Traefik 3.2 surge: HAProxy vs Envoy comparison

IBM Cloud, Nutanex, OVHcloud, SUSE, and TIBCO selected Traefik Proxy as the replacement for ingress NGINX at KubeCon today. The retirement of ingress NGINX in March 2026 triggered a massive migration because 41 to 50 percent of internet-facing Kubernetes clusters relied on it. Traefik’s NGINX Provider translates ingress NGINX annotations into Traefik configuration at runtime and it covers 90 percent of annotations used in migrations so teams can swap controllers without modifying a single Ingress resource. Traefik Proxy has 3.4 billion Docker Hub downloads and 62,000 GitHub stars. This surge in adoption follows the November 2025 decision by Kubernetes SIG Network to retire ingress NGINX. Traefik Labs, which was founded in 2016, has seen Sudeep Goswami appointed as CEO in February 2024. The company has raised $11.1 million across two funding rounds from backers like Balderton Capital and Kima Ventures.

Envoy and HAProxy take different approaches

Envoy and HAProxy take different approaches to traffic management. Envoy acts as a Swiss Army edge proxy designed for observability, retries, and circuit breaking. I find that Envoy’s complexity frequently causes frustration, particularly when misconfigured filters or stale xDS responses trigger cascading failures across microservices. Its event-driven model requires developers to think in terms of state transitions rather than static rules. Engineers must validate configuration against runtime behavior to avoid phantom issues. I have seen cases where a service mesh call shows 34ms latency in Zipkin, even though the actual latency on the backend service is only 1ms. This discrepancy often stems from the difficulty of pinpointing whether the delay comes from the egress or ingress side of the mesh. The xDS API pushes updates to proxies in real time through a Discovery Service and a Resource Manager. If the Discovery Service fails to publish configuration changes, Envoy may reject connections entirely.

HAProxy holds 10.4 percent mindshare and focuses on high-speed performance. HAProxy Enterprise includes a management GUI, premium support, and a security suite with WAF, bot management, DDoS protection, and global rate limiting. The HAProxy Fusion Control Plane provides a single pane of glass for centralized management. This control plane allows DevSecOps to manage multiple fleets of load balancers regardless of whether they deploy on-premises or in the cloud. Pricing for HAProxy Enterprise follows a subscription model based on the number of nodes. The cost remains constant whether a single node processes 10 Mbps or 100 Gbps of traffic.

Selecting the right layer

The choice between these tools depends on the specific layer of the stack you need to protect. You already know that the edge and the internal mesh require different handling. I recommend a hybrid setup where Envoy handles TLS termination and identity checks at the network edge. Traefik then manages internal service routing and route updates within the cluster. This separation of concerns allows for strong perimeter security and fast deploy cycles.

Will the massive migration to Traefik stabilize the market or create a new single point of failure for Kubernetes networking? For those running high-traffic websites, HAProxy remains a top choice because it delivers high concurrency and stability. If you need to manage microservices in a dynamic environment, Traefik provides the automation you need.