unkin-agent
4190785389
The au-syd1 edge proxy runs on a hand-managed LXD container outside the cluster, with no HA and no shared config source. - Add `apps/base/haproxy/`: 3 replicas behind the DMZ LoadBalancer 198.18.199.1, config from a ConfigMap, wildcard certs from reflected secrets. - Keep source IPs via `externalTrafficPolicy: Local`; `sessionAffinity: ClientIP` stands in for the stick-table peers a Deployment cannot name. - Drain on shutdown: `hard-stop-after 2m`, a preStop SIGUSR1 soft-stop, 150s grace. - Bind the stats listener to 127.0.0.1 so it is port-forward only. - Register the app in the platform project and ApplicationSet. Reviewed-on: #485 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
12 lines
173 B
YAML
12 lines
173 B
YAML
---
|
|
apiVersion: policy/v1
|
|
kind: PodDisruptionBudget
|
|
metadata:
|
|
name: haproxy
|
|
namespace: haproxy
|
|
spec:
|
|
maxUnavailable: 1
|
|
selector:
|
|
matchLabels:
|
|
app: haproxy
|