Move the haproxy edge behind the external Traefik (#492)

The haproxy edge holds its own DMZ VIP, a second public entry point alongside
traefik-external that must be firewalled and DNS'd separately. Traefik can
front it with TLS passthrough, leaving haproxy's certs and backends untouched.

- Add a `traefik-external` Gateway: HTTP :80 plus Passthrough TLS :443.
- TLSRoute the 12 `fe_https.map` hostnames to haproxy:443; HTTPRoute 301s :80.
- Make the Service ClusterIP on 443 only, releasing 198.18.199.1.
- Drop `fe_http`, `be_letsencrypt` and `fe_http.map`; certs are DNS-01 only.

Client IP now reads as a Traefik pod — the Gateway provider cannot emit PROXY protocol to a TLSRoute backend. `sessionAffinity` goes too (it would pin Traefik pods, not clients); SRVNAME cookies keep persistence.

Reviewed-on: #492
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

This commit was merged in pull request #492.

This commit is contained in:

Unkin Agent

2026-09-26 23:38:07 +10:00

committed by

BenVincent

parent 426a399f31

commit 20077f1029

7 changed files with 117 additions and 50 deletions

									
										apps/base/haproxy/kustomization.yaml
									
		+3
		
												View File
												
				@@ -7,6 +7,9 @@ resources:

				  - configmap.yaml

				  - deployment.yaml

				  - service.yaml

				  - gateway.yaml

				  - tlsroute.yaml

				  - httproute.yaml

				  - pdb.yaml

				  - vpa.yaml

				  - vmpodscrape.yaml