unkin-agent
4190785389
The au-syd1 edge proxy runs on a hand-managed LXD container outside the cluster, with no HA and no shared config source. - Add `apps/base/haproxy/`: 3 replicas behind the DMZ LoadBalancer 198.18.199.1, config from a ConfigMap, wildcard certs from reflected secrets. - Keep source IPs via `externalTrafficPolicy: Local`; `sessionAffinity: ClientIP` stands in for the stick-table peers a Deployment cannot name. - Drain on shutdown: `hard-stop-after 2m`, a preStop SIGUSR1 soft-stop, 150s grace. - Bind the stats listener to 127.0.0.1 so it is port-forward only. - Register the app in the platform project and ApplicationSet. Reviewed-on: #485 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
44 lines
946 B
YAML
44 lines
946 B
YAML
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: haproxy
|
|
namespace: haproxy
|
|
annotations:
|
|
purelb.io/service-group: dmz
|
|
purelb.io/addresses: 198.18.199.1
|
|
spec:
|
|
type: LoadBalancer
|
|
loadBalancerIP: "198.18.199.1"
|
|
# Source IP must survive for acl_internalsubnets, X-Real-IP and SMTP.
|
|
externalTrafficPolicy: Local
|
|
# Pins a client to one replica, standing in for the dropped stick-table peers.
|
|
sessionAffinity: ClientIP
|
|
selector:
|
|
app: haproxy
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
protocol: TCP
|
|
targetPort: http
|
|
- name: https
|
|
port: 443
|
|
protocol: TCP
|
|
targetPort: https
|
|
- name: smtp
|
|
port: 25
|
|
protocol: TCP
|
|
targetPort: smtp
|
|
- name: imap
|
|
port: 143
|
|
protocol: TCP
|
|
targetPort: imap
|
|
- name: submission
|
|
port: 587
|
|
protocol: TCP
|
|
targetPort: submission
|
|
- name: imaps
|
|
port: 993
|
|
protocol: TCP
|
|
targetPort: imaps
|