HAProxy Ingress Controller v3.4.0

Changelog

• 5018a34 DOC/MINOR: documentation: announce the 3.4 release lifecycle
• 2004905 BUILD/MINOR: go.mod: update Go indirect packages
• 84b9247 BUILD/MINOR: go.mod: update andybalholm/brotli to v1.2.7
• d8814cc BUG/MINOR: env: resolve relative paths from the configuration directory
• 60ac025 TEST/MINOR: e2e: cover a Secret shared by an Ingress and a TCP resource
• e2e31ed TEST/MINOR: certs: cover a Secret shared by an Ingress and a TCP resource
• c4d59bf BUG/MINOR: certs: address CA files with the CA file commands
• c210a01 BUG/MEDIUM: certs: do not assume a crt-list to delete a certificate
• 7ed7d80 BUG/MINOR: tcp-cr: only point a bind at a certificate that was written
• ed2530f BUG/MINOR: secret: write a certificate once per kind
• f177c22 BUILD/MINOR: go.mod: update client-native v5, client-native v6
• 15a69a8 BUILD/MINOR: go.mod: update golang.org/x packages
• a2e0a07 MAJOR: annotations: announce the annotation deprecations
• 0dfc6e4 BUG/MINOR: instance: fix a data race on the pending reload flag
• cd8aae7 BUILD/MINOR: build: ship the released gopherd binary instead of building it
• 0b63c67 TEST/MINOR: e2e: make the per-pod distribution checks deterministic
• 4db6d34 BUILD/MINOR: go.mod: update client-native to v6.4.3
• 690d961 CLEANUP/MINOR: docs: drop controller options from their version_max
• 2a31a3d BUILD/MAJOR: haproxy: use HAProxy 3.4 version
• c8f1163 BUG/MINOR: job: do not panic on a CRD version annotation that cannot be parsed
• 1b8e40a BUG/MINOR: store: keep every TLS secret of an ingress for the same host
• 99a6944 BUG/MINOR: annotations: clear frontend custom annotations when emptied
• b4b3bbb BUG/MINOR: e2e: avoid a panic when a request fails in different-ports
• 2b8b549 MINOR: annotations: accept the built-in duration and boolean spellings
• e20c3f1 BUG/MINOR: annotations: render frontend custom annotations in priority order
• 52f47dd CLEANUP/MAJOR: controller: remove Gateway API support
• 8d484dc DOC/MINOR: annotations: record the config snippets as available up to 3.2
• 14dc66c BUILD/MINOR: ci: update pinned Go tools
• d082c93 TEST/MINOR: e2e: restore the base Global resource after the rejection test
• a14dcc9 TEST/MINOR: e2e: write the base Global resource with the v3 CRD shape
• 82c3b72 MAJOR: annotations: drop support for config snippets
• 0058623 BUILD/MINOR: go.mod: keep kube-openapi at the revision required by k8s v0.37.x
• 5d7516f BUILD/MINOR: go.mod: update k8s.io packages
• e3fbf02 BUILD/MINOR: go.mod: update golang.org/x packages
• 4614c27 MINOR: metrics: report the custom resources set aside as a gauge
• a3ca8bd DOC/MINOR: custom-resources: describe what happens when HAProxy rejects one
• e26462d MINOR: tcp: set aside a TCP custom resource HAProxy rejects
• e952d9d MINOR: frontend: set aside a Frontend custom resource HAProxy rejects
• f8e8d2f MINOR: global: set aside Global and Defaults custom resources HAProxy rejects
• 9bef753 MEDIUM: store: track every custom resource kind for the rejection handling
• a80c927 MEDIUM: crs: set aside a Backend custom resource HAProxy rejects
• a20add6 BUILD/MINOR: go.mod: update pinned packages
• e064fe1 BUILD/MEDIUM: deps: update client-native to v6.4.2
• bf02083 BUILD/MINOR: go.mod: move to renameio v2
• 3c44f77 BUILD/MINOR: cr: regenerate clients for the updated k8s libraries
• 8e77087 BUILD/MINOR: go.mod: update k8s.io packages
• f93ccf3 CLEANUP/MINOR: ci: return to regular kind image for tests
• 0000339 DOC/MINOR: lifecycle: show the tested kubernetes range as min and max
• 515496b BUILD/MINOR: e2e: update kubernetes versions in tests
• 9f53463 TEST/MINOR: e2e: serve PROXY protocol from the http-echo test image
• 4aaf31b BUG/MINOR: ci: ask the backport question only once per merge request
• 7775380 CLEANUP/MINOR: server: shorter server names, dead code and comment trims
• 600aadb TEST/MEDIUM: e2e: verify cookie persistence on runtime-created servers
• aa8d036 MEDIUM: annotations: retire the server-slot annotations
• c8e6506 MEDIUM: crs: drop server switching rules from the Backend custom resource
