Repository navigation
NetworkRule backend port is accepted but ignored #737
Description
Summary
Each NetworkRule backend has its own port, but the gateway never uses it. The datapath rewrites nothing, so a packet reaches the backend on the VIP's port whatever the backend's port says. A rule whose backend port differs from the rule's port is accepted and looks healthy, but the backend never sees traffic on the port it was configured with.
Direct Server Return can't remap ports, and port remapping is a non-goal for the network load balancer (#698).
Acceptance criteria
- Admission refuses a
NetworkRulewhose backend port differs from the rule's port, with a message that says DSR can't remap ports - The API docs for the backend port say it must match the rule's port, or the field is removed
- A test covers the refusal
Phase 1 of #698.
Activity
privateip commentedon Oct 9, 2026
Port remapping is supported, so this is fixed rather than something to refuse.
Since #809, galactic-router builds a
ServiceVIPBindingfor each selected backend using the rule'sspec.backendPort. On the backend's node,usid_ingressrewrites the destination from VIP:port to backend:backendPort throughvip_xlat_table, andusid_egressreverses the rewrite on replies. The rewrite happens on the backend's node, not at the edge, so Direct Server Return still holds.network#29 and network#31 also replaced per-backend ports with a single
spec.backendPortper rule, which is the field this applies to.