Skip to main content
DevOps

Return to Answer

added 4 characters in body
Source Link
Adam Winter
Adam Winter
  • 171
  • 1
  • 4

I figured it out., and SELinux is the difference. That is, SELinux on the HAProxy host (not a cluster node):

"SELinux only allows the web server to make outbound connections to a limited set of ports"

That is, you can't make an outbound http request to any port in the NodePort range (30000-32768) without opening that port on the "client", which is the HAProxy server in this case.

sudo semanage port --add --type http_port_t --proto tcp 30080

More specifically, I guess, the security context that HAProxy runs under is different than curl.

I figured it out. SELinux is the difference. That is, SELinux on the HAProxy host (not a cluster node):

"SELinux only allows the web server to make outbound connections to a limited set of ports"

That is, you can't make an outbound http request to any port in the NodePort range (30000-32768) without opening that port on the "client", which is the HAProxy server in this case.

sudo semanage port --add --type http_port_t --proto tcp 30080

More specifically, I guess, the security context that HAProxy runs under is different than curl.

I figured it out, and SELinux is the difference. That is, SELinux on the HAProxy host (not a cluster node):

"SELinux only allows the web server to make outbound connections to a limited set of ports"

That is, you can't make an outbound http request to any port in the NodePort range (30000-32768) without opening that port on the "client", which is the HAProxy server in this case.

sudo semanage port --add --type http_port_t --proto tcp 30080

More specifically, I guess, the security context that HAProxy runs under is different than curl.

added 4 characters in body
Source Link
Adam Winter
Adam Winter
  • 171
  • 1
  • 4

I figured it out. SELinux is the difference. That is, SELinux on the HAProxy host (not a cluster node):

"SELinux only allows the web server to make outbound connections to a limited set of ports"

That is, you can't make an outbound http request to any port in the NodePort range (30000-32768) without opening that port on the "client", which is the HAProxy server in this case.

sudo semanage port --add --type http_port_t --proto tcp 30080

More specifically, I guess, the security context that HAProxy runs under is different than curl.

I figured it out. SELinux is the difference. That is, SELinux on the HAProxy host (not a cluster node):

"SELinux only allows the web server to make outbound connections to a limited set of ports"

That is, you can't make an outbound http request to any port in the NodePort range (30000-32768) without opening that port on the "client", which is the HAProxy server in this case.

sudo semanage port --add --type http_port_t --proto tcp 30080

More specifically, I guess, security context that HAProxy runs under is different than curl.

I figured it out. SELinux is the difference. That is, SELinux on the HAProxy host (not a cluster node):

"SELinux only allows the web server to make outbound connections to a limited set of ports"

That is, you can't make an outbound http request to any port in the NodePort range (30000-32768) without opening that port on the "client", which is the HAProxy server in this case.

sudo semanage port --add --type http_port_t --proto tcp 30080

More specifically, I guess, the security context that HAProxy runs under is different than curl.

Source Link
Adam Winter
Adam Winter
  • 171
  • 1
  • 4

I figured it out. SELinux is the difference. That is, SELinux on the HAProxy host (not a cluster node):

"SELinux only allows the web server to make outbound connections to a limited set of ports"

That is, you can't make an outbound http request to any port in the NodePort range (30000-32768) without opening that port on the "client", which is the HAProxy server in this case.

sudo semanage port --add --type http_port_t --proto tcp 30080

More specifically, I guess, security context that HAProxy runs under is different than curl.