ObservabilityPolicy: got TargetConflict error when creating ObservabilityPolicy for two totally seperated applications

[hongyecc]

Describe the bug
`I am playing around the gateway fabric and trying to configure tracing for my applications. With one application, the configuration worked fine. But with two applications in two different namespaces, I am getting:

ObservabilityPolicy for app1 is complaining app2:
Message: Policy cannot be applied to target "app2/app2" since another Route "app2/app2" shares a hostname:port/path combination with this target
Observed Generation: 2
Reason: TargetConflict

ObservabilityPolicy for app2 is complaining app1:
Message: Policy cannot be applied to target "app1/app1" since another Route "app1/app1" shares a hostname:port/path combination with this target
Observed Generation: 1
Reason: TargetConflict
`
To Reproduce
Steps to reproduce the behavior:

1. HTTPToutes:
   `apiVersion: v1
   items:

• apiVersion: gateway.networking.k8s.io/v1
  kind: HTTPRoute
  metadata:
  creationTimestamp: "2025-05-14T21:04:22Z"
  generation: 12
  name: app1
  namespace: app1
  resourceVersion: "60634620"
  uid: 823cfaf9-9306-403c-abde-532430422792
  spec:
  hostnames:
  • app1.playground.testapis.net
    parentRefs:
  • group: gateway.networking.k8s.io
    kind: Gateway
    name: central-gateway
    namespace: nginx-gateway
    rules:
  • backendRefs:
    • group: ""
      kind: Service
      name: app1
      namespace: app1
      port: 50080
      weight: 1
      filters:
    • extensionRef:
      group: gateway.nginx.org
      kind: SnippetsFilter
      name: app1-logging
      type: ExtensionRef
    • extensionRef:
      group: gateway.nginx.org
      kind: SnippetsFilter
      name: app1-ratelimit
      type: ExtensionRef
      matches:
    • path:
      type: PathPrefix
      value: /
      status:
      parents:
  • conditions:
    • lastTransitionTime: "2025-05-23T14:05:58Z"
      message: The route is accepted
      observedGeneration: 12
      reason: Accepted
      status: "True"
      type: Accepted
    • lastTransitionTime: "2025-05-23T14:05:58Z"
      message: All references are resolved
      observedGeneration: 12
      reason: ResolvedRefs
      status: "True"
      type: ResolvedRefs
      controllerName: gateway.nginx.org/nginx-gateway-controller
      parentRef:
      group: gateway.networking.k8s.io
      kind: Gateway
      name: central-gateway
      namespace: nginx-gateway
• apiVersion: gateway.networking.k8s.io/v1
  kind: HTTPRoute
  metadata:
  creationTimestamp: "2025-05-23T13:47:37Z"
  generation: 2
  name: app2
  namespace: app2
  resourceVersion: "60634618"
  uid: c975562d-7241-43cb-9bba-b22bb2e0a3cc
  spec:
  hostnames:
  • app2.playground.testapis.net
    parentRefs:
  • group: gateway.networking.k8s.io
    kind: Gateway
    name: central-gateway
    namespace: nginx-gateway
    rules:
  • backendRefs:
    • group: ""
      kind: Service
      name: app2
      namespace: app2
      port: 51080
      weight: 1
      filters:
    • extensionRef:
      group: gateway.nginx.org
      kind: SnippetsFilter
      name: app2-logging
      type: ExtensionRef
      matches:
    • path:
      type: PathPrefix
      value: /
      status:
      parents:
  • conditions:
    • lastTransitionTime: "2025-05-23T14:05:58Z"
      message: The route is accepted
      observedGeneration: 2
      reason: Accepted
      status: "True"
      type: Accepted
    • lastTransitionTime: "2025-05-23T14:05:58Z"
      message: All references are resolved
      observedGeneration: 2
      reason: ResolvedRefs
      status: "True"
      type: ResolvedRefs
      controllerName: gateway.nginx.org/nginx-gateway-controller
      parentRef:
      group: gateway.networking.k8s.io
      kind: Gateway
      name: central-gateway
      namespace: nginx-gateway`

ObservabilityPolicy configs:
`apiVersion: v1
items:

