如何借助DataPlaneApi实现HAProxy动态更新AWS ASG后端服务器

一、环境准备 #

• 确保HAProxy版本≥2.0（DataPlane API对HAProxy版本有最低要求）
• 安装HAProxy DataPlane API，确保它能访问HAProxy配置中指定的admin socket（即/run/haproxy/admin.sock）
• 为运行DataPlane API的实例配置IAM权限，需包含：
  • autoscaling:DescribeAutoScalingGroups：获取目标ASG的基本信息
  • ec2:DescribeInstances：查询ASG下实例的私网IP与运行状态
    建议通过IAM角色挂载实例，避免硬编码密钥。

二、DataPlane API基础配置 #

创建DataPlane API配置文件（如dataplaneapi.cfg），核心配置如下：

global:
  haproxy_bin: /usr/sbin/haproxy
  haproxy_cfg: /etc/haproxy/haproxy.cfg
  haproxy_socket: /run/haproxy/admin.sock
  server:
    host: 0.0.0.0
    port: 5555
    tls: false

启动DataPlane API：

dataplaneapi -f dataplaneapi.cfg

三、HAProxy配置调整 #

修改原有HAProxy配置，移除server-template规则，改为空后端（后续由API动态添加服务器）：

global
  daemon
  chroot /var/lib/haproxy
  user haproxy
  group haproxy
  ca-base /etc/ssl/certs
  crt-base /etc/ssl/private
  stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
  stats socket /var/run/haproxy.sock user haproxy group haproxy mode 660 level admin expose-fd listeners
  stats timeout 30s
  ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
  ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
  ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
  log /dev/log local0
  log /dev/log local1 notice

defaults unnamed_defaults_1
  mode http
  log global
  option httplog
  option dontlognull
  timeout connect 5000
  timeout client 50000
  timeout server 50000
  errorfile 400 /etc/haproxy/errors/400.http
  errorfile 403 /etc/haproxy/errors/403.http
  errorfile 408 /etc/haproxy/errors/408.http
  errorfile 500 /etc/haproxy/errors/500.http
  errorfile 502 /etc/haproxy/errors/502.http
  errorfile 503 /etc/haproxy/errors/503.http
  errorfile 504 /etc/haproxy/errors/504.http

frontend main
  bind *:80
  bind *:443 ssl crt /etc/haproxy/cl-secret1.pem crt /etc/haproxy/cl-secret2.pem
  acl app1 hdr(host) -i cloud-app1.priv.url
  acl app2 hdr(host) -i cloud-app2.priv.url
  use_backend backend1 if app1
  use_backend backend2 if app2

backend backend1
  balance source
  # 空后端，由DataPlane API动态维护服务器列表

backend backend2
  balance source
  # 空后端，由DataPlane API动态维护服务器列表

重新加载HAProxy使配置生效：

systemctl reload haproxy

四、编写自动同步脚本 #

编写Python脚本，定期拉取ASG实例私网IP，对比HAProxy当前后端服务器列表，通过DataPlane API完成增删操作：

import boto3
import requests

# 配置参数
ASG_NAME = "你的ASG名称"
HAPROXY_DATAPLANE_URL = "http://localhost:5555/v2"
BACKEND_NAMES = ["backend1", "backend2"]
INSTANCE_PORT = 443

# 获取ASG内运行中实例的私网IP
def get_asg_private_ips():
    autoscaling = boto3.client('autoscaling')
    ec2 = boto3.client('ec2')
    asg_info = autoscaling.describe_auto_scaling_groups(AutoScalingGroupNames=[ASG_NAME])['AutoScalingGroups'][0]
    instance_ids = [inst['InstanceId'] for inst in asg_info['Instances'] if inst['LifecycleState'] == 'InService']
    if not instance_ids:
        return []
    ec2_info = ec2.describe_instances(InstanceIds=instance_ids)['Reservations']
    private_ips = []
    for res in ec2_info:
        for inst in res['Instances']:
            if inst['State']['Name'] == 'running':
                private_ips.append(inst['PrivateIpAddress'])
    return private_ips

# 获取HAProxy指定后端的当前服务器IP列表
def get_current_backend_servers(backend_name):
    api_url = f"{HAPROXY_DATAPLANE_URL}/services/haproxy/configuration/servers?backend={backend_name}"
    resp = requests.get(api_url)
    resp.raise_for_status()
    return [server['address'] for server in resp.json()['data']]

# 向HAProxy后端添加服务器
def add_server(backend_name, ip):
    server_data = {
        "name": f"srv-{ip.replace('.', '-')}",
        "address": ip,
        "port": INSTANCE_PORT,
        "check": "enabled"  # 启用健康检查，可选
    }
    api_url = f"{HAPROXY_DATAPLANE_URL}/services/haproxy/configuration/servers?backend={backend_name}"
    resp = requests.post(api_url, json=server_data)
    resp.raise_for_status()

# 从HAProxy后端移除服务器
def remove_server(backend_name, ip):
    server_name = f"srv-{ip.replace('.', '-')}"
    api_url = f"{HAPROXY_DATAPLANE_URL}/services/haproxy/configuration/servers/{server_name}?backend={backend_name}"
    resp = requests.delete(api_url)
    resp.raise_for_status()

# 同步ASG实例到HAProxy后端
def sync_asg_to_haproxy():
    asg_ips = get_asg_private_ips()
    for backend in BACKEND_NAMES:
        current_ips = get_current_backend_servers(backend)
        # 添加新实例IP
        for ip in asg_ips:
            if ip not in current_ips:
                add_server(backend, ip)
        # 移除已销毁实例IP
        for ip in current_ips:
            if ip not in asg_ips:
                remove_server(backend, ip)
    # 热加载HAProxy配置
    requests.post(f"{HAPROXY_DATAPLANE_URL}/services/haproxy/runtime/load")

if __name__ == "__main__":
    sync_asg_to_haproxy()

五、设置定时任务 #

通过cron定期执行同步脚本，实现实时更新：

# 编辑crontab
crontab -e
# 添加定时任务（每分钟执行一次）
* * * * * /usr/bin/python3 /path/to/your/sync_script.py >> /var/log/haproxy_sync.log 2>&1

六、验证与调试 #

• 查看HAProxy stats页面（可在配置中开启stats模块），确认后端服务器列表自动更新
• 检查定时任务日志/var/log/haproxy_sync.log，排查脚本执行异常
• 手动触发ASG扩缩容，观察HAProxy后端是否自动完成服务器增删

内容的提问来源于stack exchange，提问作者Sammy