Skip to content

feat: set dataPlaneHAProxyImage to decouple worker HAProxy from management cluster #6660

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Anthony Vollmer (avollmer-redhat) wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat: set dataPlaneHAProxyImage to decouple worker HAProxy from management cluster #6660

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5c519c6
feat: set dataPlaneHAProxyImage to decouple worker HAProxy from manag…
avollmer-redhat Aug 24, 2026
a660b6e
fix: use acrDNSSuffix instead of hardcoded azurecr.io for non-public …
avollmer-redhat Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions cluster-service/pipeline.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,32 @@ resourceGroups:
- "unauthorized: authentication required"
maximumRetryCount: 5
durationBetweenRetries: 1m
- name: mirror-data-plane-haproxy-image
action: ImageMirror
targetACR:
configRef: 'acr.ocp.name'
sourceRegistry:
configRef: clustersService.dataPlaneHAProxyImage.registry
repository:
configRef: clustersService.dataPlaneHAProxyImage.repository
digest:
configRef: clustersService.dataPlaneHAProxyImage.digest
pullSecretKeyVault:
configRef: global.keyVault.name
pullSecretName:
configRef: imageSync.ondemandSync.pullSecretName
shellIdentity:
input:
resourceGroup: global
step: output
name: globalMSIId
automatedRetry:
errorContainsAny:
- "unknown_storage_failure"
- "unexpected EOF"
- "unauthorized: authentication required"
maximumRetryCount: 5
durationBetweenRetries: 1m
- name: kusto
resourceGroup: '{{ .kusto.rg }}'
subscription: '{{ .global.subscription.key }}'
Expand Down Expand Up @@ -135,6 +161,8 @@ resourceGroups:
step: output
- resourceGroup: global
step: mirror-image
- resourceGroup: global
step: mirror-data-plane-haproxy-image
automatedRetry:
errorContainsAny:
- "500 Internal Server Error"
Expand Down
1 change: 1 addition & 0 deletions cluster-service/testdata/zz_fixture_TestHelmTemplate_cs_azuredb.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8107,6 +8107,7 @@ spec:
- --log-fields-from-baggage=aro.correlation_id=correlation_id,aro.client.request_id=client_request_id


- --data-plane-ha-proxy-image=arohcpocpdev.azurecr.io/redhat-user-workloads/crt-redhat-acm-tenant/hypershift-shared-ingress-main@sha256:1234567890
livenessProbe:
httpGet:
path: /api/clusters_mgmt/v1
Expand Down
1 change: 1 addition & 0 deletions cluster-service/testdata/zz_fixture_TestHelmTemplate_cs_containerdb.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8208,6 +8208,7 @@ spec:
- --log-fields-from-baggage=aro.correlation_id=correlation_id,aro.client.request_id=client_request_id


- --data-plane-ha-proxy-image=arohcpocpdev.azurecr.io/redhat-user-workloads/crt-redhat-acm-tenant/hypershift-shared-ingress-main@sha256:1234567890
livenessProbe:
httpGet:
path: /api/clusters_mgmt/v1
Expand Down
1 change: 1 addition & 0 deletions cluster-service/testdata/zz_fixture_TestHelmTemplate_cs_distinct_arm_helper.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8107,6 +8107,7 @@ spec:
- --log-fields-from-baggage=aro.correlation_id=correlation_id,aro.client.request_id=client_request_id


- --data-plane-ha-proxy-image=arohcpocpdev.azurecr.io/redhat-user-workloads/crt-redhat-acm-tenant/hypershift-shared-ingress-main@sha256:1234567890
livenessProbe:
httpGet:
path: /api/clusters_mgmt/v1
Expand Down
1 change: 1 addition & 0 deletions cluster-service/testdata/zz_fixture_TestHelmTemplate_cs_shared_arm_helper.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8107,6 +8107,7 @@ spec:
- --log-fields-from-baggage=aro.correlation_id=correlation_id,aro.client.request_id=client_request_id


- --data-plane-ha-proxy-image=arohcpocpdev.azurecr.io/redhat-user-workloads/crt-redhat-acm-tenant/hypershift-shared-ingress-main@sha256:1234567890
livenessProbe:
httpGet:
path: /api/clusters_mgmt/v1
Expand Down
6 changes: 3 additions & 3 deletions cluster-service/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,9 +212,9 @@ databasePort: "5432"
# The name of the managed identities data plane audience resource.
managedIdentitiesDataPlaneAudienceResource: "{{ .msiRp.dataPlaneAudienceResource }}"
# The image used to override the HAProxy image of the worker node API server proxy.
# If set to an empty string, either the environment variable IMAGE_SHARED_INGRESS_HAPROXY or the default shared ingress image will be used.
# If given a value, it must be a valid image reference.
dataPlaneHAProxyImage: "{{ .clustersService.dataPlaneHAProxyImage }}"
# Assembled as an ACR reference so worker nodes pull from the environment-specific ACR, not quay.io.
# When digest is empty, CS falls back to IMAGE_SHARED_INGRESS_HAPROXY (legacy behavior).
dataPlaneHAProxyImage: "{{ if .clustersService.dataPlaneHAProxyImage.digest }}{{ .acr.ocp.name }}.{{ .acrDNSSuffix }}/{{ .clustersService.dataPlaneHAProxyImage.repository }}@{{ .clustersService.dataPlaneHAProxyImage.digest }}{{ end }}"
# The Azure Operator Managed Identities.
azureOperatorsMI:
roleSetName: "{{ .clustersService.azureOperatorsManagedIdentities.roleSetName }}"
Expand Down
1 change: 1 addition & 0 deletions cluster-service/zz_fixture_TestHelmTemplate_dev_westus3_svc_1_cluster_service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8107,6 +8107,7 @@ spec:
- --log-fields-from-baggage=aro.correlation_id=correlation_id,aro.client.request_id=client_request_id


- --data-plane-ha-proxy-image=arohcpocpdev.azurecr.io/redhat-user-workloads/crt-redhat-acm-tenant/hypershift-shared-ingress-main@sha256:1234567890
livenessProbe:
httpGet:
path: /api/clusters_mgmt/v1
Expand Down
3 changes: 1 addition & 2 deletions config/config.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1238,8 +1238,7 @@
]
},
"dataPlaneHAProxyImage": {
"type": "string",
"description": "A valid image reference used for overriding the HAProxy image of the worker node API server proxy. If set to an empty string, either the environment variable IMAGE_SHARED_INGRESS_HAPROXY or the default shared ingress image will be used."
"$ref": "#/definitions/containerImage"
}
Comment thread
avollmer-redhat marked this conversation as resolved.

@avollmer-redhat Anthony Vollmer (avollmer-redhat) Aug 25, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is incorrect. The containerImage definition is a shared schema type used by 33 other fields — tightening it to require non-empty digest/registry would be a breaking change affecting all of them. The ImageMirror pipeline step only runs when the field is populated (which it always is — config.yaml provides registry, repository, and digest). An empty digest would fail make validate-config-pipelines before ever reaching deployment. This PR correctly reuses the existing shared type rather than inventing a one-off stricter variant.

},
"additionalProperties": false,
Comment thread
avollmer-redhat marked this conversation as resolved.

@avollmer-redhat Anthony Vollmer (avollmer-redhat) Aug 25, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is incorrect. The containerImage definition is used by 33 other fields in this schema — none of them add per-field descriptions via allOf, and none are in a required list. The description lives on the shared containerImage definition itself. Adding dataPlaneHAProxyImage to required is unnecessary because config.yaml always provides a value, and make validate-config-pipelines validates configRef resolution at pipeline level, not schema level. This follows the exact same pattern as every other containerImage field in the schema (e.g. sharedIngressImage, externalDNSImage, istioImage, etc.).

Expand Down
7 changes: 6 additions & 1 deletion config/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1097,7 +1097,12 @@ defaults:
environment: "arohcp{{ .ctx.environment }}"
denyAssignments: "disabled"
# The image used to override the HAProxy image of the worker node API server proxy.
dataPlaneHAProxyImage: ""
# Defaults to matching sharedIngressImage so the decoupled image starts identical.
# Override only `digest` per-region in sdp-pipelines overlays when regions need pinning.
dataPlaneHAProxyImage:
registry: quay.io
repository: redhat-user-workloads/crt-redhat-acm-tenant/hypershift-shared-ingress-main
digest: sha256:5e22710fe440869655329ecc0ef57b4ae15f4ef96e74a8904b1e6fafc0d87678
postgres:
name: "arohcp-{{ .ctx.environment }}-dbcs-{{ .ctx.regionShort }}" # [globally-unique]
deploy: true
Expand Down
5 changes: 4 additions & 1 deletion config/rendered/dev/ci00/centralus.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,10 @@ clustersService:
tlsCertificatesIssuer: Self
batchProcesses: ""
batchProcessesDryRun: true
dataPlaneHAProxyImage: ""
dataPlaneHAProxyImage:
digest: sha256:5e22710fe440869655329ecc0ef57b4ae15f4ef96e74a8904b1e6fafc0d87678
registry: quay.io
repository: redhat-user-workloads/crt-redhat-acm-tenant/hypershift-shared-ingress-main
denyAssignments: disabled
deployDebugJobs: false
environment: arohcpci00
Expand Down
5 changes: 4 additions & 1 deletion config/rendered/dev/ci01/centralus.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,10 @@ clustersService:
tlsCertificatesIssuer: Self
batchProcesses: ""
batchProcessesDryRun: true
dataPlaneHAProxyImage: ""
dataPlaneHAProxyImage:
digest: sha256:5e22710fe440869655329ecc0ef57b4ae15f4ef96e74a8904b1e6fafc0d87678
registry: quay.io
repository: redhat-user-workloads/crt-redhat-acm-tenant/hypershift-shared-ingress-main
denyAssignments: disabled
deployDebugJobs: false
environment: arohcpci01
Expand Down
5 changes: 4 additions & 1 deletion config/rendered/dev/cspr/westus3.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,10 @@ clustersService:
tlsCertificatesIssuer: Self
batchProcesses: ""
batchProcessesDryRun: true
dataPlaneHAProxyImage: ""
dataPlaneHAProxyImage:
digest: sha256:5e22710fe440869655329ecc0ef57b4ae15f4ef96e74a8904b1e6fafc0d87678
registry: quay.io
repository: redhat-user-workloads/crt-redhat-acm-tenant/hypershift-shared-ingress-main
denyAssignments: disabled
deployDebugJobs: false
environment: arohcpcspr
Expand Down
5 changes: 4 additions & 1 deletion config/rendered/dev/dev/westus3.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,10 @@ clustersService:
tlsCertificatesIssuer: Self
batchProcesses: ""
batchProcessesDryRun: true
dataPlaneHAProxyImage: ""
dataPlaneHAProxyImage:
digest: sha256:5e22710fe440869655329ecc0ef57b4ae15f4ef96e74a8904b1e6fafc0d87678
registry: quay.io
repository: redhat-user-workloads/crt-redhat-acm-tenant/hypershift-shared-ingress-main
denyAssignments: disabled
deployDebugJobs: false
environment: arohcpdev
Expand Down
5 changes: 4 additions & 1 deletion config/rendered/dev/perf/westus3.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,10 @@ clustersService:
tlsCertificatesIssuer: Self
batchProcesses: ""
batchProcessesDryRun: true
dataPlaneHAProxyImage: ""
dataPlaneHAProxyImage:
digest: sha256:5e22710fe440869655329ecc0ef57b4ae15f4ef96e74a8904b1e6fafc0d87678
registry: quay.io
repository: redhat-user-workloads/crt-redhat-acm-tenant/hypershift-shared-ingress-main
denyAssignments: disabled
deployDebugJobs: false
environment: arohcpperf
Expand Down
5 changes: 4 additions & 1 deletion config/rendered/dev/pers/westus3.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,10 @@ clustersService:
tlsCertificatesIssuer: Self
batchProcesses: ""
batchProcessesDryRun: true
dataPlaneHAProxyImage: ""
dataPlaneHAProxyImage:
digest: sha256:5e22710fe440869655329ecc0ef57b4ae15f4ef96e74a8904b1e6fafc0d87678
registry: quay.io
repository: redhat-user-workloads/crt-redhat-acm-tenant/hypershift-shared-ingress-main
denyAssignments: disabled
deployDebugJobs: false
environment: arohcppers
Expand Down