load balancer release , enabling the distribution of HTTP traffic and arbitrary TCP requests among a group of servers, considering multiple factors (for example, it checks server availability, evaluates load levels, has DDoS mitigation tools) and performs initial data filtering (for instance, it can parse HTTP headers, filter out incorrect query parameters, block SQL injections and XSS, connect content processing agents). HAProxy can also coordinate the interaction of components in microservices architecture-based systems. The project code is written in C and is licensed under GPLv2. The project is used by many large websites, including Airbnb, Alibaba, GitHub, Imgur, Instagram, Reddit, StackOverflow, Tumblr, Twitter, and Vimeo.
Key features of the release:
- A new API has been introduced , allowing real-time management of HAProxy settings through REST Web API. This includes the dynamic addition and deletion of backends and servers, creating ACLs, changing request routing, and modifying handler bindings to IP;
- The nbthread directive has been added, allowing the configuration of the number of threads used in HAProxy for optimizing performance on multi-core CPUs. By default, the number of worker threads is chosen based on the available CPU cores in the current environment, while in cloud environments, one thread is set by default. Strict limits have been added through the MAX_THREADS and MAX_PROCS build options, which restrict the upper limit on the number of threads and processes;
- The use of the bind directive has been simplified for binding handlers to network addresses. Configuration now does not require the definition of process parameters — by default, connections will be distributed across threads depending on the number of active connections.
- Log configuration has been simplified when running in isolated containers — logs can now be directed to stdout and stderr, as well as to any existing file descriptor (e.g., 'log fd@1 local0');
- HTX (Native HTTP Representation) support is enabled by default, providing load balancing when utilizing advanced features such as end-to-end HTTP/2, Layer 7 Retries, and gRPC. HTX does not replace headers in place, but rather limits the operation to removing and adding a new header to the end of the list, allowing manipulation of any advanced variants of the HTTP protocol while preserving the original semantics of the headers, leading to improved performance when translating HTTP/2 to HTTP/1.1 and vice versa;
- Official support for End-to-End HTTP/2 mode has been added (processing all stages in HTTP/2, including backend calls, not just the proxy's interaction with the client);
- Full support for bidirectional gRPC protocol proxying has been implemented, enabling gRPC stream parsing, highlighting individual messages, logging gRPC traffic, and filtering messages using ACL. gRPC allows for the operation of microservices in various programming languages, interacting through a universal API. Networking in gRPC is implemented over the HTTP/2 protocol and is based on the use of Protocol Buffers for data serialization.
- Support for the Layer 7 Retries mode has been added, which allows resending HTTP requests in case of software failures not related to network connection issues (for example, when there is no response or an empty response to a POST request). To disable the mode, the flag 'disable-l7-retry' has been added to the 'http-request' option, and for fine-tuning, options 'retry-on' have been introduced in defaults, listen, and backend sections. The following criteria for resending are available: all-retryable-errors, none, conn-failure, empty-response, junk-response, response-timeout, 0rtt-rejected, as well as binding to returned status codes (404, etc.);
- A new Process Manager has been implemented, allowing configuration of the invocation of external executable files with handlers for HAProxy.
For example, the API Data Plan has been implemented as such an external handler (/usr/sbin/dataplaneapi), along with various Offload stream processing engines; - Bindings for developing SPOE (Stream Processing Offload Engine) and SPOP (Stream Processing Offload Protocol) extensions have been added for .NET Core, Go, Lua, and Python. Previously, extension development was supported only in C;
- A new external handler spoa-mirror (/usr/sbin/spoa-mirror) has been added for mirroring requests to a separate server (for instance, to copy part of the working traffic for testing an experimental environment under real load);
- Introduced to ensure integration with the Kubernetes platform;
- Built-in support for exporting statistics to the monitoring system has been added; ;
- The Peers Protocol has been expanded, which is used for exchanging information with other nodes using HAProxy. It now includes support for Heartbeat and encrypted data transmission;
- The 'log' directive has been enhanced with the 'sample' parameter, allowing only a portion of requests, such as 1 in 10, to be logged for generating an analytical sample;
- An automatic profiling mode has been added (profiling.tasks directive, which can take values auto, on, and off). Automatic profiling is enabled if the average latency exceeds the 1000 ms mark. To view profiling data in the Runtime API, the command 'show profiling' has been added or you can reset statistics to the log;
- Support for accessing backend servers using the SOCKS4 protocol has been added;
- End-to-end support for the TCP Fast Open mechanism (TFO — TCP Fast Open, RFC 7413) has been added, which reduces the number of connection setup steps by combining the first and second steps of the classical 3-step handshake process into one request, allowing data to be sent at the initial stage of connection establishment;
- New actions have been added:
- ‘http-request replace-uri’ for URL replacement using regular expressions;
- ‘tcp-request content do-resolve’ and 'http-request do-resolve’ for host name resolution;
- ‘tcp-request content set-dst’ and ‘tcp-request content set-dst-port’ to substitute the target IP address and port.
- New conversion modules have been added:
- aes_gcm_dev for decrypting streams using AES128-GCM, AES192-GCM, and AES256-GCM algorithms;
- protobuf for extracting fields from Protocol Buffers messages;
- ungrpc for extracting fields from gRPC messages.
Source: opennet.ru
