BUG/MINOR: service: ExternalName backend resolution bypassed by orphan EndpointSlices

When a Kubernetes service transitions from ClusterIP to ExternalName type,
orphan EndpointSlices from the previous ClusterIP state are not cleaned up
by Kubernetes (known behavior). These orphan slices populate HAProxyRuntime
for the service, causing getRuntimeBackend() to skip the ExternalName path
and proceed to port name matching instead.
Port matching then fails because the orphan EndpointSlice carries a named
port (e.g. "http") while the ExternalName service spec has no named port,
resulting in a routing error instead of the expected DNS-based server entry.
Fix by checking s.resource.DNS before consulting HAProxyRuntime: an
ExternalName service must always resolve via getExternalNameEndpoints(),
regardless of any EndpointSlices that may exist in the cluster.

Author: ivanmatmati

pkg/service/endpoints.go

@@ -158,15 +158,15 @@ func (s *Service) scaleHAProxySrvs(backend *store.RuntimeBackend) {
 }
 
 func (s *Service) getRuntimeBackend(k8s store.K8s) (backend *store.RuntimeBackend, err error) {
+	if s.resource.DNS != "" {
+		return s.getExternalNameEndpoints()
+	}
 	var ok bool
 	var backends map[string]*store.RuntimeBackend
 	if ns := k8s.Namespaces[s.resource.Namespace]; ns != nil {
 		backends, ok = ns.HAProxyRuntime[s.resource.Name]
 	}
 	if !ok {
-		if s.resource.DNS != "" {
-			return s.getExternalNameEndpoints()
-		}
 		return nil, errors.New("no available endpoints")
 	}
 	svcPort := s.path.SvcPortResolved