gatewayapi: fix BTPRoutingTypeIndex to not inherit RoutingType when MergeType is unset

Fixes #9541: a route-rule/route-targeted
BackendTrafficPolicy with both RoutingType and MergeType unset
incorrectly inherited RoutingType from its resolved gateway/listener
parent. MergeType nil means the policy doesn't merge with a parent at
all, so it must resolve to its own (nil) value instead.

Migrates BTPRoutingTypeIndex onto a new, generic policyIndex[T]
primitive that reuses the existing policyScope type (previously used
only by SecurityPolicy's override/merge tracking), rather than
patching the old ad hoc btpRoutingKey-based maps directly. Each entry
carries a single effective bool decided at write time - via
isRouteEffective's MergeType-aware rule for route-rule/route scopes,
or the caller-supplied hasValue for listener/gateway scopes - so
Lookup resolves any scope uniformly.

policyScope gains a RouteKind tag (a 1-byte enum, to keep the struct
under gocritic's hugeParam threshold) so route-rule/route scopes
targeting different route kinds under the same name never collide.

Signed-off-by: Muhammad Waqar <mwaqar@confluent.io>

Author: muwaqar-cflt

internal/gatewayapi/backendtrafficpolicy.go

@@ -39,135 +39,9 @@ const (
 	ResponseBodyConfigMapKey = "response.body"
 )
 
