### Start Minikube Cluster

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/setup-cluster.md

Start a Minikube cluster, a popular tool for running a sandboxed local Kubernetes environment. Ensure Minikube binary is installed first.

```bash
minikube start
```

--------------------------------

### Install Web Pods

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/dns-service-discovery/README.md

Deploy the 'web' service pods using a replication controller. This example assumes you have a replication controller definition for your web pods.

```bash
kubectl apply -f web-rc.yml
```

--------------------------------

### Bind HTTP and HTTPS Configuration Examples

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/configuration/keys.md

Examples demonstrating how to configure listening IP and port for HTTP(S) incoming requests using bind keys. These examples cover listening on all IPv6 addresses, all IPv4 and IPv6 addresses, and accepting HTTPS connections on multiple ports.

```yaml
bind-http: ":::80"
bind-https: ":::443"
```

```yaml
bind-http: ":80,:::80"
bind-https:  ":443,:::443"
```

```yaml
bind-https: ":443,:8443"
```

--------------------------------

### Start Local Kubernetes Cluster

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/setup-cluster.md

Start a single-node local Kubernetes cluster directly on your development machine. This setup bypasses the creation of host-level network configurations.

```bash
cd $GOPATH/src/k8s.io/kubernetes
hack/local-up-cluster.sh
```

--------------------------------

### Configure Request, Succeed, and Fail Headers

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/configuration/keys.md

This example configures specific headers for client-to-auth service communication, successful authentication responses to the backend, and failed authentication responses to the client. Headers starting with 'X-User-' and the 'X-Token' header are copied to the backend on success.

```yaml
auth-headers-request: "X-*"
auth-headers-succeed: "X-Token,X-User-*"
```

--------------------------------

### Install or Upgrade HAProxy Ingress Controller

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/external-haproxy.md

Command to install or upgrade the HAProxy Ingress controller using Helm, applying the specified values file and creating the namespace if it doesn't exist.

```bash
$ helm upgrade haproxy-ingress haproxy-ingress/haproxy-ingress \
  --install --create-namespace --namespace=ingress-controller \
  -f haproxy-ingress-values.yaml
```

--------------------------------

### Run HAProxy Ingress Locally

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/README.md

Clone the repository and run the HAProxy Ingress controller locally. Ensure Go is installed and HAProxy is compiled with specific options.

```bash
mkdir -p $GOPATH/src/github.com/jcmoraisjr
cd $GOPATH/src/github.com/jcmoraisjr
git clone https://github.com/jcmoraisjr/haproxy-ingress.git
cd haproxy-ingress
make run
```

--------------------------------

### Global Frontend Declaration Example

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/configuration/keys.md

An example of declaring a single HTTP/HTTPS frontend pair globally in the ConfigMap. This frontend can then be referenced by Ingress resources.

```yaml
apiVersion: v1
data:
  http-frontends: "Front8=8080/8443"
  ...
kind: ConfigMap
metadata:
  name: haproxy-ingress
  namespace: ingress-controller
```

--------------------------------

### Install or Upgrade HAProxy Ingress Helm Chart

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/metrics.md

Installs or upgrades the HAProxy Ingress Helm chart with the specified values file.

```bash
helm upgrade haproxy-ingress haproxy-ingress/haproxy-ingress\
  --install\
  --create-namespace --namespace ingress-controller\
  -f haproxy-ingress-values.yaml

```

--------------------------------

### Configure FastCGI Applications

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/configuration/keys.md

Use `config-sections` to declare and configure FastCGI applications. This example shows how to define two separate fcgi-app sections with their respective configurations.

```yaml
    config-sections: |
      fcgi-app app1
          log-stderr global
          docroot /var/www/app1
          index index.php
      fcgi-app app2
          log-stderr global
          docroot /var/www/app2
          index index.php
      ... (other custom haproxy sections)
```

