fix(translator): set status for invalid EnvoyPatchPolicy target kind

internal/gatewayapi/envoypatchpolicy.go

@@ -37,7 +37,11 @@
 		refGroup, refKind, refName := policy.Spec.TargetRef.Group, policy.Spec.TargetRef.Kind, policy.Spec.TargetRef.Name
 		if t.MergeGateways {
 			targetKind = resource.KindGatewayClass
+ fix-epp-invalid-target-status
+			// if ref GatewayClass name is not same as t.GatewayClassName, it will be skipped below.
+
 			// if ref GatewayClass name is not same as t.GatewayClassName, it will be skipped in L74.
+ main
 			irKey = string(refName)
 			ancestorRef = gwapiv1.ParentReference{
 				Group: GroupPtr(gwapiv1.GroupName),
@@ -74,11 +78,68 @@
 			irKey = t.IRKey(gatewayNN)
 			ancestorRef = getAncestorRefForPolicy(gatewayNN, nil)
 
+ fix-epp-invalid-target-status
+		// Ensure EnvoyPatchPolicy is targeting to a support type
+		if policy.Spec.TargetRef.Group != gwapiv1.GroupName || string(refKind) != targetKind {
+			message := fmt.Sprintf("TargetRef.Group:%s TargetRef.Kind:%s, only TargetRef.Group:%s and TargetRef.Kind:%s is supported.",
+				policy.Spec.TargetRef.Group, policy.Spec.TargetRef.Kind, gwapiv1.GroupName, targetKind)
+
+			resolveErr = &status.PolicyResolveError{
+				Reason:  gwapiv1.PolicyReasonInvalid,
+				Message: message,
+			}
+
+			// For invalid targetRef kind, we need to find the correct xdsIR key to attach status
+			// In MergeGateways mode, use GatewayClass name; in default mode, use Gateway namespace/name
+			var statusIRKey string
+			var statusAncestorRef gwapiv1.ParentReference
+			if t.MergeGateways {
+				statusIRKey = string(t.GatewayClassName)
+				statusAncestorRef = gwapiv1.ParentReference{
+					Group: GroupPtr(gwapiv1.GroupName),
+					Kind:  KindPtr(resource.KindGatewayClass),
+					Name:  t.GatewayClassName,
+				}
+			} else {
+				gatewayNN := types.NamespacedName{
+					Namespace: policy.Namespace,
+					Name:      string(refName),
+				}
+				statusIRKey = t.IRKey(gatewayNN)
+				statusAncestorRef = getAncestorRefForPolicy(gatewayNN, nil)
+			}
+
+			// Try to attach status to the correct xdsIR if it exists
+			if gwXdsIR, ok := xdsIR[statusIRKey]; ok {
+				policyIR := ir.EnvoyPatchPolicy{}
+				policyIR.Name = policy.Name
+				policyIR.Namespace = policy.Namespace
+				policyIR.Generation = policy.Generation
+				policyIR.Status = &policy.Status
+				gwXdsIR.EnvoyPatchPolicies = append(gwXdsIR.EnvoyPatchPolicies, &policyIR)
+			}
+
+			status.SetResolveErrorForPolicyAncestor(&policy.Status,
+				&statusAncestorRef,
+				t.GatewayControllerName,
+				policy.Generation,
+				resolveErr,
+			)
+
+			continue
+		}
+
+		gwXdsIR, ok := xdsIR[irKey]
+		if !ok {
+			// The TargetRef Gateway is not an accepted Gateway, then skip processing.
+			continue
+
 			gwXdsIR, ok = xdsIR[irKey]
 			if !ok {
 				// The TargetRef Gateway is not an accepted Gateway, then skip processing.
 				continue
 			}
+ main
 		}
 
 		// Create the IR with the context need to publish the status later
@@ -107,6 +168,8 @@
 			continue
 		}
 
+ fix-epp-invalid-target-status
+
 		// Ensure EnvoyPatchPolicy is targeting to a support type
 		if refGroup != gwapiv1.GroupName || string(refKind) != targetKind {
 			message := fmt.Sprintf("TargetRef.Group:%s TargetRef.Kind:%s, only TargetRef.Group:%s and TargetRef.Kind:%s is supported.",
@@ -126,6 +189,7 @@
 			continue
 		}
 
+ main
 		// Save the patch
 		for _, patch := range policy.Spec.JSONPatches {
 			irPatch := ir.JSONPatchConfig{}
@@ -149,7 +213,7 @@
 
 // envoyPatchPolicyCopiesWithStatusDeepCopy returns shallow copies with deep-copied Status fields.
 // Status is mutated during translation and shares a pointer with the watchable coalesce goroutine.
 func envoyPatchPolicyCopiesWithStatusDeepCopy(policies []*egv1a1.EnvoyPatchPolicy) []*egv1a1.EnvoyPatchPolicy {
 	copies := make([]*egv1a1.EnvoyPatchPolicy, len(policies))
 	for i, p := range policies {
 		out := *p
@@ -157,4 +221,4 @@
 		copies[i] = &out
 	}
 	return copies
 }

internal/gatewayapi/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml

@@ -105,6 +105,24 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    envoyPatchPolicies:
+    - name: edit-conn-buffer-bytes
+      namespace: envoy-gateway
+      status:
+        ancestors:
+        - ancestorRef:
+            group: gateway.networking.k8s.io
+            kind: GatewayClass
+            name: envoy-gateway-class
+          conditions:
+          - lastTransitionTime: null
+            message: TargetRef.Group:gateway.networking.k8s.io TargetRef.Kind:Gateway,
+              only TargetRef.Group:gateway.networking.k8s.io and TargetRef.Kind:GatewayClass
+              is supported.
+            reason: Invalid
+            status: "False"
+            type: Accepted
+          controllerName: gateway.envoyproxy.io/gatewayclass-controller
     globalResources:
       proxyServiceCluster:
         metadata: