Managed HTTPRoute never gets created while using Header Based Routing with GKE Gateway

[mukesh-nayal]

Description

When using the Gateway API plugin with useHeaderRoutes: true on GKE, the setHeaderRoute step completes as (invalid) because the httpHeaderManagedRouteMap is never populated with the managed route names from the Rollout configuration.

Environment

• Gateway API Plugin Version: v0.5.0
• Argo Rollouts Version: v1.8.0
• Kubernetes Distribution: GKE (Google Kubernetes Engine)
• Gateway API Version: v1 (CRD supports v1 and v1beta1)
• Gateway Class: gke-l7-regional-external-managed

Steps to Reproduce

1. Create a namespace with the required resources:

---
apiVersion: v1
kind: Namespace
metadata:
  name: test-header-route
---
apiVersion: v1
kind: Service
metadata:
  name: test-stable-svc
  namespace: test-header-route
spec:
  selector:
    app: test-header-route
  ports:
    - port: 80
      targetPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: test-canary-svc
  namespace: test-header-route
spec:
  selector:
    app: test-header-route
  ports:
    - port: 80
      targetPort: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: test-gateway
  namespace: test-header-route
spec:
  gatewayClassName: gke-l7-regional-external-managed
  listeners:
    - name: http
      protocol: HTTP
      port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: test-httproute
  namespace: test-header-route
spec:
  parentRefs:
    - name: test-gateway
      namespace: test-header-route
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: test-stable-svc
          port: 80
          weight: 100
        - name: test-canary-svc
          port: 80
          weight: 0
---
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: test-header-rollout
  namespace: test-header-route
spec:
  replicas: 2
  selector:
    matchLabels:
      app: test-header-route
  strategy:
    canary:
      canaryService: test-canary-svc
      stableService: test-stable-svc
      trafficRouting:
        managedRoutes:
          - name: test-managed-header-route
        plugins:
          argoproj-labs/gatewayAPI:
            httpRoutes:
              - name: test-httproute
                useHeaderRoutes: true
            namespace: test-header-route
      steps:
        - setWeight: 50
        - setHeaderRoute:
            name: test-managed-header-route
            match:
              - headerName: X-Test-Header
                headerValue:
                  exact: canary
        - pause: {}
  template:
    metadata:
      labels:
        app: test-header-route
    spec:
      containers:
        - name: nginx
          image: nginx:latest
          ports:
            - containerPort: 80

2. Apply the resources and wait for the rollout to progress
3. Trigger an update (e.g., change image tag) to ensure Generation > 1
4. Observe the logs

Expected Behavior

• The setHeaderRoute step should create a managed HTTPRoute with header matching rules
• The managed HTTPRoute should route traffic with the specified header to the canary service

Actual Behavior

• The setHeaderRoute step completes as (invalid)
• No managed HTTPRoute is created
• The plugin logs show: test-managed-header-route is not in httpHeaderManagedRouteMap

Logs

Controller logs showing the issue:

[RemoveManagedRoutes] plugin "argoproj-labs/gatewayAPI" controls HTTPRoutes: [test-httproute]
test-managed-header-route is not in httpHeaderManagedRouteMap
[SetWeight] plugin "argoproj-labs/gatewayAPI" controls HTTPRoutes: [test-httproute]

SetHeaderRoute step execution:

Rollout step 1/3 completed (setWeight: 50)
[SetHeaderRoute] plugin "argoproj-labs/gatewayAPI" controls HTTPRoutes: [test-httproute]
Rollout step 2/3 completed (invalid)

Analysis

The plugin correctly:

• Identifies it controls the HTTPRoute [test-httproute]
• Receives the SetHeaderRoute call
• Has the useHeaderRoutes: true configuration

However, the httpHeaderManagedRouteMap is never populated with the managed route name test-managed-header-route, causing the step to complete as (invalid).

RBAC Permissions

We verified RBAC permissions are correctly configured:

- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - httproutes
  verbs:
  - get
  - list
  - watch
  - update
  - create
  - patch
  - delete

Additional Context

• The issue occurs consistently on every reconciliation cycle
• The RemoveManagedRoutes function also logs the same error, indicating the map is never populated
• This appears to be specific to how the plugin builds the internal httpHeaderManagedRouteMap from the configuration

[kostis-codefresh]

Hello

The plugin also needs access to read/write configmaps, obviously. Have you set this up?

Can you try again with a superpermissive role please to rule out permission problems?

Also does this happen only with GKE? Have you tried with another provider as well?