haproxytechblog

$ openssl x509 -pubkey -noout -in ./myaccount.pem > pubkey.pem

haproxytechblog

frontend mysite
  bind :80

  # route to a backend based on path's prefix
  use_backend app-a if { path /a } || { path_beg /a/ }
  use_backend app-b if { path /b } || { path_beg /b/ }

backend app-a
  # strip the prefix '/a' off of the path
  http-request replace-path /a(/)?(.*) /\2

haproxytechblog

$ openssl req \
    -newkey rsa:2048 \
    -nodes \
    -x509 \
    -days 3650 \
    -keyout root-ca.key \
    -out root-ca.crt

haproxytechblog

log-forward syslog
  # Accepts incoming TCP messages
  bind 0.0.0.0:514

  # Accepts incoming UDP messages
  dgram-bind 0.0.0.0:514

  # Sends outgoing messages via UDP
  log 172.25.0.12:514 local0

haproxytechblog

peers mypeers
  peer garfield 127.0.0.1:10000

haproxytechblog

global
  # Uses a UDP port
  log 192.168.56.30:514 local0

haproxytechblog

$ kubectl api-resources
NAME                     SHORTNAMES   APIVERSION   NAMESPACED   KIND
bindings                              v1           true         Binding
componentstatuses        cs           v1           false        ComponentStatus
configmaps               cm           v1           true         ConfigMap
endpoints                ep           v1           true         Endpoints
events                   ev           v1           true         Event
limitranges              limits       v1           true         LimitRange
namespaces               ns           v1           false        Namespace
nodes                    no           v1           false        Node

haproxytechblog

setcap cap_net_bind_service=+ep haproxy

haproxytechblog

frontend mywebapp
  bind :80
  mode http
  default_backend webservers

backend webservers
  mode http
  balance roundrobin
  cookie SERVER insert indirect nocache
  server web1 192.168.56.20:80 check cookie web1

haproxytechblog

frontend fe_main
  ...
  option http-buffer-request
  http-request deny if { query -i -m sub class.module.classLoader.resources.context.parent.pipeline springframework.context.support.FileSystemXmlApplicationContext }
  http-request deny if { req.hdrs -i -m sub class.module.classLoader.resources.context.parent.pipeline springframework.context.support.FileSystemXmlApplicationContext }
  http-request deny if { req.body -i -m sub class.module.classLoader.resources.context.parent.pipeline springframework.context.support.FileSystemXmlApplicationContext }