add overriding condition to BackendTrafficPolicy and SecurityPolicy

internal/gatewayapi/backendtrafficpolicy.go

@@ -16,7 +16,9 @@ import (
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/utils/ptr"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 	gwv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 	gwv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
 
@@ -71,6 +73,9 @@ func (t *Translator) ProcessBackendTrafficPolicies(backendTrafficPolicies []*egv
 		gatewayMap[key] = &policyGatewayTargetContext{GatewayContext: gw}
 	}
 
+	// Map of Gateway to the routes attached to it
+	gatewayRouteMap := make(map[string]sets.Set[string])
+
 	// Translate
 	// 1. First translate Policies targeting xRoutes
 	// 2.. Finally, the policies targeting Gateways
@@ -87,6 +92,32 @@ func (t *Translator) ProcessBackendTrafficPolicies(backendTrafficPolicies []*egv
 				continue
 			}
 
+			// Populate the gatewayRouteMap that will be used to check policy overrides
+			var parents []gwapiv1.ParentReference
+			switch r := route.(type) {
+			case *HTTPRouteContext:
+				parents = r.Spec.ParentRefs
+			case *GRPCRouteContext:
+				parents = r.Spec.ParentRefs
+			}
+			for _, p := range parents {
+				if p.Kind == nil || *p.Kind == KindGateway {
+					namespace := route.GetNamespace()
+					if p.Namespace != nil {
+						namespace = string(*p.Namespace)
+					}
+					k := types.NamespacedName{
+						Namespace: namespace,
+						Name:      string(p.Name),
+					}.String()
+					v := utils.NamespacedName(route).String()
+					if _, ok := gatewayRouteMap[k]; !ok {
+						gatewayRouteMap[k] = make(sets.Set[string])
+					}
+					gatewayRouteMap[k].Insert(v)
+				}
+			}
+
 			t.translateBackendTrafficPolicyForRoute(policy, route, xdsIR)
 
 			message := "BackendTrafficPolicy has been accepted."
@@ -108,6 +139,23 @@ func (t *Translator) ProcessBackendTrafficPolicies(backendTrafficPolicies []*egv
 
 			t.translateBackendTrafficPolicyForGateway(policy, gateway, xdsIR)
 
+			// Check if this policy is overridden by other policies
+			// targeting at route level
+			gw := utils.NamespacedName(gateway).String()
+			if r, ok := gatewayRouteMap[gw]; ok {
+				// Maintain order here to ensure status/string does not change with the same data
+				routes := r.UnsortedList()
+				sort.Strings(routes)
+				message := fmt.Sprintf("There are existing ClientTrafficPolicies that are overriding this one on these routes: %v", routes)
+
+				status.SetBackendTrafficPolicyCondition(policy,
+					egv1a1.PolicyConditionOverridden,
+					metav1.ConditionTrue,
+					egv1a1.PolicyReasonOverridden,
+					message,
+				)
+			}
+
 			message := "BackendTrafficPolicy has been accepted."
 			status.SetBackendTrafficPolicyAcceptedIfUnset(&policy.Status, message)
 		}

internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml

@@ -71,6 +71,12 @@ backendTrafficPolicies:
       namespace: envoy-gateway
   status:
     conditions:
+    - lastTransitionTime: null
+      message: 'There are existing ClientTrafficPolicies that are overriding this
+        one on these routes: [envoy-gateway/httproute-1]'
+      reason: Overridden
+      status: "True"
+      type: Overridden
     - lastTransitionTime: null
       message: BackendTrafficPolicy has been accepted.
       reason: Accepted

internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml

@@ -69,6 +69,12 @@ backendTrafficPolicies:
       namespace: envoy-gateway
   status:
     conditions:
+    - lastTransitionTime: null
+      message: 'There are existing ClientTrafficPolicies that are overriding this
+        one on these routes: [default/httproute-1]'
+      reason: Overridden
+      status: "True"
+      type: Overridden
     - lastTransitionTime: null
       message: BackendTrafficPolicy has been accepted.
       reason: Accepted

internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml

@@ -84,6 +84,12 @@ backendTrafficPolicies:
       namespace: envoy-gateway
   status:
     conditions:
+    - lastTransitionTime: null
+      message: 'There are existing ClientTrafficPolicies that are overriding this
+        one on these routes: [default/httproute-1 default/httproute-2]'
+      reason: Overridden
+      status: "True"
+      type: Overridden
     - lastTransitionTime: null
       message: BackendTrafficPolicy has been accepted.
       reason: Accepted