HAProxy Ingress

HAProxy Ingress is a self-hosted Kubernetes controller that configures HAProxy to send external traffic to cluster applications. It suits platform teams that want extensive routing controls and HAProxy performance without a license fee. The trade-off is operational: you need cluster administration access, Helm 3, and a compatible Kubernetes version.

Overview

HAProxy Ingress watches Kubernetes and applies routing changes to HAProxy on the fly, so service changes do not require a separate manual reconfiguration cycle. The controller uses TLS SNI and the HTTP Host header to associate requests with ingress hosts, providing a clear basis for multi-host HTTPS routing.

Installation is delivered through a Helm chart and requires Helm version 3 plus administrative privileges in the Kubernetes cluster. HAProxy Ingress v0.16 requires Kubernetes 1.21 or newer, making the cluster baseline an important compatibility check before adoption. The project is Apache-2.0 licensed, with community discussion through a Kubernetes Slack channel, a users mailing list, and Stack Overflow.

Key features

Routing and policy controls

The project describes more than 200 configuration options, which is a strong fit for operators who need to tune HAProxy behavior rather than accept a narrow set of defaults. Both the Ingress and Gateway API models are supported. The feature set includes TLS automation, canary routing, rate limiting, web application firewall capability, and authentication policies, giving teams room to consolidate common edge controls in the ingress layer.

Gateway API coverage

HAProxy Ingress can manage Ingress and Gateway API resources in the same cluster, but its Gateway API support is partial. The documented implementation covers GatewayClass, Gateway, TCPRoute, and HTTPRoute. HTTPRoute filters and resource status updates are not implemented in the described version, so teams depending on those capabilities should choose a controller with broader Gateway API coverage.

Operations and observability

A Prometheus Operator-based example collects both HAProxy and controller metrics and visualizes them with Grafana. That integration is useful for organizations already standardizing on Prometheus and Grafana; it is less compelling if your monitoring stack is built around other tooling and you want a ready-made integration for it.

Pricing

There is one free plan and no free trial because the software itself is free. The price removes licensing cost, but it does not remove infrastructure or administration work: you provide the Kubernetes cluster, install the Helm chart, and maintain the self-hosted deployment. This model best fits teams that already operate Kubernetes and want to avoid a per-seat or usage-based gateway bill.

Platforms

HAProxy Ingress runs on Linux in a self-hosted deployment. The getting-started guide names minikube, kind, k3s, k3d, and colima as local Kubernetes options, which makes it practical for development and evaluation as well as shared clusters. Production use still depends on a running Kubernetes cluster and the required installation privileges.

Who it's for

Choose HAProxy Ingress when your organization has Kubernetes expertise, wants HAProxy-based routing, and values a large configuration surface with built-in edge policies such as canary routing and rate limiting. It is also a sensible option for teams already using Prometheus and Grafana for cluster observability.

Look elsewhere if you need a managed endpoint rather than a controller you install and operate, or if your workloads depend on Gateway API features beyond the documented partial implementation. The Kubernetes version requirement and administrative installation requirement also make it unsuitable for environments where you cannot control cluster prerequisites.

Pros and cons

Pros

• Free Apache-2.0 software avoids license fees while retaining self-hosted control.
• More than 200 configuration options support detailed HAProxy tuning.
• Dynamic application of cluster changes keeps routing aligned with Kubernetes state.
• TLS automation, canary routing, rate limiting, WAF, and auth policies cover substantial ingress needs.
• Prometheus and Grafana integration supports established Kubernetes monitoring practices.

Cons

• Running Kubernetes, Helm 3, and administrative installation access are mandatory, adding operational responsibility.
• Gateway API support is partial, with HTTPRoute filters and status updates absent in the described version.
• v0.16 requires Kubernetes 1.21 or newer, excluding older clusters.

Alternatives

See the Kubernetes Ingress Controllers directory to compare controllers. Pick ngrok instead when you want a freemium service spanning API, desktop, web, and self-hosted platforms, with a free tier offering up to three online endpoints and 1GB of transfer. Kusk Gateway is a free, MIT-licensed open-source option across API, desktop, web, and self-hosted environments.

BFE Ingress Controller is another free Apache 2.0 project with no stated plan limits. Choose Traefik Proxy for an open-source ingress controller, reverse proxy, and load balancer with service auto-discovery. agentgateway offers an open-source gateway distributed as a binary, Docker image, or Kubernetes deployment.

Higress provides a self-hosted Community Edition with community support and documentation, while users handle stability and performance. NGINX Gateway Fabric is an open-source Kubernetes deployment whose Gateway API support varies by resource. Airlock Microgateway suits small environments or local development with a free Community Edition, enforced throughput, and six-month license validity.

Verdict

HAProxy Ingress is a strong choice for Kubernetes operators who want free, self-hosted HAProxy routing with unusually broad configuration and practical edge policies. Its main reason to choose it is control without licensing cost; its main reason to look elsewhere is the operational overhead and partial Gateway API coverage.