fix: isHTTPRouteFilterReferencingSecret always returns true and cross-namespace index

Two bugs in the HTTPRouteFilter secret predicate path:

1. predicates.go: isHTTPRouteFilterReferencingSecret had 'return true' where
   'return false' was intended when no HTTPRouteFilter references the given
   Secret. This caused validateSecretForReconcile to always return true when
   hrfCRDExists=true, triggering unnecessary reconciliations on every Secret
   change.

2. indexers.go: secretRouteFilterIndexFunc indexed the Secret reference under
   filter.Namespace instead of the Secret's actual namespace. When
   ValueRef.Namespace points to a different namespace (allowed by the CRD
   with a ReferenceGrant), the index key was wrong and cross-namespace
   credential rotation would not trigger reconciliation. Fixed by using
   gatewayapi.NamespaceDerefOr to resolve the correct namespace, matching
   the pattern used by secretSecurityPolicyIndexFunc and
   secretEnvoyExtensionPolicyIndexFunc.

Added unit tests covering:
- Secret not referenced by any HTTPRouteFilter (expect false)
- Secret referenced by HTTPRouteFilter CredentialInjection, same namespace (expect true)
- Secret in another namespace referenced via ValueRef.Namespace (expect true)

Author: emilien-puget

internal/provider/kubernetes/indexers.go

@@ -1154,7 +1154,7 @@ func secretRouteFilterIndexFunc(rawObj client.Object) []string {
 	if filter.Spec.CredentialInjection != nil {
 		secretReferences = append(secretReferences,
 			types.NamespacedName{
-				Namespace: filter.Namespace,
+				Namespace: gatewayapi.NamespaceDerefOr(filter.Spec.CredentialInjection.Credential.ValueRef.Namespace, filter.Namespace),
 				Name:      string(filter.Spec.CredentialInjection.Credential.ValueRef.Name),
 			}.String(),
 		)

internal/provider/kubernetes/predicates.go

@@ -320,7 +320,7 @@ func (r *gatewayAPIReconciler) isHTTPRouteFilterReferencingSecret(nsName *types.
 		return true
 	}
 
-	return true
+	return false
 }
 
 func (r *gatewayAPIReconciler) isBackendTLSPolicyReferencingSecret(nsName *types.NamespacedName) bool {

internal/provider/kubernetes/predicates_test.go

@@ -865,6 +865,61 @@ func TestValidateSecretForReconcile(t *testing.T) {
 			secret: test.GetSecret(types.NamespacedName{Namespace: "default", Name: "secret"}),
 			expect: true,
 		},
+		{
+			name: "secret not referenced by any HTTPRouteFilter",
+			configs: []client.Object{
+				test.GetGatewayClass("test-gc", egv1a1.GatewayControllerName, nil),
+			},
+			secret: test.GetSecret(types.NamespacedName{Namespace: "default", Name: "unrelated-secret"}),
+			expect: false,
+		},
+		{
+			name: "secret referenced by HTTPRouteFilter CredentialInjection",
+			configs: []client.Object{
+				test.GetGatewayClass("test-gc", egv1a1.GatewayControllerName, nil),
+				&egv1a1.HTTPRouteFilter{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "credential-filter",
+						Namespace: "default",
+					},
+					Spec: egv1a1.HTTPRouteFilterSpec{
+						CredentialInjection: &egv1a1.HTTPCredentialInjectionFilter{
+							Credential: egv1a1.InjectedCredential{
+								ValueRef: gwapiv1.SecretObjectReference{
+									Name: "credential-secret",
+								},
+							},
+						},
+					},
+				},
+			},
+			secret: test.GetSecret(types.NamespacedName{Namespace: "default", Name: "credential-secret"}),
+			expect: true,
+		},
+		{
+			name: "secret in another namespace referenced by HTTPRouteFilter CredentialInjection",
+			configs: []client.Object{
+				test.GetGatewayClass("test-gc", egv1a1.GatewayControllerName, nil),
+				&egv1a1.HTTPRouteFilter{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "credential-filter",
+						Namespace: "default",
+					},
+					Spec: egv1a1.HTTPRouteFilterSpec{
+						CredentialInjection: &egv1a1.HTTPCredentialInjectionFilter{
+							Credential: egv1a1.InjectedCredential{
+								ValueRef: gwapiv1.SecretObjectReference{
+									Name:      "credential-secret",
+									Namespace: gatewayapi.NamespacePtr("other-ns"),
+								},
+							},
+						},
+					},
+				},
+			},
+			secret: test.GetSecret(types.NamespacedName{Namespace: "other-ns", Name: "credential-secret"}),
+			expect: true,
+		},
 	}
 
 	// Create the reconciler.
@@ -877,6 +932,7 @@ func TestValidateSecretForReconcile(t *testing.T) {
 		spCRDExists:      true,
 		epCRDExists:      true,
 		eepCRDExists:     true,
+		hrfCRDExists:     true,
 		envoyGateway: &egv1a1.EnvoyGateway{
 			EnvoyGatewaySpec: egv1a1.EnvoyGatewaySpec{
 				ExtensionAPIs: &egv1a1.ExtensionAPISettings{
@@ -895,6 +951,7 @@ func TestValidateSecretForReconcile(t *testing.T) {
 			WithIndex(&egv1a1.EnvoyProxy{}, secretEnvoyProxyIndex, secretEnvoyProxyIndexFunc).
 			WithIndex(&egv1a1.EnvoyExtensionPolicy{}, secretEnvoyExtensionPolicyIndex, secretEnvoyExtensionPolicyIndexFunc).
 			WithIndex(&egv1a1.Backend{}, secretBackendIndex, secretBackendIndexFunc).
+			WithIndex(&egv1a1.HTTPRouteFilter{}, secretHTTPRouteFilterIndex, secretRouteFilterIndexFunc).
 			Build()
 		t.Run(tc.name, func(t *testing.T) {
 			res := r.validateSecretForReconcile(tc.secret)