Startup arguments

You can customize the HAProxy Enterprise Kubernetes Ingress Controller by setting the arguments found on this page at startup. These arguments affect the lifetime of the process. How you set these startup arguments depends on how you installed the ingress controller, or whether you are running in external mode.

haproxy-ingress.hapee.yaml
yaml
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: haproxy-ingress
  [...]
spec:
  [...]
    spec:
      [...]
      containers:
      - name: haproxy-ingress
        image: registry.haproxy.com/haproxytech/hapee-ingress:v3.2
        args:
          - --configmap=haproxy-controller/haproxy-kubernetes-ingress
          - --empty-ingress-class

haproxy-ingress.hapee.yaml
yaml
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: haproxy-ingress
  [...]
spec:
  [...]
    spec:
      [...]
      containers:
      - name: haproxy-ingress
        image: registry.haproxy.com/haproxytech/hapee-ingress:v3.2
        args:
          - --configmap=haproxy-controller/haproxy-kubernetes-ingress
          - --empty-ingress-class

nix
haproxy-ingress-controller --empty-ingress-class

nix
haproxy-ingress-controller --empty-ingress-class

/etc/default/hapee-3.2-kubernetes-ingress
text
# Options for hapee-3.2-kubernetes-ingress.
## SysV legacy
#SYSV_OPTIONS=(-f /etc/hapee-3.2/kubernetes-ingress.yml)
# SystemD will not expand variables (eg. ${hapee_majorversion}) like a shell would
SYSD_OPTIONS='-f /etc/hapee-3.2/kubernetes-ingress.yml --empty-ingress-class'

/etc/default/hapee-3.2-kubernetes-ingress
text
# Options for hapee-3.2-kubernetes-ingress.
## SysV legacy
#SYSV_OPTIONS=(-f /etc/hapee-3.2/kubernetes-ingress.yml)
# SystemD will not expand variables (eg. ${hapee_majorversion}) like a shell would
SYSD_OPTIONS='-f /etc/hapee-3.2/kubernetes-ingress.yml --empty-ingress-class'

nix
sudo systemctl daemon-reload
sudo systemctl restart hapee-3.2-kubernetes-ingress

nix
sudo systemctl daemon-reload
sudo systemctl restart hapee-3.2-kubernetes-ingress

--always-log-reload-reason Jump to heading #

Log HAProxy reload reasons with INFO tag even when the configured log level is warning or error. Useful to keep track of what triggers reloads without increasing overall log verbosity.

Values

• Boolean value.

Default

• No default value

Example

nix
haproxy-ingress-controller --always-log-reload-reason

nix
haproxy-ingress-controller --always-log-reload-reason

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--always-log-reload-reason}"

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--always-log-reload-reason}"

--cache-resync-period Jump to heading #

Sets the default re-synchronization period at which the controller will re-apply the desired state.

Values

• The duration in time.Duration format; Defaults to 10m (10 minutes).

Default

• 10m

Example

nix
haproxy-ingress-controller --cache-resync-period=30m

nix
haproxy-ingress-controller --cache-resync-period=30m

--channel-size Jump to heading #

Sets the size of controller buffers used to receive and send k8s events. This parameter is a cursor to adapt to the number of resources inside your clusters and that generate a lot of events. Rule of thumb: the more resources the higher the value.

Values

• Size of channels used for k8s resources events with regards to ingresses, etc.

Default

• 600

Example

nix
haproxy-ingress-controller --channel-size=10000

nix
haproxy-ingress-controller --channel-size=10000

--config-dir Jump to heading #

Path to HAProxy configuration directory when running controller in external mode. Configuration directory is where resources like configuration file, certificates, haproxy map files, are located.

Values

• Path to configuration directory

Default

• /tmp/haproxy-ingress/etc

Example

nix
haproxy-ingress-controller --external --config-dir=/haproxy-ingress/etc

nix
haproxy-ingress-controller --external --config-dir=/haproxy-ingress/etc

--config-file Jump to heading #

Alternative way of setting options for the ingress controller, through a YAML configuration file. Using it implies external mode. Can also be set with the short option -f.

