RFE-2195: expose ROUTER_METRICS_HAPROXY_SERVER_THRESHOLD value via IngressController API

pkg/operator/controller/ingress/deployment.go

@@ -149,6 +149,12 @@ const (
 	RouterBackendCheckInterval = "ROUTER_BACKEND_CHECK_INTERVAL"
 	RouterTLSCurves            = "ROUTER_CURVES"
 
+	// RouterMetricsHAProxyServerThreshold is the env var that controls the maximum
+	// number of servers (backends) per HAProxy process for which per-server Prometheus
+	// metrics are reported. Exceeding this threshold disables per-server metrics to
+	// limit metric cardinality. Maps to spec.tuningOptions.haproxyServerThreshold.
+	RouterMetricsHAProxyServerThreshold = "ROUTER_METRICS_HAPROXY_SERVER_THRESHOLD"
+
 	RouterServiceHTTPPort  = "ROUTER_SERVICE_HTTP_PORT"
 	RouterServiceHTTPSPort = "ROUTER_SERVICE_HTTPS_PORT"
 	StatsPort              = "STATS_PORT"
@@ -564,6 +570,12 @@ func desiredRouterDeployment(ci *operatorv1.IngressController, config *Config, i
 	env = append(env, corev1.EnvVar{Name: "ROUTER_METRICS_TYPE", Value: "haproxy"})
 	env = append(env, corev1.EnvVar{Name: "ROUTER_METRICS_TLS_CERT_FILE", Value: filepath.Join(certsVolumeMountPath, "tls.crt")})
 	env = append(env, corev1.EnvVar{Name: "ROUTER_METRICS_TLS_KEY_FILE", Value: filepath.Join(certsVolumeMountPath, "tls.key")})
+	if ci.Spec.TuningOptions.HaproxyServerThreshold > 0 {
+		env = append(env, corev1.EnvVar{
+			Name:  RouterMetricsHAProxyServerThreshold,
+			Value: strconv.Itoa(int(ci.Spec.TuningOptions.HaproxyServerThreshold)),
+		})
+	}
 
 	var unsupportedConfigOverrides struct {
 		LoadBalancingAlgorithm string `json:"loadBalancingAlgorithm"`

pkg/operator/controller/ingress/deployment_test.go

@@ -3066,3 +3066,62 @@ func Test_detectFIPS(t *testing.T) {
 		})
 	}
 }
+
+// Test_HaproxyServerThreshold validates that desiredRouterDeployment correctly
+// sets or omits the ROUTER_METRICS_HAPROXY_SERVER_THRESHOLD environment variable
+// based on the value of spec.tuningOptions.haproxyServerThreshold.
+//
+// When the field is zero (omitted/default), the env var must not be set so that
+// the router image applies its own built-in default. When the field is a positive
+// integer, the env var must be set to the corresponding string value.
+func Test_HaproxyServerThreshold(t *testing.T) {
+	ic, ingressConfig, infraConfig, apiConfig, networkConfig, proxyNeeded, clusterProxyConfig := getRouterDeploymentComponents(t)
+
+	for _, tc := range []struct {
+		name                string
+		threshold           int32
+		expectEnvVarPresent bool
+		expectedEnvVarValue string
+	}{{
+		name:                "threshold is zero (default) — env var must be absent",
+		threshold:           0,
+		expectEnvVarPresent: false,
+		expectedEnvVarValue: "",
+	}, {
+		name:                "threshold is 1 (minimum valid value)",
+		threshold:           1,
+		expectEnvVarPresent: true,
+		expectedEnvVarValue: "1",
+	}, {
+		name:                "threshold is 500 (common production value)",
+		threshold:           500,
+		expectEnvVarPresent: true,
+		expectedEnvVarValue: "500",
+	}, {
+		name:                "threshold is 10000 (large cluster value)",
+		threshold:           10000,
+		expectEnvVarPresent: true,
+		expectedEnvVarValue: "10000",
+	}} {
+		t.Run(tc.name, func(t *testing.T) {
+			ic.Spec.TuningOptions.HaproxyServerThreshold = tc.threshold
+
+			deployment, err := desiredRouterDeployment(ic, &Config{IngressControllerImage: ingressControllerImage}, ingressConfig, infraConfig, apiConfig, networkConfig, nil, proxyNeeded, false, nil, clusterProxyConfig)
+			if err != nil {
+				t.Fatalf("failed to generate desired router Deployment: %v", err)
+			}
+
+			expectedEnv := []envData{{
+				name:          RouterMetricsHAProxyServerThreshold,
+				expectPresent: tc.expectEnvVarPresent,
+				expectedValue: tc.expectedEnvVarValue,
+			}}
+
+			if err := checkDeploymentEnvironment(t, deployment, expectedEnv); err != nil {
+				t.Errorf("environment variable check failed: %v", err)
+			}
+
+			checkDeploymentHasEnvSorted(t, deployment)
+		})
+	}
+}