v14.4.1+2.8.11

haproxy-boshrelease 14.4.1+2.8.11

Fixes

• The health endpoint handling for expect_proxy_cidrs has been extended, offering two health endpoints - one that expects Proxy Protocol (new), and one that doesn't (previous) by @peanball in #720

New Features

None.

Upgrades

• keepalived has been updated from 2.3.1 to 2.3.2

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.11
keepalived	2.3.2
Lua	5.4.7
PCRE	10.44
socat	1.8.0.1

Deployment

releases:
- name: "haproxy"
  version: "14.4.1+2.8.11"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.4.1+2.8.11/haproxy-14.4.1+2.8.11.tgz"
  sha1: "1bd4dfcff7b73645d331e4c3ac791f07466dffdb"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:9d912977ea9973479f95c704a9ac6cfc738c9d878aff544a1c0c96eca3c1efe1"

Deployment (patched)

releases:
- name: "haproxy"
  version: "14.4.1+2.8.11-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.4.1+2.8.11/haproxy-14.4.1+2.8.11-patched.tgz"
  sha1: "aa7874133ae71421fd69fb67a315f7560693e90c"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:9ba78f945e42b85ed5466542f637ddbfbea3208a935c7a25aa469644f483301d"

What's Changed

• fix: docker startup in acceptance by @mtekel in #716
• fix(expect-proxy): provide alternative health endpoint for expect_proxy_cidrs by @peanball in #717
• ci(shipit): Remove the need for a release_note.md by @peanball in #720
• Bump keepalived version to 2.3.2 by @CFN-CI in #722

New Contributors

• @mtekel made their first contribution in #716

Full Changelog: v14.4.0+2.8.11...v14.4.1+2.8.11

v14.4.0+2.8.11

Fixes

None

New Features

• expect_proxy_cidrs property that allows specifying conditional proxy protocol support for requests coming from the listed CIDR ranges. Thanks @Dariquest, @a18e, @Mrizwanshaik in #711
• Adding option to check backend health via TLS. Thanks to @schmidtsv in #699

Upgrades

• HAProxy has been upgraded from v2.8.10 to v2.8.11
• socat has been upgraded from v1.8.0.0 to v1.8.0.1

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.11
keepalived	2.3.1
Lua	5.4.7
PCRE	10.44
socat	1.8.0.1

Deployment

releases:
- name: "haproxy"
  version: "14.4.0+2.8.11"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.4.0+2.8.11/haproxy-14.4.0+2.8.11.tgz"
  sha1: "f0d7d74d95be8955310115ea855b087fa04304d1"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:96bf8bb17bb5306b3ee003f7c81274168d44634fdad34ca445e7a7243f56fde5"

Deployment (patched)

releases:
- name: "haproxy"
  version: "14.4.0+2.8.11-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.4.0+2.8.11/haproxy-14.4.0+2.8.11-patched.tgz"
  sha1: "3999d35f36fbaa71c20d86725f63b2ea4b87c23c"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:193934280388ea78518715b4a4e751c6b9f004f7ac55a7dfc885cf7219b84129"

What's Changed

• Adding option to check backend health via TLS by @schmidtsv in #699
• ci: install ginkgo in correct version by @maxmoehl in #704
• Bump socat version to 1.8.0.1 by @CFN-CI in #705
• Enable PROXY protocol for specific CIDRs in HAProxy by @Dariquest in #711
• Bump haproxy version to 2.8.11 by @CFN-CI in #712

New Contributors

• @Dariquest made their first contribution in #711

Full Changelog: v14.3.0+2.8.10...v14.4.0+2.8.11

v14.3.0+2.8.10

Upgrades

• keepalived has been upgraded from v2.2.8 to v2.3.1

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.10
keepalived	2.3.1
Lua	5.4.7
PCRE	10.44
socat	1.8.0.0

Deployment

releases:
- name: "haproxy"
  version: "14.3.0+2.8.10"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.3.0+2.8.10/haproxy-14.3.0+2.8.10.tgz"
  sha1: "dae9acded29dd91ae0796441fae298143d56a724"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:e1b3db615fc595edf3730fc072a2fb62335c18e7c4c8098a4f2598ef4b9d6383"

Deployment (patched)

releases:
- name: "haproxy"
  version: "14.3.0+2.8.10-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.3.0+2.8.10/haproxy-14.3.0+2.8.10-patched.tgz"
  sha1: "a470b7a33cec9381dce0fc7c6185aaedc7f0a42f"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:d28b47ea726947a62b1429bba7cb6651fe1d588a54609c719dfd6f3f4a03a156"

v14.2.0+2.8.10

New Features

• Strip headers from the frontend (@b1tamara, @hoffmaen)

