Description:
When Envoy Gateway is configured with NamespaceSelector watch type in the Kubernetes provider to only watch specific namespaces, xPolicy resources from all namespaces are still being processed.
Note: Other resources like HTTPRoute, Gateway, and ReferenceGrant are correctly filtered by the namespace selector. This issue affects all xPolicy resources (ClientTrafficPolicy, BackendTrafficPolicy, SecurityPolicy, EnvoyExtensionPolicy, etc.). The reproduction steps below use ClientTrafficPolicy as an example, but the same behavior applies to all policy types.
Repro steps:
- Install EG with namespace selector:
helm upgrade --install eg oci://docker.io/envoyproxy/gateway-helm \
--version v1.7.0 \
-n envoy-gateway-system \
--create-namespace \
--wait --wait-for-jobs \
--values - <<EOF
config:
envoyGateway:
provider:
kubernetes:
watch:
type: NamespaceSelector
namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: consumer
extensionApis:
enableBackend: true
EOF
- Apply the following manifests:
kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
name: eg
spec:
controllerName: gateway.envoyproxy.io/gatewayclass-controller
---
apiVersion: v1
kind: Namespace
metadata:
name: consumer
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: eg
namespace: consumer
spec:
gatewayClassName: eg
listeners:
- name: http
protocol: HTTP
port: 80
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: Backend
metadata:
name: backend
namespace: consumer
spec:
endpoints:
- fqdn:
hostname: httpbin.org
port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: backend
namespace: consumer
spec:
parentRefs:
- name: eg
hostnames:
- "www.example.com"
rules:
- backendRefs:
- group: gateway.envoyproxy.io
kind: Backend
name: backend
matches:
- path:
type: PathPrefix
value: /
---
apiVersion: v1
kind: Namespace
metadata:
name: consumer2
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
name: client-validation-policy
namespace: consumer2
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: eg
tls:
clientValidation:
caCertificateRefs:
- kind: Secret
group: ""
name: non-existing-secret
EOF
- Check envoy-gateway logs:
kubectl -n envoy-gateway-system logs -l app.kubernetes.io/instance=eg | grep ERROR
The following error shows that ClientTrafficPolicy in consumer2 namespace is being processed, even though only consumer namespace should be watched:
2026-02-18T15:06:48.202Z ERROR provider kubernetes/controller.go:1386 failed to process CACertificateRef for ClientTrafficPolicy {"runner": "provider", "policy": {"kind":"ClientTrafficPolicy","apiVersion":"gateway.envoyproxy.io/v1alpha1","metadata":{"name":"client-validation-policy","namespace":"consumer2","uid":"2e5b39ed-ab2c-4db2-bf2e-54c0d64d48db","resourceVersion":"20140","generation":1,"creationTimestamp":"2026-02-18T15:05:56Z","annotations":{"kubectl.kubernetes.io/last-applied-configuration":"{\"apiVersion\":\"gateway.envoyproxy.io/v1alpha1\",\"kind\":\"ClientTrafficPolicy\",\"metadata\":{\"annotations\":{},\"name\":\"client-validation-policy\",\"namespace\":\"consumer2\"},\"spec\":{\"targetRefs\":[{\"group\":\"gateway.networking.k8s.io\",\"kind\":\"Gateway\",\"name\":\"eg\"}],\"tls\":{\"clientValidation\":{\"caCertificateRefs\":[{\"group\":\"\",\"kind\":\"Secret\",\"name\":\"non-existing-secret\"}]}}}}\n"}},"spec":{"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"eg"}],"tls":{"clientValidation":{"caCertificateRefs":[{"group":"","kind":"Secret","name":"non-existing-secret"}]}}},"status":{"ancestors":null}}, "caCertificateRef": "non-existing-secret", "kind": "Secret", "error": "unable to find the Secret consumer2/non-existing-secret: Secret \"non-existing-secret\" not found"}
Environment:
EG 1.7.0
Description:
When Envoy Gateway is configured with
NamespaceSelectorwatch type in the Kubernetes provider to only watch specific namespaces, xPolicy resources from all namespaces are still being processed.Note: Other resources like
HTTPRoute,Gateway, andReferenceGrantare correctly filtered by the namespace selector. This issue affects all xPolicy resources (ClientTrafficPolicy,BackendTrafficPolicy,SecurityPolicy,EnvoyExtensionPolicy, etc.). The reproduction steps below useClientTrafficPolicyas an example, but the same behavior applies to all policy types.Repro steps:
kubectl -n envoy-gateway-system logs -l app.kubernetes.io/instance=eg | grep ERRORThe following error shows that
ClientTrafficPolicyinconsumer2namespace is being processed, even though onlyconsumernamespace should be watched:Environment:
EG 1.7.0