Repository: kubernetes-sigs/gateway-api

Issue:
BackendTLSPolicy conformance test for PolicyAncestorStatus

Add a conformance test to ensure consistent handling of PolicyAncestorStatus and policy acceptance logic across implementations. 

Proposed Test Cases:
- [ ] Conflict resolution between multiple BackendTLSPolicy resources targeting the same Service / Section. #4043
- [ ] Verify that controllers do not update PolicyAncestorStatus if the controllerName differs from their own.
- [x] Ensure that the AncestorRef field in PolicyAncestorStatus correctly points to a Gateway resource. Covered by #3930

Discussion:
@snorwin: /assign @snorwin 

Solution patch:
diff --git a/.github/workflows/crd-validation.yml b/.github/workflows/crd-validation.yml
index 4aa88c5a..4daf0bb4 100644
--- a/.github/workflows/crd-validation.yml
+++ b/.github/workflows/crd-validation.yml
@@ -15,7 +15,7 @@ jobs:
       fail-fast: false
       matrix:
         # Available versions at https://raw.githubusercontent.com/kubernetes-sigs/controller-tools/HEAD/envtest-releases.yaml
-        k8s_version: [v1.33.0, v1.32.0, v1.31.0, v1.30.3, v1.29.5]
+        k8s_version: [v1.34.0, v1.33.0, v1.32.0, v1.31.0, v1.30.3]
         crd_channel: [standard, experimental]
     steps:
       - name: Checkout code
diff --git a/RELEASE_MANAGEMENT.md b/RELEASE_MANAGEMENT.md
index 78d00208..b4dcbe8e 100644
--- a/RELEASE_MANAGEMENT.md
+++ b/RELEASE_MANAGEMENT.md
@@ -1,13 +1,8 @@
 # Release Management
 
 Major and minor releases for Gateway API are managed by a "Release Manager".
-The responsibilities of the release manager include:
-
-* Creating and managing a GitHub Milestone for the release.
-* Creating and managing a GitHub Project board for the release.
-* Creating and managing a GitHub Discussion Boards announcement for the release.
-  * This includes discussions to handle scoping for each release _channel_ as well.
-* Working through the [Release Cycle](#release-phases) for the release.
+The responsibilities of the release manager are defined in the [Release Manager]
+role definition doc.
 
 This management process ultimately results in the manager of the release
 shipping the release as per the [Release Process]. We will go into more detail
@@ -19,6 +14,7 @@ about this in the sections that follow.
 
 [Release Cycle]:https://gateway-api.sigs.k8s.io/contributing/release-cycle/
 [Release Process]:/RELEASE.md
+[Release Manager]:/roles/RELEASE_MANAGER.md
 
 ## Assigning a Release Manager
 
@@ -91,18 +87,25 @@ cycle is outlined in the [Release Cycle] documentation and should be followed
 according to that.
 
 The release manager is responsible for communicating with the community and
-seeking volunteers for features to be included in the release, and thus the
-release will be considered a **feature release**. If there are few or no
-volunteers the release may simply end being a smaller **maintenance release**.
+seeking volunteers for features to be included in the release.
+
+Each enhancement included in the release must have at least two people
+responsible for it:
+
+* **Owner**: This is the person who asks for the GEP to be included in the
+  release, and who is primarily responsible for doing the work to make the feature
+  happen.
+* **Shepherd**: This is the person who agrees to be the primary reviewer, and
+  to assist the feature through the GEP review process. Ideally, this person has
+  been a feature owner in the past and has experience with the GEP review process,
+  and can help smooth out any rough patches.
 
-> **Note**: Updates on the community sync and discussion boards about the
-> release process should be communicated regularly. We recommend bi-weekly
-> unless there's a clear reason to do more, or less.
+The Release Manager is expected to communicate regularly with Owners and Shepherds
+about the progress of their feature.
 
