A Kubernetes Gateway API pattern that consolidates routing rules from multiple HTTPRoute resources when they target the same backend services. It reduces the number of managed gateway services and can simplify operations in large environments, but it also changes service naming and should be enabled deliberately.
Expanded Definition
Combined HTTP Routes is a Kubernetes Gateway API behaviour that merges routing intent from multiple Gateway API HTTPRoute objects when they point to the same backend services. In practice, it changes how traffic policy is represented and how route ownership is understood. The pattern is useful when organisations want fewer gateway-facing objects, more consistent routing, and less operational duplication across teams or clusters.
In NHI and service identity contexts, the key concern is not just traffic flow but the identities behind that flow. When Combined HTTP Routes is enabled, naming, ownership, and policy boundaries may shift, which can affect service discovery, authorization logic, and audit trails. This is why the pattern should be treated as an explicit governance choice rather than a convenience setting. The term is still applied inconsistently across platforms, and no single standard governs implementation details beyond the underlying Gateway API model. NHI Management Group treats this as an identity-adjacent routing optimisation that must be reviewed alongside backend trust relationships, secrets access, and policy inheritance, as described in the Ultimate Guide to NHIs.
The most common misapplication is assuming combined routes are a pure performance feature, which occurs when operators enable it without checking how route consolidation alters service naming, policy scope, and ownership boundaries.
Examples and Use Cases
Implementing Combined HTTP Routes rigorously often introduces a governance tradeoff, requiring organisations to weigh simpler gateway operations against the risk of obscuring which team, workload, or identity is actually responsible for a route.
- A platform team consolidates multiple application routes that all target the same internal API service, reducing gateway object sprawl while preserving backend reachability.
- A multi-team cluster uses route combination to standardise ingress behavior, but only after aligning ownership labels and review workflows so changes can be traced back to the correct service identity.
- A security team evaluates whether consolidated routes still enforce the intended access boundaries for machine-to-machine traffic before promoting the change to production.
- An operations team uses route consolidation to simplify day-2 management in a large environment, then validates that observability tools still distinguish individual service consumers.
Because route combination can affect how traffic is attributed, teams often compare it with identity and policy controls discussed in Ultimate Guide to NHIs and with traffic governance concepts in the NIST Cybersecurity Framework 2.0. That comparison helps determine whether the operational savings are worth the loss of route granularity.
Why It Matters in NHI Security
Combined HTTP Routes matters because NHI security depends on accurate mapping between workloads, services, and the identities that authenticate them. When routing rules are merged, a hidden side effect can be weaker attribution: a service account, API key, or workload identity may continue to function through a consolidated entry point even when the original route ownership is unclear. That creates blind spots for least privilege, monitoring, and incident response.
The risk becomes more serious in environments where NHI governance is already weak. NHI Management Group reports that only 5.7% of organisations have full visibility into their service accounts, and 97% of NHIs carry excessive privileges, making any change that obscures route ownership especially sensitive. Combined routing can be safe, but only when paired with tight access review, clear service naming, and explicit policy validation. It should be aligned with identity control expectations in the NIST Cybersecurity Framework 2.0 and the operational lessons documented in the Ultimate Guide to NHIs.
Organisations typically encounter the operational cost of combined routing only after a misrouted request, audit gap, or ownership dispute, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 | Route consolidation can hide service ownership and weaken NHI visibility. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access depends on clear route and identity boundaries. |
| NIST Zero Trust (SP 800-207) | SP 3 | Zero Trust requires explicit trust decisions even when routes are consolidated. |
| NIST SP 800-63 | Digital identity guidance supports strong assurance for machine access paths. | |
| CSA MAESTRO | Agentic and service orchestration needs clear control over shared routing paths. |
Document combined routes, preserve ownership mapping, and review backend identity access after consolidation.
