Gateway API: allowedRoutes is incorrectly applied to all listeners when sectionName is omitted #42159

Is there an existing issue for this?

• I have searched the existing issues

Version

equal or higher than v1.18.2 and lower than v1.19.0

What happened?

The Cilium Gateway API controller incorrectly validates an HTTPRoute against only one listener defined in a Gateway when the HTTPRoute does not specify a sectionName.

The allowedRoutes rules of one (sometimes first, see bellow) listener are used to validate the attachment, and this result seems to be applied to all other listeners, ignoring their individual rules. For example, if one listener has a restrictive policy (from: Same) and a subsequent listener has a permissive policy (from: All), a cross-namespace HTTPRoute is incorrectly attached also to the restrictive listener.

This can lead to unintended traffic routing and a violation of the configured security posture. Specifying the sectionName in the HTTPRoute for each intended listener works as a successful workaround, as the controller then correctly applies the rules of the specified listener.

How can we reproduce the issue?

1. Prerequisites: A Kubernetes cluster with Cilium v1.18.2 and the Gateway API CRDs installed.
2. HTTPRoute in default namespace:

   kind: HTTPRoute
   apiVersion: gateway.networking.k8s.io/v1
   metadata:
     name: httproute
     namespace: default
   spec:
     parentRefs:
     - namespace: kube-system
       name: gateway
       # sectionName is intentionally omitted to trigger the bug

3. (A) If Gateway in kube-system (another) namespace has one listener with from: All and another from: Same, HTTPRoute is attached to both listeners:

   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: gateway
     namespace: kube-system
   spec:
     gatewayClassName: cilium
     listeners:
     # Listener 1 (First): Restrictive policy
     - name: http-restrictive
       port: 80
       protocol: HTTP
       allowedRoutes:
         namespaces:
           from: Same # Should only allow routes from 'kube-system' ns
     # Listener 2 (Second): Permissive policy
     - name: http-permisive
       port: 8080
       protocol: HTTP
       allowedRoutes:
         namespaces:
           from: All

4. (B) If Gateway in kube-system (another) namespace has first listener restricted to kube-system namespace by selector and second listener with from: All, HTTPRoute is not attached to either listener:

   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: gateway
     namespace: kube-system
   spec:
     gatewayClassName: cilium
     listeners:
     # Listener 1 (First): Restrictive policy
     - name: http-restrictive
       port: 80
       protocol: HTTP
       allowedRoutes:
         namespaces:
           from: Selector  # Should only allow routes from 'kube-system' ns
           selector:
             matchLabels:
               kubernetes.io/metadata.name: kube-system
     # Listener 2 (Second): Permissive policy
     - name: http-permisive
       port: 8080
       protocol: HTTP
       allowedRoutes:
         namespaces:
           from: All

5. (C) If Gateway in kube-system (another) namespace has just changed order to first listener with from: All and second listener restricted to kube-system namespace by selector, HTTPRoute is attached to both listeners:

   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: gateway
     namespace: kube-system
   spec:
     gatewayClassName: cilium
     listeners:
     # Listener 2 (First): Permissive policy
     - name: http-permisive
       port: 8080
       protocol: HTTP
       allowedRoutes:
         namespaces:
           from: All
     # Listener 1 (Second): Restrictive policy
     - name: http-restrictive
       port: 80
       protocol: HTTP
       allowedRoutes:
         namespaces:
           from: Selector  # Should only allow routes from 'kube-system' ns
           selector:
             matchLabels:
               kubernetes.io/metadata.name: kube-system

Cilium Version

Client: 1.18.2 5bd307a 2025-09-16T09:06:09+00:00 go version go1.24.7 linux/amd64
Daemon: 1.18.2 5bd307a 2025-09-16T09:06:09+00:00 go version go1.24.7 linux/amd64

Kernel Version

Linux mimi-01 6.12.48-talos #1 SMP Wed Sep 24 12:34:42 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Kubernetes Version

Client Version: v1.33.3
Kustomize Version: v5.6.0
Server Version: v1.34.0

Regression

No response

Sysdump

No response

Relevant log output

Anything else?

No response

Cilium Users Document

• Are you a user of Cilium? Please add yourself to the Users doc

Code of Conduct

• I agree to follow this project's Code of Conduct