v15.2.0+2.8.15

haproxy-boshrelease 15.2.0+2.8.15

Fixes

• fix: properly check if TCP should be drained by @maxmoehl

New Features

• feat: add block reason for the cases where HAProxy denies the requests because of specific conditions, like Host header and SNI mismatch, or other custom deny conditions by @b1tamara

Upgrades

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.15
keepalived	2.3.3
Lua	5.4.7
PCRE	10.45
socat	1.8.0.3

Deployment

releases:
- name: "haproxy"
  version: "15.2.0+2.8.15"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.2.0+2.8.15/haproxy-15.2.0+2.8.15.tgz"
  sha1: "0349614ee0792305445416ceb7f95d8731c15834"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:f22816e9adf17ffb118e54e1e6f4da8b340833ff15d269778e295bc65ab331be"

Deployment (patched)

releases:
- name: "haproxy"
  version: "15.2.0+2.8.15-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.2.0+2.8.15/haproxy-15.2.0+2.8.15-patched.tgz"
  sha1: "c6b1f446955abf428d278b22d71de737312fd2e9"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:8bb9e24ac15698f8fab6872dd0b7def28f583561a95ddf3a3a8e075923c8572c"

What's Changed

• clean: remove long unmaintained docs and code by @maxmoehl in #794
• fix: properly check if TCP should be drained by @maxmoehl in #795
• feat: add block reason for http_request_deny_conditions by @b1tamara in #796
• feat: add block reason for http request deny by @b1tamara in #797

Full Changelog: v15.1.0+2.8.15...v15.2.0+2.8.15

v15.1.0+2.8.15

haproxy-boshrelease 15.1.0+2.8.15

Fixes

New Features

Upgrades

• HAProxy has been upgraded from 2.8.14 to 2.8.15

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.15
keepalived	2.3.3
Lua	5.4.7
PCRE	10.45
socat	1.8.0.3

Deployment

releases:
- name: "haproxy"
  version: "15.1.0+2.8.15"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.1.0+2.8.15/haproxy-15.1.0+2.8.15.tgz"
  sha1: "87de2c7d011862eb5717654bf4a24aeec21ea41d"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:d62b2daf993789a0292a44f037d647fa14fae1fc5c6b01df2005ddc5bde4ab24"

Deployment (patched)

releases:
- name: "haproxy"
  version: "15.1.0+2.8.15-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.1.0+2.8.15/haproxy-15.1.0+2.8.15-patched.tgz"
  sha1: "c2ab0453fa7a33e468140c86180cdca394406491"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:abc6b4240a25b8c79ee8cb0ceff07d0dd543599e5d907ad72ae71897e5e973c0"

What's Changed

• Bump haproxy version to 2.8.15 by @CFN-CI in #791

Full Changelog: v15.0.0+2.8.14...v15.1.0+2.8.15

v15.0.0+2.8.14

haproxy-boshrelease 15.0.0+2.8.14

Fixes

Caution

Breaking change. The true_client_ip_header handling introduced in haproxy-boshrelease v14.7.0+2.8.14 was incomplete.
The default behavior has changed, which constitutes a breaking change. See below for details.

• The true_client_ip_header header is now handled correctly for CF Route Service requests. Thanks @hoffmaen, @a18e
  By default, the IP of the original client is now retained for route-service requests and no longer overwritten with the IP of the last CF egress network node (e.g. NAT gateway). See New Features for available configuration options.

New Features

• The config property ha_proxy.forward_true_client_ip_header was introduced to fine-tune the behavior of true_client_ip_header handling (thanks @hoffmaen, @a18e):
  • always_set (behavior of previous release v14.7.0+2.8.14)
  • always_forward
  • forward_only_if_route_service (new default)

Upgrades

• Bump socat version to 1.8.0.3 by @CFN-CI in #768
• Bump keepalived version to 2.3.3 by @CFN-CI in #780

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.14
keepalived	2.3.3
Lua	5.4.7
PCRE	10.45
socat	1.8.0.3

Deployment

releases:
- name: "haproxy"
  version: "15.0.0+2.8.14"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.0.0+2.8.14/haproxy-15.0.0+2.8.14.tgz"
  sha1: "f017ecf95e1b0c24e39c257896e278fd528248d9"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:b3593f58b36c88775394d86413a748514603635cb820ef3b08713ae0769b3e77"

Deployment (patched)

releases:
- name: "haproxy"
  version: "15.0.0+2.8.14-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.0.0+2.8.14/haproxy-15.0.0+2.8.14-patched.tgz"
  sha1: "15d201774295e7a9bfb12132c8ecdac7f12956ca"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:64198ce2addefc2c608b20fae8e9d61d1901d0f9cbaee570d55c6b4b74ade56d"

What's Changed

• Bump socat version to 1.8.0.3 by @CFN-CI in #768
• Bump keepalived version to 2.3.3 by @CFN-CI in #780
• Retain True-Client-Ip for Route Services by @a18e in #778

