feat(api): support Replace mergeType in BTP and SP

mehara-rothila · mehara-rothila · commit a71606f91e11 · 2026-06-09T11:55:10.000+05:30
Signed-off-by: mehara-rothila &lt;rothilamehara22@gmail.com&gt;
diff --git a/api/v1alpha1/backendtrafficpolicy_types.go b/api/v1alpha1/backendtrafficpolicy_types.go
@@ -56,7 +56,6 @@ type BackendTrafficPolicySpec struct {
 	// This field cannot be set when targeting a parent resource (Gateway).
 	// If unset, no merging occurs, and only the most specific configuration takes effect.
 	//
-	// +kubebuilder:validation:XValidation:rule="self != 'Replace'",message="Replace is not a valid MergeType for BackendTrafficPolicySpec"
 	// +optional
 	MergeType *MergeType `json:"mergeType,omitempty"`
 
diff --git a/api/v1alpha1/securitypolicy_types.go b/api/v1alpha1/securitypolicy_types.go
@@ -59,7 +59,6 @@ type SecurityPolicySpec struct {
 	// This field cannot be set when targeting a parent resource (Gateway).
 	// If unset, no merging occurs, and only the most specific configuration takes effect.
 	//
-	// +kubebuilder:validation:XValidation:rule="self != 'Replace'",message="Replace is not a valid MergeType for SecurityPolicy"
 	// +optional
 	MergeType *MergeType `json:"mergeType,omitempty"`
 
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backends.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backends.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.crds.envoyGateway.enabled }}
+{{- if .Values.crds.envoyGateway.enabled }}
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -530,3 +531,6 @@ spec:
     subresources:
       status: {}
 {{- end }}
+
+{{- end }}
+
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.crds.envoyGateway.enabled }}
+{{- if .Values.crds.envoyGateway.enabled }}
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -3642,3 +3643,6 @@ spec:
     subresources:
       status: {}
 {{- end }}
+
+{{- end }}
+
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.crds.envoyGateway.enabled }}
+{{- if .Values.crds.envoyGateway.enabled }}
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -2171,3 +2172,6 @@ spec:
     subresources:
       status: {}
 {{- end }}
+
+{{- end }}
+
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.crds.envoyGateway.enabled }}
+{{- if .Values.crds.envoyGateway.enabled }}
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -2596,3 +2597,6 @@ spec:
     subresources:
       status: {}
 {{- end }}
+
+{{- end }}
+
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoypatchpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoypatchpolicies.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.crds.envoyGateway.enabled }}
+{{- if .Values.crds.envoyGateway.enabled }}
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -510,3 +511,6 @@ spec:
     subresources:
       status: {}
 {{- end }}
+
+{{- end }}
+
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.crds.envoyGateway.enabled }}
+{{- if .Values.crds.envoyGateway.enabled }}
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -18288,3 +18289,6 @@ spec:
     subresources:
       status: {}
 {{- end }}
+
+{{- end }}
+
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_httproutefilters.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_httproutefilters.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.crds.envoyGateway.enabled }}
+{{- if .Values.crds.envoyGateway.enabled }}
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -493,3 +494,6 @@ spec:
     storage: true
     subresources: {}
 {{- end }}
+
+{{- end }}
+
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.crds.envoyGateway.enabled }}
+{{- if .Values.crds.envoyGateway.enabled }}
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -7776,3 +7777,6 @@ spec:
     subresources:
       status: {}
 {{- end }}
+
+{{- end }}
+
diff --git a/internal/gatewayapi/tls_test.go b/internal/gatewayapi/tls_test.go
@@ -6,6 +6,7 @@
 package gatewayapi
 
