From 98a192e124c8dd6070b5ea9e6cb96d59cf43d5cd Mon Sep 17 00:00:00 2001 From: Joao Morais Date: Wed, 5 Aug 2026 18:18:48 -0300 Subject: [PATCH] Add haproxyVersion in IngressController API Add haproxyVersion field in IngressController API. This field adds the ability to pin HAProxy to 2.8 before upgrade OpenShift to 5.0 or 4.23. This is an API update only, there is no operator change in 4.22. The configured value is carried to the new OpenShift version, which will deploy HAProxy as specified. EP: openshift/enhancements#1965 https://redhat.atlassian.net/browse/OCPBUGS-105168 --- .../generated_openapi/zz_generated.openapi.go | 7 +++++ operator/v1/types_ingress.go | 31 +++++++++++++++++++ ...ngresscontrollers-CustomNoUpgrade.crd.yaml | 20 ++++++++++++ ...ess_00_ingresscontrollers-Default.crd.yaml | 20 ++++++++++++ ...sscontrollers-DevPreviewNoUpgrade.crd.yaml | 20 ++++++++++++ ...ingress_00_ingresscontrollers-OKD.crd.yaml | 20 ++++++++++++ ...scontrollers-TechPreviewNoUpgrade.crd.yaml | 20 ++++++++++++ .../AAA_ungated.yaml | 20 ++++++++++++ ...ControllerDynamicConfigurationManager.yaml | 20 ++++++++++++ .../v1/zz_generated.swagger_doc_generated.go | 1 + 10 files changed, 179 insertions(+) diff --git a/openapi/generated_openapi/zz_generated.openapi.go b/openapi/generated_openapi/zz_generated.openapi.go index 7d201f7e502..b2622efa12b 100644 --- a/openapi/generated_openapi/zz_generated.openapi.go +++ b/openapi/generated_openapi/zz_generated.openapi.go @@ -56184,6 +56184,13 @@ func schema_openshift_api_operator_v1_IngressControllerSpec(ref common.Reference Format: "", }, }, + "haproxyVersion": { + SchemaProps: spec.SchemaProps{ + Description: "haproxyVersion specifies the HAProxy version to use for this IngressController.\n\nThis field is available in OpenShift 4.22 as an API-only backport with no operator implementation. Setting this field on OpenShift 4.22 allows administrators to pin HAProxy 2.8 before upgrading to OpenShift 5.0, where the operator will honor this setting.\n\nValid values for OpenShift 4.22: - Unset (default): Uses HAProxy 2.8 (the default for OpenShift 4.22) - \"2.8\": Explicitly pins HAProxy 2.8 for preservation during cluster\n upgrade to OpenShift 5.0\n\nOn OpenShift 4.22, this field has no effect on the running IngressController. It only preserves the administrator's intent for the OpenShift 5.0 upgrade.", + Type: []string{"string"}, + Format: "", + }, + }, }, }, }, diff --git a/operator/v1/types_ingress.go b/operator/v1/types_ingress.go index 0c5cf919e15..e197a05cdc6 100644 --- a/operator/v1/types_ingress.go +++ b/operator/v1/types_ingress.go @@ -385,6 +385,25 @@ type IngressControllerSpec struct { // +kubebuilder:default:="Continue" // +default="Continue" ClosedClientConnectionPolicy IngressControllerClosedClientConnectionPolicy `json:"closedClientConnectionPolicy,omitempty"` + + // haproxyVersion specifies the HAProxy version to use for this + // IngressController. + // + // This field is available in OpenShift 4.22 as an API-only backport with no + // operator implementation. Setting this field on OpenShift 4.22 allows + // administrators to pin HAProxy 2.8 before upgrading to OpenShift 5.0, where + // the operator will honor this setting. + // + // Valid values for OpenShift 4.22: + // - Unset (default): Uses HAProxy 2.8 (the default for OpenShift 4.22) + // - "2.8": Explicitly pins HAProxy 2.8 for preservation during cluster + // upgrade to OpenShift 5.0 + // + // On OpenShift 4.22, this field has no effect on the running IngressController. + // It only preserves the administrator's intent for the OpenShift 5.0 upgrade. + // + // +optional + HAProxyVersion HAProxyVersion `json:"haproxyVersion,omitempty"` } // httpCompressionPolicy turns on compression for the specified MIME types. @@ -2285,3 +2304,15 @@ const ( // server's response regardless of the client having closed the connection. IngressControllerClosedClientConnectionPolicyContinue IngressControllerClosedClientConnectionPolicy = "Continue" ) + +// HAProxyVersion is a string representing a HAProxy minor version in "X.Y" +// format. The allowed values are constrained by enum validation and vary by +// OpenShift release. +// +// +kubebuilder:validation:Enum="2.8" +type HAProxyVersion string + +const ( + // HAProxyVersion28 represents HAProxy 2.8, shipped with OpenShift 4.22. + HAProxyVersion28 HAProxyVersion = "2.8" +) diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml index fdf10772dd8..94ff90cf4da 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml @@ -892,6 +892,26 @@ spec: required: - type type: object + haproxyVersion: + description: |- + haproxyVersion specifies the HAProxy version to use for this + IngressController. + + This field is available in OpenShift 4.22 as an API-only backport with no + operator implementation. Setting this field on OpenShift 4.22 allows + administrators to pin HAProxy 2.8 before upgrading to OpenShift 5.0, where + the operator will honor this setting. + + Valid values for OpenShift 4.22: + - Unset (default): Uses HAProxy 2.8 (the default for OpenShift 4.22) + - "2.8": Explicitly pins HAProxy 2.8 for preservation during cluster + upgrade to OpenShift 5.0 + + On OpenShift 4.22, this field has no effect on the running IngressController. + It only preserves the administrator's intent for the OpenShift 5.0 upgrade. + enum: + - "2.8" + type: string httpCompression: description: |- httpCompression defines a policy for HTTP traffic compression. diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml index 97c3ca8c401..3552e4b085a 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml @@ -892,6 +892,26 @@ spec: required: - type type: object + haproxyVersion: + description: |- + haproxyVersion specifies the HAProxy version to use for this + IngressController. + + This field is available in OpenShift 4.22 as an API-only backport with no + operator implementation. Setting this field on OpenShift 4.22 allows + administrators to pin HAProxy 2.8 before upgrading to OpenShift 5.0, where + the operator will honor this setting. + + Valid values for OpenShift 4.22: + - Unset (default): Uses HAProxy 2.8 (the default for OpenShift 4.22) + - "2.8": Explicitly pins HAProxy 2.8 for preservation during cluster + upgrade to OpenShift 5.0 + + On OpenShift 4.22, this field has no effect on the running IngressController. + It only preserves the administrator's intent for the OpenShift 5.0 upgrade. + enum: + - "2.8" + type: string httpCompression: description: |- httpCompression defines a policy for HTTP traffic compression. diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml index 89c366cda45..14198706f8a 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml @@ -892,6 +892,26 @@ spec: required: - type type: object + haproxyVersion: + description: |- + haproxyVersion specifies the HAProxy version to use for this + IngressController. + + This field is available in OpenShift 4.22 as an API-only backport with no + operator implementation. Setting this field on OpenShift 4.22 allows + administrators to pin HAProxy 2.8 before upgrading to OpenShift 5.0, where + the operator will honor this setting. + + Valid values for OpenShift 4.22: + - Unset (default): Uses HAProxy 2.8 (the default for OpenShift 4.22) + - "2.8": Explicitly pins HAProxy 2.8 for preservation during cluster + upgrade to OpenShift 5.0 + + On OpenShift 4.22, this field has no effect on the running IngressController. + It only preserves the administrator's intent for the OpenShift 5.0 upgrade. + enum: + - "2.8" + type: string httpCompression: description: |- httpCompression defines a policy for HTTP traffic compression. diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml index 535ddf0bc87..88a6a89f1b3 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml @@ -892,6 +892,26 @@ spec: required: - type type: object + haproxyVersion: + description: |- + haproxyVersion specifies the HAProxy version to use for this + IngressController. + + This field is available in OpenShift 4.22 as an API-only backport with no + operator implementation. Setting this field on OpenShift 4.22 allows + administrators to pin HAProxy 2.8 before upgrading to OpenShift 5.0, where + the operator will honor this setting. + + Valid values for OpenShift 4.22: + - Unset (default): Uses HAProxy 2.8 (the default for OpenShift 4.22) + - "2.8": Explicitly pins HAProxy 2.8 for preservation during cluster + upgrade to OpenShift 5.0 + + On OpenShift 4.22, this field has no effect on the running IngressController. + It only preserves the administrator's intent for the OpenShift 5.0 upgrade. + enum: + - "2.8" + type: string httpCompression: description: |- httpCompression defines a policy for HTTP traffic compression. diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml index 2fbc3cd4e39..4b31b1b7321 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml @@ -892,6 +892,26 @@ spec: required: - type type: object + haproxyVersion: + description: |- + haproxyVersion specifies the HAProxy version to use for this + IngressController. + + This field is available in OpenShift 4.22 as an API-only backport with no + operator implementation. Setting this field on OpenShift 4.22 allows + administrators to pin HAProxy 2.8 before upgrading to OpenShift 5.0, where + the operator will honor this setting. + + Valid values for OpenShift 4.22: + - Unset (default): Uses HAProxy 2.8 (the default for OpenShift 4.22) + - "2.8": Explicitly pins HAProxy 2.8 for preservation during cluster + upgrade to OpenShift 5.0 + + On OpenShift 4.22, this field has no effect on the running IngressController. + It only preserves the administrator's intent for the OpenShift 5.0 upgrade. + enum: + - "2.8" + type: string httpCompression: description: |- httpCompression defines a policy for HTTP traffic compression. diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml index db97e59b3f6..1da4706a637 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml @@ -892,6 +892,26 @@ spec: required: - type type: object + haproxyVersion: + description: |- + haproxyVersion specifies the HAProxy version to use for this + IngressController. + + This field is available in OpenShift 4.22 as an API-only backport with no + operator implementation. Setting this field on OpenShift 4.22 allows + administrators to pin HAProxy 2.8 before upgrading to OpenShift 5.0, where + the operator will honor this setting. + + Valid values for OpenShift 4.22: + - Unset (default): Uses HAProxy 2.8 (the default for OpenShift 4.22) + - "2.8": Explicitly pins HAProxy 2.8 for preservation during cluster + upgrade to OpenShift 5.0 + + On OpenShift 4.22, this field has no effect on the running IngressController. + It only preserves the administrator's intent for the OpenShift 5.0 upgrade. + enum: + - "2.8" + type: string httpCompression: description: |- httpCompression defines a policy for HTTP traffic compression. diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml index 883dd6d1ecb..111ff0b6382 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml @@ -892,6 +892,26 @@ spec: required: - type type: object + haproxyVersion: + description: |- + haproxyVersion specifies the HAProxy version to use for this + IngressController. + + This field is available in OpenShift 4.22 as an API-only backport with no + operator implementation. Setting this field on OpenShift 4.22 allows + administrators to pin HAProxy 2.8 before upgrading to OpenShift 5.0, where + the operator will honor this setting. + + Valid values for OpenShift 4.22: + - Unset (default): Uses HAProxy 2.8 (the default for OpenShift 4.22) + - "2.8": Explicitly pins HAProxy 2.8 for preservation during cluster + upgrade to OpenShift 5.0 + + On OpenShift 4.22, this field has no effect on the running IngressController. + It only preserves the administrator's intent for the OpenShift 5.0 upgrade. + enum: + - "2.8" + type: string httpCompression: description: |- httpCompression defines a policy for HTTP traffic compression. diff --git a/operator/v1/zz_generated.swagger_doc_generated.go b/operator/v1/zz_generated.swagger_doc_generated.go index c3ed726028d..ebc52b6ad7c 100644 --- a/operator/v1/zz_generated.swagger_doc_generated.go +++ b/operator/v1/zz_generated.swagger_doc_generated.go @@ -1082,6 +1082,7 @@ var map_IngressControllerSpec = map[string]string{ "httpCompression": "httpCompression defines a policy for HTTP traffic compression. By default, there is no HTTP compression.", "idleConnectionTerminationPolicy": "idleConnectionTerminationPolicy maps directly to HAProxy's idle-close-on-response option and controls whether HAProxy keeps idle frontend connections open during a soft stop (router reload).\n\nAllowed values for this field are \"Immediate\" and \"Deferred\". The default value is \"Immediate\".\n\nWhen set to \"Immediate\", idle connections are closed immediately during router reloads. This ensures immediate propagation of route changes but may impact clients sensitive to connection resets.\n\nWhen set to \"Deferred\", HAProxy will maintain idle connections during a soft reload instead of closing them immediately. These connections remain open until any of the following occurs:\n\n - A new request is received on the connection, in which\n case HAProxy handles it in the old process and closes\n the connection after sending the response.\n\n - HAProxy's `timeout http-keep-alive` duration expires.\n By default this is 300 seconds, but it can be changed\n using httpKeepAliveTimeout tuning option.\n\n - The client's keep-alive timeout expires, causing the\n client to close the connection.\n\nSetting Deferred can help prevent errors in clients or load balancers that do not properly handle connection resets. Additionally, this option allows you to retain the pre-2.4 HAProxy behaviour: in HAProxy version 2.2 (OpenShift versions < 4.14), maintaining idle connections during a soft reload was the default behaviour, but starting with HAProxy 2.4, the default changed to closing idle connections immediately.\n\nImportant Consideration:\n\n - Using Deferred will result in temporary inconsistencies\n for the first request on each persistent connection\n after a route update and router reload. This request\n will be processed by the old HAProxy process using its\n old configuration. Subsequent requests will use the\n updated configuration.\n\nOperational Considerations:\n\n - Keeping idle connections open during reloads may lead\n to an accumulation of old HAProxy processes if\n connections remain idle for extended periods,\n especially in environments where frequent reloads\n occur.\n\n - Consider monitoring the number of HAProxy processes in\n the router pods when Deferred is set.\n\n - You may need to enable or adjust the\n `ingress.operator.openshift.io/hard-stop-after`\n duration (configured via an annotation on the\n IngressController resource) in environments with\n frequent reloads to prevent resource exhaustion.", "closedClientConnectionPolicy": "closedClientConnectionPolicy controls how the IngressController behaves when the client closes the TCP connection while the TLS handshake or HTTP request is in progress. This option maps directly to HAProxy’s \"abortonclose\" option.\n\nValid values are: \"Abort\" and \"Continue\". The default value is \"Continue\".\n\nWhen set to \"Abort\", the router will stop processing the TLS handshake if it is in progress, and it will not send an HTTP request to the backend server if the request has not yet been sent when the client closes the connection.\n\nWhen set to \"Continue\", the router will complete the TLS handshake if it is in progress, or send an HTTP request to the backend server and wait for the backend server's response, regardless of whether the client has closed the connection.\n\nSetting \"Abort\" can help free CPU resources otherwise spent on TLS computation for connections the client has already closed, and can reduce request queue size, thereby reducing the load on saturated backend servers.\n\nImportant Considerations:\n\n - The default policy (\"Continue\") is HTTP-compliant, and requests\n for aborted client connections will still be served.\n Use the \"Continue\" policy to allow a client to send a request\n and then immediately close its side of the connection while\n still receiving a response on the half-closed connection.\n\n - When clients use keep-alive connections, the most common case for premature\n closure is when the user wants to cancel the transfer or when a timeout\n occurs. In that case, the \"Abort\" policy may be used to reduce resource consumption.\n\n - Using RSA keys larger than 2048 bits can significantly slow down\n TLS computations. Consider using the \"Abort\" policy to reduce CPU usage.", + "haproxyVersion": "haproxyVersion specifies the HAProxy version to use for this IngressController.\n\nThis field is available in OpenShift 4.22 as an API-only backport with no operator implementation. Setting this field on OpenShift 4.22 allows administrators to pin HAProxy 2.8 before upgrading to OpenShift 5.0, where the operator will honor this setting.\n\nValid values for OpenShift 4.22: - Unset (default): Uses HAProxy 2.8 (the default for OpenShift 4.22) - \"2.8\": Explicitly pins HAProxy 2.8 for preservation during cluster\n upgrade to OpenShift 5.0\n\nOn OpenShift 4.22, this field has no effect on the running IngressController. It only preserves the administrator's intent for the OpenShift 5.0 upgrade.", } func (IngressControllerSpec) SwaggerDoc() map[string]string {