Tolerate 403 reply on router-reload to alleviate OCPBUGS-98255 caused by security posture change to disable 404 reply

[Scotchman0]

Addressing OCPBUGS-98255 - this PR seeks to resolve the impact condition from a restrictive response condition expectation from HAProxy when a proxy is in use for the cluster, and the customer has disabled 404 responses as a security posture update. (Change enforces a 403 instead on all calls that don't otherwise return a valid response code or 503). Because the response will now default to a 403 instead of the expected 404 the call will time out/repeatedly re-probing the port. This may lead to delay during reload execution despite successful configuration mapping.

    if [[ "$httpcode" = 503 || "$httpcode" = 404 ]]; then

Logs generated that this PR will alleviate:

2026-05-26T14:14:35.480260083Z E0526 14:14:35.479914       1 limiter.go:165] error reloading router: exit status 1
2026-05-26T14:14:35.480260083Z  - Checking http://localhost:80 using PROXY protocol ...
2026-05-26T14:14:35.480260083Z  - Exceeded max wait time (30) in health check - 57 retry attempt(s).
2026-05-26T14:15:05.010854562Z E0526 14:15:05.010807       1 limiter.go:165] error reloading router: exit status 1
2026-05-26T14:15:05.010854562Z  - Checking http://localhost:80 using PROXY protocol ...
2026-05-26T14:15:05.010854562Z  - Exceeded max wait time (30) in health check - 55 retry attempt(s).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: db24f2f0-fc46-4cf8-83cb-05f9bfeaadfe

📥 Commits

Reviewing files that changed from the base of the PR and between 4b401a8 and 28279ba.

📒 Files selected for processing (1)

• images/router/haproxy/reload-haproxy

---

📝 Walkthrough

Walkthrough

The HAProxy health check now treats HTTP 403 responses as successful. It continues to accept HTTP 503 and 404 responses.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: tolerating HTTP 403 responses during router reload health checks.
Description check	✅ Passed	The description directly explains the 403 response change, the affected health check, and the OCPBUGS-98255 issue.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only a shell health-check condition; it adds or modifies no Ginkgo tests or test titles.
Test Structure And Quality	✅ Passed	The PR changes only one shell script line and adds no Ginkgo tests, so the listed Ginkgo test-quality requirements are not applicable.
Microshift Test Compatibility	✅ Passed	The pull request changes only the HAProxy reload script and adds no Ginkgo e2e tests, so MicroShift test compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only the HAProxy shell script; it adds no Ginkgo e2e tests, so SNO compatibility checks are not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The only change adds HTTP 403 acceptance to a HAProxy reload shell health check; it adds no deployment, controller, manifest, replica, affinity, or node-scheduling constraint.
Ote Binary Stdout Contract	✅ Passed	The PR changes only the HAProxy shell reload script; searches found no OTE binary or suite setup, so the OTE stdout contract does not apply.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit changes only images/router/haproxy/reload-haproxy; it adds no Ginkgo e2e tests. Its localhost URL is in a runtime health-check script, so this test-specific check does not apply.
No-Weak-Crypto	✅ Passed	Pull request modifies only a bash script health check condition to accept HTTP 403 responses. No cryptographic functions, weak crypto algorithms, or secret comparisons are present.
Container-Privileges	✅ Passed	The PR changes only HTTP status handling. No privilege settings were added; existing hostNetwork is unchanged, and router images specify USER 1001.
No-Sensitive-Data-In-Logs	✅ Passed	The pull request modifies only an HTTP response code check in a health check function. The script logs only numeric timeout values, localhost URLs, and protocol flags. No passwords, tokens, API key...

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign gcs278 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@Scotchman0: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.