HTTPRoute `status.parents` left with previous parent after changing the `spec.parentRefs`

**If you are reporting *any* crash or *any* potential security issue, *do not*
open an issue in this repo. Please report the issue via emailing
envoy-gateway-security@googlegroups.com where the issue will be triaged appropriately.**

*Description*:
>What issue is being seen? Describe what should be happening instead of
the bug, for example: The expected value isn't returned, etc.

Hello :wave:

Thanks for your work on Envoy Gateway!

I'm deploying it in a multi-tenancy architecture (as described [here](https://gateway.envoyproxy.io/v1.2/tasks/operations/deployment-mode/#multi-tenancy)) and I sometimes need to change the gateway managing an `HTTPRoute`.

When doing so, the new gateway is now serving the route, the previous one isn't managing it, but the `status` field isn't updated correctly.

The issue is related to:
- https://github.com/envoyproxy/gateway/issues/6933
- Issue was closed but the PR addressing it was apparently reverted / not applied back, except if I'm missing something.
- https://github.com/envoyproxy/gateway/issues/5656
- There was a mitigation patch on external-dns that would prevent it from using outdated references in the `status.parents` if it's not present in the `spec.parentRefs` but I think it references the same root issue.

It's not critical but makes monitoring inaccurate.

*Repro steps*:
> Include sample requests, environment, etc. All data and inputs
required to reproduce the bug.

- Install two different tenants, each with an Envoy Gateway controller and `GatewayClass` + `Gateway`, as described in the official documentation [here](https://gateway.envoyproxy.io/v1.2/tasks/operations/deployment-mode/#multi-tenancy). I create two gateways `envoy-gateway-test-0` and `envoy-gateway-test-1` for this test.
- Create a `HTTPRoute` managed by the `envoy-gateway-test-0`
```yaml
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: httpbin
namespace: test
spec:
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: envoy-gateway-test-0
namespace: envoy-gateway-test-0
hostnames:
- httpbin.example.org
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- name: httpbin
port: 80
```
- We should observe this status:
```yaml
status:
parents:
- conditions:
- lastTransitionTime: "2026-05-18T10:13:53Z"
message: Route is accepted
observedGeneration: 1
reason: Accepted
status: "True"
type: Accepted
- lastTransitionTime: "2026-05-18T10:13:53Z"
message: Resolved all the Object references for the Route
observedGeneration: 1
reason: ResolvedRefs
status: "True"
type: ResolvedRefs
controllerName: gateway.envoyproxy.io/test-0-gatewayclass-controller
parentRef:
group: gateway.networking.k8s.io
kind: Gateway
name: envoy-gateway-test-0
namespace: envoy-gateway-test-0
```
- Edit the `HTTPRoute` to use the second gateway.
```yaml
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: httpbin
namespace: test
spec:
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: envoy-gateway-test-1 # Updated
namespace: envoy-gateway-test-1 # Updated
hostnames:
- httpbin.example.org
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- name: httpbin
port: 80
```
- We should now observe the following status with both parents being references:
```yaml
status:
parents:
- conditions:
- lastTransitionTime: "2026-05-18T10:13:53Z"
message: Route is accepted
observedGeneration: 1
reason: Accepted
status: "True"
type: Accepted
- lastTransitionTime: "2026-05-18T10:13:53Z"
message: Resolved all the Object references for the Route
observedGeneration: 1
reason: ResolvedRefs
status: "True"
type: ResolvedRefs
controllerName: gateway.envoyproxy.io/test-0-gatewayclass-controller
parentRef:
group: gateway.networking.k8s.io
kind: Gateway
name: envoy-gateway-test-0
namespace: envoy-gateway-test-0
- conditions:
- lastTransitionTime: "2026-05-18T10:15:11Z"
message: Route is accepted
observedGeneration: 2
reason: Accepted
status: "True"
type: Accepted
- lastTransitionTime: "2026-05-18T10:15:11Z"
message: Resolved all the Object references for the Route
observedGeneration: 2
reason: ResolvedRefs
status: "True"
type: ResolvedRefs
controllerName: gateway.envoyproxy.io/test-1-gatewayclass-controller
parentRef:
group: gateway.networking.k8s.io
kind: Gateway
name: envoy-gateway-test-1
namespace: envoy-gateway-test-1
```
- However, both dashboards from both gateway (after port-forwarding) show that the `test-1` gateway is the one being used.
- test-0

- test-1

>**Note**: If there are privacy concerns, sanitize the data prior to
sharing.

