This message was deleted.

We're using haproxy. Works for tcp and udp (layer4, and also https/https if you need a layer 7) and shouldn't be an issue for air-gapped. You can do it HA externally via keepalived.