As a platform operator, I want to verify that worker nodes use the overridden HAProxy image when shared ingress is enabled, so that the configuration flows through correctly.

Context

Verify that the worker node HAProxy configuration correctly uses the image override when shared ingress is enabled. The worker node HAProxy currently gets its image from the release payload, but when shared ingress is enabled, it's overridden to use sharedingress.Image (haproxy.go:259). After Story 1 updates sharedingress.Image to use the environment variable IMAGE_SHARED_INGRESS_HAPROXY, this story verifies the override flows through correctly to worker nodes. Additionally, this story introduces a NodePool-level annotation to allow per-NodePool HAProxy image customization.

Tasks

• Introduce NodePool annotation hypershift.openshift.io/haproxy-image for per-NodePool HAProxy image override

• Verify hypershift-operator/controllers/nodepool/apiserver-haproxy/haproxy.go:257-260 correctly uses the updated image resolution logic

• Confirm ignition configuration generation picks up the overridden image based on priority

• Test that worker node static pod manifests reflect the correct image override

• Document the image source priority: NodePool annotation > env var override > hardcoded sharedingress.Image (shared ingress enabled) > release payload (default)

Acceptance Criteria

• Worker node HAProxy static pods use the NodePool annotation override when hypershift.openshift.io/haproxy-image is present (highest priority)

• If NodePool annotation is not set, worker node HAProxy static pods use the env var override when shared ingress is enabled

• When neither annotation nor env var is set but shared ingress is enabled, uses the hardcoded default (current behavior)

• When shared ingress is disabled, uses the release payload image (unchanged behavior)

• Image override applies correctly per NodePool when annotation is used, or globally across all HostedClusters when env var is active and shared ingress is enabled