---
apiVersion: v1
kind: Service
metadata:
  name: haproxy
  namespace: haproxy
spec:
  type: ClusterIP
  # Reached only by the external Traefik's TLS-passthrough TLSRoute, so the
  # peer address here is a Traefik pod, not the client. sessionAffinity is
  # deliberately absent: keyed on ClientIP it would pin whole Traefik pods,
  # not clients. Backend persistence rests on the per-backend SRVNAME cookie.
  selector:
    app: haproxy
  ports:
    - name: https
      port: 443
      protocol: TCP
      targetPort: https