fix: scope BackendTrafficPolicy attachment by targetRef group/kind

Matching only by name allowed a policy to attach across resource kinds
when names collide (e.g. a ServiceImport-targeted policy attaching to a
Service backend). Validate the targetRef group/kind against the backend
ref (applying Gateway API defaults: empty group, Service kind) before
matching.

Author: AlinsRan

internal/adc/translator/httproute_test.go

@@ -401,6 +401,25 @@ func TestAttachBackendTrafficPolicyToUpstreamSectionName(t *testing.T) {
 			},
 			wantScheme: apiv2.SchemeHTTPS,
 		},
+		{
+			name: "targetRef kind mismatch does not attach to a same-named service",
+			ref:  newRef(webPort),
+			policies: map[types.NamespacedName]*v1alpha1.BackendTrafficPolicy{
+				{Namespace: namespace, Name: "p"}: {
+					ObjectMeta: metav1.ObjectMeta{Name: "p", Namespace: namespace},
+					Spec: v1alpha1.BackendTrafficPolicySpec{
+						TargetRefs: []v1alpha1.BackendPolicyTargetReferenceWithSectionName{{
+							LocalPolicyTargetReference: gatewayv1alpha2.LocalPolicyTargetReference{
+								Name: gatewayv1alpha2.ObjectName(serviceName),
+								Kind: gatewayv1alpha2.Kind("ServiceImport"),
+							},
+						}},
+						Scheme: apiv2.SchemeHTTPS,
+					},
+				},
+			},
+			wantScheme: "",
+		},
 	}
 
 	translator := NewTranslator(logr.Discard())

internal/adc/translator/policies.go

@@ -29,6 +29,7 @@ import (
 	adctypes "github.com/apache/apisix-ingress-controller/api/adc"
 	"github.com/apache/apisix-ingress-controller/api/v1alpha1"
 	apiv2 "github.com/apache/apisix-ingress-controller/api/v2"
+	internaltypes "github.com/apache/apisix-ingress-controller/internal/types"
 )
 
 func convertBackendRef(namespace, name, kind string) gatewayv1.BackendRef {
@@ -43,6 +44,17 @@ func (t *Translator) AttachBackendTrafficPolicyToUpstream(ref gatewayv1.BackendR
 	if len(policies) == 0 {
 		return
 	}
+	// Resolve the backend ref group/kind, applying the Gateway API defaults
+	// (empty group = core, Service kind) so a targetRef is only matched against
+	// a backend of the same resource type.
+	refGroup := ""
+	if ref.Group != nil {
+		refGroup = string(*ref.Group)
+	}
+	refKind := internaltypes.KindService
+	if ref.Kind != nil {
+		refKind = string(*ref.Kind)
+	}
 	// A targetRef with sectionName scopes the policy to a specific Service port
 	// (matched by port name). It takes precedence over a whole-Service targetRef
 	// (no sectionName) that matches the same backend.
@@ -55,6 +67,12 @@ func (t *Translator) AttachBackendTrafficPolicyToUpstream(ref gatewayv1.BackendR
 			if ref.Name != targetRef.Name {
 				continue
 			}
+			if targetRef.Group != "" && string(targetRef.Group) != refGroup {
+				continue
+			}
+			if targetRef.Kind != "" && string(targetRef.Kind) != refKind {
+				continue
+			}
 			if targetRef.SectionName != nil && *targetRef.SectionName != "" {
 				if backendRefMatchesSectionName(ref, po.Namespace, string(*targetRef.SectionName), services) {
 					specificPolicy = po