I’d argue that you don’t need TCP load balancing if you have service discovery. You can access master.mysql.service.consul:3306 from any machine in your cluster if your MySQL master is registered in consul with the master tag. Same goes for slave.mysql.service.consul:3306.
Fabio now supports TCP proxying for TLS connections which allow you to forward a TLS connection without re-encryption. You get full end-to-end encryption with this.