add worker connections field to nginxproxy

Sarthak Agrawal · sarthyparty · commit 6e218525884f · 2025-07-09T13:32:24.000-07:00
diff --git a/apis/v1alpha2/nginxproxy_types.go b/apis/v1alpha2/nginxproxy_types.go
@@ -76,6 +76,13 @@ type NginxProxySpec struct {
 	//
 	// +optional
 	Kubernetes *KubernetesSpec `json:"kubernetes,omitempty"`
+	// WorkerConnections specifies the maximum number of simultaneous connections that can be opened by a worker process.
+	// Default is 1024.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=65535
+	WorkerConnections *int32 `json:"workerConnections,omitempty"`
 }
 
 // Telemetry specifies the OpenTelemetry configuration.
diff --git a/apis/v1alpha2/zz_generated.deepcopy.go b/apis/v1alpha2/zz_generated.deepcopy.go
diff --git a/config/crd/bases/gateway.nginx.org_nginxproxies.yaml b/config/crd/bases/gateway.nginx.org_nginxproxies.yaml
@@ -7187,6 +7187,14 @@ spec:
                     - key
                     x-kubernetes-list-type: map
                 type: object
+              workerConnections:
+                description: |-
+                  WorkerConnections specifies the maximum number of simultaneous connections that can be opened by a worker process.
+                  Default is 1024.
+                format: int32
+                maximum: 65535
+                minimum: 1
+                type: integer
             type: object
         required:
         - spec
diff --git a/deploy/crds.yaml b/deploy/crds.yaml
@@ -7772,6 +7772,14 @@ spec:
                     - key
                     x-kubernetes-list-type: map
                 type: object
+              workerConnections:
+                description: |-
+                  WorkerConnections specifies the maximum number of simultaneous connections that can be opened by a worker process.
+                  Default is 1024.
+                format: int32
+                maximum: 65535
+                minimum: 1
+                type: integer
             type: object
         required:
         - spec
diff --git a/internal/controller/nginx/conf/nginx-plus.conf b/internal/controller/nginx/conf/nginx-plus.conf
@@ -5,10 +5,6 @@ worker_processes auto;
 
 pid /var/run/nginx/nginx.pid;
 
-events {
-  worker_connections 1024;
-}
-
 http {
   include /etc/nginx/conf.d/*.conf;
   include /etc/nginx/mime.types;
diff --git a/internal/controller/nginx/conf/nginx.conf b/internal/controller/nginx/conf/nginx.conf
@@ -5,10 +5,6 @@ worker_processes auto;
 
 pid /var/run/nginx/nginx.pid;
 
-events {
-  worker_connections 1024;
-}
-
 http {
   include /etc/nginx/conf.d/*.conf;
   include /etc/nginx/mime.types;
diff --git a/internal/controller/nginx/config/main_config_template.go b/internal/controller/nginx/config/main_config_template.go
@@ -7,6 +7,10 @@ load_module modules/ngx_otel_module.so;
 
 error_log stderr {{ .Conf.Logging.ErrorLevel }};
 
+events {
+  worker_connections {{ .Conf.WorkerConnections }};
+}
+
 {{ range $i := .Includes -}}
 include {{ $i.Name }};
 {{ end -}}
diff --git a/internal/controller/nginx/config/main_config_test.go b/internal/controller/nginx/config/main_config_test.go
@@ -147,3 +147,55 @@ func TestGenerateMgmtFiles_Panic(t *testing.T) {
 		gen.generateMgmtFiles(dataplane.Configuration{})
 	}).To(Panic())
 }
+
+func TestExecuteMainConfig_WorkerConnections(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name                 string
+		expWorkerConnections string
+		conf                 dataplane.Configuration
+	}{
+		{
+			name: "default worker connections",
+			conf: dataplane.Configuration{
+				WorkerConnections: 1024,
+			},
+			expWorkerConnections: "worker_connections 1024;",
+		},
+		{
+			name: "custom worker connections",
+			conf: dataplane.Configuration{
+				WorkerConnections: 2048,
+			},
+			expWorkerConnections: "worker_connections 2048;",
+		},
+		{
+			name: "minimum worker connections",
+			conf: dataplane.Configuration{
+				WorkerConnections: 1,
+			},
+			expWorkerConnections: "worker_connections 1;",
+		},
+		{
+			name: "maximum worker connections",
+			conf: dataplane.Configuration{
+				WorkerConnections: 65535,
+			},
+			expWorkerConnections: "worker_connections 65535;",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			g := NewWithT(t)
+
+			res := executeMainConfig(test.conf)
+			g.Expect(res).To(HaveLen(1))
+			g.Expect(res[0].dest).To(Equal(mainIncludesConfigFile))
+			g.Expect(string(res[0].data)).To(ContainSubstring(test.expWorkerConnections))
+			g.Expect(string(res[0].data)).To(ContainSubstring("events {"))
+		})
+	}
+}
diff --git a/internal/controller/provisioner/templates.go b/internal/controller/provisioner/templates.go
@@ -9,7 +9,11 @@ var (
 )
 
 const mainTemplateText = `
-error_log stderr {{ .ErrorLevel }};`
+error_log stderr {{ .ErrorLevel }};
+
+events {
+  worker_connections 1024;
+}`
 
