bug(gateway): default TenantGateway drops HTTPRoutes on cilium 1.19.x via cilium#45559 (TLS-passthrough listeners) #3070

What happens

On the cilium version shipped with Cozystack v1.5.x (cilium 1.19.3 / 1.19.5), the default TenantGateway silently drops HTTPRoutes. Attached routes report Accepted=False with reason NotAllowedByListeners, so Gateway API publishing of HTTP apps does not work on the default root/tenant gateway.

Root cause

This is cilium #45559: when a Gateway has multiple listeners on the same port whose explicit allowedRoutes.kinds differ, cilium collapses those listeners and drops the affected routes.

The TenantGateway controller renders, on port 443:

• HTTPS-terminate listeners with allowedRoutes.kinds: [HTTPRoute]
• one TLS-passthrough listener with allowedRoutes.kinds: [TLSRoute] per spec.tlsPassthroughServices

tlsPassthroughServices defaults to [api, vm-exportproxy, cdi-uploadproxy] (packages/extra/gateway/values.yaml), so by default every TenantGateway ends up with both HTTPRoute and TLSRoute listeners on port 443 — divergent kinds on the same port — which trips cilium#45559 and drops the HTTPRoutes.

Reproduction

Confirmed on cilium 1.19.3. Two Gateways using the cilium GatewayClass, each with one HTTPRoute attached by sectionName:

• Uniform kinds — all port-443 listeners kinds: [HTTPRoute]: the route is Accepted=True.
• Mixed kinds — one HTTPS-terminate listener kinds: [HTTPRoute] plus one TLS-passthrough listener kinds: [TLSRoute] on port 443 (the default root-gateway shape): the HTTPRoute is Accepted=False, reason NotAllowedByListeners.

The two Gateways differ only in the second listener's kind, which isolates the cause to the divergent-kind collapse.

Affected versions

cilium 1.19.3 and 1.19.5 (Cozystack v1.5.0 and v1.5.1). The upstream fix cilium #45693 landed only in cilium 1.20 and is not backported to the 1.19.x branch.

Workaround

Until cilium 1.20 is available, avoid mixing HTTPRoute and TLSRoute on a single TenantGateway — move the TLS-passthrough services onto a separate Gateway, or do not publish them via Gateway API for now.

Possible cozystack-side fix

The controller could omit the explicit allowedRoutes.kinds on the HTTPS-terminate listeners. The route-hostname validating admission policy already gates HTTPRoute / TLSRoute attachment by hostname, so dropping the explicit kinds removes the divergence and sidesteps cilium#45559 without waiting for the 1.20 bump.