The TLS cipher settings for ClientTrafficPolicy do not support equal-preference groups.

[jing8956]

Description:
In version 1.7.x, I enabled TLS 1.1 by modifying the default cipher suites listed in the documentation.
After upgrading to version 1.8.3, the TLS ciphers defined in the ClientTrafficPolicy became invalid.
The error message reads:

TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]

Repro steps:

1. Create the following policy：

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
  name: eg
spec:
  tls:
    # To maintain compatibility with okhttp 2.X, downgrade to HTTP/1.1.
    alpnProtocols:
      - http/1.1
    minVersion: "1.1"
    ciphers:
    - '[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]'
    - '[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]'
    - ECDHE-ECDSA-AES256-GCM-SHA384
    - ECDHE-RSA-AES256-GCM-SHA384
    # Due to the need to support Windows Server 2008, it is necessary to enable TLS 1.1.
    - ECDHE-ECDSA-AES128-SHA
    - ECDHE-RSA-AES128-SHA
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: eg

2. Run kubectl describe ClientTrafficPolicy eg

Environment:
Envoy Gateway 1.8.3

Logs:

Status:
  Ancestors:
    Ancestor Ref:
      Group:      gateway.networking.k8s.io
      Kind:       Gateway
      Name:       eg
      Namespace:  default
    Conditions:
      Last Transition Time:  2026-08-06T04:10:03Z
      Message:               TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
TLS: unsupported cipher suite: [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305].
      Observed Generation:  9
      Reason:               Invalid
      Status:               False
      Type:                 Accepted
    Controller Name:        gateway.envoyproxy.io/gatewayclass-controller

Mitigation Solution
Separate ciphers that in the equal-preference groups:

    ciphers:
    - ECDHE-ECDSA-AES128-GCM-SHA256
    - ECDHE-ECDSA-CHACHA20-POLY1305
    - ECDHE-RSA-AES128-GCM-SHA256
    - ECDHE-RSA-CHACHA20-POLY1305

[arkodg]

cc @zhaohuabing