-// btpRoutingKey identifies a BTP routing type target
-type btpRoutingKey struct {
-	Kind, Namespace, Name, SectionName string
-}
-
-// BTPRoutingTypeIndex holds RoutingType values from BackendTrafficPolicies
-// This avoids an O(BTPs) lookup for every iteration of processDestination.
-type BTPRoutingTypeIndex struct {
-	routeRuleLevel           map[btpRoutingKey]*egv1a1.RoutingType
-	routeLevel               map[btpRoutingKey]*egv1a1.RoutingType
-	listenerSetListenerLevel map[btpRoutingKey]*egv1a1.RoutingType
-	listenerSetLevel         map[btpRoutingKey]*egv1a1.RoutingType
-	listenerLevel            map[btpRoutingKey]*egv1a1.RoutingType
-	gatewayLevel             map[btpRoutingKey]*egv1a1.RoutingType
-}
-
-// btpRoutingTypeIndexMaps allocates BTPRoutingTypeIndex's maps.
-func btpRoutingTypeIndexMaps() *BTPRoutingTypeIndex {
-	return &BTPRoutingTypeIndex{
-		routeRuleLevel:           make(map[btpRoutingKey]*egv1a1.RoutingType),
-		routeLevel:               make(map[btpRoutingKey]*egv1a1.RoutingType),
-		listenerSetListenerLevel: make(map[btpRoutingKey]*egv1a1.RoutingType),
-		listenerSetLevel:         make(map[btpRoutingKey]*egv1a1.RoutingType),
-		listenerLevel:            make(map[btpRoutingKey]*egv1a1.RoutingType),
-		gatewayLevel:             make(map[btpRoutingKey]*egv1a1.RoutingType),
-	}
-}
-
-// LookupBTPRoutingType resolves the RoutingType for a specific route rule
-// and gateway/listener combination by checking the index in
-// priority order: routeRule > route > listener > gateway.
-// Returns nil if no matching BTP RoutingType is found, or if the index is nil.
-func (idx *BTPRoutingTypeIndex) LookupBTPRoutingType(
-	routeKind gwapiv1.Kind,
-	routeNN types.NamespacedName,
-	gatewayNN types.NamespacedName,
-	listenerName *gwapiv1.SectionName,
-	listenerSetNN *types.NamespacedName,
-	routeRuleName *gwapiv1.SectionName,
-) *egv1a1.RoutingType {
-	if idx == nil {
-		return nil
-	}
-
-	// 1. Route-rule level (most specific)
-	if routeRuleName != nil {
-		key := btpRoutingKey{
-			Kind:        string(routeKind),
-			Namespace:   routeNN.Namespace,
-			Name:        routeNN.Name,
-			SectionName: string(*routeRuleName),
-		}
-		if rt, ok := idx.routeRuleLevel[key]; ok {
-			return rt
-		}
-	}
-
-	// 2. Route level
-	routeKey := btpRoutingKey{
-		Kind:      string(routeKind),
-		Namespace: routeNN.Namespace,
-		Name:      routeNN.Name,
-	}
-	if rt, ok := idx.routeLevel[routeKey]; ok {
-		return rt
-	}
-
-	// 3. ListenerSet listener level, then ListenerSet level for routes attached through a ListenerSet.
-	if listenerSetNN != nil {
-		if listenerName != nil {
-			listenerSetListenerKey := btpRoutingKey{
-				Kind:        resource.KindListenerSet,
-				Namespace:   listenerSetNN.Namespace,
-				Name:        listenerSetNN.Name,
-				SectionName: string(*listenerName),
-			}
-			if rt, ok := idx.listenerSetListenerLevel[listenerSetListenerKey]; ok {
-				return rt
-			}
-		}
-
-		listenerSetKey := btpRoutingKey{
-			Kind:      resource.KindListenerSet,
-			Namespace: listenerSetNN.Namespace,
-			Name:      listenerSetNN.Name,
-		}
-		if rt, ok := idx.listenerSetLevel[listenerSetKey]; ok {
-			return rt
-		}
-	}
-
-	// 4. Gateway listener level. ListenerSet-attached routes intentionally skip
-	// Gateway listener policy lookup because Gateway listeners and ListenerSet
-	// listeners are sibling scopes.
-	if listenerSetNN == nil && listenerName != nil {
-		listenerKey := btpRoutingKey{
-			Kind:        resource.KindGateway,
-			Namespace:   gatewayNN.Namespace,
-			Name:        gatewayNN.Name,
-			SectionName: string(*listenerName),
-		}
-		if rt, ok := idx.listenerLevel[listenerKey]; ok {
-			return rt
-		}
-	}
-
-	// 5. Gateway level (least specific)
-	return idx.LookupGatewayBTRoutingType(gatewayNN)
-}
-
-// LookupGatewayBTRoutingType resolves the RoutingType from a gateway-level BTP only, ignoring any
-// listener/route/route-rule level override. Returns nil if no matching BTP RoutingType is found,
-// or if the index is nil.
-func (idx *BTPRoutingTypeIndex) LookupGatewayBTRoutingType(gatewayNN types.NamespacedName) *egv1a1.RoutingType {
-	if idx == nil {
-		return nil
-	}
-
-	gwKey := btpRoutingKey{
-		Kind:      resource.KindGateway,
-		Namespace: gatewayNN.Namespace,
-		Name:      gatewayNN.Name,
-	}
-	if rt, ok := idx.gatewayLevel[gwKey]; ok {
-		return rt
-	}
-
-	return nil
-}
+// BTPRoutingTypeIndex holds RoutingType values from BackendTrafficPolicies, keyed by attachment
+// scope. This avoids an O(BTPs) lookup for every iteration of processDestination.
+type BTPRoutingTypeIndex = policyIndex[*egv1a1.RoutingType]
 
 // btpSpecHasClusterScopedFields reports whether spec sets any backend-cluster-scoped (CDS) field —
 // either directly inside its embedded ClusterSettings, or via a sibling field on the spec that also
@@ -190,34 +64,12 @@ func btpSpecHasClusterScopedFields(spec *egv1a1.BackendTrafficPolicySpec) bool {
 }
 
