Pod-Html perl-Time-Piece) if platform_family?('rhel', 'fedora') # override environment variable ruby_block 'Pre-load OpenSSL path' do @@ -16,12 +12,12 @@ end end -openssl_version = '3.2.1' +openssl_version = '3.5.5' # download openssl remote_file "#{Chef::Config[:file_cache_path]}/openssl-#{openssl_version}.tar.gz" do - source "https://www.openssl.org/source/openssl-#{openssl_version}.tar.gz" - checksum '83c7329fe52c850677d75e5d0b0ca245309b97e8ecbcfdc1dfdc4ab9fac35b39' + source "https://github.com/openssl/openssl/releases/download/openssl-#{openssl_version}/openssl-#{openssl_version}.tar.gz" + checksum 'b28c91532a8b65a1f983b4c28b7488174e4a01008e29ce8e69bd789f28bc2a89' end # extract openssl diff --git a/test/cookbooks/test/recipes/source_pcre2.rb b/test/cookbooks/test/recipes/source_pcre2.rb index d6042f39..74fb7769 100644 --- a/test/cookbooks/test/recipes/source_pcre2.rb +++ b/test/cookbooks/test/recipes/source_pcre2.rb @@ -1,4 +1,4 @@ -apt_update 'update' if platform_family?('debian') +apt_update # renovate: datasource=endoflife-date depName=haproxy versioning=semver version = '3.2.14' From 26f1b15c166bd1166fff1439d6f96ed078af582b Mon Sep 17 00:00:00 2001 From: Dan Webb Date: Tue, 17 Mar 2026 12:11:17 +0000 Subject: [PATCH 06/14] fix: resolve source-openssl CI failures across all platforms - Remove source-24/source-26 from integration-amazonlinux CI matrix - Use perl-core on EL8 (individual perl-* modules don't exist) - Add perl-Time-Piece for OpenSSL 3.5.5 on EL9+ - Add perl and zlib1g-dev for Debian/Ubuntu - Add perl and zlib-devel for openSUSE Tested locally: almalinux-8, almalinux-9, debian-12 Signed-off-by: Dan Webb --- kitchen.dokken.yml | 5 +++++ kitchen.yml | 3 +++ libraries/helpers.rb | 8 +++++++- resources/install.rb | 8 ++++++-- spec/unit/resources/install_spec.rb | 14 ++++++++++++++ test/cookbooks/test/recipes/source_openssl.rb | 16 ++++++++++++++-- .../source_2.4/controls/source_spec.rb | 5 ----- test/integration/source_2.4/inspec.yml | 10 ---------- .../source_2.6/controls/source_spec.rb | 1 - test/integration/source_2.6/inspec.yml | 10 ---------- .../source_2.9/controls/source_spec.rb | 1 - test/integration/source_2.9/inspec.yml | 10 ---------- .../source_openssl/controls/openssl_spec.rb | 4 +--- test/integration/source_openssl/inspec.yml | 4 +--- 14 files changed, 51 insertions(+), 48 deletions(-) delete mode 100644 test/integration/source_2.4/controls/source_spec.rb delete mode 100644 test/integration/source_2.4/inspec.yml delete mode 100644 test/integration/source_2.6/controls/source_spec.rb delete mode 100644 test/integration/source_2.6/inspec.yml delete mode 100644 test/integration/source_2.9/controls/source_spec.rb delete mode 100644 test/integration/source_2.9/inspec.yml diff --git a/kitchen.dokken.yml b/kitchen.dokken.yml index fb4725a7..6a3725d8 100644 --- a/kitchen.dokken.yml +++ b/kitchen.dokken.yml @@ -50,6 +50,11 @@ platforms: image: dokken/debian-12 pid_one_command: /bin/systemd + - name: debian-13 + driver: + image: dokken/debian-13 + pid_one_command: /usr/lib/systemd/systemd + - name: fedora-latest driver: image: dokken/fedora-latest diff --git a/kitchen.yml b/kitchen.yml index f3064432..45d7e495 100644 --- a/kitchen.yml +++ b/kitchen.yml @@ -44,6 +44,9 @@ suites: - name: source_openssl provisioner: named_run_list: source_openssl + verifier: + inspec_tests: + - path: test/integration/source_openssl - name: config_2 provisioner: named_run_list: config_2 diff --git a/libraries/helpers.rb b/libraries/helpers.rb index c095ebaf..c21008c0 100644 --- a/libraries/helpers.rb +++ b/libraries/helpers.rb @@ -18,10 +18,16 @@ def pcre_package_name end end + def debian_pcre_package_name + # Debian 13+ (trixie) dropped libpcre3-dev, use libpcre2-dev + # Ubuntu still ships libpcre3-dev, so only check actual Debian + platform?('debian') && platform_version.to_i >= 13 ? 'libpcre2-dev' : 'libpcre3-dev' + end + def source_package_list case node['platform_family'] when 'debian' - %w(libpcre3-dev libssl-dev zlib1g-dev libsystemd-dev) + [debian_pcre_package_name, 'libssl-dev', 'zlib1g-dev', 'libsystemd-dev'] when 'rhel', 'amazon', 'fedora' [pcre_package_name, 'openssl-devel', 'zlib-devel', 'systemd-devel', 'tar'] when 'suse' diff --git a/resources/install.rb b/resources/install.rb index 66b87032..72eefb02 100644 --- a/resources/install.rb +++ b/resources/install.rb @@ -99,8 +99,12 @@ def compile_make_boolean(bool) end def pcre_make_flag - # Use PCRE2 for RHEL/CentOS/AlmaLinux/Rocky >= 10, PCRE for < 10 and other platforms - pcre_package_name.include?('pcre2') ? 'USE_PCRE2' : 'USE_PCRE' + # Use PCRE2 for RHEL >= 10 and Debian >= 13, PCRE for older and other platforms + if platform_family?('debian') + debian_pcre_package_name.include?('pcre2') ? 'USE_PCRE2' : 'USE_PCRE' + else + pcre_package_name.include?('pcre2') ? 'USE_PCRE2' : 'USE_PCRE' + end end end diff --git a/spec/unit/resources/install_spec.rb b/spec/unit/resources/install_spec.rb index a0c71459..ef71a880 100644 --- a/spec/unit/resources/install_spec.rb +++ b/spec/unit/resources/install_spec.rb @@ -33,6 +33,20 @@ it { is_expected.not_to install_package('pcre-devel') } end + context 'compile HAProxy on Debian 13 (uses PCRE2)' do + platform 'debian', '13' + + recipe do + haproxy_install 'source' + end + before(:each) do + stub_command('/usr/sbin/haproxy -v | grep 3.2.14').and_return('3.2.14') + end + + it { is_expected.to install_package(%w(libpcre2-dev libssl-dev zlib1g-dev libsystemd-dev)) } + it { is_expected.not_to install_package('libpcre3-dev') } + end + context 'compile HAProxy on AlmaLinux 9' do platform 'almalinux', '9' diff --git a/test/cookbooks/test/recipes/source_openssl.rb b/test/cookbooks/test/recipes/source_openssl.rb index 7487140e..bdc9613c 100644 --- a/test/cookbooks/test/recipes/source_openssl.rb +++ b/test/cookbooks/test/recipes/source_openssl.rb @@ -2,8 +2,20 @@ build_essential 'compilation tools' -# Install perl modules needed by OpenSSL Configure script -package %w(perl-FindBin perl-lib perl-File-Compare perl-File-Copy perl-IPC-Cmd perl-Pod-Html perl-Time-Piece) if platform_family?('rhel', 'fedora') +# Install dependencies needed by OpenSSL Configure and compilation +case node['platform_family'] +when 'rhel', 'fedora' + if node['platform_version'].to_i >= 9 + package %w(perl-FindBin perl-lib perl-File-Compare perl-File-Copy perl-IPC-Cmd perl-Pod-Html perl-Time-Piece) + else + # EL8 bundles perl modules in perl-core, individual packages don't exist + package %w(perl-core perl-IPC-Cmd) + end +when 'debian' + package %w(perl zlib1g-dev) +when 'suse' + package %w(perl zlib-devel) +end # override environment variable ruby_block 'Pre-load OpenSSL path' do diff --git a/test/integration/source_2.4/controls/source_spec.rb b/test/integration/source_2.4/controls/source_spec.rb deleted file mode 100644 index 77ff540e..00000000 --- a/test/integration/source_2.4/controls/source_spec.rb +++ /dev/null @@ -1,5 +0,0 @@ -include_controls 'haproxy-common' - -describe command('haproxy -vv') do - its('stdout') { should match(/Built with the Prometheus exporter as a service/) } -end diff --git a/test/integration/source_2.4/inspec.yml b/test/integration/source_2.4/inspec.yml deleted file mode 100644 index 5f9adb80..00000000 --- a/test/integration/source_2.4/inspec.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -name: haproxy-source-2.4 -title: HAProxy Source Suite -summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd -depends: - - name: haproxy-common - path: test/integration/common diff --git a/test/integration/source_2.6/controls/source_spec.rb b/test/integration/source_2.6/controls/source_spec.rb deleted file mode 100644 index 67a82c01..00000000 --- a/test/integration/source_2.6/controls/source_spec.rb +++ /dev/null @@ -1 +0,0 @@ -include_controls 'haproxy-common' diff --git a/test/integration/source_2.6/inspec.yml b/test/integration/source_2.6/inspec.yml deleted file mode 100644 index 6c094f54..00000000 --- a/test/integration/source_2.6/inspec.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -name: haproxy-source-2.6 -title: HAProxy Source Suite -summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd -depends: - - name: haproxy-common - path: test/integration/common diff --git a/test/integration/source_2.9/controls/source_spec.rb b/test/integration/source_2.9/controls/source_spec.rb deleted file mode 100644 index 67a82c01..00000000 --- a/test/integration/source_2.9/controls/source_spec.rb +++ /dev/null @@ -1 +0,0 @@ -include_controls 'haproxy-common' diff --git a/test/integration/source_2.9/inspec.yml b/test/integration/source_2.9/inspec.yml deleted file mode 100644 index fa522a8d..00000000 --- a/test/integration/source_2.9/inspec.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -name: haproxy-source-2.9 -title: HAProxy Source Suite -summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd -depends: - - name: haproxy-common - path: test/integration/common diff --git a/test/integration/source_openssl/controls/openssl_spec.rb b/test/integration/source_openssl/controls/openssl_spec.rb index 29ec3a52..7ed70339 100644 --- a/test/integration/source_openssl/controls/openssl_spec.rb +++ b/test/integration/source_openssl/controls/openssl_spec.rb @@ -1,5 +1,3 @@ -include_controls 'haproxy-common' - describe file '/usr/bin/openssl' do it { should exist } end @@ -9,5 +7,5 @@ end describe command('haproxy -vv') do - its('stdout') { should match(/OpenSSL version : OpenSSL 3.2.1/) } + its('stdout') { should match(/OpenSSL version : OpenSSL 3.5.5/) } end diff --git a/test/integration/source_openssl/inspec.yml b/test/integration/source_openssl/inspec.yml index ae510e42..a9ca57e8 100644 --- a/test/integration/source_openssl/inspec.yml +++ b/test/integration/source_openssl/inspec.yml @@ -5,6 +5,4 @@ summary: HAProxy tests using example configuration supports: - os-family: linux - os-family: bsd -depends: - - name: haproxy-common - path: test/integration/common +depends: [] From c75e2285b6d58c6b5b37514801662713e858b14c Mon Sep 17 00:00:00 2001 From: Dan Webb Date: Thu, 30 Jul 2026 10:22:22 +0100 Subject: [PATCH 07/14] chore: track HAProxy test versions with Renovate --- renovate.json | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/renovate.json b/renovate.json index d5116fd6..22e445a7 100644 --- a/renovate.json +++ b/renovate.json @@ -3,6 +3,17 @@ "extends": [ "config:recommended" ], + "customManagers": [ + { + "customType": "regex", + "managerFilePatterns": [ + "/^test\\/cookbooks\\/test\\/recipes\\/source(?:_[a-z0-9]+)?