-> **Note**: Communicating whether a release is expected to be a **feature
-> release** or a **maintenance release** is largely done via the [Milestone].
-> However, the final GitHub release should also make note of this in the
-> release description.
+Additionally, the Release Manager MUST keep the broader community updated on the
+release, including what is currently in scope for the release, and any changes
+or updates. This MUST be done at least weekly.
 
 Release candidates--and the eventual final release--must utilize the [Release
 Process](/RELEASE.md) for delivery.
@@ -116,7 +119,7 @@ final release when it is cut.
 
 ## Time Extensions
 
-Extensions to timelines may be requested by contributors. Our guidelines for
+Extensions to deadlines may be requested by contributors. Our guidelines for
 this are based on the Kubernetes process:
 
 * Extensions can be granted on a per-GEP basis
diff --git a/apis/v1/shared_types.go b/apis/v1/shared_types.go
index 99299acd..2b38e32c 100644
--- a/apis/v1/shared_types.go
+++ b/apis/v1/shared_types.go
@@ -232,7 +232,7 @@ type CommonRouteSpec struct {
 }
 
 // PortNumber defines a network port.
-type PortNumber int32
+type PortNumber = int32
 
 // BackendRef defines how a Route should forward a request to a Kubernetes
 // resource.
diff --git a/apis/v1alpha2/object_reference_types.go b/apis/v1alpha2/object_reference_types.go
index 13ae680c..3dea734b 100644
--- a/apis/v1alpha2/object_reference_types.go
+++ b/apis/v1alpha2/object_reference_types.go
@@ -18,43 +18,8 @@ package v1alpha2
 
 import v1 "sigs.k8s.io/gateway-api/apis/v1"
 
-// LocalObjectReference identifies an API object within the namespace of the
-// referrer.
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-//
-// References to objects with invalid Group and Kind are not valid, and must
-// be rejected by the implementation, with appropriate Conditions set
-// on the containing object.
-// +k8s:deepcopy-gen=false
 type LocalObjectReference = v1.LocalObjectReference
 
-// SecretObjectReference identifies an API object including its namespace,
-// defaulting to Secret.
-//
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-//
-// References to objects with invalid Group and Kind are not valid, and must
-// be rejected by the implementation, with appropriate Conditions set
-// on the containing object.
-// +k8s:deepcopy-gen=false
 type SecretObjectReference = v1.SecretObjectReference
 
-// BackendObjectReference defines how an ObjectReference that is
-// specific to BackendRef. It includes a few additional fields and features
-// than a regular ObjectReference.
-//
-// Note that when a namespace different than the local namespace is specified, a
-// ReferenceGrant object is required in the referent namespace to allow that
-// namespace's owner to accept the reference. See the ReferenceGrant
-// documentation for details.
-//
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-//
-// References to objects with invalid Group and Kind are not valid, and must
-// be rejected by the implementation, with appropriate Conditions set
-// on the containing object.
-// +k8s:deepcopy-gen=false
 type BackendObjectReference = v1.BackendObjectReference
diff --git a/apis/v1alpha2/referencegrant_types.go b/apis/v1alpha2/referencegrant_types.go
index 372022f7..2c234550 100644
--- a/apis/v1alpha2/referencegrant_types.go
+++ b/apis/v1alpha2/referencegrant_types.go
@@ -59,16 +59,8 @@ type ReferenceGrantList struct {
 	Items           []ReferenceGrant `json:"items"`
 }
 
-// ReferenceGrantSpec identifies a cross namespace relationship that is trusted
-// for Gateway API.
-// +k8s:deepcopy-gen=false
 type ReferenceGrantSpec = v1beta1.ReferenceGrantSpec
 
-// ReferenceGrantFrom describes trusted namespaces and kinds.
-// +k8s:deepcopy-gen=false
 type ReferenceGrantFrom = v1beta1.ReferenceGrantFrom
 
