Namespace isolation failing: Controller watching wrong Gateway Proxy Service (KongUpstreamPolicy)

We have 2 Kong Gateway’s setup in single GKE cluster. To isolate the Gateway’s. we have created the seperate GatewayClass, Gateways, Controller and IngressControllerClass further we have added the watchNamespace paramater and set rbac clusterroles to false. Still getting the below error when we restart the kong controller.
If we restart kong controller from namespace-1. It is throwing controllers.KongUpstreamPolicy error while trying to accesskong gateway proxy from another namespace.
error controllers.KongUpstreamPolicy Failed to retrieve Service in watch predicates {“Service”: “namespace-2/kong-gateway-proxy-ns2”, “error”: “unable to get: namespace-2/kong-gateway-proxy-ns2 because of unknown namespace for the cache”}

no such behaviour is observed on namespace-2 when namespace-2 kong controller is restarted
kong-controller version = 3.2

1 Like