*Environment*:
>Include the environment like gateway version, envoy version and so on.

Deployment is made using Envoy Gateway 1.7.3 with the following images:
- docker.io/envoyproxy/gateway:v1.7.3
- docker.io/envoyproxy/envoy:distroless-v1.37.2

*Logs*:
>Include the access logs and the Envoy logs.

Here are logs when I edit to change from `test-0` to `test-1`

From Envoy Gateway controller test-0

```
2026-05-18T10:24:42.043Z INFO provider kubernetes/controller.go:318 reconciling gateways {"runner": "provider", "trace_id": "3cd8adc7c46b16b6cc062108a24c17b8", "span_id": "b6f0c80e6667e39d"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:1209 processing OIDC HMAC Secret {"runner": "provider", "namespace": "envoy-gateway-test-0", "name": "envoy-oidc-hmac"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:1231 processing Envoy TLS Secret {"runner": "provider", "namespace": "envoy-gateway-test-0", "name": "envoy"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:1639 processing Gateway {"runner": "provider", "namespace": "envoy-gateway-test-0", "name": "envoy-gateway-test-0"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:1290 processing Secret {"runner": "provider", "namespace": "envoy-gateway-test-0", "name": "envoy-proxy-test"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:2842 processing EnvoyProxy {"runner": "provider", "namespace": "envoy-gateway-test-0", "name": "envoy-proxy-config-test"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:684 processing Backend {"runner": "provider", "kind": "Service", "namespace": "envoy-gateway-test-0", "name": "envoy-envoy-gateway-test-0-envoy-gateway-test-0-e3c2c938"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:702 added Service to resource tree {"runner": "provider", "kind": "Service", "namespace": "envoy-gateway-test-0", "name": "envoy-envoy-gateway-test-0-envoy-gateway-test-0-e3c2c938"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:844 added EndpointSlice to resource tree {"runner": "provider", "kind": "Service", "namespace": "envoy-gateway-test-0", "name": "envoy-envoy-gateway-test-0-envoy-gateway-test-0-e3c2c938", "namespace": "envoy-gateway-test-0", "name": "envoy-envoy-gateway-test-0-envoy-gateway-test-0-e3c2c938-wwdll"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:607 reconciled gateways successfully {"runner": "provider", "trace_id": "3cd8adc7c46b16b6cc062108a24c17b8", "span_id": "b6f0c80e6667e39d"}
2026-05-18T10:24:42.045Z INFO gateway-api runner/runner.go:190 received an update {"runner": "gateway-api", "trace_id": "3cd8adc7c46b16b6cc062108a24c17b8", "span_id": "c171bc607fb79826", "key": "gateway.envoyproxy.io/test-gatewayclass-controller"}
2026-05-18T10:24:42.052Z INFO infrastructure runner/runner.go:112 received an update {"runner": "infrastructure", "key": "envoy-gateway-test-0/envoy-gateway-test-0", "delete": false}
2026-05-18T10:24:42.052Z INFO provider kubernetes/status_updater.go:143 received a status update {"runner": "provider", "namespace": "envoy-gateway-test-0", "name": "envoy-gateway-test-0", "kind": "Gateway"}
2026-05-18T10:24:42.053Z INFO xds runner/runner.go:274 received an update {"runner": "xds", "trace_id": "3cd8adc7c46b16b6cc062108a24c17b8", "span_id": "677ad10f2fd449de"}
