Repository: envoyproxy/gateway

Issue:
Inconsistent between how UDPRoute and HTTPRoute handles Accepted condition
https://github.com/envoyproxy/gateway/pull/5803#discussion_r2057742805

Discussion:
@github-actions: This issue has been automatically marked as stale because it has not had activity in the last 30 days.

Solution patch:
diff --git a/VERSION b/VERSION
index 0d0c52f84..66d62a800 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-v1.4.0
+v1.4.1
diff --git a/internal/gatewayapi/route.go b/internal/gatewayapi/route.go
index 6bdeaf8b0..9c95e9d87 100644
--- a/internal/gatewayapi/route.go
+++ b/internal/gatewayapi/route.go
@@ -1117,16 +1117,6 @@ func (t *Translator) processUDPRouteParentRefs(udpRoute *UDPRouteContext, resour
 				metav1.ConditionFalse,
 				resolveErrs.Reason(),
 				resolveErrs.Error())
-
-			// TODO: zhaohuabing should we set the accepted condition to false here?
-			status.SetRouteStatusCondition(routeStatus,
-				parentRef.routeParentStatusIdx,
-				udpRoute.GetGeneration(),
-				gwapiv1.RouteConditionAccepted,
-				metav1.ConditionFalse,
-				"Failed to process the settings associated with the UDP route.",
-				resolveErrs.Error(),
-			)
 		} else {
 			status.SetRouteStatusCondition(routeStatus,
 				parentRef.routeParentStatusIdx,
diff --git a/release-notes/v1.4.1.yaml b/release-notes/v1.4.1.yaml
new file mode 100644
index 000000000..7a7b1311e
--- /dev/null
+++ b/release-notes/v1.4.1.yaml
@@ -0,0 +1,21 @@
+date: June 4, 2025
+
+# New features or capabilities added in this release.
+new features: |
+  Added support for configuring Subject Alternative Names (SANs) for upstream TLS validation via `BackendTLSPolicy.validation.subjectAltNames`.
+  Added support for setting ownerreference to infra resources when Gateway Namespace mode is enabled.
+
+bug fixes: |
+  Fixed OverlappingTLSConfig condition for merged Gateways.
+  Fixed an issue with shared rules in the rate limit translator when `clientSelector` is not specified.
+  Fixed an issue with handling integer values in zone annotations.
+  Fixed an issue where routes without WASM in their EnvoyExtensionPolicies returned HTTP 500 responses when WASM cache initialization failed.
+  Fixed an issue where UDP listeners were not created in the Envoy proxy’s xDS configuration.
+  Fixed broken rate limit merging for `BackendTrafficPolicy` when the Gateway target defines rate limiting but the Route target does not.
+  Fixed an issue that preserves ALPN configuration for listeners with overlapping certificates when ALPN is explicitly set in `ClientTrafficPolicy`.
+  Replaced static UID with a dynamic UID for the global rate limit Grafana dashboard.
+
+# Other notable changes not covered by the above sections.
+Other changes: |
+  Fixed backend TLS e2e test.
+  Bumped go version to 1.24.3.
diff --git a/site/content/en/news/releases/notes/v1.4.1.md b/site/content/en/news/releases/notes/v1.4.1.md
new file mode 100644
index 000000000..035d4c8d7
--- /dev/null
+++ b/site/content/en/news/releases/notes/v1.4.1.md
@@ -0,0 +1,27 @@
+---
+title: "v1.4.1"
+publishdate: 2025-06-04
+---
+
+Date: June 4, 2025
+
+## New Features
+
+- Added support for configuring Subject Alternative Names (SANs) for upstream TLS validation via `BackendTLSPolicy.validation.subjectAltNames`.
+- Added support for setting ownerreference to infra resources when Gateway Namespace mode is enabled.
+
+## Bug Fixes
+
+- Fixed OverlappingTLSConfig condition for merged Gateways.
+- Fixed an issue with shared rules in the rate limit translator when `clientSelector` is not specified.
+- Fixed an issue with handling integer values in zone annotations.
+- Fixed an issue where routes without WASM in their EnvoyExtensionPolicies returned HTTP 500 responses when WASM cache initialization failed.
+- Fixed an issue where UDP listeners were not created in the Envoy proxy’s xDS configuration.
+- Fixed broken rate limit merging for `BackendTrafficPolicy` when the Gateway target defines rate limiting but the Route target does not.
+- Fixed an issue that preserves ALPN configuration for listeners with overlapping certificates when ALPN is explicitly set in `ClientTrafficPolicy`.
+- Replaced static UID with a dynamic UID for the global rate limit Grafana dashboard.
