Announcing HAProxy 3.4

HAProxy 3.4 is a milestone release that significantly advances HAProxy’s legendary flexibility, performance, security, reliability, and observability. 

Dynamic backend management simplifies integration with modern architectures, memory efficiency improves across a broader range of workloads, native cryptographic operations at the proxy layer open new possibilities for API security architectures, and OpenTelemetry support makes HAProxy a first-class participant in distributed tracing pipelines. 

Meanwhile, operational improvements in health checking, attack resistance, and log management mean HAProxy remains the best choice for the world's most demanding environments.

These advances extend HAProxy's lead across G2 categories in Load Balancing, API Management, Container Networking, DDoS Protection, and Web Application Firewall (WAF).

What’s new in HAProxy 3.4?

	Feature
Flexibility	Dynamic backends allow operators to add, publish, and delete backends at runtime without a reload.
	QMux enables HTTP/3 and QUIC on TCP-only networks.
Performance	Smarter buffer allocation reduces memory footprint by adapting to workload size.
	Up to 20% higher request rate achieved via improved efficiency on large-core-count CPUs.
Security and TLS	Native cryptographic operations at the proxy layer provide built-in JWT decryption and AES encryption/decryption.
	Enhanced ACME features simplify domain validation and certificate management.
Reliability	The glitch detector now covers H1 (in addition to H2 and QUIC) and closes misbehaving connections gracefully.
	Stream elasticity moderates the number of concurrent H2 and H3 streams per connection depending on system load.
Observability	HAProxy 3.4 introduces OpenTelemetry support as an add-on replacing OpenTracing.
	OpenTracing is now officially deprecated and will be completely removed in version 3.5.

In this blog post, we’ll explore all the latest changes in detail. As always, enterprise customers can expect to find these features included in the next version of HAProxy Enterprise load balancer.

New to HAProxy?

HAProxy is the world’s fastest and most widely used software load balancer. It provides high availability, load balancing, and best-in-class SSL/TLS processing for TCP, QUIC, and HTTP-based applications.

HAProxy is the open source core that powers HAProxy One, the world’s fastest application delivery and security platform. The platform consists of a flexible data plane (HAProxy Enterprise) for TCP, UDP, QUIC, and HTTP traffic; a scalable control plane (HAProxy Fusion); and a secure edge network (HAProxy Edge).

HAProxy is trusted by leading companies and cloud providers to simplify, scale, and secure modern applications, APIs, and AI services in any environment.

How to upgrade to HAProxy 3.4?

You can install HAProxy 3.4 in any of the following ways:

• Install the new HAProxy packages for Ubuntu, Debian, and RHEL.

• Run it as a Docker container. View the Docker installation instructions.

• Compile it from source. View the compilation instructions.

Flexibility

HAProxy 3.4 delivers greater flexibility than ever, simplifying integration into complex environments and enabling new use cases. 

The headline addition is the introduction of dynamic backends, which extends HAProxy’s strengths in modern, automated environments. Building on the dynamic servers capability introduced in HAProxy 2.4, dynamic backends allow backends to be added, published, and deleted at runtime without requiring a reload. The result is fully automated backend lifecycle management, driven directly from your control plane or orchestration layer.

Experimental QMux support also lands in 3.4, enabling HTTP/3 and QUIC over TCP, useful in networks where UDP is blocked or not a suitable transport layer.

Dynamically add and delete backends

New HAProxy Runtime API commands let you add, delete, and publish backend sections. Publish makes the backend available for use. 

First, consider this HAProxy configuration:

The global section enables the HAProxy Runtime API, alongside a defaults section named mydefaults and a frontend named mysite. The frontend uses a map file to route requests to the appropriate backend based on the requested URL path. The map file is virtual, meaning it only exists in memory, and is initially empty. If no entry matches the requested URL path, requests are routed to the default backend, webservers.

We use the HAProxy Runtime API to perform the following:

• Create a new test-backend backend with a server, inheriting settings from the mydefaults defaults section.

• Enable the server and its health checks.

• Publish the backend so that the frontend can use it.

• Add an entry to our map file to route requests for the path /test to the new backend.

The corresponding HAProxy Runtime API commands are shown below:

At this point, we've created the backend and populated it with a server, we updated the map file with an entry that routes requests for the URL path /test to the new backend, and the configuration is ready to serve traffic.

To delete the server, backend, and map entry, use the following commands: