envoyproxy / envoyproxy/gateway

GatewayClass finalizer blocks deletion when Gateway controller is removed

Open
#7,287 2 comments 0 reactions 0 assignees View on GitHub
stale triage
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

*Description*:
When using GitOps (ArgoCD) to manage Envoy Gateway resources, there's a problematic scenario during deletion:
1. GatewayClass has a `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer
2. When deleting the entire application stack via GitOps, the Gateway controller gets deleted first
3. The finalizer remains on GatewayClass but there's no controller to remove it
4. GatewayClass becomes stuck in termination state indefinitely

**Current behavior:**
- GatewayClass cannot be deleted after Gateway controller is removed
- Manual intervention required: `kubectl patch` to remove finalizers
- This breaks GitOps automation and requires manual cleanup

**Expected behavior:**
- GatewayClass should be deletable even when Gateway controller is unavailable
- Finalizer should either have a fallback mechanism or be optional

```yaml
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
name: proxy-config
namespace: networking-system
spec:
logging:
level:
default: debug
provider:
type: Kubernetes
kubernetes:
envoyDeployment:
replicas: 1
envoyService:
externalTrafficPolicy: Cluster
type: LoadBalancer
backendTLS:
minVersion: "1.3"
maxVersion: "1.3"
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
name: envoy-gateway
spec:
controllerName: gateway.envoyproxy.io/gatewayclass-controller
parametersRef:
group: gateway.envoyproxy.io
kind: EnvoyProxy
name: proxy-config
namespace: networking-system

```
```yaml
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
name: networking-system-appset
namespace: argocd
labels:
argocd.argoproj.io/instance: networking-system
spec:
generators:
- list:
elements:
- name: metallb
path: progressive-sync/networking-system/metallb
- name: envoy-gateway-operator
path: progressive-sync/networking-system/envoy-gateway/operator
- name: gateway-classes
path: progressive-sync/networking-system/envoy-gateway/gateway-classes
- name: gateways
path: progressive-sync/networking-system/envoy-gateway/gateways
strategy:
type: RollingSync
rollingSync:
steps:
- matchExpressions:
- key: app.kubernetes.io/name
operator: In
values:
- metallb
- matchExpressions:
- key: app.kubernetes.io/name
operator: In
values:
- envoy-gateway-operator
- matchExpressions:
- key: app.kubernetes.io/name
operator: In
values:
- gateway-classes
- matchExpressions:
- key: app.kubernetes.io/name
operator: In
values:
- gateways

template:
metadata:
name: "{{ name }}"
labels:
argocd.argoproj.io/instance: networking-system
app.kubernetes.io/name: "{{ name }}"
finalizers:
- resources-finalizer.argocd.argoproj.io
spec:
project: networking-system-project
source:
plugin:
name: kustomize-build-with-helm
repoURL: >-
ssh://git@github.com/haruops/argocd-app-of-apps.git
targetRevision: HEAD
path: "{{ path }}"
destination:
name: in-cluster
namespace: networking-system
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
- Validate=true
- ServerSideApply=true
- PrunePropagationPolicy=foreground
- PruneLast=true
retry:
limit: 5
backoff:
duration: 5s
maxDuration: 3m0s
factor: 2
ignoreDifferences:
- group: ""
kind: Secret
jsonPointers:
- /data
```

*Environment*:
- Envoy Gateway: 1.5.3
- Kubernetes: v1.32.9
- ArgoCD: v3.1.8

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.