Skip to Content

Wiki source code of HA Proxy

Version 1.1 by Sungwon Lee on 2026/07/05 03:53
Hide last authors
Sungwon Lee 1.1 1 etc/haproxy/haproxy.cfg
2
3 {{code}}
4 # =====================================================================
5 # 1. HTTP (Port 80) Configuration
6 # =====================================================================
7 frontend k8s_http_frontend
8 bind 10.10.3.130:80
9 mode http
10 option httplog
11 option forwardfor
12 # ACL based on domain
13 acl is_testweb hdr(host) -i testweb.sysproto.com
14 acl is_kubeui hdr(host) -i kubeui.sysproto.com
15 # Backend mapping by domain
16 use_backend k8s_gateway_http_backend if is_testweb
17 use_backend k8s_dashboard_http_backend if is_kubeui
18
19 # --- Existing HTTP backend for testweb ---
20 backend k8s_gateway_http_backend
21 mode http
22 balance roundrobin
23 # Updated to standard syntax for v2.8
24 option httpchk
25 http-check send meth GET uri / ver HTTP/1.1 hdr Host testweb.sysproto.com
26 http-check expect status 200
27 server vdevk8s05 10.10.1.35:32542 check inter 2s fall 3 rise 2
28 server vdevk8s06 10.10.1.36:32542 check inter 2s fall 3 rise 2
29
30 # --- New HTTP backend for kubeui dashboard ---
31 backend k8s_dashboard_http_backend
32 mode http
33 balance roundrobin
34 # Updated to standard syntax for v2.8
35 option httpchk
36 http-check send meth GET uri / ver HTTP/1.1 hdr Host kubeui.sysproto.com
37 http-check expect status 200-499
38 server vdevk8s05 10.10.1.35:32542 check inter 2s fall 3 rise 2
39 server vdevk8s06 10.10.1.36:32542 check inter 2s fall 3 rise 2
40
41 # =====================================================================
42 # 2. HTTPS (Port 443) Configuration - Pure TCP Pass-Through
43 # =====================================================================
44 frontend k8s_https_frontend
45 bind 10.10.3.130:443
46 mode tcp # http-request directives cannot be used in tcp mode
47 option tcplog
48 # Inspect SNI (domain from TLS handshake)
49 tcp-request inspect-delay 5s
50 tcp-request content accept if { req_ssl_hello_type 1 }
51 # ACL based on domain (via SNI)
52 acl sn_testweb req_ssl_sni -i testweb.sysproto.com
53 acl sn_kubeui req_ssl_sni -i kubeui.sysproto.com
54 use_backend k8s_gateway_https_backend if sn_testweb
55 use_backend k8s_dashboard_https_backend if sn_kubeui
56
57 # --- Existing HTTPS backend for testweb ---
58 backend k8s_gateway_https_backend
59 mode tcp # Backend must also be tcp to avoid corrupting data when frontend is tcp
60 balance roundrobin
61 server vdevk8s05 10.10.1.35:32585 check inter 2s fall 3 rise 2
62 server vdevk8s06 10.10.1.36:32585 check inter 2s fall 3 rise 2
63
64 # --- New HTTPS backend for kubeui dashboard ---
65 backend k8s_dashboard_https_backend
66 mode tcp # Passes through directly to port 32585 (Cilium NodePort) without SSL decryption
67 balance roundrobin
68 server vdevk8s05 10.10.1.35:32585 check inter 2s fall 3 rise 2
69 server vdevk8s06 10.10.1.36:32585 check inter 2s fall 3 rise 2
70
71 {{/code}}
72
73
74 {{code}}
75 vrrp_script check_haproxy {
76 script "killall -0 haproxy" # Check if HAProxy process is running
77 interval 2
78 weight 2
79 }
80
81 vrrp_instance VI_1 {
82 state MASTER
83 interface ens3 # Change to your actual 10.10.3.0/24 interface name (e.g., ens4, eth1)
84 virtual_router_id 51 # Must match between MASTER and BACKUP
85 priority 101 # Higher priority than BACKUP
86 advert_int 1
87
88 authentication {
89 auth_type PASS
90 auth_pass k8s_secret # Must match between MASTER and BACKUP
91 }
92
93 unicast_src_ip 10.10.3.131
94 unicast_peer {
95 10.10.3.132
96 }
97
98 virtual_ipaddress {
99 10.10.3.130/24 # Shared Virtual IP (VIP) for service network
100 }
101
102 track_script {
103 check_haproxy
104 }
105 }
106
107 {{/code}}