[backport] make BackendRef.Port Optional for InferencePool Refs (#11450)

Signed-off-by: Daneyon Hansen <[email protected]>

Author: danehans

internal/kgateway/krtcollections/policy.go

@@ -134,19 +134,49 @@ func (i *BackendIndex) getBackendFromRef(kctx krt.HandlerContext, localns string
 }
 
 func (i *BackendIndex) GetBackendFromRef(kctx krt.HandlerContext, src ir.ObjectSource, ref gwv1.BackendObjectReference) (*ir.BackendObjectIR, error) {
-	fromns := src.Namespace
-
-	fromgk := schema.GroupKind{
-		Group: src.Group,
-		Kind:  src.Kind,
+	// Check if a ReferenceGrant allows the cross-namespace ref
+	fromNs := src.Namespace
+	fromGK := schema.GroupKind{Group: src.Group, Kind: src.Kind}
+	to := toFromBackendRef(fromNs, ref)
+	if !i.refgrants.ReferenceAllowed(kctx, fromGK, fromNs, to) {
+		return nil, ErrMissingReferenceGrant
 	}
-	to := toFromBackendRef(fromns, ref)
 
-	if i.refgrants.ReferenceAllowed(kctx, fromgk, fromns, to) {
+	// Fetch the InferencePool IR by name/namespace only, ignoring any user-supplied port altogether.
+	// TODO [danehans]: Add a warning message to HTTPRoute status the required change is made per
+	// discussion in github.com/kubernetes-sigs/gateway-api-inference-extension/discussions/918
+	kind := strOr(ref.Kind, string(wellknown.ServiceKind))
+	if kind == wellknown.InferencePoolKind {
+		// Find the pool's IR in availableBackends
+		poolGK := to.GetGroupKind()
+		nns := types.NamespacedName{Namespace: to.Namespace, Name: to.Name}
+		var poolIR *ir.BackendObjectIR
+
+		if col, exists := i.availableBackends[poolGK]; exists {
+			matches := krt.Fetch(kctx, col, krt.FilterGeneric(func(obj any) bool {
+				b, ok := obj.(ir.BackendObjectIR)
+				return ok &&
+					b.ObjectSource.Name == nns.Name &&
+					b.ObjectSource.Namespace == nns.Namespace
+			}))
+			if len(matches) > 0 {
+				poolIR = &matches[0]
+			}
+		}
+
+		if poolIR == nil {
+			return nil, &NotFoundError{NotFoundObj: to}
+		}
+
+		// Overwrite ref.Port so lookup uses the correct port
+		correct := gwv1.PortNumber(poolIR.Port)
+		ref.Port = &correct
+
+		// Delegate to the normal port-aware lookup
 		return i.getBackendFromRef(kctx, src.Namespace, ref)
-	} else {
-		return nil, ErrMissingReferenceGrant
 	}
+
+	return i.getBackendFromRef(kctx, src.Namespace, ref)
 }
 
 // MARK: GatewayIndex

internal/kgateway/krtcollections/policy_test.go

@@ -18,6 +18,9 @@ import (
 	gwv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 	gwv1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
 	extensionsplug "github.com/kgateway-dev/kgateway/v2/internal/kgateway/extensions2/plugin"
 	"github.com/kgateway-dev/kgateway/v2/internal/kgateway/ir"
 	"github.com/kgateway-dev/kgateway/v2/internal/kgateway/utils/krtutil"
@@ -326,6 +329,92 @@ func TestFailInferencePoolWithRefGrantWrongKind(t *testing.T) {
 	}
 }
 
+func TestInferencePoolPortOverride(t *testing.T) {
+	cases := []struct {
+		name         string
+		poolNs       string
+		refGrant     *gwv1beta1.ReferenceGrant
+		providedPort gwv1.PortNumber
+		wantPort     int32
+		expectError  bool
+	}{
+		{
+			name:         "same‐ns override",
+			poolNs:       "",
+			refGrant:     nil,
+			providedPort: 9001,
+			wantPort:     8080,
+		},
+		{
+			name:         "cross‐ns override with RefGrant",
+			poolNs:       "foo-ns",
+			refGrant:     refGrantWithNs("foo-ns"),
+			providedPort: 9999,
+			wantPort:     8080,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			inputs := []any{
+				infPool(tc.poolNs),
+			}
+			if tc.refGrant != nil {
+				inputs = append(inputs, tc.refGrant)
+			}
+			// Build an HTTPRoute whose HTTPBackendRef.Port is “wrong”
+			ns := ""
+			if tc.poolNs != "" {
+				ns = tc.poolNs
+			}
+			route := &gwv1.HTTPRoute{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "httproute",
+					Namespace: "default",
+				},
+				Spec: gwv1.HTTPRouteSpec{
+					Rules: []gwv1.HTTPRouteRule{{
+						BackendRefs: []gwv1.HTTPBackendRef{{
+							BackendRef: gwv1.BackendRef{
+								BackendObjectReference: gwv1.BackendObjectReference{
+									Group:     ptr.To(gwv1.Group(infextv1a2.GroupVersion.Group)),
+									Kind:      ptr.To(gwv1.Kind(wellknown.InferencePoolKind)),
+									Name:      gwv1.ObjectName("foo"),
+									Namespace: ptrToNamespace(ns),
+									Port:      &tc.providedPort,
+								},
+							},
+						}},
+					}},
+				},
+			}
+			inputs = append(inputs, route)
+
+			ir := translateRoute(t, inputs)
+			require.NotNil(t, ir)
+			b := getBackends(ir)[0]
+			if tc.expectError {
+				require.Error(t, b.Err)
+				return
+			}
+			require.NoError(t, b.Err)
+
+			// Assert the BackendObject IR port number
+			assert.Equal(t, tc.wantPort, b.BackendObject.Port,
+				"expected the pool's TargetPortNumber to override the provided port")
+		})
+	}
+}
+
+// Helper to build a Namespace pointer, or nil if empty
+func ptrToNamespace(ns string) *gwv1.Namespace {
+	if ns == "" {
+		return nil
+	}
+	n := gwv1.Namespace(ns)
+	return &n
+}
+
 func svc(ns string) *corev1.Service {
 	if ns == "" {
 		ns = "default"
@@ -404,6 +493,16 @@ func refGrant() *gwv1beta1.ReferenceGrant {
 	}
 }
 
+// Helper that calls refGrant() but with its Namespace set to the given namespace
+func refGrantWithNs(ns string) *gwv1beta1.ReferenceGrant {
+	rg := refGrant()
+	rg.Namespace = ns
+	for i := range rg.Spec.From {
+		rg.Spec.From[i].Namespace = gwv1.Namespace("default")
+	}
+	return rg
+}
+
 func k8sSvcUpstreams(services krt.Collection[*corev1.Service]) krt.Collection[ir.BackendObjectIR] {
 	return krt.NewManyCollection(services, func(kctx krt.HandlerContext, svc *corev1.Service) []ir.BackendObjectIR {
 		uss := []ir.BackendObjectIR{}