Values

• Path to a YAML configuration file, see cfg-example.yml in the repository documentation for the format

Default

• No default value

Example

nix
haproxy-ingress-controller --config-file=/etc/hapee-ingress/config.yaml

nix
haproxy-ingress-controller --config-file=/etc/hapee-ingress/config.yaml

--configmap Jump to heading #

Sets the ConfigMap object that defines global settings for the ingress controller. An empty ConfigMap is deployed by default and you can see its name by calling kubectl get configmaps. You can either override the default ConfigMap with your own object that uses the same name, or you can set this argument to point to a different ConfigMap. See the ConfigMap Options to learn which values you can store in the ConfigMap.

Values

• The name of the ConfigMap that contains global settings. Defaults to default/haproxy-configmap

Default

• default/haproxy-configmap

Example

nix
haproxy-ingress-controller --configmap=default/my-configmap

nix
haproxy-ingress-controller --configmap=default/my-configmap

--configmap-errorfiles Jump to heading #

Sets the ConfigMap object that defines contents to serve instead of HAProxy errors. As explained in the haproxy documentation it is important to understand that errorfile content is not meant to rewrite errors returned by the server, but rather errors detected and returned by HAProxy. In the following example, instead of HAProxy returning a 503 error, it will return the corresponding content in the ConfigMap:

yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: errorfile
  namespace: haproxy-controller
data:
  503: |-
    HTTP/1.0 503 Service Unavailable
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
    <html><body><h1>Oops, that's embarrassing!</h1>
    There are no servers available to handle your request.
    </body></html>

yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: errorfile
  namespace: haproxy-controller
data:
  503: |-
    HTTP/1.0 503 Service Unavailable
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
    <html><body><h1>Oops, that's embarrassing!</h1>
    There are no servers available to handle your request.
    </body></html>

Values

• The name of the ConfigMap containing errorfile content

Default

• No default value

Example

nix
haproxy-ingress-controller --configmap-errorfiles=default/errorfile

nix
haproxy-ingress-controller --configmap-errorfiles=default/errorfile

--configmap-patternfiles Jump to heading #

Sets the ConfigMap object that defines pattern files to be used in HAProxy configuration. Controller will create corresponding files and update them when ConfigMap is updated. Pattern files are particularly useful for HAProxy ACLs where we can load patterns from file. The following example will load two pattern files:

% cat /tmp/ips
127.0.0.1
10.0.0.0/8
1.2.3.4/24

% cat /tmp/ips
127.0.0.1
10.0.0.0/8
1.2.3.4/24

% cat /tmp/names
foo
bar
toto
bidule

% cat /tmp/names
foo
bar
toto
bidule

kubectl create -n default configmap acl-patterns --from-file=/tmp/ips --from-file=/tmp/names

kubectl create -n default configmap acl-patterns --from-file=/tmp/ips --from-file=/tmp/names

The resulting configmap will be:

yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: acls-patterns
  namespace: haproxy-controller
data:
  ips: |
    127.0.0.1
    10.0.0.0/8
    1.2.3.4/24
  names: |
    foo
    bar
    toto
    bidule

yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: acls-patterns
  namespace: haproxy-controller
data:
  ips: |
    127.0.0.1
    10.0.0.0/8
    1.2.3.4/24
  names: |
    foo
    bar
    toto
    bidule

Pattern files are useful in config-snippets. Example:

backend-config-snippet: |
  http-request deny if !{ src -f patterns/ips }

backend-config-snippet: |
  http-request deny if !{ src -f patterns/ips }

• In order to use pattern files, the target file should be prefixed with “patterns/”

Values

• The name of the ConfigMap in format NS/ConfigMapName

Default

• No default value

Example

nix
haproxy-ingress-controller --configmap-patternfiles=default/acl-patterns

nix
haproxy-ingress-controller --configmap-patternfiles=default/acl-patterns

--configmap-tcp-services Jump to heading #

Sets the ConfigMap that contains mappings for TCP services to proxy through the ingress controller. This ConfigMap contains mappings like this:

yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: tcp
  namespace: haproxy-controller
data:
  3306:                    # Port where the frontend is going to listen to.
    mysql-ns/mysql:3306    # Kubernetes service in the format NS/ServiceName:ServicePort
  389:
    ldap-ns/ldap:389:ssl   # ssl option will enable ssl offloading for target service.
  6379:
    redis-ns/redis:6379

yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: tcp
  namespace: haproxy-controller
data:
  3306:                    # Port where the frontend is going to listen to.
    mysql-ns/mysql:3306    # Kubernetes service in the format NS/ServiceName:ServicePort
  389:
    ldap-ns/ldap:389:ssl   # ssl option will enable ssl offloading for target service.
  6379:
    redis-ns/redis:6379

• Ports of TCP services should be exposed on the controller’s Kubernetes service

Values

• The name of the ConfigMap that contains mappings for TCP services

Default

• No default value

Example

nix
haproxy-ingress-controller --configmap-tcp-services=default/my-tcpservices-configmap

nix
haproxy-ingress-controller --configmap-tcp-services=default/my-tcpservices-configmap

--controller-port Jump to heading #

Port to listen on for the controller data server which serves the prometheus and pprof endpoints. The endpoints are available at the /metrics and /debug/pprof paths. More details can be found in the prometheus documentation.

Values

• A valid port in the range. Default: 6060

Default

• 6060

Example

nix
haproxy-ingress-controller --controller-port=6060

nix
haproxy-ingress-controller --controller-port=6060

--custom-validation-rules Jump to heading #

References the ValidationRules custom resource that defines user defined custom annotations with CEL validation. More details can be found in the custom annotations documentation.

Values

• The name of the ValidationRules resource in namespace/name format

Default

• No default value

Example

nix
haproxy-ingress-controller --custom-validation-rules=haproxy-controller/example-validationrules

nix
haproxy-ingress-controller --custom-validation-rules=haproxy-controller/example-validationrules

--default-backend-port Jump to heading #

if default-backend-service is not used with this you can set default port used for same purpose

Values

• port that will be used for default service within controller pod

Default

• No default value

Example

nix
haproxy-ingress-controller --default-backend-port=6060

nix
haproxy-ingress-controller --default-backend-port=6060

--default-backend-service Jump to heading #

The name of the Kubernetes service to send requests to when no Ingress rules match. By default, it uses the builtin HTTP backend.

Values

• The name of the backend service

Default

• No default value

Example

nix
haproxy-ingress-controller --default-backend-service=default/my-default-service

nix
haproxy-ingress-controller --default-backend-service=default/my-default-service

--default-ssl-certificate Jump to heading #

The name of a TLS Secret that contains the certificate to use for SSL/TLS traffic. This can be overridden with the ssl-certificate setting.

Values

• The name of the TLS Secret

Default

• No default value

Example

nix
haproxy-ingress-controller --default-ssl-certificate=default/my-tls

nix
haproxy-ingress-controller --default-ssl-certificate=default/my-tls

--disable-config-snippets Jump to heading #

Allow to disable one or several of the following config snippets: backend, frontend, global.

Values

• Comma separated list of the kind of config snippets to disable. Possible values in the list are
• backend,frontend,global,all
• If ‘all’ is present then all (backend, frontend, global) config snippets are disabled.

Default

• No default value

Example

nix
haproxy-ingress-controller --disable-config-snippets=backend,frontend

nix
haproxy-ingress-controller --disable-config-snippets=backend,frontend

--disable-http Jump to heading #

Disabling the HTTP frontend.

Values

• Boolean value, just need to declare the flag to disable the HTTP frontend.

Default

• No default value

Example

nix
haproxy-ingress-controller --disable-http

nix
haproxy-ingress-controller --disable-http

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--disable-http}"

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--disable-http}"

--disable-https Jump to heading #

Disabling the HTTPS frontend.

Values

• Boolean value, just need to declare the flag to disable the HTTPS frontend.

Default

• No default value

Example

nix
haproxy-ingress-controller --disable-https

nix
haproxy-ingress-controller --disable-https

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--disable-https}"

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--disable-https}"

--disable-ingress-status-update Jump to heading #

If set, disables updating the status field of Ingress resources by the controller. By default, the controller will update the status field with the LoadBalancer address. This flag is useful if you want to prevent the controller from modifying Ingress status, for example when using another controller or external process to manage status updates.

Values

• Boolean flag; just declare the flag to disable status updates.

Default

• No default value

Example

nix
haproxy-ingress-controller --disable-ingress-status-update

nix
haproxy-ingress-controller --disable-ingress-status-update

--disable-ipv4 Jump to heading #

Disabling the IPv4 bind support.

Values

• Boolean value, just need to declare the flag to disable the IPv4.

Default

• No default value

Example

nix
haproxy-ingress-controller --disable-ipv4

nix
haproxy-ingress-controller --disable-ipv4

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--disable-ipv4}"

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--disable-ipv4}"

--disable-ipv6 Jump to heading #

Disabling the IPv6 bind support.

Values

• Boolean value, just need to declare the flag to disable the IPv6.

Default

• No default value

Example

nix
haproxy-ingress-controller --disable-ipv6

nix
haproxy-ingress-controller --disable-ipv6

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--disable-ipv6}"

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--disable-ipv6}"

--disable-modules Jump to heading #

Toggle to disable enterprise modules.

Values

• this is boolean flag

Default

• No default value

Example

nix
haproxy-ingress-controller --disable-modules

nix
haproxy-ingress-controller --disable-modules

--disable-quic Jump to heading #

option to disable the quic binding used by default if a certificate is provided throug ssl-certificate annotation. Please be aware that the quic implementation is activated with the “limited-quic” global option. Please refer to the documentation for details.

Values

Default

• No default value

Example

nix
haproxy-ingress-controller args:
  - --disable-quic

nix
haproxy-ingress-controller args:
  - --disable-quic

--disable-service-external-name Jump to heading #

Disable forwarding to ExternalName Services due to CVE-2021-25740

Values

• Boolean value, just need to declare the flag to disable forwarding to ExternalName Services.

Default

• false

Example

nix
haproxy-ingress-controller --disable-service-external-name

nix
haproxy-ingress-controller --disable-service-external-name

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--disable-service-external-name}"

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--disable-service-external-name}"

--disable-writing-only-if-reload Jump to heading #

Disable the delayed writing of files to disk ONLY in case of haproxy reload (= write files to disk even if no reload)

Values

• Boolean value, just need to declare the flag to disable

Default

• No default value

Example

nix
haproxy-ingress-controller --disable-writing-only-if-reload

nix
haproxy-ingress-controller --disable-writing-only-if-reload

--empty-ingress-class Jump to heading #

A flag to indicate the controller should process ingresses with empty ingress.class annotation.

Values

• No value.Being a flag you add it or not.

Default

• No default value

Example

nix
haproxy-ingress-controller --empty-ingress-class

nix
haproxy-ingress-controller --empty-ingress-class

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--empty-ingress-class}"

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--empty-ingress-class}"

--enable-custom-annotations-on-ingress Jump to heading #

Enable support for custom annotations on ingress resources. Use with caution when using the same annotation on multiple ingresses for same service.

Values

• Boolean value, just need to declare the flag

Default

• No default value

Example

nix
haproxy-ingress-controller --enable-custom-annotations-on-ingress

nix
haproxy-ingress-controller --enable-custom-annotations-on-ingress

--experimental Jump to heading #

Activates experimental features by providing a comma separated list of them. Experimental features may change or be removed in a future release. The only feature currently available is use-ingress-merge, which processes ingresses by merging the annotations of the ingresses that reference the same service, instead of handling each ingress separately.

Values

• Comma separated list of experimental features to activate

Default

• No default value

Example

nix
haproxy-ingress-controller --experimental=use-ingress-merge

nix
haproxy-ingress-controller --experimental=use-ingress-merge

--external Jump to heading #

Run as external Ingress Controller (out of kubernetes cluster). This can be done by cloning Ingress Controller project and building Controller with go build. Or using export GO111MODULE=on; go get github.com/haproxytech/kubernetes-ingress.

Values

• Boolean value.

Default

• No default value

Example

nix
haproxy-ingress-controller --external

nix
haproxy-ingress-controller --external

--gateway-controller-name Jump to heading #

identifier of your controller to know which gatewayclass it will handle

Values

• The name of the controllerName in GatewayClass

Default

• No default value

Example

nix
haproxy-ingress-controller --gateway-controller-name=haproxy.org/gateway-controller

nix
haproxy-ingress-controller --gateway-controller-name=haproxy.org/gateway-controller

Helm example

helm install intranet haproxytech/kubernetes-ingress \
  --set controller.gatewayControllerName=haproxy.org/gateway-controller

helm install intranet haproxytech/kubernetes-ingress \
  --set controller.gatewayControllerName=haproxy.org/gateway-controller

--healthz-bind-port Jump to heading #

Port to listen on for the health probes endpoint of the controller, used by the readiness probe.