-// ReferenceGrantTo describes what Kinds are allowed as targets of the
-// references.
-// +k8s:deepcopy-gen=false
 type ReferenceGrantTo = v1beta1.ReferenceGrantTo
diff --git a/apis/v1alpha2/shared_types.go b/apis/v1alpha2/shared_types.go
index 3d2f7879..df39d425 100644
--- a/apis/v1alpha2/shared_types.go
+++ b/apis/v1alpha2/shared_types.go
@@ -18,45 +18,14 @@ package v1alpha2
 
 import v1 "sigs.k8s.io/gateway-api/apis/v1"
 
-// ParentReference identifies an API object (usually a Gateway) that can be considered
-// a parent of this resource (usually a route). The only kind of parent resource
-// with "Core" support is Gateway. This API may be extended in the future to
-// support additional kinds of parent resources, such as HTTPRoute.
-//
-// Note that there are specific rules for ParentRefs which cross namespace
-// boundaries. Cross-namespace references are only valid if they are explicitly
-// allowed by something in the namespace they are referring to. For example:
-// Gateway has the AllowedRoutes field, and ReferenceGrant provides a
-// generic way to enable any other kind of cross-namespace reference.
-//
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-// +k8s:deepcopy-gen=false
-type ParentReference = v1.ParentReference
-
-// CommonRouteSpec defines the common attributes that all Routes MUST include
-// within their spec.
-// +k8s:deepcopy-gen=false
-type CommonRouteSpec = v1.CommonRouteSpec
-
-// PortNumber defines a network port.
-type PortNumber = v1.PortNumber
-
-// BackendRef defines how a Route should forward a request to a Kubernetes
-// resource.
-//
-// Note that when a namespace different than the local namespace is specified, a
-// ReferenceGrant object is required in the referent namespace to allow that
-// namespace's owner to accept the reference. See the ReferenceGrant
-// documentation for details.
-// +k8s:deepcopy-gen=false
-type BackendRef = v1.BackendRef
-
-// RouteConditionType is a type of condition for a route.
-type RouteConditionType = v1.RouteConditionType
-
-// RouteConditionReason is a reason for a route condition.
-type RouteConditionReason = v1.RouteConditionReason
+type (
+	ParentReference      = v1.ParentReference
+	CommonRouteSpec      = v1.CommonRouteSpec
+	PortNumber           = v1.PortNumber
+	BackendRef           = v1.BackendRef
+	RouteConditionType   = v1.RouteConditionType
+	RouteConditionReason = v1.RouteConditionReason
+)
 
 const (
 	// This condition indicates whether the route has been accepted or rejected
@@ -140,215 +109,22 @@ const (
 	RouteReasonBackendNotFound RouteConditionReason = "BackendNotFound"
 )
 
