Limitations and Considerations
EasyHAProxy will not work with --network=host
The --network=host option cannot be used with EasyHAProxy due to its networking requirements.
EasyHAProxy needs to inspect and interact with Docker containers from within the Docker network where it's running. Using the --network=host option bypasses Docker networking, preventing EasyHAProxy from accessing and configuring containers effectively.
The same applies to the containers it routes to: a labeled container that uses --network=host, --network=none or --network=container:<name> cannot join the EasyHAProxy network, so it is skipped and the log says why. The other containers are still routed.
Considerations for Multiple Replica Deployments in EasyHAProxy
EasyHAProxy is designed for single replica deployment.
What happens with multiple replicas?
On Kubernetes, multiple copies come from replicaCount above 1 in Deployment mode, or from more than one labeled node in DaemonSet mode, where one pod runs on every node with the easyhaproxy/node label.
EasyHAProxy can still operate with multiple replicas; however:
-
Service Discovery: Each replica will independently discover services, which may lead to temporary inconsistencies among replicas (out-of-sync for a few seconds).
-
ACME/Certificate Issues: Running multiple replicas creates significant problems with Let's Encrypt and other ACME certificate issuance:
- Each replica will attempt to obtain its own certificate
- ACME challenges may be directed to different replicas, causing failures
- You may quickly hit certificate issuance rate limits
- Certificate renewal may fail unpredictably
If you need to run multiple replicas for high availability, do not activate ACME/Let's Encrypt. Instead, use manually managed certificates or an external certificate management solution.