dashboard.xxx.xxx HTTPRoute .status.parents reports HTTPRoute is not allowed to attach to this Gateway due to namespace selector restrictions #3721

Activity

1. Ray Low (crossRT)

   added

   kind/bugCategorizes issue or PR as related to a bugCategorizes issue or PR as related to a bug

   triage/needs-triageIndicates an issue needs triage by a maintainerIndicates an issue needs triage by a maintainer

   on Aug 10, 2026
2. dosubot commented on Aug 10, 2026

   

   dosubotbot

   on Aug 10, 2026 – with DosuBot

   More actions

   This looks like a labeling issue on the cozy-dashboard namespace. The Gateway in tenant-root uses a label-based namespace selector — it requires namespaces to have namespace.cozystack.io/gateway: tenant-root to allow HTTPRoute attachment [1]. While cozy-dashboard is included in the platform's default attachedNamespaces list [2], being listed there isn't sufficient on its own — the TenantGateway controller must also apply the corresponding label to the namespace.

   You can verify this:

   kubectl get namespace cozy-dashboard --show-labels | grep gateway
   kubectl get gateway cozystack -n tenant-root -o yaml  # check spec.listeners[].allowedRoutes.namespaces.selector

   If the label is missing, applying it manually should resolve the issue immediately:

   kubectl label namespace cozy-dashboard namespace.cozystack.io/gateway=tenant-root

   If it turns out the label is already present (as you mentioned), the problem might be related to #3070, which reports HTTPRoutes rejected with NotAllowedByListeners on the default TenantGateway due to Cilium 1.19.x handling of multiple port-443 listeners [3]. That's a different error reason but affects Gateway route acceptance generally — worth checking your Cilium version if the label checks out.

   To reply, just mention @dosu.

   ---

   Share context across your team and agents. Try Dosu.

   
3. lexfrei commented on Aug 17, 2026

   

   Aleksei Sviridkin (lexfrei)

   on Aug 17, 2026

   Contributor

   More actions

   The label is not the problem. cozy-dashboard carries namespace.cozystack.io/gateway: tenant-root and the route is still refused, because Cilium v1.19.5 rejects on the first listener whose namespace selector misses instead of continuing to the listeners that would accept.

   CheckGatewayAllowedForNamespace in operator/pkg/gateway-api/routechecks/gateway_checks.go walks gw.Spec.Listeners, skipping a listener when the parentRef pins a different sectionName or port, when the listener has a hostname that shares nothing with the route's, or when it declares no allowedRoutes.namespaces. For the first listener that survives all of those and uses From: Selector, v1.19.5 lists the namespaces the selector matches and, if the route's namespace is not among them, sets Accepted=False with NotAllowedByListeners and returns — the loop never reaches listener two. The message it writes is <Kind> is not allowed to attach to this Gateway due to namespace selector restrictions, which is the string in the report above.

   The TenantGateway controller renders the port-80 listener at index 0 (internal/controller/tenantgateway/reconciler.go:746-753), and that listener carries a deliberately much narrower selector than the rest: kubernetes.io/metadata.name In [tenant namespace, cert-manager challenge namespace], from buildHTTPListenerAllowedRoutes at internal/controller/tenantgateway/renderers.go:135-141. It also declares no hostname, so the hostname skip never fires on it. The HTTPS listeners that would admit cozy-dashboard use the label selector from buildAllowedRoutes at renderers.go:106-118 and sit at index 1 and beyond.

   So every platform app route — all of which attach by hostname with no sectionName and no port — is measured against the port-80 listener, misses its selector, and is rejected before any :443 listener is considered. A route that pins a sectionName is unaffected, which is why the ACME challenge route keeps working while the dashboard route does not.

   This is cilium#42159. v1.19.6 removes the early return: the selector case returns true on a match and otherwise falls through to the next listener, so the rejection is only written after every listener has been tried. #3343 bumps the vendored chart to v1.19.6 and is the fix in flight for this.

   There is a cozystack-side remedy that does not wait on the bump, worth recording in case the bump is delayed: render the port-80 listener last instead of first, so the permissive :443 listeners are evaluated before the narrow one. The constraint it has to respect is that the ACME HTTP-01 challenge route must keep landing on :80, and it does — the solver pins SectionName: "http" explicitly (internal/controller/tenantgateway/renderers.go:266-278), so it selects that listener by name regardless of ordering. It is a small change in renderGateway, but it is a workaround for a bug already fixed upstream, so it is only worth doing if v1.19.6 cannot land soon.
4. Aleksei Sviridkin (lexfrei)

   added

   area/ciliumIssues or PRs related to Cilium (agent, operator, Gateway API, network policy, LB-IPAM)Issues or PRs related to Cilium (agent, operator, Gateway API, network policy, LB-IPAM)

   on Aug 19, 2026
5. Aleksei Sviridkin (lexfrei)

   added

   area/networkingIssues or PRs related to networking (ingress, gateway, vpn, metallb, kube-ovn)Issues or PRs related to networking (ingress, gateway, vpn, metallb, kube-ovn)

   triage/acceptedIndicates an issue is ready to be actively worked onIndicates an issue is ready to be actively worked on

   priority/important-soonMust be staffed and worked on either currently, or very soon, ideally in time for the next releaseMust be staffed and worked on either currently, or very soon, ideally in time for the next release

   and removed

   triage/needs-triageIndicates an issue needs triage by a maintainerIndicates an issue needs triage by a maintainer

   on Sep 23, 2026