--------------------------------

### Install HAProxy Ingress with Helm

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/tcp-example/README.md

Install or upgrade the haproxy-ingress controller using Helm, applying the specified values file. This command ensures the controller is deployed with the custom TCP port configurations.

```sh
helm upgrade --install \
    --namespace ingress \
    --values values.yaml \
    my-release haproxy-ingress/haproxy-ingress
```

--------------------------------

### HAProxy Ingress Container Logs

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/external-haproxy.md

Example log output from the haproxy-ingress container, showing initialization, leader election, and HAProxy updates.

```log
... 
I0117 17:30:27.282701       6 controller.go:87] HAProxy Ingress successfully initialized
I0117 17:30:27.282743       6 leaderelection.go:243] attempting to acquire leader lease  ingress-controller/ingress-controller-leader-haproxy...
I0117 17:30:27.335674       6 status.go:177] new leader elected: haproxy-ingress-6f8848d6fb-cxb6w
I0117 17:30:27.392372       6 controller.go:321] starting haproxy update id=1
I0117 17:30:27.392463       6 ingress.go:153] using auto generated fake certificate
I0117 17:30:27.437047       6 instance.go:309] haproxy successfully reloaded (external)
I0117 17:30:27.437217       6 controller.go:353] finish haproxy update id=1: parse_ingress=0.143483ms write_maps=0.149637ms write_config=0.971026ms reload_haproxy=43.498718ms total=44.762864ms
I0117 17:30:58.066768       6 leaderelection.go:253] successfully acquired lease ingress-controller/ingress-controller-leader-haproxy
I0117 17:30:58.066867       6 status.go:177] new leader elected: haproxy-ingress-6f8848d6fb-gxmrk
```

--------------------------------

### Scale Green Deployment and Observe Traffic Shift (Pod Mode)

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/blue-green/README.md

Scales the 'green' deployment to 3 replicas and then uses 'kubectl get pod -w' to monitor pod status. This is followed by running the hareq alias to observe the traffic shift towards the green deployment.

```bash
$ kubectl scale deploy green --replicas=3
$ kubectl get pod -w
```

```bash
$ hareq
Running 100 requests...
  25 blue
  75 green
```

--------------------------------

### ConfigMap Example for HAProxy Ingress

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/configuration/keys.md

This ConfigMap defines global configuration options for HAProxy Ingress. Keys like 'balance-algorithm', 'max-connections', and 'ssl-redirect' are used to customize behavior. Note that numerical and boolean values should be declared as strings.

```yaml
apiVersion: v1
data:
  balance-algorithm: leastconn
  max-connections: "10000"
  ssl-redirect: "true"
kind: ConfigMap
metadata:
  name: haproxy-ingress
  namespace: ingress-controller
```

--------------------------------

### Strict Host Configuration Example

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/configuration/keys.md

Illustrates how 'strict-host' setting affects request routing for wildcard hosts. When false, all matching wildcard hosts are checked; when true, the default-backend is used if a path isn't matched.

```yaml
spec:
  rules:
  - host: my.domain.com
    http:
      paths:
      - path: /a
        backend:
          serviceName: svc1
          servicePort: 8080
  - host: *.domain.com
    http:
      paths:
      - path: /
        backend:
          serviceName: svc2
          servicePort: 8080
```

--------------------------------

### HAProxy Ingress Controller Configuration Parameter

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/custom-configuration/README.md

This is an example of the --configmap parameter used when deploying the HAProxy Ingress controller. It specifies the ConfigMap to use for custom configurations.

```bash
- --configmap=default/haproxy-conf
```

--------------------------------

### Create ConfigMap for HAProxy Customization

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/custom-configuration/README.md

Use this command to create a ConfigMap named 'haproxy-ingress' and set the 'syslog-endpoint' to a specific IP address. This is an example of how to customize a specific HAProxy setting.

```bash
$ kubectl create configmap haproxy-ingress --from-literal=syslog-endpoint=172.17.8.101
```

