From 1d34f8f9c00d1c3056171adf10bafb961e953dff Mon Sep 17 00:00:00 2001 From: Emilia Desch Date: Fri, 4 Sep 2026 13:56:17 +0200 Subject: [PATCH 1/3] Switch on-prem HAProxy pods to haproxy-router-haproxy32 image HAProxy is being removed from the haproxy-router image in 5.1; use the dedicated haproxy-router-haproxy32 (HAProxy 3.2) payload component instead. --- cmd/machine-config-operator/bootstrap.go | 2 +- install/0000_80_machine-config_02_images.configmap.yaml | 2 +- install/image-references | 4 ++-- pkg/controller/template/constants.go | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/cmd/machine-config-operator/bootstrap.go b/cmd/machine-config-operator/bootstrap.go index 5a37c1883a..75eeb74b9c 100644 --- a/cmd/machine-config-operator/bootstrap.go +++ b/cmd/machine-config-operator/bootstrap.go @@ -132,7 +132,7 @@ func runBootstrapCmd(_ *cobra.Command, _ []string) { bootstrapOpts.oauthProxyImage = findImageOrDie(imgstream, "oauth-proxy") bootstrapOpts.kubeRbacProxyImage = findImageOrDie(imgstream, "kube-rbac-proxy") bootstrapOpts.infraImage = findImageOrDie(imgstream, "pod") - bootstrapOpts.haproxyImage = findImageOrDie(imgstream, "haproxy-router") + bootstrapOpts.haproxyImage = findImageOrDie(imgstream, "haproxy-router-haproxy32") bootstrapOpts.dockerRegistryImage = findImageOrDie(imgstream, "docker-registry") bootstrapOpts.baseOSContainerImage, err = findImage(imgstream, baseOSContainerImageTag) if err != nil { diff --git a/install/0000_80_machine-config_02_images.configmap.yaml b/install/0000_80_machine-config_02_images.configmap.yaml index 0ee80876b2..dd5d2a15bb 100644 --- a/install/0000_80_machine-config_02_images.configmap.yaml +++ b/install/0000_80_machine-config_02_images.configmap.yaml @@ -15,7 +15,7 @@ data: "infraImage": "placeholder.url.oc.will.replace.this.org/placeholdernamespace:pod", "keepalivedImage": "placeholder.url.oc.will.replace.this.org/placeholdernamespace:keepalived-ipfailover", "corednsImage": "placeholder.url.oc.will.replace.this.org/placeholdernamespace:coredns", - "haproxyImage": "placeholder.url.oc.will.replace.this.org/placeholdernamespace:haproxy-router", + "haproxyImage": "placeholder.url.oc.will.replace.this.org/placeholdernamespace:haproxy-router-haproxy32", "baremetalRuntimeCfgImage": "placeholder.url.oc.will.replace.this.org/placeholdernamespace:baremetal-runtimecfg", "oauthProxy": "placeholder.url.oc.will.replace.this.org/placeholdernamespace:oauth-proxy", "kubeRbacProxy": "placeholder.url.oc.will.replace.this.org/placeholdernamespace:kube-rbac-proxy", diff --git a/install/image-references b/install/image-references index 44917fd2e9..970384176a 100644 --- a/install/image-references +++ b/install/image-references @@ -44,10 +44,10 @@ spec: from: kind: DockerImage name: placeholder.url.oc.will.replace.this.org/placeholdernamespace:coredns - - name: haproxy-router + - name: haproxy-router-haproxy32 from: kind: DockerImage - name: placeholder.url.oc.will.replace.this.org/placeholdernamespace:haproxy-router + name: placeholder.url.oc.will.replace.this.org/placeholdernamespace:haproxy-router-haproxy32 - name: baremetal-runtimecfg from: kind: DockerImage diff --git a/pkg/controller/template/constants.go b/pkg/controller/template/constants.go index 91baec288e..6994658ce2 100644 --- a/pkg/controller/template/constants.go +++ b/pkg/controller/template/constants.go @@ -16,7 +16,7 @@ const ( // CorednsKey is the key that references the coredns image in the controller CorednsKey string = "corednsImage" - // HaproxyKey is the key that references the haproxy-router image in the controller + // HaproxyKey is the key that references the haproxy-router-haproxy32 image in the controller HaproxyKey string = "haproxyImage" // BaremetalRuntimeCfgKey is the key that