-// RouteParentStatus describes the status of a route with respect to an
-// associated Parent.
-// +k8s:deepcopy-gen=false
-type RouteParentStatus = v1.RouteParentStatus
-
-// RouteStatus defines the common attributes that all Routes MUST include within
-// their status.
-// +k8s:deepcopy-gen=false
-type RouteStatus = v1.RouteStatus
-
-// Hostname is the fully qualified domain name of a network host. This matches
-// the RFC 1123 definition of a hostname with 2 notable exceptions:
-//
-//  1. IPs are not allowed.
-//  2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
-//     label must appear by itself as the first label.
-//
-// Hostname can be "precise" which is a domain name without the terminating
-// dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
-// domain name prefixed with a single wildcard label (e.g. `*.example.com`).
-//
-// Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
-// alphanumeric characters or '-', and must start and end with an alphanumeric
-// character. No other punctuation is allowed.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
-type Hostname = v1.Hostname
-
-// PreciseHostname is the fully qualified domain name of a network host. This
-// matches the RFC 1123 definition of a hostname with 1 notable exception that
-// numeric IP addresses are not allowed.
-//
-// Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
-// alphanumeric characters or '-', and must start and end with an alphanumeric
-// character. No other punctuation is allowed.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
-type PreciseHostname = v1.PreciseHostname
-
-// Group refers to a Kubernetes Group. It must either be an empty string or a
-// RFC 1123 subdomain.
-//
-// This validation is based off of the corresponding Kubernetes validation:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L208
-//
-// Valid values include:
-//
-// * "" - empty string implies core Kubernetes API group
-// * "networking.k8s.io"
-// * "foo.example.com"
-//
-// Invalid values include:
-//
-// * "example.com/bar" - "/" is an invalid character
-//
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
-type Group = v1.Group
-
-// Kind refers to a Kubernetes Kind.
-//
-// Valid values include:
-//
-// * "Service"
-// * "HTTPRoute"
-//
-// Invalid values include:
-//
-// * "invalid/kind" - "/" is an invalid character
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=63
-// +kubebuilder:validation:Pattern=`^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$`
-type Kind = v1.Kind
-
-// ObjectName refers to the name of a Kubernetes object.
-// Object names can have a variety of forms, including RFC1123 subdomains,
-// RFC 1123 labels, or RFC 1035 labels.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-type ObjectName = v1.ObjectName
-
-// Namespace refers to a Kubernetes namespace. It must be a RFC 1123 label.
-//
-// This validation is based off of the corresponding Kubernetes validation:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L187
-//
-// This is used for Namespace name validation here:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/api/validation/generic.go#L63
-//
-// Valid values include:
-//
-// * "example"
-//
-// Invalid values include:
-//
-// * "example.com" - "." is an invalid character
-//
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=63
-type Namespace = v1.Namespace
-
-// SectionName is the name of a section in a Kubernetes resource.
-//
-// In the following resources, SectionName is interpreted as the following:
-//
-// * Gateway: Listener name
-// * HTTPRoute: HTTPRouteRule name
-// * Service: Port name
-//
-// Section names can have a variety of forms, including RFC 1123 subdomains,
-// RFC 1123 labels, or RFC 1035 labels.
-//
-// This validation is based off of the corresponding Kubernetes validation:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L208
-//
-// Valid values include:
-//
-// * "example"
-// * "foo-example"
-// * "example.com"
-// * "foo.example.com"
-//
-// Invalid values include:
-//
-// * "example.com/bar" - "/" is an invalid character
-//
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-type SectionName = v1.SectionName
-
-// GatewayController is the name of a Gateway API controller. It must be a
-// domain prefixed path.
-//
-// Valid values include:
-//
-// * "example.com/bar"
-//
-// Invalid values include:
-//
-// * "example.com" - must include path
-// * "foo.example.com" - must include path
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$`
-type GatewayController = v1.GatewayController
-
-// AnnotationKey is the key of an annotation in Gateway API. This is used for
-// validation of maps such as TLS options. This matches the Kubernetes
-// "qualified name" validation that is used for annotations and other common
-// values.
-//
-// Valid values include:
-//
-// * example
-// * example.com
-// * example.com/path
-// * example.com/path.html
-//
-// Invalid values include:
-//
-// * example~ - "~" is an invalid character
-// * example.com. - cannot start or end with "."
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]/?)*$`
-type AnnotationKey = v1.AnnotationKey
-
-// AnnotationValue is the value of an annotation in Gateway API. This is used
-// for validation of maps such as TLS options. This roughly matches Kubernetes
-// annotation validation, although the length validation in that case is based
-// on the entire size of the annotations struct.
-//
-// +kubebuilder:validation:MinLength=0
-// +kubebuilder:validation:MaxLength=4096
-type AnnotationValue = v1.AnnotationValue
-
-// AddressType defines how a network address is represented as a text string.
-// This may take two possible forms:
-//
-// * A predefined CamelCase string identifier (currently limited to `IPAddress` or `Hostname`)
-// * A domain-prefixed string identifier (like `acme.io/CustomAddressType`)
-//
-// Values `IPAddress` and `Hostname` have Extended support.
-//
-// The `NamedAddress` value has been deprecated in favor of implementation
-// specific domain-prefixed strings.
-//
-// All other values, including domain-prefixed values have Implementation-specific support,
-// which are used in implementation-specific behaviors. Support for additional
-// predefined CamelCase identifiers may be added in future releases.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$`
-type AddressType = v1.AddressType
-
-// Duration is a string value representing a duration in time. The format is as specified
-// in GEP-2257, a strict subset of the syntax parsed by Golang time.ParseDuration.
-type Duration = v1.Duration
+type (
+	RouteParentStatus = v1.RouteParentStatus
+	RouteStatus       = v1.RouteStatus
+	Hostname          = v1.Hostname
+	PreciseHostname   = v1.PreciseHostname
+	Group             = v1.Group
+	Kind              = v1.Kind
+	ObjectName        = v1.ObjectName
+	Namespace         = v1.Namespace
+	SectionName       = v1.SectionName
+	GatewayController = v1.GatewayController
+	AnnotationKey     = v1.AnnotationKey
+	AnnotationValue   = v1.AnnotationValue
+	AddressType       = v1.AddressType
+	Duration          = v1.Duration
+)
 