Values

• A valid port in the range. Default: 1042

Default

• 1042

Example

nix
haproxy-ingress-controller --healthz-bind-port=1042

nix
haproxy-ingress-controller --healthz-bind-port=1042

--healthz-bind-thread Jump to heading #

Sets the thread parameter of the healthz frontend bind line, pinning it to specific HAProxy worker threads. Useful when the nbthread annotation sets more than one thread.

Values

• A thread or a range of threads in the 1-1 format, same syntax as the HAProxy thread bind parameter

Default

• No default value

Example

nix
haproxy-ingress-controller --healthz-bind-thread=1-1

nix
haproxy-ingress-controller --healthz-bind-thread=1-1

--help Jump to heading #

Prints the help message listing all the controller arguments and exits.

Values

• this is boolean flag

Default

• No default value

Example

nix
haproxy-ingress-controller --help

nix
haproxy-ingress-controller --help

--http-bind-port Jump to heading #

Customize the HTTP frontend binding port.

Values

• A valid port in the range. Default: 8080

Default

• 8080

Example

nix
haproxy-ingress-controller --http-bind-port=8080

nix
haproxy-ingress-controller --http-bind-port=8080

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--http-bind-port=8080}"

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--http-bind-port=8080}"

--http-bind-thread Jump to heading #

Sets the thread parameter of the HTTP frontend bind line, pinning it to specific HAProxy worker threads. Useful when the nbthread annotation sets more than one thread.

Values

• A thread or a range of threads in the 1-1 format, same syntax as the HAProxy thread bind parameter

Default

• No default value

Example

nix
haproxy-ingress-controller --http-bind-thread=1-2

nix
haproxy-ingress-controller --http-bind-thread=1-2

--https-bind-port Jump to heading #

Customize the HTTPS frontend binding port.

Values

• A valid port in the range. Default: 8443

Default

• 8443

Example

nix
haproxy-ingress-controller --https-bind-port=8443

nix
haproxy-ingress-controller --https-bind-port=8443

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--https-bind-port=8443}"

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--https-bind-port=8443}"

--https-bind-thread Jump to heading #

Sets the thread parameter of the HTTPS frontend bind line, pinning it to specific HAProxy worker threads. Useful when the nbthread annotation sets more than one thread.

Values

• A thread or a range of threads in the 1-1 format, same syntax as the HAProxy thread bind parameter

Default

• No default value

Example

nix
haproxy-ingress-controller --https-bind-thread=3-4

nix
haproxy-ingress-controller --https-bind-thread=3-4

--ingress.class Jump to heading #

A name to assign to the ingress controller so that Ingress objects can target it apart from other running ingress controllers.

• In kubernetes 1.18+, a new IngressClass resource can be referenced by Ingress objects to target an Ingress Controller. More details can be found in the IngressClass documentation.

Values

• The name of the ingress class

Default

• No default value

Example

nix
haproxy-ingress-controller --ingress.class=haproxy

nix
haproxy-ingress-controller --ingress.class=haproxy

Helm example

helm install intranet haproxytech/kubernetes-ingress \
  --set controller.ingressClass=haproxy

helm install intranet haproxytech/kubernetes-ingress \
  --set controller.ingressClass=haproxy

--initial-sync-period Jump to heading #

Sets the period to wait before the controller runs the first sync of the HAProxy configuration file after startup. Later syncs are performed at the --sync-period interval.

Values

• An integer with unit of time (1s = 1 second, 1m = 1 minute, 1h = 1 hour); Defaults to 0s (first sync executed as soon as caches are populated)

Default

• 0s

Example

nix
haproxy-ingress-controller --initial-sync-period=30s

nix
haproxy-ingress-controller --initial-sync-period=30s

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--initial-sync-period=60s}"

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--initial-sync-period=60s}"

--input-file Jump to heading #

This is the path to a manifest (yaml) of a v1 version to the CRDs to convert to v3. Goes with --output-file for the result

Values

• Path a to a CRD manifest you want to convert to the latest version

Default

• No default value

Example

nix
haproxy-ingress-controller --input-file=/home/xxx/convert/v1/global-full.yaml

nix
haproxy-ingress-controller --input-file=/home/xxx/convert/v1/global-full.yaml

--ipv4-bind-address Jump to heading #

Customize the IPv4 binding address.

