Can a Single Envoy Controller Manage Multiple GatewayClasses and Gateways with Different Envoy Proxies?

[riyaz-apica]

Multiple GatewayClasses per Single Controller

Can a single Envoy Gateway controller can manage multiple GatewayClasses, each with their own Gateway(s) and dedicated EnvoyProxy configurations.

for example, i need different LB configurations per individual Gateway (not per GatewayClass), im attaching the EnvoyProxy directly to each Gateway via infrastructure.parametersRef as per the doc.
clear picture:
GatewayClass A → Gateway (NLB config via EnvoyProxy)
GatewayClass B → Gateway (ALB/internal config via EnvoyProxy)
Both managed by the same single controller.

my major concerns:
it will work ?
Can One Gateway/GatewayClass Harm Another?

Note:
I'm getting this from the envoy gateway assistant,
There is a known issue worth being aware of: when a single controller manages multiple GatewayClasses using ClusterIP service type, Gateway status can intermittently flap to Programmed: False with reason AddressNotAssigned. The root cause hypothesis is a race condition in the controller when multiple GatewayClasses are reconciled concurrently. [Gateway Status Issue]

To avoid the known issues if I use single gateway class with multiple gateway which having there on envoypoxy with different LB under a single controller . it can help to sort out the issues. because i'm not passing any config to gatewayclass and i will attach envoypoxy config directly to gateway by infrastructure.parametersRef.

envoy assistant answer:

Your reasoning is logical, but the knowledge sources do not explicitly confirm that using a single GatewayClass with multiple Gateways (each with EnvoyProxy attached via infrastructure.parametersRef) would definitively avoid the AddressNotAssigned flapping issue.

What the knowledge sources do tell us about the issue:

The flapping was observed in Envoy Gateway v1.6.2 with a setup of multiple GatewayClasses under a single controller, all using ClusterIP service type. [Gateway Status Issue]
The root cause hypothesis is a race condition during concurrent reconciliation of multiple GatewayClasses. [Gateway Status Issue]
The user who reported the issue noted that upgrading to v1.6.3 (which included a fix for a server run race condition causing goroutine leaks during config reloading) appeared to resolve the flapping. [Gateway Status Issue]

What This Means for Your Approach
If the race condition is tied specifically to multiple GatewayClasses being reconciled concurrently, then using a single GatewayClass could theoretically reduce exposure to that specific race. However, the knowledge sources do not explicitly validate this as a confirmed workaround.

can please give me a proper idea and solution. i want to implement envoy gateway into my cluster if I have multiple different application running in different namespace.

[zirain]

Actually, we're using multiple GCs during our tests(e2e, conformance, upgrade, resilience etc.)

[riyaz-apica]

Issue with Single Envoy Gateway Controller Managing Multiple GatewayClasses

We observed an issue in a single Envoy Gateway controller setup.

Scenario:
We are running multiple GatewayClasses, each with its own EnvoyProxy configuration attached. For each GatewayClass, we create Gateway API resources that are used by different applications.

However, we noticed an unexpected behavior. When one EnvoyProxy configuration (attached to a specific GatewayClass) was accidentally deleted, it caused issues not only for the Gateways associated with that particular GatewayClass but also affected other Gateways that were using different GatewayClasses with valid EnvoyProxy configurations.

This resulted in disruptions across multiple applications, even though their configurations were correct.

Concern:
Our goal is to run multiple Gateways within a single Kubernetes cluster to manage different applications while maintaining proper isolation at the namespace level. Ideally, a failure or misconfiguration in one GatewayClass or its EnvoyProxy configuration should not impact other Gateways or applications that are correctly configured.

Could you help clarify why this behavior occurs and whether there is a recommended approach or best practice to ensure proper isolation between multiple GatewayClasses and their EnvoyProxy configurations when using a single Envoy Gateway controller?

[zirain]

However, we noticed an unexpected behavior. When one EnvoyProxy configuration (attached to a specific GatewayClass) was accidentally deleted, it caused issues not only for the Gateways associated with that particular GatewayClass but also affected other Gateways that were using different GatewayClasses with valid EnvoyProxy configurations.

sounds like a bug, can you create an issue with repro steps?

[riyaz-apica]

If this is a bug then its very critical right ,
we cant use it in production.
then i want to create multiple controller for different gateway class: sounds not good!

[zirain]

there're lots of users(include our e2e) use mutliple GCs in one controller, I didn't hear what your said too much.
That's why I asked you share the reproducible steps/yamls.