docs: document SecurityPolicy client-IP authorization for UDPRoute

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io>

Author: zhaohuabing

release-notes/current/new_features/9833-securitypolicy-udproute-client-ip.md

@@ -0,0 +1 @@
+Added `UDPRoute` as a valid `SecurityPolicy` target, so client IP allowlists and denylists can now be applied to UDP services such as DNS, syslog, NTP, telemetry collectors and game servers. As with `TCPRoute`, only `authorization` rules using `principal.clientCIDRs` apply; the client IP is the source address of the datagram, and a denied source is dropped without a reply rather than receiving an error.

site/content/en/latest/concepts/gateway_api_extensions/security-policy.md

@@ -36,13 +36,13 @@ SecurityPolicy can be attached to Gateway API resources using two targeting mech
 1. **Direct Reference (`targetRefs`)**: Explicitly reference specific resources by name and kind.
 2. **Label Selection (`targetSelectors`)**: Match resources based on their labels (see [targetSelectors API reference](../../api/extension_types#targetselectors))
 
-The policy applies to all resources that match either targeting method. You can target various Gateway API resource types including `Gateway`, `ListenerSet`, `HTTPRoute`, `GRPCRoute`, and `TCPRoute`.
+The policy applies to all resources that match either targeting method. You can target various Gateway API resource types including `Gateway`, `ListenerSet`, `HTTPRoute`, `GRPCRoute`, `TCPRoute`, and `UDPRoute`.
 
 When a SecurityPolicy targets a `ListenerSet`, it applies only to listeners in that ListenerSet. It does not apply to listeners owned directly by the parent Gateway. A `ListenerSet` target can also use `sectionName` to apply the policy to a single listener in the ListenerSet.
 
 Route-level policies apply to the targeted route regardless of whether that route is attached directly to a `Gateway` or through a `ListenerSet`.
 
-Note: TCPRoute support is limited to authorization using client IP allow/deny lists (IP-based authorization). Other SecurityPolicy features such as JWT, API Key, Basic Auth, or OIDC are not applicable to TCPRoute targets.
+Note: TCPRoute and UDPRoute support is limited to authorization using client IP allow/deny lists (IP-based authorization). Other SecurityPolicy features such as JWT, API Key, Basic Auth, or OIDC are not applicable to L4 targets, since there is no HTTP request to inspect. For a UDPRoute the client IP is the source address of the datagram, and a denied source is dropped without a reply.
 
 **Important**: A SecurityPolicy can only target resources in the same namespace as the policy itself.
 
@@ -52,8 +52,8 @@ When multiple SecurityPolicies apply to the same resource, Envoy Gateway resolve
 
 Route-specific policies take precedence first:
 
-1. **Route rule-level policies** (HTTPRoute, GRPCRoute, or TCPRoute with `sectionName` targeting specific rules)
-2. **Route-level policies** (HTTPRoute, GRPCRoute, or TCPRoute without `sectionName`)
+1. **Route rule-level policies** (HTTPRoute, GRPCRoute, TCPRoute, or UDPRoute with `sectionName` targeting specific rules)
+2. **Route-level policies** (HTTPRoute, GRPCRoute, TCPRoute, or UDPRoute without `sectionName`)
 
 After route-specific policies, parent policy precedence depends on how the route is attached.
 

site/content/en/latest/tasks/security/restrict-ip-access.md

@@ -6,7 +6,7 @@ This task provides instructions for configuring IP allowlist/denylist on Envoy G
 checks if an incoming request is from an allowed IP address before routing the request to a backend service.
 
 Envoy Gateway introduces a new CRD called [SecurityPolicy][SecurityPolicy] that allows the user to configure IP allowlist/denylist.
-This instantiated resource can be linked to a [Gateway][Gateway], [HTTPRoute][HTTPRoute], [GRPCRoute][GRPCRoute] or [TCPRoute][TCPRoute] resource.
+This instantiated resource can be linked to a [Gateway][Gateway], [HTTPRoute][HTTPRoute], [GRPCRoute][GRPCRoute], [TCPRoute][TCPRoute] or [UDPRoute][UDPRoute] resource.
 
 ## Prerequisites
 
@@ -195,3 +195,4 @@ Checkout the [Developer Guide](/community/develop) to get involved in the projec
 [HTTPRoute]: https://gateway-api.sigs.k8s.io/reference/api-types/httproute/
 [GRPCRoute]: https://gateway-api.sigs.k8s.io/reference/api-types/grpcroute/
 [TCPRoute]: https://gateway-api.sigs.k8s.io/guides/tcp/
+[UDPRoute]: https://gateway-api.sigs.k8s.io/api-types/udproute/