feat(securitypolicy): add MergeType support for policy merging

api/v1alpha1/securitypolicy_types.go

@@ -52,6 +52,15 @@ type SecurityPolicy struct {
 type SecurityPolicySpec struct {
 	PolicyTargetReferences `json:",inline"`
 
+	// MergeType determines how this configuration is merged with existing SecurityPolicy
+	// configurations targeting a parent resource. When set, this configuration will be merged
+	// into a parent SecurityPolicy (i.e. the one targeting a Gateway or Listener).
+	// This field cannot be set when targeting a parent resource (Gateway).
+	// If unset, no merging occurs, and only the most specific configuration takes effect.
+	//
+	// +optional
+	MergeType *MergeType `json:"mergeType,omitempty"`
+
 	// APIKeyAuth defines the configuration for the API Key Authentication.
 	//
 	// +optional

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml

@@ -4368,6 +4368,14 @@ spec:
                 required:
                 - providers
                 type: object
+              mergeType:
+                description: |-
+                  MergeType determines how this configuration is merged with existing SecurityPolicy
+                  configurations targeting a parent resource. When set, this configuration will be merged
+                  into a parent SecurityPolicy (i.e. the one targeting a Gateway or Listener).
+                  This field cannot be set when targeting a parent resource (Gateway).
+                  If unset, no merging occurs, and only the most specific configuration takes effect.
+                type: string
               oidc:
                 description: OIDC defines the configuration for the OpenID Connect
                   (OIDC) authentication.

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml

@@ -4367,6 +4367,14 @@ spec:
                 required:
                 - providers
                 type: object
+              mergeType:
+                description: |-
+                  MergeType determines how this configuration is merged with existing SecurityPolicy
+                  configurations targeting a parent resource. When set, this configuration will be merged
+                  into a parent SecurityPolicy (i.e. the one targeting a Gateway or Listener).
+                  This field cannot be set when targeting a parent resource (Gateway).
+                  If unset, no merging occurs, and only the most specific configuration takes effect.
+                type: string
               oidc:
                 description: OIDC defines the configuration for the OpenID Connect
                   (OIDC) authentication.