 import (
+	"bytes"
 	"os"
 	"path/filepath"
 	"testing"
@@ -382,7 +383,9 @@ func TestFilterValidCertificates(t *testing.T) {
 				if tc.ExpectedDataFile != "" {
 					expectedData, err := os.ReadFile(filepath.Join("testdata", "tls", tc.ExpectedDataFile))
 					require.NoError(t, err)
-					require.Equal(t, expectedData, result, "filtered certificate data should match expected value")
+					expectedData = bytes.ReplaceAll(expectedData, []byte("\r\n"), []byte("\n"))
+					resultNormal := bytes.ReplaceAll(result, []byte("\r\n"), []byte("\n"))
+					require.Equal(t, expectedData, resultNormal, "filtered certificate data should match expected value")
 				}
 			} else {
 				require.Error(t, listenerErr)
@@ -395,7 +398,9 @@ func TestFilterValidCertificates(t *testing.T) {
 					if tc.ExpectedDataFile != "" {
 						expectedData, err := os.ReadFile(filepath.Join("testdata", "tls", tc.ExpectedDataFile))
 						require.NoError(t, err)
-						require.Equal(t, expectedData, result, "filtered certificate data should match expected value")
+						expectedData = bytes.ReplaceAll(expectedData, []byte("\r\n"), []byte("\n"))
+						resultNormal := bytes.ReplaceAll(result, []byte("\r\n"), []byte("\n"))
+						require.Equal(t, expectedData, resultNormal, "filtered certificate data should match expected value")
 					}
 				} else {
 					require.Nil(t, result, "result should be nil for completely invalid certificates")
diff --git a/internal/utils/merge.go b/internal/utils/merge.go
@@ -51,6 +51,8 @@ func mergeInternal[T any](original T, patchJSON []byte, mergeType egv1a1.MergeTy
 		if err != nil {
 			return empty, fmt.Errorf("error during JSON merge: %w", err)
 		}
+	case egv1a1.Replace:
+		patchedJSON = patchJSON
 	default:
 		return empty, fmt.Errorf("unsupported merge type: %v", mergeType)
 	}
diff --git a/internal/utils/merge_test.go b/internal/utils/merge_test.go
@@ -25,6 +25,7 @@ func TestMergePolicy(t *testing.T) {
 	require.NoError(t, err)
 
 	for _, caseFile := range caseFiles {
+		caseFile = filepath.ToSlash(caseFile)
 		caseName := strings.TrimPrefix(strings.TrimSuffix(caseFile, ".in.yaml"), baseDir+"/")
 		policyType := strings.SplitN(caseName, "_", 2)[0]
 
@@ -44,21 +45,26 @@ func TestMergePolicy(t *testing.T) {
 func runMergePolicyTest[T client.Object](t *testing.T, caseFile string) {
 	t.Helper()
 
-	for _, mergeType := range []egv1a1.MergeType{egv1a1.StrategicMerge, egv1a1.JSONMerge} {
+	for _, mergeType := range []egv1a1.MergeType{egv1a1.StrategicMerge, egv1a1.JSONMerge, egv1a1.Replace} {
 		patchedInput := strings.Replace(caseFile, ".in.yaml", ".patch.yaml", 1)
+		original := readObject[T](t, caseFile)
+		patch := readObject[T](t, patchedInput)
+
+		got, err := Merge(original, patch, mergeType)
+		require.NoError(t, err)
+
+		if mergeType == egv1a1.Replace {
+			require.Equal(t, patch, got)
+			continue
+		}
+
 		var output string
 		if mergeType == egv1a1.StrategicMerge {
 			output = strings.Replace(caseFile, ".in.yaml", ".strategicmerge.out.yaml", 1)
 		} else {
 			output = strings.Replace(caseFile, ".in.yaml", ".jsonmerge.out.yaml", 1)
 		}
 