+
+## Other changes
+
+- Fixed backend TLS e2e test.
+- Bumped go version to 1.24.3.
diff --git a/site/content/en/v1.4/concepts/introduction/load-balancing.md b/site/content/en/v1.4/concepts/introduction/load-balancing.md
new file mode 100644
index 000000000..e99bbc138
--- /dev/null
+++ b/site/content/en/v1.4/concepts/introduction/load-balancing.md
@@ -0,0 +1,70 @@
+---
+title: "Load Balancing"
+---
+
+## Overview
+
+Load balancing distributes incoming requests across multiple backend services to improve availability, responsiveness, and scalability. Instead of directing all traffic to a single backend, which can cause slowdowns or outages, load balancing spreads the load across multiple instances, helping your applications stay fast and reliable under pressure.
+
+## Use Cases
+
+Use load balancing to:
+
+- Handle high traffic by distributing it across multiple service instances  
+- Keep services available even if one or more backends go down  
+- Improve response time by routing to less busy or closer backends  
+
+## Load Balancing in Envoy Gateway
+
+Envoy Gateway supports several load balancing strategies that determine how traffic is distributed across backend services. These strategies are configured using the `BackendTrafficPolicy` resource and can be applied to `Gateway`, `HTTPRoute`, or `GRPCRoute` resources either by directly referencing them using the targetRefs field or by dynamically selecting them using the targetSelectors field, which matches resources based on Kubernetes labels.
+
+**Supported load balancing types:**
+- **Round Robin** – Sends requests sequentially to all available backends
+- **Random** – Chooses a backend at random to balance load
+- **Least Request** – Sends the request to the backend with the fewest active requests (this is the default)
+- **Consistent Hash** – Routes requests based on a hash (e.g., client IP or header), which helps keep repeat requests going to the same backend (useful for session affinity)
+
+If no load balancing strategy is specified, Envoy Gateway uses **Least Request** by default.
+
+## Example: Round Robin Load Balancing
+
+This example shows how to apply the Round Robin strategy using a `BackendTrafficPolicy` that targets a specific `HTTPRoute`:
+
+```yaml
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: round-robin-policy
+  namespace: default
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: round-robin-route
+  loadBalancer:
+    type: RoundRobin
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: round-robin-route
+  namespace: default
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - "www.example.com"
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /round
+    backendRefs:
+    - name: backend
+      port: 3000
+```
+In this setup, traffic matching /round is distributed evenly across all available backend service instances. For example, if there are four replicas of the backend service, each one should receive roughly 25% of the requests.
+
+## Related Resources
+- [BackendTrafficPolicy](../introduction/gateway_api_extensions/backend-traffic-policy.md)
+- [Task: Load Balancing](../../tasks/traffic/load-balancing.md)
diff --git a/site/content/en/v1.4/concepts/introduction/rate-limiting.md b/site/content/en/v1.4/concepts/introduction/rate-limiting.md
new file mode 100644
index 000000000..02df8c39b
--- /dev/null
+++ b/site/content/en/v1.4/concepts/introduction/rate-limiting.md
@@ -0,0 +1,107 @@
+---
+title: "Rate Limiting"
+---
+
+## Overview
+
+Rate limiting is a technique for controlling the number of incoming requests over a defined period. It can be used to control usage for business purposes, like agreed usage quotas, or to ensure the stability of a system, preventing overload and protecting the system from, e.g., Denial of Service attacks.
+
+## Use Cases
+
+Rate limiting is commonly used to:
+
+- **Prevent Overload:** Protect internal systems like databases from excessive traffic.
+- **Enhance Security:** Block or limit abusive behavior such as brute-force attempts or DDoS attacks.
+- **Ensure Fair Usage:** Enforce quotas and prevent resource hogging by individual clients.
+- **Implement Entitlements:** Define API usage limits based on user identity or role.
+
+## Rate Limiting in Envoy Gateway
+
+Envoy Gateway supports two types of rate limiting:
+
+- **Global Rate Limiting:** Shared limits across all Envoy instances.
+- **Local Rate Limiting:** Independent limits per Envoy instance.
+
+Envoy Gateway supports rate limiting through the `BackendTrafficPolicy` custom resource. You can define rate-limiting rules and apply them to `HTTPRoute`, `GRPCRoute`, or `Gateway` resources either by directly referencing them with the targetRefs field or by dynamically selecting them using the targetSelectors field, which matches resources based on Kubernetes labels.
+
+{{% alert title="Note" color="primary" %}}
+Rate limits are applied per route, even if the `BackendTrafficPolicy` targets a `Gateway`. For example, if the limit is 100r/s and a Gateway has 3 routes, each route has its own 100r/s bucket.