--------------------------------

### Configure Deployment to Run as Root User

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/configuration/keys.md

Set the `runAsUser` to `0` in the pod's security context to allow the container to start as the root user. This is necessary for certain security configurations like chroot.

```yaml
...
  template:
    spec:
      securityContext:
        runAsUser: 0

```

```yaml
controller:
  securityContext:
    runAsUser: 0

```

--------------------------------

### Install Prometheus Operator Helm Chart

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/metrics.md

Installs or upgrades the kube-prometheus-stack Helm chart to deploy Prometheus Operator and its components.

```bash
helm upgrade prometheus prometheus-community/kube-prometheus-stack \
  --install \
  --create-namespace --namespace monitoring \
  -f prometheus-operator-values.yaml

```

--------------------------------

### Test Default Backend Access

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/tls-termination/README.md

These commands demonstrate accessing the default backend before and after setting the correct `Host` header, showing a 404 and then a redirect.

```bash
$ curl -iL 172.17.4.99:30876
HTTP/1.1 404 Not Found
Date: Tue, 07 Feb 2017 00:06:07 GMT
Content-Length: 21
Content-Type: text/plain; charset=utf-8

default backend - 404
```

```bash
$ curl -iL 172.17.4.99:30876 -H 'Host: foo.bar'
HTTP/1.1 302 Found
Cache-Control: no-cache
Content-length: 0
Location: https://foo.bar/
Connection: close
^C
```

--------------------------------

### Scale Green Deployment and Observe Load

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/blue-green.md

Scales the green deployment to 3 replicas and monitors pod status, demonstrating how replica count affects load in pod mode.

```bash
$ kubectl scale deploy green --replicas=3
$ kubectl get pod -w
```

--------------------------------

### Deploy Default Backend

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/deployment/README.md

Deploys a default backend service using the 'defaultbackend' image, which serves '404 Not Found' pages. It's configured with resource limits for CPU and memory.

```bash
$ kubectl run ingress-default-backend \
  --namespace=ingress-controller \
  --image=gcr.io/google_containers/defaultbackend:1.0 \
  --port=8080 \
  --limits=cpu=10m,memory=20Mi \
  --expose
```

--------------------------------

### Create echoserver Deployment and Service

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/getting-started/_index.md

Deploys the echoserver image and exposes it as a Kubernetes Service.

```bash
$ kubectl --namespace default create deployment echoserver --image k8s.gcr.io/echoserver:1.3
$ kubectl --namespace default expose deployment echoserver --port=8080
```

--------------------------------

### List Minikube Addons

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/setup-cluster.md

List all available addons for your Minikube cluster and their current status (enabled or disabled).

```bash
minikube addons list
- addon-manager: enabled
- dashboard: enabled
- kube-dns: enabled
- heapster: disabled
```

--------------------------------

### Configure Unprivileged Port Start

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/external-haproxy.md

This configuration allows HAProxy to start on unprivileged ports by setting the net.ipv4.ip_unprivileged_port_start sysctl value. Note that this configuration has limitations and may not work with hostNetwork or older kernel versions.

```yaml
controller:
  config:
    syslog-endpoint: stdout
    syslog-format: raw
  haproxy:
    enabled: true
    securityContext:
      sysctls:
        name: net.ipv4.ip_unprivileged_port_start
        value: "1"
```

--------------------------------

### Displaying glbc Help Information

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/setup-cluster.md

Use the --help flag to view available options for the glbc command, including flags like --running-in-cluster.

```console
$ cd $GOPATH/k8s.io/ingress/controllers/gce
$ glbc --help
```

--------------------------------

### HTTP Response With Headers Only

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/configuration/keys.md

Provide only headers in the HTTP response. This example sets the `connection` header to `close`.

```yaml
  data:
    http-response-404: |
      connection: close
```

--------------------------------

### Clone Kubernetes Repository

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/setup-cluster.md

Clone the Kubernetes repository to your local development environment. Ensure you have Go installed and are in your Go path.

```bash
cd $GOPATH/src/k8s.io
git clone https://github.com/kubernetes/kubernetes.git
```

