NetworkRule backends wait on a node field galactic leaves empty

Summary

Since #809, a NetworkRule uses a selected VPCAttachment as a backend only once the attachment records its node, which galactic never writes and the datum-cloud/cloud controller failed to write.

Galactic now names each BGPAdvertisement with hex-encoded IDs and a node suffix, while the controller still parsed <vpc>-<attachment> in base62, so it matched no attachment and left the node empty. Every rule then failed to load with no node, so the VIP was never advertised and no ServiceVIPBinding was generated.

datum-cloud/cloud#31 fixed the parsing, and #822 documents the dependency.

Reproduce

Run galactic at or after feat: Pick load balancer backends by label and bind them automatically #809 with a datum-cloud/cloud controller older than fix(controller): discover node-qualified attachment advertisements cloud#31.
Create an instance whose VPCAttachment is ready, with its VPC and an IPv6 interface address in status.
Apply a NetworkRule whose VPC and backend selector pick that attachment.
Every gateway reports Programmed=False with reason InvalidRule and no selected attachment is a backend yet: <namespace>/<attachment>: no node.

Writing the node into the attachment's status by hand makes the rule program, the binding generate, and the VIP answer.

Acceptance criteria

A NetworkRule that selects a ready attachment programs on a cluster running every component galactic documents as required
An operator can tell from the docs or the rule's status which component must record an attachment's node

Related to #799

Code references, pinned to galactic 1f6410b.

The backend selection skips any attachment with an empty Status.Node:

galactic/internal/controller/rulebackends.go

Lines 119 to 122 in 1f6410b

    
           if attachment.Status.Node == "" { 
        
           	pending = append(pending, key.String()+": no node") 
        
           	continue 
        
           }

The gateway configuration docs say a generated binding's targetRef.name comes from status.node, without naming what writes it:

galactic/docs/gateway/configuration.md

Lines 565 to 566 in 1f6410b

    
           - `targetRef.name` is the **backend's own node**, from its attachment's 
        
             `status.node`, not a gateway node.

The writer lives in datum-cloud/cloud, which sets attachment.Status.Node while reconciling BGPAdvertisements: https://github.com/datum-cloud/cloud/blob/a9f05f0284f347de924af88464b69ee9093d5c11/internal/controller/bgpadvertisement_controller.go#L82

ServiceRoute reads the same field when it picks a VRF instance, so private service routes probably hit the same gap:

galactic/internal/controller/serviceroute_controller.go

Lines 491 to 502 in 1f6410b

    
           identity := attachment.Status.VPC + "|" + attachment.Status.Node 
        
           if sid, ok := cache[identity]; ok { 
        
           	return append(net.IP(nil), sid...), nil 
        
           } 
        
           namespace := r.BGPNamespace 
        
           if namespace == "" { 
        
           	namespace = config.DefaultNamespace 
        
           } 
        
           vrf := &networkv1alpha1.BGPVRFInstance{} 
        
           vrfKey := types.NamespacedName{ 
        
           	Namespace: namespace, 
        
           	Name:      crdnames.BGPVRFInstanceName(attachment.Status.VPC, attachment.Status.Node),

docs(gateway): Name datum-cloud/cloud as the writer of attachment node

Correction: the datum-cloud/cloud controller was installed, but it parsed advertisement names in the format galactic used before 5a846f8 and a7dc165, so it matched no attachment; datum-cloud/cloud#31 fixed that, and with it deployed a NetworkRule's backends bind with no manual status patch.

Navigation Menu

Repository navigation

NetworkRule backends wait on a node field galactic leaves empty #821

Summary

Reproduce

Acceptance criteria

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

	if attachment.Status.Node == "" {
	pending = append(pending, key.String()+": no node")
	continue
	}

	- `targetRef.name` is the backend's own node, from its attachment's
	`status.node`, not a gateway node.

	identity := attachment.Status.VPC + "\|" + attachment.Status.Node
	if sid, ok := cache[identity]; ok {
	return append(net.IP(nil), sid...), nil
	}
	namespace := r.BGPNamespace
	if namespace == "" {
	namespace = config.DefaultNamespace
	}
	vrf := &networkv1alpha1.BGPVRFInstance{}
	vrfKey := types.NamespacedName{
	Namespace: namespace,
	Name: crdnames.BGPVRFInstanceName(attachment.Status.VPC, attachment.Status.Node),

NetworkRule backends wait on a node field galactic leaves empty #821

Description

Summary

Reproduce

Acceptance criteria

Activity

privateip commented on Oct 9, 2026

privateip commented on Oct 9, 2026

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions