Policy controller question

[artyom-p]

Hi, im trying to integrate linkerd with our existing setup, we have Coutour as ingress, we use gateway-api 1.3.
linkerd-destination pod's policy controller is unable to start as it constantly prints warnings about unknown gateway api HttRoute filter. In our case its CORS filter, cors filter was added in gwapi 1.3, and linkerd doesnt support that version yet, but we need that filter, we have quite a lot routes already depending on this filter, so downgrade is not an option.

2025-11-13T07:54:15.258173Z  INFO httproutes.gateway.networking.k8s.io: kubert::errors: stream failed error=failed to perform initial object list: Error deserializing response
2025-11-13T07:54:20.267115Z  WARN httproutes.gateway.networking.k8s.io: kube_client::client:......Error("unknown variant `CORS`, expected one of `RequestHeaderModifier`, `ResponseHeaderModifier`, `RequestMirror`, `RequestRedirect`, `URLRewrite`, `ExtensionRef`", line: 1, column: 3026)

Is there a way to use selectors to specify which httroutes are allowed to parse and which not? or maybe polciy controller can be disabled or tuned?

[mg1986jp]

Looks like the policy controller is crashing because it's trying to watch HTTPRoute resources and encountering CORS filter types that it doesn't recognize. Linkerd's policy controller uses its own gateway-api CRD definitions and probably doesn't know about filters added in 1.3.

Since downgrading gwapi isn't an option, one workaround that might help: separate your HTTPRoute resources so the ones with CORS filters aren't in namespaces that Linkerd's policy controller is watching. If you're using linkerd inject selectively (not cluster-wide), the policy controller should only care about routes in meshed namespaces.

If that's not feasible, you could try disabling the policy controller's gateway-api HTTPRoute watch by setting policyController.gatewayAPI.enabled=false in the Linkerd Helm values. You'd lose Server/ServerAuthorization based on HTTPRoute matching, but if you're using Contour for routing anyway and only need Linkerd for mTLS + observability, that might be acceptable.

The real fix is Linkerd updating to support gateway-api 1.3. I believe there's ongoing work on this but the gateway-api dependency bump tends to lag a few months behind the spec releases.