HAProxy as a Kubernetes Ingress Controller: the production guide

1. The role of the Ingress Controller in Kubernetes #

To expose HTTP/HTTPS services to the outside world, Kubernetes relies on a three-part mechanism: the Ingress resource, the IngressClass and the Ingress Controller.

Understanding the routing chain #

• Ingress resource: a YAML object that defines routing rules. It is a statement of intent: 'I want traffic for api.mondomaine.com to go to the api-service service'.
• IngressClass: a resource that links an Ingress rule to a specific controller. It lets several Ingress Controllers (HAProxy, Nginx, etc.) coexist in the same cluster.
• Ingress Controller: the active engine. It is a pod (or a set of pods) that watches the Kubernetes API, reads Ingress resources and dynamically configures its internal proxy (here, HAProxy) to apply the routing rules.

Why HAProxy is a top choice #

While Nginx is often the default Ingress, HAProxy is preferred in very high-performance environments for its low latency, optimized memory consumption and advanced load balancing features.

2. The 'direct-to-pod' architecture: the key to performance #

One of the major advantages of the HAProxy Ingress Controller is its ability to route traffic directly to pods, bypassing part of Kubernetes' internal network.

Bypassing kube-proxy #

By default, traffic in Kubernetes goes through kube-proxy, which uses iptables or IPVS rules to redirect traffic to a service's pods. The HAProxy Ingress, on the other hand, subscribes directly to the Kubernetes Endpoints API. It therefore knows, in real time, the private IP addresses of each application pod.

Result: traffic goes directly from the Ingress Controller to the destination pod, which reduces latency, simplifies network troubleshooting and offers smarter load balancing algorithms than kube-proxy's simple round robin.

3. Deployment and basic configuration #

Let's set up simple routing to expose an application.

Deploying with Helm #

The simplest way to deploy the HAProxy Ingress Controller is to use its official Helm chart.

helm repo add haproxy-ingress https://haproxy-ingress.github.io/charts
helm install haproxy-ingress haproxy-ingress/haproxy-ingress

This command deploys the controller and creates a LoadBalancer service to expose it to the Internet.

Example Ingress resource #

Here is an example Ingress resource that routes traffic for app.mondomaine.com to a service named webapp-service on port 8080.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: webapp-ingress
spec:
  ingressClassName: haproxy # On spécifie quel contrôleur utiliser
  rules:
  - host: app.mondomaine.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: webapp-service
            port:
              number: 8080

4. Managing TLS (HTTPS) #

Securing traffic is a crucial step. HAProxy can handle TLS termination, relieving applications of this task.

TLS termination with a Kubernetes Secret #

To enable HTTPS, you first need to store your certificate and private key in a Kubernetes Secret of type kubernetes.io/tls.

kubectl create secret tls mon-cert-tls \
  --cert=path/to/cert.pem \
  --key=path/to/key.pem

Then simply reference this secret in the Ingress resource.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: webapp-ingress-tls
  annotations:
    haproxy.org/ssl-redirect: "true" # Force la redirection de HTTP vers HTTPS
spec:
  ingressClassName: haproxy
  tls:
  - hosts:
    - app.mondomaine.com
    secretName: mon-cert-tls # On référence le secret
  rules:
  - host: app.mondomaine.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: webapp-service
            port:
              number: 8080

The haproxy.org/ssl-redirect annotation is a good practice to make sure all traffic goes through an encrypted connection.

5. High availability and scalability #

In production, an Ingress Controller must never be a single point of failure (SPOF).

Deploying several replicas #

You must deploy at least 2 or 3 replicas of the Ingress Controller pod. The upstream LoadBalancer service distributes traffic between these replicas. Anti-affinity rules are generally used to make sure the controller pods are deployed on different physical nodes.

Configuration example (Helm values.yaml):

controller:
  replicaCount: 3
  # Force le déploiement des pods sur des nœuds différents
  affinity:
    podAntiAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchExpressions:
          - key: app.kubernetes.io/name
            operator: In
            values:
            - haproxy-ingress
        topologyKey: "kubernetes.io/hostname"

Conclusion: a robust choice for production #

HAProxy stands out as a mature, extremely high-performing solution to manage incoming traffic in Kubernetes.

Summary #

By choosing HAProxy as your Ingress Controller, you benefit from:

• Cutting-edge performance thanks to its optimized architecture and direct-to-pod routing.
• Advanced load balancing and security features (ACLs, rate limiting).
• A dynamic configuration that adapts in real time to changes in the cluster.
• Compatibility with the ecosystem's standards, including the upcoming Gateway API.

It is a solid technical choice for applications that cannot afford any compromise on latency and reliability.