2026-05-18T10:24:42.065Z INFO xds v3/simple.go:583 open delta watch ID:529 for type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment Resources:map[envoy-gateway-test-0/envoy-gateway-test-0:{}] from nodeID: "envoy-envoy-gateway-test-0-envoy-gateway-test-0-e3c2c938-85c859jtsh", version "3cd8adc7c46b16b6cc062108a24c17b8"
2026-05-18T10:24:42.065Z INFO xds v3/simple.go:583 open delta watch ID:530 for type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment Resources:map[envoy-gateway-test-0/envoy-gateway-test-0:{}] from nodeID: "envoy-envoy-gateway-test-0-envoy-gateway-test-0-e3c2c938-85c855ftqv", version "3cd8adc7c46b16b6cc062108a24c17b8"
2026-05-18T10:24:42.065Z INFO xds v3/simple.go:583 open delta watch ID:531 for type.googleapis.com/envoy.config.cluster.v3.Cluster Resources:map[] from nodeID: "envoy-envoy-gateway-test-0-envoy-gateway-test-0-e3c2c938-85c859jtsh", version "3cd8adc7c46b16b6cc062108a24c17b8"
2026-05-18T10:24:42.065Z INFO xds v3/simple.go:583 open delta watch ID:532 for type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment Resources:map[envoy-gateway-test-0/envoy-gateway-test-0:{}] from nodeID: "envoy-envoy-gateway-test-0-envoy-gateway-test-0-e3c2c938-85c859jtsh", version "3cd8adc7c46b16b6cc062108a24c17b8"
2026-05-18T10:24:42.067Z INFO xds v3/simple.go:583 open delta watch ID:533 for type.googleapis.com/envoy.config.cluster.v3.Cluster Resources:map[] from nodeID: "envoy-envoy-gateway-test-0-envoy-gateway-test-0-e3c2c938-85c855ftqv", version "3cd8adc7c46b16b6cc062108a24c17b8"
2026-05-18T10:24:42.067Z INFO xds v3/simple.go:583 open delta watch ID:534 for type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment Resources:map[envoy-gateway-test-0/envoy-gateway-test-0:{}] from nodeID: "envoy-envoy-gateway-test-0-envoy-gateway-test-0-e3c2c938-85c855ftqv", version "3cd8adc7c46b16b6cc062108a24c17b8"
2026-05-18T10:24:42.067Z INFO xds v3/simple.go:583 open delta watch ID:535 for type.googleapis.com/envoy.config.listener.v3.Listener Resources:map[] from nodeID: "envoy-envoy-gateway-test-0-envoy-gateway-test-0-e3c2c938-85c855ftqv", version "3cd8adc7c46b16b6cc062108a24c17b8"
2026-05-18T10:24:42.067Z INFO xds v3/simple.go:583 open delta watch ID:536 for type.googleapis.com/envoy.config.route.v3.RouteConfiguration Resources:map[envoy-gateway-test-0/envoy-gateway-test-0/http:{} envoy-gateway-test-0/envoy-gateway-test-0/https:{}] from nodeID: "envoy-envoy-gateway-test-0-envoy-gateway-test-0-e3c2c938-85c855ftqv", version "3cd8adc7c46b16b6cc062108a24c17b8"
2026-05-18T10:24:42.067Z INFO xds v3/simple.go:583 open delta watch ID:537 for type.googleapis.com/envoy.config.listener.v3.Listener Resources:map[] from nodeID: "envoy-envoy-gateway-test-0-envoy-gateway-test-0-e3c2c938-85c859jtsh", version "3cd8adc7c46b16b6cc062108a24c17b8"
2026-05-18T10:24:42.069Z INFO xds v3/simple.go:583 open delta watch ID:538 for type.googleapis.com/envoy.config.route.v3.RouteConfiguration Resources:map[envoy-gateway-test-0/envoy-gateway-test-0/http:{} envoy-gateway-test-0/envoy-gateway-test-0/https:{}] from nodeID: "envoy-envoy-gateway-test-0-envoy-gateway-test-0-e3c2c938-85c859jtsh", version "3cd8adc7c46b16b6cc062108a24c17b8"
```