• 432b08b OPTIM/MINOR: server: pick maintenance servers from memory instead of re-parsing the file
• 5bcccd1 MAJOR: server: create and delete backend servers through the runtime API
• bd69397 BUILD/MINOR: build: update gopherd to 1.3.0
• 1ef5036 BUILD/MINOR: go.mod: update golang.org/x packages
• 5fd5622 BUG/MINOR: e2e: open a fresh connection for every request
• 4cc55e7 BUILD/MINOR: tools: update the Go tools to their latest releases
• d7395db BUILD/MEDIUM: crs: generate the custom resource code with the current code generator
• c7b3775 BUILD/MEDIUM: build: move the project to Go 1.27
• 96f153c CLEANUP/MINOR: annotations: skip empty elements in allow-list and deny-list
• fe5ffaf MEDIUM: frontend: amend the ssl frontend with a custom resource
• e904182 BUG/MINOR: main: exit with non-zero code on panic
• 98ed57d BUG/MINOR: e2e: build host-port addresses with net.JoinHostPort
• c2cac64 BUILD/MINOR: ci: trigger the Docker Hub description update on master
• cba7fb8 BUILD/MINOR: ci: stop persisting the token in the checkout of every workflow
• ca5ad68 BUILD/MINOR: ci: restrict the token permissions of every workflow
• 71fe88c BUILD/MINOR: strip the symbol table and trim the build path from the binary
• 3726f32 TEST/MINOR: cover the two flags a sync consumes
• 897dc32 BUG/MINOR: store: consume the request to publish every ingress
• 26a2cd7 TEST/MEDIUM: cover what Update resolves and what it consumes
• 2360e1e MEDIUM: status: decide what to publish for every ingress, not only on a full sweep
• 71a219f TEST/MEDIUM: cover the ingestion path, the class exemption and the status updates
• 1a77792 BUG/MINOR: store: reset ClassUpdated when cleaning the store
• bcc88c0 TEST/MEDIUM: cover the class predicate, the admission latch and what neither covers
• 558cb3d CLEANUP/MEDIUM: ingress: split the class predicate from the admission it records
• 78289b1 BUG/MEDIUM: k8s: stop filtering ingresses on the IngressClass name at ingestion
• 42c9f6b BUILD/MINOR: ci: block documentation links that break the documentation site
• 4e816fb DOC/MINOR: annotations: stop linking repository files from tips
• 65784da DOC/MINOR: annotations: reword a tip that broke links on the documentation site
• e60b58d DOC/MINOR: add related documentation links to controller arguments and annotations
• a578750 DOC/MINOR: controller: document localpeer port and supervisor arguments
• db5f3fc DOC/MINOR: controller: document bind thread, stats and healthz arguments
• 3e06f8e DOC/MINOR: annotations: add custom resource annotations
• 8805ae6 DOC/MINOR: annotations: add prometheus-endpoint-auth-secret
• 17a7087 DOC/MINOR: controller: document --controller-port and fix --job-check-crd description
• 1c4e5bd DOC/MINOR: controller: document --initial-sync-period, --experimental and --custom-validation-rules
• cb3f83c DOC/MINOR: annotations: add abortonclose and cors-respond-to-options
• f4dc0a4 BUILD/MINOR: ci: raise the kernel watch limits before building a cluster
• 4b301a3 BUILD/MINOR: ci: accept the crash loop jargon in the spell check
• 1b03cf3 BUILD/MINOR: ci: skip pipelines in forks without registry access
• 559d450 BUILD/MINOR: ci: give e2e retries two hours to reuse the built image
• 8a7858c BUILD/MINOR: ci: stop kube-proxy from touching shared kernel settings
• 3bb4259 BUILD/MINOR: ci: capture cluster state when an e2e job fails
• 4ec38e3 BUILD/MAJOR: replace s6-overlay with gopherd in Docker images
• 3c95396 BUILD/MINOR: ci: check discovery against a second scan, not a count
• 8f4ba00 BUILD/MINOR: ci: generate the two API packages at the same time
• ea28f25 BUILD/MINOR: ci: run diff-crd only when generation inputs change
• a411222 BUILD/MINOR: ci: stop the kind control plane from restarting mid test
• eedc263 BUILD/MINOR: ci: build the kind cluster while the image is still building
• 49e0317 BUILD/MINOR: ci: discover the e2e tests instead of declaring them
• afc1c4f BUILD/MINOR: ci: spread e2e jobs across runners with a child pipeline
• da14123 BUILD/MINOR: go.mod: update Go indirect packages
• 3120157 BUILD/MINOR: go.mod: update k8s.io packages
• 358671b BUILD/MINOR: go.mod: update golang.org/x packages
