<p>We have Kubernetes setup hosted on premises and are trying to allow clients outside of K8s to connect to services hosted in the K8s cluster.</p>

<p>In order to make this work using HA Proxy (which runs outside K8s), we have the HAProxy backend configuration as follows -</p>

<pre><code>   backend vault-backend
   ...
   ...
   server k8s-worker-1 worker1:32200 check
   server k8s-worker-2 worker2:32200 check
   server k8s-worker-3 worker3:32200 check
</code></pre>

<p>Now, this solution works, but the worker names and the corresponding nodePorts are hard-coded in this config, which obviously is inconvenient as and when more workers are added (or removed/changed).</p>

<p>We came across the HAProxy Ingress Controller (<a href="https://www.haproxy.com/blog/haproxy_ingress_controller_for_kubernetes/" rel="nofollow noreferrer">https://www.haproxy.com/blog/haproxy_ingress_controller_for_kubernetes/</a>) which sounds promising, but (we feel) effectively adds another HAProxy layer to the mix..and thus, adds another failure point.</p>

<p>Is there a better solution to implement this requirement?</p>

mmukhe
<blockquote>
  <p>Now, this solution works, but the worker names and the corresponding nodePorts are hard-coded in this config, which obviously is inconvenient as and when more workers are added (or removed/changed).</p>
</blockquote>

<p>You can explicitly configure the NodePort for your Kubernetes <a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="nofollow noreferrer">Service</a> so it doesn't pick a random port and you always use the same port on your external HAProxy:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: &lt;my-nodeport-service&gt;
  labels:
    &lt;my-label-key&gt;: &lt;my-label-value&gt;
spec:
  selector:
    &lt;my-selector-key&gt;: &lt;my-selector-value&gt;
  type: NodePort
  ports:
   - port: &lt;service-port&gt;
     nodePort: 32200
</code></pre>

<blockquote>
  <p>We came across the HAProxy Ingress Controller (<a href="https://www.haproxy.com/blog/haproxy_ingress_controller_for_kubernetes/" rel="nofollow noreferrer">https://www.haproxy.com/blog/haproxy_ingress_controller_for_kubernetes/</a>) which sounds promising, but (we feel) effectively adds another HAProxy layer to the mix..and thus, adds another failure point.</p>
</blockquote>

<p>You could run the HAProxy ingress inside the cluster and remove the HAproxy outside the cluster, but this really depends on what type of service you are running. The Kubernetes <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Ingress</a> is Layer 7 resource, for example. The DR here would be handled by having multiple replicas of your HAProxy ingress controller.</p>
