Summary

Adds a new valueless option: set load-balancing haproxy backend <name> ssl checks-only. Turn it on and the backend's existing ssl settings apply only to health checks, not to the actual traffic: the generated HAProxy server lines get check-ssl verify none or check-ssl ca-file <ca>.pem instead of ssl ..., so forwarded traffic is left alone. In short, this exposes HAProxy's per-server check-ssl keyword, which the CLI currently has no way to express. Existing configs render exactly as before.

Use case

Load balancing Kubernetes API servers behind HAProxy in TCP passthrough mode: traffic has to stay passthrough because clients do end-to-end TLS client-cert auth, but the health check should still hit GET /readyz over HTTPS, so traffic only ever routes to nodes that are actually healthy, not just nodes that happen to still be accepting TCP (e.g. an apiserver that's lost etcd quorum but hasn't dropped its socket). Right now that's not possible: http-check only ever sends plaintext, and the one existing TLS option (backend <name> ssl no-verify|ca-certificate) puts ssl on the HAProxy server lines, which re-encrypts the forwarded traffic and breaks every passthrough connection. So today you're stuck with plain TCP checks.

Additional information

Example:

set load-balancing haproxy backend k8s-api mode tcp
set load-balancing haproxy backend k8s-api http-check method get
set load-balancing haproxy backend k8s-api http-check uri /readyz
set load-balancing haproxy backend k8s-api http-check expect status 200
set load-balancing haproxy backend k8s-api ssl no-verify
set load-balancing haproxy backend k8s-api ssl checks-only
set load-balancing haproxy backend k8s-api server node1 address 192.0.2.10
set load-balancing haproxy backend k8s-api server node1 port 6443
set load-balancing haproxy backend k8s-api server node1 check

which renders as server node1 192.0.2.10:6443 check check-ssl verify none.

Why a backend-level flag instead of a per-server check ssl option? Because HAProxy's trust settings (verify/ca-file) are already shared per server line between ssl and check-ssl, and the CLI's existing ssl node already holds them, so this reuses config that's already there rather than adding new PKI handling. Commit validation rejects checks-only if no server on the backend has check enabled, or if neither no-verify nor ca-certificate is set.