Description:

When a Gateway has both an HTTPS listener (TLS terminate, no hostname) and a TCP or TLS listener on the same port, and the TCP/TLS listener has no routes attached, Envoy rejects the xDS listener update with a duplicate filter chain matcher error.

The error is continuous and blocks all xDS updates for the affected listener, meaning any subsequent configuration changes to that listener are also rejected until a route is added.

Expected behaviour: a TCP or TLS listener with no routes but a specific hostname should not conflict with other listeners on the same port.

Repro steps:

Apply the manifest below to a cluster running Envoy Gateway. No TLSRoute is created for the tls-passthrough listener.

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: repro
  namespace: default
spec:
  gatewayClassName: envoy-gateway
  listeners:
  - name: https
    port: 443
    protocol: HTTPS
    allowedRoutes:
      namespaces:
        from: All
    tls:
      mode: Terminate
      certificateRefs:
      - kind: Secret
        name: repro-cert
  - name: tls-passthrough
    port: 443
    protocol: TLS
    hostname: '*.example.com'
    allowedRoutes:
      namespaces:
        from: All
      kinds:
      - group: gateway.networking.k8s.io
        kind: TLSRoute
    tls:
      mode: Passthrough

Check the Envoy proxy pod logs — the xDS update is rejected immediately.

Adding a TLSRoute that attaches to the tls-passthrough listener resolves the error, confirming the issue is specific to the no-routes case.

Environment:

• Envoy Gateway: 1.8.1
• Envoy Proxy: 1.38.2

Logs:

  [warning][config] delta config for type.googleapis.com/envoy.config.listener.v3.Listener rejected: Error adding/updating listener(s) tcp-443: error adding listener '0.0.0.0:10443': filter
  chain 'EmptyCluster' has the same matching rules defined as 'default/repro/https'. duplicate matcher is: {}
  [warning][config] gRPC config for type.googleapis.com/envoy.config.listener.v3.Listener rejected: Error adding/updating listener(s) tcp-443: error adding listener '0.0.0.0:10443': filter
  chain 'EmptyCluster' has the same matching rules defined as 'default/repro/https'. duplicate matcher is: {}