From b90725ac27e75ac6702cd5e16cb17cd7ae7fd47c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Delgado?= Date: Sun, 1 Nov 2026 22:05:59 +0100 Subject: [PATCH 1/2] MINOR: kubernetes-ingress: add TLS ticket keys support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add controller.tlsTicketKeys to mount a user-managed Secret and set the tls-ticket-keys controller config key so replicas share TLS session ticket keys. Signed-off-by: Jérémy Delgado --- kubernetes-ingress/README.md | 4 ++++ .../ci/daemonset-tlsticketkeys-values.yaml | 5 +++++ .../ci/deployment-tlsticketkeys-values.yaml | 5 +++++ kubernetes-ingress/templates/_podspec.tpl | 13 +++++++++++++ .../templates/controller-configmap.yaml | 16 +++++++++++++++- kubernetes-ingress/values.yaml | 10 ++++++++++ 6 files changed, 52 insertions(+), 1 deletion(-) create mode 100644 kubernetes-ingress/ci/daemonset-tlsticketkeys-values.yaml create mode 100644 kubernetes-ingress/ci/deployment-tlsticketkeys-values.yaml diff --git a/kubernetes-ingress/README.md b/kubernetes-ingress/README.md index b9b36cda..1249f0ee 100644 --- a/kubernetes-ingress/README.md +++ b/kubernetes-ingress/README.md @@ -477,6 +477,10 @@ To override defaults, either pass a values file with `-f my-values.yaml` (recomm | `controller.extraContainers` | Additional sidecar containers. | `[]` | | `controller.extraVolumeMounts` | Extra `volumeMounts` on the controller container (needed e.g. when running with `readOnlyRootFilesystem`). | `[]` | | `controller.extraVolumes` | Extra `volumes` on the pod. | `[]` | +| `controller.tlsTicketKeys.enabled` | Mount a Secret with TLS session ticket keys and set the `tls-ticket-keys` controller config key (shared across replicas). | `false` | +| `controller.tlsTicketKeys.existingSecret` | Existing Secret holding the ticket keys file (3 base64 keys, one per line). Required when enabled. | `""` | +| `controller.tlsTicketKeys.secretKey` | Key of the file inside the Secret. | `tls-ticket-keys` | +| `controller.tlsTicketKeys.mountPath` | Directory where the Secret file is mounted. | `/etc/haproxy/tls-ticket-keys` | ### Prometheus integrations (ServiceMonitor / PodMonitor) diff --git a/kubernetes-ingress/ci/daemonset-tlsticketkeys-values.yaml b/kubernetes-ingress/ci/daemonset-tlsticketkeys-values.yaml new file mode 100644 index 00000000..8cefce1a --- /dev/null +++ b/kubernetes-ingress/ci/daemonset-tlsticketkeys-values.yaml @@ -0,0 +1,5 @@ +controller: + kind: DaemonSet + tlsTicketKeys: + enabled: true + existingSecret: tls-ticket-keys diff --git a/kubernetes-ingress/ci/deployment-tlsticketkeys-values.yaml b/kubernetes-ingress/ci/deployment-tlsticketkeys-values.yaml new file mode 100644 index 00000000..b3736fff --- /dev/null +++ b/kubernetes-ingress/ci/deployment-tlsticketkeys-values.yaml @@ -0,0 +1,5 @@ +controller: + kind: Deployment + tlsTicketKeys: + enabled: true + existingSecret: tls-ticket-keys diff --git a/kubernetes-ingress/templates/_podspec.tpl b/kubernetes-ingress/templates/_podspec.tpl index 39715aa4..96fc1cfb 100644 --- a/kubernetes-ingress/templates/_podspec.tpl +++ b/kubernetes-ingress/templates/_podspec.tpl @@ -275,6 +275,11 @@ containers: {{- else if gt (len $ctlr.extraVolumeMounts) 0 }} {{ toYaml $ctlr.extraVolumeMounts | indent 6 }} {{- end }} + {{- if and $ctlr.tlsTicketKeys $ctlr.tlsTicketKeys.enabled }} + - name: tls-ticket-keys + mountPath: {{ $ctlr.tlsTicketKeys.mountPath }} + readOnly: true + {{- end }} {{- if $ctlr.auxiliaryConfig }} - name: haproxy-aux-cfg mountPath: /etc/haproxy/haproxy-aux.cfg @@ -304,6 +309,14 @@ volumes: {{- else if gt (len $ctlr.extraVolumes) 0 }} {{ toYaml $ctlr.extraVolumes | indent 2 }} {{- end }} + {{- if and $ctlr.tlsTicketKeys $ctlr.tlsTicketKeys.enabled }} + - name: tls-ticket-keys + secret: + secretName: {{ required "controller.tlsTicketKeys.existingSecret is required when controller.tlsTicketKeys.enabled is true" $ctlr.tlsTicketKeys.existingSecret }} + items: + - key: {{ $ctlr.tlsTicketKeys.secretKey }} + path: {{ $ctlr.tlsTicketKeys.secretKey }} + {{- end }} {{- if $ctlr.auxiliaryConfig }} - name: haproxy-aux-cfg configMap: diff --git a/kubernetes-ingress/templates/controller-configmap.yaml b/kubernetes-ingress/templates/controller-configmap.yaml index e69e22de..55bf1b2d 100644 --- a/kubernetes-ingress/templates/controller-configmap.yaml +++ b/kubernetes-ingress/templates/controller-configmap.yaml @@ -25,7 +25,11 @@ metadata: annotations: {{ toYaml .Values.controller.configAnnotations | indent 4 }} {{- end }} -{{- if or .Values.controller.logging.traffic .Values.controller.config }} +{{- $tlsTicketKeys := .Values.controller.tlsTicketKeys | default dict }} +{{- if and $tlsTicketKeys.enabled (not $tlsTicketKeys.existingSecret) }} +{{- fail "controller.tlsTicketKeys.existingSecret is required when controller.tlsTicketKeys.enabled is true" }} +{{- end }} +{{- if or .Values.controller.logging.traffic .Values.controller.config $tlsTicketKeys.enabled }} data: {{- if .Values.controller.logging.traffic }} syslog-server: {{ include "kubernetes-ingress.syslogServer" . }} @@ -37,4 +41,14 @@ data: {{ toYaml .Values.controller.config | indent 2 }} {{- end }} {{- end }} +{{- if $tlsTicketKeys.enabled }} +{{- /* A user-set controller.config["tls-ticket-keys"] wins */}} +{{- if eq "string" (printf "%T" .Values.controller.config) }} +{{- if not (regexMatch "(?m)^\\s*tls-ticket-keys:" (tpl .Values.controller.config .)) }} + tls-ticket-keys: {{ printf "%s/%s" $tlsTicketKeys.mountPath $tlsTicketKeys.secretKey | quote }} +{{- end }} +{{- else if not (hasKey (.Values.controller.config | default dict) "tls-ticket-keys") }} + tls-ticket-keys: {{ printf "%s/%s" $tlsTicketKeys.mountPath $tlsTicketKeys.secretKey | quote }} +{{- end }} +{{- end }} {{- end }} diff --git a/kubernetes-ingress/values.yaml b/kubernetes-ingress/values.yaml index bc968225..930952c9 100644 --- a/kubernetes-ingress/values.yaml +++ b/kubernetes-ingress/values.yaml @@ -612,6 +612,16 @@ controller: # command: ["/bin/sh"] # args: ["-c", "while true; do date; sleep 5;done"] + ## Share TLS session ticket keys across replicas (sets the `tls-ticket-keys` controller config key) + ## Rotation of the Secret content is up to the user + tlsTicketKeys: + enabled: false + ## Existing Secret holding the ticket keys file (3 base64 keys, one per line) + existingSecret: "" + ## Key of the file inside the Secret + secretKey: tls-ticket-keys + mountPath: /etc/haproxy/tls-ticket-keys + ## Additional volumeMounts to the controller main container extraVolumeMounts: [] ## Example empty volume mounts when using securityContext->readOnlyRootFilesystem From 6715ceb0b00afe6d69e59828b589bdf6ae9778a5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Delgado?= Date: Sun, 1 Nov 2026 22:06:00 +0100 Subject: [PATCH 2/2] RELEASE/MINOR: kubernetes-ingress: Tag release 1.55.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Changes in kubernetes-ingress: - add TLS ticket keys support (controller.tlsTicketKeys) Signed-off-by: Jérémy Delgado --- kubernetes-ingress/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kubernetes-ingress/Chart.yaml b/kubernetes-ingress/Chart.yaml index 5b144a4e..0f6942f5 100644 --- a/kubernetes-ingress/Chart.yaml +++ b/kubernetes-ingress/Chart.yaml @@ -16,7 +16,7 @@ apiVersion: v2 name: kubernetes-ingress description: A Helm chart for HAProxy Kubernetes Ingress Controller type: application -version: 1.54.4 +version: 1.55.0 appVersion: 3.2.19 kubeVersion: ">=1.23.0-0" keywords: