HA Proxy

# =====================================================================
# 1. HTTP (Port 80) Configuration
# =====================================================================
frontend k8s_http_frontend
   bind 10.10.3.130:80
   mode http
   option httplog
   option forwardfor
    # ACL based on domain
   acl is_testweb hdr(host) -i testweb.sysproto.com
   acl is_kubeui  hdr(host) -i kubeui.sysproto.com
    # Backend mapping by domain
   use_backend k8s_gateway_http_backend if is_testweb
   use_backend k8s_dashboard_http_backend if is_kubeui

# --- Existing HTTP backend for testweb ---
backend k8s_gateway_http_backend
   mode http
   balance roundrobin
    # Updated to standard syntax for v2.8
   option httpchk
   http-check send meth GET uri / ver HTTP/1.1 hdr Host testweb.sysproto.com
   http-check expect status 200
   server vdevk8s05 10.10.1.35:32542 check inter 2s fall 3 rise 2
   server vdevk8s06 10.10.1.36:32542 check inter 2s fall 3 rise 2

# --- New HTTP backend for kubeui dashboard ---
backend k8s_dashboard_http_backend
   mode http
   balance roundrobin
    # Updated to standard syntax for v2.8
   option httpchk
   http-check send meth GET uri / ver HTTP/1.1 hdr Host kubeui.sysproto.com
   http-check expect status 200-499
   server vdevk8s05 10.10.1.35:32542 check inter 2s fall 3 rise 2
   server vdevk8s06 10.10.1.36:32542 check inter 2s fall 3 rise 2

# =====================================================================
# 2. HTTPS (Port 443) Configuration - Pure TCP Pass-Through
# =====================================================================
frontend k8s_https_frontend
   bind 10.10.3.130:443
   mode tcp             # http-request directives cannot be used in tcp mode
   option tcplog
    # Inspect SNI (domain from TLS handshake)
   tcp-request inspect-delay 5s
   tcp-request content accept if { req_ssl_hello_type 1 }
    # ACL based on domain (via SNI)
   acl sn_testweb req_ssl_sni -i testweb.sysproto.com
   acl sn_kubeui  req_ssl_sni -i kubeui.sysproto.com
   use_backend k8s_gateway_https_backend if sn_testweb
   use_backend k8s_dashboard_https_backend if sn_kubeui

# --- Existing HTTPS backend for testweb ---
backend k8s_gateway_https_backend
   mode tcp             # Backend must also be tcp to avoid corrupting data when frontend is tcp
   balance roundrobin
   server vdevk8s05 10.10.1.35:32585 check inter 2s fall 3 rise 2
   server vdevk8s06 10.10.1.36:32585 check inter 2s fall 3 rise 2

# --- New HTTPS backend for kubeui dashboard ---
backend k8s_dashboard_https_backend
   mode tcp             # Passes through directly to port 32585 (Cilium NodePort) without SSL decryption
   balance roundrobin
   server vdevk8s05 10.10.1.35:32585 check inter 2s fall 3 rise 2
   server vdevk8s06 10.10.1.36:32585 check inter 2s fall 3 rise 2

vrrp_script check_haproxy {
   script "killall -0 haproxy" # Check if HAProxy process is running
   interval 2
   weight 2
}

vrrp_instance VI_1 {
   state MASTER
   interface ens3           # Change to your actual 10.10.3.0/24 interface name (e.g., ens4, eth1)
   virtual_router_id 51      # Must match between MASTER and BACKUP
   priority 101              # Higher priority than BACKUP
   advert_int 1

   authentication {
       auth_type PASS
       auth_pass k8s_secret  # Must match between MASTER and BACKUP
    }

   unicast_src_ip 10.10.3.131
   unicast_peer {
       10.10.3.132
    }

   virtual_ipaddress {
       10.10.3.130/24        # Shared Virtual IP (VIP) for service network
    }

   track_script {
       check_haproxy
    }
}

vrrp_script check_haproxy {
    script "killall -0 haproxy"
   interval 2
    weight 2
}

vrrp_instance VI_1 {
   state BACKUP              # Set to BACKUP
    interface ens3            # Change to your actual 10.10.3.0/24 interface name
    virtual_router_id 51      # Must match MASTER
    priority 100              # Lower priority than MASTER
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass k8s_secret  # Must match MASTER
   }

    unicast_src_ip 10.10.3.132
    unicast_peer {
       10.10.3.131
   }

    virtual_ipaddress {
       10.10.3.130/24       # Same Virtual IP (VIP) as MASTER
   }

    track_script {
        check_haproxy
   }
}