Draft: NE-2823: Promote Multi HAProxy Versions feature to default

[jcmoraisjr]

Promote the IngressControllerMultipleHAProxyVersions feature gate to the default featureset.

https://redhat.atlassian.net/browse/NE-2823

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@jcmoraisjr: This pull request references NE-2823 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Promote the IngressControllerMultipleHAProxyVersions feature gate to the default featureset.

https://redhat.atlassian.net/browse/NE-2823

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

IngressControllerMultipleHAProxyVersions now enables for default and OKD contexts in its feature-gate declaration. Its documentation entry was repositioned, and the 4.10 HyperShift and self-managed HA Default and OKD manifests now list the gate as enabled instead of disabled.

Suggested reviewers: sadasu, vr4manta

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo spec titles were added or changed; the diff only updates feature-gate docs/manifests and generated CRDs.
Test Structure And Quality	✅ Passed	PR only changes feature-gate metadata/code and CRD manifests; no Ginkgo test code was added or modified.
Microshift Test Compatibility	✅ Passed	No Ginkgo e2e tests were added or modified; the PR only changes feature-gate config and generated CRD/manifests.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo/e2e tests were added; the commit only updates feature-gate docs/config and generated CRD manifests.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only promotes the HAProxy-version feature gate and adds CRD fields; no node selectors, affinity, topology-spread, PDB, or topology assumptions changed.
Ote Binary Stdout Contract	✅ Passed	Only feature-gate config/registration changed; the affected Go helpers are pure builders and a search found no stdout/logging writes in process-level code.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Commit only updates feature-gate docs/manifests and registration; no new Ginkgo e2e tests or network-dependent test code were added.
No-Weak-Crypto	✅ Passed	No weak crypto was introduced; DES-CBC3-SHA was pre-existing in the CRD manifests, while the diff only promotes the feature gate.
Container-Privileges	✅ Passed	PASS: The diff only adds HAProxy version schema/feature-gate entries; no privileged, hostPID/hostIPC, runAsUser:0, or allowPrivilegeEscalation fields were added.
No-Sensitive-Data-In-Logs	✅ Passed	The diff only promotes a feature gate in Go/YAML/CRD manifests; it adds no logging code or sensitive-data output.
Title check	✅ Passed	The title clearly summarizes the main change: promoting the Multi HAProxy Versions feature to default.
Description check	✅ Passed	The description is directly related to the changeset and accurately states the feature-gate promotion.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

Hello @jcmoraisjr! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[qodo-for-rh-openshift]

PR Summary by Qodo

Promote IngressControllerMultipleHAProxyVersions to default feature set

✨ Enhancement ⚙️ Configuration changes 📝 Documentation 🕐 20-40 Minutes

AI Description

• Enable IngressControllerMultipleHAProxyVersions in the default/OKD feature sets.
• Expose HAProxy version pinning and reporting fields in IngressController CRDs.
• Update feature-gate payload manifests and feature documentation to match defaults.

Diagram

graph TD
  A["FeatureGate payload (4.10)"] --> B["Feature registry (features.go)"] --> C["Ingress Operator"] --> D[("IngressController CRD schema")] --> E["IngressController CRs"]
  B --> F["Feature docs (features.md)"]

Loading

High-Level Assessment

Promoting the existing feature gate into the Default/OKD feature sets is the most direct way to make the API fields generally available without introducing new flags or migration mechanisms. The PR also correctly pairs the promotion with CRD schema and payload-manifest updates so clusters see consistent defaults.

Files changed (8) +94 / -14

Enhancement (2) +80 / -0

0000_50_ingress_00_ingresscontrollers-Default.crd.yamlAdd haproxyVersion spec field and effectiveHAProxyVersion status field (Default CRD) +40/-0

Add haproxyVersion spec field and effectiveHAProxyVersion status field (Default CRD)

• Extends the IngressController CRD schema with spec.haproxyVersion (enum: 2.8, 3.2) and status.effectiveHAProxyVersion (enum: 2.8, 3.2). The descriptions document defaulting/pinning behavior and upgrade-blocking semantics when a pinned version becomes unsupported.

operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml

0000_50_ingress_00_ingresscontrollers-OKD.crd.yamlAdd haproxyVersion spec field and effectiveHAProxyVersion status field (OKD CRD) +40/-0

Add haproxyVersion spec field and effectiveHAProxyVersion status field (OKD CRD)

• Mirrors the Default CRD schema changes for OKD by adding spec.haproxyVersion and status.effectiveHAProxyVersion with the same enums and documentation. This keeps API surface consistent across Default and OKD payloads.

operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml

Documentation (1) +1 / -1

features.mdMove multi-HAProxy-versions feature to default feature-set documentation +1/-1

Move multi-HAProxy-versions feature to default feature-set documentation

• Updates the feature table to reflect IngressControllerMultipleHAProxyVersions being enabled by default. The entry is repositioned to align with the default-enabled section of the document.

features.md

Other (5) +13 / -13

features.goEnable IngressControllerMultipleHAProxyVersions in Default and OKD feature sets +1/-1

Enable IngressControllerMultipleHAProxyVersions in Default and OKD feature sets

• Updates the feature-gate registration to include inDefault() and inOKD() for IngressControllerMultipleHAProxyVersions. This promotes the feature gate from preview-only to default-enabled while retaining preview feature sets.

features/features.go

featureGate-4-10-Hypershift-Default.yamlPromote multi-HAProxy-versions feature gate into default-enabled list (HyperShift Default) +3/-3

Promote multi-HAProxy-versions feature gate into default-enabled list (HyperShift Default)

• Moves IngressControllerMultipleHAProxyVersions from the earlier (non-default) block into the default-enabled feature list for the HyperShift Default feature gate payload. This aligns runtime defaults with the promoted feature-set behavior.

payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml

featureGate-4-10-Hypershift-OKD.yamlPromote multi-HAProxy-versions feature gate into default-enabled list (HyperShift OKD) +3/-3

Promote multi-HAProxy-versions feature gate into default-enabled list (HyperShift OKD)

• Moves IngressControllerMultipleHAProxyVersions into the default-enabled feature list for the HyperShift OKD feature gate payload. This keeps OKD HyperShift defaults consistent with the promoted feature gate.

payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml

featureGate-4-10-SelfManagedHA-Default.yamlPromote multi-HAProxy-versions feature gate into default-enabled list (SelfManagedHA Default) +3/-3

Promote multi-HAProxy-versions feature gate into default-enabled list (SelfManagedHA Default)

• Moves IngressControllerMultipleHAProxyVersions into the default-enabled feature list for the SelfManagedHA Default payload. This ensures self-managed HA clusters get the feature enabled by default.

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml

featureGate-4-10-SelfManagedHA-OKD.yamlPromote multi-HAProxy-versions feature gate into default-enabled list (SelfManagedHA OKD) +3/-3

Promote multi-HAProxy-versions feature gate into default-enabled list (SelfManagedHA OKD)

• Moves IngressControllerMultipleHAProxyVersions into the default-enabled feature list for the SelfManagedHA OKD payload. This maintains parity between Default and OKD self-managed HA payloads.

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign joelspeed for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[qodo-for-rh-openshift]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

⚠️ Tickets: not configured — ticket URL found in PR but could not be fetched — check ticket provider credentials

✅ Compliance rules (platform): 29 rules

✅ Skills: api-review

1. 5.0-only value exposed 🐞 Bug ≡ Correctness

Description

IngressControllerMultipleHAProxyVersions is now enabled for the Default and OKD feature sets without
any OpenShift major-version constraint, which makes spec.haproxyVersion accept "3.2" even on
payloads that target major version 4. This contradicts the API documentation that describes HAProxy
3.2 as introduced in OpenShift 5.0 and can let OpenShift 4.x clusters pass API validation with a
value that may not be supported by that release’s ingress payload/operator logic.

Code

features/features.go[682]

+								enable(inDefault(), inOKD(), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()).

Relevance

⭐⭐⭐ High

Likely treated as backward-compat/correctness bug: avoid exposing 5.0-only API values on 4.x payload
validation.

PR-#2906
PR-#2784

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR change enables the gate in Default/OKD; the generated payload FeatureGate manifests apply to
major version 4 as well; and the API type/docs + enum explicitly frame 3.2 as an OpenShift 5.0
capability while still allowing it via validation.

features/features.go[677-683]
payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml[2-9]
operator/v1/types_ingresscontroller.go[389-413]
operator/v1/types_ingresscontroller.go[2373-2386]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The feature gate `IngressControllerMultipleHAProxyVersions` is now enabled in `Default` and `OKD` for all generated OpenShift major versions, but the API type/doc explicitly describes HAProxy `3.2` as an OpenShift 5.0 introduction. This means OpenShift major version 4 payloads will advertise and validate a value (`"3.2"`) that is documented as 5.0-only.

### Issue Context
- The feature-gate payloads are annotated for major versions `4,5,6,7,8,9,10`.
- The `HAProxyVersion` type is enum-constrained to `"2.8";"3.2"`.
- The `haproxyVersion` field description states HAProxy 3.2 is the OpenShift 5.0 default.

### Fix Focus Areas
- features/features.go[677-683]

### How to fix
Update the feature gate registration to only enable this gate in `Default`/`OKD` for OpenShift major version >= 5 (e.g., by adding `inVersion(5, greaterThanOrEqual)` to the enable options for `inDefault()` and `inOKD()`), or otherwise make the exposed/validated values release-aware so major version 4 payloads do not validate/advertise `"3.2"` as a supported setting.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[qodo-for-rh-openshift]

1. 5.0-only value exposed 🐞 Bug ≡ Correctness

IngressControllerMultipleHAProxyVersions is now enabled for the Default and OKD feature sets without
any OpenShift major-version constraint, which makes spec.haproxyVersion accept "3.2" even on
payloads that target major version 4. This contradicts the API documentation that describes HAProxy
3.2 as introduced in OpenShift 5.0 and can let OpenShift 4.x clusters pass API validation with a
value that may not be supported by that release’s ingress payload/operator logic.

Agent Prompt

### Issue description
The feature gate `IngressControllerMultipleHAProxyVersions` is now enabled in `Default` and `OKD` for all generated OpenShift major versions, but the API type/doc explicitly describes HAProxy `3.2` as an OpenShift 5.0 introduction. This means OpenShift major version 4 payloads will advertise and validate a value (`"3.2"`) that is documented as 5.0-only.

### Issue Context
- The feature-gate payloads are annotated for major versions `4,5,6,7,8,9,10`.
- The `HAProxyVersion` type is enum-constrained to `"2.8";"3.2"`.
- The `haproxyVersion` field description states HAProxy 3.2 is the OpenShift 5.0 default.

### Fix Focus Areas
- features/features.go[677-683]

### How to fix
Update the feature gate registration to only enable this gate in `Default`/`OKD` for OpenShift major version >= 5 (e.g., by adding `inVersion(5, greaterThanOrEqual)` to the enable options for `inDefault()` and `inOKD()`), or otherwise make the exposed/validated values release-aware so major version 4 payloads do not validate/advertise `"3.2"` as a supported setting.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[openshift-ci]

@jcmoraisjr: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify-hypershift-integration	bb7402c	link	true	/test verify-hypershift-integration
ci/prow/verify-feature-promotion	bb7402c	link	true	/test verify-feature-promotion

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.