feat(ingress): add --max-concurrent-reconciles flag

The ingress controller ran reconciles with the controller-runtime default
concurrency of 1. Expose a --max-concurrent-reconciles flag (default 1, so
behavior is unchanged unless set) to allow parallel steady-state reconciles.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: danielwatrous-zendesk

cmd/ingress_opts.go

@@ -24,6 +24,7 @@ type ingressControllerOpts struct {
 	SyncAPIURL              string
 	SyncAPINamespaceID      string
 	SyncAPIToken            string
+	MaxConcurrentReconciles int `validate:"min=1"`
 }
 
 const (
@@ -39,6 +40,7 @@ const (
 	syncAPIURL                 = "sync-api-url"
 	syncAPINamespaceID         = "sync-api-namespace-id"
 	syncAPIToken               = "sync-api-token" //nolint:gosec
+	maxConcurrentReconciles    = "max-concurrent-reconciles"
 )
 
 func (s *ingressControllerOpts) setupFlags(flags *pflag.FlagSet) {
@@ -53,6 +55,8 @@ func (s *ingressControllerOpts) setupFlags(flags *pflag.FlagSet) {
 	flags.StringVar(&s.SyncAPIURL, syncAPIURL, "", "unified API sync URL")
 	flags.StringVar(&s.SyncAPINamespaceID, syncAPINamespaceID, "", "unified API sync namespace ID")
 	flags.StringVar(&s.SyncAPIToken, syncAPIToken, "", "unified API sync token")
+	flags.IntVar(&s.MaxConcurrentReconciles, maxConcurrentReconciles, 1,
+		"maximum number of concurrent ingress reconciles")
 }
 
 func (s *ingressControllerOpts) Validate() error {
@@ -76,6 +80,7 @@ func (s *ingressControllerOpts) getIngressControllerOptions() ([]ingress.Option,
 		ingress.WithNamespaces(s.Namespaces),
 		ingress.WithAnnotationPrefix(s.AnnotationPrefix),
 		ingress.WithControllerName(s.ClassName),
+		ingress.WithMaxConcurrentReconciles(s.MaxConcurrentReconciles),
 	}
 	if name, err := s.getGlobalSettings(); err != nil {
 		return nil, err

controllers/ingress/concurrency_test.go

@@ -0,0 +1,21 @@
+package ingress
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestWithMaxConcurrentReconciles(t *testing.T) {
+	ic := &ingressController{}
+
+	// default zero value leaves controller-runtime default in place
+	assert.Equal(t, 0, ic.maxConcurrentReconciles)
+
+	WithMaxConcurrentReconciles(4)(ic)
+	assert.Equal(t, 4, ic.maxConcurrentReconciles)
+
+	// a value < 1 is still recorded; SetupWithManager decides whether to apply it
+	WithMaxConcurrentReconciles(0)(ic)
+	assert.Equal(t, 0, ic.maxConcurrentReconciles)
+}

controllers/ingress/controller.go

@@ -10,6 +10,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
@@ -55,6 +56,10 @@ type ingressController struct {
 	// globalSettings defines which global settings object to watch
 	globalSettings *types.NamespacedName
 
+	// maxConcurrentReconciles is the number of concurrent ingress reconciles.
+	// Defaults to 1 (controller-runtime default) when unset.
+	maxConcurrentReconciles int
+
 	// object Kinds are frequently used, do not change and are cached
 	endpointsKind    string
 	ingressKind      string
@@ -119,6 +124,14 @@ func WithWatchSettings(name types.NamespacedName) Option {
 	}
 }
 
+// WithMaxConcurrentReconciles sets the maximum number of concurrent ingress
+// reconciles. A value < 1 leaves the controller-runtime default (1) in place.
+func WithMaxConcurrentReconciles(n int) Option {
+	return func(ic *ingressController) {
+		ic.maxConcurrentReconciles = n
+	}
+}
+
 // SetupWithManager sets up the controller with the Manager
 func (r *ingressController) SetupWithManager(mgr ctrl.Manager) error {
 	r.Client = mgr.GetClient()
@@ -132,6 +145,11 @@ func (r *ingressController) SetupWithManager(mgr ctrl.Manager) error {
 	r.endpointsKind = generic.GVKForType[*corev1.Endpoints](r.Scheme).Kind
 	r.ingressClassKind = generic.GVKForType[*networkingv1.IngressClass](r.Scheme).Kind
 
+	opts := controller.Options{}
+	if r.maxConcurrentReconciles > 0 {
+		opts.MaxConcurrentReconciles = r.maxConcurrentReconciles
+	}
+
 	err := ctrl.NewControllerManagedBy(mgr).
 		Named(controllerName).
 		For(&networkingv1.Ingress{}).
@@ -146,6 +164,7 @@ func (r *ingressController) SetupWithManager(mgr ctrl.Manager) error {
 		Watches(&corev1.Service{}, handler.EnqueueRequestsFromMapFunc(r.getDependantIngressFn(r.serviceKind))).
 		Watches(&corev1.Endpoints{}, handler.EnqueueRequestsFromMapFunc(r.getDependantIngressFn(r.endpointsKind))).
 		WithEventFilter(predicate.ResourceVersionChangedPredicate{}).
+		WithOptions(opts).
 		Complete(r)
 	if err != nil {
 		return err