Repository navigation
Load balancer bindings get stuck deleting after their VPC is gone #750
Description
Summary
Deleting a load balancer backend binding after its VPC has left the node never finishes, because the router cannot unbind it without the VPC.
The VIP translation entries it programmed probably stay on the node, where a reused VPC identifier could match them. This blocks putting the gateway into service.
Acceptance criteria
- Deleting a binding whose VPC is already gone from the node completes without manual finalizer removal
- Every VIP translation entry the binding programmed is removed from the node, whether or not its VPC still exists
- An operator can find and remove the entries left on the staging node by the manual cleanup on 2026-10-06
Activity
fix: Check row owners before removing by VRF
fix: Give each VIP binding its own translation rows
privateip commentedon Oct 7, 2026
Seen on a staging compute node. The binding for a hand-applied test VIP sat in deleting from 2026-09-29 until 2026-10-06, and the router failed every retry because the node no longer had a local
BGPVRFInstancefor the binding's VPC.Its finalizer was cleared by hand on 2026-10-06, along with the matching NetworkRule's, whose teardown had nothing to withdraw. The node's VIP translation map was checked on 2026-10-07 and held no leftover rows.