LoginSign Up
← Back to all sparks
H

HAProxy Kubernetes Ingress Controller

INFRA · APIS
Velocity2.5

Ingress controller bringing HAProxy load balancing to Kubernetes

www.haproxy.com/documentation/kubernetes-ingress ↗

Nine months into the 3.2 line, HAProxy Ingress is still repairing ssl-passthrough and ingress merge order.

kubernetesingressssl-passthroughcorrectnessreconciliation
◆Current state
The controller ships a steady patch cadence on the 3.2 branch, roughly one release every two to four weeks. Content is almost entirely correctness work: ssl-passthrough handling and the rules that decide which Ingress object owns a shared backend. Feature additions are absent from the last ten releases; dependency bumps to k8s.io and golang.org/x packages appear in most of them.
◆Where it's heading
v3.2.13 is the largest release in the window and marks a shift from patching individual ssl-passthrough bugs to defining the semantics properly: backends are now reconciled rather than recreated, the invariant is applied before anything that can fail, and controller-owned backend state survives a failed transaction. Alongside it, ingress merge order became deterministic — oldest ingress first — and the first Ingress to constitute a backend now owns it, with the annotations a losing Ingress forfeits named explicitly. That pairing suggests the team traced a class of flapping and non-reproducible config bugs back to undefined ordering.
◆Prediction
Expect the next few releases to stay on the 3.2 patch line, adding tests around the new ownership and passthrough invariants rather than new annotations.

◆Recent moves

  1. 4d ago

    Deterministic ingress merge order and reconciled ssl-passthrough backends

    The release that turns the running ssl-passthrough repair into a defined model: backends are reconciled on every sync instead of created, the passthrough invariant is applied before any fallible step, and controller-owned state survives a failed transaction. It also makes ingress walking deterministic by age and gives backend ownership to the first Ingress that constitutes it. For anyone running several Ingress objects against one service, this changes which annotations actually take effect.

    View source ↗
  2. 1mo ago

    ssl-passthrough mode now resolved before rules are built

    Resolves passthrough mode ahead of rule construction and fixes a block_secrets stability regression. An early step in the same ssl-passthrough arc that v3.2.13 completes, handled here as a point fix rather than a model change.

    View source ↗
  3. 2mo ago

    Stops continuous reloads on default log config; deprecates cookie-persistence

    Fixes a reload loop triggered by the default log configuration and deprecates the cookie-persistence annotation on Ingress. The deprecation is the more durable signal — it narrows the annotation surface the ownership rules in v3.2.13 have to arbitrate.

    View source ↗
  4. 2mo ago

    ExternalName backends no longer bypassed by orphan EndpointSlices

    Fixes ExternalName backend resolution being bypassed when orphan EndpointSlices are present, with unit tests for getRuntimeBackend. Another instance of the pattern running through this window: stale or unexpected cluster state silently producing the wrong backend.

    View source ↗
  5. 2mo ago

    Dependency bumps only

    k8s.io and golang.org/x module updates with no user-visible change. Routine maintenance between the substantive passthrough fixes on either side of it.

    View source ↗
  6. 3mo ago

    Dependency bumps and Go 1.26 base image

    Updates k8s.io packages and moves the container base image to golang 1.26-alpine. Build-side only; operators see no behavior change.

    View source ↗