# Microk8s api nodes behind haproxy

**URL:** <https://discuss.kubernetes.io/t/microk8s-api-nodes-behind-haproxy/25481>\
**Category:** microk8s\
**Tags:** loadbalancer\
**Created:** [September 20, 2023, 10:43am UTC](https://discuss.kubernetes.io/t/microk8s-api-nodes-behind-haproxy/25481 "2023-09-20T10:43:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nicola\_Urbinati](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/nicola_urbinati/32/10028_2.png) [@Nicola\_Urbinati](https://discuss.kubernetes.io/u/Nicola_Urbinati)\
**Post date:** [September 20, 2023, 10:43am UTC](https://discuss.kubernetes.io/t/microk8s-api-nodes-behind-haproxy/25481/1 "2023-09-20T10:43:26Z")

</div>

Hi,

I’m trying to wrap my microk8s cluster api nodes behind a loadbalancer, is there a guide to reach this?

In the cluster ha guide it only refers to the possibility, and only the external etcd guide exists, not an external loadbalancer for the apis.

Tried haproxy (it works flawlessly with kubeadm) to no avail, with this error:

```auto
curl -v -XGET -H "User-Agent: kubectl/v1.28.1 (linux/amd64) kubernetes/8dc49c4" -H "Accept: application/json;g=apidiscovery.k8s.io;v=v2beta1;as=APIGroupDiscoveryList,application/json" 'https://k8cp.urbaman.it:16443/api'
Note: Unnecessary use of -X or --request, GET is already inferred.
* Trying 10.0.50.64:16443...
* Connected to k8cp.urbaman.it (10.0.50.64) port 16443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.0 (OUT), TLS header, Unknown (21):
* TLSv1.3 (OUT), TLS alert, decode error (562):
* error:0A000126:SSL routines::unexpected eof while reading
* Closing connection 0
curl: (35) error:0A000126:SSL routines::unexpected eof while reading

```

---

<div class="post-metadata">

**Author:** ![docsa](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/docsa/32/14286_2.png) [@docsa](https://discuss.kubernetes.io/u/docsa)\
**Post date:** [February 13, 2024, 8:25pm UTC](https://discuss.kubernetes.io/t/microk8s-api-nodes-behind-haproxy/25481/2 "2024-02-13T20:25:37Z")

</div>

I have same problem. Did you find a solution ?

---

<div class="post-metadata">

**Author:** ![fox-md](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/fox-md/32/10613_2.png) [@fox-md](https://discuss.kubernetes.io/u/fox-md)\
**Post date:** [February 16, 2024, 9:14am UTC](https://discuss.kubernetes.io/t/microk8s-api-nodes-behind-haproxy/25481/3 "2024-02-16T09:14:46Z")

</div>

Hi,  
Which balancing layer are you using?

---

<div class="post-metadata">

**Author:** ![Nicola\_Urbinati](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/nicola_urbinati/32/10028_2.png) [@Nicola\_Urbinati](https://discuss.kubernetes.io/u/Nicola_Urbinati)\
**Post date:** [February 16, 2024, 9:32am UTC](https://discuss.kubernetes.io/t/microk8s-api-nodes-behind-haproxy/25481/4 "2024-02-16T09:32:32Z")

</div>

Hi,

Just using the same conf used for a kubeadm cluster, working flawlessly, and changed ports.

Don’t have che conf at hand after all this time, should be normal https.

This error is probably due to the missing tls registration of the domain, and probably it’s enough to add ip and domain in the default ips and domains for which mk8s registers tls.

I remember it was not enough and a also had many other problems getting this work.