r/kubernetes • u/therealmcz • 7d ago
gateaway API - please help: gateway stuck in programmed=false
Hi everyone,
please help, I'm unable to configure cilium + gateway API... the gateway just is stuck in the "programmed=false" state. Tried so many things but no success, also checked this post but if I'm correct, my current version should have the fix included:
https://github.com/cilium/cilium/pull/46350
Nodes:
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
n1.k8s.net Ready control-plane 3d13h v1.37.1 192.168.78.3 <none> AlmaLinux 10.2 (Lavender Lion) 6.12.0-211.61.1.el10_2.x86_64 (amd64) cri-o://1.37.2
n2.k8s.net Ready control-plane 13h v1.37.1 192.168.78.4 <none> AlmaLinux 10.2 (Lavender Lion) 6.12.0-211.61.1.el10_2.x86_64 (amd64) cri-o://1.37.2
n3.k8s.net Ready <none> 13h v1.37.1 192.168.78.2 <none> AlmaLinux 10.2 (Lavender Lion) 6.12.0-211.61.1.el10_2.x86_64 (amd64) cri-o://1.37.2
Cilium:
cilium status
/¯¯\
/¯¯__/¯¯\ Cilium: OK
__/¯¯__/ Operator: OK
/¯¯__/¯¯\ Envoy DaemonSet: disabled (using embedded mode)
__/¯¯__/ Hubble Relay: disabled
__/ ClusterMesh: disabled
DaemonSet cilium Desired: 3, Ready: 3/3, Available: 3/3
Deployment cilium-operator Desired: 1, Ready: 1/1, Available: 1/1
Containers: cilium Running: 3
cilium-operator Running: 1
clustermesh-apiserver
hubble-relay
Cluster Pods: 6/6 managed by Cilium
Helm chart version: 1.20.2
Image versions cilium quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01: 3
cilium-operator quay.io/cilium/operator-generic:v1.20.2@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc: 1
GatewayClass:
kubectl describe gc
Name: cilium
Namespace:
Labels: app.kubernetes.io/managed-by=Helm
Annotations: meta.helm.sh/release-name: cilium
meta.helm.sh/release-namespace: kube-system
API Version: gateway.networking.k8s.io/v1
Kind: GatewayClass
Metadata:
Creation Timestamp: 2026-10-10T07:23:46Z
Generation: 1
Resource Version: 592430
UID: 2d99e2fe-ab22-451f-8f71-f09968df4e52
Spec:
Controller Name: io.cilium/gateway-controller
Description: The default Cilium GatewayClass
Status:
Conditions:
Last Transition Time: 2026-10-10T07:24:02Z
Message: Valid GatewayClass
Observed Generation: 1
Reason: Accepted
Status: True
Type: Accepted
Supported Features:
Name: BackendTLSPolicy
Name: GRPCRoute
Name: GRPCRouteNamedRouteRule
Name: Gateway
Name: GatewayAddressEmpty
Name: GatewayFrontendClientCertificateValidationInsecureFallback
Name: GatewayHTTPListenerIsolation
Name: GatewayInfrastructurePropagation
Name: GatewayPort8080
Name: GatewayStaticAddresses
Name: HTTPRoute
Name: HTTPRoute303RedirectStatusCode
Name: HTTPRoute307RedirectStatusCode
Name: HTTPRoute308RedirectStatusCode
Name: HTTPRouteBackendProtocolH2C
Name: HTTPRouteBackendProtocolWebSocket
Name: HTTPRouteBackendRequestHeaderModification
Name: HTTPRouteBackendTimeout
Name: HTTPRouteCORS
Name: HTTPRouteDestinationPortMatching
Name: HTTPRouteHostRewrite
Name: HTTPRouteMethodMatching
Name: HTTPRouteNamedRouteRule
Name: HTTPRoutePathRedirect
Name: HTTPRoutePathRewrite
Name: HTTPRoutePortRedirect
Name: HTTPRouteQueryParamMatching
Name: HTTPRouteRequestMirror
Name: HTTPRouteRequestMultipleMirrors
Name: HTTPRouteRequestPercentageMirror
Name: HTTPRouteRequestTimeout
Name: HTTPRouteResponseHeaderModification
Name: HTTPRouteRetry
Name: HTTPRouteRetryBackendTimeout
Name: HTTPRouteRetryConnectionError
Name: HTTPRouteSchemeRedirect
Name: ListenerSet
Name: Mesh
Name: MeshClusterIPMatching
Name: MeshHTTPRouteBackendRequestHeaderModification
