HAProxy 2.2: What's New, Release History & EOL Status

What Is New in HAProxy 2.2

HAProxy 2.2 introduces significant enhancements in security, observability, and dynamic configuration. This release focuses on tightening the data plane and expanding the capabilities of the Runtime API.

How did data plane security get stronger?

The data plane is now more secure with the introduction of a new privileges parameter for the stats socket directive. This allows for fine-grained control over which commands can be executed, moving beyond the simple read/write/admin levels.

In practice, you can now restrict a management socket to only allow specific actions, like clearing counters, without granting full administrative rights. This matters because it minimizes the potential damage from a compromised socket connection.

What new observability features were added?

Observability gets a major boost with a native Prometheus exporter. You can now expose metrics in Prometheus format by simply appending ;prometheus to a stats uri declaration.

This eliminates the need for external exporters or custom scripts, providing a direct and efficient way to feed metrics into your monitoring stack. The built-in exporter covers a wide array of metrics from frontends, backends, and servers.

How does the new Redis integration work?

Stick tables can now use Redis as a persistence layer. By adding the store keyword with a Redis configuration to a stick-table definition, HAProxy will offload stick-table data to a Redis server.

This is a game-changer for distributed environments. It allows multiple HAProxy instances to share session state, enabling true zero-downtime reloads and seamless failover without losing user sessions.

stick-table type ip size 1m store http_req_cnt in redis 127.0.0.1:6379 db 0

What improvements were made to dynamic updates?

The Runtime API was expanded with new commands for managing SSL certificates and servers. You can now dynamically update SSL certificates on a listener without a reload using set ssl cert and commit ssl cert.

Server management also got smarter. The set server command now accepts a agent-addr parameter, allowing you to dynamically override the address used for agent checks. This adds flexibility for complex environments where agent check networks differ from data paths.

What is the new FastCGI application service?

HAProxy 2.2 introduces a mode that allows it to act as a FastCGI application server, not just a proxy. This means it can directly communicate with processes using the FastCGI protocol.

This opens up new use cases for serving dynamic content directly through HAProxy, potentially simplifying architectures that previously required a separate web application server layer for PHP or similar languages.