Support ListenerSet as TargetRefs for xPolicies

Related to #5800

This issue has been automatically marked as stale because it has not had activity in the last 30 days.

change to ListenerSet as it's promoted to standard in Gateway API v1.5.

This issue has been automatically marked as stale because it has not had activity in the last 30 days.

Not stale, ListenerSet is now supported with 1.8.0. It would be nice to have support for targetting them with

EnvoyExtensionPolicy
SecurityPolicy
ClientTrafficPolicy
BackendTrafficPolicy

Our team is currently waiting for this feature to start migrating the NGINX Ingresses in all our clusters to Envoy Gateway.
It's great that it will be included in Envoy Gateway 1.9.0

/assign

Before jumping into the implementation, I’d like to get everyone on the same page about the design and current support.
and I’d like to discuss the scope of the first release.

whether we should support section-level policy attachment for ListenerSet ?
whether we should support mergeType spec for ListenerSet ?

Current

Policy	Target resources	Section attachment support	Merge support
`EnvoyExtensionPolicy`	`Gateway`, `HTTPRoute`, `GRPCRoute`, `UDPRoute`, `TCPRoute`, `TLSRoute`	Yes. Supports `Gateway(section=listener)` and `Route(section=rule)`	No. tracking issue #6733
`SecurityPolicy`	`Gateway`, `HTTPRoute`, `GRPCRoute`, `TCPRoute`	Yes. Supports `Gateway(section=listener)` and `Route(section=rule)`	Yes. Route can merge with parent `Gateway` / `Gateway(section)`
`ClientTrafficPolicy`	`Gateway` only	Yes. Supports `Gateway(section=listener)`	No. tracking issue #6735
`BackendTrafficPolicy`	`Gateway`, `HTTPRoute`, `GRPCRoute`, `UDPRoute`, `TCPRoute`, `TLSRoute`	Yes. Supports `Gateway(section=listener)` and `Route(section=rule)`	Yes. Route can merge with parent `Gateway` / `Gateway(section)`

policy hierarchy

Route Rule > Route > Listener > Gateway

merge behavior

support
- resource level
- e.g. route and gateway
not support
- section level
- e.g. route rule and route, listener and gateway

ListenerSet Policy Design

Support Section attachment

Based on GEP 1713, it looks that policy should affect all listeners in ListenerSet
https://gateway-api.sigs.k8s.io/geps/gep-1713/#policy-attachment

IMO, it may be fine to start by supporting whole attachment only. If there is strong user demand, we can consider adding section attachment support later.
wdyt @envoyproxy/envoy-maintainers ?

policy hierarchy

Route Rule > Route > ListenerSet > Listener > Gateway

merge behavior

when Route policy has `mergeType`

we should include ListenerSet in merge target.
when Route policy has mergeType and ListenerSet parentRef and there are related Gateway and ListenerSet Policies,
we should handle merge process with three policies based on hierarchy.

I think in many cases the Infra team manages Gateway and its policies, while the App team manages ListenerSet/xRoute and their policies. This makes three-way merge support important.

when ListenerSet policy has `mergeType`

If we support mergeType in ListenerSet policy, we should handle merge process with two policies.(ListenerSet/Gateway).
I'm considering whether to include support for mergeType in ListenerSet Policy in the first release.
wdyt @envoyproxy/envoy-maintainers ?

@apkatsikas

/assign @apkatsikas

@apkatsikas will work on CTP
@kkk777-7 will work on SP

Does this issue also cover referencing a HTTPRoute that references a ListenerSet (e.g. BackendTrafficPolicy -> HTTPRoute -> ListenerSet -> Gateway)?

I have something like this which doesn't seem to be picked up by the envoy-gateway as it gets no status, meanwhile the same policy that targets a direct HTTPRoute (BTP -> HTTPRoute -> Gateway) works:

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
  name: grafana
  namespace: grafana
spec:
  loadBalancer:
    consistentHash:
      cookie:
        attributes:
          Path: /
        name: lb-session-affinity
        ttl: 1h
      type: Cookie
    type: ConsistentHash
  mergeType: StrategicMerge
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: grafana

Not sure if this is a missing feature or a bug, it seems that there's a missing code for handling this case in all policies:

gateway/internal/gatewayapi/backendtrafficpolicy.go

Line 457 in 3ab110e

if p.Kind == nil || *p.Kind == resource.KindGateway {

@eplightning

Hi @eplightning, I've run into the same issue when using SecurityPolicy resources.

SecurityPolicy → HTTPRoute → ListenerSet → Gateway doesn't work for me either,

while SecurityPolicy → HTTPRoute → Gateway works perfectly.

However, I'm not sure if this issue will cover that problem, since the core issue is about supporting ListenerSet resources as targetRefs in xPolicies... it would be very nice.

At my job, we're currently waiting on this to migrate all of our applications that use mTLS (we need to enable mTLS in ClientTrafficPolicy and target it to a ListenerSet).

@V1cenZ

@V1cenZ Created a separate issue+PR for using policies with routes attached to ListenerSets: #9242

reopen: need follow-up PRs for BTP/EEP
I'm working these.

Hi, everyone. we finished to implement for LS policy attachment.
This feature will ship in v1.9.0-rc.1.
Let's try it out and feel free to open an issue if you have any feedback.

Navigation Menu

Repository navigation

Support ListenerSet as TargetRefs for xPolicies #8092

Current

policy hierarchy

merge behavior

ListenerSet Policy Design

Support Section attachment

policy hierarchy

merge behavior

when Route policy has `mergeType`

when ListenerSet policy has `mergeType`

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Support ListenerSet as TargetRefs for xPolicies #8092

Description

Activity

github-actions commented on Mar 12, 2026

zirain commented on Mar 12, 2026

github-actions commented on Apr 11, 2026

sjoukedv commented on May 13, 2026

V1cenZ commented on May 17, 2026

kkk777-7 commented on May 18, 2026

kkk777-7 commented on May 18, 2026

Current

policy hierarchy

merge behavior

ListenerSet Policy Design

Support Section attachment

policy hierarchy

merge behavior

when Route policy has mergeType

when ListenerSet policy has mergeType

kkk777-7 commented on May 18, 2026

eplightning commented on Jun 1, 2026

V1cenZ commented on Jun 10, 2026

eplightning commented on Jun 17, 2026

kkk777-7 commented on Jul 5, 2026

kkk777-7 commented on Jul 30, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

when Route policy has `mergeType`

when ListenerSet policy has `mergeType`