[Tutorial] Deploying Control Plane LB on Ubuntu via Ansible

This is a development document, intended for developers and AI.

This article uses Ubuntu as an example to deploy a single-node HAProxy using Ansible, which only handles L4 TCP load balancing for the RKE2/Kubernetes control plane entry point.

Scope

• Only carries the control plane entry point (6443/9345), and is not responsible for business traffic or Ingress.
• Single-node LB, no high availability.
• Available when there is no managed L4 LB in the public cloud or due to cost constraints.

Prerequisites

• 1 Ubuntu server as the LB node.
• LB and control plane nodes in the same region/internal network, stable latency preferred.
• Open 6443/TCP and 9345/TCP to the control plane nodes.

Initialize Ansible Project

Initialize Repository

First, create a folder, assuming the project name is lb-ansible

yun@yun ~/V/a/y/p/ansible (main)> mkdir lb-ansible
yun@yun ~/V/a/y/p/ansible (main)> ls
lb-ansible/

Enter the project repository, initialize git, and create a GitHub repository:

cd lb-ansible

git init
echo "# lb-ansible" > README.md
git add .
git commit -m "chore: initial commit"

gh repo create lb-ansible --private --source=. --remote=origin --push

The following code snippet is optional, used to declare the newly created code repository as a submodule:

cd ..
rm -rf lb-ansible/

git submodule add https://github.com/<用户名或组织>/lb-ansible.git ./lb-ansible

Plan Directory Structure

Next, divide the project structure:

mkdir -p inventories/prod \
  group_vars \
  playbooks \
  templates

Use micro to create and edit files:

micro ansible.cfg \
  inventories/prod/hosts.yml \
  group_vars/lb.yml \
  playbooks/lb.yml \
  templates/haproxy.cfg.j2

The directory structure is as follows:

lb-ansible/
├── ansible.cfg
├── inventories/
│   └── prod/
│       └── hosts.yml
├── group_vars/
│   └── lb.yml
├── playbooks/
│   └── lb.yml
└── templates/
    └── haproxy.cfg.j2

Configure Ansible

micro ansible.cfg :

[defaults]
inventory = inventories/prod/hosts.yml
remote_user = root
host_key_checking = False
timeout = 30

Write Inventory

micro inventories/prod/hosts.yml :

all:
  children:
    lb:
      hosts:
        lb-1:

You can directly use aliases from SSH Config, no need to write ansible_host.

Write Variables

micro group_vars/lb.yml :

haproxy_bind_ip: "0.0.0.0"
haproxy_api_port: 6443
haproxy_reg_port: 9345

rke2_api_backends:
  - name: rke2-server1
    host: 10.0.0.11
  - name: rke2-server2
    host: 10.0.0.12
  - name: rke2-server3
    host: 10.0.0.13

Write Template

micro templates/haproxy.cfg.j2 :

global
  log /dev/log local0
  maxconn 4096

defaults
  mode tcp
  timeout connect 5s
  timeout client  30s
  timeout server  30s

frontend rke2_api
  bind {{ haproxy_bind_ip }}:{{ haproxy_api_port }}
  default_backend rke2_api

backend rke2_api
  option tcp-check
  default-server inter 2s fall 3 rise 2
{% for backend in rke2_api_backends %}
  server {{ backend.name }} {{ backend.host }}:{{ haproxy_api_port }} check
{% endfor %}

frontend rke2_reg
  bind {{ haproxy_bind_ip }}:{{ haproxy_reg_port }}
  default_backend rke2_reg

backend rke2_reg
  option tcp-check
  default-server inter 2s fall 3 rise 2
{% for backend in rke2_api_backends %}
  server {{ backend.name }} {{ backend.host }}:{{ haproxy_reg_port }} check
{% endfor %}

Write Playbook

micro playbooks/lb.yml :

- name: Deploy control plane LB
  hosts: lb
  become: true
  tasks:
    - name: Install haproxy
      ansible.builtin.apt:
        name: haproxy
        state: present
        update_cache: true

    - name: Deploy haproxy config
      ansible.builtin.template:
        src: templates/haproxy.cfg.j2
        dest: /etc/haproxy/haproxy.cfg
        owner: root
        group: root
        mode: "0644"
      notify: Restart haproxy

    - name: Enable haproxy
      ansible.builtin.service:
        name: haproxy
        enabled: true
        state: started

  handlers:
    - name: Restart haproxy
      ansible.builtin.service:
        name: haproxy
        state: restarted

Execution and Verification

Execute deployment:

ansible-playbook playbooks/lb.yml

Check ports:

ss -lntp | grep -E ":6443|:9345"

Use the LB node IP or domain name for the control plane entry point, and set rke2_api_ip to this address in the RKE2 variables.