[management] remove ingress ports (#8062)

management/server/types/account_networkmapdata.go

@@ -213,8 +213,7 @@ func twinPeer(p *nbpeer.Peer) *nmdata.Peer {
 	}
 }
 
-// TwinPeer converts a real peer to its slim nmdata twin. Exported for the
-// port-forwarding integration, which builds proxy NetworkMaps holding twins.
+// TwinPeer converts a real peer to its slim nmdata twin.
 func TwinPeer(p *nbpeer.Peer) *nmdata.Peer {
 	return twinPeer(p)
 }

management/server/types/aliases.go

@@ -15,7 +15,6 @@ import (
 type FirewallRule = sharedtypes.FirewallRule
 
 type NetworkMap = sharedtypes.NetworkMap
-type ForwardingRule = sharedtypes.ForwardingRule
 
 type PolicyTrafficActionType = sharedtypes.PolicyTrafficActionType
 type PolicyRuleProtocolType = sharedtypes.PolicyRuleProtocolType

management/server/types/legacynmap/aliases.go

@@ -10,7 +10,6 @@ type (
 
 	DNSSettings       = types.DNSSettings
 	FirewallRule      = sharedtypes.FirewallRule
-	ForwardingRule    = sharedtypes.ForwardingRule
 	Group             = types.Group
 	Network           = types.Network
 	Policy            = types.Policy

management/server/types/legacynmap/converters.go

@@ -19,7 +19,6 @@ type NetworkMap struct {
 	OfflinePeers        []*ComponentPeer
 	FirewallRules       []*FirewallRule
 	RoutesFirewallRules []*RouteFirewallRule
-	ForwardingRules     []*ForwardingRule
 	AuthorizedUsers     map[string]map[string]struct{}
 	EnableSSH           bool
 	// ForceRoutingPeerDNSResolution forces the peer to run/use routing-peer DNS

management/server/types/legacynmap/equivalence_test.go

@@ -320,7 +320,6 @@ func canonicalize(nm *proto.NetworkMap) {
 	slices.SortFunc(nm.Routes, cmpRoute)
 	slices.SortFunc(nm.FirewallRules, cmpFirewallRule)
 	slices.SortFunc(nm.RoutesFirewallRules, cmpRouteFirewallRule)
-	slices.SortFunc(nm.ForwardingRules, cmpForwardingRule)
 
 	for _, r := range nm.FirewallRules {
 		slices.SortFunc(r.SourcePrefixes, bytes.Compare)
@@ -550,16 +549,6 @@ func cmpRouteFirewallRule(a, b *proto.RouteFirewallRule) int {
 	return boolCmp(a.IsDynamic, b.IsDynamic)
 }
 
-func cmpForwardingRule(a, b *proto.ForwardingRule) int {
-	if a == nil || b == nil {
-		return boolCmp(a == nil, b == nil)
-	}
-	if c := cmp.Compare(int32(a.Protocol), int32(b.Protocol)); c != 0 {
-		return c
-	}
-	return bytes.Compare(a.TranslatedAddress, b.TranslatedAddress)
-}
-
 func portInfoKey(pi *proto.PortInfo) string {
 	if pi == nil {
 		return ""
@@ -591,7 +580,6 @@ func describeDivergence(legacy, updated *proto.NetworkMap, accountID, peerID str
 		{"Routes", len(legacy.Routes), len(updated.Routes), func() string { return diffLists(legacy.Routes, updated.Routes) }},
 		{"FirewallRules", len(legacy.FirewallRules), len(updated.FirewallRules), func() string { return diffLists(legacy.FirewallRules, updated.FirewallRules) }},
 		{"RoutesFirewallRules", len(legacy.RoutesFirewallRules), len(updated.RoutesFirewallRules), func() string { return diffLists(legacy.RoutesFirewallRules, updated.RoutesFirewallRules) }},
-		{"ForwardingRules", len(legacy.ForwardingRules), len(updated.ForwardingRules), func() string { return diffLists(legacy.ForwardingRules, updated.ForwardingRules) }},
 	}
 	for _, l := range lens {
 		if l.a != l.b {

management/server/types/legacynmap/proto_legacy.go

@@ -186,14 +186,6 @@ func ToProtoNetworkMap(
 	pm.RoutesFirewallRules = routesFirewallRules
 	pm.RoutesFirewallRulesIsEmpty = len(routesFirewallRules) == 0
 
-	if nm.ForwardingRules != nil {
-		forwardingRules := make([]*proto.ForwardingRule, 0, len(nm.ForwardingRules))
-		for _, rule := range nm.ForwardingRules {
-			forwardingRules = append(forwardingRules, rule.ToProto())
-		}
-		pm.ForwardingRules = forwardingRules
-	}
-
 	if nm.AuthorizedUsers != nil {
 		hashedUsers, machineUsers := networkmap.BuildAuthorizedUsersProto(ctx, nm.AuthorizedUsers)
 		userIDClaim := auth.DefaultUserIDClaim