Skip to content

Instantly share code, notes, and snippets.

@haproxytechblog

haproxytechblog/blog20210119-01.yaml

Last active January 22, 2021 15:36
Show Gist options
  • Save haproxytechblog/cd7c330e50ce4b070d04eeb2b6709c67 to your computer and use it in GitHub Desktop.
Save haproxytechblog/cd7c330e50ce4b070d04eeb2b6709c67 to your computer and use it in GitHub Desktop.
Download ZIP
Announcing HAProxy Kubernetes Ingress Controller 1.5
Raw
blog20210119-01.yaml
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: web-ingress
namespace: default
annotations:
haproxy.org/ssl-redirect: "true"
haproxy.org/ssl-redirect-code: "301"
haproxy.org/ssl-certificate: "default/tls-secret"
# ... other ingress settings...
Raw
blog20210119-02.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: haproxy-kubernetes-ingress
namespace: default
data:
global-config-snippet: |
ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
tune.ssl.default-dh-param 2048
tune.bufsize 32768
Raw
blog20210119-03.yaml
apiVersion: v1
kind: Service
metadata:
labels:
run: web
name: web
annotations:
haproxy.org/backend-config-snippet: |
stick-table type binary size 1000 store http_req_rate(5s)
http-request track-sc0 url32+src
http-request deny if { url32+src,table_http_req_rate() gt 50 }
# ... other service settings...
Raw
blog20210119-04.yaml
apiVersion: v1
kind: Service
metadata:
labels:
run: web
name: web
annotations:
haproxy.org/server-ca: "default/server-tls-secret"
haproxy.org/server-crt: "default/client-tls-secret"
# ... other service settings...
Raw
blog20210119-05.yaml
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: web-ingress
namespace: default
annotations:
haproxy.org/ssl-redirect: "true"
haproxy.org/ssl-redirect-code: "301"
haproxy.org/ssl-certificate: "default/tls-secret"
haproxy.org/auth-type: basic-auth
haproxy.org/auth-secret: "default/logins"
# ... other ingress settings...
Raw
blog20210119-06.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: customerrors
namespace: default
data:
503: |-
HTTP/1.0 503 Service Unavailable
Cache-Control: no-cache
Connection: close
Content-Type: text/html
<html><body><h1>Oops, that's embarassing!</h1>
<p>There are no servers available to handle your request.</p>
</body></html>
Raw
blog20210119-07.yaml
args:
- --configmap-errorfile=default/customerrors
Raw
blog20210119-08.cfg
frontend http
mode http
bind 0.0.0.0:80 name bind_1
bind :::80 v4v6 name bind_2
http-request set-var(txn.host) req.hdr(Host),field(1,:),lower
http-request set-var(txn.path) path
http-request set-var(txn.base) base
http-request deny deny_status 403 if { var(txn.host),concat(,txn.path) -m beg -f /etc/haproxy/maps/16510262515213450.lst } { src -f /etc/haproxy/maps/7895261178644353572.lst } or { var(txn.host) -f /etc/haproxy/maps/16510262515213450.lst } { src -f /etc/haproxy/maps/7895261178644353572.lst } or { var(txn.path) -m beg -f /etc/haproxy/maps/16510262515213450.lst } { src -f /etc/haproxy/maps/7895261178644353572.lst }
http-request capture "hdr(Referer)" len 128 if { var(txn.host),concat(,txn.path) -m beg -f /etc/haproxy/maps/18288779858306557702.lst } or { var(txn.host) -f /etc/haproxy/maps/18288779858306557702.lst } or { var(txn.path) -m beg -f /etc/haproxy/maps/18288779858306557702.lst }
http-request capture "hdr(User-Agent)" len 128 if { var(txn.host),concat(,txn.path) -m beg -f /etc/haproxy/maps/15330672981640189476.lst } or { var(txn.host) -f /etc/haproxy/maps/15330672981640189476.lst } or { var(txn.path) -m beg -f /etc/haproxy/maps/15330672981640189476.lst }
use_backend echo-echo-3-http-echo-8080 if { var(txn.host) echo.k8s.local } { var(txn.path) -m beg /echo-3 }
use_backend echo-echo-2-http-echo-8080 if { var(txn.host) echo.k8s.local } { var(txn.path) -m beg /echo-2 }
use_backend echo-echo-3-http-echo-8080 if { var(txn.host) echo-3.k8s.local }
use_backend echo-echo-2-http-echo-8080 if { var(txn.host) echo-2.k8s.local }
use_backend echo-echo-1-http-echo-8443 if { var(txn.host) echo-1.k8s.local }
use_backend echo-echo-3-http-echo-8080 if { var(txn.path) -m beg /echo-3 }
use_backend echo-echo-2-http-echo-8080 if { var(txn.path) -m beg /echo-2 }
default_backend default-haproxy-1-4-kubernetes-ingress-default-backend-8080
Raw
blog20210119-09.cfg
frontend http
mode http
bind 0.0.0.0:80 name bind_1
bind :::80 name bind_2 v4v6
http-request set-var(txn.base) base
http-request set-var(txn.path) path
http-request set-var(txn.host) req.hdr(Host),field(1,:),lower,map(/etc/haproxy/maps/host.map)
http-request set-var(txn.host) req.hdr(Host),field(1,:),regsub(^[^.]*,,),lower,map(/etc/haproxy/maps/host.map,'') if !{ var(txn.host) -m found }
http-request set-var(txn.match) var(txn.host),concat(,txn.path,),map(/etc/haproxy/maps/path-exact.map)
http-request set-var(txn.match) var(txn.host),concat(,txn.path,),map_beg(/etc/haproxy/maps/path-prefix.map) if !{ var(txn.match) -m found }
http-request deny deny_status 403 if { var(txn.match) -m dom 819381936 } { src -f /etc/haproxy/maps/blacklist-2602162148.map }
http-request capture "hdr(Referer)" len 128 if { var(txn.match) -m dom 4205828474 }
http-request capture "hdr(User-Agent)" len 128 if { var(txn.match) -m dom 2786470064 }
use_backend %[var(txn.match),field(1,.)]
default_backend default-haproxy-kubernetes-ingress-default-backend-8080
Raw
blog20210119-10.sh
$ ip route add <pod-network> via <node-ip>
Raw
blog20210119-11.sh
$ ./kubernetes-ingress -e \
--configmap=default/haproxy-kubernetes-ingress \
--program=/usr/bin/haproxy \
--disable-ipv6 \
--ipv4-bind-address=10.0.3.100
--http-bind-port=8080 \
--https-bind-port=8443
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment