Add unsupported config override for config manager

Add an unsupported config override to enable OpenShift router's dynamic
config manager for HAProxy.

* pkg/operator/controller/ingress/deployment.go
(RouterHAProxyConfigManager): New const.
(desiredRouterDeployment): Add unsupported config override for
ROUTER_HAPROXY_CONFIG_MANAGER.
* pkg/operator/controller/ingress/deployment_test.go
(TestDesiredRouterDeployment): Verify that desiredRouterDeployment sets
ROUTER_HAPROXY_CONFIG_MANAGER as expected.
* test/e2e/operator_test.go
(TestDynamicConfigManagerUnsupportedConfigOverride): Verify that the
operator sets ROUTER_HAPROXY_CONFIG_MANAGER on a router deployment for an
IngressController that enables the unsupported config override.

pkg/operator/controller/ingress/deployment.go

@@ -67,6 +67,8 @@ const (
 
 	LivenessGracePeriodSecondsAnnotation = "unsupported.do-not-use.openshift.io/override-liveness-grace-period-seconds"
 
+	RouterHAProxyConfigManager = "ROUTER_HAPROXY_CONFIG_MANAGER"
+
 	RouterHAProxyThreadsEnvName      = "ROUTER_THREADS"
 	RouterHAProxyThreadsDefaultValue = 4
 
@@ -410,12 +412,14 @@ func desiredRouterDeployment(ci *operatorv1.IngressController, ingressController
 
 	var unsupportedConfigOverrides struct {
 		LoadBalancingAlgorithm string `json:"loadBalancingAlgorithm"`
+		DynamicConfigManager   string `json:"dynamicConfigManager"`
 	}
 	if len(ci.Spec.UnsupportedConfigOverrides.Raw) > 0 {
 		if err := json.Unmarshal(ci.Spec.UnsupportedConfigOverrides.Raw, &unsupportedConfigOverrides); err != nil {
 			return nil, fmt.Errorf("ingresscontroller %q has invalid spec.unsupportedConfigOverrides: %w", ci.Name, err)
 		}
 	}
+
 	loadBalancingAlgorithm := "random"
 	switch unsupportedConfigOverrides.LoadBalancingAlgorithm {
 	case "leastconn":
@@ -426,6 +430,14 @@ func desiredRouterDeployment(ci *operatorv1.IngressController, ingressController
 		Value: loadBalancingAlgorithm,
 	})
 
+	dynamicConfigOverride := unsupportedConfigOverrides.DynamicConfigManager
+	if v, err := strconv.ParseBool(dynamicConfigOverride); err == nil && v {
+		env = append(env, corev1.EnvVar{
+			Name:  RouterHAProxyConfigManager,
+			Value: "true",
+		})
+	}
+
 	if len(ci.Status.Domain) > 0 {
 		env = append(env, corev1.EnvVar{Name: "ROUTER_CANONICAL_HOSTNAME", Value: "router-" + ci.Name + "." + ci.Status.Domain})
 	}
@@ -620,7 +632,7 @@ func desiredRouterDeployment(ci *operatorv1.IngressController, ingressController
 
 	tlsProfileSpec := tlsProfileSpecForIngressController(ci, apiConfig)
 
-	ciphers := strings.Join(tlsProfileSpec.Ciphers, ":")
+	ciphers := strings.Join(tlsProfileSpec.DeepCopy().Ciphers, ":")
 	env = append(env, corev1.EnvVar{Name: "ROUTER_CIPHERS", Value: ciphers})
 
 	var minTLSVersion string

pkg/operator/controller/ingress/deployment_test.go

@@ -218,6 +218,8 @@ func TestDesiredRouterDeployment(t *testing.T) {
 			deployment.Spec.Template.Spec.Tolerations)
 	}
 
+	checkDeploymentHasEnvVar(t, deployment, "ROUTER_HAPROXY_CONFIG_MANAGER", false, "")
+
 	checkDeploymentHasEnvVar(t, deployment, "ROUTER_LOAD_BALANCE_ALGORITHM", true, "random")
 
 	checkDeploymentHasEnvVar(t, deployment, "ROUTER_USE_PROXY_PROTOCOL", false, "")
@@ -347,7 +349,7 @@ func TestDesiredRouterDeployment(t *testing.T) {
 	var expectedReplicas int32 = 8
 	ci.Spec.Replicas = &expectedReplicas
 	ci.Spec.UnsupportedConfigOverrides = runtime.RawExtension{
-		Raw: []byte(`{"loadBalancingAlgorithm":"leastconn"}`),
+		Raw: []byte(`{"loadBalancingAlgorithm":"leastconn","dynamicConfigManager":"false"}`),
 	}
 	ci.Status.Domain = "example.com"
 	ci.Status.EndpointPublishingStrategy.Type = operatorv1.LoadBalancerServiceStrategyType
@@ -377,6 +379,8 @@ func TestDesiredRouterDeployment(t *testing.T) {
 		t.Errorf("expected empty startup probe host, got %q", deployment.Spec.Template.Spec.Containers[0].StartupProbe.Handler.HTTPGet.Host)
 	}
 
+	checkDeploymentHasEnvVar(t, deployment, "ROUTER_HAPROXY_CONFIG_MANAGER", false, "")
+
 	checkDeploymentHasEnvVar(t, deployment, "ROUTER_LOAD_BALANCE_ALGORITHM", true, "leastconn")
 
 	checkDeploymentHasEnvVar(t, deployment, "ROUTER_USE_PROXY_PROTOCOL", true, "true")
@@ -412,7 +416,7 @@ func TestDesiredRouterDeployment(t *testing.T) {
 	// Any value for loadBalancingAlgorithm other than "leastconn" should be
 	// ignored.
 	ci.Spec.UnsupportedConfigOverrides = runtime.RawExtension{
-		Raw: []byte(`{"loadBalancingAlgorithm":"source"}`),
+		Raw: []byte(`{"loadBalancingAlgorithm":"source","dynamicConfigManager":"true"}`),
 	}
 	ci.Status.EndpointPublishingStrategy.LoadBalancer = &operatorv1.LoadBalancerStrategy{
 		Scope: operatorv1.ExternalLoadBalancer,
@@ -446,6 +450,8 @@ func TestDesiredRouterDeployment(t *testing.T) {
 		t.Errorf("expected empty startup probe host, got %q", deployment.Spec.Template.Spec.Containers[0].StartupProbe.Handler.HTTPGet.Host)
 	}
 
+	checkDeploymentHasEnvVar(t, deployment, "ROUTER_HAPROXY_CONFIG_MANAGER", true, "true")
+
 	checkDeploymentHasEnvVar(t, deployment, "ROUTER_LOAD_BALANCE_ALGORITHM", true, "random")
 
 	checkDeploymentDoesNotHaveEnvVar(t, deployment, "ROUTER_USE_PROXY_PROTOCOL")

test/e2e/operator_test.go

@@ -1978,6 +1978,43 @@ func TestLoadBalancingAlgorithmUnsupportedConfigOverride(t *testing.T) {
 	}
 }
 
+// TestDynamicConfigManagerUnsupportedConfigOverride verifies that the operator
+// configures router pod replicas to use the dynamic config manager if the
+// ingresscontroller is so configured using an unsupported config override.
+func TestDynamicConfigManagerUnsupportedConfigOverride(t *testing.T) {
+	icName := types.NamespacedName{Namespace: operatorNamespace, Name: "dynamic-config-manager"}
+	domain := icName.Name + "." + dnsConfig.Spec.BaseDomain
+	ic := newPrivateController(icName, domain)
+	if err := kclient.Create(context.TODO(), ic); err != nil {
+		t.Fatalf("failed to create ingresscontroller: %v", err)
+	}
+	defer assertIngressControllerDeleted(t, kclient, ic)
+
+	if err := waitForIngressControllerCondition(t, kclient, 5*time.Minute, icName, availableConditionsForPrivateIngressController...); err != nil {
+		t.Errorf("failed to observe expected conditions: %w", err)
+	}
+
+	if err := kclient.Get(context.TODO(), icName, ic); err != nil {
+		t.Fatalf("failed to get ingresscontroller: %v", err)
+	}
+	deployment := &appsv1.Deployment{}
+	if err := kclient.Get(context.TODO(), controller.RouterDeploymentName(ic), deployment); err != nil {
+		t.Fatalf("failed to get ingresscontroller deployment: %v", err)
+	}
+	if err := waitForDeploymentEnvVar(t, kclient, deployment, 30*time.Second, "ROUTER_HAPROXY_CONFIG_MANAGER", ""); err != nil {
+		t.Fatalf("expected initial deployment not to set ROUTER_HAPROXY_CONFIG_MANAGER=true: %v", err)
+	}
+
+	ic.Spec.UnsupportedConfigOverrides = runtime.RawExtension{
+		Raw: []byte(`{"dynamicConfigManager":"true"}`),
+	}
+	if err := kclient.Update(context.TODO(), ic); err != nil {
+		t.Fatalf("failed to update ingresscontroller: %v", err)
+	}
+	if err := waitForDeploymentEnvVar(t, kclient, deployment, 1*time.Minute, "ROUTER_HAPROXY_CONFIG_MANAGER", "true"); err != nil {
+		t.Fatalf("expected initial deployment to set ROUTER_HAPROXY_CONFIG_MANAGER=true: %v", err)
+	}
+}
 // TestLocalWithFallbackOverrideForLoadBalancerService verifies that the
 // operator does not set the local-with-fallback annotation on a LoadBalancer
 // service if the the localWithFallback unsupported config override is set to