@arkodg You are right - we do have a regression here. The following _should_ be possible but is not possible right now:

Setting a single ClientTrafficPolicy or a SecurityPolicy that targets a single Gateway, when that Gateway has more than one listener. The policy in this case is intended to apply the same settings to all of the listeners, and is valid, but it is currently being rejected.

If, instead of targeting the entire Gateway, the SecurityPolicy were to target a specific HTTPRoute then the correct behavior would have been to reject the SecurityPolicy since it's not possible to have different configuration for two routes connected to the same listener.

I think that this should be tracked as a separate issue though - WDYT?

Originally posted by @liorokman in #2742 (comment)