+{{% /alert %}}
+
+---
+
+## Global Rate Limiting
+
+Global rate limiting ensures a consistent request limit across the entire Envoy fleet. This is ideal for shared resources or distributed environments where coordinated enforcement is critical.
+
+Global limits are enforced via Envoy’s external Rate Limit Service, which is automatically deployed and managed by the Envoy Gateway system. The Rate Limit Service requires a datastore component (commonly Redis). When a request is received, Envoy sends a descriptor to this external service to determine if the request should be allowed.
+
+**Benefits of global limits:**
+
+- Centralized control across instances
+- Fair sharing of backend capacity
+- Burst resistance during autoscaling
+
+### Example
+
+```yaml
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: global-ratelimit
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: my-api
+  rateLimit:
+    type: Global
+    global:
+      rules:
+      - limit:
+          requests: 100
+          unit: Minute
+
+```
+This configuration limits all requests across all Envoy instances for the my-api route to 100 requests per minute total. If there are multiple replicas of Envoy, the limit is shared across all of them.
+
+---
+
+## Local Rate Limiting
+
+
+Local rate limiting applies limits independently within each Envoy Proxy instance. It does not rely on external services, making it lightweight and efficient—especially for blocking abusive traffic early.
+
+**Benefits of local limits:**
+
+- Lightweight and does not require an external rate limit service
+- Fast enforcement with rate limiting at the edge
+- Effective as a first line of defense against traffic bursts
+
+### Example
+
+```yaml
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: local-ratelimit
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: my-api
+  rateLimit:
+    type: Local
+    local:
+      rules:
+      - limit:
+          requests: 50
+          unit: Minute
+
+```
+This configuration limits traffic to 50 requests per minute per Envoy instance for the my-api route. If there are two Envoy replicas, up to 100 total requests per minute may be allowed (50 per replica).
+
+## Related Resources
+- [BackendTrafficPolicy](../introduction/gateway_api_extensions/backend-traffic-policy.md)
+- [Task: Global Rate Limit](../../tasks/traffic/global-rate-limit.md)
+- [Task: Local Rate Limit](../../tasks/traffic/local-rate-limit.md)
diff --git a/site/layouts/shortcodes/helm-version.html b/site/layouts/shortcodes/helm-version.html
index 9091cd0a4..22ab1a18d 100644
--- a/site/layouts/shortcodes/helm-version.html
+++ b/site/layouts/shortcodes/helm-version.html
@@ -12,8 +12,8 @@
 {{- "v1.3.3" -}}
 {{- end -}}
 {{- with (strings.HasPrefix $pagePrefix "v1.4") -}}
-{{- "v1.4.0" -}}
+{{- "v1.4.1" -}}
 {{- end -}}
 {{- with (strings.HasPrefix $pagePrefix "docs") -}}
-{{- "v1.4.0" -}}
+{{- "v1.4.1" -}}
 {{- end -}}
diff --git a/site/layouts/shortcodes/yaml-version.html b/site/layouts/shortcodes/yaml-version.html
index aef3ab5ab..1296e75a4 100644
--- a/site/layouts/shortcodes/yaml-version.html
+++ b/site/layouts/shortcodes/yaml-version.html
@@ -12,8 +12,8 @@
 {{- "v1.3.3" -}}
 {{- end -}}
 {{- with (strings.HasPrefix $pagePrefix "v1.4") -}}
-{{- "v1.4.0" -}}
+{{- "v1.4.1" -}}
 {{- end -}}
 {{- with (strings.HasPrefix $pagePrefix "docs") -}}
-{{- "v1.4.0" -}}
+{{- "v1.4.1" -}}
 {{- end -}}



Test patch:
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
index dffc8a4c8..4e34fea02 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
@@ -73,9 +73,9 @@ udpRoutes:
     parents:
     - conditions:
       - lastTransitionTime: null
-        message: UDP Port 8080 not found on Service default/service-1
-        reason: Failed to process the settings associated with the UDP route.