• 8bb632d TEST/MEDIUM: ssl-passthrough: cover allow-list on https with cluster passthrough
• 48cd024 BUG/MEDIUM: ssl-passthrough: keep allow/deny-list on the https frontend
• 0d5582f BUG/MEDIUM: controller: stop duplicating default local backend config snippet
• 2aa26b8 TEST/MEDIUM: cover a default backend whose service asks for ssl-passthrough
• 373a5fa MINOR: controller: report that ssl-passthrough cannot reach a default backend
• 4583184 TEST/MEDIUM: cover the service scope of ssl-passthrough
• 58bc8ac MINOR: ingress: apply ssl-passthrough at the service scope
• b0df0cc TEST/MEDIUM: cover the declaration of frontend rules against the routes
• 6711c9a BUG/MINOR: ingress: declare frontend rules only once a route carries their ids
• 2d3c0a7 TEST/MEDIUM: cover the backend annotation names and what an ingress loses
• 3e9f50c MINOR: ingress: name the backend annotations an ingress loses to the owner of a backend
• 4b800d2 TEST/MEDIUM: cover backend ownership, the walk order and the ordered set direction
• ca4f352 BUG/MINOR: controller: make the merge path walk deterministic, oldest ingress first
• c6db72e MEDIUM: ingress: let the first ingress to constitute a backend own it
• 2346ddd BUG/MEDIUM: controller: walk ingresses by age, in a deterministic order
• 97706e0 TEST/MEDIUM: cover the ssl-passthrough backend permanence
• 8250082 BUG/MEDIUM: handler: apply the ssl-passthrough invariant before anything that can fail
• af0a9e4 BUG/MINOR: handler: reconcile the ssl-passthrough binds instead of creating them
• f775948 BUG/MEDIUM: handler: re-assert the ssl-passthrough backend on every sync
• 16342bd BUG/MEDIUM: haproxy: keep controller-owned backend state across a failed transaction
• 9fd9e53 BUILD/MINOR: update CHECK_COMMIT version to 5.8.1
• 2ba6bd4 DOC/MINOR: remove Go Report Card badge from README
• bd6de51 BUILD/MINOR: ci: migrate to helm/kind-action for kind cluster setup
• b8ab05e TEST/MEDIUM: cover the report of routing key collisions
• 5fa75ca MINOR: ingress: report two ingresses colliding on a routing map key
• a69dae2 CLEANUP/MINOR: route: describe a route as the map rows it produces
• 7c7b552 CLEANUP/MINOR: maps: name the order in which the rows of a map file are matched
• 8fc818a BUG/MAJOR: service: deep-copy cr-backend spec to fix cross-service server contamination
• e93ff2e BUG/MINOR: rules: apply SSL redirect before basic auth on ingress frontend
• 6f28612 BUG/MEDIUM: haproxy: stop overriding HAProxy default SSL bind options and ciphers
• b1ba3bd BUG/MINOR: gracefully handle missing RBAC for Gateway API CRDs
• a1dea9c TEST/MEDIUM: controller: cover deterministic default backend selection
• f56e919 BUG/MEDIUM: controller: select ingress default backend deterministically
• fc12067 BUILD/MINOR: go.mod: update k8s.io packages
• 1ea9d6e BUG/MEDIUM: block_secrets stability regression
• dd0f2e7 TEST/MINOR: controller: cover ssl-passthrough mode resolution
• 79d754a BUG/MEDIUM: ssl-passthrough: resolve passthrough mode before building rules
• 5d2b684 BUILD/MINOR: go.mod: update golang.org/x packages
• d431c32 BUG/MINOR: prevent continuous reloads on default log config
• 2fa2ea6 BUG/MEDIUM: service: resolve cookie-persistence at service level only
• 642eda4 TEST/MINOR: certs: add a test with a running haproxy and runtime command
• 1f6fb28 TEST/MINOR: service: add unit tests for getRuntimeBackend
• 8b77d5f BUG/MINOR: service: ExternalName backend resolution bypassed by orphan EndpointSlices
• 2ee40de BUILD/MINOR: go.mod: update golang.org/x packages
• ab32820 BUILD/MINOR: go.mod: update k8s.io packages
• 39b2a08 BUILD/MINOR: bump golang base image to 1.26-alpine
• 8b658ef BUILD/MINOR: go.mod: update k8s.io packages
• 5053b62 BUILD/MINOR: go.mod: update golang.org/x packages
• 5b0c43f MAJOR: feature and security improvements for haproxy wrapper
• e6c0123 MAJOR: feature and security improvements for block secrets protection
• 19eb217 BUG/MINOR: improve error handling and early validation checks
• d5da0df CLEANUP/MINOR: correct error messages for HTTP response rules
• 2adc583 CLEANUP/MINOR: apply formatting to the code using latest gofumpt
• 7a91f7b TEST/MINOR: add e2e test for Backend CRD covering most rule-list fixes
