-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathinstall-lb-for-ocp4.sh
124 lines (103 loc) · 3.67 KB
/
install-lb-for-ocp4.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
#!/bin/bash
set -x
sudo dnf install -y haproxy
#SELinux
sudo setsebool -P haproxy_connect_any=1
source ocp_vars.sh
cat <<EOF > /tmp/haproxy.cfg
#---------------------------------------------------------------------
# Example configuration for a possible web application. See the
# full configuration options online.
#
# https://www.haproxy.org/download/1.8/doc/configuration.txt
#
#---------------------------------------------------------------------
#---------------------------------------------------------------------
# Global settings
#---------------------------------------------------------------------
global
# to have these messages end up in /var/log/haproxy.log you will
# need to:
#
# 1) configure syslog to accept network log events. This is done
# by adding the '-r' option to the SYSLOGD_OPTIONS in
# /etc/sysconfig/syslog
#
# 2) configure local2 events to go to the /var/log/haproxy.log
# file. A line like the following can be added to
# /etc/sysconfig/syslog
#
# local2.* /var/log/haproxy.log
#
log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon
# turn on stats unix socket
stats socket /var/lib/haproxy/stats
# utilize system-wide crypto-policies
#ssl-default-bind-ciphers PROFILE=SYSTEM
#ssl-default-server-ciphers PROFILE=SYSTEM
#---------------------------------------------------------------------
# common defaults that all the 'listen' and 'backend' sections will
# use if not designated in their block
#---------------------------------------------------------------------
defaults
mode tcp
log global
option httplog
option dontlognull
option http-server-close
option forwardfor except 127.0.0.0/8
option redispatch
retries 3
timeout http-request 10s
timeout queue 1m
timeout connect 10s
timeout client 1m
timeout server 1m
timeout http-keep-alive 10s
timeout check 10s
maxconn 3000
#---------------------------------------------------------------------
# main frontend which proxys to the backends
#---------------------------------------------------------------------
frontend api
bind :6443
default_backend controlplaneapi
#frontend apiinternal
# bind :22623
# default_backend controlplaneapiinternal
#
frontend secure
bind :443
default_backend secure
#---------------------------------------------------------------------
# static backend
#---------------------------------------------------------------------
backend controlplaneapi
balance source
server master0 ${MASTER0_IP}:6443 check
server master1 ${MASTER1_IP}:6443 check
server master2 ${MASTER2_IP}:6443 check
#backend controlplaneapiinternal
# balance source
# server master0 ${MASTER0_IP}:22623 check
# server master1 ${MASTER1_IP}:22623 check
# server master2 ${MASTER2_IP}:22623 check
backend secure
balance source
server compute0 ${MASTER0_IP}:443 check
server compute1 ${MASTER1_IP}:443 check
server compute2 ${MASTER2_IP}:443 check
EOF
sudo cp /tmp/haproxy.cfg /etc/haproxy/
sudo firewall-cmd --zone=public --permanent --add-service=https
sudo firewall-cmd --zone=public --permanent --add-port=6443/tcp
sudo firewall-cmd --zone=public --permanent --list-services
sudo firewall-cmd --zone=public --permanent --list-ports
sudo systemctl stop haproxy
sudo systemctl --now enable haproxy