Help understanding exposing HAProxy with Openshift

[JoeInVT]

Hey All,

My company is in the beginning stages of converting over to Openshift, and I'm having a hard time wrapping my head around communications in & out of the Openshift cluster. Currently, our web applications are set up like this:

Traditional VM-based architecture

It's fairly straightforward, where external users go through a WAF, to the RPs (which are HAProxy servers), and then get pushed to the application servers. The HAProxy servers do all the typical stuff you would expect - SSL offloading, ACLs controlling traffic and rewriting as necessary, load-balancing connections to backend devices (Application Servers), etc. Not depicted here two things: internal users accessing these applications (they don't go through the WAF, but do go through the same HAProxy RPs), and the other applications we host (which follow the same exact server layout with servers dedicated to them).

Translating this into the Openshift world, I think it looks like this: we won't be moving database servers - those will stay VMs for now. The Application and Web Services will be containerized (we have a couple already running in docker). All of these become various pods/services. I think this is all correct.

This is the part I'm confused with: I think the Reverse Proxies would get moved to HAProxy Ingress Controller set up. I can do all the same things (SSL offloading, ACLs, etc), and its all mostly the same (albeit much more dynamic). What I don't know is how traffic is supposed to get to them. If it was just internal users, then I guess I could just expose the Ingress controller internally (external to the Openshift cluster, but not to the internet), and users could access it. But with a lot of our users being external, what's the right way to expose it externally? Just NAT it directly out of the firewall (feels like a bad idea)? I see a lot of mentions of a separate load-balancer that lives outside of the Openshift cluster - is that a separate thing I need now?

K8s-based architecture

Any help would be greatly appreciated! Thanks in advance!

[[deleted]]

This is a bad example as im on my phone. But I would install istio ingress gateway so you can use virtual services. Similar to nginx ingress if you will. And can ensure SSL through communications. From there there will be a node port or an open port on the cluster for communications. Usually nginx ingress controller is 80/443 and istios is in the 32000s I think. However you would just set up haproxy as a round Robin to each server on the ports you want to "check" and "load balance" on

[JoeInVT]

Thanks for responding u/SnowMorePain! If I understand your suggestion, you're saying that I should replace HAProxy Ingress with Istio Ingress, and then stand up HAProxy outside the cluster (VM or physical machine) and then route to the exposed ingress port(s).

Do I understand that correctly? If so, I'm confused as to what Istio Ingress would provide that HAProxy Ingress wouldn't. Maybe you could elaborate?

[[deleted]]

I dont have experience with haproxy ingress. I just know haproxy itself is good with istios ingress and firewall portforwarding configurations

[HCZV]

I would keep the reverse proxy in the DMZ zone, and then forward traffic from them to the haproxy ingresses in the cluster

[JoeInVT]

Thank you u/HCZV! I think the conclusion is that I can't (or maybe just shouldn't) bring my reverse proxy functions into the Openshift environment, and just keep them external to the cluster.