• bf15d9e BUG/MINOR: add support for HTTP checks, error rules, log targets and TCP checks in Backend CRD
• 4b16cda BUG/MINOR: use filters in Backend CRD
• 0283e95 BUG/MINOR: use TCP requests and responses in Backend CRD
• 5492066 BUG/MINOR: add support for stick rules configuration in Backend CRD
• a2e9de9 BUG/MINOR: add support for server switching rules in Backend CRD
• 88614f0 TEST/MINOR: add unit tests for backend HTTP response rules
• c23ea30 BUG/MINOR: implement HTTP after response rule management
• 90a58a8 BUILD/MINOR: ci: update CHECK_COMMIT version to 5.5.3
• ebc61be BUG/MEDIUM: crd/backend: populate http-response rules and fix reload
• 5837273 BUILD/MINOR: ci: bump GO_VERSION to 1.26
• b34f5bc BUG/MEDIUM: fix periodic reload due to wrong log target changes in Global CR
• 09a2785 BUG/MEDIUM: handle different endpoint ports
• 860bb75 BUILD/MINOR: go.mod: update k8s.io packages
• db87496 BUILD/MINOR: go.mod: update golang.org/x packages
• 3662de8 BUG/MAJOR: certs: redact PEM content from runtime error logs
• 1c92c28 DOC/MINOR: update client-ca annotation to specify CA certificate requirements
• 4882c04 CLEANUP/MINOR: ci: avoid installing kind and kubectl in the CI
• bfa7675 DOC/MINOR: update request-capture documentation to clarify header handling
• a239db2 BUG/MINOR: normalize certificates to fix renewal with multiple newlines
• 5e9e36f CLEANUP/MINOR: ci: use new internal registry for gitlab
• 70d58bb BUILD/MINOR: go.mod: update k8s.io packages
• 46b1a9a BUILD/MINOR: go.mod: update golang.org/x packages
• c914fe9 BUILD/MINOR: crd: do not require name for backend crd
• e1e7b1c CLEANUP/MINOR: ci: use temporary directory for additional tools
• f0371c5 DOC/MEDIUM: update examples with v3 CRD for TCP CR
• a68a1c4 BUG/MEDIUM: fix error on rate-limit-requests
• 802f5d2 BUG/MINOR: do not create a user in userlist with empty password for basic authentication
• 106c021 MINOR: go: update go version to go1.25
• 7d96c0a BUILD/MINOR: ci: add more wait time on k8s starting to avoid fails
• 22badbd BUILD/MINOR: ci: add extra job to indicate if someone used static check override
• 086f5f6 BUILD/MINOR: ci: add extra job to indicate if someone used revive override
• a67717c CLEANUP/MINOR: ci: use better check for large files
• 7414086 BUILD/MEDIUM: ci: use revive and static check for linting code
• 32550c6 MINOR: rate-limit: Update minimum version requirement to 3.2
• 49e03f9 MINOR: rate-limit: add rate-limit-whitelist annotation to exclude IPs
• d6a4e3b BUG/MINOR: fix unnecessary restarts when using multiple log targets
• 8e5c702 BUG/MEDIUM: fix reloads Prometheus metrics for success and failure
• 7553a1e MINOR: add from to all Frontends and Backends
• 7657f70 MINOR: remove default tune.ssl.default-dh-param
• fc2b679 MINOR: bind admin port to ipv6
• 754cc75 MEDIUM: respect the order for ACLs and HTTP_Request_Rules for Backend CR
• 642ede4 DOC/MEDIUM: remove the support for ingress.class annotation from the documentation
• 6908326 BUG/MEDIUM: handle properly max_version for doc generation
• c15d105 BUG/MEDIUM: TCP CR, avoid wrong reloads due wrongly detected default backend changed
• 69deaf2 BUG/MINOR: job: on crd upgrade account that validation rules have different annotation for version
• 06fc1b4 CLEANUP/MINOR: reduce number of unnecessary logs
• ea49073 BUG/MEDIUM: write certificates on disk even if the runtime update failed
• eac5717 DOC/MINOR: add controller argument to the tutorial about custom annotations
• 924e298 MEDIUM: reactivate annotations prefixes
• 226cc3d BUG/MINOR: copy ConfigMap annotations only for the Main ConfigMap
• eebeaa6 BUILD/MINOR: ci: due to issues with runners auto retry to pick another runner
• 302a0dc MINOR: improve startup time of ingress controller
• 9bdefb9 BUILD/MINOR: add startup, liveness and readiness probe to testing environment
• 0f46130 BUILD/MINOR: use bigger runner for builds on github
• a54f492 BUG/MEDIUM: errorfile configmap deletion should trigger an update
• cf6817c CLEANUP/MINOR: remove error message about gateway API
• 4558e2a BUG/MEDIUM: healthz: do not lose binds for healthz frontend