TLS passthrough using tlsroute and Listenerset.

[suvarnanith]

Hi All,

I need help as i was trying the TLS PASSTHROUGH using the tlsroute and Listenerset.

I am using the envoy version 1.8.0

TLS Route:

apiVersion: gateway.networking.k8s.io/v1
kind: TLSRoute
metadata:
annotations:
creationTimestamp: "2026-09-15T16:19:55Z"
generation: 1
name: kafkatest
namespace: test
spec:
hostnames:

• kafkatest-1.eiesnad.sbx.aws.kenvue.com
  parentRefs:
• group: gateway.networking.k8s.io
  kind: ListenerSet
  name: plain-ingress-listeners
  namespace: confluent
  sectionName: kafkatest-1
  rules:
• backendRefs:
  • group: ""
    kind: Service
    name: controlcenter-0-internal
    port: 9021
    weight: 1
    status:
    parents:
• conditions:
  • lastTransitionTime: "2026-09-15T16:19:55Z"
    message: Route is accepted
    observedGeneration: 1
    reason: Accepted
    status: "True"
    type: Accepted
  • lastTransitionTime: "2026-09-15T16:19:55Z"
    message: Resolved all the Object references for the Route
    observedGeneration: 1
    reason: ResolvedRefs
    status: "True"
    type: ResolvedRefs
    controllerName: gateway.envoyproxy.io/gatewayclass-controller
    parentRef:
    group: gateway.networking.k8s.io
    kind: ListenerSet
    name: plain-ingress-listeners
    namespace: test
    sectionName: kafkatest

ListenerSet:

apiVersion: v1
items:

• apiVersion: gateway.networking.k8s.io/v1
  kind: ListenerSet
  metadata:
  annotations:
  cert-manager.io/cluster-issuer: sectigo
  creationTimestamp: "2026-09-15T16:19:55Z"
  generation: 6
  name: plain-ingress-listeners
  namespace: test
  spec:
  listeners:
  • allowedRoutes:
    kinds:
    • group: gateway.networking.k8s.io
      kind: TLSRoute
      namespaces:
      from: All
      hostname: kafkatest.eiesnad.sbx.aws.kenvue.com
      name: kafkatest
      port: 9021
      protocol: TLS
      tls:
      mode: Passthrough
      parentRef:
      group: gateway.networking.k8s.io
      kind: Gateway
      name: gateway
      namespace: msp-gateway-api
      status:
      conditions:
  • lastTransitionTime: "2026-09-16T17:13:07Z"
    message: All listeners are accepted
    observedGeneration: 6
    reason: Accepted
    status: "True"
    type: Accepted
  • lastTransitionTime: "2026-09-16T17:13:07Z"
    message: All listeners are programmed
    observedGeneration: 6
    reason: Programmed
    status: "True"
    type: Programmed
    listeners:
  • attachedRoutes: 1
    conditions:
    • lastTransitionTime: "2026-09-16T17:13:07Z"
      message: Sending translated listener configuration to the data plane
      observedGeneration: 6
      reason: Programmed
      status: "True"
      type: Programmed
    • lastTransitionTime: "2026-09-16T17:13:07Z"
      message: Listener has been successfully translated
      observedGeneration: 6
      reason: Accepted
      status: "True"
      type: Accepted
    • lastTransitionTime: "2026-09-16T17:13:07Z"
      message: Listener references have been resolved
      observedGeneration: 6
      reason: ResolvedRefs
      status: "True"
      type: ResolvedRefs
    • lastTransitionTime: "2026-09-16T17:13:07Z"
      message: No conflicts detected
      observedGeneration: 6
      reason: NoConflicts
      status: "False"
      type: Conflicted
      name: kafkatest
      supportedKinds:
    • group: gateway.networking.k8s.io
      kind: TLSRoute
      kind: List
      metadata:
      resourceVersion: ""

Gateway:

apiVersion: v1
items:

• apiVersion: gateway.networking.k8s.io/v1
  kind: Gateway
  metadata:
  annotations:
  creationTimestamp: "2026-09-10T09:02:10Z"
  generation: 1
  name: gateway
  namespace: gateway-api
  spec:
  allowedListeners:
  namespaces:
  from: All
  gatewayClassName: envoy-gatewayclass
  listeners:
  • allowedRoutes:
    namespaces:
    from: Same
    hostname: dummy
    name: http
    port: 80
    protocol: HTTP
    status:
    addresses:
  • type: Hostname
    value: XXXXXXX-cCCCCC0f1.elb.us-east-1.amazonaws.com
    attachedListenerSets: 1
    conditions:
  • lastTransitionTime: "2026-09-15T16:19:55Z"
    message: The Gateway has been scheduled by Envoy Gateway
    observedGeneration: 1
    reason: Accepted
    status: "True"
    type: Accepted
  • lastTransitionTime: "2026-09-15T16:19:55Z"
    message: Address assigned to the Gateway, 2/2 envoy replicas available
    observedGeneration: 1
    reason: Programmed
    status: "True"
    type: Programmed
    listeners:
  • attachedRoutes: 0
    conditions:
    • lastTransitionTime: "2026-09-15T16:19:55Z"
      message: Sending translated listener configuration to the data plane
      observedGeneration: 1
      reason: Programmed
      status: "True"
      type: Programmed
    • lastTransitionTime: "2026-09-15T16:19:55Z"
      message: Listener has been successfully translated
      observedGeneration: 1
      reason: Accepted
      status: "True"
      type: Accepted
    • lastTransitionTime: "2026-09-15T16:19:55Z"
      message: Listener references have been resolved
      observedGeneration: 1
      reason: ResolvedRefs
      status: "True"
      type: ResolvedRefs
      name: http
      supportedKinds:
    • group: gateway.networking.k8s.io
      kind: HTTPRoute
    • group: gateway.networking.k8s.io
      kind: GRPCRoute
      kind: List
      metadata:
      resourceVersion: ""

When i hit the URL i get host not found page. I see that URL is resolving to correct IP.

Want to know if the tlsroute works along with listenerset?

[sueun-dev]

v1.8.0 includes a ListenerSet + TLS passthrough test fixture. Before changing TLS settings, I'd reconcile the references in the pasted objects:

• TLSRoute targets namespace confluent, section kafkatest-1; the shown ListenerSet is in test, with listener kafkatest.
• ListenerSet targets a Gateway in msp-gateway-api; the shown Gateway is in gateway-api.
• Route and listener hostnames start with kafkatest-1 and kafkatest, respectively, with the same suffix. These exact hostnames don't intersect.
• The route's status parentRef says test / kafkatest, unlike its spec.

The Gateway API hostname rule requires an intersection. I tested the extracted v1.8.0 hostname helper offline with analogous names: different exact names produced an empty intersection, while the matching-name control passed. This wasn't a cluster reproduction.

Are those differences anonymization artifacts? A consistent redacted spec/status snapshot would help establish which listener this route actually attaches to before investigating the backend or the "host not found" response.