From a0b452298856a850d19a4b96ccc04e3d39ae385f Mon Sep 17 00:00:00 2001 From: Klaus Niedermair Date: Sun, 12 Jul 2026 11:08:25 +0200 Subject: [PATCH] fix: stop HAProxy ingress controller reload loop from unstable log_target_list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every provider's ingress-controller bootstrap set logging through two conflicting paths: a global-config-snippet ("log stdout ...") and a Global custom resource with no log_target_list declared. The controller couldn't converge on a stable log-targets state and reloaded HAProxy roughly every 30 seconds indefinitely, tearing down and rebuilding every ingress's IP-allowlist ACL rule on each reload — intermittently letting non-allowlisted IPs through during the gap. Move the log target into the Global CR's log_target_list (the supported mechanism) and drop the redundant snippet, so the controller has one source of truth and stops reloading. --- .github/workflows/k8s-setup-azure.yml | 7 +++++-- .github/workflows/k8s-setup-ionos.yml | 7 +++++-- .github/workflows/k8s-setup-otc.yml | 7 +++++-- 3 files changed, 15 insertions(+), 6 deletions(-) diff --git a/.github/workflows/k8s-setup-azure.yml b/.github/workflows/k8s-setup-azure.yml index 5812699..90278fe 100644 --- a/.github/workflows/k8s-setup-azure.yml +++ b/.github/workflows/k8s-setup-azure.yml @@ -64,8 +64,6 @@ jobs: defaults-config-snippet: | log global option httplog - global-config-snippet: | - log stdout format raw local0 info EOF - name: Setup Global Configuration run: | @@ -77,6 +75,11 @@ jobs: name: haproxy-global namespace: haproxy-controller spec: + log_target_list: + - address: stdout + format: raw + facility: local0 + level: info ssl_options: default_bind_ciphers: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256 default_bind_ciphersuites: TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384 diff --git a/.github/workflows/k8s-setup-ionos.yml b/.github/workflows/k8s-setup-ionos.yml index 5114727..e75f9db 100644 --- a/.github/workflows/k8s-setup-ionos.yml +++ b/.github/workflows/k8s-setup-ionos.yml @@ -67,8 +67,6 @@ jobs: defaults-config-snippet: | log global option httplog - global-config-snippet: | - log stdout format raw local0 info EOF - name: Setup Global Configuration run: | @@ -80,6 +78,11 @@ jobs: name: haproxy-global namespace: haproxy-controller spec: + log_target_list: + - address: stdout + format: raw + facility: local0 + level: info ssl_options: default_bind_ciphers: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256 default_bind_ciphersuites: TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384 diff --git a/.github/workflows/k8s-setup-otc.yml b/.github/workflows/k8s-setup-otc.yml index 53ea0bf..1009a72 100644 --- a/.github/workflows/k8s-setup-otc.yml +++ b/.github/workflows/k8s-setup-otc.yml @@ -76,8 +76,6 @@ jobs: defaults-config-snippet: | log global option httplog - global-config-snippet: | - log stdout format raw local0 info EOF - name: Setup Global Configuration run: | @@ -89,6 +87,11 @@ jobs: name: haproxy-global namespace: haproxy-controller spec: + log_target_list: + - address: stdout + format: raw + facility: local0 + level: info ssl_options: default_bind_ciphers: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256 default_bind_ciphersuites: TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384