Symptoms
On clusters that have both the Istio service mesh add-on and App Routing (web application routing) enabled, but without the managed Gateway API installed, the App Routing operator pod enters CrashLoopBackOff. Because the operator can't start, it never reconciles NGINX ingress — so App Routing shows as enabled on the resource, but no ingress resources are created/updated. Existing, already-programmed NGINX traffic continues to serve (data plane is unaffected); only the control plane (reconciliation of new/changed ingress) is impacted.
Affected configuration
- Istio service mesh add-on: enabled
- App Routing: enabled
- Managed Gateway API: not installed
Cause
The operator was being started with Gateway TLS integration enabled whenever the Istio mesh add-on was present. That makes it watch gateway.networking.k8s.io resources at startup; on clusters without the Gateway API CRDs (which the mesh add-on alone does not install), its informer cache fails to populate and the operator crashes before it can reconcile.
Workarounds
Either of the following unblocks the operator:
- Enable the managed Gateway API on the cluster, or
- Install the Gateway API CRDs yourself (
gateway.networking.k8s.io).
Fix
A fix that only enables the Gateway TLS integration when the managed Gateway API is installed is rolling out imminently. This issue will be updated as the rollout completes; no action is required once the fix reaches your region if you're using one of the workarounds above.
Symptoms
On clusters that have both the Istio service mesh add-on and App Routing (web application routing) enabled, but without the managed Gateway API installed, the App Routing operator pod enters
CrashLoopBackOff. Because the operator can't start, it never reconciles NGINX ingress — so App Routing shows as enabled on the resource, but no ingress resources are created/updated. Existing, already-programmed NGINX traffic continues to serve (data plane is unaffected); only the control plane (reconciliation of new/changed ingress) is impacted.Affected configuration
Cause
The operator was being started with Gateway TLS integration enabled whenever the Istio mesh add-on was present. That makes it watch
gateway.networking.k8s.ioresources at startup; on clusters without the Gateway API CRDs (which the mesh add-on alone does not install), its informer cache fails to populate and the operator crashes before it can reconcile.Workarounds
Either of the following unblocks the operator:
gateway.networking.k8s.io).Fix
A fix that only enables the Gateway TLS integration when the managed Gateway API is installed is rolling out imminently. This issue will be updated as the rollout completes; no action is required once the fix reaches your region if you're using one of the workarounds above.