jcmoraisjr/haproxy-ingress
Haproxy Ingress
This project is a Kubernetes ingress controller that manages external traffic by dynamically configuring the HAProxy load balancer. It functions as a bridge between cluster resources and the network data plane, translating high-level ingress definitions into active proxy configurations to route HTTP, TCP, and UDP traffic into containerized environments.
The controller distinguishes itself through a decoupled architecture that separates control plane logic from the proxy process, allowing for independent lifecycle management and versioning. It utilizes template-based configuration generation and real-time hot-reloading via Unix sockets to apply routing updates without service interruptions. By supporting advanced traffic patterns such as blue-green deployment orchestration, header manipulation, and custom parameter injection, it provides a lightweight alternative to full service mesh implementations for edge traffic management.
The platform includes a comprehensive suite of operational capabilities, covering automated TLS certificate management, granular access control policies, and integration with external web application firewalls. It also provides robust observability through custom traffic logging, performance metrics, and auxiliary health checks that dynamically adjust load balancing weights based on real-time backend status.
The controller supports flexible deployment models, including namespace-level scoping and resource filtering, to enable multi-tenant operation within a single cluster. It integrates with standard Kubernetes networking patterns and the Gateway API to ensure compatibility with existing infrastructure workflows.
Features
- Load Balancers - Acts as a high-performance proxy and load balancer that distributes network traffic across backend services.
- Blue-Green Deployments - Splits traffic between different server groups using weights, headers, or cookies to facilitate controlled application releases.
- Ingress Controllers - Routes external HTTP and TCP traffic into a Kubernetes cluster by dynamically configuring HAProxy based on ingress resources.
- Routing State Synchronization - Updates load balancer configurations in real time by monitoring the cluster for changes to ingress resources.
- Kubernetes Controllers - Manages cluster state through declarative reconciliation loops to translate ingress definitions into proxy configurations.
- Load Balancing Algorithms - Distributes incoming traffic across backend servers using configurable algorithms to ensure high availability.
- Kubernetes Application Exposers - Exposes internal cluster services to external traffic by mapping hostnames and paths to specific backend applications.
- Advanced Traffic Routing - Supports complex traffic patterns including path rewriting, header manipulation, and custom routing rules.
- Dynamic Service Discovery - Updates backend server lists dynamically using DNS service discovery to support scalable infrastructure.
- TLS Certificate Management - Automates certificate issuance, renewal, and provisioning using standard protocols for secure client-server communication.
- Access Control - Enforces security through IP whitelisting, authentication, and CORS policies to protect sensitive backend services.
- Configuration-Driven Templating Engines - Generates proxy configuration files by processing structured templates based on cluster metadata.
- Control and Data Plane Separation - Separates control plane logic from the proxy process to allow independent lifecycle management and versioning.
- Event-Driven Synchronization - Updates application state based on real-time event streams from infrastructure daemons to maintain consistency between the cluster and proxy.
- Ingress Class Selectors - Processes specific ingress objects based on class names to allow multiple controllers to coexist within a cluster.
- Backend Identifiers - Assigns stable identifiers to backend servers based on unique pod addresses to ensure consistent request routing.
- Service Mesh Alternatives - Provides a lightweight approach to managing traffic routing, security, and observability at the edge without full service mesh complexity.
- Proxy Configuration Injections - Injects custom parameters and proxy directives into global, frontend, or backend sections for specialized routing.
- Cloud Native Networking - Provides tools and patterns for managing service connectivity, traffic routing, and security policies within containerized infrastructure.
- Connection Rate Limiting - Caps concurrent connections and request rates per client IP to mitigate traffic spikes and protect services.
- DNS-Based Service Discovery - Resolves backend service endpoints through internal network lookups to maintain accurate routing tables in highly volatile environments.
- Gateway API Integrations - Monitors and parses cluster networking resources to automate traffic routing decisions based on industry standards.
- Session Persistence - Ensures client requests are routed to the same backend server using cookies to preserve session state for consistent user interactions.
- Backend Protocol Settings - Configures communication protocols like HTTP/1, HTTP/2, and FastCGI between the proxy and backend services.
- Port-Based Traffic Routings - Forwards raw network connections from specific ports to designated backend services to ensure traffic reaches the correct destination without modifying underlying data.
- Non-HTTP Traffic Routing - Directs raw TCP or UDP traffic to internal services based on port mappings for protocols outside the standard web stack.
- HTTP Request Redirections - Redirects requests sent to the root context or unmatched hostnames to designated application paths or default backends to simplify URL structures.
- Hot-Reloading Mechanisms - Updates the proxy process configuration in real time via local sockets to avoid service interruptions during scaling.
- Controller Scope Restriction - Restricts the controller's watch and configuration scope to a single namespace to improve security and resource isolation.
- Cluster Security - Protects backend services by implementing IP whitelisting, basic authentication, and integration with external web firewalls.
- Cross-Namespace Reference Grants - Manages permissions for resources in one namespace to reference secrets or services in another for secure configuration sharing.
- Web Application Firewalls - Connects to external security agents to inspect incoming traffic for malicious patterns and block unauthorized requests.
- Health Monitoring Endpoints - Provides endpoints for health checks, readiness probes, and performance monitoring data for external observability tools.
- Custom Health Check Sequences - Executes auxiliary health checks independently to monitor server status and dynamically adjust load balancing weights.
- Connection Draining - Maintains persistent connections to terminating or unhealthy pods to ensure graceful shutdown of active sessions.
- API Gateways and Proxies - Ingress controller implementation using HAProxy.
