| Thanks, We use haproxy pods for inbound traffic, they perform TLS termination and simply pass the traffic over to a local proxy pod. The haproxy pod (and all other pods) communicate with each other over this local proxy service which is running on each host. We have a very simplified and robust overall architecture, were each pod allocates a specific virtual port and the proxy will try each host for that pod (and remember status), meaning we don't need to keep track of global routing tables and update each host's ip tables (shivering) when pods come and go. We don't use iptables. If some instance of a pod is unavailable the proxy will seamlessly try another instance of the pod. Initially we tried to config haproxy to do all this proxying for us, but it was asking too much. Good to know is that Simplenetes is still in beta. |