v0.12.0

[0.12.0] - 2026-11-10

Changed

• haptic preflight --resources lists the Warning Events its render records.

Fixed

• Playground downloads recover from stalled transfers, and the entry page opens the current stable release.

Helm chart

Added

• HAProxyRoutePolicy.spec.sourceAddress restricts attached HTTPRoute and GRPCRoute rules with inline or immutable-ConfigMap IPv4/IPv6 allow and deny lists, with invalid rules failing closed (#662).
• Serve additional TLS Secrets from the controller namespace by SNI through controller.config.templatingSettings.extraContext.tls.additionalCertificates (#640).
• haproxy-haptic.org/redirect-scheme, -host, -port, -path, -path-prefix, -query, and -code redirect an Ingress's routes to a target built from the request, so a host alias keeps the path and query (#643).
• haproxy-haptic.org/backend-ca-secret: "@system-ca" verifies an Ingress upstream against HAProxy's system CA store (#653).
• haproxy-haptic.org/response-remove-header and haproxy-haptic.org/request-remove-header remove response and request headers by exact name or <prefix>* family (#648).

Changed

• BREAKING: haproxy-haptic.org/https-redirect, https-redirect-code, https-redirect-port, permanent-redirect, permanent-redirect-code, temporary-redirect, and temporary-redirect-code are removed in favor of redirect-*; admission rejects them. See Removed annotations for the migration.

Fixed

• Header annotations reject changes to Content-Length, Transfer-Encoding, and request Host, including removal prefixes that match them, preventing dropped request bodies and invalid response framing (#654).
• Admission refusals consistently say the affected resource is rejected instead of describing reconcile-only skipped, fallback, or 503 behavior (#655, #660).
• Disabling the SPOA hub removes mirror and shared rate-limit dispatch directives, keeping active HTTPS frontends valid.
• A JWT metadata ConfigMap that is invalid, names a host the Ingress doesn't serve, or conflicts with another document returns 503 for that Ingress with a JWTMetadataInvalid Warning Event, instead of stopping the configuration from rendering and failing admission of unrelated Ingresses (#644).
• haproxy.org/request-redirect keeps the request path and query, adds http:// to a bare host, and applies only to the Ingress's routes, as upstream does.
• A Service of type: ExternalName referenced by an Ingress, Gateway route, or default backend now emits a server line for spec.externalName with runtime DNS resolution via resolvers dns, instead of rendering an empty backend that answers 503 (#647).