-        status: "False"
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
         type: Accepted
       - lastTransitionTime: null
         message: UDP Port 8080 not found on Service default/service-1
@@ -100,3 +100,11 @@ xdsIR:
     - address: 0.0.0.0
       name: envoy-gateway/gateway-1/udp
       port: 10162
+      route:
+        destination:
+          metadata:
+            kind: UDPRoute
+            name: udproute-1
+            namespace: default
+          name: udproute/default/udproute-1/rule/-1
+        name: udproute/default/udproute-1
diff --git a/internal/xds/translator/testdata/in/xds-ir/udp-route-no-endpoints.yaml b/internal/xds/translator/testdata/in/xds-ir/udp-route-no-endpoints.yaml
new file mode 100644
index 000000000..c78d4436d
--- /dev/null
+++ b/internal/xds/translator/testdata/in/xds-ir/udp-route-no-endpoints.yaml
@@ -0,0 +1,13 @@
+# UDP route with no endpoints, this will happen when the Gateway API translator failed to resolve the backendRefs
+udp:
+- name: "udp-route"
+  address: "0.0.0.0"
+  port: 10162
+  route:
+    destination:
+      metadata:
+        kind: UDPRoute
+        name: udproute-1
+        namespace: default
+      name: udproute/default/udproute-1/rule/-1
+    name: udproute/default/udproute-1
diff --git a/internal/xds/translator/testdata/out/xds-ir/udp-route-no-endpoints.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/udp-route-no-endpoints.clusters.yaml
new file mode 100644
index 000000000..62b5062e7
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/udp-route-no-endpoints.clusters.yaml
@@ -0,0 +1,24 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_PREFERRED
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: udproute/default/udproute-1/rule/-1
+  ignoreHealthOnHostRemoval: true
+  lbPolicy: LEAST_REQUEST
+  metadata:
+    filterMetadata:
+      envoy-gateway:
+        resources:
+        - kind: UDPRoute
+          name: udproute-1
+          namespace: default
+  name: udproute/default/udproute-1/rule/-1
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/internal/xds/translator/testdata/out/xds-ir/udp-route-no-endpoints.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/udp-route-no-endpoints.endpoints.yaml
new file mode 100644
index 000000000..3e07819c2
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/udp-route-no-endpoints.endpoints.yaml
@@ -0,0 +1 @@
+- clusterName: udproute/default/udproute-1/rule/-1
diff --git a/internal/xds/translator/testdata/out/xds-ir/udp-route-no-endpoints.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/udp-route-no-endpoints.listeners.yaml
new file mode 100644
index 000000000..5edcecc24
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/udp-route-no-endpoints.listeners.yaml
@@ -0,0 +1,18 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10162
+      protocol: UDP
+  listenerFilters:
+  - name: envoy.filters.udp_listener.udp_proxy
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.UdpProxyConfig
+      matcher:
+        onNoMatch:
+          action:
+            name: route
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.Route
+              cluster: udproute/default/udproute-1/rule/-1
+      statPrefix: service
+  name: udp-route
diff --git a/internal/xds/translator/testdata/out/xds-ir/udp-route-no-endpoints.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/udp-route-no-endpoints.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/udp-route-no-endpoints.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/site/content/en/latest/concepts/introduction/load-balancing.md b/site/content/en/latest/concepts/introduction/load-balancing.md
new file mode 100644
index 000000000..e99bbc138
--- /dev/null
+++ b/site/content/en/latest/concepts/introduction/load-balancing.md
@@ -0,0 +1,70 @@
+---
+title: "Load Balancing"
+---
+
+## Overview
+
+Load balancing distributes incoming requests across multiple backend services to improve availability, responsiveness, and scalability. Instead of directing all traffic to a single backend, which can cause slowdowns or outages, load balancing spreads the load across multiple instances, helping your applications stay fast and reliable under pressure.
+
+## Use Cases
+
+Use load balancing to:
+
+- Handle high traffic by distributing it across multiple service instances  
+- Keep services available even if one or more backends go down  
+- Improve response time by routing to less busy or closer backends  
+
+## Load Balancing in Envoy Gateway
+
+Envoy Gateway supports several load balancing strategies that determine how traffic is distributed across backend services. These strategies are configured using the `BackendTrafficPolicy` resource and can be applied to `Gateway`, `HTTPRoute`, or `GRPCRoute` resources either by directly referencing them using the targetRefs field or by dynamically selecting them using the targetSelectors field, which matches resources based on Kubernetes labels.
+
+**Supported load balancing types:**
+- **Round Robin** – Sends requests sequentially to all available backends
+- **Random** – Chooses a backend at random to balance load
+- **Least Request** – Sends the request to the backend with the fewest active requests (this is the default)
+- **Consistent Hash** – Routes requests based on a hash (e.g., client IP or header), which helps keep repeat requests going to the same backend (useful for session affinity)
+
+If no load balancing strategy is specified, Envoy Gateway uses **Least Request** by default.
+
+## Example: Round Robin Load Balancing
+
+This example shows how to apply the Round Robin strategy using a `BackendTrafficPolicy` that targets a specific `HTTPRoute`:
+
+```yaml
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: round-robin-policy
+  namespace: default
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: round-robin-route
+  loadBalancer:
+    type: RoundRobin
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: round-robin-route
+  namespace: default
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - "www.example.com"
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /round
+    backendRefs:
+    - name: backend
+      port: 3000
+```
+In this setup, traffic matching /round is distributed evenly across all available backend service instances. For example, if there are four replicas of the backend service, each one should receive roughly 25% of the requests.
+
+## Related Resources
+- [BackendTrafficPolicy](../introduction/gateway_api_extensions/backend-traffic-policy.md)
+- [Task: Load Balancing](../../tasks/traffic/load-balancing.md)
diff --git a/site/content/en/latest/concepts/introduction/rate-limiting.md b/site/content/en/latest/concepts/introduction/rate-limiting.md
new file mode 100644
index 000000000..02df8c39b
--- /dev/null
+++ b/site/content/en/latest/concepts/introduction/rate-limiting.md
@@ -0,0 +1,107 @@
+---
+title: "Rate Limiting"
+---
+
+## Overview
+
+Rate limiting is a technique for controlling the number of incoming requests over a defined period. It can be used to control usage for business purposes, like agreed usage quotas, or to ensure the stability of a system, preventing overload and protecting the system from, e.g., Denial of Service attacks.
+
+## Use Cases
+
+Rate limiting is commonly used to:
+
+- **Prevent Overload:** Protect internal systems like databases from excessive traffic.
+- **Enhance Security:** Block or limit abusive behavior such as brute-force attempts or DDoS attacks.
+- **Ensure Fair Usage:** Enforce quotas and prevent resource hogging by individual clients.
+- **Implement Entitlements:** Define API usage limits based on user identity or role.
+
+## Rate Limiting in Envoy Gateway
+
+Envoy Gateway supports two types of rate limiting:
+
+- **Global Rate Limiting:** Shared limits across all Envoy instances.
+- **Local Rate Limiting:** Independent limits per Envoy instance.
+
+Envoy Gateway supports rate limiting through the `BackendTrafficPolicy` custom resource. You can define rate-limiting rules and apply them to `HTTPRoute`, `GRPCRoute`, or `Gateway` resources either by directly referencing them with the targetRefs field or by dynamically selecting them using the targetSelectors field, which matches resources based on Kubernetes labels.
+
+{{% alert title="Note" color="primary" %}}
+Rate limits are applied per route, even if the `BackendTrafficPolicy` targets a `Gateway`. For example, if the limit is 100r/s and a Gateway has 3 routes, each route has its own 100r/s bucket.
+{{% /alert %}}
+
+---
+
+## Global Rate Limiting
+
+Global rate limiting ensures a consistent request limit across the entire Envoy fleet. This is ideal for shared resources or distributed environments where coordinated enforcement is critical.
+
+Global limits are enforced via Envoy’s external Rate Limit Service, which is automatically deployed and managed by the Envoy Gateway system. The Rate Limit Service requires a datastore component (commonly Redis). When a request is received, Envoy sends a descriptor to this external service to determine if the request should be allowed.
+
+**Benefits of global limits:**
+
+- Centralized control across instances
+- Fair sharing of backend capacity
+- Burst resistance during autoscaling
+
+### Example
+
+```yaml
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: global-ratelimit
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: my-api
+  rateLimit:
+    type: Global
+    global:
+      rules:
+      - limit:
+          requests: 100
+          unit: Minute
+
+```
+This configuration limits all requests across all Envoy instances for the my-api route to 100 requests per minute total. If there are multiple replicas of Envoy, the limit is shared across all of them.
+
+---
+
+## Local Rate Limiting
+
+
+Local rate limiting applies limits independently within each Envoy Proxy instance. It does not rely on external services, making it lightweight and efficient—especially for blocking abusive traffic early.
+
+**Benefits of local limits:**
+
+- Lightweight and does not require an external rate limit service
+- Fast enforcement with rate limiting at the edge
+- Effective as a first line of defense against traffic bursts
+
+### Example
+
+```yaml
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: local-ratelimit
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: my-api
+  rateLimit:
+    type: Local
+    local:
+      rules:
+      - limit:
+          requests: 50
+          unit: Minute
+
+```
+This configuration limits traffic to 50 requests per minute per Envoy instance for the my-api route. If there are two Envoy replicas, up to 100 total requests per minute may be allowed (50 per replica).
+
+## Related Resources
+- [BackendTrafficPolicy](../introduction/gateway_api_extensions/backend-traffic-policy.md)
+- [Task: Global Rate Limit](../../tasks/traffic/global-rate-limit.md)
+- [Task: Local Rate Limit](../../tasks/traffic/local-rate-limit.md)