Skip to content

HAProxy Data Plane API v3.3.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Feb 10:32
· 3 commits to master since this release
v3.3.0
5ee76f4

Release Notes

Key changes in the HAProxy Data Plane API 3.3 release include:

New Features

ACME DNS-01 Challenge Support

Added comprehensive support for ACME DNS-01 challenges, enabling automated certificate management via DNS validation:

  • Added ACME DNS-01 challenge support using libdns to resolve challenges for HAProxy. To use it, configure HAProxy's acme section to use dns-01 challenge with the appropriate acme-provider and acme-vars.
  • Implemented DNS propagation checks for ACME with configurable timeout via DPAPI_ACME_PROPAGTIMEOUT_SEC and DPAPI_ACME_PROPAGDELAY_SEC environment variables. Setting DPAPI_ACME_PROPAGTIMEOUT_SEC to -1 disables propagation checks.
  • Added support for listening to HAProxy events on the master socket, currently handling the "newcert" event to save newly generated certificates to disk.
  • Added runtime handlers for ACME status and renew operations.
  • Enabled Route53 DNS provider for ACME challenges.
  • Enabled deSEC DNS provider for ACME challenges.
  • Added support for the acme-provider and acme-vars keywords for DNS-01 challenge configuration.
  • Added support for the reuse-key ACME keyword.

Configuration Enhancements

  • Added ssl-passphrase-cmd parameter to the global section.
  • Added abortonclose parameter to frontend section.
  • Added cc (congestion control) parameter to server and bind configurations.
  • Added experimental ktls parameter to server and bind for kernel TLS offloading.
  • Added no-ktls option to global section.
  • Added experimental shm-stats-file and shm-stats-file-max-objects options to global section.
  • Added sni-auto / no-sni-auto parameters to server configuration.
  • Added check-sni-auto / no-check-sni-auto parameters to server configuration.
  • Added tcp-md5sig parameter to both server and bind configurations.
  • Added renegotiate keyword support for servers.
  • Added label bind parameter support.
  • Specification now populates defaults from the OpenAPI spec.

SSL/TLS Improvements

  • Added support for parsing multiple certificate options in bind configurations, now parsed and serialized as SslCertificate field delimited by :.
  • Added runtime support for dumping SSL certificates.
  • Fixed IP address certificate acceptance.
  • Enhanced leaf certificate selection to include DNS names, fixing cases where names are too long and have no CN but only SAN.
  • Fixed self-signed certificates parsing in storage API.

Parser and Serialization Improvements

  • Added parser option allowing exclusion of sections with a given name during serialization.
  • Sections are now always sorted by name even if dependency or circular checks fail.
  • Switched to go-method-gen for methods generation with automatic unit tests generation.
  • ACL now uses the same type in config parser as in the rest of the module.
  • Config parser now allows using models for types.

Bug Fixes

Data Plane API

  • Fixed GET default sections endpoint ignoring the full_section=true parameter.
  • Fixed service discovery to keep running despite errors instead of stopping.
  • Fixed AWS service discovery to enforce context timeout when interacting with AWS endpoints.

Configuration and Serialization (client-native)

  • Fixed missing set-var-fmt in http_after_response_rule.
  • Fixed duplicate name entry of binds.
  • Fixed all names marked as required to fit in map structured data.
  • Fixed default time suffix for stats refresh delay (was milliseconds, should be seconds).
  • Fixed serialization of FCGI option mpxs-conns.
  • Fixed duplication of xxx / no-xxx options on serialization.
  • Fixed server templates ordering by name when serialized.
  • Fixed serialization of UseFCGIApp which was failing with "invalid data".
  • Fixed missing int and expression in http-after-response sc-add-gpc.
  • Fixed http-response sc-add-gpc and sc-inc-gpc serialization issues.
  • Fixed http-request sc-add-gpc and sc-inc-gpc serialization.
  • Fixed tcp-request content set-bandwidth-limit to avoid serializing limit and period if not set.
  • Fixed filter bwlim-in and bwlim-out min-serialize.
  • Fixed tls-tickets serialization in bind params.
  • Fixed server fall and rise options parsing (are counters, not time values).
  • Fixed serialization of log-steps.
  • Fixed servers in backends ordering by name when serialized.
  • Fixed missing ID in Frontend serialization.
  • Fixed default-bind to report error when parsing failed.
  • Fixed ACME vars ordering when serializing.
  • Fixed metadata where it was missing.

Runtime

  • Added missing fields to stick table output: http_fail_cnt, http_fail_rate, gpt, gpc, and gpc_rate.
  • Fixed missing reload socket command termination.
  • Fixed redispatch to allow interval of 0.

Other Changes

Build and Dependencies

  • Upgraded Go to 1.25.
  • Upgraded golangci-lint to 2.8.0.
  • Upgraded go-swagger to v0.32.3.
  • Upgraded client-native library to latest version.
  • Updated AWS SDK packages to latest versions.
  • Updated golang.org/x packages.
  • Fixed CVE-2025-47911.
  • Swagger now honors default values for fields set in the specification.

Testing

  • Updated E2E tests for HAProxy 3.3 and 3.4 compatibility.
  • Added ACME test infrastructure and HTTP-01 testing.
  • Fixed tests for HAProxy 3.3 (backends and frontends cannot share the same name; program section removed).
  • Allowed passing multiple test names in $TESTNAME for faster test validation.
  • Fixed the set_uid E2E test to work on both Alpine and Debian.
  • Added automatic unit tests generation for client-native.
  • Fixed gentype issue that prevented running tests for sections with dashes.
  • Re-enabled gocritic linter which was mistakenly disabled.

CI/CD

  • Added CI question for backport need on merge requests.
  • Cancel duplicate pipelines on forked projects.
  • Updated GitHub Actions tooling and Go versions.

HAProxy Compatibility

This release supports HAProxy 3.3 and later versions.

Contributors

We would like to thank all the contributors who made this release possible:

Contributor Area
Olivier Duclos FEATURE | BUG | TEST | REORG
Marko Juraga BUILD | BUG | CLEANUP | FEATURE | TEST
Vincent Gramer FEATURE | BUG | BUILD
Helene Durand BUG | FEATURE | TEST
Zlatko Bratkovic BUILD | BUG | CLEANUP
Dario Tranchitella BUG
Ivan Matmati FEATURE | CLEANUP
Pierre-Alain SIMON BUILD
Philipp Kolberg BUG
JM BUG
AdamJCrawford BUILD

Thank you to everyone who contributed code, reported issues, and provided feedback for this release!

Assets 33
Loading