Unable to reference jwt provider when composing Gateway SecurityPolicy and HTTPRoute SecurityPolicy

[jimmyjones2]

Description:
I've configured OIDC and JWT in a SecurityConfig at the Gateway. I'd like to have a SecurityConfig per HTTPRoute to override / add authorization, without having to duplicate the jwt configuration.

If I don't duplicate the JWT configuration, I get the error The SecurityPolicy "argocd-compose" is invalid: spec: Invalid value: if authorization.rules.principal.jwt is used, jwt must be defined - the admission controller doesn't appear to be checking the merged SecurityConfig, but the SecurityConfig before it's merged.

Repro steps:
(lightly redacted)

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: oidc
  namespace: envoy-gateway-system
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: gw
  oidc:
    provider:
      issuer: https://auth.example.com
    clientID: foobar
    clientSecret:
      name: oidc-creds
    redirectURL: https://myapp.example.com/oauth2/callback
    logoutPath: /logout
    cookieDomain: myapp.example.com
    forwardAccessToken: true
  jwt:
    providers:
    - name: zitadel
      remoteJWKS:
        uri: https://auth.example.com/oauth/v2/keys
      claimToHeaders:
      - claim: sub
        header: X-Zitadel-Sub
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: argocd
  namespace: argocd
spec:
  parentRefs:
    - name: gw
      kind: Gateway
      group: gateway.networking.k8s.io
      namespace: envoy-gateway-system
  hostnames:
    - argocd.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: argocd-server
          port: 80
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: argocd
  namespace: argocd
spec:
  mergeType: StrategicMerge  
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: argocd
  # Without jwt dictionary got following issue 
  # The SecurityPolicy "argocd-compose" is invalid: spec: Invalid value: if authorization.rules.principal.jwt is used, jwt must be defined
  # If copy jwt dictionary from oidc SecurityPolicy above, works as expected
  authorization:
    defaultAction: Deny
    rules:
      - name: allow-mygroup
        action: Allow
        principal:
          jwt:
            provider: zitadel
            claims:
              - name: roles
                valueType: StringArray
                values:
                  - mygroup

Environment:
envoy-gateway helm 1.8.0
envoy v1.38.3

Logs:
N/A

[arkodg]

cc @kkk777-7