
- How to interpret Gateway API resource conditions and status fields.
- A step-by-step debugging workflow for common failure scenarios.
- Typical misconfigurations and how to detect them quickly.
- Observability tips: events, logs, and metrics to inspect.
- Best practices to avoid recurring issues in Gateway API deployments.
Start troubleshooting by checking resource Status and Conditions, then move outward: controller logs → Kubernetes events → network connectivity. This structured approach reduces guesswork and speeds remediation.
- Accepted / Programmed: The controller has accepted the configuration and provisioned data plane state.
- ResolvedRefs: References to backend resources (Services, Secrets) were successfully resolved.
- Detached / DetachedFromGateway: The route or listener is not attached to a Gateway; check selectors and namespaces.
- Rejected: The controller cannot use the configuration (policy, validation error, or unsupported features).
- Unknown / Pending: The controller has not yet reconciled or is still processing the resource.
- Validate resource definitions
- Confirm API versions and object schemas match the Gateway API version your controller expects.
- Use
kubectl getandkubectl describeto view statuses and conditions for Gateways, Listeners, Routes, and Services.
- Check Gateway controller status and logs
- Identify the controller Pod(s) and inspect logs for reconciliation errors or warnings.
- Look for messages about unsupported features, validation failures, or resource conflicts.
- Inspect Kubernetes events and conditions
kubectl get events --all-namespacesandkubectl describe <resource>provide immediate hints (e.g., missing TLS secrets, unresolved backend refs).
- Validate routing and attachment
- Ensure Routes match Gateway Listeners (hostname, port, protocol) and that selectors match the Gateway’s labels.
- Verify that Routes show an Attached/Accepted condition when expected.
- Check backend connectivity
- Confirm Services resolve to healthy Endpoints and Pods, and that network policies or firewall rules permit traffic.
- Verify data plane (ingress/controller) configuration
- If using a specific implementation (NGINX, Fabric Gateway, Contour, etc.), inspect the implementation’s generated config and metrics.
- Escalate with observability data
- Collect controller logs, events, and, if available, data-plane config snapshots and metrics for deeper analysis.
When troubleshooting in production, avoid making broad or disruptive changes without a rollback plan. Use canary or staging environments to validate fixes first.
- Inspect a Gateway and its status:
kubectl describe gateway <name> -n <namespace>
- Inspect an HTTPRoute:
kubectl describe httproute <name> -n <namespace>
- Check controller logs:
kubectl logs -n <controller-namespace> <controller-pod>
- Examine Events:
kubectl get events -n <namespace> --sort-by=.metadata.creationTimestamp
- Gateway API specification: https://gateway-api.sigs.k8s.io/
- Kubernetes documentation: https://kubernetes.io/docs/
- NGINX Gateway / Fabric Gateway docs: https://www.nginx.com/ (search for your implementation)