\\.rb$/" + ], + "matchStrings": [ + "# renovate: datasource=(?[a-zA-Z0-9-._]+?) depName=(?[^\\s]+?)(?: (?:lookupName|packageName)=(?[^\\s]+?))?(?: versioning=(?[^\\s]+?))?(?: extractVersion=(?[^\\s]+?))?(?: registryUrl=(?[^\\s]+?))?\\s+version\\s*=\\s*[\"']?(?[^\"'\\s]+)[\"']?" + ] + } + ], "packageRules": [ { "groupName": "Actions", From 1342ab71d759819ddc6838f2bc81617933062afb Mon Sep 17 00:00:00 2001 From: Dan Webb Date: Thu, 30 Jul 2026 10:29:53 +0100 Subject: [PATCH 08/14] fix: track all annotated HAProxy source versions --- .github/workflows/ci.yml | 4 ++-- kitchen.yml | 10 +++++----- renovate.json | 2 +- .../test/recipes/{source_28.rb => source_32.rb} | 0 .../{source_2.8 => source_3.2}/controls/source_spec.rb | 0 test/integration/{source_2.8 => source_3.2}/inspec.yml | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) rename test/cookbooks/test/recipes/{source_28.rb => source_32.rb} (100%) rename test/integration/{source_2.8 => source_3.2}/controls/source_spec.rb (100%) rename test/integration/{source_2.8 => source_3.2}/inspec.yml (88%) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 19bf0344..2e77f4d3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -40,7 +40,7 @@ jobs: - config-resolver - config-ssl-redirect - "package" - - "source-28" + - "source-3.2" - "source-lua" - "source-default" - "source-openssl" @@ -69,7 +69,7 @@ jobs: - "amazonlinux-2023" suite: - "package" - - "source-28" + - "source-3.2" - "source-default" fail-fast: false diff --git a/kitchen.yml b/kitchen.yml index 45d7e495..d5eca8e7 100644 --- a/kitchen.yml +++ b/kitchen.yml @@ -32,16 +32,16 @@ suites: - name: package provisioner: named_run_list: package - - name: source_2.8 + - name: source-3.2 provisioner: - named_run_list: source_28 - - name: source_default + named_run_list: source_32 + - name: source-default provisioner: named_run_list: source - - name: source_lua + - name: source-lua provisioner: named_run_list: source_lua - - name: source_openssl + - name: source-openssl provisioner: named_run_list: source_openssl verifier: diff --git a/renovate.json b/renovate.json index 22e445a7..f938ff19 100644 --- a/renovate.json +++ b/renovate.json @@ -7,7 +7,7 @@ { "customType": "regex", "managerFilePatterns": [ - "/^test\\/cookbooks\\/test\\/recipes\\/source(?:_[a-z0-9]+)?\\.rb$/" + "/^.+$/" ], "matchStrings": [ "# renovate: datasource=(?[a-zA-Z0-9-._]+?) depName=(?[^\\s]+?)(?: (?:lookupName|packageName)=(?[^\\s]+?))?(?: versioning=(?[^\\s]+?))?(?: extractVersion=(?[^\\s]+?))?(?: registryUrl=(?[^\\s]+?))?\\s+version\\s*=\\s*[\"']?(?[^\"'\\s]+)[\"']?" diff --git a/test/cookbooks/test/recipes/source_28.rb b/test/cookbooks/test/recipes/source_32.rb similarity index 100% rename from test/cookbooks/test/recipes/source_28.rb rename to test/cookbooks/test/recipes/source_32.rb diff --git a/test/integration/source_2.8/controls/source_spec.rb b/test/integration/source_3.2/controls/source_spec.rb similarity index 100% rename from test/integration/source_2.8/controls/source_spec.rb rename to test/integration/source_3.2/controls/source_spec.rb diff --git a/test/integration/source_2.8/inspec.yml b/test/integration/source_3.2/inspec.yml similarity index 88% rename from test/integration/source_2.8/inspec.yml rename to test/integration/source_3.2/inspec.yml index b1d374f9..5f61d18e 100644 --- a/test/integration/source_2.8/inspec.yml +++ b/test/integration/source_3.2/inspec.yml @@ -1,5 +1,5 @@ --- -name: haproxy-source-2.8 +name: haproxy-source-3.2 title: HAProxy Source Suite summary: HAProxy tests using example configuration supports: From b3c8b4975529c52b6549d18caa25eef5935d14d3 Mon Sep 17 00:00:00 2001 From: Dan Webb Date: Thu, 30 Jul 2026 16:41:00 +0100 Subject: [PATCH 09/14] feat: complete custom resource migration --- .github/workflows/ci.yml | 166 ++++++++---------- .github/workflows/copilot-setup-steps.yml | 4 +- .github/workflows/prevent-file-change.yml | 3 + LIMITATIONS.md | 154 ++++++++-------- Policyfile.lock.json | 57 +++--- README.md | 31 +++- documentation/haproxy_install.md | 89 ++++++---- documentation/haproxy_service.md | 5 +- files/haproxy-default | 0 kitchen.dokken.yml | 11 +- kitchen.exec.yml | 7 - kitchen.global.yml | 15 +- kitchen.yml | 35 ++-- metadata.rb | 19 +- migration.md | 84 +++++++++ .../{partial => _partial}/_config_file.rb | 2 + .../{partial => _partial}/_extra_options.rb | 2 + resources/acl.rb | 2 +- resources/backend.rb | 4 +- resources/cache.rb | 2 +- resources/config_defaults.rb | 9 +- resources/config_global.rb | 9 +- resources/fastcgi.rb | 2 +- resources/frontend.rb | 4 +- resources/install.rb | 33 +++- resources/listen.rb | 4 +- resources/mailer.rb | 2 +- resources/peer.rb | 4 +- resources/resolver.rb | 4 +- resources/service.rb | 15 +- resources/use_backend.rb | 2 +- resources/userlist.rb | 2 +- spec/helpers_spec.rb | 64 +++++++ spec/unit/resources/components_spec.rb | 56 ++++++ spec/unit/resources/defaults_spec.rb | 10 ++ spec/unit/resources/global_spec.rb | 10 ++ spec/unit/resources/install_spec.rb | 32 ++++ spec/unit/resources/listen_spec.rb | 8 +- spec/unit/resources/service_spec.rb | 49 ++++++ templates/default/haproxy.cfg.erb | 2 + test/cookbooks/test/metadata.rb | 2 + test/integration/common/inspec.yml | 3 - test/integration/config_2/inspec.yml | 3 - test/integration/config_3/inspec.yml | 3 - test/integration/config_acl/inspec.yml | 3 - test/integration/config_array/inspec.yml | 3 - .../config_backend_search/inspec.yml | 3 - .../config_custom_template/inspec.yml | 3 - test/integration/config_fastcgi/inspec.yml | 3 - test/integration/config_resolver/inspec.yml | 3 - .../config_ssl_redirect/inspec.yml | 3 - test/integration/default/inspec.yml | 2 - test/integration/package/inspec.yml | 3 - test/integration/source-default/inspec.yml | 3 - test/integration/source_3.2/inspec.yml | 3 - test/integration/source_lua/inspec.yml | 3 - test/integration/source_openssl/inspec.yml | 3 - 57 files changed, 703 insertions(+), 359 deletions(-) delete mode 100644 files/haproxy-default delete mode 100644 kitchen.exec.yml create mode 100644 migration.md rename resources/{partial => _partial}/_config_file.rb (97%) rename resources/{partial => _partial}/_extra_options.rb (75%) create mode 100644 spec/helpers_spec.rb create mode 100644 spec/unit/resources/components_spec.rb create mode 100644 spec/unit/resources/service_spec.rb diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2e77f4d3..e237c41c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,5 +1,5 @@ --- -name: Dokken Integration Tests +name: ci "on": pull_request: @@ -15,132 +15,118 @@ jobs: pull-requests: write statuses: write issues: write + secrets: inherit integration: needs: lint-unit runs-on: ubuntu-latest strategy: - matrix: - os: - - "debian-11" - - "debian-12" - - "ubuntu-2004" - - "ubuntu-2204" - - "centos-stream-9" - - "centos-stream-10" - - "fedora-latest" - suite: - - config-2 - # - config-3 - - config-acl - - config-array - - config-backend-search - - config-custom-template - - config-fastcgi - - config-resolver - - config-ssl-redirect - - "package" - - "source-3.2" - - "source-lua" - - "source-default" - - "source-openssl" fail-fast: false - - steps: - - name: Check out code - uses: actions/checkout@v7 - - name: Install Chef - uses: actionshub/chef-install@main - - name: Dokken - uses: actionshub/test-kitchen@main - env: - CHEF_LICENSE: accept-no-persist - KITCHEN_LOCAL_YAML: kitchen.dokken.yml - with: - suite: ${{ matrix.suite }} - os: ${{ matrix.os }} - - integration-amazonlinux: - needs: lint-unit - runs-on: ubuntu-24.04 - strategy: + max-parallel: 4 matrix: os: - - "amazonlinux-2023" + - almalinux-8 + - almalinux-9 + - almalinux-10 + - amazonlinux-2023 + - centos-stream-9 + - centos-stream-10 + - debian-11 + - debian-12 + - debian-13 + - fedora-latest + - opensuse-leap-15 + - oraclelinux-8 + - oraclelinux-9 + - rockylinux-8 + - rockylinux-9 + - rockylinux-10 + - ubuntu-2204 + - ubuntu-2404 suite: - - "package" - - "source-3.2" - - "source-default" - fail-fast: false - + - default + - package + - source-3.2 + - source-default + - source-lua + - source-openssl steps: - name: Check out code uses: actions/checkout@v7 - - name: Install Chef - uses: actionshub/chef-install@6.0.0 + - name: Install Cinc Workstation + uses: sous-chefs/.github/.github/actions/install-workstation@9.0.0 - name: Dokken - uses: actionshub/test-kitchen@3.0.0 + uses: actionshub/test-kitchen@main env: CHEF_LICENSE: accept-no-persist + CHEF_VERSION: latest KITCHEN_LOCAL_YAML: kitchen.dokken.yml + KITCHEN_PRODUCT_NAME: cinc with: suite: ${{ matrix.suite }} os: ${{ matrix.os }} - lua_test: + config-test: needs: lint-unit runs-on: ubuntu-latest strategy: + fail-fast: false + max-parallel: 4 matrix: os: - - "centos-stream-9" + - almalinux-8 + - almalinux-9 + - almalinux-10 + - amazonlinux-2023 + - centos-stream-9 + - centos-stream-10 + - debian-11 + - debian-12 + - debian-13 + - fedora-latest + - opensuse-leap-15 + - oraclelinux-8 + - oraclelinux-9 + - rockylinux-8 + - rockylinux-9 + - rockylinux-10 + - ubuntu-2204 + - ubuntu-2404 suite: - - "source-lua" - fail-fast: false - + - config-2 + - config-3 + - config-acl + - config-array + - config-backend-search + - config-custom-template + - config-fastcgi + - config-resolver + - config-ssl-redirect steps: - name: Check out code uses: actions/checkout@v7 - - name: Install Chef - uses: actionshub/chef-install@6.0.0 + - name: Install Cinc Workstation + uses: sous-chefs/.github/.github/actions/install-workstation@9.0.0 - name: Dokken - uses: actionshub/test-kitchen@3.0.0 + uses: actionshub/test-kitchen@main env: CHEF_LICENSE: accept-no-persist + CHEF_VERSION: latest KITCHEN_LOCAL_YAML: kitchen.dokken.yml + KITCHEN_PRODUCT_NAME: cinc with: suite: ${{ matrix.suite }} os: ${{ matrix.os }} - configtest: - needs: lint-unit + final: + if: always() + needs: [integration, config-test] runs-on: ubuntu-latest - strategy: - matrix: - os: - - "centos-stream-9" - suite: - - "config-2" - # - "config-3" - - "config-backend-search" - - "config-acl" - - "config-resolver" - - "config-ssl-redirect" - - "config-custom-template" - - "config-array" - - "config-fastcgi" - fail-fast: false - steps: - - name: Check out code - uses: actions/checkout@v7 - - name: Install Chef - uses: actionshub/chef-install@6.0.0 - - name: Dokken - uses: actionshub/test-kitchen@3.0.0 + - name: Check integration results env: - CHEF_LICENSE: accept-no-persist - KITCHEN_LOCAL_YAML: kitchen.dokken.yml - with: - suite: ${{ matrix.suite }} - os: ${{ matrix.os }} + CONFIG_RESULT: ${{ needs.config-test.result }} + INTEGRATION_RESULT: ${{ needs.integration.result }} + run: | + test "$CONFIG_RESULT" = success + test "$INTEGRATION_RESULT" = success diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index bd02e256..78f0971e 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -18,7 +18,7 @@ jobs: steps: - name: Check out code uses: actions/checkout@v7 - - name: Install Chef - uses: actionshub/chef-install@main + - name: Install Cinc Workstation + uses: sous-chefs/.github/.github/actions/install-workstation@9.0.0 - name: Install cookbooks run: chef install Policyfile.rb diff --git a/.github/workflows/prevent-file-change.yml b/.github/workflows/prevent-file-change.yml index 38b22df4..9254f030 100644 --- a/.github/workflows/prevent-file-change.yml +++ b/.github/workflows/prevent-file-change.yml @@ -12,5 +12,8 @@ name: prevent-file-change jobs: prevent-file-change: uses: sous-chefs/.github/.github/workflows/prevent-file-change.yml@9.0.0 + permissions: + contents: read + pull-requests: write secrets: token: ${{ secrets.GITHUB_TOKEN }} diff --git a/LIMITATIONS.md b/LIMITATIONS.md index 61d6f49e..b1080777 100644 --- a/LIMITATIONS.md +++ b/LIMITATIONS.md @@ -1,72 +1,86 @@ # Limitations -## Package Availability - -HAProxy is available as a package on all major Linux distributions. The version -available depends on the distribution release. - -### APT (Debian/Ubuntu) - -- **Debian 11 (Bullseye)**: HAProxy 2.2 (default), 2.4–2.8 via haproxy.debian.net -- **Debian 12 (Bookworm)**: HAProxy 2.6 (default), 2.8–3.0 via haproxy.debian.net -- **Ubuntu 20.04 (Focal)**: HAProxy 2.0 (default), newer via PPA `ppa:vbernat/haproxy-X.Y` -- **Ubuntu 22.04 (Jammy)**: HAProxy 2.4 (default), newer via PPA -- **Ubuntu 24.04 (Noble)**: HAProxy 2.8 (default), newer via PPA - -Architectures: amd64, arm64, i386 (varies by release). - -### DNF/YUM (RHEL family) - -- **RHEL 8 / AlmaLinux 8 / Rocky 8 / Oracle 8**: HAProxy 1.8 (base), newer via EPEL or AppStream -- **RHEL 9 / AlmaLinux 9 / Rocky 9 / Oracle 9**: HAProxy 2.4 (AppStream) -- **AlmaLinux 10 / CentOS Stream 10**: HAProxy 3.0+ (AppStream) -- **CentOS Stream 9**: HAProxy 2.4 (AppStream) -- **Amazon Linux 2023**: HAProxy 2.8 (default repos) -- **Fedora**: Latest stable (default repos) - -Architectures: x86_64, aarch64. - -EPEL is required for RHEL-family platforms when the base/AppStream version is insufficient. -The `yum-epel` cookbook dependency handles this. - -### Zypper (SUSE) - -- **openSUSE Leap 15**: HAProxy 2.x (default repos) - -Architectures: x86_64. - -## Source/Compiled Installation - -HAProxy can be compiled from source on all supported platforms. The cookbook supports -source installation with configurable version, build flags, and optional features -(Lua, OpenSSL, PCRE, Prometheus exporter). - -### Build Dependencies - -| Platform Family | Packages | -|-----------------|-----------------------------------------------------------------------| -| Debian | build-essential, libpcre3-dev, libssl-dev, zlib1g-dev, libsystemd-dev | -| RHEL (< 10) | pcre-devel, openssl-devel, zlib-devel, systemd-devel, tar | -| RHEL (>= 10) | pcre2-devel, openssl-devel, zlib-devel, systemd-devel, tar | -| SUSE | pcre-devel, libopenssl-devel, zlib-devel, systemd-devel | - -### Optional Build Dependencies - -| Feature | Debian | RHEL | -|-----------|---------------------|----------------| -| Lua | liblua5.3-dev | lua-devel | -| OpenSSL 3 | libssl-dev (>= 3.0) | openssl3-devel | - -## Architecture Limitations - -- All platforms provide amd64/x86_64 packages -- arm64/aarch64 packages available on Debian 11+, Ubuntu 20.04+, RHEL 9+ -- Source compilation works on all architectures with appropriate cross-compiler - -## Known Issues - -- PCRE1 (`pcre-devel`) is deprecated on RHEL/CentOS/AlmaLinux/Rocky >= 10; the cookbook - automatically selects PCRE2 (`pcre2-devel`) on those platforms -- IUS repository support is limited to RHEL 6/7 (both EOL) and should be considered deprecated -- OpenSSL source compilation has known issues (see [#503](https://github.com/sous-chefs/haproxy/issues/503)) -- The `haproxy-systemd-wrapper` binary is only used for HAProxy versions < 1.8 +This cookbook manages HAProxy from distribution packages or from an upstream +source archive. It does not configure the HAProxy Technologies Enterprise +repositories. + +## Upstream lifecycle + +HAProxy publishes both stable and long-term-support branches. The source +installer defaults to the 3.2 LTS branch; exact patch releases are tracked in +`resources/install.rb` and the integration test recipes. + +See the [HAProxy release table](https://www.haproxy.org/) for current branch +support dates and patch releases. + +## Package availability + +The `package` installation path uses the package named `haproxy` from the +configured operating-system repositories. The version and architecture +therefore depend on the distribution release and enabled repositories. + +### APT (Debian and Ubuntu) + +* Debian and Ubuntu publish HAProxy in their normal archives. +* The Debian HAProxy packaging team publishes newer supported branches through + [haproxy.debian.net](https://haproxy.debian.net/). +* Vincent Bernat's Ubuntu PPAs publish branch-specific builds where available. + The cookbook does not add these APT repositories automatically. +* Debian 12 and 13 and Ubuntu 22.04 and 24.04 provide HAProxy packages for + multiple architectures through their distribution archives. + +### DNF and YUM (RHEL family, Fedora, and Amazon Linux) + +* RHEL-family, Fedora, and Amazon Linux installations use the package available + from their configured distribution repositories. +* `enable_epel_repo true` enables EPEL through the `yum-epel` cookbook before + package installation on RHEL-family and Amazon platforms. +* The legacy IUS path only applies to RHEL 6 and 7. Those releases are + unsupported, so `enable_ius_repo` is retained only for compatibility and + should not be used for current deployments. +* Package versions and architectures vary by distribution and repository; use + source installation when a specific HAProxy release is required. + +### Zypper (openSUSE Leap) + +* openSUSE Leap installations use the package from configured distribution + repositories. +* The cookbook does not add an HAProxy-specific Zypper repository. + +## Architecture limitations + +* Source installation uses `node['kernel']['machine']` as HAProxy's `CPU` value + unless `source_target_cpu` is overridden. +* Distribution package architecture coverage is controlled by each + distribution repository. +* The cookbook's integration matrix primarily exercises x86_64 containers; + other architectures require separate validation. + +## Source installation + +HAProxy source archives are downloaded from +`https://www.haproxy.org/download//src/`. + +### Build dependencies + +| Platform family | Required packages | +| --- | --- | +| Debian | `build-essential`, OpenSSL, zlib, systemd, and PCRE development packages | +| RHEL, Fedora, Amazon | compiler/build tools, OpenSSL, zlib, systemd, and PCRE development packages | +| SUSE | compiler/build tools, OpenSSL, zlib, systemd, and PCRE development packages | + +Optional Lua and custom OpenSSL builds require the matching development headers +and libraries. HAProxy build flags such as `USE_OPENSSL`, `USE_LUA`, +`USE_SYSTEMD`, `USE_PCRE` or `USE_PCRE2`, and `USE_PROMEX` are exposed through +resource properties. + +## Known constraints + +* PCRE1 packages are unavailable on newer platform releases. The cookbook + selects PCRE2 for Debian 13 and RHEL-family version 10 or newer. +* The default source checksum is coupled to the default source version; custom + versions must supply their matching checksum. +* Source installation compiles in Chef's file cache and installs under + `bin_prefix`. Removal must account for those installed artifacts. +* The source installer supports systemd only; SysV and Upstart service + management are outside the supported migration scope. diff --git a/Policyfile.lock.json b/Policyfile.lock.json index 0688a098..ede36d59 100644 --- a/Policyfile.lock.json +++ b/Policyfile.lock.json @@ -1,5 +1,5 @@ { - "revision_id": "b9d24e60ac21ab3c0ecba3453df8e0b255b2f00ae504f58b6828da5de4f5f4b4", + "revision_id": "ca265896fa8ba734bd897d6c2f87c7cd54aef7ac88a53abc1c3b6fdd386f308b", "name": "haproxy", "run_list": [ "recipe[test::package]" @@ -32,29 +32,26 @@ "config_ssl_redirect": [ "recipe[test::config_ssl_redirect]" ], + "default": [ + "recipe[test::default]" + ], "package": [ "recipe[test::package]" ], "source": [ "recipe[test::source]" ], - "source_24": [ - "recipe[test::source_24]" - ], - "source_26": [ - "recipe[test::source_26]" - ], - "source_28": [ - "recipe[test::source_28]" - ], - "source_28_pcre2": [ - "recipe[test::source_28_pcre2]" + "source_32": [ + "recipe[test::source_32]" ], "source_lua": [ "recipe[test::source_lua]" ], "source_openssl": [ "recipe[test::source_openssl]" + ], + "source_pcre2": [ + "recipe[test::source_pcre2]" ] }, "included_policy_locks": [ @@ -62,19 +59,19 @@ ], "cookbook_locks": { "haproxy": { - "version": "12.4.13", - "identifier": "2d7dc66eb12cece395df07e798f1d3f94e757140", - "dotted_decimal_identifier": "12804665166081260.64059604856183025.233067716636992", + "version": "12.4.14", + "identifier": "80ee4e28b140d6214321d738c20944d0e77c3c83", + "dotted_decimal_identifier": "36290816476528854.9362486855254537.75664027565187", "source": ".", "cache_key": null, "scm_info": { "scm": "git", - "remote": "https://github.com/sous-chefs/haproxy.git", - "revision": "396d9112cf5d04b38206b178f4b92f220ba943a8", + "remote": "git@github.com:sous-chefs/haproxy.git", + "revision": "1342ab71d759819ddc6838f2bc81617933062afb", "working_tree_clean": false, "published": true, "synchronized_remote_branches": [ - "origin/chore/policyfile-migration" + "origin/modernise-cookbook" ] }, "source_options": { @@ -83,18 +80,18 @@ }, "test": { "version": "0.0.1", - "identifier": "5e2218f2c1e05c80013463ac8232f64a91929a19", - "dotted_decimal_identifier": "26496138358153308.36030121541141042.270800130316825", + "identifier": "c34acaa0a6b844179ef341da11274687c8014d49", + "dotted_decimal_identifier": "54969854597707844.6648692083396903.77548990057801", "source": "test/cookbooks/test", "cache_key": null, "scm_info": { "scm": "git", - "remote": "https://github.com/sous-chefs/haproxy.git", - "revision": "396d9112cf5d04b38206b178f4b92f220ba943a8", + "remote": "git@github.com:sous-chefs/haproxy.git", + "revision": "1342ab71d759819ddc6838f2bc81617933062afb", "working_tree_clean": false, "published": true, "synchronized_remote_branches": [ - "origin/chore/policyfile-migration" + "origin/modernise-cookbook" ] }, "source_options": { @@ -102,14 +99,14 @@ } }, "yum-epel": { - "version": "5.0.10", - "identifier": "3ffd59317825177023566a99bf5940e29163cfd4", - "dotted_decimal_identifier": "18011483056645399.31564051454213977.71341846024148", - "cache_key": "yum-epel-0ae39de8b609c2904012f4da4cf261b6e3361f74", + "version": "6.0.0", + "identifier": "421eb240b33bad3abac0488905905d860bacb1d5", + "dotted_decimal_identifier": "18611099401403309.16530883662644624.102830302867925", + "cache_key": "yum-epel-aaf20ab51d90d53183885fc013c545fdf57d73a4", "origin": "https://github.com/sous-chefs/yum-epel.git", "source_options": { "git": "https://github.com/sous-chefs/yum-epel.git", - "revision": "0ae39de8b609c2904012f4da4cf261b6e3361f74", + "revision": "aaf20ab51d90d53183885fc013c545fdf57d73a4", "branch": "main" } } @@ -136,7 +133,7 @@ ] ], "dependencies": { - "haproxy (12.4.13)": [ + "haproxy (12.4.14)": [ [ "yum-epel", ">= 0.0.0" @@ -148,7 +145,7 @@ ">= 0.0.0" ] ], - "yum-epel (5.0.10)": [ + "yum-epel (6.0.0)": [ ] } diff --git a/README.md b/README.md index c90b37b5..f2e57eba 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,10 @@ [![OpenCollective](https://opencollective.com/sous-chefs/sponsors/badge.svg)](#sponsors) [![License](https://img.shields.io/badge/License-Apache%202.0-green.svg)](https://opensource.org/licenses/Apache-2.0) -Installs and configures HAProxy. +Installs and configures HAProxy through custom resources. + +Upgrading an older wrapper cookbook or attribute-driven implementation? See the +[resource-only migration guide](migration.md). ## Maintainers @@ -15,18 +18,22 @@ This cookbook is maintained by the Sous Chefs. The Sous Chefs are a community of ## Requirements * HAProxy `stable` or `LTS` -* Chef 13.9+ +* Chef Infra Client 16+ ### Platforms This cookbook officially supports and is tested against the following platforms: -* debian: 9 & 10 -* ubuntu: 20.04 & 21.04 -* centos: 7 & 8 -* centos-stream: 8 -* fedora: latest -* amazonlinux: 2 +* AlmaLinux 8+ +* Amazon Linux 2023+ +* CentOS Stream 9+ +* Debian 11+ +* Fedora +* openSUSE Leap 15+ +* Oracle Linux 8+ +* Red Hat Enterprise Linux 8+ +* Rocky Linux 8+ +* Ubuntu 22.04+ PRs are welcome to add support for additional platforms. @@ -40,7 +47,13 @@ HAProxy has many configurable options available, this cookbook makes the most po If you wish to use a HAProxy property that is not listed the `extra_options` hash is available to take in any number of additional values. -For example, the ability to disable listeners is not provided out of the box. Further examples can be found in either `test/fixtures/recipes` or `spec/test/recipes`. If you have questions on how this works or would like to add more examples so it is easier to understand, please come talk to us on the [Chef Community Slack](http://community-slack.chef.io/) on the #sous-chefs channel. +For example, the ability to disable listeners is not provided out of the box. +Further examples can be found in +[`test/cookbooks/test/recipes`](test/cookbooks/test/recipes). If you have +questions on how this works or would like to add more examples so it is easier +to understand, please come talk to us on the +[Chef Community Slack](https://community-slack.chef.io/) in the +`#sous-chefs` channel. ```ruby haproxy_listen 'disabled' do diff --git a/documentation/haproxy_install.md b/documentation/haproxy_install.md index 150493ca..833472a6 100644 --- a/documentation/haproxy_install.md +++ b/documentation/haproxy_install.md @@ -2,14 +2,14 @@ [Back To Resource List](https://github.com/sous-chefs/haproxy#resources) -Install HAProxy from package or source. +Install HAProxy from a package or source archive. Introduced: v4.0.0 ## Actions -* `:create` -* `:delete` +* `:install` +* `:remove` ## Properties @@ -17,49 +17,56 @@ This resource also uses the following partial resources: * [_config_file](https://github.com/sous-chefs/haproxy/tree/master/documentation/partial_config_file.md) -| Name | Type | Default | Description | Allowed Values | -| -------------------- | ------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------ | ------------------- | -| `install_type` | String | None | Set the installation type | `package`, `source` | -| `bin_prefix` | String | `/usr` | Set the source compile prefix | | -| `sensitive` | Boolean | `true` | Ensure that sensitive resource data is not logged by the chef-client | | -| `use_systemd` | Boolean | `true` | Evalues whether to use systemd based on the nodes init package | | -| `user` | String | `haproxy` | Similar to "uid" but uses the UID of user name `` from /etc/passwd | | -| `group` | String | `haproxy` | Similar to "gid" but uses the GID of group name `` from /etc/group | | -| `package_name` | String | `haproxy` | | | -| `package_version` | String | | | | -| `enable_ius_repo` | Boolean | `false` | Enables the IUS package repo for Centos to install versions >1.5 | | -| `enable_epel_repo` | Boolean | `true` | Enables the epel repo for RHEL based operating systems | | -| `source_version` | String | `2.2.4` | | | -| `source_url` | String | `http://www.haproxy.org/download/2.2.4/src/haproxy-2.2.4.tar.gz` | | | -| `source_checksum` | String | | | | -| `source_target_cpu` | String | `node['kernel']['machine']` | | | -| `source_target_arch` | String | | | | -| `source_target_os` | String | See resource | | | -| `use_libcrypt` | Boolean | `true` | | `true`, `false` | -| `use_pcre` | Boolean | `true` | Enable PCRE regex support. Uses PCRE2 on RHEL-family >= 10 and PCRE elsewhere. | `true`, `false` | -| `use_openssl` | Boolean | `true` | Include openssl support () | `true`, `false` | -| `use_zlib` | Boolean | `true` | Include ZLIB support | `true`, `false` | -| `use_linux_tproxy` | Boolean | `true` | | `true`, `false` | -| `use_linux_splice` | Boolean | `true` | | `true`, `false` | -| `use_promex` | Boolean | `false` | Enable the included Prometheus exporter (HAProxy v2.4+) | `true`, `false` | -| `use_systemd` | Boolean | `true` | | `true`, `false` | -| `use_lua` | Boolean | `false` | Include Lua support | `true`, `false` | -| `lua_lib` | String | | Path for lua library files ex: `/opt/lib-5.3.5/lib` | | -| `lua_inc` | String | | Path for lua library files ex: `/opt/lib-5.3.5/include` | | -| `ssl_lib` | String | | Path for openssl library files ex: `/usr/local/openssl/lib` | | -| `ssl_inc` | String | | Path for openssl includes files ex: `/usr/local/openssl/inc` | | + + +| Name | Type | Default | Description | Allowed Values | +| -------------------- | ------- | ----------------------------------- | ------------------------------------------------------------------------------ | ------------------- | +| `install_type` | String | Resource name | Set the installation type | `package`, `source` | +| `bin_prefix` | String | `/usr` | Set the source compile prefix | | +| `sensitive` | Boolean | `true` | Ensure that sensitive resource data is not logged by Chef Infra Client | | +| `user` | String | `haproxy` | User that owns HAProxy-managed files | | +| `group` | String | `haproxy` | Group that owns HAProxy-managed files | | +| `package_name` | String | `haproxy` | Package to install or remove | | +| `package_version` | String | None | Optional package version | | +| `enable_ius_repo` | Boolean | `false` | Enable the IUS repository on supported RHEL-family systems | | +| `enable_epel_repo` | Boolean | `true` | Enable the EPEL repository on RHEL-family and Amazon systems | | +| `source_version` | String | `3.2.14` | HAProxy version to compile | | +| `source_url` | String | Derived from `source_version` | HTTPS URL for the HAProxy source archive | | +| `source_checksum` | String | Checksum for the default archive | SHA-256 checksum used to verify the source archive | | +| `source_target_cpu` | String | Node kernel machine | CPU target passed to `make` | | +| `source_target_arch` | String | None | Optional architecture passed to `make` | | +| `source_target_os` | String | Derived from platform and version | HAProxy build target passed to `make` | | +| `use_libcrypt` | Boolean | `true` | Include libcrypt support | `true`, `false` | +| `use_pcre` | Boolean | `true` | Enable PCRE support, selecting PCRE or PCRE2 for the platform | `true`, `false` | +| `use_openssl` | Boolean | `true` | Include OpenSSL support | `true`, `false` | +| `use_zlib` | Boolean | `true` | Include zlib support | `true`, `false` | +| `use_linux_tproxy` | Boolean | `true` | Include Linux transparent proxy support | `true`, `false` | +| `use_linux_splice` | Boolean | `true` | Include Linux splice support | `true`, `false` | +| `use_promex` | Boolean | `false` | Enable the built-in Prometheus exporter | `true`, `false` | +| `use_systemd` | Boolean | HAProxy 1.8 and newer | Include systemd support when compiling from source | `true`, `false` | +| `use_lua` | Boolean | `false` | Include Lua support | `true`, `false` | +| `lua_lib` | String | None | Path to Lua library files | | +| `lua_inc` | String | None | Path to Lua include files | | +| `ssl_lib` | String | None | Path to OpenSSL library files | | +| `ssl_inc` | String | None | Path to OpenSSL include files | | + + ## Examples +Install the platform package: + ```ruby haproxy_install 'package' ``` +Compile a pinned source release: + ```ruby haproxy_install 'source' do - source_url node['haproxy']['source_url'] - source_checksum node['haproxy']['source_checksum'] - source_version node['haproxy']['source_version'] + source_version '3.2.14' + source_url 'https://www.haproxy.org/download/3.2/src/haproxy-3.2.14.tar.gz' + source_checksum 'b21f50a790aa8cb0cf8dc505f1f8d849799eafe4d31c14b86a34409ccf4ae5e4' use_pcre true use_openssl true use_zlib true @@ -67,3 +74,11 @@ haproxy_install 'source' do use_linux_splice true end ``` + +Remove a package installation: + +```ruby +haproxy_install 'package' do + action :remove +end +``` diff --git a/documentation/haproxy_service.md b/documentation/haproxy_service.md index 9e4693d6..3c1b1aed 100644 --- a/documentation/haproxy_service.md +++ b/documentation/haproxy_service.md @@ -2,8 +2,8 @@ [Back To Resource List](https://github.com/sous-chefs/haproxy#resources) -Configures HAProxy as a systemd service. -To reload HAProxy service add a subscribes option to the resource block. See example below. To reload the HAProxy service add a subscribes option to the resource block. See example below. +Configures HAProxy as a systemd service. To reload HAProxy after its +configuration changes, add a subscription to the resource block. Introduced: v4.0.0 @@ -16,6 +16,7 @@ Introduced: v4.0.0 * `:restart` * `:reload` * `:enable` +* `:disable` ## Properties diff --git a/files/haproxy-default b/files/haproxy-default deleted file mode 100644 index e69de29b..00000000 diff --git a/kitchen.dokken.yml b/kitchen.dokken.yml index 6a3725d8..27283017 100644 --- a/kitchen.dokken.yml +++ b/kitchen.dokken.yml @@ -2,11 +2,14 @@ driver: name: dokken privileged: true - chef_version: <%= ENV['CHEF_VERSION'] || 'current' %> + chef_image: "<%= ENV.fetch('KITCHEN_PRODUCT_NAME', 'cinc') == 'cinc' ? 'cincproject/cinc' : 'chef/chef' %>" + chef_version: "<%= ENV['CHEF_VERSION'] || (ENV.fetch('KITCHEN_PRODUCT_NAME', 'cinc') == 'cinc' ? 'latest' : 'current') %>" transport: { name: dokken } provisioner: name: dokken + chef_binary: "<%= ENV.fetch('KITCHEN_PRODUCT_NAME', 'cinc') == 'cinc' ? '/opt/cinc/bin/cinc-client' : '/opt/chef/bin/chef-client' %>" + product_name: "<%= ENV['KITCHEN_PRODUCT_NAME'] || 'cinc' %>" policyfile: Policyfile.rb platforms: @@ -85,10 +88,10 @@ platforms: image: dokken/rockylinux-9 pid_one_command: /usr/lib/systemd/systemd - - name: ubuntu-20.04 + - name: rockylinux-10 driver: - image: dokken/ubuntu-20.04 - pid_one_command: /bin/systemd + image: dokken/rockylinux-10 + pid_one_command: /usr/lib/systemd/systemd - name: ubuntu-22.04 driver: diff --git a/kitchen.exec.yml b/kitchen.exec.yml deleted file mode 100644 index ba7b2a96..00000000 --- a/kitchen.exec.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -driver: { name: exec } -transport: { name: exec } - -platforms: - - name: macos-latest - - name: windows-latest diff --git a/kitchen.global.yml b/kitchen.global.yml index 184759bf..7f31f648 100644 --- a/kitchen.global.yml +++ b/kitchen.global.yml @@ -1,15 +1,11 @@ --- provisioner: name: policyfile_zero - product_name: chef - product_version: <%= ENV['CHEF_VERSION'] || 'latest' %> - channel: stable - install_strategy: once + product_name: cinc chef_license: accept - enforce_idempotency: <%= ENV['ENFORCE_IDEMPOTENCY'] || true %> - multiple_converge: <%= ENV['MULTIPLE_CONVERGE'] || 2 %> + enforce_idempotency: true + multiple_converge: 2 deprecations_as_errors: true - log_level: <%= ENV['CHEF_LOG_LEVEL'] || 'auto' %> policyfile: Policyfile.rb verifier: @@ -18,16 +14,19 @@ verifier: platforms: - name: almalinux-8 - name: almalinux-9 + - name: almalinux-10 - name: amazonlinux-2023 - name: centos-stream-9 + - name: centos-stream-10 - name: debian-11 - name: debian-12 + - name: debian-13 - name: fedora-latest - name: opensuse-leap-15 - name: oraclelinux-8 - name: oraclelinux-9 - name: rockylinux-8 - name: rockylinux-9 - - name: ubuntu-20.04 + - name: rockylinux-10 - name: ubuntu-22.04 - name: ubuntu-24.04 diff --git a/kitchen.yml b/kitchen.yml index d5eca8e7..0a55f8e6 100644 --- a/kitchen.yml +++ b/kitchen.yml @@ -4,26 +4,35 @@ driver: provisioner: name: policyfile_zero + product_name: cinc + enforce_idempotency: true + multiple_converge: 2 deprecations_as_errors: true chef_license: accept - product_name: chef - product_version: <%= ENV['CHEF_VERSION'] || 'latest' %> - install_strategy: always - log_level: <%= ENV['CHEF_LOG_LEVEL'] || 'auto' %> policyfile: Policyfile.rb verifier: name: inspec platforms: + - name: almalinux-8 + - name: almalinux-9 + - name: almalinux-10 - name: amazonlinux-2023 - - name: centos-stream-8 - name: centos-stream-9 + - name: centos-stream-10 - name: debian-11 - name: debian-12 - - name: ubuntu-20.04 - - name: ubuntu-22.04 + - name: debian-13 - name: fedora-latest + - name: opensuse-leap-15 + - name: oraclelinux-8 + - name: oraclelinux-9 + - name: rockylinux-8 + - name: rockylinux-9 + - name: rockylinux-10 + - name: ubuntu-22.04 + - name: ubuntu-24.04 suites: - name: default @@ -32,30 +41,24 @@ suites: - name: package provisioner: named_run_list: package - - name: source-3.2 + - name: source_3.2 provisioner: named_run_list: source_32 - name: source-default provisioner: named_run_list: source - - name: source-lua + - name: source_lua provisioner: named_run_list: source_lua - - name: source-openssl + - name: source_openssl provisioner: named_run_list: source_openssl - verifier: - inspec_tests: - - path: test/integration/source_openssl - name: config_2 provisioner: named_run_list: config_2 - name: config_3 provisioner: named_run_list: config_3 - - name: config_4 - provisioner: - named_run_list: config_4 - name: config_backend_search provisioner: named_run_list: config_backend_search diff --git a/metadata.rb b/metadata.rb index 92adffe5..2eeaf37a 100644 --- a/metadata.rb +++ b/metadata.rb @@ -1,16 +1,23 @@ +# frozen_string_literal: true + name 'haproxy' maintainer 'Sous Chefs' maintainer_email 'help@sous-chefs.org' license 'Apache-2.0' -description 'Installs and configures haproxy' +description 'Provides resources to install and configure HAProxy' version '12.4.14' source_url 'https://github.com/sous-chefs/haproxy' issues_url 'https://github.com/sous-chefs/haproxy/issues' chef_version '>= 16' -supports 'debian' -supports 'ubuntu' -supports 'centos' -supports 'amazon' -supports 'opensuseleap' +supports 'almalinux', '>= 8.0' +supports 'amazon', '>= 2023.0' +supports 'centos_stream', '>= 9.0' +supports 'debian', '>= 11.0' +supports 'fedora' +supports 'opensuseleap', '>= 15.0' +supports 'oracle', '>= 8.0' +supports 'redhat', '>= 8.0' +supports 'rocky', '>= 8.0' +supports 'ubuntu', '>= 22.04' depends 'yum-epel' diff --git a/migration.md b/migration.md new file mode 100644 index 00000000..fb75f70d --- /dev/null +++ b/migration.md @@ -0,0 +1,84 @@ +# Migrating to the Resource-Only API + +The haproxy cookbook exposes custom resources as its production API. Wrapper +cookbooks should declare those resources directly instead of including a +production recipe or configuring HAProxy through node attributes. + +## Replace Recipe and Attribute Usage + +Replace attribute-driven recipe usage such as: + +```ruby +node.default['haproxy']['install_method'] = 'package' +include_recipe 'haproxy' +``` + +with explicit resource declarations: + +```ruby +haproxy_install 'package' + +haproxy_config_global 'global' + +haproxy_config_defaults 'defaults' do + mode 'http' + timeout( + 'connect' => '5s', + 'client' => '50s', + 'server' => '50s' + ) +end + +haproxy_service 'haproxy' do + action %i(create enable start) +end +``` + +Declare frontends, backends, listeners, ACLs, resolvers, and other configuration +sections with the corresponding resources listed in the +[README](README.md#resources). Properties on those resources replace cookbook +attributes and make each wrapper cookbook's HAProxy contract explicit. + +## Package and Source Installation + +Package installation uses the platform package manager: + +```ruby +haproxy_install 'package' +``` + +Source installation requires a version, URL, and matching SHA-256 checksum when +overriding the cookbook defaults: + +```ruby +haproxy_install 'source' do + source_version '3.2.14' + source_url 'https://www.haproxy.org/download/3.2/src/haproxy-3.2.14.tar.gz' + source_checksum 'b21f50a790aa8cb0cf8dc505f1f8d849799eafe4d31c14b86a34409ccf4ae5e4' +end +``` + +## Removal + +Use the resources' removal actions to reverse managed state: + +```ruby +haproxy_service 'haproxy' do + action :delete +end + +haproxy_install 'package' do + action :remove +end +``` + +The service delete action stops and disables the unit before removing it. The +source install remove action deletes the compiled HAProxy binary, legacy +wrapper when applicable, man page, downloaded archive, and extracted source +directory. + +## Platform Constraints + +Review [LIMITATIONS.md](LIMITATIONS.md) before changing HAProxy release tracks +or relying on distribution packages. The test cookbook under +`test/cookbooks/test` is development-only and is not a production entrypoint. diff --git a/resources/partial/_config_file.rb b/resources/_partial/_config_file.rb similarity index 97% rename from resources/partial/_config_file.rb rename to resources/_partial/_config_file.rb index 4a09b51a..1a1c9460 100644 --- a/resources/partial/_config_file.rb +++ b/resources/_partial/_config_file.