LoginSign Up
← Back to all sparks
H

HAProxy Kubernetes Ingress Controller

INFRA · APIS
Velocity0.0

Ingress controller bringing HAProxy load balancing to Kubernetes

www.haproxy.com/documentation/kubernetes-ingress ↗

The changelog is a raw commit log, and its severity tags tell you more than the prose would.

kubernetes-ingresshaproxycommit-log-changelogsecurity-hardeningregression-followupservice-resolution
◆Current state
Every release note is a list of commit hashes with HAProxy's own severity prefixes attached — BUILD/MINOR, BUG/MEDIUM, TEST/MINOR, MAJOR. Two of the six releases in this window contain nothing but go.mod and base image bumps. The 3.2.x line ships roughly every two to four weeks and stays entirely within patch scope.
◆Where it's heading
The interesting arc is traceable through the tags. v3.2.7 landed two commits marked MAJOR — feature and security improvements to the haproxy wrapper and to block secrets protection — and five releases later v3.2.12 fixes a BUG/MEDIUM described as a block_secrets stability regression. The security hardening introduced instability that took nearly two months to surface and correct. Alongside that, the recurring subject is Kubernetes resource resolution: ExternalName backends bypassed by orphan EndpointSlices, ssl-passthrough mode resolved too late to build rules correctly.
◆Prediction
Expect the 3.2.x line to continue absorbing fallout from the 3.2.7 hardening work and further edge cases in service resolution; the deprecation of the cookie-persistence annotation in 3.2.11 suggests annotation cleanup is also in progress.

◆Recent moves

  1. 1mo ago

    HAProxy Ingress 3.2.12 fixes a block_secrets stability regression

    Two real fixes behind the dependency bump: a block_secrets stability regression traceable to the MAJOR hardening work in 3.2.7, and ssl-passthrough mode now resolved before rules are built. The accompanying test commit covering passthrough mode resolution suggests this was an under-tested path.

    View source ↗
  2. 1mo ago

    HAProxy Ingress 3.2.11 stops reload churn on default log config

    Stops continuous reloads triggered by the default log config — a bug that costs churn on every controller running unmodified defaults. Also deprecates the cookie-persistence annotation on Ingress.

    View source ↗
  3. 2mo ago

    HAProxy Ingress 3.2.10 fixes ExternalName backend resolution

    Fixes ExternalName backend resolution being bypassed by orphan EndpointSlices, with unit tests added for getRuntimeBackend alongside it. A narrow but real routing correctness bug.

    View source ↗
  4. 2mo ago

    HAProxy Ingress Controller v3.2.9

    Two dependency bumps to k8s.io and golang.org/x packages, tagged BUILD/MINOR. Nothing else in the release.

    View source ↗
  5. 2mo ago

    HAProxy Ingress Controller v3.2.8

    A k8s.io package update and a bump of the golang base image to 1.26-alpine. Build maintenance only.

    View source ↗
  6. 2mo ago

    HAProxy Ingress 3.2.7 hardens the wrapper and secrets protection

    The substantial release of the window, carrying two commits tagged MAJOR — feature and security improvements to the haproxy wrapper and to block secrets protection — plus Backend CRD support for HTTP checks, error rules, log targets and TCP checks with e2e coverage. It is also the origin of the regression fixed in 3.2.12.

    View source ↗