<p>I want to connect Galera cluster from <code>haproxy</code> pod deployed in kubernetes.</p>
<p>Docker file for the image.</p>
<pre><code>FROM haproxy:2.3
COPY haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg
</code></pre>
<p><code>haproxy.cfg</code> File</p>
<pre><code>defaults
    log global
    mode tcp
    retries 10
    timeout client 10000
    timeout connect 100500
    timeout server 10000
frontend mysql-router-service
    bind *:6446
    mode tcp
    option tcplog
    default_backend galera_cluster_backend
# MySQL Cluster BE configuration
backend galera_cluster_backend
    mode tcp
    #option mysql-check user haproxy
    option tcp-check 
    balance source
    server mysql_cluster_01 192.168.1.2:3306  check weight 1
    server mysql_cluster_02 192.168.1.3:3306  check weight 1
    server mysql_cluster_03 192.168.1.4:3306  check weight 1
</code></pre>
<p>Here <code>mysql-router-service</code> may mislead, but we used it as it was the earlier db connectivity service.</p>
<p>Kubernetes deployment manifest</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: ha-proxy
  namespace: mysql-router
spec:
  replicas: 1 
  selector:
    matchLabels:
      app: ha-proxy
  template:
    metadata:
      labels:
        app: ha-proxy
        version: v1
    spec:
      imagePullSecrets:
      - name: dreg
      containers:
      - name: ha-proxy
        image: our-registry:5000/haproxy:v14
        imagePullPolicy: Always
        ports:
        - containerPort: 6446
</code></pre>
<p>Kubernetes service manifest :</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: mysql-router-service
  namespace: mysql-router
  labels:
    app: ha-proxy
spec:
  selector:
    app: ha-proxy
    version: v1
  ports:
  - name: ha-proxy
    port: 6446
    protocol: TCP
    targetPort: 6446
  type: LoadBalancer
  loadBalancerIP: 192.168.1.101
</code></pre>
<p>Followings were seen in <code>ha-proxy</code> pod logs</p>
<pre><code>[WARNING] 237/114804 (1) : config : log format ignored for frontend 'mysql-router-service' since it has no log address.
[NOTICE] 237/114804 (1) : New worker #1 (8) forked
</code></pre>
<p>If we use <code>option  mysql-check user haproxy</code> in config file, Galera logs <code>/var/log/mysql/error.log</code> has</p>
<pre><code>[Warning] Access denied for user 'haproxy'@'192.168.1.10' (using password NO)
</code></pre>
<p>Here <code>192.168.1.10</code> is one of k8 worker.</p>
<p>In galera cluster we have following users</p>
<pre><code>+---------------+-------------+
| Host          | User        |
+---------------+-------------+    
| 192.168.1.%   | haproxy     |  
| localhost     | mariadb.sys |
| localhost     | mysql       |
| localhost     | root        |
+---------------+-------------+
</code></pre>
<p>All nodes are running <code>Ubuntu 18-04</code>, <code>ufw</code> is disabled.</p>
<p>We can telnet to galera nodes from k8 workers. (telnet <code>192.168.1.2 3306</code>)</p>
<p>What we had missed here?</p>

<p>Depends on :</p>
<p><code>[Warning] Access denied for user 'haproxy'@'192.168.1.10' (using password NO)</code></p>
<p>I think you have to set password for user : <code>haproxy</code>.</p>
