Skip to Content

Wiki source code of HA Proxy

Last modified by Sungwon Lee on 2026/07/05 03:54
Hide last authors
Sungwon Lee 1.1 1 etc/haproxy/haproxy.cfg
2
Sungwon Lee 2.1 3 1번노드, 2번노드 동일 설정
4
Sungwon Lee 1.1 5 {{code}}
6 # =====================================================================
7 # 1. HTTP (Port 80) Configuration
8 # =====================================================================
9 frontend k8s_http_frontend
10 bind 10.10.3.130:80
11 mode http
12 option httplog
13 option forwardfor
14 # ACL based on domain
15 acl is_testweb hdr(host) -i testweb.sysproto.com
16 acl is_kubeui hdr(host) -i kubeui.sysproto.com
17 # Backend mapping by domain
18 use_backend k8s_gateway_http_backend if is_testweb
19 use_backend k8s_dashboard_http_backend if is_kubeui
20
21 # --- Existing HTTP backend for testweb ---
22 backend k8s_gateway_http_backend
23 mode http
24 balance roundrobin
25 # Updated to standard syntax for v2.8
26 option httpchk
27 http-check send meth GET uri / ver HTTP/1.1 hdr Host testweb.sysproto.com
28 http-check expect status 200
29 server vdevk8s05 10.10.1.35:32542 check inter 2s fall 3 rise 2
30 server vdevk8s06 10.10.1.36:32542 check inter 2s fall 3 rise 2
31
32 # --- New HTTP backend for kubeui dashboard ---
33 backend k8s_dashboard_http_backend
34 mode http
35 balance roundrobin
36 # Updated to standard syntax for v2.8
37 option httpchk
38 http-check send meth GET uri / ver HTTP/1.1 hdr Host kubeui.sysproto.com
39 http-check expect status 200-499
40 server vdevk8s05 10.10.1.35:32542 check inter 2s fall 3 rise 2
41 server vdevk8s06 10.10.1.36:32542 check inter 2s fall 3 rise 2
42
43 # =====================================================================
44 # 2. HTTPS (Port 443) Configuration - Pure TCP Pass-Through
45 # =====================================================================
46 frontend k8s_https_frontend
47 bind 10.10.3.130:443
48 mode tcp # http-request directives cannot be used in tcp mode
49 option tcplog
50 # Inspect SNI (domain from TLS handshake)
51 tcp-request inspect-delay 5s
52 tcp-request content accept if { req_ssl_hello_type 1 }
53 # ACL based on domain (via SNI)
54 acl sn_testweb req_ssl_sni -i testweb.sysproto.com
55 acl sn_kubeui req_ssl_sni -i kubeui.sysproto.com
56 use_backend k8s_gateway_https_backend if sn_testweb
57 use_backend k8s_dashboard_https_backend if sn_kubeui
58
59 # --- Existing HTTPS backend for testweb ---
60 backend k8s_gateway_https_backend
61 mode tcp # Backend must also be tcp to avoid corrupting data when frontend is tcp
62 balance roundrobin
63 server vdevk8s05 10.10.1.35:32585 check inter 2s fall 3 rise 2
64 server vdevk8s06 10.10.1.36:32585 check inter 2s fall 3 rise 2
65
66 # --- New HTTPS backend for kubeui dashboard ---
67 backend k8s_dashboard_https_backend
68 mode tcp # Passes through directly to port 32585 (Cilium NodePort) without SSL decryption
69 balance roundrobin
70 server vdevk8s05 10.10.1.35:32585 check inter 2s fall 3 rise 2
71 server vdevk8s06 10.10.1.36:32585 check inter 2s fall 3 rise 2
72
73 {{/code}}
74
Sungwon Lee 1.2 75 /etc/keepalived/keepalived.conf
Sungwon Lee 1.1 76
77 {{code}}
78 vrrp_script check_haproxy {
79 script "killall -0 haproxy" # Check if HAProxy process is running
80 interval 2
81 weight 2
82 }
83
84 vrrp_instance VI_1 {
85 state MASTER
86 interface ens3 # Change to your actual 10.10.3.0/24 interface name (e.g., ens4, eth1)
87 virtual_router_id 51 # Must match between MASTER and BACKUP
88 priority 101 # Higher priority than BACKUP
89 advert_int 1
90
91 authentication {
92 auth_type PASS
93 auth_pass k8s_secret # Must match between MASTER and BACKUP
94 }
95
96 unicast_src_ip 10.10.3.131
97 unicast_peer {
98 10.10.3.132
99 }
100
101 virtual_ipaddress {
102 10.10.3.130/24 # Shared Virtual IP (VIP) for service network
103 }
104
105 track_script {
106 check_haproxy
107 }
108 }
109
110 {{/code}}
Sungwon Lee 1.2 111
112 2번 노드
113
114 {{code}}
115 vrrp_script check_haproxy {
116 script "killall -0 haproxy"
117 interval 2
118 weight 2
119 }
120
121 vrrp_instance VI_1 {
122 state BACKUP # Set to BACKUP
123 interface ens3 # Change to your actual 10.10.3.0/24 interface name
124 virtual_router_id 51 # Must match MASTER
125 priority 100 # Lower priority than MASTER
126 advert_int 1
127
128 authentication {
129 auth_type PASS
130 auth_pass k8s_secret # Must match MASTER
131 }
132
133 unicast_src_ip 10.10.3.132
134 unicast_peer {
135 10.10.3.131
136 }
137
138 virtual_ipaddress {
139 10.10.3.130/24 # Same Virtual IP (VIP) as MASTER
140 }
141
142 track_script {
143 check_haproxy
144 }
145 }
146
147 {{/code}}
Sungwon Lee 2.1 148
149