SecurityPolicy / BackendTrafficPolicy status churn: status.ancestors oscillates when targeting multiple routes #8318
Description
Description:
When a single policy targets multiple HTTPRoutes that attach to different Gateways, status.ancestors on the policy churns continuously.
Observed with at least:
SecurityPolicyBackendTrafficPolicy
The policy status flips between different ancestor, causing constant updates.
Reproducer
Create a policy that targets two routes:
targetRefs:
- group: gateway.networking.k8s.io
kind: HTTPRoute
name: foo-route
- group: gateway.networking.k8s.io
kind: HTTPRoute
name: bar-route
Those routes are attached to different Gateways similar to:
```bash
NAME CLASS ADDRESS PROGRAMMED AGE
foo-gateway foo-gateway-class 198.51.100.10 True 300d
bar-gateway bar-gateway-class 10.0.0.20 True 280dstatus.ancestors keeps flipping between snapshots like:
- [bar-gateway]
- [foo-gateway]
with frequent lastTransitionTime changes and repeated status updates.
status:
ancestors:
- ancestorRef:
group: gateway.networking.k8s.io
kind: Gateway
name: foo-gateway
conditions:
- lastTransitionTime: timestamp
message: Policy has been accepted.
observedGeneration: 3
reason: Accepted
status: "True"
type: Accepted
controllerName: gateway.envoyproxy.io/gatewayclass-controller
---
status:
ancestors:
- ancestorRef:
group: gateway.networking.k8s.io
kind: Gateway
name: bar-gateway
conditions:
- lastTransitionTime: timestamp
message: Policy has been accepted.
observedGeneration: 3
reason: Accepted
status: "True"
type: Accepted
controllerName: gateway.envoyproxy.io/gatewayclass-controller