fix(gatewayapi): keep the parentRef port in route policy ancestors

internal/gatewayapi/backendtrafficpolicy.go

@@ -1008,7 +1008,7 @@ func (t *Translator) processBackendTrafficPolicyForRoute(
 			}
 
 			// Do need a section name since the policy is targeting to a route.
-			ancestorRef := getAncestorRefForPolicy(parentNN, p.SectionName)
+			ancestorRef := getAncestorRefForRouteParent(parentNN, p)
 			ancestorRefs = append(ancestorRefs, &ancestorRef)
 			if parentRefCtx := targetedRoute.GetRouteParentContext(p); parentRefCtx != nil {
 				parentRefCtxs = append(parentRefCtxs, parentRefCtx)
@@ -1038,7 +1038,7 @@ func (t *Translator) processBackendTrafficPolicyForRoute(
 
 			// ListenerSet-attached Route policies report status against the
 			// ListenerSet itself.
-			ancestorRef := getAncestorRefForListenerSetPolicy(parentNN, p.SectionName)
+			ancestorRef := getAncestorRefForRouteParent(parentNN, p)
 			ancestorRefs = append(ancestorRefs, &ancestorRef)
 			if parentRefCtx := targetedRoute.GetRouteParentContext(p); parentRefCtx != nil {
 				parentRefCtxs = append(parentRefCtxs, parentRefCtx)

internal/gatewayapi/contexts.go

@@ -844,10 +844,7 @@ func (r *RouteParentContext) PolicyAncestorRef() gwapiv1.ParentReference {
 		Namespace: NamespaceDerefOr(r.Namespace, r.routeNamespace()),
 		Name:      string(r.Name),
 	}
-	if r.Kind != nil && *r.Kind == resource.KindListenerSet {
-		return getAncestorRefForListenerSetPolicy(parentNN, r.SectionName)
-	}
-	return getAncestorRefForPolicy(parentNN, r.SectionName)
+	return getAncestorRefForRouteParent(parentNN, *r.ParentReference)
 }
 
 func (r *RouteParentContext) routeNamespace() string {

internal/gatewayapi/envoyextensionpolicy.go

@@ -457,7 +457,7 @@ func (t *Translator) processEnvoyExtensionPolicyForRoute(
 			}
 
 			// Do need a section name since the policy is targeting to a route
-			ancestorRef := getAncestorRefForPolicy(parentNN, p.SectionName)
+			ancestorRef := getAncestorRefForRouteParent(parentNN, p)
 			ancestorRefs = append(ancestorRefs, &ancestorRef)
 
 			// Only process parentRefs that were handled by this translator
@@ -488,7 +488,7 @@ func (t *Translator) processEnvoyExtensionPolicyForRoute(
 
 			// ListenerSet-attached Route policies report status against the
 			// ListenerSet itself.
-			ancestorRef := getAncestorRefForListenerSetPolicy(parentNN, p.SectionName)
+			ancestorRef := getAncestorRefForRouteParent(parentNN, p)
 			ancestorRefs = append(ancestorRefs, &ancestorRef)
 
 			// Only process parentRefs that were handled by this translator

internal/gatewayapi/extensionserverpolicy.go

@@ -13,6 +13,7 @@ import (
 
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/sets"
@@ -340,8 +341,7 @@ func (t *Translator) processExtensionServerPolicyForRoute(
 		}
 
 		policyStatus := ExtServerPolicyStatusAsPolicyStatus(policy)
-		gatewayNN := utils.NamespacedName(gtwCtx)
-		ancestorRef := getAncestorRefForPolicy(gatewayNN, p.SectionName)
+		ancestorRef := parentRefCtx.PolicyAncestorRef()
 
 		if !supportedRouteKind {
 			status.SetTranslationErrorForPolicyAncestor(
@@ -529,10 +529,10 @@ func resolveExtServerPolicyRouteTargetRef(
 }
 
