Gateway deployment controller stops reconciling on Kubernetes 1.36: controller-version annotation patch via /status fails ("name must be provided")

Is this the right place to submit this?

• This is not a security vulnerability or a crashing bug
• This is not a question about how to use Istio

Bug Description

On Kubernetes 1.36, the managed gateway deployment controller never renders or applies the gateway Deployment/Service for a Gateway that doesn't already carry gateway.istio.io/controller-version. As a result, istiod upgrades are silently not propagated to gateway pods. In our cluster the gateway stayed on proxyv2:1.30.3 through upgrades to 1.30.4, 1.31.0 and 1.31.1.

istiod log after every start:

info  gatewaycommon  reconciling gateway with controller istio.io/gateway-controller  gateway=istio-system/shared-gateway
info  gatewaycommon  reconciling  gateway=istio-system/shared-gateway
error controllers  error handling istio-system/shared-gateway, retrying (retry count: 1): update gateway annotation: the name of the object (shared-gateway based on URL) was undeterminable: name must be provided  controller=gateway deployment
...
error controllers  error handling istio-system/shared-gateway, and retry budget exceeded: update gateway annotation: the name of the object (shared-gateway based on URL) was undeterminable: name must be provided  controller=gateway deployment

The Gateway itself is a plain gatewayClassName: istio Gateway created via server-side apply (Terraform kubernetes_manifest) without any annotations.

Root cause (as far as we can tell)

1. ManagedGatewayControllerVersion() returns takeOver=true when the annotation is missing, so configureIstioGateway() calls setGatewayControllerVersion() before rendering. If that call fails, the function returns early and nothing is applied.
2. setGatewayControllerVersion() server-side-applies {"apiVersion":…,"kind":"Gateway","metadata":{"annotations":{…}}} to the status subresource. The body has no metadata.name/namespace.
3. For custom resources, the apiserver wipes metadata changes written through /status. So the annotation was never persisted, not even on older Kubernetes. The Gateway only has a stale managedFields entry (manager: istio.io/gateway-controller, operation: Apply, subresource: status, f:metadata.f:annotations.f:gateway.istio.io/controller-version) while metadata.annotations is empty. Every reconcile therefore takes the takeOver path again.
4. Up to Kubernetes 1.35 that patch succeeded as a no-op, so rendering continued. On 1.36 the apply is rejected with name must be provided, and the controller stops at step 1. This is possibly related to kubernetes/kubernetes#137689, which changed /status metadata reset/ownership handling for CRs.

Timeline in our cluster: the last successful controller apply of the gateway Deployment (per managedFields) was the Istio 1.30.3 upgrade on K8s 1.35 (2026-07-17). After the K8s 1.36 upgrade (2026-08-10), none of the Istio upgrades reached the gateway. The setGatewayControllerVersion() code is identical in 1.30.3, 1.30.4, 1.31.0 and 1.31.1.

Workaround

Set the annotation directly on the main resource:

kubectl -n <ns> annotate gateway <name> gateway.istio.io/controller-version=5

Verified: the annotation change re-queues the gateway, ManagedGatewayControllerVersion returns manage=true, takeOver=false, istiod logs gateway updated, and the Deployment is re-rendered with the current proxy image (1.30.3 → 1.31.1).

Suggested fix

• Include metadata.name/namespace in the apply body, and don't rely on /status for metadata on CRs, since it's always wiped. Either patch the main resource or accept that the annotation can't be written with status-only RBAC.
• At minimum, don't block rendering when writing the version annotation fails. Log it and continue.

Version

$ istioctl version
client version: 1.31.0
control plane version: 1.31.1
data plane version: 1.31.1 (4 proxies)
$ kubectl version
Client Version: v1.35.6
Kustomize Version: v5.7.1
Server Version: v1.36.5
$ helm version --short
v4.2.0+g0646808

Additional Information

• Installed via Helm (ambient profile) through KubeOne, 3-node bare-metal cluster, Cilium CNI
• Gateway API v1.6.2 CRDs
• No istioctl bug-report attached: the cause is fully visible in the istiod log lines and the Gateway's managedFields above. Happy to provide more data if needed.

Affected product area

• Networking
• Upgrade