address codex comments

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

Author: kkk777-7

internal/gatewayapi/securitypolicy.go

@@ -1669,10 +1669,12 @@ func (t *Translator) buildOIDC(
 		disableTokenEncryption = *oidc.DisableTokenEncryption
 	}
 
+	oidcOwner := policyOwnerOr(owners.oidc, policy)
+
 	// Generate a unique cookie suffix for oauth filters.
 	// This is to avoid cookie name collision when multiple security policies are applied
 	// to the same route.
-	suffix := utils.Digest32(string(policy.UID))
+	suffix := utils.Digest32(string(oidcOwner.UID))
 
 	// Get the HMAC secret.
 	// HMAC secret is generated by the CertGen job and stored in a secret
@@ -1688,7 +1690,6 @@ func (t *Translator) buildOIDC(
 			"HMAC secret not found in secret %s/%s", t.ControllerNamespace, oidcHMACSecretName)
 	}
 
-	oidcOwner := policyOwnerOr(owners.oidc, policy)
 	irOIDC := &ir.OIDC{
 		Name:                   irConfigName(oidcOwner),
 		Provider:               *provider,

internal/gatewayapi/testdata/securitypolicy-with-merge-needs-fieldowner.in.yaml

@@ -42,6 +42,16 @@ services:
     - port: 9000
       name: grpc
       protocol: TCP
+- apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: default
+    name: grpc-backend
+  spec:
+    ports:
+    - port: 9000
+      name: grpc
+      protocol: TCP
 endpointSlices:
 - apiVersion: discovery.k8s.io/v1
   kind: EndpointSlice
@@ -60,12 +70,30 @@ endpointSlices:
     - 8.8.8.8
     conditions:
       ready: true
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    namespace: default
+    name: endpointslice-grpc-backend
+    labels:
+      kubernetes.io/service-name: grpc-backend
+  addressType: IPv4
+  ports:
+  - name: grpc
+    protocol: TCP
+    port: 9000
+  endpoints:
+  - addresses:
+    - 9.9.9.9
+    conditions:
+      ready: true
 securityPolicies:
 - apiVersion: gateway.envoyproxy.io/v1alpha1
   kind: SecurityPolicy
   metadata:
     namespace: envoy-gateway
     name: policy-for-gateway
+    uid: "aaaaaaaa-0000-0000-0000-000000000001" # check: oidc suffix value [c3556d06]
   spec:
     targetRefs:
     - group: gateway.networking.k8s.io
@@ -121,13 +149,18 @@ securityPolicies:
   metadata:
     namespace: default
     name: policy-for-route
+    uid: "bbbbbbbb-0000-0000-0000-000000000002" # check: oidc suffix value [6ac6170b]
   spec:
     mergeType: StrategicMerge
     targetRefs:
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
       name: httproute-1
     extAuth:
+      grpc:
+        backendRefs:
+        - name: grpc-backend
+          port: 9000
       contextExtensions:
       - name: shared
         type: ValueRef

internal/gatewayapi/testdata/securitypolicy-with-merge-needs-fieldowner.out.yaml

@@ -117,6 +117,7 @@ securityPolicies:
   metadata:
     name: policy-for-route
     namespace: default
+    uid: bbbbbbbb-0000-0000-0000-000000000002
   spec:
     extAuth:
       contextExtensions:
@@ -134,6 +135,10 @@ securityPolicies:
           key: data
           kind: ConfigMap
           name: context-extension-for-route
+      grpc:
+        backendRefs:
+        - name: grpc-backend
+          port: 9000
     mergeType: StrategicMerge
     targetRefs:
     - group: gateway.networking.k8s.io
@@ -164,6 +169,7 @@ securityPolicies:
   metadata:
     name: policy-for-gateway
     namespace: envoy-gateway
+    uid: aaaaaaaa-0000-0000-0000-000000000001
   spec:
     basicAuth:
       users:
@@ -312,31 +318,31 @@ xdsIR:
             - name: parent-only
               value: '[redacted]'
             grpc:
-              authority: grpc-backend.envoy-gateway:9000
+              authority: grpc-backend.default:9000
               destination:
                 metadata:
                   kind: SecurityPolicy
-                  name: policy-for-gateway
-                  namespace: envoy-gateway
-                name: securitypolicy/envoy-gateway/policy-for-gateway/extauth/0
+                  name: policy-for-route
+                  namespace: default
+                name: securitypolicy/default/policy-for-route/extauth/0
                 settings:
                 - addressType: IP
                   endpoints:
-                  - host: 8.8.8.8
+                  - host: 9.9.9.9
                     port: 9000
                   metadata:
                     kind: Service
                     name: grpc-backend
-                    namespace: envoy-gateway
+                    namespace: default
                     sectionName: "9000"
-                  name: securitypolicy/envoy-gateway/policy-for-gateway/extauth/0/backend/0
+                  name: securitypolicy/default/policy-for-route/extauth/0/backend/0
                   protocol: GRPC
                   weight: 1
             name: securitypolicy/default/policy-for-route
           oidc:
             clientID: client1.apps.googleusercontent.com
             clientSecret: '[redacted]'
-            cookieSuffix: 811c9dc5
+            cookieSuffix: c3556d06
             hmacSecret: '[redacted]'
             logoutPath: /logout
             name: securitypolicy/envoy-gateway/policy-for-gateway

release-notes/current.yaml

@@ -2,6 +2,7 @@ date: Pending
 
 # Changes that are expected to cause an incompatibility with previous versions, such as deletions or modifications to existing APIs.
 breaking changes: |
+  Merged SecurityPolicy IR/xDS resource names (OIDC, BasicAuth, ExtAuth, JWT) now derive from the policy that contributes the field (parent or route) rather than always using the route-level policy. EnvoyPatchPolicy users who reference those generated names must update their patch targets.
 
 # Updates addressing vulnerabilities, security flaws, or compliance requirements.
 security updates: |