From Envoy Gateway controller test-1

```
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:318 reconciling gateways {"runner": "provider", "trace_id": "b8f8089f52b4bd72e9a820a3dda57ac1", "span_id": "31e3fe58493ce7a3"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:1209 processing OIDC HMAC Secret {"runner": "provider", "namespace": "envoy-gateway-test-1", "name": "envoy-oidc-hmac"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:1231 processing Envoy TLS Secret {"runner": "provider", "namespace": "envoy-gateway-test-1", "name": "envoy"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:1639 processing Gateway {"runner": "provider", "namespace": "envoy-gateway-test-1", "name": "envoy-gateway-test-1"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:1290 processing Secret {"runner": "provider", "namespace": "envoy-gateway-test-1", "name": "envoy-proxy-test-1"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/routes.go:315 processing HTTPRoute {"runner": "provider", "namespace": "test", "name": "httpbin-0"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:2842 processing EnvoyProxy {"runner": "provider", "namespace": "envoy-gateway-test-1", "name": "envoy-proxy-config-test-1"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:684 processing Backend {"runner": "provider", "kind": "Service", "namespace": "test", "name": "httpbin"}
2026-05-18T10:24:42.044Z INFO provider kubernetes/controller.go:702 added Service to resource tree {"runner": "provider", "kind": "Service", "namespace": "test", "name": "httpbin"}
2026-05-18T10:24:42.045Z INFO provider kubernetes/controller.go:844 added EndpointSlice to resource tree {"runner": "provider", "kind": "Service", "namespace": "test", "name": "httpbin", "namespace": "test", "name": "httpbin-b4g6k"}
2026-05-18T10:24:42.045Z INFO provider kubernetes/controller.go:684 processing Backend {"runner": "provider", "kind": "Service", "namespace": "envoy-gateway-test-1", "name": "envoy-envoy-gateway-test-1-envoy-gateway-test-1-5a36667d"}
2026-05-18T10:24:42.045Z INFO provider kubernetes/controller.go:702 added Service to resource tree {"runner": "provider", "kind": "Service", "namespace": "envoy-gateway-test-1", "name": "envoy-envoy-gateway-test-1-envoy-gateway-test-1-5a36667d"}
2026-05-18T10:24:42.045Z INFO provider kubernetes/controller.go:844 added EndpointSlice to resource tree {"runner": "provider", "kind": "Service", "namespace": "envoy-gateway-test-1", "name": "envoy-envoy-gateway-test-1-envoy-gateway-test-1-5a36667d", "namespace": "envoy-gateway-test-1", "name": "envoy-envoy-gateway-test-1-envoy-gateway-test-1-5a36667d-q89zp"}
2026-05-18T10:24:42.046Z INFO gateway-api runner/runner.go:190 received an update {"runner": "gateway-api", "trace_id": "b8f8089f52b4bd72e9a820a3dda57ac1", "span_id": "78b76b67420ddc5f", "key": "gateway.envoyproxy.io/test-1-gatewayclass-controller"}
2026-05-18T10:24:42.046Z INFO provider kubernetes/controller.go:607 reconciled gateways successfully {"runner": "provider", "trace_id": "b8f8089f52b4bd72e9a820a3dda57ac1", "span_id": "31e3fe58493ce7a3"}
2026-05-18T10:24:42.052Z INFO infrastructure runner/runner.go:112 received an update {"runner": "infrastructure", "key": "envoy-gateway-test-1/envoy-gateway-test-1", "delete": false}