Values

• A valid IPv4 addresses. Default: 0.0.0.0

Default

• 0.0.0.0

Example

nix
haproxy-ingress-controller --ipv4-bind-address=10.0.0.1

nix
haproxy-ingress-controller --ipv4-bind-address=10.0.0.1

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--ipv4-bind-address=10.0.0.1}"

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--ipv4-bind-address=10.0.0.1}"

--ipv6-bind-address Jump to heading #

Customize the IPv6 binding address.

Values

• A valid IPv6 addresses. Default: ::

Default

• ::

Example

nix
haproxy-ingress-controller --ipv6-bind-address=::ffff:c0a8:5909

nix
haproxy-ingress-controller --ipv6-bind-address=::ffff:c0a8:5909

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--ipv6-bind-address=::ffff:c0a8:5909}"

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--ipv6-bind-address=::ffff:c0a8:5909}"

--job-check-crd Jump to heading #

Special mode for controller that installs missing CRDs and updates the existing ones to the latest version. Note that this will not run ingress controller, it just creates or updates the CRDs and then exits

Values

• this is boolean flag

Default

• No default value

Example

nix
haproxy-ingress-controller --job-check-crd

nix
haproxy-ingress-controller --job-check-crd

--job-convert-config Jump to heading #

Does not run the ingress controller. Converts the given HAProxy configuration file to CRD manifests written to the current directory, then exits.

Values

• Path to an HAProxy configuration file to convert

Default

• No default value

Example

nix
haproxy-ingress-controller --job-convert-config=/etc/haproxy/haproxy.cfg

nix
haproxy-ingress-controller --job-convert-config=/etc/haproxy/haproxy.cfg

--k8s-api-sync-type Jump to heading #

Type of synchronization between HAProxy and Kubernetes

Values

• normal
• k8s
• proxy

Default

• normal

Example

nix
haproxy-ingress-controller --k8s-api-sync-type=k8s

nix
haproxy-ingress-controller --k8s-api-sync-type=k8s

--kubeconfig Jump to heading #

Path to the kubeconfig file to use when running controller in external mode, combined with -e. Defaults to the kubeconfig file in the user home directory.

Values

• Path to a kubeconfig file

Default

• No default value

Example

nix
haproxy-ingress-controller --external --kubeconfig=/home/user/.kube/config

nix
haproxy-ingress-controller --external --kubeconfig=/home/user/.kube/config

--localpeer-port Jump to heading #

Sets the port used by the HAProxy peers protocol to synchronize the rate limiting stick tables between controller replicas. Each replica announces itself as a peer on this port (pod IP and port), so rate limit counters are shared and a client is rate limited globally even when its requests hit different replicas. The port should be the same on all replicas and reachable between them, and it must not be already used inside the pod.

Values

• A valid port in the range. Default: 10000

Default

• 10000

Example

nix
haproxy-ingress-controller --localpeer-port=10000

nix
haproxy-ingress-controller --localpeer-port=10000

--log Jump to heading #

The level of logging to perform; Defaults to info

Values

• error
• warning
• info (default)
• debug
• trace

Default

• info

Example

nix
haproxy-ingress-controller --log=debug

nix
haproxy-ingress-controller --log=debug

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set controller.logging.level=debug

helm install haproxy haproxytech/kubernetes-ingress \
  --set controller.logging.level=debug

--namespace-blacklist Jump to heading #

Namespaces that the ingress controller should not monitor for changes to pods and services.

Values

• The namespace to exclude from monitoring; You can specify this argument multiple times

Default

• No default value

Example

nix
haproxy-ingress-controller --namespace-blacklist=foo --namespace-blacklist=bar

nix
haproxy-ingress-controller --namespace-blacklist=foo --namespace-blacklist=bar

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--namespace-blacklist=foo}"

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--namespace-blacklist=foo}"

--namespace-whitelist Jump to heading #

Namespaces that the ingress controller should monitor for changes to pods and service.

Values

• The namespace to monitor; You can specify this argument multiple times

Default

• No default value

Example

nix
haproxy-ingress-controller --namespace-whitelist=foo --namespace-whitelist=bar

nix
haproxy-ingress-controller --namespace-whitelist=foo --namespace-whitelist=bar

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--namespace-whitelist=foo}"

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--namespace-whitelist=foo}"

--output-file Jump to heading #

This is the path to a manifest (yaml) where to write to the converted v3 CRD from a v1 manifest (see --input-file). Goes with --input-file

Values

• Path a to a CRD manifest where the converted v3 CRDs will be written

Default

• No default value

Example

nix
haproxy-ingress-controller --output-file=/home/xxx/convert/v3/global-full.yaml

nix
haproxy-ingress-controller --output-file=/home/xxx/convert/v3/global-full.yaml

--pprof Jump to heading #

enable pprof endpoint, if default-backend-port is not used 6060 will be used

Values

• this is boolean flag

Default

• No default value

Example

nix
haproxy-ingress-controller --pprof

nix
haproxy-ingress-controller --pprof

--process-stats-period Jump to heading #

The period between logging of process stats to structured log output, set to 0 to disable.

Values

• An integer with a unit of time (1 second = 1s, 1 minute = 1m, 1h = 1 hour)

Default

• 0

Example

nix
haproxy-ingress-controller --process-stats-period=30s

nix
haproxy-ingress-controller --process-stats-period=30s

--program Jump to heading #

Path to HAProxy binary to use when running controller in external mode.

Values

• Path to HAProxy binary

Default

• haproxy in PATH location

Example

nix
haproxy-ingress-controller --external --program=/usr/bin/haproxy

nix
haproxy-ingress-controller --external --program=/usr/bin/haproxy

--prometheus Jump to heading #

enable prometheus endpoint, if default-backend-port is not used 6060 will be used

Values

• this is boolean flag

Default

• No default value

Example

nix
haproxy-ingress-controller --prometheus

nix
haproxy-ingress-controller --prometheus

--proxy-k8s-fetch-period Jump to heading #

Fetch period, the fetch period for sync modes fetch and proxy (Used if k8s-api-sync-type!=normal)

Values

• An integer with a unit of time (1 second = 1s, 1 minute = 1m, 1h = 1 hour)

Default

• 5s

Example

nix
haproxy-ingress-controller --proxy-k8s-fetch-period=10s

nix
haproxy-ingress-controller --proxy-k8s-fetch-period=10s

--proxy-k8s-fetch-size Jump to heading #

Sets the number of objects to fetch from the k8s API (or proxy) - (Used if k8s-api-sync-type!=normal)

Values

• this is an int

Default

• No default value

Example

nix
haproxy-ingress-controller --proxy-k8s-fetch-size=100

nix
haproxy-ingress-controller --proxy-k8s-fetch-size=100

--proxy-server-mode Jump to heading #

true = server - Used only if k8s-api-sync-type!=normal for the proxy

Values

Default

• No default value

Example

nix
haproxy-ingress-controller --proxy-server-mode

nix
haproxy-ingress-controller --proxy-server-mode

--proxy-server-port Jump to heading #

port to listen on for proxy server - Required if proxy-server-mode=true

Values

• this is an int

Default

• 7777

Example

nix
haproxy-ingress-controller --proxy-server-port=7777

nix
haproxy-ingress-controller --proxy-server-port=7777

--proxy-svc-label-selector Jump to heading #

label selector for proxy service - Required if k8s-api-sync-type!=normal

Values

• this is a string

Default

• No default value

Example

nix
haproxy-ingress-controller --proxy-svc-label-selector=run:haproxy-ingress-proxy

nix
haproxy-ingress-controller --proxy-svc-label-selector=run:haproxy-ingress-proxy

--publish-service Jump to heading #

Copies the ingress controller’s IP address to the ‘Address’ field in all Ingress objects that the controller manages. This is useful for tools like external-dns, which use this information to create DNS records.

Values

• Name of the ingress controller’s service, e.g. default/kubernetes-ingress

Default

• No default value

Example

nix
haproxy-ingress-controller --publish-service=default/kubernetes-ingress

nix
haproxy-ingress-controller --publish-service=default/kubernetes-ingress

--quic-announce-port Jump to heading #

sets the port in the alt-svc header to redirect to the exposed port in case it differs from the quic binding port.

Values

Default

• No default value

Example

nix
haproxy-ingress-controller args:
  - --quic-announce-port=10443

nix
haproxy-ingress-controller args:
  - --quic-announce-port=10443

--quic-bind-port Jump to heading #

sets the binding port for quic in HTTPS frontend.