--------------------------------

### External HAProxy Container Logs

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/external-haproxy.md

Example log output from the external haproxy container, showing access logs for requests.

```log
... 
192.168.1.10:61116 [17/Jan/2021:17:32:36.050] _front_http _error404/<lua.send-404> 0/0/0/0/0 404 190 - - LR-- 1/1/0/0/0 0/0 "GET / HTTP/1.1"
```

--------------------------------

### Deploy Echo Application

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/modsecurity.md

Deploys a simple echo server application to Kubernetes.

```bash
$ kubectl run echo \
  --image=gcr.io/google_containers/echoserver:1.3 \
  --port=8080 \
  --expose
```

--------------------------------

### Create Echoserver Deployment

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/auth/oauth/README.md

Deploy a simple echoserver to simulate your application and test the headers passed by the oauth2-proxy.

```bash
kubectl run echoserver \
  --image=gcr.io/google_containers/echoserver:1.3 \
  --port=8080 \
  --expose
```

--------------------------------

### Get ModSecurity Service ClusterIP

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/modsecurity.md

Retrieves the ClusterIP address assigned to the ModSecurity agent service, which is needed for the HAProxy Ingress ConfigMap.

```bash
$ kubectl -n ingress-controller get service modsecurity-spoa
NAME                     TYPE       CLUSTERIP        EXTERNAL-IP  PORT(S)     AGE
modsecurity-spoa         ClusterIP  172.20.216.246   <none>       12345/TCP   7m
```

--------------------------------

### Create Valid Client Certificate and Key

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/auth/client-certs/README.md

Generates a valid client certificate and private key signed by the CA.

```bash
openssl req -new -newkey rsa:2048 -nodes -subj '/CN=client' -keyout client.key | \
  openssl x509 -req -CA ca.crt -CAkey ca.key -set_serial 1 -out client.crt
```

--------------------------------

### Fragmented Ingress for Distinct Configurations

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/configuration/keys.md

Example of splitting configurations across multiple Ingress resources to apply distinct settings to different routes.

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-front
spec:
  rules:
  - host: app.local
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: frontend
            port:
              number: 8080
```

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    haproxy-ingress.github.io/rewrite-target: "/"
  name: app-back
spec:
  rules:
  - host: app.local
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: backend
            port:
              number: 8080
```

--------------------------------

### Deploy Optional Web App for Testing

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/deployment/README.md

Deploys a simple web application using the 'echoserver' image for testing the ingress controller's functionality. It runs as a deployment with one replica and exposes port 8080.

```bash
$ kubectl run http-svc \
  --namespace=ingress-controller \
  --image=gcr.io/google_containers/echoserver:1.3 \
  --port=8080 \
  --replicas=1 \
  --expose
```

--------------------------------

### Configure Request Headers for Authentication

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/configuration/keys.md

This configuration copies only headers starting with 'X-' from the client to the authentication service. All other headers are copied by default unless explicitly excluded.

```yaml
auth-headers-request: "X-*"
```

--------------------------------

### Select Blue Group via Header

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/blue-green/README.md

Sets the GROUP environment variable to 'blue' and then runs the hareq alias. This directs all requests to the 'blue' deployment using the configured header selector.

```bash
$ GROUP=blue
$ hareq
Running 100 requests...
 100 blue
```

--------------------------------

### Configure Coraza in HAProxy Ingress ConfigMap

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/modsecurity.md

Add these keys to your haproxy-ingress ConfigMap to enable and configure Coraza. Adjust `modsecurity-args` based on your Coraza setup and version.

```yaml
modsecurity-use-coraza: true
modsecurity-args: "app=hdr(host) id=unique-id src-ip=src src-port=src_port dst-ip=dst dst-port=dst_port method=method path=path query=query version=req.ver headers=req.hdrs body=req.body"
```

