feat: validate targetRefs group and skip sectionName for L4RoutePolicy

Add an XValidation rule requiring targetRefs.group to be
gateway.networking.k8s.io so invalid targets fail fast instead of being
silently ignored by the controller.

L4 routes expose no addressable sections, so a targetRef that pins a
sectionName cannot be honored. Ignore such refs when accepting a policy
(ProcessL4RoutePolicy) and when attaching plugins (AttachL4RoutePolicyPlugins)
to keep status and dataplane behavior consistent.

Author: AlinsRan

api/v1alpha1/l4routepolicy_types.go

@@ -30,6 +30,7 @@ type L4RoutePolicySpec struct {
 	// +kubebuilder:validation:MinItems=1
 	// +kubebuilder:validation:MaxItems=16
 	// +kubebuilder:validation:XValidation:rule="self.all(r, r.kind == 'TCPRoute' || r.kind == 'UDPRoute' || r.kind == 'TLSRoute')",message="targetRefs kind must be TCPRoute, UDPRoute, or TLSRoute"
+	// +kubebuilder:validation:XValidation:rule="self.all(r, r.group == 'gateway.networking.k8s.io')",message="targetRefs group must be gateway.networking.k8s.io"
 	TargetRefs []gatewayv1alpha2.LocalPolicyTargetReferenceWithSectionName `json:"targetRefs"`
 
 	// Plugins is the list of APISIX stream plugins to attach to the targeted L4 routes.

config/crd/bases/apisix.apache.org_l4routepolicies.yaml

@@ -119,6 +119,8 @@ spec:
                 - message: targetRefs kind must be TCPRoute, UDPRoute, or TLSRoute
                   rule: self.all(r, r.kind == 'TCPRoute' || r.kind == 'UDPRoute' ||
                     r.kind == 'TLSRoute')
+                - message: targetRefs group must be gateway.networking.k8s.io
+                  rule: self.all(r, r.group == 'gateway.networking.k8s.io')
             required:
             - targetRefs
             type: object

internal/adc/translator/policies.go

@@ -198,6 +198,11 @@ func (t *Translator) AttachL4RoutePolicyPlugins(
 			if string(ref.Name) != routeName {
 				continue
 			}
+			// sectionName targeting is not supported for L4 routes; skip such refs
+			// so plugins are not attached for an attachment that cannot be honored.
+			if ref.SectionName != nil && *ref.SectionName != "" {
+				continue
+			}
 			t.mergeL4PolicyPlugins(policy, plugins)
 			return
 		}

internal/controller/policies.go

@@ -228,6 +228,31 @@ func parentRefValueEqual(a, b gatewayv1.ParentReference) bool {
 		a.Name == b.Name
 }
 
+// l4RoutePolicyMatchesRoute reports whether the policy has a targetRef that matches the
+// given L4 route. A ref matches only when its group/kind/name equal the route and it does
+// not pin a sectionName, since L4 routes expose no addressable sections to attach to.
+func l4RoutePolicyMatchesRoute(policy v1alpha1.L4RoutePolicy, routeKind, routeNamespace, routeName string) bool {
+	if policy.Namespace != routeNamespace {
+		return false
+	}
+	for _, ref := range policy.Spec.TargetRefs {
+		if string(ref.Group) != gatewayv1alpha2.GroupName {
+			continue
+		}
+		if string(ref.Kind) != routeKind {
+			continue
+		}
+		if string(ref.Name) != routeName {
+			continue
+		}
+		if ref.SectionName != nil && *ref.SectionName != "" {
+			continue
+		}
+		return true
+	}
+	return false
+}
+
 // ProcessL4RoutePolicy finds L4RoutePolicy resources that target the given L4 route
 // (identified by namespace, name, and kind), resolves conflicts deterministically,
 // populates tctx.L4RoutePolicies with the winning policy, and queues status updates.
@@ -247,6 +272,15 @@ func ProcessL4RoutePolicy(
 		return
 	}
 
+	// L4 routes have no addressable sections; a targetRef that specifies a sectionName
+	// cannot be honored, so ignore policies that only match this route via such a ref.
+	list.Items = slices.DeleteFunc(list.Items, func(p v1alpha1.L4RoutePolicy) bool {
+		return !l4RoutePolicyMatchesRoute(p, routeKind, routeNamespace, routeName)
+	})
+	if len(list.Items) == 0 {
+		return
+	}
+
 	// Deterministic conflict resolution: oldest creationTimestamp wins; tie-break by namespace/name.
 	sort.Slice(list.Items, func(i, j int) bool {
 		ti := list.Items[i].CreationTimestamp.Time