-		original := readObject[T](t, caseFile)
-		patch := readObject[T](t, patchedInput)
-
-		got, err := Merge(original, patch, mergeType)
-		require.NoError(t, err)
-
 		if test.OverrideTestData() {
 			b, err := yaml.Marshal(got)
 			require.NoError(t, err)
diff --git a/internal/utils/path/path_test.go b/internal/utils/path/path_test.go
@@ -8,6 +8,7 @@ package path
 import (
 	"os"
 	"path"
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -66,9 +67,9 @@ func TestListDirsAndFiles(t *testing.T) {
 }
 
 func TestGetParentDirs(t *testing.T) {
-	aPaths := path.Join("a")
-	bPaths := path.Join("a", "b")
-	cPaths := path.Join("a", "b", "c")
+	aPaths := filepath.Join("a")
+	bPaths := filepath.Join("a", "b")
+	cPaths := filepath.Join("a", "b", "c")
 
 	testCases := []struct {
 		name             string
@@ -78,8 +79,8 @@ func TestGetParentDirs(t *testing.T) {
 		{
 			name: "all files",
 			paths: []string{
-				path.Join(cPaths, "foo"),
-				path.Join(bPaths, "bar"),
+				filepath.Join(cPaths, "foo"),
+				filepath.Join(bPaths, "bar"),
 			},
 			expectParentDirs: []string{
 				cPaths,
@@ -89,8 +90,8 @@ func TestGetParentDirs(t *testing.T) {
 		{
 			name: "all dirs",
 			paths: []string{
-				bPaths + "/",
-				cPaths + "/",
+				bPaths + string(filepath.Separator),
+				cPaths + string(filepath.Separator),
 			},
 			expectParentDirs: []string{
 				bPaths,
@@ -100,13 +101,13 @@ func TestGetParentDirs(t *testing.T) {
 		{
 			name: "mixed files and dirs",
 			paths: []string{
-				path.Join(cPaths, "foo"),
-				path.Join(cPaths, "bar"),
-				path.Join(bPaths, "foo"),
-				path.Join(bPaths, "bar"),
-				aPaths + "/",
-				bPaths + "/",
-				cPaths + "/",
+				filepath.Join(cPaths, "foo"),
+				filepath.Join(cPaths, "bar"),
+				filepath.Join(bPaths, "foo"),
+				filepath.Join(bPaths, "bar"),
+				aPaths + string(filepath.Separator),
+				bPaths + string(filepath.Separator),
+				cPaths + string(filepath.Separator),
 			},
 			expectParentDirs: []string{
 				cPaths,
diff --git a/release-notes/current.yaml b/release-notes/current.yaml
@@ -13,6 +13,7 @@ security updates: |
 new features: |
   Added support for authorization path match.
   Added a `requestBody` field to the HTTP active health checker in `BackendTrafficPolicy`, allowing a request body payload to be sent during HTTP health checking. The field requires the health check `method` to be `POST` or `PUT`.
+  Added support for `Replace` `mergeType` in `BackendTrafficPolicy` and `SecurityPolicy` resources.
 
 bug fixes: |
   Fixed the xDS server in GatewayNamespaceMode serving a stale certificate after cert-manager rotation by re-reading the cert from disk on every TLS handshake.
diff --git a/site/content/en/v1.8/concepts/gateway_api_extensions/backend-traffic-policy.md b/site/content/en/v1.8/concepts/gateway_api_extensions/backend-traffic-policy.md
@@ -159,6 +159,7 @@ When merging occurs, route-level policies will merge with either a gateway-level
 
 - **StrategicMerge**: Uses Kubernetes strategic merge patch semantics, providing intelligent merging for complex data structures including arrays
 - **JSONMerge**: Uses RFC 7396 JSON Merge Patch semantics, with simple replacement strategy where arrays are completely replaced
+- **Replace**: Discards the parent policy configuration completely and replaces it with the child policy configuration
 
 ### Example Usage
 
diff --git a/site/content/en/v1.8/concepts/gateway_api_extensions/security-policy.md b/site/content/en/v1.8/concepts/gateway_api_extensions/security-policy.md
@@ -215,6 +215,7 @@ When merging occurs, route-level policies will merge with either a gateway-level
 
 - **StrategicMerge**: Uses Kubernetes strategic merge patch semantics, providing intelligent merging for complex data structures including arrays
 - **JSONMerge**: Uses RFC 7396 JSON Merge Patch semantics, with simple replacement strategy where arrays are completely replaced
+- **Replace**: Discards the parent policy configuration completely and replaces it with the child policy configuration
 
 ### Example Usage
 
