Dit deel is nog niet vertaald. Je ziet de Engelse tekst.
Wat het doet
HAProxy sits in front of several servers and spreads traffic over the healthy ones. It works on layer 4 (any TCP service: databases, SMTP, Kubernetes API) and layer 7 (HTTP: routing by host or path, headers, rate limits). A pair of HAProxy servers with keepalived and a virtual IP gives a highly available entry point — a classic setup in front of Kubernetes control planes.
The config /etc/haproxy/haproxy.cfg has global, defaults, frontend (where clients connect) and backend (the servers) sections. Check it with haproxy -c before a reload.
Zo schrijf je het
haproxy -c -f /etc/haproxy/haproxy.cfg
systemctl {reload|status} haproxyBelangrijkste delen
Config sections
global- Process settings: logging, user, max connections, TLS defaults.
defaults- Default timeouts and mode for the sections below.
frontendNAME- Listen address and port, rules (ACLs) that choose a backend.
backendNAME- The servers, the balance algorithm, health checks.
listenNAME- Frontend and backend in one section (stats page, simple TCP).
Opties 10
Meest gebruikt
Command-line options
Niets past bij dit filter.
Voorbeelden 10
$ als gewone gebruiker# als root (of met sudo)
1Check the config and reload
haproxy -c -f /etc/haproxy/haproxy.cfg Configuration file is valid systemctl reload haproxy2Balance HTTP over three web servers
cat /etc/haproxy/haproxy.cfg frontend web bind :80 default_backend app backend app balance roundrobin option httpchk GET /health server web1 10.30.1.11:8080 check server web2 10.30.1.12:8080 check server web3 10.30.1.13:8080 check backup3End TLS and redirect HTTP to HTTPS
cat /etc/haproxy/conf.d/tls.cfg frontend https bind :443 ssl crt /etc/haproxy/certs/shop.pem alpn h2,http/1.1 bind :80 http-request redirect scheme https unless { ssl_fc } http-response set-header Strict-Transport-Security "max-age=31536000" default_backend app4Route by host name
cat /etc/haproxy/conf.d/routes.cfg frontend web bind :80 acl is_api hdr(host) -i api.example.com use_backend api if is_api default_backend app5Load-balance the Kubernetes API (TCP)
cat /etc/haproxy/conf.d/k8s.cfg frontend k8s-api bind :6443 mode tcp default_backend k8s-cp backend k8s-cp mode tcp balance roundrobin option tcp-check server cp1 192.168.122.11:6443 check server cp2 192.168.122.12:6443 check server cp3 192.168.122.13:6443 check6Turn on the statistics page
7Limit requests per client
cat /etc/haproxy/conf.d/ratelimit.cfg frontend web stick-table type ip size 100k expire 30s store http_req_rate(10s) http-request track-sc0 src http-request deny deny_status 429 if { sc_http_req_rate(0) gt 50 }8Drain a server for maintenance through the runtime API
9Allow HAProxy to connect to any port with SELinux
setsebool -P haproxy_connect_any on10Read the logs
journalctl -u haproxy -n 50
Niets past bij dit filter.
Let op
- Combine the certificate and key in one PEM file for
crt, with rights600. - Bind the stats page and the admin socket only to localhost or protect them with a password.
option httpchkneeds a real health URL; otherwise a broken app still gets traffic.
Bestanden
/etc/haproxy/haproxy.cfg- Main configuration.
/etc/haproxy/conf.d/- Extra config files (RHEL loads them with the service).
/run/haproxy/admin.sock- Runtime API socket (if configured).
Tips om te onthouden
balance leastconnis better than round-robin for long connections (databases, WebSockets).- Pair with keepalived for a floating virtual IP between two HAProxy nodes.
Exitcodes
0 | Config valid / success. |
1 | Config error. |