use a single backend if content-cache is fronting a single k8s cluster

[Junien F]

Hi,

In the case where content-cache is fronting a single k8s cluster, it might make sense to use a single backend in haproxy.

I'm not sure having one health-check per _site_ makes sense in this context. The k8s cluster has its own ingress and its own health-checks, and will reroute traffic if needed.

This would avoid requiring to have all the certificates in the k8s cluster, as haproxy=>k8s could use a single certificate and route traffic based on the Host header as normal.

This would allow better connection reuse, and reduce TLS handshakes.

[Haw Loeung (hloeung)]

I think this is a good idea, especially for content caches where there are lots of sites defined, most of which are low traffic.

I think we can implement this in the backend HAProxy layer where either a sites configuration option to collapse or a global charm option to collapse backends if it detects that there are multiple definitions with the same set of backends.

We'll still want multiple sites in Nginx, separate and isolated cache.

Not sure about the bit with having a single certificate though.

[Junien F (axino)]

"Not sure about the bit with having a single certificate though."

This is actually very important. Without a single certificate, haproxy won't be able to reuse connections because the SNI of connections to forward requests for 2 different sites will be different, and according to haproxy doc :

  - connections sent to a server with a TLS SNI extension are marked private
    and are never shared;

https://cbonte.github.io/haproxy-dconv/2.2/configuration.html#4.2-http-reuse

The wording for 2.4 is a bit different :

When http connection sharing is enabled, a great care is taken to respect the
connection properties and compatibility. Indeed, some properties are specific
and it is not possibly to reuse it blindly. Those are the SSL SNI, source
and destination address and proxy protocol block. A connection is reused only
if it shares the same set of properties with the request.

https://cbonte.github.io/haproxy-dconv/2.4/configuration.html#4.2-http-reuse