v0.10.0

[0.10.0] - 2026-11-02

Added

• fileRegistry.Register("secret", …) delivers a file to sidecars under spec.dataplane.secretsDir (default /etc/haproxy/secrets) without a reload. Its content is published only as a Kubernetes Secret, readable resources carry a keyed digest instead of a content digest, and the secret:<name> validation test target asserts on it.
• haptic preflight --resources <path> and --resources-from-cluster also render the configuration against the resources the controller will watch and run haproxy -c on the result (#586).

Fixed

• A map or file whose template reads a watched resource directly (such as with GetSingle) or fetches over HTTP now picks up changes to that input after a render reused its previous output; before, it could keep stale content indefinitely (#604).
• A render no longer panics when a template imports a snippet exporting a var function both directly and from inside a macro; the snippet now initializes at whichever import runs first (#585).
• After a release was only partly applied, the pre-rollout hook failed every later sync or upgrade with "finish the current apply before upgrading". It now validates the incoming release and applies it, which completes the partial one (#559).

Helm chart

Added

• Gateway API v1.7.0 support, including its sessionPersistence shape; sessionPersistence.cookie.path sets the cookie's Path.
• A secret-storage tmpfs volume at /etc/haproxy/secrets, mounted in the agent and SPOA hub containers but not in the HAProxy container.
• haproxy-haptic.org/sso-auth signs users in with OpenID Connect through the SPOA hub's sso-auth plugin, using a provider Secret in the Ingress's namespace; sso-auth-allowed-groups admits only members of the listed groups, and pass-token forwards the ID or access token as Authorization: Bearer and refreshes it (#548).
• controller.config.templatingSettings.extraContext.ssoAuth.allowedIssuers lists the identity providers sso-auth provider Secrets may use.
• Governance rules take a label selector to apply only to matching resources, and defaultFrom to pick a default by a value of the resource such as its hosts (#582).
• haproxy-haptic.org/error-pages names a ConfigMap whose pages replace the 401, 403, 413, and 429 HAProxy sends when it refuses a request and the 500, 502, 503, and 504 it generates for the Ingress's backends, as a static file or an lf-file limited to operator-allowed expressions (#571, #577, #578).
• controller.config.templatingSettings.extraContext.customResponses.defaultErrorPages names a ConfigMap whose error pages apply to every Ingress; an Ingress's own error-pages override it per status code (#583).
• controller.config.templatingSettings.extraContext.tls.requireSniHostMatch and the haproxy-haptic.org/require-sni-host-match annotation answer 421 when an HTTPS request's Host differs from its TLS SNI (#567).
• vector.requestMetrics.serverLabel: counters adds the server label to requests_total only, keeping it off the histograms (#564).

Changed

• The CRDs moved from crds/ to the haptic-crds subchart (charts/haptic-crds/crds/), which keeps them out of the Helm release Secret; Helm still installs them, and the apply-crds hook still upgrades them (#588).
• Update the bundled Vector image to 0.61.0.
• The controller requests 500m CPU instead of 100m, so its startup validation finishes within the startup probe on a busy node (#570).

Fixed

• Restart the controllers when the SPOA hub plugin set changes, so their validator stops rejecting configurations that use a newly enabled plugin (#546).
• The oauth annotations of the HAPTIC and haproxy-ingress libraries send the request's path and query as rd to oauth2-proxy's sign-in instead of the literal %[path]; a trailing $escaped_request_uri in any auth-signin URL is expanded the same way (#550).
• The oauth annotations no longer apply external authentication to the Ingress's own oauth2-proxy path, which redirected browsers in a loop (#551).
• The vector and spoa-hub sidecar health checks no longer trigger Falco's "Redirect STDOUT/STDIN to Network Connection in Container" rule every few seconds (#555).
• Source allow-lists and deny-lists of every annotation family are enforced before the SPOA hub, so a refused client is denied before WAF, external authentication or OIDC sign-in (#568).

Security

• Plain HTTP to an Ingress that requires a client certificate is redirected to HTTPS instead of being served without verification; only ACME HTTP-01 challenge requests stay on HTTP.