EnvoyPatchPolicy with JSONPatch blocks xDS updates when target objects don’t exist (control plane stuck) #8151
Description
Description:
Creating an EnvoyPatchPolicy that targets a SecurityPolicy-backed OAuth2 filter works once the SecurityPolicy exists, but if the EnvoyPatchPolicy is created first (while the SecurityPolicy does not exist), the control
plane gets stuck: other resources (HTTPRoutes) stop producing new xDS, and the Envoy configuration never updates.
Expected behavior: the control plane should log the error but remain healthy and continue generating xDS for unrelated resources.
Repro steps:
- Create the following EnvoyPatchPolicy (no SecurityPolicy yet):
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyPatchPolicy
metadata:
name: foo
spec:
jsonPatches:
- name: default/ingress/https
operation:
jsonPath: $..http_filters[?match(@.name, "non-existing-filter/.*")].typed_config.config.credentials
op: replace
path: /cookie_names
value:
bearer_token: baz
type: type.googleapis.com/envoy.config.listener.v3.Listener
targetRef:
group: gateway.networking.k8s.io
kind: Gateway
name: ingress
type: JSONPatchThe status shows the programmed condition is "false" with an error, which is expected, but the other resources such as HTTPRoutes also stop producing new xDS.
- lastTransitionTime: "2026-02-02T02:27:21Z"
message: 'No jsonPointers were found while evaluating the jsonPath: ''$..http_filters[?match(@.name,
"non-existing-filter/.*")].typed_config.config.credentials''. Ensure the elements
you are trying to select with the jsonPath exist in the document. If you need
to add a non-existing property, use the ''path'' attribute.
- Do not create the referenced SecurityPolicy.
- Create or update unrelated HTTPRoutes.
Environment:
Envoy Gateway version: v1.6.3
Logs:
Envoy Gateway log:
2026-02-02T02:27:21.393Z ERROR xds runner/runner.go:323 failed to translate xds ir {"runner": "xds", "trace_id": "16f51cfa80dcacffcc2cf19eb45db6ae", "span_id": "37569daa11b959d0", "error": "no jsonPointers were found while evaluating the jsonPath: '$..http_filters[?match(@.name, \"non-existing-filter/.*\")].typed_config.config.credentials'. Ensure the elements you are trying to select with the jsonPath exist in the document. If you need to add a non-existing property, use the 'path' attribute"}