envoyproxy / envoyproxy/gateway

HTTPRoute status condition not refreshed when listener configuration changes (NoMatchingListenerHostname stale)

Open
#8,861 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

## Description

HTTPRoute resources can be left with a stale `status.parents[].conditions[Accepted]=False` condition (reason `NoMatchingListenerHostname`) after the underlying Gateway listener has been changed to match the route's hostname. The data plane is healthy and serving traffic on the affected hostnames, but the route's status object never re-emits because status reconciliation appears to be gated on the route's own `metadata.generation` changing — listener-side changes alone do not retrigger status emission for affected routes.

## Environment

- Envoy Gateway: **v1.7.0** (Helm chart `gateway-helm` from `docker.io/envoyproxy`)
- Provider: Kubernetes
- Gateway API: v1
- Single Gateway with multiple listeners; many HTTPRoutes attached via `parentRefs`

## Reproduction

1. Have HTTPRoute `X` bound to `Gateway/main` where no listener matches `X`'s hostname. Status condition correctly reports:
```
type: Accepted
status: "False"
reason: NoMatchingListenerHostname
```
2. Update `Gateway/main` to add a listener whose hostname matches `X`.
3. Observe that the data plane begins serving `X`'s hostname correctly — routing works end-to-end.
4. Inspect `kubectl get httproute X -o yaml`: the `Accepted=False/NoMatchingListenerHostname` condition is **still present** indefinitely. `observedGeneration` reflects the route's last generation, not the listener change.
5. Workaround: bumping any annotation on `X` (e.g. `kubectl annotate httproute X foo=bar --overwrite`) forces a new `metadata.generation`, which triggers status reconciliation and the condition flips to `Accepted=True`.

## Expected behavior

When listener configuration changes such that a previously-rejected route can now be accepted (or vice versa), the controller should re-evaluate route status and re-emit the `Accepted` condition for affected routes, without requiring a generation bump on the route itself.

## Impact

- Operators monitoring HTTPRoute status for health get false negatives.
- Any tooling that reads `status.parents[].conditions[]` to determine route health (dashboards, gating in CI, alerting) must either ignore the condition or implement its own annotation-bump workaround.
- Particularly painful in fleets with many routes — we hit this on 37 routes simultaneously after a Gateway listener consolidation.

## Workaround

We bumped a `focusapiary.org/status-refresh: \"2026-04-25\"` annotation on all 37 affected routes to force generation churn. Reference (private repo): https://git.developerdojo.org/FocusApiary/envoy-gateway-k8s/-/merge_requests/17

Happy to gather additional logs or test patches if helpful.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.