EnvoyProxy CRD validation blocks per-Gateway tracing overrides that rely on merged backendRefs

Description:

The CEL validation on spec.telemetry.tracing.provider is enforced per-object at admission, before the GatewayClass-level <-> per-Gateway mergeType: StrategicMerge merge runs.

As a result a per-Gateway EnvoyProxy cannot override a single tracing-provider field (e.g. serviceName) while inheriting type and other fields merged class-level EnvoyProxy.

Expected: the per-Gateway EnvoyProxy is accepted and the host/backendRefs requirement is validated against the merged result, so type + backendRefs can be defined once on the class-level EnvoyProxy and individual provider fields can be overridden per Gateway.

Repro steps:

1. Class-level EnvoyProxy, referenced by GatewayClass.spec.parametersRef:

   apiVersion: gateway.envoyproxy.io/v1alpha1
   kind: EnvoyProxy
   metadata: { name: class-proxy, namespace: envoy-gateway-system }
   spec:
     telemetry:
       tracing:
         provider:
           type: Datadog
           backendRefs:
             - { group: gateway.envoyproxy.io, kind: Backend, name: datadog-apm, port: 8126 }
   

2. Per-Gateway EnvoyProxy, referenced by Gateway.spec.infrastructure.parametersRef, intending to only override serviceName:

   apiVersion: gateway.envoyproxy.io/v1alpha1
   kind: EnvoyProxy
   metadata: { name: gw-proxy, namespace: app-ns }
   spec:
     mergeType: StrategicMerge
     telemetry:
       tracing:
         provider:
           serviceName: my-custom-service
   

3. kubectl apply of gw-proxy is rejected:

   The EnvoyProxy "gw-proxy" is invalid: spec.telemetry.tracing.provider:
   Invalid value: "object": no such key: backendRefs evaluating rule:
   host or backendRefs needs to be set
   

Environment:

• Envoy Gateway v1.8.2 (gateway-helm chart 1.8.2)
• Kubernetes v1.33 (also reproduced on kind v1.36.1)

Logs:

N/A