feat: policy field owner by kkk777-7 · Pull Request #8538 · envoyproxy/gateway

kkk777-7 · 2026-03-17T16:17:32Z

What this PR does / why we need it:
follow up #7918

introduce PolicyFieldOwners to fixes below issues when parent/route Policy merge

handle LocalObjectReference/BackendRef correctly
handle IR Config name correctly

Which issue(s) this PR fixes:

Fixes #

Release Notes: No

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

netlify · 2026-03-17T16:17:55Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`d1df896`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69b9ff4dacdaf9000842ca58
😎 Deploy Preview	https://deploy-preview-8538--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2026-03-17T16:28:24Z

Codecov Report

❌ Patch coverage is 87.02290% with 17 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.21%. Comparing base (efa9021) to head (d1df896).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/gatewayapi/securitypolicy.go	86.40%	8 Missing and 9 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8538      +/-   ##
==========================================
+ Coverage   74.16%   74.21%   +0.04%     
==========================================
  Files         242      242              
  Lines       37624    37708      +84     
==========================================
+ Hits        27903    27984      +81     
+ Misses       7773     7771       -2     
- Partials     1948     1953       +5

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

kkk777-7 · 2026-03-17T16:49:02Z

internal/gatewayapi/testdata/securitypolicy-with-merge-multi-gateway-same-listener.in.yaml

    - port: 9001
      name: http
      protocol: TCP
-referenceGrants:


this PR fixes unnecessary refGrant.

Gateway Policy (ns/envoy-gateway) has extAuth setting and auth-service exist in envoy-gateway.

Previously, during the merge, it was treated as spec of route policy, which meant that references from different namespaces.

kkk777-7 · 2026-03-17T16:49:42Z

internal/gatewayapi/testdata/securitypolicy-with-merge-multi-gateway-same-listener.in.yaml

  type: Opaque
  data:
    .htpasswd: dXNlcjE6e1NIQX15LzJzWUFqNXlyUUlONFRMMFlkUGRtR05LcGM9
- apiVersion: v1


this PR fixes unnecessary secret in Route ns.

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 · 2026-03-17T17:09:02Z

internal/gatewayapi/testdata/securitypolicy-with-merge-needs-fieldowner.out.yaml

+          prefix: /foo
+        security:
+          basicAuth:
+            name: securitypolicy/envoy-gateway/policy-for-gateway


merge policy can resolve parent policy's auth ref and generate IR name correctly.

kkk777-7 · 2026-03-17T17:10:08Z

internal/gatewayapi/testdata/securitypolicy-with-merge-needs-fieldowner.out.yaml

+            grpc:
+              authority: grpc-backend.envoy-gateway:9000
+              destination:
+                metadata:


merge policy can resolve parent policy's ext auth backendRef and generate IR name correctly.

kkk777-7 · 2026-03-17T17:10:51Z

internal/gatewayapi/testdata/securitypolicy-with-merge-needs-fieldowner.out.yaml

+            cookieSuffix: 811c9dc5
+            hmacSecret: '[redacted]'
+            logoutPath: /logout
+            name: securitypolicy/envoy-gateway/policy-for-gateway


merge policy can resolve parent policy's oidc refs and generate IR name correctly.

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

zhaohuabing · 2026-03-19T02:18:04Z

internal/gatewayapi/securitypolicy.go


-	if contextExtensions, err = t.buildContextExtensions(policy.Spec.ExtAuth.ContextExtensions, policy.Namespace); err != nil {
+	ownerPolicy := resolvePolicyFieldOwner(fieldOwners, spFieldExtAuthContextExtensions, policy)
+	if contextExtensions, err = t.buildContextExtensions(policy.Spec.ExtAuth.ContextExtensions, ownerPolicy.Namespace); err != nil {


We'll need a per-entry owner map for ContextExtensions. It may contain ContextExtension valueRefs from different namespaces after merging.

thanks for comment :)

Yes, while checking the CRD markers, I initially thought the same thing as your comment.
https://github.com/envoyproxy/gateway/blob/main/api/v1alpha1/ext_auth_types.go#L73-L78

But, while adding SecurityPolicy to tests for the policy merge function, I confirmed that ContextExtensions is merged by replacing the entire array.
(add test file utils/testdata/securitypolicy_all in this PR)

Let me know if I missing sometheing. Or is the entire-array replacement a separate issue?

On second thought, full-array replacement might be the correct behavior, since this is part of ExtAuth.

cc @maxbrunet

rudrakhp · 2026-03-19T09:45:42Z

internal/gatewayapi/securitypolicy.go

+	routePolicy *egv1a1.SecurityPolicy,
+	parentPolicy *egv1a1.SecurityPolicy,
+) PolicyFieldOwners[*egv1a1.SecurityPolicy] {
+	// Route policy owners are applied last so they override parent owners when both define the same field key.


Isn't it possible that some of the resources under a path that is a list might belong to route while some others might belong to parent? For example if Spec.JWT.Providers are merged from both route and parent who will be the owner of this field?

thanks, that’s a good point.

I had the same concern, so I checked how merging behaves in SP (utils/testdata/securitypolicy_all in this PR).
I confirmed that all list fields are merged by replacing the entire array.

If we will add any list field that is not merged via full-array replacement, we would need a per-entry ownership map.

Full-array replacement within an auth method seems the right default for me. Merging inner properties across different levels is error-prone, as the fields are often interrelated and shouldn’t be merged implicitly.

feat: policy field owner

24ad4d5

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 commented Mar 17, 2026

View reviewed changes

kkk777-7 force-pushed the fix-merge-policy-ref branch from 233556d to 3a7dc97 Compare March 17, 2026 16:54

update gatewayapi test input

c9abe3a

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 force-pushed the fix-merge-policy-ref branch from 3a7dc97 to c9abe3a Compare March 17, 2026 17:06

kkk777-7 commented Mar 17, 2026

View reviewed changes

kkk777-7 added 2 commits March 18, 2026 09:35

fix lint

678c747

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

fix comments and docs

d1df896

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 marked this pull request as ready for review March 18, 2026 06:36

kkk777-7 requested a review from a team as a code owner March 18, 2026 06:36

kkk777-7 added this to the v1.8.0-rc.1 Release milestone Mar 18, 2026

zhaohuabing reviewed Mar 19, 2026

View reviewed changes

arkodg requested a review from rudrakhp March 19, 2026 07:04

rudrakhp reviewed Mar 19, 2026

View reviewed changes

zhaohuabing requested a review from a team March 24, 2026 02:09

Conversation

kkk777-7 commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

codecov bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kkk777-7 Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kkk777-7 commented Mar 17, 2026 •

edited

Loading

netlify bot commented Mar 17, 2026 •

edited

Loading

codecov bot commented Mar 17, 2026 •

edited

Loading

zhaohuabing Mar 19, 2026 •

edited

Loading

kkk777-7 Mar 19, 2026 •

edited

Loading