references the baremetal-runtimecfg image in the controller From 7bdcadba05fad7f155eed9f587c5550dfd538a75 Mon Sep 17 00:00:00 2001 From: Emilia Desch Date: Mon, 7 Sep 2026 14:32:02 +0200 Subject: [PATCH 2/3] Create /var/lib/haproxy/run and run haproxy as root for HAProxy 3.2 The haproxy-router-haproxy32 image differs from the old haproxy-router image in two ways that break the on-prem haproxy static pod: it does not ship the /var/lib/haproxy/run directory, and it runs as a non-root user by default. Both cause haproxy to crashloop when binding the stats socket at /var/lib/haproxy/run/haproxy.sock. Create the directory before starting haproxy and set runAsUser: 0 (allowed under the pod's privileged SCC) to restore the prior behavior. --- templates/master/00-master/on-prem/files/haproxy.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/templates/master/00-master/on-prem/files/haproxy.yaml b/templates/master/00-master/on-prem/files/haproxy.yaml index d698264ac6..30f61570d6 100644 --- a/templates/master/00-master/on-prem/files/haproxy.yaml +++ b/templates/master/00-master/on-prem/files/haproxy.yaml @@ -53,6 +53,8 @@ contents: containers: - name: haproxy image: {{.Images.haproxyImage}} + securityContext: + runAsUser: 0 env: - name: OLD_HAPROXY_PS_FORCE_DEL_TIMEOUT value: "120" @@ -100,6 +102,10 @@ contents: done } set -ex + # The haproxy-router-haproxy32 (HAProxy 3.2) image does not ship the + # /var/lib/haproxy/run directory that older haproxy-router images did. + # HAProxy needs it to create the stats socket and pid file, so ensure it exists. + mkdir -p /var/lib/haproxy/run declare -r haproxy_sock="/var/run/haproxy/haproxy-master.sock" declare -r haproxy_log_sock="/var/run/haproxy/haproxy-log.sock" export -f msg_handler From e575d217733506d16dbff0e9f55e94141bd4d6fc Mon Sep 17 00:00:00 2001 From: Emilia Desch Date: Thu, 10 Sep 2026 09:22:43 +0200 Subject: [PATCH 3/3] Mount emptyDir at /var/lib/haproxy/run instead of running haproxy as root The haproxy-router-haproxy32 (HAProxy 3.2) image does not ship the /var/lib/haproxy/run directory that older images did. Rather than creating it in the startup script (which required running the container as root), mount a writable emptyDir volume at that path, matching the existing run-dir pattern in this manifest. This removes the need for runAsUser: 0. Co-Authored-By: Claude Opus 4.8 --- templates/master/00-master/on-prem/files/haproxy.yaml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/templates/master/00-master/on-prem/files/haproxy.yaml b/templates/master/00-master/on-prem/files/haproxy.yaml index 30f61570d6..52e872e153 100644 --- a/templates/master/00-master/on-prem/files/haproxy.yaml +++ b/templates/master/00-master/on-prem/files/haproxy.yaml @@ -24,6 +24,8 @@ contents: path: "/var/lib/kubelet" - name: run-dir empty-dir: {} + - name: lib-run-dir + empty-dir: {} - name: conf-dir hostPath: path: "/etc/haproxy" @@ -53,8 +55,6 @@ contents: containers: - name: haproxy image: {{.Images.haproxyImage}} - securityContext: - runAsUser: 0 env: - name: OLD_HAPROXY_PS_FORCE_DEL_TIMEOUT value: "120" @@ -102,10 +102,6 @@ contents: done } set -ex - # The haproxy-router-haproxy32 (HAProxy 3.2) image does not ship the - # /var/lib/haproxy/run directory that older haproxy-router images did. - # HAProxy needs it to create the stats socket and pid file, so ensure it exists. - mkdir -p /var/lib/haproxy/run declare -r haproxy_sock="/var/run/haproxy/haproxy-master.sock" declare -r haproxy_log_sock="/var/run/haproxy/haproxy-log.sock" export -f msg_handler @@ -127,6 +123,8 @@ contents: mountPropagation: HostToContainer - name: run-dir mountPath: "/var/run/haproxy" + - name: lib-run-dir + mountPath: "/var/lib/haproxy/run" livenessProbe: initialDelaySeconds: 50 httpGet: