title: HAProxy in kubernetes to connect galera cluster
body: <p>I want to connect Galera cluster from <code>haproxy</code> pod deployed in kubernetes.</p>
  <p>Docker file for the image.</p>
  <pre><code>FROM haproxy:2.3
  COPY haproxy.cfg /usr/local/etc/haproxy/haproxy.cfg
  </code></pre>
  <p><code>haproxy.cfg</code> File</p>
  <pre><code>defaults
      log global
      mode tcp
      retries 10
      timeout client 10000
      timeout connect 100500
      timeout server 10000
  frontend mysql-router-service
      bind *:6446
      mode tcp
      option tcplog
      default_backend galera_cluster_backend
  # MySQL Cluster BE configuration
  backend galera_cluster_backend
      mode tcp
      #option mysql-check user haproxy
      option tcp-check 
      balance source
      server mysql_cluster_01 192.168.1.2:3306  check weight 1
      server mysql_cluster_02 192.168.1.3:3306  check weight 1
      server mysql_cluster_03 192.168.1.4:3306  check weight 1
  </code></pre>
  <p>Here <code>mysql-router-service</code> may mislead, but we used it as it was the earlier db connectivity service.</p>
  <p>Kubernetes deployment manifest</p>
  <pre><code>apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: ha-proxy
    namespace: mysql-router
  spec:
    replicas: 1 
    selector:
      matchLabels:
        app: ha-proxy
    template:
      metadata:
        labels:
          app: ha-proxy
          version: v1
      spec:
        imagePullSecrets:
        - name: dreg
        containers:
        - name: ha-proxy
          image: our-registry:5000/haproxy:v14
          imagePullPolicy: Always
          ports:
          - containerPort: 6446
  </code></pre>
  <p>Kubernetes service manifest :</p>
  <pre><code>apiVersion: v1
  kind: Service
  metadata:
    name: mysql-router-service
    namespace: mysql-router
    labels:
      app: ha-proxy
  spec:
    selector:
      app: ha-proxy
      version: v1
    ports:
    - name: ha-proxy
      port: 6446
      protocol: TCP
      targetPort: 6446
    type: LoadBalancer
    loadBalancerIP: 192.168.1.101
  </code></pre>
  <p>Followings were seen in <code>ha-proxy</code> pod logs</p>
  <pre><code>[WARNING] 237/114804 (1) : config : log format ignored for frontend 'mysql-router-service' since it has no log address.
  [NOTICE] 237/114804 (1) : New worker #1 (8) forked
  </code></pre>
  <p>If we use <code>option  mysql-check user haproxy</code> in config file, Galera logs <code>/var/log/mysql/error.log</code> has</p>
  <pre><code>[Warning] Access denied for user 'haproxy'@'192.168.1.10' (using password NO)
  </code></pre>
  <p>Here <code>192.168.1.10</code> is one of k8 worker.</p>
  <p>In galera cluster we have following users</p>
  <pre><code>+---------------+-------------+
  | Host          | User        |
  +---------------+-------------+    
  | 192.168.1.%   | haproxy     |  
  | localhost     | mariadb.sys |
  | localhost     | mysql       |
  | localhost     | root        |
  +---------------+-------------+
  </code></pre>
  <p>All nodes are running <code>Ubuntu 18-04</code>, <code>ufw</code> is disabled.</p>
  <p>We can telnet to galera nodes from k8 workers. (telnet <code>192.168.1.2 3306</code>)</p>
  <p>What we had missed here?</p>