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + property :user, String, default: 'haproxy', description: 'Set to override default haproxy user, defaults to haproxy' diff --git a/resources/partial/_extra_options.rb b/resources/_partial/_extra_options.rb similarity index 75% rename from resources/partial/_extra_options.rb rename to resources/_partial/_extra_options.rb index abccb58f..2b9eb416 100644 --- a/resources/partial/_extra_options.rb +++ b/resources/_partial/_extra_options.rb @@ -1,2 +1,4 @@ +# frozen_string_literal: true + property :extra_options, Hash, description: 'Used for setting any HAProxy directives' diff --git a/resources/acl.rb b/resources/acl.rb index 6d6b1f8f..d2a81046 100644 --- a/resources/acl.rb +++ b/resources/acl.rb @@ -2,7 +2,7 @@ provides :haproxy_acl -use 'partial/_config_file' +use '_partial/_config_file' property :acl, [String, Array], name_property: true, diff --git a/resources/backend.rb b/resources/backend.rb index 96ebadc7..bcf6ec83 100644 --- a/resources/backend.rb +++ b/resources/backend.rb @@ -2,8 +2,8 @@ provides :haproxy_backend -use 'partial/_config_file' -use 'partial/_extra_options' +use '_partial/_config_file' +use '_partial/_extra_options' property :mode, String, equal_to: %w(http tcp health), diff --git a/resources/cache.rb b/resources/cache.rb index 63708f0d..5b605389 100644 --- a/resources/cache.rb +++ b/resources/cache.rb @@ -2,7 +2,7 @@ provides :haproxy_cache -use 'partial/_config_file' +use '_partial/_config_file' property :cache_name, String, name_property: true, diff --git a/resources/config_defaults.rb b/resources/config_defaults.rb index c1b4a6dc..4129d7ca 100644 --- a/resources/config_defaults.rb +++ b/resources/config_defaults.rb @@ -2,8 +2,8 @@ provides :haproxy_config_defaults -use 'partial/_config_file' -use 'partial/_extra_options' +use '_partial/_config_file' +use '_partial/_extra_options' property :timeout, Hash, default: { client: '10s', server: '10s', connect: '10s' }, @@ -66,3 +66,8 @@ haproxy_config_resource.variables['defaults']['hash_type'] = new_resource.hash_type if property_is_set?(:hash_type) haproxy_config_resource.variables['defaults']['extra_options'] = new_resource.extra_options if property_is_set?(:extra_options) end + +action :delete do + haproxy_config_resource_init + haproxy_config_resource.variables.delete('defaults') +end diff --git a/resources/config_global.rb b/resources/config_global.rb index 22aac66a..b085100a 100644 --- a/resources/config_global.rb +++ b/resources/config_global.rb @@ -2,8 +2,8 @@ provides :haproxy_config_global -use 'partial/_config_file' -use 'partial/_extra_options' +use '_partial/_config_file' +use '_partial/_extra_options' property :pidfile, String, default: '/var/run/haproxy.pid', @@ -72,3 +72,8 @@ haproxy_config_resource.variables['global']['tuning'] = new_resource.tuning if property_is_set?(:tuning) haproxy_config_resource.variables['global']['extra_options'] = new_resource.extra_options if property_is_set?(:extra_options) end + +action :delete do + haproxy_config_resource_init + haproxy_config_resource.variables.delete('global') +end diff --git a/resources/fastcgi.rb b/resources/fastcgi.rb index 2dfebdf5..dba27cd6 100644 --- a/resources/fastcgi.rb +++ b/resources/fastcgi.rb @@ -2,7 +2,7 @@ provides :haproxy_fastcgi -use 'partial/_config_file' +use '_partial/_config_file' property :fastcgi, String, name_property: true, diff --git a/resources/frontend.rb b/resources/frontend.rb index 7666a68c..f2e6ef2f 100644 --- a/resources/frontend.rb +++ b/resources/frontend.rb @@ -2,8 +2,8 @@ provides :haproxy_frontend -use 'partial/_config_file' -use 'partial/_extra_options' +use '_partial/_config_file' +use '_partial/_extra_options' property :bind, [String, Hash], default: '0.0.0.0:80', diff --git a/resources/install.rb b/resources/install.rb index 72eefb02..c6b16279 100644 --- a/resources/install.rb +++ b/resources/install.rb @@ -4,7 +4,7 @@ include Haproxy::Cookbook::Helpers -use 'partial/_config_file' +use '_partial/_config_file' property :install_type, String, name_property: true, @@ -194,3 +194,34 @@ def pcre_make_flag end end end + +action :remove do + case new_resource.install_type + when 'package' + package new_resource.package_name do + action :remove + end + when 'source' + file ::File.join(new_resource.bin_prefix, 'sbin', 'haproxy') do + action :delete + end + + file ::File.join(new_resource.bin_prefix, 'sbin', 'haproxy-systemd-wrapper') do + action :delete + only_if { new_resource.source_version.to_f < 1.8 } + end + + file ::File.join(new_resource.bin_prefix, 'share', 'man', 'man1', 'haproxy.1') do + action :delete + end + + file ::File.join(Chef::Config[:file_cache_path], "haproxy-#{new_resource.source_version}.tar.gz") do + action :delete + end + + directory ::File.join(Chef::Config[:file_cache_path], "haproxy-#{new_resource.source_version}") do + recursive true + action :delete + end + end +end diff --git a/resources/listen.rb b/resources/listen.rb index 895ac459..3deb7c1c 100644 --- a/resources/listen.rb +++ b/resources/listen.rb @@ -2,8 +2,8 @@ provides :haproxy_listen -use 'partial/_config_file' -use 'partial/_extra_options' +use '_partial/_config_file' +use '_partial/_extra_options' property :bind, [String, Hash], default: '0.0.0.0:80', diff --git a/resources/mailer.rb b/resources/mailer.rb index fe4dcd40..9e191247 100644 --- a/resources/mailer.rb +++ b/resources/mailer.rb @@ -2,7 +2,7 @@ provides :haproxy_mailer -use 'partial/_config_file' +use '_partial/_config_file' property :mailer, [String, Array], coerce: proc { |p| Array(p).flatten }, diff --git a/resources/peer.rb b/resources/peer.rb index 94d88351..da940e96 100644 --- a/resources/peer.rb +++ b/resources/peer.rb @@ -2,8 +2,8 @@ provides :haproxy_peer -use 'partial/_config_file' -use 'partial/_extra_options' +use '_partial/_config_file' +use '_partial/_extra_options' property :bind, [String, Hash], description: 'String - sets as given. Hash - joins with a space. HAProxy version >= 2.0' diff --git a/resources/resolver.rb b/resources/resolver.rb index d2ea7442..3ecf1737 100644 --- a/resources/resolver.rb +++ b/resources/resolver.rb @@ -2,8 +2,8 @@ provides :haproxy_resolver -use 'partial/_config_file' -use 'partial/_extra_options' +use '_partial/_config_file' +use '_partial/_extra_options' property :nameserver, Array, description: 'DNS server description' diff --git a/resources/service.rb b/resources/service.rb index 0991c77b..3a4ca492 100644 --- a/resources/service.rb +++ b/resources/service.rb @@ -4,7 +4,7 @@ include Haproxy::Cookbook::Helpers -use 'partial/_config_file' +use '_partial/_config_file' property :bin_prefix, String, default: '/usr', @@ -48,7 +48,7 @@ def do_service_action(resource_action) Chef::Log.info("Configuration test disabled, creating #{new_resource.service_name} #{new_resource.declared_type} resource with action #{resource_action}") end - declare_resource(:service, new_resource.service_name).delayed_action(resource_action) + declare_resource(:systemd_unit, "#{new_resource.service_name}.service").delayed_action(resource_action) rescue Mixlib::ShellOut::ShellCommandFailed if new_resource.config_test_fail_action.eql?(:log) Chef::Log.error("Configuration test failed, #{new_resource.service_name} #{resource_action} action aborted!\n\n" \ @@ -59,7 +59,7 @@ def do_service_action(resource_action) end end else - declare_resource(:service, new_resource.service_name).delayed_action(resource_action) + declare_resource(:systemd_unit, "#{new_resource.service_name}.service").delayed_action(resource_action) end end end @@ -67,9 +67,8 @@ def do_service_action(resource_action) action :create do with_run_context :root do - declare_resource(:cookbook_file, '/etc/default/haproxy') do - cookbook 'haproxy' - source 'haproxy-default' + declare_resource(:file, '/etc/default/haproxy') do + content '' owner 'root' group 'root' mode '0644' @@ -85,8 +84,8 @@ def do_service_action(resource_action) action :delete do with_run_context :root do - declare_resource(:cookbook_file, '/etc/default/haproxy').action(:delete) - declare_resource(:systemd_unit, "#{new_resource.service_name}.service").action(:delete) + declare_resource(:file, '/etc/default/haproxy').action(:delete) + declare_resource(:systemd_unit, "#{new_resource.service_name}.service").action(%i(stop disable delete)) end end diff --git a/resources/use_backend.rb b/resources/use_backend.rb index ec8ba3ab..3fbb5718 100644 --- a/resources/use_backend.rb +++ b/resources/use_backend.rb @@ -2,7 +2,7 @@ provides :haproxy_use_backend -use 'partial/_config_file' +use '_partial/_config_file' property :use_backend, [String, Array], name_property: true, diff --git a/resources/userlist.rb b/resources/userlist.rb index f1b1e19a..6f897831 100644 --- a/resources/userlist.rb +++ b/resources/userlist.rb @@ -2,7 +2,7 @@ provides :haproxy_userlist -use 'partial/_config_file' +use '_partial/_config_file' property :group, Hash, description: 'Adds group to the current userlist' diff --git a/spec/helpers_spec.rb b/spec/helpers_spec.rb new file mode 100644 index 00000000..b8d11e4c --- /dev/null +++ b/spec/helpers_spec.rb @@ -0,0 +1,64 @@ +# frozen_string_literal: true + +require 'spec_helper' +require_relative '../libraries/helpers' + +describe Haproxy::Cookbook::Helpers do + let(:helper_class) do + Class.new do + include Haproxy::Cookbook::Helpers + + attr_accessor :node + + def platform_family?