feat: support section name in policies, and add tests for all attachment types.

[yuval-k]

Description

Handle attachment edge cases, and allow policies to target section names.

Change Type

/kind feature

Changelog

Allow TrafficPolicy to targetRef using section name.

Additional Notes

Behavior after this PR:

• Route policies never attach to the envoy-listener (i.e. filters on the listener are disabled; so that without a per-filter route config they do nothing
• Route Policies that target ref a gateway will go on the route configuration
• Route policies that target a section will go on:
  • for http - on the virtual host
  • for https - on the route configuration

Main implication is that HCM plugins can't attach to http plain text listeners by section name, because the http filter chain is shared. (But does work on tls).
Option to address this is to remove section name from the http listener policy.

Additional changes

• Updated traffic policy to place filters on the specific filter chain.
• Made getTargetingPolicies to not return policies without a section name when a section name is requested. instead we use envoy's hierarchy to get the same data plane behaviour.

[Copilot]

Pull Request Overview

This PR adds edge-case tests for ext-auth policies and enhances policy targeting by introducing section names, updating how filters are attached per filter chain.

• Add a new test entry for TrafficPolicy edge cases in gateway translator tests
• Extend data structures and logic to carry and match SectionName for policy attachments
• Refactor trafficPolicyPluginGwPass to track per-filter-chain state and disable/enable filters accordingly

Reviewed Changes

Copilot reviewed 55 out of 55 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
internal/kgateway/translator/gateway/gateway_translator_test.go	Added table entry for TrafficPolicy edge cases
internal/kgateway/setup/testdata/standard/*.yaml	Updated expected YAML to include disabled: true and typedPerFilterConfig per chain
internal/kgateway/query/httproute.go	Extended UniqueRouteName to accept an optional ruleName
internal/kgateway/krtcollections/policy.go	Incorporated SectionName in targetRefs indexing and lookup
internal/kgateway/extensions2/pluginutils/policy.go	Propagate SectionName into IR conversion
internal/kgateway/extensions2/plugins/trafficpolicy/traffic_policy_plugin.go	Refactored to use maps keyed by filter-chain and track per-chain provider state
internal/kgateway/extensions2/plugins/trafficpolicy/extauth_policy_test.go	Updated tests to supply FilterChainName context
install/helm/kgateway-crds/templates/*.yaml	Added sectionName field in CRD schemas
api/v1alpha1/*.go	Added SectionName to API types and updated deep copy methods
api/applyconfiguration/*.go	Added SectionName in apply configurations

Comments suppressed due to low confidence (3)

internal/kgateway/extensions2/plugins/trafficpolicy/traffic_policy_plugin.go:261

• [nitpick] The name ProviderNeededMap is generic. Consider renaming it to something more descriptive, e.g. FilterChainProviderMap, to clarify its purpose.

type ProviderNeededMap struct {

internal/kgateway/extensions2/plugins/trafficpolicy/traffic_policy_plugin.go:507

• [nitpick] The plugin name returned is routepolicies but this extension now handles a broader traffic policy. Consider updating it to trafficpolicies to reflect its intent and avoid confusion.

func (p *TrafficPolicy) Name() string {

internal/kgateway/query/httproute.go:103

• The signature of UniqueRouteName now takes an extra ruleName argument. Consider adding unit tests for when ruleName is non-empty to cover the new branch.

func (r *RouteInfo) UniqueRouteName(ruleIdx, matchIdx int, ruleName string) string {

[yuval-k]

i noticed some multi listener tests are flakey due to ordering; i'll fix that; but otherwise ready for review

[lgadban]

code review is WIP but can you we change the PR title to reflect there are actual functional changes (i.e. it's not just tests) and also i think the PR description is slightly out of order or unintentional

[shashankram]

Could you pre-merge the policies per GK here so that it is easier to invoke a Merge() on them within the loop

	attachedPolicies := ir.AttachedPolicies{
		Policies: map[schema.GroupKind][]ir.PolicyAtt{},
	}
       attachedHttpPolicies.Append(h.gw.AttachedHttpPolicies, h.attachedPolicies)

[shashankram]

Do you need to MergePolicies when pass.MergePolicies != nil?