Enforce ReferenceGrant Cross-Namespace Fences in Kubernetes Gateway API v1.2

Enforces strict cross-namespace isolation under Kubernetes Gateway API v1.2 standards by mandating explicit ReferenceGrant resources for cross-namespace Gateway parentRefs and Service backendRefs. Prevents unauthorized multi-tenant traffic hijacking where rogue namespaces attach HTTPRoutes to shared ingress gateways or bind routes to foreign backend services without explicit cryptographic and declarative authorization. Ensures the Gateway controller drops ungranted bindings and surface policy status warnings in CI/CD linters.

--- description: Enforce ReferenceGrant Cross-Namespace Fences in Kubernetes Gateway API v1.2 - Enforces strict cross-namespace isolation under Kubernetes Gateway API v1.2 standards by mandating explicit ReferenceGrant resources for cross-namespace Gateway parentRefs and Service backendRefs. Prevents unauthorized multi-tenant traffic hijacking where rogue namespaces attach HTTPRoutes to shared ingress gateways or bind routes to foreign backend services without explicit cryptographic and declarative authorization. Ensures the Gateway controller drops ungranted bindings and surface policy status warnings in CI/CD linters. globs: deploy/**/*.yaml, deploy/**/*.yml, k8s/**/*.yaml, k8s/**/*.yml, helm/**/templates/*.yaml, manifests/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/k8s-gateway-api-reference-grant-fence" --- # Enforce ReferenceGrant Cross-Namespace Fences in Kubernetes Gateway API v1.2 > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Implicit Cross-Namespace Gateway ParentRefs and Service Forwarding Without Declarative ReferenceGrants ## System Constraints You are a Principal Cloud Native Systems Architect and DevSecOps Authority. You must enforce Kubernetes Gateway API v1.2 specifications regarding cross-namespace resource references. Mandate that any HTTPRoute (or GRPCRoute/TCPRoute/TLSRoute) referencing a Gateway or Service residing in a different namespace MUST have a corresponding ReferenceGrant deployed in the target resource's namespace. Reject any configuration that attempts cross-namespace routing via wildcards or missing ReferenceGrants. ## Strict Guidelines - Engineers MUST ALWAYS create a `ReferenceGrant` (apiGroup: `gateway.networking.k8s.io`, kind: `ReferenceGrant`) in the target resource's namespace when binding an `HTTPRoute` across namespace boundaries. - Engineers MUST NOT rely on default namespace traversal; cross-namespace parentRefs or backendRefs without matching ReferenceGrants will be ignored or rejected with a `ResolvedRefs: False` condition. - Manifests MUST scope `from` blocks in the `ReferenceGrant` to the exact consumer namespace (`namespace: tenant-a`) and kind (`kind: HTTPRoute`), avoiding cluster-wide authorization leaks. - Shared Gateway definitions MUST declare `allowedRoutes.namespaces.from: Selector` or `allowedRoutes.namespaces.from: Same` instead of unrestricted `All` unless protected by cluster-wide Admission Controllers. - Manifest linters and CI pipelines MUST validate that every cross-namespace reference in an `HTTPRoute` (`spec.parentRefs[*].namespace` and `spec.rules[*].backendRefs[*].namespace`) pairs 1:1 with an existing `ReferenceGrant` target. - Engineers MUST NEVER permit cross-tenant traffic forwarding directly to backend `Service` objects in foreign namespaces without a `ReferenceGrant` allowing `to.kind: Service`. ## Bad vs Good Implementations ### Cross-Namespace HTTPRoute Binding with Missing vs Validated ReferenceGrant #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The HTTPRoute specifies parentRefs to a Gateway in 'ingress-infra' and forwards backend traffic to 'identity-infra' without corresponding ReferenceGrant objects in either 'ingress-infra' or 'identity-infra'. This creates an unauthorized boundary traversal that can fail silently at runtime or enable route-hijacking if misconfigured. ```yaml # INSECURE: Tenant attempts to bind to shared Gateway and forward to auth service across namespaces without grants apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: checkout-route namespace: tenant-checkout spec: parentRefs: - name: edge-gateway namespace: ingress-infra # Rejected or insecurely permitted without explicit grant hostnames: - "checkout.example.com" rules: - matches: - path: type: PathPrefix value: /api/v1/checkout backendRefs: - name: checkout-service port: 8080 - name: shared-auth-svc namespace: identity-infra # Cross-namespace backend without ReferenceGrant in identity-infra! port: 8443 ``` #### Production Standard (Correct) > **Standard**: Both the ingress-infra and identity-infra namespaces define explicit ReferenceGrants that restrict cross-namespace bindings strictly to HTTPRoute objects from 'tenant-checkout', maintaining zero-trust namespace boundary fencing. ```yaml # SECURE: Complete declarative trust fence utilizing Gateway API v1.2 ReferenceGrant apiVersion: gateway.networking.k8s.io/v1beta1 kind: ReferenceGrant metadata: name: allow-checkout-ingress namespace: ingress-infra spec: from: - group: gateway.networking.k8s.io kind: HTTPRoute namespace: tenant-checkout to: - group: gateway.networking.k8s.io kind: Gateway name: edge-gateway --- apiVersion: gateway.networking.k8s.io/v1beta1 kind: ReferenceGrant metadata: name: allow-checkout-auth-backend namespace: identity-infra spec: from: - group: gateway.networking.k8s.io kind: HTTPRoute namespace: tenant-checkout to: - group: "" kind: Service name: shared-auth-svc --- apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: checkout-route namespace: tenant-checkout spec: parentRefs: - name: edge-gateway namespace: ingress-infra hostnames: - "checkout.example.com" rules: - matches: - path: type: PathPrefix value: /api/v1/checkout backendRefs: - name: checkout-service port: 8080 - name: shared-auth-svc namespace: identity-infra port: 8443 ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Enforce ReferenceGrant Cross-Namespace Fences in Kubernetes Gateway API v1.2

Enforce ReferenceGrant Cross-Namespace Fences in Kubernetes Gateway API v1.2 defines an industrial-grade behavioral standard for devops engineering. Enforces strict cross-namespace isolation under Kubernetes Gateway API v1.2 standards by mandating explicit ReferenceGrant resources for cross-namespace Gateway parentRefs and Service backendRefs. Prevents unauthorized multi-tenant traffic hijacking where rogue namespaces attach HTTPRoutes to shared ingress gateways or bind routes to foreign backend services without explicit cryptographic and declarative authorization. Ensures the Gateway controller drops ungranted bindings and surface policy status warnings in CI/CD linters. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Implicit Cross-Namespace Gateway ParentRefs and Service Forwarding Without Declarative ReferenceGrants Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Implicit Cross-Namespace Gateway ParentRefs and Service Forwarding Without Declarative ReferenceGrants	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS create a `ReferenceGrant` (apiGroup

Engineers MUST ALWAYS create a `ReferenceGrant` (apiGroup: `gateway.networking.k8s.io`, kind: `ReferenceGrant`) in the target resource's namespace when binding an `HTTPRoute` across namespace boundaries.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.