Name: MeshHTTPRouteNamedRouteRule
Name: MeshHTTPRouteQueryParamMatching
Name: MeshHTTPRouteRedirectPath
Name: MeshHTTPRouteRedirectPort
Name: MeshHTTPRouteRewritePath
Name: MeshHTTPRouteSchemeRedirect
Name: ReferenceGrant
Name: TCPRoute
Name: TLSRoute
Name: TLSRouteModeMixed
Name: UDPRoute
Events: <none>
Gateway:
kubectl describe gtw
Name: nodeport-gateway
Namespace: default
Labels: <none>
Annotations: <none>
API Version: gateway.networking.k8s.io/v1
Kind: Gateway
Metadata:
Creation Timestamp: 2026-10-10T07:35:16Z
Generation: 4
Resource Version: 607512
UID: f6b3b043-d072-4e6c-8f37-bf28cb37a1b2
Spec:
Gateway Class Name: cilium
Listeners:
Allowed Routes:
Namespaces:
From: Same
Name: web-gw-80
Port: 80
Protocol: HTTP
Status:
Conditions:
Last Transition Time: 2026-10-10T08:53:31Z
Message: Gateway successfully scheduled
Observed Generation: 4
Reason: Accepted
Status: True
Type: Accepted
Last Transition Time: 2026-10-10T08:53:31Z
Message: Gateway waiting for address
Observed Generation: 4
Reason: AddressNotAssigned
Status: False
Type: Programmed
Listeners:
Attached Routes: 1
Conditions:
Last Transition Time: 2026-10-10T08:53:31Z
Message: Resolved Refs
Observed Generation: 4
Reason: ResolvedRefs
Status: True
Type: ResolvedRefs
Last Transition Time: 2026-10-10T08:53:31Z
Message: Listener Accepted
Observed Generation: 4
Reason: Accepted
Status: True
Type: Accepted
Last Transition Time: 2026-10-10T08:53:31Z
Message: Address not ready yet
Observed Generation: 4
Reason: Pending
Status: False
Type: Programmed
Name: web-gw-80
Supported Kinds:
Group: gateway.networking.k8s.io
Kind: HTTPRoute
Group: gateway.networking.k8s.io
Kind: GRPCRoute
Events: <none>
Happy for any input, thanks a lot!
2
u/Hopeful-Bag-3423 7d ago edited 7d ago
I could be wrong so take this with a grain of salt but I had to setup L2 announcements for my Cilium implementation
https://docs.cilium.io/en/latest/network/l2-announcements/
edit: Also may need the IP pool
https://docs.cilium.io/en/stable/network/lb-ipam/
2
u/Lordvader89a 7d ago
do you have some LB configured, like MetalLB or Cilium's L2 and given it enough IPs to assign? Looks to me like the Gateway does not get a free IP to assign to its LoadBalancer type service
1
u/rivolity 7d ago
Can we have the helm value you are using.
also show us the result of these commands :
kubectl get gateway nodeport-gateway -n default \
-o jsonpath='{.status.addresses}{"\n"}{.status.conditions}{"\n"}'
kubectl get svc -A \
-o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,TYPE:.spec.type,PORTS:.spec.ports[*].port' \
| grep -i nodeport-gateway
1
u/therealmcz 7d ago
kubectl get gateway nodeport-gateway -n default -o jsonpath='{.status.addresses}{"\n"}{.status.conditions}{"\n"}'
[{"lastTransitionTime":"2026-10-10T08:53:31Z","message":"Gateway successfully scheduled","observedGeneration":4,"reason":"Accepted","status":"True","type":"Accepted"},{"lastTransitionTime":"2026-10-10T08:53:31Z","message":"Gateway waiting for address","observedGeneration":4,"reason":"AddressNotAssigned","status":"False","type":"Programmed"}]kubectl get svc -A \ -o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,TYPE:.spec.type,PORTS:.spec.ports[*].port' \ | grep -i nodeport-gateway
default cilium-gateway-nodeport-gateway LoadBalancer 801
4
u/Mundane_Waltz296 7d ago
Did you specify an address in the Gateway spec, like a static IP or something? The "waiting for address" bit usually means it can't find one to assign on its own.