LoginSign Up
← Back to all sparks
H

HAProxy Kubernetes Ingress Controller

INFRA · APIS
Velocity5.0

Ingress controller bringing HAProxy load balancing to Kubernetes

www.haproxy.com/documentation/kubernetes-ingress ↗

Fourteen patches into 3.2, and ssl-passthrough is still where the bugs are.

ingress-controllerhaproxyssl-passthroughkubernetespatch-releasestabilization
◆Current state
The controller is deep in the 3.2 patch line, shipping roughly every two weeks with no new configuration surface since the series opened. Four of the last six releases touch ssl-passthrough: resolving its mode before rules are built, reconciling its backends, and now keeping allow and deny lists attached to the https frontend. The rest is Kubernetes-object correctness — EndpointSlice handling, ingress merge ordering, duplicated backend config snippets.
◆Where it's heading
This is a stabilisation series, not a feature series. The recurring theme is that ssl-passthrough interacts badly with everything layered on top of it — access control, backend reconciliation, rule generation — and each release fixes one more intersection. Test coverage is now landing alongside the fixes rather than after them, which suggests the maintainers are treating the passthrough path as a known weak spot rather than a series of unrelated bugs.
◆Prediction
Expect 3.2.x to continue at a two-week cadence with further ssl-passthrough intersections, and expect any new capability to wait for a 3.3 line rather than arrive in a patch.

◆Recent moves

  1. 19d ago

    ssl-passthrough allow/deny lists retained on the https frontend

    Two BUG/MEDIUM fixes on top of routine Go and k8s.io dependency bumps. The load-bearing one keeps allow and deny lists attached to the https frontend under cluster passthrough — an access-control rule silently dropping is worth noticing — and it ships with a test covering that case. The second stops the controller duplicating the default local backend config snippet.

    View source ↗
  2. 1mo ago

    Deterministic ingress merge order and reconciled ssl-passthrough backends

    Deterministic ingress merge ordering plus reconciled ssl-passthrough backends. The immediate predecessor in the same passthrough thread that 3.2.14 continues.

    View source ↗
  3. 2mo ago

    ssl-passthrough mode now resolved before rules are built

    Resolving ssl-passthrough mode before rules are built — the ordering fix that the later backend and allow-list work builds on.

    View source ↗
  4. 3mo ago

    Stops continuous reloads on default log config; deprecates cookie-persistence

    Stopped continuous reloads triggered by the default log config and deprecated cookie-persistence. Operationally visible: needless reloads on a proxy are churn users feel.

    View source ↗
  5. 3mo ago

    ExternalName backends no longer bypassed by orphan EndpointSlices

    ExternalName backends no longer bypassed by orphan EndpointSlices — the Kubernetes-object correctness half of this stabilisation series.

    View source ↗
  6. 3mo ago

    Dependency bumps only

    Dependency bumps only. No user-visible change.

    View source ↗