 // BTPClusterSettingsIndex holds, per route-rule/route/listener target, whether a
-// BackendTrafficPolicy contributes backend-cluster-scoped (CDS) settings.
-type BTPClusterSettingsIndex struct {
-	routeRuleLevel map[btpRoutingKey]bool
-	routeLevel     map[btpRoutingKey]bool
-	listenerLevel  map[btpRoutingKey]bool
-}
-
-// btpClusterSettingsIndexMaps allocates BTPClusterSettingsIndex's maps.
-func btpClusterSettingsIndexMaps() *BTPClusterSettingsIndex {
-	return &BTPClusterSettingsIndex{
-		routeRuleLevel: make(map[btpRoutingKey]bool),
-		routeLevel:     make(map[btpRoutingKey]bool),
-		listenerLevel:  make(map[btpRoutingKey]bool),
-	}
-}
+// BackendTrafficPolicy sets a cluster-scoped field, or has MergeType unset.
+type BTPClusterSettingsIndex = policyIndex[bool]
 
 // BTPLoadBalancerIndex reports, per gateway, whether a BackendTrafficPolicy attached to it sets
 // LoadBalancer to ConsistentHash.
-type BTPLoadBalancerIndex struct {
-	gatewayLevel map[types.NamespacedName]bool
-}
-
-// btpLoadBalancerIndexMaps allocates BTPLoadBalancerIndex's maps.
-func btpLoadBalancerIndexMaps() *BTPLoadBalancerIndex {
-	return &BTPLoadBalancerIndex{
-		gatewayLevel: make(map[types.NamespacedName]bool),
-	}
-}
+type BTPLoadBalancerIndex = policyIndex[bool]
 
 // BTPIndexes groups the three pre-computed BackendTrafficPolicy indexes BuildBTPIndexes builds
 // together in one pass over btps.
@@ -237,9 +89,9 @@ func BuildBTPIndexes(
 	namespaceLookup func(string) *corev1.Namespace,
 	mergeBackendsEnabled bool,
 ) *BTPIndexes {
-	routingTypeIdx := btpRoutingTypeIndexMaps()
-	clusterSettingsIdx := btpClusterSettingsIndexMaps()
-	loadBalancerIdx := btpLoadBalancerIndexMaps()
+	routingTypeIdx := newPolicyIndex[*egv1a1.RoutingType]()
+	clusterSettingsIdx := newPolicyIndex[bool]()
+	loadBalancerIdx := newPolicyIndex[bool]()
 
 	allTargets := make([]client.Object, 0, len(routes)+len(gateways)+len(listenerSets))
 	allTargets = append(allTargets, routes...)
@@ -252,15 +104,13 @@ func BuildBTPIndexes(
 
 	for _, btp := range btps {
 		hasRoutingType := btp.Spec.RoutingType != nil
-		// ClusterSettings/LoadBalancer only inform merge-eligibility, so they're moot when no
-		// accepted gateway can enable merging; RoutingType applies regardless of MergeBackends.
-		hasClusterScoped := mergeBackendsEnabled && btpSpecHasClusterScopedFields(&btp.Spec)
-		hasLoadBalancer := mergeBackendsEnabled && btp.Spec.LoadBalancer != nil
-
-		if !hasRoutingType && !hasClusterScoped && !hasLoadBalancer {
-			continue
-		}
+		hasClusterScoped := btpSpecHasClusterScopedFields(&btp.Spec)
+		hasLoadBalancer := btp.Spec.LoadBalancer != nil
 
+		// Unlike ClusterSettings/LoadBalancer, RoutingType can never be skipped here: every
+		// accepted BTP must claim its target's first-write-wins slot, even one that sets nothing
+		// at all, so a younger conflicting policy can't silently win, and so a route/rule-level
+		// policy with MergeType unset can still pin its scope to nil instead of inheriting.
 		refs := resolvePolicyTargets(
 			btp.Spec.PolicyTargetReferences,
 			allTargets,
@@ -273,66 +123,47 @@ func BuildBTPIndexes(
 
 		for _, ref := range refs {
 			kind := string(ref.Kind)
-			key := btpRoutingKey{
-				Kind:        kind,
-				Namespace:   string(ref.Namespace),
-				Name:        string(ref.Name),
-				SectionName: string(ptr.Deref(ref.SectionName, "")),
-			}
+			nn := types.NamespacedName{Namespace: string(ref.Namespace), Name: string(ref.Name)}
 