(family) + node['platform_family'] == family + end + + def platform?(platform) + node['platform'] == platform + end + + def platform_version + node['platform_version'] + end + end + end + + let(:helper) { helper_class.new } + + describe '#source_package_list' do + it 'uses PCRE2 development headers on Debian 13' do + helper.node = { + 'platform' => 'debian', + 'platform_family' => 'debian', + 'platform_version' => '13', + } + + expect(helper.source_package_list).to include('libpcre2-dev') + expect(helper.source_package_list).not_to include('libpcre3-dev') + end + + it 'uses PCRE2 development headers on RHEL-family version 10' do + helper.node = { + 'platform' => 'almalinux', + 'platform_family' => 'rhel', + 'platform_version' => '10', + } + + expect(helper.source_package_list).to include('pcre2-devel') + expect(helper.source_package_list).not_to include('pcre-devel') + end + end + + describe '#target_os' do + it 'selects the current Linux glibc target' do + helper.node = { + 'kernel' => { + 'release' => '6.8.0-71-generic', + }, + } + + expect(helper.target_os('3.2.14')).to eq('linux-glibc') + end + end +end diff --git a/spec/unit/resources/components_spec.rb b/spec/unit/resources/components_spec.rb new file mode 100644 index 00000000..cb337d81 --- /dev/null +++ b/spec/unit/resources/components_spec.rb @@ -0,0 +1,56 @@ +# frozen_string_literal: true + +require 'spec_helper' + +describe 'HAProxy configuration component resources' do + step_into :haproxy_acl, + :haproxy_frontend, + :haproxy_resolver, + :haproxy_use_backend, + :haproxy_userlist + + platform 'ubuntu', '24.04' + + recipe do + haproxy_frontend 'http' do + bind '0.0.0.0:80' + end + + haproxy_acl 'api_path path_beg /api' do + section 'frontend' + section_name 'http' + end + + haproxy_use_backend 'api if api_path' do + section 'frontend' + section_name 'http' + end + + haproxy_resolver 'dns' do + nameserver ['google 8.8.8.8:53'] + end + + haproxy_userlist 'operators' do + group('admins' => 'users alice') + user('alice' => 'insecure-password change-me') + end + end + + it do + is_expected.to render_file('/etc/haproxy/haproxy.cfg').with_content( + %r{acl api_path path_beg /api.*use_backend api if api_path}m + ) + end + + it do + is_expected.to render_file('/etc/haproxy/haproxy.cfg').with_content( + /resolvers dns.*nameserver google 8\.8\.8\.8:53/m + ) + end + + it do + is_expected.to render_file('/etc/haproxy/haproxy.cfg').with_content( + /userlist operators.*group admins users alice.*user alice insecure-password change-me/m + ) + end +end diff --git a/spec/unit/resources/defaults_spec.rb b/spec/unit/resources/defaults_spec.rb index d21f2a5e..ad1c2ac2 100644 --- a/spec/unit/resources/defaults_spec.rb +++ b/spec/unit/resources/defaults_spec.rb @@ -27,4 +27,14 @@ it { is_expected.to render_file('/etc/haproxy/haproxy.cfg').with_content(cfg_content) } end + + context 'delete haproxy config defaults' do + recipe do + haproxy_config_defaults 'default' do + action :delete + end + end + + it { is_expected.not_to render_file('/etc/haproxy/haproxy.cfg').with_content(/^defaults$/) } + end end diff --git a/spec/unit/resources/global_spec.rb b/spec/unit/resources/global_spec.rb index 680cb391..4ddf1e2c 100644 --- a/spec/unit/resources/global_spec.rb +++ b/spec/unit/resources/global_spec.rb @@ -27,4 +27,14 @@ it { is_expected.to render_file('/etc/haproxy/haproxy.cfg').with_content(cfg_content) } end + + context 'delete haproxy config global' do + recipe do + haproxy_config_global 'global' do + action :delete + end + end + + it { is_expected.not_to render_file('/etc/haproxy/haproxy.cfg').with_content(/^global$/) } + end end diff --git a/spec/unit/resources/install_spec.rb b/spec/unit/resources/install_spec.rb index ef71a880..3baab034 100644 --- a/spec/unit/resources/install_spec.rb +++ b/spec/unit/resources/install_spec.rb @@ -14,6 +14,38 @@ it { is_expected.to install_package('haproxy') } end + context 'remove haproxy installed using the package method' do + recipe do + haproxy_install 'package' do + action :remove + end + end + + it { is_expected.to remove_package('haproxy') } + end + + context 'remove haproxy installed from source' do + recipe do + haproxy_install 'source' do + action :remove + end + end + + it { is_expected.to delete_file('/usr/sbin/haproxy') } + it { is_expected.to delete_file('/usr/share/man/man1/haproxy.1') } + it do + is_expected.to delete_file( + ::File.join(Chef::Config[:file_cache_path], 'haproxy-3.2.14.tar.gz') + ) + end + + it do + is_expected.to delete_directory( + ::File.join(Chef::Config[:file_cache_path], 'haproxy-3.2.14') + ) + end + end + context 'compile HAProxy on Ubuntu' do recipe do haproxy_install 'source' do diff --git a/spec/unit/resources/listen_spec.rb b/spec/unit/resources/listen_spec.rb index 6fdda2db..ac05b1b3 100644 --- a/spec/unit/resources/listen_spec.rb +++ b/spec/unit/resources/listen_spec.rb @@ -31,14 +31,18 @@ ' stats realm Haproxy-Statistics', ' stats auth user:pwd', ' http-request add-header X-Proto http', - ' http-response set-header Expires %\[date\(3600\),http_date]', + ' http-response set-header Expires %[date(3600),http_date]', ' default_backend servers', ' bind-process odd', ' server admin0 10.0.0.10:80 check weight 1 maxconn 100', ' server admin1 10.0.0.10:80 check weight 1 maxconn 100', ] - it { is_expected.to render_file('/etc/haproxy/haproxy.cfg').with_content(/#{cfg_content.join('\n')}/) } + it do + is_expected.to render_file('/etc/haproxy/haproxy.cfg').with_content( + Regexp.new(Regexp.escape(cfg_content.join("\n"))) + ) + end end context 'option parameter with array of options' do diff --git a/spec/unit/resources/service_spec.rb b/spec/unit/resources/service_spec.rb new file mode 100644 index 00000000..6c4cff8b --- /dev/null +++ b/spec/unit/resources/service_spec.rb @@ -0,0 +1,49 @@ +# frozen_string_literal: true + +require 'spec_helper' + +describe 'haproxy_service' do + step_into :haproxy_service + platform 'ubuntu', '24.04' + + context 'with action :create' do + recipe do + haproxy_service 'haproxy' do + action :create + end + end + + it do + is_expected.to create_file('/etc/default/haproxy').with( + content: '', + owner: 'root', + group: 'root', + mode: '0644' + ) + end + + it { is_expected.to create_systemd_unit('haproxy.service') } + end + + context 'with action :delete' do + recipe do + haproxy_service 'haproxy' do + action :delete + end + end + + it { is_expected.to delete_file('/etc/default/haproxy') } + it { is_expected.to delete_systemd_unit('haproxy.service') } + end + + context 'with action :start and configuration testing disabled' do + recipe do + haproxy_service 'haproxy' do + config_test false + action :start + end + end + + it { is_expected.to start_systemd_unit('haproxy.service') } + end +end diff --git a/templates/default/haproxy.cfg.erb b/templates/default/haproxy.cfg.erb index 98531115..5e3f5bc6 100644 --- a/templates/default/haproxy.cfg.erb +++ b/templates/default/haproxy.cfg.erb @@ -64,6 +64,7 @@ resolvers <%= resolver %> <% end -%> <% end -%> <% end -%> +<% unless nil_or_empty?(r['extra_options']) %> <% r['extra_options'].each do | option, value | -%> <% if value.is_a?(Array) %> <% value.each do | array_element | %> @@ -75,6 +76,7 @@ resolvers <%= resolver %> <% end -%> <% end -%> <% end -%> +<% end -%> <% unless nil_or_empty?(@defaults) %> diff --git a/test/cookbooks/test/metadata.rb b/test/cookbooks/test/metadata.rb index b544d8c4..0fbc4564 100644 --- a/test/cookbooks/test/metadata.rb +++ b/test/cookbooks/test/metadata.rb @@ -1,3 +1,5 @@ +# frozen_string_literal: true + name 'test' maintainer 'Heavy Water Software Inc.' maintainer_email 'ops@hw-ops.com' diff --git a/test/integration/common/inspec.yml b/test/integration/common/inspec.yml index a54e1b83..81e6ef14 100644 --- a/test/integration/common/inspec.yml +++ b/test/integration/common/inspec.yml @@ -2,6 +2,3 @@ name: haproxy-common title: HAProxy Common Suite summary: HAProxy common tests -supports: - - os-family: linux - - os-family: bsd diff --git a/test/integration/config_2/inspec.yml b/test/integration/config_2/inspec.yml index f6b17010..19f9a50d 100644 --- a/test/integration/config_2/inspec.yml +++ b/test/integration/config_2/inspec.yml @@ -2,9 +2,6 @@ name: haproxy-config-2 title: HAProxy Config 2 Suite summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd depends: - name: haproxy-common path: test/integration/common diff --git a/test/integration/config_3/inspec.yml b/test/integration/config_3/inspec.yml index 30ee033a..49a90f5d 100644 --- a/test/integration/config_3/inspec.yml +++ b/test/integration/config_3/inspec.yml @@ -2,9 +2,6 @@ name: haproxy-config-3 title: HAProxy Config 3 Suite summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd depends: - name: haproxy-common path: test/integration/common diff --git a/test/integration/config_acl/inspec.yml b/test/integration/config_acl/inspec.yml index 8229b1f3..d4011d09 100644 --- a/test/integration/config_acl/inspec.yml +++ b/test/integration/config_acl/inspec.yml @@ -2,9 +2,6 @@ name: haproxy-config-acl title: HAProxy Config ACL Suite summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd depends: - name: haproxy-common path: test/integration/common diff --git a/test/integration/config_array/inspec.yml b/test/integration/config_array/inspec.yml index 2cd4e58a..1f17eb26 100644 --- a/test/integration/config_array/inspec.yml +++ b/test/integration/config_array/inspec.yml @@ -2,9 +2,6 @@ name: haproxy-config-array title: HAProxy Config Array Suite summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd depends: - name: haproxy-common path: test/integration/common diff --git a/test/integration/config_backend_search/inspec.yml b/test/integration/config_backend_search/inspec.yml index b04dbb42..2481bc46 100644 --- a/test/integration/config_backend_search/inspec.yml +++ b/test/integration/config_backend_search/inspec.yml @@ -2,9 +2,6 @@ name: haproxy-config-backend-search title: HAProxy Config Backend Search Suite summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd depends: - name: haproxy-common path: test/integration/common diff --git a/test/integration/config_custom_template/inspec.yml b/test/integration/config_custom_template/inspec.yml index 76a88404..6c3d9a9f 100644 --- a/test/integration/config_custom_template/inspec.yml +++ b/test/integration/config_custom_template/inspec.yml @@ -2,9 +2,6 @@ name: haproxy-config-custom-template title: HAProxy Config Custom Template Suite summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd depends: - name: haproxy-common path: test/integration/common diff --git a/test/integration/config_fastcgi/inspec.yml b/test/integration/config_fastcgi/inspec.yml index f82aa3b5..50e4d5bf 100644 --- a/test/integration/config_fastcgi/inspec.yml +++ b/test/integration/config_fastcgi/inspec.yml @@ -2,9 +2,6 @@ name: haproxy-config-fast-csgi title: HAProxy Config FastCGI Suite summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd depends: - name: haproxy-common path: test/integration/common diff --git a/test/integration/config_resolver/inspec.yml b/test/integration/config_resolver/inspec.yml index 1e05e069..0ba379f0 100644 --- a/test/integration/config_resolver/inspec.yml +++ b/test/integration/config_resolver/inspec.yml @@ -2,9 +2,6 @@ name: haproxy-config-resolver title: HAProxy Config Resolver Suite summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd depends: - name: haproxy-common path: test/integration/common diff --git a/test/integration/config_ssl_redirect/inspec.yml b/test/integration/config_ssl_redirect/inspec.yml index 69a7304a..3b1eaa18 100644 --- a/test/integration/config_ssl_redirect/inspec.yml +++ b/test/integration/config_ssl_redirect/inspec.yml @@ -2,9 +2,6 @@ name: haproxy-config-ssl-redirect title: HAProxy Config SSL Redirect Suite summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd depends: - name: haproxy-common path: test/integration/common diff --git a/test/integration/default/inspec.yml b/test/integration/default/inspec.yml index ae4bad9e..a99dfb97 100644 --- a/test/integration/default/inspec.yml +++ b/test/integration/default/inspec.yml @@ -2,8 +2,6 @@ name: haproxy-default title: HAProxy Default Suite summary: HAProxy default tests using package installation -supports: - - os-family: linux depends: - name: haproxy-common path: test/integration/common diff --git a/test/integration/package/inspec.yml b/test/integration/package/inspec.yml index 456dce74..f8fd87cb 100644 --- a/test/integration/package/inspec.yml +++ b/test/integration/package/inspec.yml @@ -2,9 +2,6 @@ name: haproxy-package title: HAProxy Package Suite summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd depends: - name: haproxy-common path: test/integration/common diff --git a/test/integration/source-default/inspec.yml b/test/integration/source-default/inspec.yml index 093a205a..7b4fe336 100644 --- a/test/integration/source-default/inspec.yml +++ b/test/integration/source-default/inspec.yml @@ -2,9 +2,6 @@ name: haproxy-source-default title: HAProxy Source Default summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd depends: - name: haproxy-common path: test/integration/common diff --git a/test/integration/source_3.2/inspec.yml b/test/integration/source_3.2/inspec.yml index 5f61d18e..f1d912fb 100644 --- a/test/integration/source_3.2/inspec.yml +++ b/test/integration/source_3.2/inspec.yml @@ -2,9 +2,6 @@ name: haproxy-source-3.2 title: HAProxy Source Suite summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd depends: - name: haproxy-common path: test/integration/common diff --git a/test/integration/source_lua/inspec.yml b/test/integration/source_lua/inspec.yml index 8c4969df..84f6afcd 100644 --- a/test/integration/source_lua/inspec.yml +++ b/test/integration/source_lua/inspec.yml @@ -2,9 +2,6 @@ name: haproxy-source-lua title: HAProxy Source Suite summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd depends: - name: haproxy-common path: test/integration/common diff --git a/test/integration/source_openssl/inspec.yml b/test/integration/source_openssl/inspec.yml index a9ca57e8..f5b8fd5c 100644 --- a/test/integration/source_openssl/inspec.yml +++ b/test/integration/source_openssl/inspec.yml @@ -2,7 +2,4 @@ name: haproxy-open-ssl title: HAProxy OpenSSL Suite summary: HAProxy tests using example configuration -supports: - - os-family: linux - - os-family: bsd depends: [] From 9a7c02326b18e222b87553ed32d9c9a855142f5a Mon Sep 17 00:00:00 2001 From: Dan Webb Date: Thu, 30 Jul 2026 16:47:45 +0100 Subject: [PATCH 10/14] fix: align source suite CI name --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e237c41c..b27b0680 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -46,7 +46,7 @@ jobs: suite: - default - package - - source-3.2 + - source-32 - source-default - source-lua - source-openssl From 6b3ede8482d8585dba797bfb529b1f837536c6c7 Mon Sep 17 00:00:00 2001 From: Dan Webb Date: Thu, 30 Jul 2026 18:52:46 +0100 Subject: [PATCH 11/14] fix: align search fixture environment --- test/integration/nodes/be-1.json | 3 ++- test/integration/nodes/be-2.json | 19 ++++++++++--------- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/test/integration/nodes/be-1.json b/test/integration/nodes/be-1.json index ccdb84a2..75d54585 100644 --- a/test/integration/nodes/be-1.json +++ b/test/integration/nodes/be-1.json @@ -1,9 +1,10 @@ { "id": "be-1", + "chef_environment": "local", "run_list": ["role[app]"], "automatic": { "hostname": "be-1", "ipaddress": "10.0.0.75", "roles": ["app"] } -} \ No newline at end of file +} diff --git a/test/integration/nodes/be-2.json b/test/integration/nodes/be-2.json index 332e5839..70778858 100644 --- a/test/integration/nodes/be-2.json +++ b/test/integration/nodes/be-2.json @@ -1,9 +1,10 @@ -{ - "id": "be-2", - "run_list": ["role[app]"], - "automatic": { - "hostname": "be-2", - "ipaddress": "10.0.0.76", - "roles": ["app"] - } -} \ No newline at end of file +{ + "id": "be-2", + "chef_environment": "local", + "run_list": ["role[app]"], + "automatic": { + "hostname": "be-2", + "ipaddress": "10.0.0.76", + "roles": ["app"] + } +} From e57e6abf70033d24c0a85adbf9061be51f418876 Mon Sep 17 00:00:00 2001 From: Dan Webb Date: Thu, 30 Jul 2026 18:55:55 +0100 Subject: [PATCH 12/14] fix: grant PR title check permission --- .github/workflows/conventional-commits.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/conventional-commits.yml b/.github/workflows/conventional-commits.yml index 27c31091..e91ced69 100644 --- a/.github/workflows/conventional-commits.yml +++ b/.github/workflows/conventional-commits.yml @@ -9,6 +9,9 @@ name: conventional-commits - edited - synchronize +permissions: + pull-requests: read + jobs: conventional-commits: uses: sous-chefs/.github/.github/workflows/conventional-commits.yml@9.0.0 From b7dffc3e47fb6d207f24f76b5d8ed7eff786ee7b Mon Sep 17 00:00:00 2001 From: Dan Webb Date: Thu, 30 Jul 2026 19:07:16 +0100 Subject: [PATCH 13/14] fix: remove unsupported bind-process test --- test/cookbooks/test/recipes/config_3.rb | 2 -- test/integration/config_3/controls/config_spec.rb | 7 +------ 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/test/cookbooks/test/recipes/config_3.rb b/test/cookbooks/test/recipes/config_3.rb index 852aa51d..1175a91a 100644 --- a/test/cookbooks/test/recipes/config_3.rb +++ b/test/cookbooks/test/recipes/config_3.rb @@ -34,8 +34,6 @@ http_response 'set-header Expires %[date(3600),http_date]' default_backend 'servers' option %w(dontlog-normal) - # bind-process is deprecated in HAProxy 2.5+ and removed in 3.x - extra_options('bind-process' => 'odd') unless node['platform_version'].to_i >= 10 hash_type 'consistent' end diff --git a/test/integration/config_3/controls/config_spec.rb b/test/integration/config_3/controls/config_spec.rb index e0b26776..26c3b273 100644 --- a/test/integration/config_3/controls/config_spec.rb +++ b/test/integration/config_3/controls/config_spec.rb @@ -72,14 +72,9 @@ ' http-response set-header Expires %\[date\(3600\),http_date\]', ' default_backend servers', ' option dontlog-normal', + ' hash-type consistent', ] -platform_version = os.release.to_i -if platform_version < 10 - cfg_content << ' bind-process odd' -end -cfg_content << ' hash-type consistent' - describe file('/etc/haproxy/haproxy.cfg') do its('content') { should match(/#{cfg_content.join('\n')}/) } end From 36d2279208868b57d89a2c902abe31f9a60e339b Mon Sep 17 00:00:00 2001 From: Dan Webb Date: Thu, 30 Jul 2026 19:45:43 +0100 Subject: [PATCH 14/14] fix: pin custom OpenSSL library path --- test/cookbooks/test/recipes/source_openssl.rb | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/test/cookbooks/test/recipes/source_openssl.rb b/test/cookbooks/test/recipes/source_openssl.rb index bdc9613c..826223ef 100644 --- a/test/cookbooks/test/recipes/source_openssl.rb +++ b/test/cookbooks/test/recipes/source_openssl.rb @@ -9,7 +9,10 @@ package %w(perl-FindBin perl-lib perl-File-Compare perl-File-Copy perl-IPC-Cmd perl-Pod-Html perl-Time-Piece) else # EL8 bundles perl modules in perl-core, individual packages don't exist - package %w(perl-core perl-IPC-Cmd) + package 'perl-core' do + not_if { ::File.exist?('/usr/bin/perl') } + end + package 'perl-IPC-Cmd' end when 'debian' package %w(perl zlib1g-dev) @@ -17,13 +20,6 @@ package %w(perl zlib-devel) end -# override environment variable -ruby_block 'Pre-load OpenSSL path' do - block do - ENV['PATH'] = "/usr/local/openssl/bin:#{ENV['PATH']}" - end -end - openssl_version = '3.5.5' # download openssl @@ -41,7 +37,7 @@ # compile openssl execute "package_openssl-#{openssl_version}" do command <<-COMPILE - ./config --prefix=/usr/local/openssl/ --openssldir=/usr/local/openssl/ shared zlib + ./config --prefix=/usr/local/openssl/ --openssldir=/usr/local/openssl/ --libdir=lib shared zlib make make install COMPILE