Repository navigation
[Backport release-1.6] fix(tcp-balancer): rename backends and pin HAProxy so the chart starts on 3.3+ - #4516
Merged
myasnikovdaniil merged 3 commits intoOct 16, 2026
Conversation
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…s on 3.3+ haproxy:latest now resolves to 3.3 and newer, where a backend named like a frontend is a fatal config error, so every tcp-balancer pod fails at config parse. Backends get a _backend suffix and the image follows the chart appVersion on the 3.4 LTS line instead of a floating tag. The whitelist rules render inside one guard. On the kubernetes and talos frontends an empty whitelist means no filtering; whitelistHTTP with an empty whitelist fails the render, because a security opt-in that quietly became a no-op would not be noticed the way a crash is. The unittest suite pins the rendered config for the default, whitelist and failure cases and the image pin, so a template refactor cannot bring the collision or the floating tag back. Fixes cozystack#1966 Signed-off-by: Yan Bondarenko <202671653+yankawai@users.noreply.github.com> (cherry picked from commit 12cc48d)
The accept and reject assertions matched anywhere in haproxy.cfg, so a frontend that lost its reject rule stayed green as long as another frontend still carried one. Without reject a non-matching connection falls through to HAProxy's default accept, so that frontend is open to everyone. Each assertion now anchors the acl, accept and reject lines to the frontend they belong to. Signed-off-by: Yan Bondarenko <202671653+yankawai@users.noreply.github.com> (cherry picked from commit 6855bfb)
The render now fails when whitelistHTTP is set with an empty whitelist, so the values description tells users that before they hit the error. Signed-off-by: Yan Bondarenko <202671653+yankawai@users.noreply.github.com> (cherry picked from commit eee0596)
europrinter (yankawai)
force-pushed
the
backport/tcp-balancer-release-1.6-20260926
branch
from
October 4, 2026 08:40
e467d86 to
948327d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Backports #4366 to release-1.6. All three original commits applied without conflicts and retain their cherry-pick references.
HAProxy is pinned to 3.4.4 and backend names no longer collide with frontend names. An empty whitelist leaves Kubernetes and Talos frontends unfiltered. Enabling whitelistHTTP without a whitelist fails rendering.
Validation passed with 9 Helm tests, five rendered configurations checked by HAProxy 3.4.4, and package generation without changes. The old chart reproduces the name collision. Removing only the HTTP reject rule makes the regression test fail.
Downstream repositories
Release note