v0.8.0

[0.8.0] - 2026-10-28

HAPTIC 0.8 adds client-certificate identity checks and headers for Ingress,
and serves TLSRoute termination and passthrough listeners on the same port.
It also closes Ingress client-certificate verification bypasses and tightens
trust of client-address headers.

Before upgrading: if you use src-ip-header, check which proxies may set
that header. Routes protected by client-certificate verification now enforce it
when using the default TLS certificate too. Read the
upgrade notes.

Added

• validationTests.<name>.useDeploymentWatchScopes checks fixtures against configured watch namespaces, including expected out-of-scope lookup rejections in haptic preflight.

Fixed

• Validation tests no longer reject deterministic auxiliary files because their generated section markers change between renders.

Security

• Build with Go 1.27.3 to reject compromised intermediate certificates in TLS verification (CVE-2026-111943).
• Update golang.org/x/net to 0.62.0 for HTML parsing and rendering security fixes (#519).

Helm chart

Added

• Serve TLSRoute termination and passthrough listeners on one port with isolated certificates and client-validation policies.
• haproxy-haptic.org/auth-tls-match-subject limits a host to client certificates whose subject DN matches a regular expression.
• haproxy-haptic.org/auth-tls-cn-header forwards the verified client certificate's CN in a request header you name, such as X-Scope-OrgID.
• Pin controller, agent, and lifecycle hook images with controller.image.digest.

Changed

• BREAKING: src-ip-header no longer trusts client-sent X-Real-IP, X-Client-IP, or Client-IP by itself. List the L7 proxy in forwardedHeaders.trustedProxies or produce the header in an operator snippet; L4 PROXY-protocol client addresses need no header annotation.
• Update the bundled Vector image to 0.60.0.

Fixed

• Forward Ingress client-certificate headers on resumed TLS sessions and when annotation libraries coexist.
• HTTPRoute hostname specificity takes precedence over path length and header conditions when routes intersect the same listener hostname.
• Keep TLS passthrough listener isolation on the shared HTTPS address after routes are removed or listener modes change; unmatched Gateway names still reach Ingress routes.

Security

• Enforce Ingress client-certificate verification with default TLS certificates, including when the certificate names the protected host.
• Reject requests to a client-certificate-protected Ingress with 421 when TLS SNI names another host or is absent, instead of bypassing verification.
• Drop untrusted client-sent Forwarded, X-Forwarded-Prefix, X-Forwarded-Server, X-Real-IP, X-Client-IP, and Client-IP headers, while preserving trusted proxies and operator header changes (#490).

Known issues

• An intermittent HTTPRouteRequestMirror conformance failure remains under investigation: affected runs did not observe mirrored requests in backend logs (#517).