# Namespace isolation failing: Controller watching wrong Gateway Proxy Service (KongUpstreamPolicy)

**URL:** <https://discuss.konghq.com/t/namespace-isolation-failing-controller-watching-wrong-gateway-proxy-service-kongupstreampolicy/13835>\
**Category:** Questions\
**Tags:** kubernetes, kong-gateway\
**Created:** [December 3, 2025, 7:17am UTC](https://discuss.konghq.com/t/namespace-isolation-failing-controller-watching-wrong-gateway-proxy-service-kongupstreampolicy/13835 "2025-12-03T07:17:05Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sudhir\_Jaiswal](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/sudhir_jaiswal/32/4685_2.png) [@Sudhir\_Jaiswal](https://discuss.konghq.com/u/Sudhir_Jaiswal)\
**Post date:** [December 3, 2025, 7:17am UTC](https://discuss.konghq.com/t/namespace-isolation-failing-controller-watching-wrong-gateway-proxy-service-kongupstreampolicy/13835/1 "2025-12-03T07:17:05Z")

</div>

We have 2 Kong Gateway’s setup in single GKE cluster. To isolate the Gateway’s. we have created the seperate GatewayClass, Gateways, Controller and IngressControllerClass further we have added the watchNamespace paramater and set rbac clusterroles to false. Still getting the below error when we restart the kong controller.  
If we restart kong controller from namespace-1. It is throwing controllers.KongUpstreamPolicy error while trying to accesskong gateway proxy from another namespace.  
`error	controllers.KongUpstreamPolicy	Failed to retrieve Service in watch predicates	{“Service”: “namespace-2/kong-gateway-proxy-ns2”, “error”: “unable to get: namespace-2/kong-gateway-proxy-ns2 because of unknown namespace for the cache”}`

no such behaviour is observed on namespace-2 when namespace-2 kong controller is restarted  
kong-controller version = 3.2