Upgrade HAProxy to latest version (v3.3)

[MartinaeyNL]

Description

We currently run HAProxy on version 2.9, while version 3.3 has came out since.
As new features have been introduced, and bugs have been resolved, it makes sense to upgrade.
For example, the configuration item minimum file size for applying compression above a certain threshold.

Acceptance criteria

• HAProxy has been updated to the latest (or at least a newer) version.
• The new image has been extensively tested on several platforms, for example:
  • Using a local Docker environment
  • Using a local Kubernetes environment
  • On a remote AWS EC2 instance
  • On a remote Kubernetes cluster
  • Using a custom project with a custom HAProxy config
  • A manual double check whether functionality like Support path based proxying #7 still works after upgrading.

[wborn]

I asked Gemini what the impact is based on the CHANGELOG and our Dockerfile:

---

Based on the provided Dockerfile which uses haproxy:2.9-alpine , and the CHANGELOG file covering development up to version 3.4-dev4, here are the major changes that concern your deployment.

1. Current Version Status

• Current: You are using HAProxy 2.9, which is a stable release.

• Upgrade Path:

  • HAProxy 3.0 is the current LTS (Long Term Support) version, released in May 2024. This is the recommended target for production stability.
  • HAProxy 3.2 is a newer LTS version released in May 2025.
  • HAProxy 3.4 is currently in development.

2. Critical Feature: Native ACME (Let's Encrypt) Support

Your Dockerfile manually installs certbot, python, and an entrypoint.sh script to handle certificate renewals. A major change in the 3.x series is the introduction of a native ACME client, which could allow you to remove Certbot entirely from your image.

• Native ACME Client: Starting around version 3.2 and 3.3, HAProxy includes a native ACME client to handle certificate generation and renewal without external tools.
• Configuration: New keywords like crt-store and acme sections allow you to configure certificate authorities and renewal logic directly in haproxy.cfg.
• Impact: You can simplify your Dockerfile significantly by removing the RUN apk add ... certbot lines and the custom renewal scripts once you upgrade to a version with stable ACME support (likely 3.2+).

3. HTTP/3 and QUIC Support

If you plan to support modern protocols, significant work has landed in recent versions:

• Production Ready: QUIC and HTTP/3 support is officially marked as stable/non-experimental in version 3.0.
• Ease of Use: Version 3.3 automatically enables SSL on QUIC servers and improves configuration for listeners.
• Performance: Numerous optimizations for packet handling, congestion control (BBR support), and zero-copy forwarding have been added between 2.9 and 3.4.

4. Breaking Changes & Deprecations

Before upgrading, check your haproxy.cfg for these removed or deprecated features:

• nbproc Removed: The nbproc keyword (multi-process mode) is fully removed. You must use nbthread (multi-threading) instead.

• Deprecated Keywords:

  • req* and rsp* rules (e.g., reqadd, rspirep) are removed. You must use http-request and http-response actions.
  • option http-tunnel is deprecated.
  • listen sections with mode health are removed.
  • monitor-net is removed in 3.4-dev.
  • transparent and option transparent are deprecated in 3.3.

5. Security & SSL Updates

• OpenSSL 3.0+: HAProxy has full support for OpenSSL 3.x. Ensure your Alpine image uses a compatible OpenSSL version.
• OCSP & Certificate Management: Improved CLI commands for managing certificates (add ssl crt-list, set ssl cert) allow for dynamic updates without reloads.
• WolfSSL & AWS-LC: Support for these alternative SSL libraries has been added if you need FIPS compliance or specific features.

6. Lua Scripting

Your Dockerfile adds a Lua ACME plugin.

• Lua 5.4: Support for Lua 5.4 was added in 2.4/2.5 eras.

• Threaded Lua: Support for lua-load-per-thread allows better performance in multi-threaded setups.

Summary of Action Items

1. Upgrade Target: Plan an upgrade to HAProxy 3.0 LTS for stability and QUIC support.
2. Simplify Image: Investigate HAProxy 3.2+ features to replace your certbot setup with the native ACME client.
3. Config Audit: Verify your haproxy.cfg does not use nbproc or old req*/rsp* keywords.
4. SSL Config: Ensure your SSL configuration aligns with the new crt-store and ssl-min-ver syntaxes if you plan to use modern TLS features.