<p>I'm using HAProxy Ingress Controller (<a href="https://github.com/helm/charts/tree/master/incubator/haproxy-ingress" rel="nofollow noreferrer">https://github.com/helm/charts/tree/master/incubator/haproxy-ingress</a>) for TLS-termination for my app.
I have a simple Node.JS server listening on 8080 for HTTP, and 1935 as a simple echo server (not HTTP).<br />
And I use HAProxy Ingress controller to wrap the ports in TLS. (8080 -&gt; 443 (HTTPS), 1935 -&gt; 1936 (TCP + TLS))<br />
I installed HAProxy Ingress Controller with</p>
<pre><code>helm upgrade --install haproxy-ingress incubator/haproxy-ingress \
   --namespace test \
  -f ./haproxy-ingress-values.yaml \
  --version v0.0.27
</code></pre>
<p>, where the content of <code>haproxy-ingress-values.yaml</code> is</p>
<pre><code>
controller:
  ingressClass: haproxy
  replicaCount: 1
  service:
    type: LoadBalancer
  tcp:
    1936: &quot;test/simple-server:1935:::test/ingress-cert&quot;
  nodeSelector:
    &quot;kubernetes.io/os&quot;: linux
defaultBackend:
  nodeSelector:
    &quot;kubernetes.io/os&quot;: linux
</code></pre>
<p>And here's my ingress:</p>
<pre><code>
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress
  annotations:
    kubernetes.io/ingress.class: &quot;haproxy&quot;
spec:
  tls:
  - hosts:
    secretName: ingress-cert
  rules:
    - http:
        paths:
        - path: /
          backend:
            serviceName: &quot;simple-server&quot;
            servicePort: 8080
</code></pre>
<p>The cert is self-signed.
If I test the TLS handshake with</p>
<pre><code>echo | openssl s_client -connect &quot;&lt;IP&gt;&quot;:1936
</code></pre>
<p>Sometimes (about 1/3 of the times) it fails with</p>
<pre><code>CONNECTED(00000005)
139828847829440:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:332:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 316 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
</code></pre>
<p>The same problem doesn't happen for 443 port.<br />
See <a href="https://github.com/hanshsieh/misc/tree/haproxy-ingress-tls" rel="nofollow noreferrer">here</a> for the details of the settings to reproduce the problem.</p>
<p><strong>[edit]</strong><br />
As pointed out by @JoaoMorais, it's because the default statistic port is 1936.
Although I didn't turn on statistics, it seems like it still interferes with the behavior.<br />
There're two solutions that work for me.</p>
<ul>
<li>Change my service's 1936 port to another</li>
<li>Change the stats port by adding values like below when installing the haproxy-ingress chart.</li>
</ul>
<pre><code>controller:
  stats:
    port: 5000
</code></pre>

<p>HAProxy by default allows to reuse the same port number across the same or other frontend/listen sections and also across other haproxy process. This can be changed adding <a href="https://cbonte.github.io/haproxy-dconv/2.2/configuration.html#noreuseport" rel="nofollow noreferrer">noreuseport</a> in the <code>global</code> section.</p>
<p>The default HAProxy Ingress configuration uses port number <code>1936</code> to expose stats. If such port number is reused by eg a tcp proxy, the incoming requests will be distributed between both frontends - sometimes your service will be called, sometimes the stats page. Changing the tcp proxy or the stats page (doc <a href="https://haproxy-ingress.github.io/docs/configuration/keys/#stats" rel="nofollow noreferrer">here</a>) to another port should solve the issue.</p>