--------------------------------

### Test Pod Mode with Increased Green Replicas

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/blue-green.md

Tests traffic distribution after increasing green replicas to 3, expecting a 1:3 balance.

```bash
$ hareq
Running 100 requests...
  25 blue
  75 green
```

--------------------------------

### Test Deploy Mode with 1:2 Balance

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/blue-green.md

Tests traffic distribution with the configured 1:2 balance in deploy mode.

```bash
$ hareq
Running 100 requests...
  33 blue
  67 green
```

--------------------------------

### Configure Custom HTTP Response Payload

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/configuration/keys.md

Customize the content type, headers, and body for a specific HTTP response code. This example shows how to set a custom response for 404 errors.

```yaml
  data:
    http-response-404: |
      content-type: text/plain
      connection: close

      404 not found
```

--------------------------------

### Configure Blue/Green Balance (Deploy Mode)

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/blue-green/README.md

Annotates the ingress resource to set a specific blue/green balance, with a ratio of 1 for blue and 2 for green. This configuration is applied when BG mode is set to 'deploy'.

```bash
$ kubectl annotate --overwrite ingress bluegreen \
  ingress.kubernetes.io/blue-green-deploy=group=blue=1,group=green=2
```

--------------------------------

### Test Legitimate Request

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/modsecurity/README.md

Send a simple GET request to the Ingress controller to verify that the application is accessible and returning a 200 OK status. Replace the IP with your Ingress controller's IP.

```bash
$ curl -I 192.168.100.99 -H 'Host: echo.domain'
HTTP/1.1 200 OK
Server: nginx/1.9.11
Date: Sun, 27 May 2018 23:28:58 GMT
Content-Type: text/plain
```

--------------------------------

### Configure HAProxy Ingress for Blue/Green

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/blue-green.md

Define an Ingress resource to manage traffic for 'bluegreen.example.com'. Use annotations to specify the blue-green deployment strategy, including the 'group' labels and their initial weights (e.g., 1:1). The 'blue-green-mode' is set to 'pod' for direct pod routing.

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    haproxy-ingress.github.io/balance-algorithm: roundrobin
    haproxy-ingress.github.io/blue-green-deploy: group=blue=1,group=green=1
    haproxy-ingress.github.io/blue-green-mode: pod
    haproxy-ingress.github.io/ssl-redirect: "false"
  name: bluegreen
spec:
  rules:
  - host: bluegreen.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: bluegreen
            port:
              number: 8000
```

--------------------------------

### Verify Pods and Labels

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/blue-green/README.md

Check that the pods are running and have the correct 'group' and 'run' labels applied.

```bash
$ kubectl get pod -lrun=bluegreen --show-labels
NAME                     READY     STATUS    RESTARTS   AGE       LABELS
blue-79c9b67d5b-5hd2r    1/1       Running   0          35s       group=blue,pod-template-hash=3575623816,run=bluegreen
green-7546d648c4-p7pmz   1/1       Running   0          28s       group=green,pod-template-hash=3102820470,run=bluegreen
```

--------------------------------

### Test Connection With Valid Certificate

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/auth/client-certs/README.md

Connects to the service using the correct client certificate and private key, expecting a successful response.

```bash
curl -ik https://foo.bar:31692 --resolve 'foo.bar:31692:172.17.4.99' --cert client.crt --key client.key
```

--------------------------------

### Deploy HAProxy Ingress with Custom ConfigMap

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/custom-configuration/README.md

Deploy the HAProxy Ingress controller using a custom YAML file. Ensure the --configmap parameter is correctly set to point to your custom ConfigMap, for example, 'default/haproxy-conf'.

```bash
$ kubectl create -f haproxy-custom-configuration.yaml
```

--------------------------------

### Test Pod Mode Blue/Green Balance

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/blue-green.md

Verifies the traffic distribution in pod mode with a 1:1 balance between blue and green deployments.

```bash
$ hareq
Running 100 requests...
  50 blue
  50 green
```

--------------------------------

### Configure TCP Services via ConfigMap

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/configuration/command-line.md

Defines TCP services and ports for HAProxy to listen on using a ConfigMap. The ConfigMap key is the HAProxy port number. Deprecated starting v0.13, use tcp-service-port instead.

```yaml
data:
  "3306": "default/mysql:3306::::-"
  "5432": "default/pgsql:5432::::1s"
  "8000": "system-prod/http:8000::PROXY-V1"
  "9900": "system-prod/admin:9900:PROXY::system-prod/tcp-9900"
  "9990": "system-prod/admin:9999::PROXY-V2"
  "9995": "system-prod/admin:9900:::system-prod/tcp-9995::system-prod/tcp-9995-ca"
  "9999": "system-prod/admin:9900:PROXY:PROXY"
```

--------------------------------

### Configure Deploy Mode Balance

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/blue-green.md

Sets the blue/green balance in deploy mode to 1:2 (blue:green) using an ingress annotation.

```bash
$ kubectl annotate --overwrite ingress bluegreen \
  haproxy-ingress.github.io/blue-green-deploy=group=blue=1,group=green=2
```

--------------------------------

### Switch to Deploy Mode for Blue/Green

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/blue-green.md

Annotates the ingress resource to switch the blue/green mode from 'pod' to 'deploy'. This mode targets balance configuration to the entire deployment.

```bash
$ kubectl annotate --overwrite ingress bluegreen \
  haproxy-ingress.github.io/blue-green-mode=deploy
```

--------------------------------

### Deploy echoserver Workload

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/configuration/gateway-api.md

Deploys a sample echoserver deployment and exposes it via a Kubernetes Service. This is a prerequisite for testing Gateway API configurations.

```bash
$ kubectl --namespace default create deployment echoserver --image k8s.gcr.io/echoserver:1.3
$ kubectl --namespace default expose deployment echoserver --port=8080
```

--------------------------------

### Select Green Group via Header

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/blue-green/README.md

Sets the GROUP environment variable to 'green' and then runs the hareq alias. This directs all requests to the 'green' deployment using the configured header selector.

```bash
$ GROUP=green
$ hareq
Running 100 requests...
 100 green
```

--------------------------------

### Check for Ready Nodes (Local Cluster)

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/setup-cluster.md

Verify that the Kubernetes nodes in your local cluster are in a 'Ready' state. This command uses the 'local' context.

```bash
kubectl get no --context=local
NAME        STATUS    AGE       VERSION
127.0.0.1   Ready     5s        v1.6.0-alpha.0.1914+8ccecf93aa6db5-dirty
```

--------------------------------

### Create Fake Certificate and Key

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/auth/client-certs/README.md

Generates a fake CA, certificate, and private key for testing refusal scenarios.

```bash
openssl req -x509 -newkey rsa:2048 -nodes -subj '/CN=example-ca' -keyout ca-fake.key -out ca-fake.crt
openssl req -new -newkey rsa:2048 -nodes -subj '/CN=client' -keyout fake.key | \
  openssl x509 -req -CA ca-fake.crt -CAkey ca-fake.key -set_serial 1 -out fake.crt
```

--------------------------------

### Check 'bar.foo' Certificate

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/multi-tls/README.md

Use openssl to verify the TLS certificate presented for the 'bar.foo' hostname.

```bash
$ openssl s_client -connect 10.129.51.55:31578 -servername bar.foo
...
subject=/CN=bar.foo
issuer=/CN=bar.foo
---
```

--------------------------------

### Test With Host Headers

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/multi-tls/README.md

These commands test the controller's response when specific host headers ('foo.bar' and 'bar.foo') are provided, demonstrating successful redirection.

