haproxy-for-openshift.yaml

---
- name: Install and configure HAProxy for OpenShift
  hosts: all
  become: yes
  user: root
  vars:
    openshift_api_vip: 192.168.122.90
    openshift_apps_vip: 192.168.122.63
  tasks:
    - name: Install HAProxy
      yum:
        name: haproxy
        state: present

    - name: Set SELinux for port 6443
      ansible.builtin.shell: |
        semanage port -a -t http_port_t -p tcp 6443

    - name: Backup existing HAProxy configuration
      copy:
        src: /etc/haproxy/haproxy.cfg
        dest: /etc/haproxy/haproxy.cfg.bak
        remote_src: yes
        backup: yes
      ignore_errors: yes

    - name: Deploy HAProxy configuration
      copy:
        dest: /etc/haproxy/haproxy.cfg
        content: |
          global
              log 127.0.0.1 local0
              log 127.0.0.1 local1 notice
              maxconn 20000
              chroot /var/lib/haproxy
              pidfile /var/run/haproxy.pid
              user haproxy
              group haproxy
              daemon

          defaults
              log global
              option httplog
              option dontlognull
              retries 3
              option redispatch
              maxconn 10000
              timeout connect 5000ms
              timeout client 50000ms
              timeout server 50000ms

          frontend openshift_api
              bind *:6443
              mode tcp
              option tcplog
              default_backend openshift_api_backend

          backend openshift_api_backend
              mode tcp
              balance roundrobin
              server master1 {{ openshift_api_vip }}:6443 check

          frontend openshift_https
              bind *:443
              mode tcp
              option tcplog
              default_backend openshift_https_backend

          backend openshift_https_backend
              mode tcp
              balance roundrobin
              server worker1 {{ openshift_apps_vip }}:443 check
      notify: Restart HAProxy

    - name: Ensure HAProxy service is enabled and started
      service:
        name: haproxy
        state: started
        enabled: yes

  handlers:
    - name: Restart HAProxy
      service:
        name: haproxy
        state: restarted