feat(securitypolicy): add MergeType support for policy merging

[rajatvig]

Add MergeType field to SecurityPolicy to enable policy merging similar
to BackendTrafficPolicy. This allows route-level policies to merge with
parent Gateway/Listener policies rather than completely overriding them.

Fixes #6734

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name	Link
🔨 Latest commit	7e10a97
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69a8d106a9ec340008b1eba4

[codecov]

Codecov Report

❌ Patch coverage is 81.25000% with 33 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.17%. Comparing base (80eb3f9) to head (7e10a97).
⚠️ Report is 10 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/gatewayapi/securitypolicy.go	81.25%	29 Missing and 4 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7918      +/-   ##
==========================================
- Coverage   74.18%   74.17%   -0.01%     
==========================================
  Files         242      242              
  Lines       37310    37438     +128     
==========================================
+ Hits        27678    27771      +93     
- Misses       7698     7730      +32     
- Partials     1934     1937       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[rajatvig]

@arkodg @kkk777-7 The PR is ready. Please do review when you have bandwidth. The E2E tests for the feature are passing, CI seems to have a bit of flakiness.

[kkk777-7]

Hi @rajatvig , thanks for working on this!
I left some comments.

[rajatvig]

@rajatvig Sorry, there’s one point I missed in the last review. I left a comment, so could you please take a look?

Just fixed the last bit I think.

[rajatvig]

@kkk777-7 @zhaohuabing Does this look good now? Any other points I need to address?

[rudrakhp]

Note that you might need to handle refs from parent policy after merge, see #8210 that fixes ref resolution for merged BTPs.

[rajatvig]

Note that you might need to handle refs from parent policy after merge, see #8210 that fixes ref resolution for merged BTPs.

@rudrakhp From what I could gather looking at the code, it would mostly affect secrets when the parent policy refers to a secret that the merged policy tries looking up in the route's namespace.

There is an issue #8094 tracking that. Would it be ok to resolve this as part of that issue?

[rudrakhp]

@rajatvig it will affect not only secrets but any LocalObjectReference, I would recommend waiting on #8210 attempting to provide a generic way to handle local object references in merge scenarios.

[kkk777-7]

@rajatvig
Sorry for the late reply, and thank you so much for working on this PR for such a long time.
I left one comment.
please, could you confirm and resolve conflict?

Although there are still some issues we need to address, I think it might be fine to tackle them in a follow-up PR (and I can take care of them as well if needed).

• handle LocalObjectReference with merge
• handle IR Config name

[rajatvig]

@kkk777-7 I will find time today or at the latest tomorrow to address it if that works.

[rajatvig]

@rajatvig Sorry for the late reply, and thank you so much for working on this PR for such a long time. I left one comment. please, could you confirm and resolve conflict?

Although there are still some issues we need to address, I think it might be fine to tackle them in a follow-up PR (and I can take care of them as well if needed).

• handle LocalObjectReference with merge
• handle IR Config name

I addressed the issue (I think). I can try and hack on both as well over the weekend. Is there an issue for those? I have the similar issue for ClientTrafficPolicy which I think I should be able to work on after. Would that work?

[kkk777-7]

LGTM, thanks!

[kkk777-7]

LocalObjectRef is #8094. (this issue is not only secret, contains some ref)

I have the similar issue for ClientTrafficPolicy which I think I should be able to work on after.

do you mean this issue?

I think we should improve merge logic and fix some issues before extending merge scope.
so it would be appreciated if you work on the issues (LocalObjectRef, IRConfig name) first.

[kkk777-7]

/retest

[rajatvig]

LocalObjectRef is #8094. (this issue is not only secret, contains some ref)

I have the similar issue for ClientTrafficPolicy which I think I should be able to work on after.

do you mean this issue?

I think we should improve merge logic and fix some issues before extending merge scope.

so it would be appreciated if you work on the issues (LocalObjectRef, IRConfig name) first.

Will do. I think I did see an issue about using interfaces when using merges and yes, will fix what exists and then extend.

[rudrakhp]

LGTM. Assuming handling LocalObjectRef during merges will be handled in a follow up as in current state accessing refs from child policy ns is broken.