Connecting to on-premise Kubernetes through an ingress controller

Use this option when you run on Kubernetes without OpenShift routes and want to expose Db2 externally through an ingress controller or similar TCP entry point.

1. Find the Db2 engine NodePort service and identify the node ports:
   1. Run the following command:

      oc get svc c-${instance-name}-db2u-engn-svc -n ${namespace}

   2. Look for the NodePort mappings in the output:
      • Port `50000` (non-SSL) will be mapped to a high-numbered port. For example, 30000-32767.
      • Port `50001` (SSL) will be mapped to a high-numbered port. For example, 30000-32767.
      Example output:

      NAME                         TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)                       AGE
      c-db2inst1-db2u-engn-svc    NodePort   172.30.123.45   <none>        50000:31234/TCP,50001:31235/TCP   5d

      The SSL NodePort in this example is 31235.

      For a single‑node deployment, using the head‑engine service is often simpler because it connects directly to the head engine.

      In many on‑premises environments, a NodePort sits behind an ingress controller or another external TCP entry point. Clients connect to the hostname or IP address exposed by that ingress layer, along with its port. The ingress layer then forwards the traffic to the Db2 NodePort on the cluster nodes.

2. Configure your ingress controller to forward traffic to the Db2 NodePort.
   The exact configuration depends on the ingress controller that you use. The following example shows an HAProxy configuration.

   1. Install HAProxy:

      yum install haproxy -y

   2. Edit the HAProxy configuration:

      vi /etc/haproxy/haproxy.cfg

   3. Add the following configuration with your values:

      frontend db2
          bind *:<db2-nodeport>
          default_backend db2u
          mode tcp
          option tcplog
      
      backend db2u
          balance source
          mode tcp
          server master0 <master0-private-ip>:<db2-nodeport> check
          server master1 <master1-private-ip>:<db2-nodeport> check
          server master2 <master2-private-ip>:<db2-nodeport> check

   4. Validate the configuration:

      haproxy -c -f /etc/haproxy/haproxy.cfg

   5. Reload HAProxy and check status:

      systemctl reload haproxy
      systemctl status haproxy

3. Connect to the database using the following:
   • Hostname: HAProxy server hostname or IP address
   • Port: The NodePort you configured in Ha Proxy. For example, 31235 for SSL.
   • Connection type: SSL/TLS if you are using the SSL NodePort.

   Example connection string:

   db2 connect to <database-name> user <username> using <password> host <haproxy-hostname> port <db2-nodeport> ssl