haproxy.cfg

global
  maxconn 2048
  log /dev/log	local0
  log /dev/log	local1 notice
  chroot /var/lib/haproxy
  stats socket /run/haproxy/admin.sock mode 660 level admin
  stats timeout 30s
  user haproxy
  group haproxy
  daemon

  # Default SSL material locations
  ca-base /etc/ssl/certs
  crt-base /etc/ssl/private

  # Default ciphers to use on SSL-enabled listening sockets.
  # For more information, see ciphers(1SSL).
  ssl-default-bind-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL

defaults
  log	global
  mode	http
  option  httplog
  option  dontlognull
  option  forwardfor
  option  http-server-close
  
  stats enable
  stats uri /stats
  stats realm Haproxy\ Statistics
  stats auth ha-admin:'}swN,JrCRt|K2n>\D#G9w*ES3Z#gC=A7'
  
  timeout connect 5000
  timeout client  50000
  timeout server  50000
  
  errorfile 400 /etc/haproxy/errors/400.http
  errorfile 403 /etc/haproxy/errors/403.http
  errorfile 408 /etc/haproxy/errors/408.http
  errorfile 500 /etc/haproxy/errors/500.http
  errorfile 502 /etc/haproxy/errors/502.http
  errorfile 503 /etc/haproxy/errors/503.http
  errorfile 504 /etc/haproxy/errors/504.http

frontend k8s-master-lb
  mode tcp
  bind HAPROXY_PUBLIC_IP4:6443
  bind HAPROXY_PUBLIC_IP6:6443
  default_backend k8s-master

backend k8s-master
  mode tcp
  server unode1 UNODE1_PRIVATE_IP:6443 check
  server unode2 UNODE2_PRIVATE_IP:6443 check
  server unode3 UNODE3_PRIVATE_IP:6443 check
  
#
frontend https-lb
  mode tcp
  bind HAPROXY_PUBLIC_IP4:443
  bind HAPROXY_PUBLIC_IP6:443
  default_backend https

backend https
  mode tcp
  server unode1 UNODE1_PRIVATE_IP:443 check
  server unode2 UNODE2_PRIVATE_IP:443 check
  server unode3 UNODE3_PRIVATE_IP:443 check

frontend http-lb
  mode http
  bind HAPROXY_PUBLIC_IP4:443
  bind HAPROXY_PUBLIC_IP6:443
  default_backend http

backend http
  mode http
  server unode1 UNODE1_PRIVATE_IP:443 check
  server unode2 UNODE2_PRIVATE_IP:443 check
  server unode3 UNODE3_PRIVATE_IP:443 check