• apiVersion: gateway.nginx.org/v1alpha2
  kind: ObservabilityPolicy
  metadata:
  creationTimestamp: "2025-05-22T18:23:49Z"
  generation: 2
  name: app1-observability
  namespace: app1
  resourceVersion: "60627544"
  uid: 241ba77f-7860-4bb7-832e-32e393ced533
  spec:
  targetRefs:
  • group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: app1
    tracing:
    ratio: 100
    spanAttributes:
    • key: app1
      value: app1
      strategy: ratio
      status:
      ancestors:
  • ancestorRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: app1
    namespace: app1
    conditions:
    • lastTransitionTime: "2025-05-23T13:47:37Z"
      message: Policy cannot be applied to target "app2/app2" since another Route
      "app2/app2" shares a hostname:port/path combination with this target
      observedGeneration: 2
      reason: TargetConflict
      status: "False"
      type: Accepted
      controllerName: gateway.nginx.org/nginx-gateway-controller
• apiVersion: gateway.nginx.org/v1alpha2
  kind: ObservabilityPolicy
  metadata:
  creationTimestamp: "2025-05-23T14:30:03Z"
  generation: 1
  name: app2-observability
  namespace: app2
  resourceVersion: "60643831"
  uid: cdd669f5-17dc-43f8-91a0-8966cc1bad83
  spec:
  targetRefs:
  • group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: app2
    tracing:
    ratio: 100
    spanAttributes:
    • key: app2
      value: app2
      strategy: ratio
      status:
      ancestors:
  • ancestorRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: app2
    namespace: app2
    conditions:
    • lastTransitionTime: "2025-05-23T14:30:04Z"
      message: Policy cannot be applied to target "app1/app1" since another Route
      "app1/app1" shares a hostname:port/path combination with this target
      observedGeneration: 1
      reason: TargetConflict
      status: "False"
      type: Accepted
      controllerName: gateway.nginx.org/nginx-gateway-controller
      kind: List
      metadata:
      resourceVersion: ""`

Your environment

• Version of the NGINX Gateway Fabric - release version or a specific commit. The first line of the nginx-gateway container logs includes the commit info.
  {"level":"info","ts":"2025-05-23T13:00:37Z","msg":"Starting NGINX Gateway Fabric in static mode","version":"1.6.2","commit":"532db6a20b2912fe397211eef9f8d564d46a4bdd","date":"2025-03-11T17:28:32Z","dirty":"false"}
• Version of Kubernetes
  Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3 Server Version: v1.31.8
• Kubernetes platform: AKS
• Details on how you expose the NGINX Gateway Fabric Pod (e.g. Service of type LoadBalancer or port-forward)
• Logs of NGINX container: kubectl -n <nginx-deployment-namespace> logs deployments/<nginx-deployment>
• NGINX Configuration: kubectl -n <nginx-deployment-namespace> exec -it deployments/<nginx-deployment> -- nginx -T

Additional context
Following section was injected in http.conf file:
`otel_exporter {
⤑ endpoint opentelemetry-collector-i.estapis.net:4317;
}

otel_service_name ngf:nginx-gateway:central-gateway;
split_clients $otel_trace_id $otel_ratio_100 {
⤑ 100% on;
⤑ * off;
}`

[bjee19]

Hey @hongyecc , thanks for submitting this issue. I'm currently trying to reproduce the issue, however I'm having some difficulty.

Do you think you could provide the yaml file for the Gateway you deployed? Also having the yaml files for the HTTPRoutes/Observability policies would help a lot, but aren't necessary.

[hongyecc]

@bjee19 thanks for looking into the problem ... here is the gateway yaml I used. Feel free to let me know if you need anything else
`
apiVersion: v1
items:

• apiVersion: gateway.networking.k8s.io/v1
  kind: Gateway
  metadata:
  creationTimestamp: "2025-05-12T23:40:47Z"
  generation: 1
  name: central-gateway
  namespace: nginx-gateway
  resourceVersion: "60627545"
  uid: ab0610f2-4685-4a5b-a78a-f8420969fa54
  spec:
  gatewayClassName: nginx
  listeners:
  • allowedRoutes:
    namespaces:
    from: All
    hostname: '*.playground.testapis.net'
    name: http
    port: 80
    protocol: HTTP
  • allowedRoutes:
    namespaces:
    from: All
    hostname: '*.playground.testapis.net'
    name: https
    port: 443
    protocol: HTTPS
    tls:
    certificateRefs:
    • group: ""
      kind: Secret
      name: playground.testapis.net
      namespace: nginx-gateway
      mode: Terminate
      `