Skip to Content

Wiki source code of HA Proxy

Version 1.2 by Sungwon Lee on 2026/07/05 03:54
Hide last authors
Sungwon Lee 1.1 1 etc/haproxy/haproxy.cfg
2
3 {{code}}
4 # =====================================================================
5 # 1. HTTP (Port 80) Configuration
6 # =====================================================================
7 frontend k8s_http_frontend
8 bind 10.10.3.130:80
9 mode http
10 option httplog
11 option forwardfor
12 # ACL based on domain
13 acl is_testweb hdr(host) -i testweb.sysproto.com
14 acl is_kubeui hdr(host) -i kubeui.sysproto.com
15 # Backend mapping by domain
16 use_backend k8s_gateway_http_backend if is_testweb
17 use_backend k8s_dashboard_http_backend if is_kubeui
18
19 # --- Existing HTTP backend for testweb ---
20 backend k8s_gateway_http_backend
21 mode http
22 balance roundrobin
23 # Updated to standard syntax for v2.8
24 option httpchk
25 http-check send meth GET uri / ver HTTP/1.1 hdr Host testweb.sysproto.com
26 http-check expect status 200
27 server vdevk8s05 10.10.1.35:32542 check inter 2s fall 3 rise 2
28 server vdevk8s06 10.10.1.36:32542 check inter 2s fall 3 rise 2
29
30 # --- New HTTP backend for kubeui dashboard ---
31 backend k8s_dashboard_http_backend
32 mode http
33 balance roundrobin
34 # Updated to standard syntax for v2.8
35 option httpchk
36 http-check send meth GET uri / ver HTTP/1.1 hdr Host kubeui.sysproto.com
37 http-check expect status 200-499
38 server vdevk8s05 10.10.1.35:32542 check inter 2s fall 3 rise 2
39 server vdevk8s06 10.10.1.36:32542 check inter 2s fall 3 rise 2
40
41 # =====================================================================
42 # 2. HTTPS (Port 443) Configuration - Pure TCP Pass-Through
43 # =====================================================================
44 frontend k8s_https_frontend
45 bind 10.10.3.130:443
46 mode tcp # http-request directives cannot be used in tcp mode
47 option tcplog
48 # Inspect SNI (domain from TLS handshake)
49 tcp-request inspect-delay 5s
50 tcp-request content accept if { req_ssl_hello_type 1 }
51 # ACL based on domain (via SNI)
52 acl sn_testweb req_ssl_sni -i testweb.sysproto.com
53 acl sn_kubeui req_ssl_sni -i kubeui.sysproto.com
54 use_backend k8s_gateway_https_backend if sn_testweb
55 use_backend k8s_dashboard_https_backend if sn_kubeui
56
57 # --- Existing HTTPS backend for testweb ---
58 backend k8s_gateway_https_backend
59 mode tcp # Backend must also be tcp to avoid corrupting data when frontend is tcp
60 balance roundrobin
61 server vdevk8s05 10.10.1.35:32585 check inter 2s fall 3 rise 2
62 server vdevk8s06 10.10.1.36:32585 check inter 2s fall 3 rise 2
63
64 # --- New HTTPS backend for kubeui dashboard ---
65 backend k8s_dashboard_https_backend
66 mode tcp # Passes through directly to port 32585 (Cilium NodePort) without SSL decryption
67 balance roundrobin
68 server vdevk8s05 10.10.1.35:32585 check inter 2s fall 3 rise 2
69 server vdevk8s06 10.10.1.36:32585 check inter 2s fall 3 rise 2
70
71 {{/code}}
72
Sungwon Lee 1.2 73 /etc/keepalived/keepalived.conf
Sungwon Lee 1.1 74
75 {{code}}
76 vrrp_script check_haproxy {
77 script "killall -0 haproxy" # Check if HAProxy process is running
78 interval 2
79 weight 2
80 }
81
82 vrrp_instance VI_1 {
83 state MASTER
84 interface ens3 # Change to your actual 10.10.3.0/24 interface name (e.g., ens4, eth1)
85 virtual_router_id 51 # Must match between MASTER and BACKUP
86 priority 101 # Higher priority than BACKUP
87 advert_int 1
88
89 authentication {
90 auth_type PASS
91 auth_pass k8s_secret # Must match between MASTER and BACKUP
92 }
93
94 unicast_src_ip 10.10.3.131
95 unicast_peer {
96 10.10.3.132
97 }
98
99 virtual_ipaddress {
100 10.10.3.130/24 # Shared Virtual IP (VIP) for service network
101 }
102
103 track_script {
104 check_haproxy
105 }
106 }
107
108 {{/code}}
Sungwon Lee 1.2 109
110 2번 노드
111
112 {{code}}
113 vrrp_script check_haproxy {
114 script "killall -0 haproxy"
115 interval 2
116 weight 2
117 }
118
119 vrrp_instance VI_1 {
120 state BACKUP # Set to BACKUP
121 interface ens3 # Change to your actual 10.10.3.0/24 interface name
122 virtual_router_id 51 # Must match MASTER
123 priority 100 # Lower priority than MASTER
124 advert_int 1
125
126 authentication {
127 auth_type PASS
128 auth_pass k8s_secret # Must match MASTER
129 }
130
131 unicast_src_ip 10.10.3.132
132 unicast_peer {
133 10.10.3.131
134 }
135
136 virtual_ipaddress {
137 10.10.3.130/24 # Same Virtual IP (VIP) as MASTER
138 }
139
140 track_script {
141 check_haproxy
142 }
143 }
144
145 {{/code}}