 func PolicyStatusToUnstructured(policyStatus gwapiv1.PolicyStatus) map[string]any {
-	ret := map[string]any{}
-	// No need to check the marshal/unmarshal error here
-	d, _ := json.Marshal(policyStatus)
-	_ = json.Unmarshal(d, &ret)
+	// Use the unstructured converter rather than a JSON round trip, so that numbers such as the port of an
+	// ancestorRef are int64 as in any unstructured object, not float64.
+	// No need to check the error here, the policyStatus is a typed object.
+	ret, _ := runtime.DefaultUnstructuredConverter.ToUnstructured(&policyStatus)
 	return ret
 }
 

internal/gatewayapi/helpers.go

@@ -789,6 +789,20 @@ func getAncestorRefForListenerSetPolicy(lsNN types.NamespacedName, sectionName *
 	}
 }
 
+// getAncestorRefForRouteParent returns the Gateway or ListenerSet that a route parentRef refers to
+// as an ancestor reference for a policy targeting the route. It keeps the sectionName and port of
+// the parentRef, so that parentRefs to different listeners of the same parent get their own ancestors.
+func getAncestorRefForRouteParent(parentNN types.NamespacedName, parentRef gwapiv1.ParentReference) gwapiv1.ParentReference {
+	var ref gwapiv1.ParentReference
+	if parentRef.Kind != nil && *parentRef.Kind == resource.KindListenerSet {
+		ref = getAncestorRefForListenerSetPolicy(parentNN, parentRef.SectionName)
+	} else {
+		ref = getAncestorRefForPolicy(parentNN, parentRef.SectionName)
+	}
+	ref.Port = parentRef.Port
+	return ref
+}
+
 // getAncestorRefForGatewayClassPolicy returns a GatewayClass as an ancestor reference for policy.
 // Used when a policy directly targets a GatewayClass, which is only meaningful when the Gateways
 // under that class are merged into a single xDS IR.

internal/gatewayapi/securitypolicy.go

@@ -470,7 +470,7 @@ func (t *Translator) processSecurityPolicyForRoute(
 			}
 
 			// Do need a section name since the policy is targeting to a route.
-			ancestorRef := getAncestorRefForPolicy(parentNN, p.SectionName)
+			ancestorRef := getAncestorRefForRouteParent(parentNN, p)
 			ancestorRefs = append(ancestorRefs, &ancestorRef)
 
 			// Only process parentRefs that were handled by this translator
@@ -502,7 +502,7 @@ func (t *Translator) processSecurityPolicyForRoute(
 
 			// ListenerSet-attached Route policies report status against the
 			// ListenerSet itself.
-			ancestorRef := getAncestorRefForListenerSetPolicy(parentNN, p.SectionName)
+			ancestorRef := getAncestorRefForRouteParent(parentNN, p)
 			ancestorRefs = append(ancestorRefs, &ancestorRef)
 
 			// Only process parentRefs that were handled by this translator

internal/gatewayapi/status/policy.go

@@ -362,6 +362,14 @@ func ancestorRefsEqual(a, b *gwapiv1.ParentReference) bool {
 		return false
 	}
 
+	// Compare Port pointers
+	if (a.Port == nil) != (b.Port == nil) {
+		return false
+	}
+	if a.Port != nil && *a.Port != *b.Port {
+		return false
+	}
+
 	return true
 }
 

internal/gatewayapi/status/policy_test.go

@@ -144,6 +144,39 @@ func TestSetWarningForPolicyAncestorMergesWarnings(t *testing.T) {
 	}
 }
 
+// TestSetConditionForPolicyAncestorPort verifies that ancestors differing only by port are kept
+// apart, as route parentRefs to the same Gateway differing only by port attach to different listeners.
+func TestSetConditionForPolicyAncestorPort(t *testing.T) {
+	const controller = "example.com/controller"
+	policyStatus := &gwapiv1.PolicyStatus{}
+
+	refs := []*gwapiv1.ParentReference{
+		{Name: "gw"},
+		{Name: "gw", Port: new(gwapiv1.PortNumber(80))},
+		{Name: "gw", Port: new(gwapiv1.PortNumber(8080))},
+	}
+	for i, ref := range refs {
+		SetConditionForPolicyAncestor(policyStatus, ref, controller,
+			gwapiv1.PolicyConditionAccepted, metav1.ConditionTrue, gwapiv1.PolicyReasonAccepted, fmt.Sprintf("msg-%d", i), 1)
+	}
+	// Setting a condition on an existing ancestor updates it instead of adding a new one.
+	SetConditionForPolicyAncestor(policyStatus, &gwapiv1.ParentReference{Name: "gw", Port: new(gwapiv1.PortNumber(80))}, controller,
+		gwapiv1.PolicyConditionAccepted, metav1.ConditionFalse, gwapiv1.PolicyReasonInvalid, "updated", 1)
+
+	assert.Len(t, policyStatus.Ancestors, len(refs))
+	for i, ref := range refs {
+		cond := getPolicyAncestorCondition(policyStatus, ref, controller, gwapiv1.PolicyConditionAccepted)
+		if !assert.NotNil(t, cond) {
+			continue
+		}
+		want := fmt.Sprintf("msg-%d", i)
+		if i == 1 {
+			want = "updated"
+		}
+		assert.Equal(t, want, cond.Message)
+	}
+}
+
 func TestSetNotMergedForPolicyAncestor(t *testing.T) {
 	const controller = "example.com/controller"
 	ref := &gwapiv1.ParentReference{Name: "gw-1"}

internal/gatewayapi/testdata/extensions/extensionpolicy-with-httproute-parentrefs-differing-only-by-port.in.yaml

@@ -0,0 +1,122 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    allowedListeners:
+      namespaces:
+        from: All
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: http-8080
+      protocol: HTTP
+      port: 8080
+      allowedRoutes:
+        namespaces:
+          from: All
+listenerSets:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: ListenerSet
+  metadata:
+    namespace: envoy-gateway
+    name: listenerset-1
+  spec:
+    parentRef:
+      name: gateway-1
+    listeners:
+    - name: ls-http-8081
+      protocol: HTTP
+      port: 8081
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: ls-http-8082
+      protocol: HTTP
+      port: 8082
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - foo.example.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      port: 80
+    - namespace: envoy-gateway
+      name: gateway-1
+      port: 8080
+    rules:
+    - matches:
+      - path:
+          value: "/foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - bar.example.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: listenerset-1
+      kind: ListenerSet
+      group: gateway.networking.k8s.io
+      port: 8081
+    - namespace: envoy-gateway
+      name: listenerset-1
+      kind: ListenerSet
+      group: gateway.networking.k8s.io
+      port: 8082
+    rules:
+    - matches:
+      - path:
+          value: "/bar"
+      backendRefs:
+      - name: service-1
+        port: 8080
+extensionServerPolicies:
+# The parentRefs differ only by port, so the policy reports an ancestor for each of them.
+- apiVersion: foo.example.io/v1alpha1
+  kind: Bar
+  metadata:
+    name: policy-1
+    namespace: default
+  spec:
+    targetRef:
+      kind: HTTPRoute
+      group: gateway.networking.k8s.io
+      name: httproute-1
+    data: "attached to an httproute with parentRefs differing only by port"
+
+# The parentRefs to the ListenerSet differ only by port, so the policy reports an ancestor for each of them,
+# against the ListenerSet rather than its parent Gateway.
+- apiVersion: foo.example.io/v1alpha1
+  kind: Bar
+  metadata:
+    name: policy-2
+    namespace: default
+  spec:
+    targetRef:
+      kind: HTTPRoute
+      group: gateway.networking.k8s.io
+      name: httproute-2
+    data: "attached to an httproute with ListenerSet parentRefs differing only by port"