2026-05-18T10:24:42.053Z INFO provider kubernetes/status_updater.go:143 received a status update {"runner": "provider", "namespace": "envoy-gateway-test-1", "name": "envoy-gateway-test-1", "kind": "Gateway"}
2026-05-18T10:24:42.053Z INFO xds runner/runner.go:274 received an update {"runner": "xds", "trace_id": "b8f8089f52b4bd72e9a820a3dda57ac1", "span_id": "51fe6b2f6cc1f562"}
2026-05-18T10:24:42.069Z INFO xds v3/simple.go:583 open delta watch ID:83 for type.googleapis.com/envoy.config.listener.v3.Listener Resources:map[] from nodeID: "envoy-envoy-gateway-test-1-envoy-gateway-test-1-5a36667d-68wbj2", version "b8f8089f52b4bd72e9a820a3dda57ac1"
2026-05-18T10:24:42.070Z INFO xds v3/simple.go:583 open delta watch ID:84 for type.googleapis.com/envoy.config.route.v3.RouteConfiguration Resources:map[envoy-gateway-test-1/envoy-gateway-test-1/http:{} envoy-gateway-test-1/envoy-gateway-test-1/https:{}] from nodeID: "envoy-envoy-gateway-test-1-envoy-gateway-test-1-5a36667d-68wbj2", version "b8f8089f52b4bd72e9a820a3dda57ac1"
2026-05-18T10:24:42.071Z INFO xds v3/simple.go:583 open delta watch ID:85 for type.googleapis.com/envoy.config.cluster.v3.Cluster Resources:map[] from nodeID: "envoy-envoy-gateway-test-1-envoy-gateway-test-1-5a36667d-68wbj2", version "b8f8089f52b4bd72e9a820a3dda57ac1"
2026-05-18T10:24:42.072Z INFO xds v3/simple.go:583 open delta watch ID:86 for type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment Resources:map[envoy-gateway-test-1/envoy-gateway-test-1:{} httproute/test/httpbin-0/rule/0:{}] from nodeID: "envoy-envoy-gateway-test-1-envoy-gateway-test-1-5a36667d-68wbj2", version "b8f8089f52b4bd72e9a820a3dda57ac1"
2026-05-18T10:24:42.076Z INFO provider kubernetes/status_updater.go:143 received a status update {"runner": "provider", "namespace": "test", "name": "httpbin-0", "kind": "HTTPRoute"}
2026-05-18T10:24:42.082Z INFO xds v3/simple.go:583 open delta watch ID:87 for type.googleapis.com/envoy.config.listener.v3.Listener Resources:map[] from nodeID: "envoy-envoy-gateway-test-1-envoy-gateway-test-1-5a36667d-6q9nzm", version "b8f8089f52b4bd72e9a820a3dda57ac1"
2026-05-18T10:24:42.083Z INFO xds v3/simple.go:583 open delta watch ID:88 for type.googleapis.com/envoy.config.route.v3.RouteConfiguration Resources:map[envoy-gateway-test-1/envoy-gateway-test-1/http:{} envoy-gateway-test-1/envoy-gateway-test-1/https:{}] from nodeID: "envoy-envoy-gateway-test-1-envoy-gateway-test-1-5a36667d-6q9nzm", version "b8f8089f52b4bd72e9a820a3dda57ac1"
2026-05-18T10:24:42.086Z INFO xds v3/simple.go:583 open delta watch ID:89 for type.googleapis.com/envoy.config.cluster.v3.Cluster Resources:map[] from nodeID: "envoy-envoy-gateway-test-1-envoy-gateway-test-1-5a36667d-6q9nzm", version "b8f8089f52b4bd72e9a820a3dda57ac1"
2026-05-18T10:24:42.087Z INFO xds v3/simple.go:583 open delta watch ID:90 for type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment Resources:map[envoy-gateway-test-1/envoy-gateway-test-1:{} httproute/test/httpbin-0/rule/0:{}] from nodeID: "envoy-envoy-gateway-test-1-envoy-gateway-test-1-5a36667d-6q9nzm", version "b8f8089f52b4bd72e9a820a3dda57ac1"
```

Let me know if you believe this comment should rather be attached to an existing issue instead.

Thanks,
Paul