Full Changelog: v14.7.0+2.8.14...v15.0.0+2.8.14

v14.7.0+2.8.14

haproxy-boshrelease 14.7.0+2.8.14

Fixes

New Features

• true_client_ip_header property that allows specifying header to store the client's IP address, as seen from HAProxy. The header will be overwritten if it already exists in the request. Thanks @hoffmaen and @mtekel (#759)
• backend_config_targeted property allows for more fine-grained configuration of a specific backend, enabling you to tailor configurations to meet specific requirements for each backend separately. Thanks @Mrizwanshaik and @b1tamara (#765)

Upgrades

• HAProxy has been upgraded from 2.8.13 to 2.8.14
• PCRE has been upgraded from 10.44 to 10.45

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.14
keepalived	2.3.2
Lua	5.4.7
PCRE	10.45
socat	1.8.0.2

Deployment

releases:
- name: "haproxy"
  version: "14.7.0+2.8.14"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.7.0+2.8.14/haproxy-14.7.0+2.8.14.tgz"
  sha1: "d4770ac2e6e97beb900b5340989ae59dca50e505"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:d7658451501ebeb358fd48262a8f3d38b1ee325f64d72c67c64e90ba60f038f3"

Deployment (patched)

releases:
- name: "haproxy"
  version: "14.7.0+2.8.14-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.7.0+2.8.14/haproxy-14.7.0+2.8.14-patched.tgz"
  sha1: "e68bf61272f0b93ce1f9ba8efec78e0d2cca68e9"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:5337b7ddd4884eecaf20636ae4a31e292433a81318e2bd169e15b6474072bd23"

v14.6.0+2.8.13

haproxy-boshrelease 14.6.0+2.8.13

Fixes

• TCP frontends are now included in draining and also have the additional health check adjustments when enabling PROXY protocol, see #748.

Upgrades

• socat has been upgraded from v1.8.0.1 to v1.8.0.2

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.13
keepalived	2.3.2
Lua	5.4.7
PCRE	10.44
socat	1.8.0.2

Deployment

releases:
- name: "haproxy"
  version: "14.6.0+2.8.13"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.6.0+2.8.13/haproxy-14.6.0+2.8.13.tgz"
  sha1: "b79a04077b79165adf7ce776eb130a838f5e6c8f"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:fede3b65ab18f893c413d49ecf6b11cb67484ce661acf093b0aff2feacb518d8"

Deployment (patched)

releases:
- name: "haproxy"
  version: "14.6.0+2.8.13-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.6.0+2.8.13/haproxy-14.6.0+2.8.13-patched.tgz"
  sha1: "79e766c56ba1a756bcf6cbba41c6f07e6ac2e0da"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:05cf9bfb3578c9c65c8c6bcf3fca682b0c337927d2e3c2b3b8c0e60c211b4cb4"

v14.5.1+2.8.12

haproxy-boshrelease 14.5.1+2.8.12

Fixes

• Enabled expect_proxy_cidrs handling in tcp backends by @peanball in #741

New Features

None

Upgrades

None

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.12
keepalived	2.3.2
Lua	5.4.7
PCRE	10.44
socat	1.8.0.1

Deployment

releases:
- name: "haproxy"
  version: "14.5.1+2.8.12"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.5.1+2.8.12/haproxy-14.5.1+2.8.12.tgz"
  sha1: "063036bff0f6c27ce925051220411aed52c5bc98"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:3a991af7642d01cccd441087e201dbdf98ed09d596826ce61fffa67ab810cf67"

Deployment (patched)

releases:
- name: "haproxy"
  version: "14.5.1+2.8.12-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.5.1+2.8.12/haproxy-14.5.1+2.8.12-patched.tgz"
  sha1: "385477c6bf1c6b16cdffcda93757820f00f76dc8"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:1b54b93b172808061e029022054445d5e372395331040f57a1eb10b5eeecf19b"

What's Changed

• fix: enable expect_proxy_cidrs handling in tcp backends by @peanball in #741

Full Changelog: v14.5.0+2.8.12...v14.5.1+2.8.12

v14.5.0+2.8.12

haproxy-boshrelease 14.5.0+2.8.12

Fixes

• The proxy protocol health check port that is available when expect_proxy_cidrs is enabled is now subject to draining as well. Thanks @maxmoehl

New Features

None.

Upgrades

HAProxy was updated from 2.8.10 to 2.8.11

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.12
keepalived	2.3.2
Lua	5.4.7
PCRE	10.44
socat	1.8.0.1

Deployment

releases:
- name: "haproxy"
  version: "14.5.0+2.8.12"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.5.0+2.8.12/haproxy-14.5.0+2.8.12.tgz"
  sha1: "54aefaf964e91ed6e3a0006c30aab5b8f05f5207"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:e230b0794340a1bb40bd6749a9af7ed623ebffd6d981f06d6614d5a703b35bc1"

Deployment (patched)

releases:
- name: "haproxy"
  version: "14.5.0+2.8.12-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.5.0+2.8.12/haproxy-14.5.0+2.8.12-patched.tgz"
  sha1: "313c53d861d8b427c0d5e83bd2f3ab718406f0ec"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:9f8a5bcf6867b0094101c35c4fb2ad85182ac2e0b2a95ed65dd08c6584a02207"

What's Changed

• Bump haproxy version to 2.8.12 by @CFN-CI in #729
• fix: include PROXY health check in draining by @maxmoehl in #737

Full Changelog: v14.4.1+2.8.11...v14.5.0+2.8.12

v14.4.1+2.8.11

haproxy-boshrelease 14.4.1+2.8.11

Fixes

• The health endpoint handling for expect_proxy_cidrs has been extended, offering two health endpoints - one that expects Proxy Protocol (new), and one that doesn't (previous) by @peanball in #720

New Features

None.

Upgrades

• keepalived has been updated from 2.3.1 to 2.3.2

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.11
keepalived	2.3.2
Lua	5.4.7
PCRE	10.44
socat	1.8.0.1

Deployment

releases:
- name: "haproxy"
  version: "14.4.1+2.8.11"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.4.1+2.8.11/haproxy-14.4.1+2.8.11.tgz"
  sha1: "1bd4dfcff7b73645d331e4c3ac791f07466dffdb"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:9d912977ea9973479f95c704a9ac6cfc738c9d878aff544a1c0c96eca3c1efe1"

Deployment (patched)

releases:
- name: "haproxy"
  version: "14.4.1+2.8.11-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.4.1+2.8.11/haproxy-14.4.1+2.8.11-patched.tgz"
  sha1: "aa7874133ae71421fd69fb67a315f7560693e90c"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:9ba78f945e42b85ed5466542f637ddbfbea3208a935c7a25aa469644f483301d"

What's Changed

• fix: docker startup in acceptance by @mtekel in #716
• fix(expect-proxy): provide alternative health endpoint for expect_proxy_cidrs by @peanball in #717
• ci(shipit): Remove the need for a release_note.md by @peanball in #720
• Bump keepalived version to 2.3.2 by @CFN-CI in #722

New Contributors

• @mtekel made their first contribution in #716

Full Changelog: v14.4.0+2.8.11...v14.4.1+2.8.11

v14.4.0+2.8.11

Fixes

None

New Features

• expect_proxy_cidrs property that allows specifying conditional proxy protocol support for requests coming from the listed CIDR ranges. Thanks @Dariquest, @a18e, @Mrizwanshaik in #711
• Adding option to check backend health via TLS. Thanks to @schmidtsv in #699

Upgrades

• HAProxy has been upgraded from v2.8.10 to v2.8.11
• socat has been upgraded from v1.8.0.0 to v1.8.0.1

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.11
keepalived	2.3.1
Lua	5.4.7
PCRE	10.44
socat	1.8.0.1

Deployment

releases:
- name: "haproxy"
  version: "14.4.0+2.8.11"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.4.0+2.8.11/haproxy-14.4.0+2.8.11.tgz"
  sha1: "f0d7d74d95be8955310115ea855b087fa04304d1"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:96bf8bb17bb5306b3ee003f7c81274168d44634fdad34ca445e7a7243f56fde5"

Deployment (patched)

releases:
- name: "haproxy"
  version: "14.4.0+2.8.11-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.4.0+2.8.11/haproxy-14.4.0+2.8.11-patched.tgz"
  sha1: "3999d35f36fbaa71c20d86725f63b2ea4b87c23c"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:193934280388ea78518715b4a4e751c6b9f004f7ac55a7dfc885cf7219b84129"

What's Changed

• Adding option to check backend health via TLS by @schmidtsv in #699
• ci: install ginkgo in correct version by @maxmoehl in #704
• Bump socat version to 1.8.0.1 by @CFN-CI in #705
• Enable PROXY protocol for specific CIDRs in HAProxy by @Dariquest in #711
• Bump haproxy version to 2.8.11 by @CFN-CI in #712

New Contributors

• @Dariquest made their first contribution in #711

Full Changelog: v14.3.0+2.8.10...v14.4.0+2.8.11

v14.3.0+2.8.10

Upgrades

• keepalived has been upgraded from v2.2.8 to v2.3.1

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.10
keepalived	2.3.1
Lua	5.4.7
PCRE	10.44
socat	1.8.0.0

Deployment

releases:
- name: "haproxy"
  version: "14.3.0+2.8.10"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.3.0+2.8.10/haproxy-14.3.0+2.8.10.tgz"
  sha1: "dae9acded29dd91ae0796441fae298143d56a724"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:e1b3db615fc595edf3730fc072a2fb62335c18e7c4c8098a4f2598ef4b9d6383"

Deployment (patched)

releases:
- name: "haproxy"
  version: "14.3.0+2.8.10-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v14.3.0+2.8.10/haproxy-14.3.0+2.8.10-patched.tgz"
  sha1: "a470b7a33cec9381dce0fc7c6185aaedc7f0a42f"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:d28b47ea726947a62b1429bba7cb6651fe1d588a54609c719dfd6f3f4a03a156"