Support targetRef with AI RoutePolicy

[npolshakova]

We want to support configuring RoutePolicy with targetRef for AI Options:

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: route-to-upstream
  namespace: gwtest
spec:
  parentRefs:
    - name: http-gw-for-test
  hostnames:
    - "www.example.com"
  rules:
    - matches:
        - path:
            type: Exact
            value: /v1/chat/completions
    - backendRefs:
        - name: vertexai
          kind: Upstream
          group: gateway.kgateway.dev
---
apiVersion: gateway.kgateway.dev/v1alpha1
kind: RoutePolicy
metadata:
  name: route-test
  namespace: gwtest
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: vertexai
  ai:
    promptGuard:
      request:
        customResponse:
          message: "Rejected due to inappropriate content"
          statusCode: 400
        regex:
          matches:
            - "credit card"

However, if one of the route rules doesn't have an AI Upstream, the targetRef should error:

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: route-to-upstream
  namespace: gwtest
spec:
  parentRefs:
    - name: http-gw-for-test
  hostnames:
    - "www.example.com"
  rules:
    - matches:
        - path:
            type: Exact
            value: /hello
    - backendRefs:
        - name: not-an-ai-service # this can't have AI RoutePolicy applied
          kind: Service
    - matches:
        - path:
            type: Exact
            value: /v1/chat/completions
    - backendRefs:
        - name: vertexai
          kind: Upstream
          group: gateway.kgateway.dev
---
apiVersion: gateway.kgateway.dev/v1alpha1
kind: RoutePolicy
metadata:
  name: route-test
  namespace: gwtest
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: vertexai
  ai:
    promptGuard:
      request:
        customResponse:
          message: "Rejected due to inappropriate content"
          statusCode: 400
        regex:
          matches:
            - "credit card"

In this case, we need:

• Check the Upstream is an AI Upstream before running the ApplyRoute plugin (

  kgateway/internal/kgateway/extensions2/plugins/routepolicy/route_policy_plugin.go

  Line 106 in b85f004

  func (p *routePolicyPluginGwPass) ApplyForRoute(ctx context.Context, pCtx *ir.RouteContext, outputRoute *envoy_config_route_v3.Route) error {

  ). Report an error if there is a mismatch, don't translate policy. The ApplyRoute does not have access to the Upstream, so it's trickier to validate the route is referencing an AI Upstream

[npolshakova]

@lgadban Here's the issue write up for the targetRef problem!