-			if hasRoutingType {
-				switch {
-				case kind == resource.KindGateway && ref.SectionName != nil:
-					if _, exists := routingTypeIdx.listenerLevel[key]; !exists {
-						routingTypeIdx.listenerLevel[key] = btp.Spec.RoutingType
-					}
-				case kind == resource.KindGateway:
-					if _, exists := routingTypeIdx.gatewayLevel[key]; !exists {
-						routingTypeIdx.gatewayLevel[key] = btp.Spec.RoutingType
-					}
-				case kind == resource.KindListenerSet && ref.SectionName != nil:
-					if _, exists := routingTypeIdx.listenerSetListenerLevel[key]; !exists {
-						routingTypeIdx.listenerSetListenerLevel[key] = btp.Spec.RoutingType
-					}
-				case kind == resource.KindListenerSet:
-					if _, exists := routingTypeIdx.listenerSetLevel[key]; !exists {
-						routingTypeIdx.listenerSetLevel[key] = btp.Spec.RoutingType
-					}
-				case ref.SectionName != nil:
-					if _, exists := routingTypeIdx.routeRuleLevel[key]; !exists {
-						routingTypeIdx.routeRuleLevel[key] = btp.Spec.RoutingType
-					}
-				default:
-					if _, exists := routingTypeIdx.routeLevel[key]; !exists {
-						routingTypeIdx.routeLevel[key] = btp.Spec.RoutingType
-					}
-				}
+			switch {
+			case kind == resource.KindGateway && ref.SectionName != nil:
+				routingTypeIdx.setGatewayListenerLevel(nn, *ref.SectionName, btp.Spec.RoutingType, hasRoutingType)
+			case kind == resource.KindGateway:
+				routingTypeIdx.setGatewayLevel(nn, btp.Spec.RoutingType)
+			case kind == resource.KindListenerSet && ref.SectionName != nil:
+				routingTypeIdx.setListenerSetListenerLevel(nn, *ref.SectionName, btp.Spec.RoutingType, hasRoutingType)
+			case kind == resource.KindListenerSet:
+				routingTypeIdx.setListenerSetLevel(nn, btp.Spec.RoutingType)
+			case ref.SectionName != nil:
+				routingTypeIdx.setRouteRuleLevel(nn, kind, *ref.SectionName, btp.Spec.RoutingType, btp.Spec.MergeType)
+			default:
+				routingTypeIdx.setRouteLevel(nn, kind, btp.Spec.RoutingType, btp.Spec.MergeType)
 			}
 
-			if hasClusterScoped {
+			// ClusterSettings/LoadBalancer only inform merge-eligibility, so they're moot when no
+			// accepted gateway can enable merging; RoutingType (above) applies regardless.
+			if mergeBackendsEnabled {
 				switch {
 				case kind == resource.KindGateway && ref.SectionName != nil:
-					clusterSettingsIdx.listenerLevel[key] = true
+					clusterSettingsIdx.setGatewayListenerLevel(nn, *ref.SectionName, hasClusterScoped, true)
 				case kind == resource.KindGateway:
 					// Gateway-level settings apply uniformly to every route sharing a merged
 					// cluster, so they don't disqualify merging - no entry needed.
 				case ref.SectionName != nil:
-					clusterSettingsIdx.routeRuleLevel[key] = true
+					clusterSettingsIdx.setRouteRuleLevel(nn, kind, *ref.SectionName, hasClusterScoped, btp.Spec.MergeType)
 				default:
-					clusterSettingsIdx.routeLevel[key] = true
+					clusterSettingsIdx.setRouteLevel(nn, kind, hasClusterScoped, btp.Spec.MergeType)
 				}
-			}
 
