router with haproxy backend does not route accurately to service with multiple ports

In hypershift kubevirt, we are using a wildcard route to direct ingress traffic to KubeVirt vm pods. The service that routes to the pods has two ports, in our case 80 and 443.

The route is using TLS passthrough and we are not setting a TargetPort on the router. Per the router API documentation, by not setting the TargetPort, then all endpoint exposed by the service are used by default (for most routers)

        // If specified, the port to be used by the router. Most routers will use all
        // endpoints exposed by the service by default - set this value to instruct routers
        // which port to use.
        Port *RoutePort `json:"port,omitempty" protobuf:"bytes,5,opt,name=port"`


It appears that our default router (HAProxy) does not work this way though. If I have a service with multiple ports, the HAProxy router will only work with one of those ports, and the port it works with is seemingly randomly picked.

The result is that in this scenario, traffic over one port consistently works with the route, but traffic with another port (even though the port is exposed by the service) does not.

4.13

100%

1. create a pod that answers on both port 80 and 443
2. create a service to expose that pod on port 80 and 443
3. create a route with TLS passthrough that targets the service. Leave the TargetPort empty.

randomly, either port 80 or port 443 will work for ingress over the route, but not both ports.

It is expected that both ports serve traffic through the route.