[BUG] Endpoint updates can rewrite multi-port service routes to the wrong port
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
### Current Behavior
When Kubernetes Endpoints change, `EndpointsReconciler` rebuilds upstream handles for all ingresses that reference the service using the first TCP port from each endpoint subset.
```java
CoreV1EndpointPort endpointPort = ports.stream()
.filter(coreV1EndpointPort -> "TCP".equals(coreV1EndpointPort.getProtocol()))
.findFirst()
.orElseThrow(...);
```
The service-to-ingress cache only stores namespace/service to ingress names, not the backend service port selected by each ingress. `updateSelectors(...)` then applies the same rebuilt upstream handle to all cached divide/websocket selectors for that service.
If a service exposes multiple TCP ports and an ingress selects a non-first port, or multiple ingresses select different ports on the same service, an endpoint update can rewrite selectors to the wrong upstream port.
### Expected Behavior
Endpoint reconciliation should preserve the service port selected by each ingress backend instead of using the first TCP endpoint port for every selector associated with the service.
### Impact
For multi-port services, endpoint updates can silently route divide/websocket traffic to the wrong upstream port.
### Code Location
- `shenyu-kubernetes-controller/src/main/java/org/apache/shenyu/k8s/reconciler/EndpointsReconciler.java`
- `endpointAddresses()` picks the first TCP port from the endpoint subset.
- `updateSelectors()` applies the rebuilt handle to all selectors associated with the service.
- `shenyu-kubernetes-controller/src/main/java/org/apache/shenyu/k8s/cache/ServiceIngressCache.java`
- cache key does not retain the ingress backend service port.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with EndpointsReconciler.java, reading endpointAddresses() and updateSelectors(), then inspect ServiceIngressCache.java to understand what the cache retains for each ingress. Trace how a service port selected by an ingress reaches the rebuilt upstream handle. Done means endpoint updates preserve each ingress backend's selected service port, including when multiple TCP ports or ingresses are involved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, kubernetes
- Domain
- backend, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 62/100