Values

Default

• No default value

Example

nix
haproxy-ingress-controller args:
  - --quic-bind-port=4443

nix
haproxy-ingress-controller args:
  - --quic-bind-port=4443

--runtime-dir Jump to heading #

Path to HAProxy runtime directory when running controller in external mode. Runtime directory is where resources like PID file, runtime socket, etc are located.

Values

• Path to runtime directory

Default

• /tmp/haproxy-ingress/run

Example

nix
haproxy-ingress-controller --external --runtime-dir=/haproxy-ingress/run

nix
haproxy-ingress-controller --external --runtime-dir=/haproxy-ingress/run

--slog-maxbackup Jump to heading #

Maximum number of slog files to retain

Values

• this is an int

Default

• 3

Example

nix
haproxy-ingress-controller --slog-maxbackup=3

nix
haproxy-ingress-controller --slog-maxbackup=3

--slog-maxsize Jump to heading #

Maximum size of the slog file (in megabytes)

Values

• this is an int

Default

• 500

Example

nix
haproxy-ingress-controller --slog-maxsize=500

nix
haproxy-ingress-controller --slog-maxsize=500

--stats-bind-port Jump to heading #

Port to listen on for the stats page.

Values

• A valid port in the range. Default: 1024

Default

• 1024

Example

nix
haproxy-ingress-controller --stats-bind-port=1024

nix
haproxy-ingress-controller --stats-bind-port=1024

--stats-bind-thread Jump to heading #

Sets the thread parameter of the stats frontend bind line, pinning it to specific HAProxy worker threads. Useful when the nbthread annotation sets more than one thread.

Values

• A thread or a range of threads in the 1-1 format, same syntax as the HAProxy thread bind parameter

Default

• No default value

Example

nix
haproxy-ingress-controller --stats-bind-thread=1-1

nix
haproxy-ingress-controller --stats-bind-thread=1-1

--sync-period Jump to heading #

The interval at which the controller syncs its configuration with updated Kubernetes objects. In the case where the ingress controller is reloading too frequently, a higher value may be required. Note, if using helm charts you must also adjust the startupProbe’s initialDelaySeconds value. Its value must be higher than the --sync-period value.

Values

• An integer with unit of time (1s = 1 second, 1m = 1 minute, 1h = 1 hour); Defaults to 5s

Default

• 5s

Example

nix
haproxy-ingress-controller --sync-period=10s

nix
haproxy-ingress-controller --sync-period=10s

Helm example

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--sync-period=60s}" \
  --set controller.startupProbe.initialDelaySeconds=80

helm install haproxy haproxytech/kubernetes-ingress \
  --set-string "controller.extraArgs={--sync-period=60s}" \
  --set controller.startupProbe.initialDelaySeconds=80

--techdump-dir Jump to heading #

Path to a directory where the techdump zip will be created.

Values

• Path to techdump directory

Default

• /etc/haproxy/techdump inside pod, /tmp/haproxy-ingress/run in external mode

Example

nix
haproxy-ingress-controller args:
  - --techdump-dir=/etc/haproxy/techdump

nix
haproxy-ingress-controller args:
  - --techdump-dir=/etc/haproxy/techdump

--version Jump to heading #

Prints the version of the Ingress Controller and exits.

Values

• this is boolean flag

Default

• No default value

Example

nix
haproxy-ingress-controller --version

nix
haproxy-ingress-controller --version

--with-gopherd Jump to heading #

Use gopherd as the process supervisor inside the pod, to start/stop/reload HAProxy and to restart the controller when it exits. More details in the gopherd documentation.

Values

• this is boolean flag

Default

• No default value

Example

nix
haproxy-ingress-controller --with-gopherd

nix
haproxy-ingress-controller --with-gopherd

--with-pebble Jump to heading #

Deprecated, use --with-gopherd instead. Use pebble to start/stop/reload HAProxy. A deprecation warning is logged and support will be removed in a future release.

Values

• this is boolean flag

Default

• No default value

Example

nix
haproxy-ingress-controller --with-pebble

nix
haproxy-ingress-controller --with-pebble

--with-s6-overlay Jump to heading #

Deprecated, use --with-gopherd instead. Use s6 overlay to start/stop/reload HAProxy. A deprecation warning is logged and support will be removed in a future release.

Values

• this is boolean flag

Default

• No default value

Example

nix
haproxy-ingress-controller --with-s6-overlay

nix
haproxy-ingress-controller --with-s6-overlay