```bash
$ curl -iL 10.129.51.55:36462 -H 'Host: foo.bar'
HTTP/1.1 302 Found
Cache-Control: no-cache
Content-length: 0
Location: https://foo.bar/
Connection: close
```

```bash
$ curl -iL 10.129.51.55:36462 -H 'Host: bar.foo'
HTTP/1.1 302 Found
Cache-Control: no-cache
Content-length: 0
Location: https://bar.foo/
Connection: close
^C
```

--------------------------------

### Check for Ready Nodes (Minikube)

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/setup-cluster.md

Check the status of nodes in your Minikube cluster. This command lists nodes and their versions.

```bash
kubectl get no
NAME       STATUS    AGE       VERSION
minikube   Ready     42m       v1.4.6
```

--------------------------------

### Enable Minikube Ingress Addon

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/setup-cluster.md

Enable the ingress addon for your Minikube cluster if it is not already enabled. This is a prerequisite for deploying the HAProxy Ingress controller.

```bash
minikube addons enable ingress
```

--------------------------------

### Deploy Demo Application and TLS Secret

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/metrics.md

Deploys a sample application and a self-signed TLS certificate as a Kubernetes secret. This is a prerequisite for testing ingress and TLS functionality.

```bash
openssl req -x509 -subj "/CN=dory.localdomain" -nodes -days 30 -newkey rsa:2048 -keyout /tmp/h.key -out /tmp/h.crt
kubectl --namespace default create secret tls dory --cert /tmp/h.crt --key /tmp/h.key
rm -fv /tmp/h.crt /tmp/h.key
kubectl --namespace default create deploy dory --image jcmoraisjr/dory
kubectl --namespace default scale deploy dory --replicas=4
kubectl --namespace default expose deploy dory --port 8000
kubectl --namespace default create ingress dory \
  --class=haproxy \
  --annotation haproxy-ingress.github.io/ssl-redirect=false \
  --rule="dory.localdomain/*=dory:8000,tls=dory"
```

--------------------------------

### Create Blue and Green Deployments

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/docs/content/en/docs/examples/blue-green.md

Use kubectl to create two deployments, 'blue' and 'green', each with distinct labels for the blue-green strategy. Ensure they use the same 'run' label for service selection and different 'group' labels for deployment differentiation.

```bash
$ kubectl run blue \
  --image=jcmoraisjr/whoami \
  --port=8000 --labels=run=bluegreen,group=blue
deployment "blue" created

$ kubectl run green \
  --image=jcmoraisjr/whoami \
  --port=8000 --labels=run=bluegreen,group=green
deployment "green" created
```

--------------------------------

### Verify Ingress Creation

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/blue-green/README.md

Confirm that the Ingress resource has been successfully created and is accessible.

```bash
$ kubectl get ing
NAME        HOSTS                   ADDRESS   PORTS     AGE
bluegreen   bluegreen.example.com             80        11s
```

--------------------------------

### Check 'foo.bar' Certificate

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/multi-tls/README.md

Use openssl to verify the TLS certificate presented for the 'foo.bar' hostname.

```bash
$ openssl s_client -connect 10.129.51.55:31578 -servername foo.bar
...
subject=/CN=foo.bar
issuer=/CN=foo.bar
---
```

--------------------------------

### Connect to HAProxy Ingress with Client Certificate

Source: https://github.com/jcmoraisjr/haproxy-ingress/blob/master/examples/auth/client-certs/README.md

This command demonstrates how to connect to the HAProxy Ingress controller using a client certificate and private key. It includes sending an HTTP request and shows a successful response, indicating that client certificate authentication has passed.

```http
GET / HTTP/1.0
Host: foo.bar
```

```bash
$ openssl s_client -connect 172.17.4.99:31692 -servername foo.bar -cert client.crt -key client.key
... 
---
GET / HTTP/1.0
Host: foo.bar

HTTP/1.1 200 OK
Server: nginx/1.9.11
Date: Sun, 26 Mar 2017 14:06:30 GMT
Content-Type: text/plain
Content-Length: 268
Connection: close
Strict-Transport-Security: max-age=15768000

CLIENT VALUES:
...
```