In pkg/ignition/network.go, adjustVrfs unconditionally sets every VRF route's
Table to the VRF's own table. This is intentional — the VRF table always takes
precedence, matching systemd-networkd/netplan v2 behaviour. A user setting a
divergent explicit route.Table on a VRF route is a config error on their part.
Currently we do not validate this: a VRF route with a Table that disagrees with
the VRF's Table passes the webhook and bootstrap without complaint, and silently
gets its table overwritten at render time.
The follow-up is to add webhook validation rejecting VRF routes whose Table is
set to a value other than the VRF's table (or nil), mirroring the existing
constraint already enforced for RoutingPolicy entries. The behaviour — that
the VRF table unconditionally wins — also needs to be documented clearly in the
adjustVrfs comment and in user-facing documentation.
Issue description written by Claude Sonnet 4.6.
In
pkg/ignition/network.go,adjustVrfsunconditionally sets every VRF route'sTableto the VRF's own table. This is intentional — the VRF table always takesprecedence, matching systemd-networkd/netplan v2 behaviour. A user setting a
divergent explicit
route.Tableon a VRF route is a config error on their part.Currently we do not validate this: a VRF route with a
Tablethat disagrees withthe VRF's
Tablepasses the webhook and bootstrap without complaint, and silentlygets its table overwritten at render time.
The follow-up is to add webhook validation rejecting VRF routes whose
Tableisset to a value other than the VRF's table (or nil), mirroring the existing
constraint already enforced for
RoutingPolicyentries. The behaviour — thatthe VRF table unconditionally wins — also needs to be documented clearly in the
adjustVrfscomment and in user-facing documentation.Issue description written by Claude Sonnet 4.6.