Cozystack

Scratch my last message — it's not your namespaces. Both conditions are one known bug, already fixed on main but not in 1.5. The default Gateway renders TLS-passthrough listeners for api, vm-exportproxy and cdi-uploadproxy on port 443 (kinds: [TLSRoute]) next to the HTTPS listeners (kinds: [HTTPRoute]). Cilium 1.19.x merges listeners that share a port and keeps only one listener's allowedRoutes (cilium#45559) — so the surviving listener carries the wrong kinds and the wrong namespace selector, and the platform's own HTTPRoutes bounce with exactly the two conditions you're seeing. Tracked as #3070, fixed by #3084 — merged June 26, after v1.5.0 was cut, so it never reached release-1.5. Gateway API on any 1.5.x is broken out of the box; sorry you had to find that the hard way. Upstream lands in Cilium 1.20. Options: v1.6.0-rc already carries the fix and 1.6 is close — that's the clean path. If you must stay on 1.5.x, either keep using ingress-nginx for now, or clear tlsPassthroughServices on the tenant's gateway module (no passthrough listeners, nothing to merge) — but that drops the passthrough routes for the Kubernetes API, vm-exportproxy and cdi-uploadproxy, so it's a trade, not a fix.