Support Gateway API ListenerSet (GEP-1713)

[roxannelandry]

Welcome!

• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've searched similar issues on the Traefik community forum and didn't find any.

What did you expect to see?

When using Gateway API with cert-manager, the cert-manager.io/cluster-issuer annotation on the Gateway applies to all listeners. There's no way to exclude specific listeners that need manually-managed certificates (e.g., partner-provided certificates).

Proposition

Support for GEP-1713 ListenerSet (currently XListenerSet in the experimental channel as of Gateway API v1.3.0).

This would enable:

• Delegating listener configuration to different namespaces
• Per-ListenerSet annotations (allowing some ListenerSets to use cert-manager while others use manual certificates)
• Better multi-tenant gateway management
• Exceeding the 64 listener limit per Gateway

Environment

• Traefik version: v3.6.7
• Gateway API CRDs: v1.3.0 experimental channel
• kubernetesGateway.experimentalChannel: true is already configured
• Additional context

The XListenerSet CRD (xlistenersets.gateway.networking.x-k8s.io/v1alpha1) is installed and resources can be created, but Traefik does not currently recognize or process them (status shows Unknown).

Running: kubectl get xlistenersets -A 
NAMESPACE   NAME                             ACCEPTED   PROGRAMMED   AGE
default             listeners                         Unknown       Unknown             24m
default             manual-cert-listeners   Unknown       Unknown             24m

Status:
  Conditions:
    Last Transition Time:  1970-01-01T00:00:00Z
    Message:               Waiting for controller
    Reason:                Pending
    Status:                Unknown
    Type:                  Accepted
    Last Transition Time:  1970-01-01T00:00:00Z
    Message:               Waiting for controller
    Reason:                Pending
    Status:                Unknown
    Type:                  Programmed
Events:                    <none>

[nmengin]

Hey @roxannelandry

Thanks for your suggestion, we think it makes a lot of sense.
We put it on our maintainers plate.

[roxannelandry]

Do we have an estimate for when this could be done?
I’m trying to decide whether to implement a workaround for now or wait, since this is blocking our migration from NGINX to Traefik.

Also, how do you handle releases? I see some features we need are already in master but haven’t made it into a release yet.

[nmengin]

Hey @roxannelandry,

This is definitely on our radar.

Gateway API is a hot topic for us, and support for ListenerSets, expected to land in the standard channel with Gateway API v1.5, is already on our backlog.

That said, we’re currently focused on other priorities (mainly expanding NGINX annotations support), so we don’t have an ETA to share yet, even though this is something we fully intend to work on.

As for the features already available on master (including the NGINX annotations currently under development), we don’t have a timeline to share either, but we’re doing our best to move things forward as quickly as possible.

We’ll keep you updated as soon as we’re able to make progress.

[roxannelandry]

Alright thank you for that 👍🏽 Have a nice one!

[localleon]

Hey @nmengin, is there a general issue tracking all Gateway API v1.5 changes for Traefik?

rc-2 for v1.5 has been released and includes some exiting feating (additionally TLSRoute in Standard Channel). See https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.5.0-rc.2 for more info

[nmengin]

Hey @localleon,

There's no dedicated issue for this yet, but rest assured — Gateway API is very much on our radar and something we care deeply about moving forward on.

That said, as mentioned earlier in this thread, our current focus is on expanding NGINX annotation support, so we don't have a concrete ETA to share just yet.
It's sitting high up in our backlog though, and we'll get to it as soon as we can.

Stay tuned! 😄

[mydoomfr]

Hello folks, I just wanted to provide a little update on ListenerSet

• Gateway API v1.5.0 (released Feb 27, 2026): ListenerSet has graduated from XListenerSet (experimental) to ListenerSet in the Standard channel as v1 (GA).
• cert-manager v1.20.0 (released Mar 10, 2026): Added support for ListenerSets via a feature gate.

Both Gateway API and cert-manager are now ready and the missing piece is Traefik support.

Many teams are actively migrating away from ingress-nginx to Gateway API-based ingress controllers. Traefik is a natural choice for these migrations, and ListenerSet support will be essential for multi-tenant cluster administrators who need per-listener certificate management and cross-namespace delegation.

[nmengin]

Hey there,

Improving our Gateway API support, including ListenerSet, is on our short-term roadmap.
We'll keep you updated on our advancement through this issue.

[mydoomfr]

@nmengin Thank you for the update!

For what it's worth, I've implemented ListenerSet support in a fork and have been running it in my homelab for the past two weeks without issues. I don't feel particularly legitimate opening a PR, but if it can help move things forward or serve as a reference, the branch is here: https://github.com/mydoomfr/traefik/tree/gep-1713-listenerset-v2

HTTPRoute & ListenerSet example with .status

---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: prometheus
  namespace: monitoring
spec:
  parentRefs:
    - name: prometheus-external
      kind: ListenerSet
      sectionName: https-prometheus
  hostnames:
    - prometheus.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /oauth2/
      backendRefs:
        - name: oauth2-proxy
          namespace: oauth2-proxy
          port: 4180
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: monitoring-kube-prometheus-prometheus
          port: 9090
      filters:
        - type: ExtensionRef
          extensionRef:
            group: traefik.io
            kind: Middleware
            name: oauth2-forwardauth

apiVersion: gateway.networking.k8s.io/v1
kind: ListenerSet
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
  creationTimestamp: "2026-03-12T12:56:10Z"
  generation: 1
  labels:
    kustomize.toolkit.fluxcd.io/name: monitoring
    kustomize.toolkit.fluxcd.io/namespace: flux-system
  name: prometheus-external
  namespace: monitoring
  resourceVersion: "304319748"
  uid: 135cf532-90a1-4ccf-9b9a-d30e3e929904
spec:
  listeners:
  - allowedRoutes:
      namespaces:
        from: Same
    hostname: prometheus.example.com
    name: https-prometheus
    port: 8443
    protocol: HTTPS
    tls:
      certificateRefs:
      - group: ""
        kind: Secret
        name: prometheus-external-tls
      mode: Terminate
  parentRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: homelab-external
    namespace: traefik
status:
  conditions:
  - lastTransitionTime: "2026-03-12T12:59:51Z"
    message: ListenerSet accepted
    observedGeneration: 1
    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: "2026-03-12T12:59:51Z"
    message: ListenerSet programmed
    observedGeneration: 1
    reason: Programmed
    status: "True"
    type: Programmed
  listeners:
  - attachedRoutes: 1
    conditions:
    - lastTransitionTime: "2026-03-12T12:59:51Z"
      message: No error found
      observedGeneration: 1
      reason: Accepted
      status: "True"
      type: Accepted
    - lastTransitionTime: "2026-03-12T12:59:51Z"
      message: No error found
      observedGeneration: 1
      reason: ResolvedRefs
      status: "True"
      type: ResolvedRefs
    - lastTransitionTime: "2026-03-12T12:59:51Z"
      message: No error found
      observedGeneration: 1
      reason: Programmed
      status: "True"
      type: Programmed
    name: https-prometheus
    supportedKinds:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
    - group: gateway.networking.k8s.io
      kind: GRPCRoute

[nmengin]

Hey @mydoomfr,

Thanks for weighing in!
If you'd like to contribute, opening a PR would be a great way to help accelerate this.
We're happy to review and work through it with you.