+Fixed a route-level `SecurityPolicy` with `mergeType` set being rejected on admission when its `authorization` rules reference a JWT provider defined by the parent `SecurityPolicy` it merges into (`if authorization.rules.principal.jwt is used, jwt must be defined`). The CRD validation ran against the policy before the merge, so the JWT providers had to be duplicated on every route. The reference is now resolved against the merged policy, and an unknown provider is reported as an `Accepted: False` condition on the policy instead of silently producing an authorization rule that never matches.
0 commit comments