-			if hasLoadBalancer {
-				switch {
-				case kind == resource.KindGateway && ref.SectionName == nil:
-					gwKey := types.NamespacedName{Namespace: string(ref.Namespace), Name: string(ref.Name)}
-					if _, exists := loadBalancerIdx.gatewayLevel[gwKey]; !exists {
-						loadBalancerIdx.gatewayLevel[gwKey] = btp.Spec.LoadBalancer.Type == egv1a1.ConsistentHashLoadBalancerType
+				if hasLoadBalancer {
+					switch {
+					case kind == resource.KindGateway && ref.SectionName == nil:
+						loadBalancerIdx.setGatewayLevel(nn, btp.Spec.LoadBalancer.Type == egv1a1.ConsistentHashLoadBalancerType)
+					default:
+						// A listener/route-rule/route-level LoadBalancer setting already
+						// disqualifies its own rule from merging on its own, so it's never looked
+						// up here.
 					}
-				default:
-					// A listener/route-rule/route-level LoadBalancer setting already disqualifies
-					// its own rule from merging on its own, so it's never looked up here.
 				}
 			}
 		}
@@ -345,65 +176,6 @@ func BuildBTPIndexes(
 	}
 }
 
-// HasRouteLevelClusterSettings reports whether a route-rule, route, or listener-level
-// BackendTrafficPolicy contributes backend-cluster-scoped settings for the given target. A
-// gateway-level setting isn't checked: it applies uniformly to every route sharing a merged
-// cluster, so it can't cause a divergence.
-func (idx *BTPClusterSettingsIndex) HasRouteLevelClusterSettings(
-	routeKind gwapiv1.Kind,
-	routeNN types.NamespacedName,
-	gatewayNN types.NamespacedName,
-	listenerName *gwapiv1.SectionName,
-	routeRuleName *gwapiv1.SectionName,
-) bool {
-	if idx == nil {
-		return false
-	}
-
-	if routeRuleName != nil {
-		key := btpRoutingKey{
-			Kind:        string(routeKind),
-			Namespace:   routeNN.Namespace,
-			Name:        routeNN.Name,
-			SectionName: string(*routeRuleName),
-		}
-		if idx.routeRuleLevel[key] {
-			return true
-		}
-	}
-
-	routeKey := btpRoutingKey{
-		Kind:      string(routeKind),
-		Namespace: routeNN.Namespace,
-		Name:      routeNN.Name,
-	}
-	if idx.routeLevel[routeKey] {
-		return true
-	}
-
-	if listenerName != nil {
-		listenerKey := btpRoutingKey{
-			Kind:        resource.KindGateway,
-			Namespace:   gatewayNN.Namespace,
-			Name:        gatewayNN.Name,
-			SectionName: string(*listenerName),
-		}
-		if idx.listenerLevel[listenerKey] {
-			return true
-		}
-	}
-
-	return false
-}
-
-// IsConsistentHash reports whether gatewayNN has a BackendTrafficPolicy setting LoadBalancer to
-// ConsistentHash.
-func (idx *BTPLoadBalancerIndex) IsConsistentHash(gatewayNN types.NamespacedName) bool {
-	if idx == nil {
-		return false
-	}
-	return idx.gatewayLevel[gatewayNN]
-}
 
 // deprecatedFieldsUsedInBackendTrafficPolicy returns a map of deprecated field paths to their alternatives.
 func deprecatedFieldsUsedInBackendTrafficPolicy(policy *egv1a1.BackendTrafficPolicy) map[string]string {
@@ -770,7 +542,7 @@ func (t *Translator) processBackendTrafficPolicyForRoute(
 	// parentRefCtxs holds parent gateway/listener contexts for using in policy merge logic.
 	parentRefCtxs := make([]*RouteParentContext, 0, len(parentRefs))
 	routeNN := utils.NamespacedName(targetedRoute)
-	routeAsChildScope := routeScope(routeNN)
+	routeAsChildScope := routeScope(routeNN, string(targetedRoute.GetRouteType()))
 	for _, p := range parentRefs {
 		parentNamespace := targetedRoute.GetNamespace()
 		if p.Namespace != nil {