gateway-api: routes rejected when using multiple listeners with allowedRoutes

Is there an existing issue for this?

I have searched the existing issues

Version

equal or higher than v1.19.3 and lower than v1.20.0

What happened?

Route attachment fails as GRPC and HTTP collapse into one.

See cec-dump.broken.yaml which. misses HTTPRoutes related resources alltogether

How can we reproduce the issue?

I've been using the setup defined in: https://github.com/eufriction/k8s-cilium-gapi/blob/main/scenarios/22-http-grpc-allowed-routes/README.md

Deploy the following Gateway and start to attach 2 HTTPRoutes and 2 GRPCRoutes results in missing routes.

---
# yaml-language-server: $schema=https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/gateway.networking.k8s.io/gateway_v1.json
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: allowed-routes-gateway
  namespace: gateway-system
  labels:
    app.kubernetes.io/part-of: demo
spec:
  gatewayClassName: cilium
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      hostname: "*.example.test"
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: allowed-routes-gateway-tls
      allowedRoutes:
        namespaces:
          from: All
        kinds:
          - group: gateway.networking.k8s.io
            kind: HTTPRoute
    - name: grpcs
      protocol: HTTPS
      port: 50051
      hostname: "*.example.test"
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: allowed-routes-gateway-tls
      allowedRoutes:
        namespaces:
          from: All
        kinds:
          - group: gateway.networking.k8s.io
            kind: GRPCRoute

Cilium Version

1.19.3

Kernel Version

Linux k8s-cilium-gapi-worker2 6.12.76-linuxkit #1 SMP Mon Mar 30 09:10:35 UTC 2026 aarch64 aarch64 aarch64 GNU/Linux

Kubernetes Version

kind, 1.35

Regression

Broken in main, 1.19.1, and 1.19.3

Sysdump

No response

Relevant log output

Anything else?

No response

Cilium Users Document

Are you a user of Cilium? Please add yourself to the Users doc

Code of Conduct

I agree to follow this project's Code of Conduct

I was just about to file this as a new issue when I found yours — sounds like the same underlying bug with a different listener combination. Posting my data point here instead of duplicating.

We're hitting it on quay.io/cilium/cilium:v1.19.3.

Scenario: One Gateway with three listeners — HTTP, HTTPS (Terminate), and TLS (Passthrough). HTTPRoutes attached to either HTTP or HTTPS listener are rejected with NotAllowedByListeners: "HTTPRoute is not allowed to attach to this Gateway due to route kind restrictions". The TLSRoute on the TLS listener is accepted. Removing the TLS listener from the Gateway immediately flips the HTTPRoutes to Accepted: True.

Pinning allowedRoutes.kinds explicitly on every listener (HTTPRoute on HTTP/HTTPS, TLSRoute on TLS) does not fix it — HTTPRoutes are still rejected with the same message.

This looks like a regression of (or incomplete fix for) #42013. PR #43802 and its v1.19 backport #43922 both merged 2026-01-22 but neither is listed in the v1.19.2 / v1.19.3 release notes.

Minimal repro (three listeners on one Gateway):

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: repro-gw
  namespace: default
spec:
  gatewayClassName: cilium
  listeners:
    - name: http
      protocol: HTTP
      port: 80
      allowedRoutes:
        namespaces:
          from: Same
    - name: https-app
      protocol: HTTPS
      port: 443
      hostname: app.example.com
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: app-tls
      allowedRoutes:
        namespaces:
          from: Same
    - name: tls-passthrough
      protocol: TLS
      port: 443
      hostname: passthrough.example.com
      tls:
        mode: Passthrough
      allowedRoutes:
        namespaces:
          from: Same
        kinds:
          - group: gateway.networking.k8s.io
            kind: TLSRoute
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: app-route
  namespace: default
spec:
  parentRefs:
    - name: repro-gw
      sectionName: https-app
  hostnames:
    - app.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: app-svc
          port: 8080
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: app-http-redirect
  namespace: default
spec:
  parentRefs:
    - name: repro-gw
      sectionName: http
  hostnames:
    - app.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            port: 443
            statusCode: 301
---
apiVersion: gateway.networking.k8s.io/v1alpha3
kind: TLSRoute
metadata:
  name: passthrough-route
  namespace: default
spec:
  parentRefs:
    - name: repro-gw
      sectionName: tls-passthrough
  hostnames:
    - passthrough.example.com
  rules:
    - backendRefs:
        - name: passthrough-svc
          port: 8443

Env: Cilium v1.19.3, EKS v1.34.4-eks-f69f56f, kernel 6.12.77-99.140.amzn2023.aarch64.

@dinoshauer

@dinoshauer Thanks for adding additional information. I'm looking into if there is an easy fix for this as I found the behavior when working on #44889.

Will test with the setup in https://github.com/eufriction/k8s-cilium-gapi/tree/main/scenarios/22-http-grpc-allowed-routes, I could possibly add a TLSRoute there or in another scenario to cover your use case.