Size the OpenShift ingress router: routes and connections per router pod, TLS handshake rate and connection-limit utilisation.
Router load is about concurrency, not throughput: Little's law turns a request rate and a connection lifetime into the number of sockets HAProxy holds open, and that is what the maxconn limit governs. TLS is a second, independent constraint because only non-resumed handshakes cost an asymmetric crypto operation. Every route in the cluster shares the same router pods, so one team's traffic growth exhausts everyone's ingress — and above roughly a thousand routes the HAProxy configuration reload itself becomes the limiting factor.
OpenShift Route Capacity
concurrent connections = routes × requests per second × connection lifetime; per pod that is divided by the replica count and compared with ROUTER_MAX_CONNECTIONS.
concurrent connections = routes × requests per second × connection lifetime; per pod that is divided by the replica count and compared with ROUTER_MAX_CONNECTIONS. Router load is about concurrency, not throughput: Little's law turns a request rate and a connection lifetime into the number of sockets HAProxy holds open, and that is what the maxconn limit governs. TLS is a second, independent constraint because only non-resumed handshakes cost an asymmetric crypto operation.
Every route in the cluster shares the same router pods, so one team's traffic growth exhausts everyone's ingress — and above roughly a thousand routes the HAProxy configuration reload itself becomes the limiting factor.
This calculator takes 7 inputs: Routes exposed, Router pods (replicas), Requests per second per route, Average connection lifetime, ROUTER_MAX_CONNECTIONS per pod, Routes terminating TLS at the router, TLS sessions resumed. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Each route becomes HAProxy backend configuration, and a change to any route triggers a reload of the whole configuration. At high route counts those reloads get slow and overlap, which is why the router supports dynamic configuration for backend changes rather than a full reload.