Upgrades

• Minor version bumps

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.10
keepalived	2.2.8
Lua	5.4.7
PCRE	10.44
socat	1.8.0.0

Deployment

releases:
- name: "haproxy"
  version: "14.2.0+2.8.10"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.2.0+2.8.10/haproxy-14.2.0+2.8.10.tgz"
  sha1: "4e85dddfdbbeb875031552c5ca1743b63be4bb67"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:23fea6994b59053c54774bb3d763d032dafa55a0e4a7d60dff1cc055a8789fcf"

Deployment (patched)

releases:
- name: "haproxy"
  version: "14.2.0+2.8.10-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.2.0+2.8.10/haproxy-14.2.0+2.8.10-patched.tgz"
  sha1: "412abbebc920bd867772a15a5f7a15b27120b611"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:2eda2a445327c60f0b191b1042a13e0363fd0ded60e7804f7315d19e8ac14846"

v14.1.1+2.8.10

Fixes

• Honor the default-off disable_tcp_accept_proxy flag when using accept_proxy with non-SSL backends. (@peanball)

New Features

None.

Upgrades

None.

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.10
keepalived	2.2.8
Lua	5.4.6
PCRE	10.44
socat	1.8.0.0

Deployment

releases:
- name: "haproxy"
  version: "14.1.1+2.8.10"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.1.1+2.8.10/haproxy-14.1.1+2.8.10.tgz"
  sha1: "6875a60bb75f1bac5604407c07f00cd19cba412c"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:787632a641bbb6d2142d64e3d4a899154fe6f753b067cc8becb8fc19efaa4d2b"

Deployment (patched)

releases:
- name: "haproxy"
  version: "14.1.1+2.8.10-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.1.1+2.8.10/haproxy-14.1.1+2.8.10-patched.tgz"
  sha1: "6ab66f86155eb8105b5287a4fe089fd96247a503"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:54a086519fb31d3739a450d2936395fefbb17be25ea0239ae09726a1f9d12411"

v14.1.0+2.8.10

Fixes

No new fixes or functionality.

Upgrades

• haproxy has been upgraded from v2.8.9 to v2.8.10
• PCRE2 has been upgraded from v10.43 to v10.44
• socat has been upgraded from v1.7.4.4 to v1.8.0.0

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.10
keepalived	2.2.8
Lua	5.4.6
PCRE	10.44
socat	1.8.0.0

Deployment

releases:
- name: "haproxy"
  version: "14.1.0+2.8.10"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.1.0+2.8.10/haproxy-14.1.0+2.8.10.tgz"
  sha1: "35fa841f656c029732f1d1ff3e8626784284061c"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:fbb8253fc2364d9e372cf57aa0043e4de1fc3abd390ef720e9a37cbf39e146c1"

Deployment (patched)

releases:
- name: "haproxy"
  version: "14.1.0+2.8.10-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.1.0+2.8.10/haproxy-14.1.0+2.8.10-patched.tgz"
  sha1: "f6011b7a6fd42cac8c62dc1b9b94d0dcc82788e5"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:33ec4840d43187db0010bcd54b98f727f90cbd6839afb3f4e4e652edbed2d813"

v14.0.0+2.8.9

Announcements

• We deprecate support for disable_tls_10, disable_tls_11, disable_tls_12 and disable_tls_13, move to ssl_min_ver and ssl_max_ver instead. The deprecated configuration might be removed with the next major release.

Fixes

• ⚠️ Default health check behavior for Proxy Protocol scenarios was changed: Proxy Protocol is now also enabled for the health check endpoint by default. Use disable_health_check_proxy: true to disable it again, see #633 (thanks @a18e) ⚠️

New Features

• For mTLS scenarios, the root CA DN (ssl_c_r_dn) is now sent besides other client certificate headers, see #659 (thanks @Mrizwanshaik)
• Rate limiting now also works for IPv6 client IP addresses, see #633 (thanks @a18e)
• SSL versions can be properly set via ssl_min_ver and ssl-max-ver as a successor of e.g. no-tlsv10, see #657 (thanks @kinjelom)
• An additional pre-start script can be defined via pre_start_script, see #657 (thanks @kinjelom)
• Authentication for the /stats endpoint can be disabled by defining stats_user empty, see #657 (thanks @kinjelom)
• Well formatted raw config can be appended via raw_blocks as per spec, see #652. Additional config before raw_blocks can be actively switched using config_mode, see #657 (thanks @kinjelom)

Upgrades

• Minor version bumps

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.9
keepalived	2.2.8
Lua	5.4.6
PCRE	10.43
socat	1.7.4.4

Deployment

releases:
- name: "haproxy"
  version: "14.0.0+2.8.9"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.0.0+2.8.9/haproxy-14.0.0+2.8.9.tgz"
  sha1: "d7c4b82b8cd8f9dcb32610949f2b6084e82d0e4d"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:beae6c34c4aed3b59d6f852f463ea4c13602929fa844201ec5567dacb9d5132c"

Deployment (patched)

releases:
- name: "haproxy"
  version: "14.0.0+2.8.9-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.0.0+2.8.9/haproxy-14.0.0+2.8.9-patched.tgz"
  sha1: "24cf797a460bd28d408cfd86c0d3df5480ad9fc1"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:01853783dd2f5f06ae8f2ac0c05a77df3e09694b3d26a1534c4953e555a517f7"

v13.5.0+2.8.9

Upgrades

• HAProxy has been upgraded from v2.8.5 to v2.8.9
• PCRE2 has been upgraded from v10.42 to v10.43

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.9
keepalived	2.2.8
Lua	5.4.6
PCRE	10.43
socat	1.7.4.4

Deployment

releases:
- name: "haproxy"
  version: "13.5.0+2.8.9"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v13.5.0+2.8.9/haproxy-13.5.0+2.8.9.tgz"
  sha1: "c87ade925dc0b098b5de9f4e016ad7a7fe448d58"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:ecd584ec35d4c69d48f799dfa6107126129721132e6adfddb103b99a045061bd"

Deployment (patched)

releases:
- name: "haproxy"
  version: "13.5.0+2.8.9-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v13.5.0+2.8.9/haproxy-13.5.0+2.8.9-patched.tgz"
  sha1: "b02eadb07da287c60d7cf672212c6015cb87cdf7"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:d2358e3f0501198eac9176a82c00590a50d898ced9cf552e2a843e3d3aad4c05"

v13.4.0+2.8.5

New Features

• HAProxy now supports retries on failed backend connections. (@domdom82)
• HAProxy now supports redispatching connection retries to different backend servers (@domdom82)

Upgrades

• HAProxy has been upgraded from v2.8.4 to v2.8.5

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.5
keepalived	2.2.8
Lua	5.4.6
PCRE	10.42
socat	1.7.4.4

Deployment

releases:
- name: "haproxy"
  version: "13.4.0+2.8.5"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v13.4.0+2.8.5/haproxy-13.4.0+2.8.5.tgz"
  sha1: "6331b5595b1c06e316542a15d371e23f52b2b44d"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:9005616a8c4657e2c4f5040beb6f387c125cd0db5dbe8f5583710d8a0ef4df19"

Deployment (patched)

releases:
- name: "haproxy"
  version: "13.4.0+2.8.5-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v13.4.0+2.8.5/haproxy-13.4.0+2.8.5-patched.tgz"
  sha1: "b1683b679ec45f54886c61076882a4db8944857a"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:ba3cde768157af81dc33e9c54ece7e1bb3847e0fe85a2b8389628fe63a83b1bb"

v12.3.0+2.7.11

New Features

• HAProxy now supports retries on failed backend connections. (@domdom82)
• HAProxy now supports redispatching connection retries to different backend servers (@domdom82)

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.7.11
keepalived	2.2.8
Lua	5.4.6
PCRE	10.42
socat	1.7.4.4

Deployment

releases:
- name: "haproxy"
  version: "12.3.0+2.7.11"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v12.3.0+2.7.11/haproxy-12.3.0+2.7.11.tgz"
  sha1: "3f354adf249841240c71428ba51ddc91c8acca1a"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:8c15f9afe0ef3b3f496f5516544668d7e4d67ae5d345a64bc038a48751a46bf7"

Deployment (patched)

releases:
- name: "haproxy"
  version: "12.3.0+2.7.11-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v12.3.0+2.7.11/haproxy-12.3.0+2.7.11-patched.tgz"
  sha1: "f0259dbe32b959a3b5b1ee13b5b194e114591f91"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:cbbd007a318bedc0f524ee21fe097155e375f0b8f488e9e8c28e00fb024fd877"