 const mgmtTemplateText = `mgmt {
     {{- if .UsageEndpoint }}
diff --git a/internal/controller/state/dataplane/configuration.go b/internal/controller/state/dataplane/configuration.go
@@ -76,12 +76,13 @@ func BuildConfiguration(
 			buildRefCertificateBundles(g.ReferencedSecrets, g.ReferencedCaCertConfigMaps),
 			backendGroups,
 		),
-		Telemetry:        buildTelemetry(g, gateway),
-		BaseHTTPConfig:   baseHTTPConfig,
-		Logging:          buildLogging(gateway),
-		NginxPlus:        nginxPlus,
-		MainSnippets:     buildSnippetsForContext(gatewaySnippetsFilters, ngfAPIv1alpha1.NginxContextMain),
-		AuxiliarySecrets: buildAuxiliarySecrets(g.PlusSecrets),
+		Telemetry:         buildTelemetry(g, gateway),
+		BaseHTTPConfig:    baseHTTPConfig,
+		Logging:           buildLogging(gateway),
+		NginxPlus:         nginxPlus,
+		MainSnippets:      buildSnippetsForContext(gatewaySnippetsFilters, ngfAPIv1alpha1.NginxContextMain),
+		AuxiliarySecrets:  buildAuxiliarySecrets(g.PlusSecrets),
+		WorkerConnections: buildWorkerConnections(gateway),
 	}
 
 	return config
@@ -1105,6 +1106,21 @@ func buildLogging(gateway *graph.Gateway) Logging {
 	return logSettings
 }
 
+func buildWorkerConnections(gateway *graph.Gateway) int32 {
+	defaultWorkerConnections := int32(1024)
+
+	if gateway == nil || gateway.EffectiveNginxProxy == nil {
+		return defaultWorkerConnections
+	}
+
+	ngfProxy := gateway.EffectiveNginxProxy
+	if ngfProxy.WorkerConnections != nil {
+		return *ngfProxy.WorkerConnections
+	}
+
+	return defaultWorkerConnections
+}
+
 func buildAuxiliarySecrets(
 	secrets map[types.NamespacedName][]graph.PlusSecretFile,
 ) map[graph.SecretFileType][]byte {
@@ -1143,8 +1159,9 @@ func buildNginxPlus(gateway *graph.Gateway) NginxPlus {
 
 func GetDefaultConfiguration(g *graph.Graph, gateway *graph.Gateway) Configuration {
 	return Configuration{
-		Logging:          buildLogging(gateway),
-		NginxPlus:        NginxPlus{},
-		AuxiliarySecrets: buildAuxiliarySecrets(g.PlusSecrets),
+		Logging:           buildLogging(gateway),
+		NginxPlus:         NginxPlus{},
+		AuxiliarySecrets:  buildAuxiliarySecrets(g.PlusSecrets),
+		WorkerConnections: buildWorkerConnections(gateway),
 	}
 }
diff --git a/internal/controller/state/dataplane/configuration_test.go b/internal/controller/state/dataplane/configuration_test.go
@@ -4895,3 +4895,62 @@ func TestBuildNginxPlus(t *testing.T) {
 		})
 	}
 }
+
+func TestBuildWorkerConnections(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		gw                   *graph.Gateway
+		msg                  string
+		expWorkerConnections int32
+	}{
+		{
+			msg:                  "NginxProxy is nil",
+			gw:                   &graph.Gateway{},
+			expWorkerConnections: 1024,
+		},
+		{
+			msg: "NginxProxy doesn't specify worker connections",
+			gw: &graph.Gateway{
+				EffectiveNginxProxy: &graph.EffectiveNginxProxy{},
+			},
+			expWorkerConnections: 1024,
+		},
+		{
+			msg: "NginxProxy specifies worker connections",
+			gw: &graph.Gateway{
+				EffectiveNginxProxy: &graph.EffectiveNginxProxy{
+					WorkerConnections: helpers.GetPointer(int32(2048)),
+				},
+			},
+			expWorkerConnections: 2048,
+		},
+		{
+			msg: "NginxProxy specifies minimum worker connections",
+			gw: &graph.Gateway{
+				EffectiveNginxProxy: &graph.EffectiveNginxProxy{
+					WorkerConnections: helpers.GetPointer(int32(1)),
+				},
+			},
+			expWorkerConnections: 1,
+		},
+		{
+			msg: "NginxProxy specifies maximum worker connections",
+			gw: &graph.Gateway{
+				EffectiveNginxProxy: &graph.EffectiveNginxProxy{
+					WorkerConnections: helpers.GetPointer(int32(65535)),
+				},
+			},
+			expWorkerConnections: 65535,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.msg, func(t *testing.T) {
+			t.Parallel()
+			g := NewWithT(t)
+
+			g.Expect(buildWorkerConnections(tc.gw)).To(Equal(tc.expWorkerConnections))
+		})
+	}
+}
diff --git a/internal/controller/state/dataplane/types.go b/internal/controller/state/dataplane/types.go
@@ -54,6 +54,8 @@ type Configuration struct {
 	NginxPlus NginxPlus
 	// BaseHTTPConfig holds the configuration options at the http context.
 	BaseHTTPConfig BaseHTTPConfig
+	// WorkerConnections specifies the max number of simultaneous connections that can be opened by a worker process.
+	WorkerConnections int32
 }
 
 // SSLKeyPairID is a unique identifier for a SSLKeyPair.
