fix(gateway): watch NetworkGateway from NetworkRuleReconciler - #371
Merged
Conversation
A NetworkRule created before any gateway node registers parks at
Accepted=False with reason NoGatewayNodes. Nothing re-examined it
afterwards: SetupWithManager was For(&NetworkRule{}) only, so no
NetworkGateway event reached this reconciler and no requeue was
scheduled. Since NetworkGatewayReconciler skips rules that are not
Accepted, the rule stayed unprogrammed until the informer's periodic
resync (10 hours by default).
Watch NetworkGateway here and map a gateway change to every
NetworkRule in its namespace, the mirror image of the NetworkRule
watch NetworkGatewayReconciler already has. The rule is re-examined
as soon as a gateway node registers.
Also rewrite the zero-nodes comment, which claimed both that the next
NetworkGateway event re-triggers the rule and that the reconciler
relies on the periodic resync.
Related to #367
privateip
approved these changes
Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A rule created before any gateway node has registered is marked not accepted, correctly, and then forgotten. Nothing re-examined it when the nodes arrived, because the rule reconciler watched only rules. It waited for the informer resync, ten hours by default, and stayed out of every gateway's rule table for that whole window.
On a cluster coming up in the usual order, that reads as broken: rules exist, nodes exist, no traffic flows, nothing explains the wait.
The rule reconciler now watches gateways too, and maps a gateway change to the rules in its namespace. That is the mirror image of the watch the gateway reconciler already has in the other direction, and the same deliberate broadcast, since a rule names no gateway and every rule's acceptance depends on the namespace's whole node pool.
The comment on that path used to say a gateway event re-triggers the rule and then, in the same sentence, that it relies on the resync. It now describes what the code does.
Not in scope
The second half of #367, where withdrawal misses advertisements belonging to nodes that have since left the namespace, is untouched. That needs owner references or a label selector rather than rebuilding names from current membership, which is a design change worth its own PR. The issue stays open for it.
Test plan
task linttask buildtask test:unit, including a new case: a rule parked with no gateway nodes is enqueued when a gateway appears, and then accepted with a primary nodetask test:e2eCI is the gate; this machine cannot build the module.
Note this reconciler is not registered by any binary on main yet. That arrives with #352, and the RBAC that lets it watch gateways arrives with #354, so there is no runtime behavior change until both land.
Related to #367