From 36ec93a493db5b7321c77778b5313ec48c40d0ca Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Tue, 21 Jul 2026 20:06:25 -0400
Subject: [PATCH] feat: aggregate SecurityPolicy status from edge

SecurityPolicies in project control planes did not surface their edge
status because no Karmada ResourceInterpreterCustomization aggregated
SecurityPolicy status from member clusters back to the hub.

Add a statusAggregation customization for
gateway.envoyproxy.io/v1alpha1 SecurityPolicy, modeled on the existing
BackendTrafficPolicy block. SecurityPolicy uses the Gateway API
PolicyStatus shape, so aggregation copies status.ancestors from the
first member status item.

Closes #97
---
 config/federation/resourceinterpreters.yaml | 32 +++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/config/federation/resourceinterpreters.yaml b/config/federation/resourceinterpreters.yaml
index 452a19ad..36553ac2 100644
--- a/config/federation/resourceinterpreters.yaml
+++ b/config/federation/resourceinterpreters.yaml
@@ -232,3 +232,35 @@ spec:
           end
           return desiredObj
         end
+---
+apiVersion: config.karmada.io/v1alpha1
+kind: ResourceInterpreterCustomization
+metadata:
+  name: gateway.envoyproxy.io-securitypolicy
+spec:
+  target:
+    apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: SecurityPolicy
+  customizations:
+    statusAggregation:
+      luaScript: >
+        function AggregateStatus(desiredObj, statusItems)
+          if statusItems == nil or #statusItems == 0 then
+            return desiredObj
+          end
+          if desiredObj.status == nil then
+            desiredObj.status = {}
+          end
+
+          local item = statusItems[1]
+          if item == nil or item.status == nil then
+            return desiredObj
+          end
+
+          -- TODO(jreese) implement proper aggregation logic. Would be good to
+          -- think through how to represent propagation status across clusters.
+          if item.status.ancestors ~= nil then
+            desiredObj.status.ancestors = item.status.ancestors
+          end
+          return desiredObj
+        end