gateway request send to 1/2 ready pod

[krju13]

Hello,
I’m using Envoy Gateway v1.8.0 and observed that an HTTPRoute sends requests to a Pod even though the Pod is not Ready.
The Pod has two containers. Container A is not ready, while container B is ready and serves traffic on port 8000. Since one container is not ready, the Pod is 1/2 Ready. The Service used by the HTTPRoute targets container B’s port.
Here is My test pod and service, httproute rule.

apiVersion: v1
kind: ConfigMap
metadata:
  name: readiness-demo-app
  namespace: test 
data:
  app.py: |
    import os
    from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer

    PORT = int(os.environ.get("PORT", "8080"))
    READY = os.environ.get("READY", "false").lower() == "true"

    class Handler(BaseHTTPRequestHandler):
        def do_GET(self):
            if self.path in ("/liveness", "/healthz"):
                code, body = 200, b"alive\n"
            elif self.path in ("/readiness", "/v1/onrsvc/health_check/"):
                code = 200 if READY else 503
                body = b"ready\n" if READY else b"not ready\n"
            else:
                code, body = 404, b"not found\n"
            self.send_response(code)
            self.send_header("Content-Type", "text/plain; charset=utf-8")
            self.send_header("Content-Length", str(len(body)))
            self.end_headers()
            self.wfile.write(body)

        def log_message(self, fmt, *args):
            print("%s - %s" % (self.address_string(), fmt % args), flush=True)

    print(f"Listening on :{PORT}; READY={READY}", flush=True)
    ThreadingHTTPServer(("0.0.0.0", PORT), Handler).serve_forever()
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: readiness-demo
  namespace: test 
  labels:
    app: readiness-demo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: readiness-demo
  template:
    metadata:
      labels:
        app: readiness-demo
    spec:
      containers:
        # Simulates the container whose readiness endpoint fails.
        - name: container-a-not-ready
          image: python:3.12-slim
          command: ["python", "-u", "/app/app.py"]
          env:
            - name: PORT
              value: "8080"
            - name: READY
              value: "false"
          ports:
            - name: a-http
              containerPort: 8080
          readinessProbe:
            httpGet:
              path: /readiness
              port: 8080
            failureThreshold: 3
            periodSeconds: 2
            successThreshold: 1
            timeoutSeconds: 2
          startupProbe:
            httpGet:
              path: /liveness
              port: 8080
            failureThreshold: 720
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
            - name: app
              mountPath: /app
              readOnly: true
        # Simulates the container whose readiness endpoint succeeds.
        - name: container-b-ready
          image: python:3.12-slim
          command: ["python", "-u", "/app/app.py"]
          env:
            - name: PORT
              value: "8000"
            - name: READY
              value: "true"
          ports:
            - name: b-http
              containerPort: 8000
          readinessProbe:
            httpGet:
              path: /v1/onrsvc/health_check/
              port: 8000
            initialDelaySeconds: 5
            failureThreshold: 6
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 5
          volumeMounts:
            - name: app
              mountPath: /app
              readOnly: true
      volumes:
        - name: app
          configMap:
            name: readiness-demo-app
---
# This Service selects the Pod, not an individual container. Its EndpointSlice
# should therefore mark the Pod endpoint not ready while container A is unready.
apiVersion: v1
kind: Service
metadata:
  name: readiness-demo
  namespace: test 
spec:
  selector:
    app: readiness-demo
  ports:
    - name: http
      port: 80
      targetPort: b-http
---
# Replace the Gateway name/namespace below with the Gateway you want to test.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: readiness-demo
  namespace: test 
spec:
  parentRefs:
    - name: eg-common
      namespace: default
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /v1/onrsvc/health_check/
      backendRefs:
        - name: readiness-demo
          port: 80

Observed Pod status:

NAME                                READY   STATUS    RESTARTS   AGE
readiness-demo-886c4b969-8njvm      1/2     Running   0          2m26s

Observed EndpointSlice:

endpoints:
- addresses:
  - 10.244.53.253
  conditions:
    ready: false
    serving: false
    terminating: false
  targetRef:
    kind: Pod
    name: readiness-demo-886c4b969-8njvm
    namespace: test
ports:
- name: http
  port: 8000
  protocol: TCP

The corresponding Endpoints resource has no addresses:

NAME             ENDPOINTS
readiness-demo   <none>

However, a request to /v1/onrsvc/health_check/ through the Gateway succeeds. The Envoy access log shows that the request was sent to the Pod IP on port 8000 and received an HTTP 200 response:

{
  "path": "/v1/onrsvc/health_check/",
  "status": 200,
  "response_code_detail": "via_upstream",
  "upstream_cluster": "httproute/test/readiness-demo/rule/0",
  "upstream_host": "10.244.53.253:8000",
  "upstream_response_length": 159,
  "time": "2026-10-23T02:25:04.063Z"
}

The HTTPRoute references the readiness-demo Service, whose targetPort is the named port b-http on container B (port 8000).

Expected behavior
I expected Envoy Gateway not to send traffic to this Pod.

Questions

1. Is this expected behavior in Envoy Gateway v1.8.0?
2. How can I configure gateway api I expected?

[krju13]

sorry. I found the way.

here is the how to solve this problem.

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
  name: disable-panic
  namespace: test
spec:
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: HTTPRoute          # or Gateway, GRPCRoute
    name: readiness-demo
  healthCheck:
    panicThreshold: 0  

this makes the gateway return 503 no healty upstaeam.