Original: * `Append`, preserves any existing headers by specifying that the ingress controller appends them.
* `Replace`, removes any existing headers by specifying that the ingress controller sets the headers.
* `Never`, preserves any existing headers by specifying that the ingress controller never sets the headers.
* `httpCompressionmimeTypes` defines a list of MIME types to which compression should be applied. For example, `text/css; charset=utf-8`, `text/html`, `text/*`, `image/svg+xml`, `application/octet-stream`, `X-custom/customsub`, using the format pattern, `type/subtype; [;attribute=value]`. The `types` are: application, image, message, multipart, text, video, or a custom type prefaced by `X-`. To see the full notation for MIME types and subtypes, see link:https://datatracker.ietf.org/doc/html/rfc1341#page-7[RFC1341] (IETF Datatracker documentation).
|`httpEmptyRequestsPolicy` describes how HTTP connections are handled if the connection times out before a request is received. Allowed values for this field are `Respond` and `Ignore`. The default value is `Respond`.
The `httpEmptyRequestsPolicy` type accepts either one of two values:
* `Respond`: If the field is set to `Respond`, the ingress controller sends an HTTP `400` or `408` response, logs the connection if access logging is enabled, and counts the connection in the appropriate metrics.
* `Ignore`: Setting the option to `Ignore` adds the `http-ignore-probes` parameter in the `HAproxy` configuration. If the field is set to `Ignore`, the ingress controller closes the connection without sending a response, then logs the connection, or incrementing metrics.
These connections come from load-balancer health probes or preconnects and can be safely ignored. However, these requests can be caused by network errors, so setting this field to `Ignore` can impede detection or diagnosis of problems. These requests can be caused by port scans, in which case logging empty requests can aid in detecting intrusion attempts.
|`logEmptyRequests`
|`logEmptyRequests` specifies connections for which no request is received and logged. These empty requests come from load balancer health probes or web browser speculative connections (preconnect) and logging these requests can be undesirable. However, these requests can be caused by network errors, in which case logging empty requests can be useful for diagnosing the errors. These requests can be caused by port scans, and logging empty requests can aid in detecting intrusion attempts. Allowed values for this field are `Log` and `Ignore`. The default is `Log`.
The `LoggingPolicy` type accepts either one of two values:
* `Log`: Setting this value to `Log` indicates that an event should be logged.
* `Ignore`: Setting this value to `Ignore` sets the `dontlognull` option in the HAproxy configuration.
|`routeAdmission` defines a policy for handling new route claims, such as allowing or denying claims across namespaces.
`namespaceOwnership` describes how hostname claims across namespaces should be handled. The default is `InterNamespaceAllowed`.
* `Strict`: does not allow routes to claim the same hostname across namespaces.
* `InterNamespaceAllowed`: allows routes to claim different paths of the same hostname across namespaces.
`wildcardPolicy` describes how routes with wildcard policies are handled by the ingress controller.
* `WildcardsDisallowed`: Indicates only routes with a wildcard policy of `None` are admitted by the ingress controller. Updating `wildcardPolicy` from `WildcardsAllowed` to `WildcardsDisallowed` causes admitted routes with a wildcard policy of `Subdomain` to stop working. These routes must be recreated to a wildcard policy of `None` to be readmitted by the ingress The default value can change in future releases.
|`tlsSecurityProfile`
|`tlsSecurityProfile` specifies settings for TLS connections for Ingress Controllers.
If not set, the default value is based on the `apiservers.config.openshift.io/cluster` resource.
`Intermediate` is the default setting.
The minimum TLS version for ingress controllers is `1.1`. The maximum TLS version is `1.3`.
Ciphers and the minimum TLS version of the configured security profile are reflected in the `TLSProfile` status.
[IMPORTANT]
====
The TLS `1.0` version of an `Old` or `Custom` profile is automatically converted to `1.1` by the ingress controller.
====
|`tuningOptions` specifies options for tuning the performance of ingress controller pods.
* `clientFinTimeout` specifies how long a connection is held open while waiting for the client response to the server closing the connection. The default timeout is `1s`.
* `clientTimeout` specifies how long a connection is held open while waiting for a client response. The default timeout is `30s`.
* `headerBufferBytes` specifies how much memory is reserved, in bytes, for ingress controller connection sessions. This value must be at least `16384` if HTTP/2 is enabled for the ingress controller. If not set, the default value is `32768` bytes.
+
* `headerBufferMaxRewriteBytes` specifies how much memory should be reserved, in bytes, from `headerBufferBytes` for HTTP header rewriting and appending for ingress controller connection sessions. The minimum value for `headerBufferMaxRewriteBytes` is `4096`. `headerBufferBytes` must be greater than the `headerBufferMaxRewriteBytes` value for incoming HTTP requests. If not set, the default value is `8192` bytes.
+
* `healthCheckInterval` specifies how long the router waits between health checks. The default is `5s`.
* `serverFinTimeout` specifies how long a connection is held open while waiting for the server response to the client that is closing the connection. The default timeout is `1s`.
* `serverTimeout` specifies how long a connection is held open while waiting for a server response. The default timeout is `30s`.
* `threadCount` specifies the number of threads to create per HAProxy process. Creating more threads allows each ingress controller pod to handle more connections, at the cost of more system resources being used. `HAProxy` supports up to `64` threads. If this field is empty, the ingress controller uses the default value of `4` threads.
+
[IMPORTANT]
====
Setting this field is not recommended because increasing the number of `HAProxy` threads allows ingress controller pods to use more CPU time under load, and prevent other pods from receiving the CPU resources they need to perform. Reducing the number of threads can cause the ingress controller to perform poorly.
====
Revised: * If the field has the value of `-1`, the HAProxy process dynamically computes a maximum value based on the available `ulimits` in the running container. This process results in a large computed value that incurs significant memory usage compared to the current default value of `50000`.