 const (
 	// A textual representation of a numeric IP address. IPv4
@@ -382,7 +158,4 @@ const (
 	NamedAddressType AddressType = "NamedAddress"
 )
 
-// SessionPersistence defines the desired state of
-// SessionPersistence.
-// +k8s:deepcopy-gen=false
 type SessionPersistence = v1.SessionPersistence
diff --git a/apis/v1alpha3/backendtlspolicy_types.go b/apis/v1alpha3/backendtlspolicy_types.go
index 9c5c019d..cbd2c464 100644
--- a/apis/v1alpha3/backendtlspolicy_types.go
+++ b/apis/v1alpha3/backendtlspolicy_types.go
@@ -76,6 +76,23 @@ type BackendTLSPolicySpec struct {
 	//   be unique across all targetRef entries in the BackendTLSPolicy.
 	// * They select different sectionNames in the same target.
 	//
+	//
+	// When more than one BackendTLSPolicy selects the same target and
+	// sectionName, implementations MUST determine precedence using the
+	// following criteria, continuing on ties:
+	//
+	// * The older policy by creation timestamp takes precedence. For
+	//   example, a policy with a creation timestamp of "2021-07-15
+	//   01:02:03" MUST be given precedence over a policy with a
+	//   creation timestamp of "2021-07-15 01:02:04".
+	// * The policy appearing first in alphabetical order by {name}.
+	//   For example, a policy named `bar` is given precedence over a
+	//   policy named `baz`.
+	//
+	// For any BackendTLSPolicy that does not take precedence, the
+	// implementation MUST ensure the `Accepted` Condition is set to
+	// `status: False`, with Reason `Conflicted`.
+	//
 	// Support: Extended for Kubernetes Service
 	//
 	// Support: Implementation-specific for any other resource
@@ -184,7 +201,11 @@ type BackendTLSPolicyValidation struct {
 	// backends:
 	//
 	// 1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
-	// 2. Hostname MUST be used for authentication and MUST match the certificate served by the matching backend, unless SubjectAltNames is specified.
+	// 2. Hostname MUST be used for authentication and MUST match the certificate
+	//    served by the matching backend, unless SubjectAltNames is specified.
+	// 3. If SubjectAltNames are specified, Hostname can be used for certificate selection
+	//    but MUST NOT be used for authentication. If you want to use the value
+	//    of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.
 	//
 	// Support: Core
 	//
diff --git a/apis/v1alpha3/shared_types.go b/apis/v1alpha3/shared_types.go
index fa487f96..a54a211d 100644
--- a/apis/v1alpha3/shared_types.go
+++ b/apis/v1alpha3/shared_types.go
@@ -18,72 +18,12 @@ package v1alpha3
 
 import v1 "sigs.k8s.io/gateway-api/apis/v1"
 
-// CommonRouteSpec defines the common attributes that all Routes MUST include
-// within their spec.
-// +k8s:deepcopy-gen=false
 type CommonRouteSpec = v1.CommonRouteSpec
 
-// BackendRef defines how a Route should forward a request to a Kubernetes
-// resource.
-//
-// Note that when a namespace different than the local namespace is specified, a
-// ReferenceGrant object is required in the referent namespace to allow that
-// namespace's owner to accept the reference. See the ReferenceGrant
-// documentation for details.
-// +k8s:deepcopy-gen=false
 type BackendRef = v1.BackendRef
 
-// RouteStatus defines the common attributes that all Routes MUST include within
-// their status.
-// +k8s:deepcopy-gen=false
 type RouteStatus = v1.RouteStatus
 
-// Hostname is the fully qualified domain name of a network host. This matches
-// the RFC 1123 definition of a hostname with 2 notable exceptions:
-//
-//  1. IPs are not allowed.
-//  2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
-//     label must appear by itself as the first label.
-//
-// Hostname can be "precise" which is a domain name without the terminating
-// dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
-// domain name prefixed with a single wildcard label (e.g. `*.example.com`).
-//
-// Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
-// alphanumeric characters or '-', and must start and end with an alphanumeric
-// character. No other punctuation is allowed.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
 type Hostname = v1.Hostname
 
-// SectionName is the name of a section in a Kubernetes resource.
-//
-// In the following resources, SectionName is interpreted as the following:
-//
-// * Gateway: Listener name
-// * HTTPRoute: HTTPRouteRule name
-// * Service: Port name
-//
-// Section names can have a variety of forms, including RFC 1123 subdomains,
-// RFC 1123 labels, or RFC 1035 labels.
-//
-// This validation is based off of the corresponding Kubernetes validation:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L208
-//
-// Valid values include:
-//
-// * "example"
-// * "foo-example"
-// * "example.com"
-// * "foo.example.com"
-//
-// Invalid values include:
-//
-// * "example.com/bar" - "/" is an invalid character
-//
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
 type SectionName = v1.SectionName
diff --git a/apis/v1beta1/gateway_types.go b/apis/v1beta1/gateway_types.go
index 60bac20c..6c3e1027 100644
--- a/apis/v1beta1/gateway_types.go
+++ b/apis/v1beta1/gateway_types.go
@@ -44,123 +44,34 @@ type GatewayList struct {
 	Items           []Gateway `json:"items"`
 }
 
-// GatewaySpec defines the desired state of Gateway.
-//
-// Not all possible combinations of options specified in the Spec are
-// valid. Some invalid configurations can be caught synchronously via CRD
-// validation, but there are many cases that will require asynchronous
-// signaling via the GatewayStatus block.
-// +k8s:deepcopy-gen=false
 type GatewaySpec = v1.GatewaySpec
 
-// Listener embodies the concept of a logical endpoint where a Gateway accepts
-// network connections.
-// +k8s:deepcopy-gen=false
 type Listener = v1.Listener
 
-// ProtocolType defines the application protocol accepted by a Listener.
-// Implementations are not required to accept all the defined protocols. If an
-// implementation does not support a specified protocol, it MUST set the
-// "Accepted" condition to False for the affected Listener with a reason of
-// "UnsupportedProtocol".
-//
-// Core ProtocolType values are listed in the table below.
-//
-// Implementations can define their own protocols if a core ProtocolType does not
-// exist. Such definitions must use prefixed name, such as
-// `mycompany.com/my-custom-protocol`. Un-prefixed names are reserved for core
-// protocols. Any protocol defined by implementations will fall under
-// implementation-specific conformance.
-//
-// Valid values include:
-//
-// * "HTTP" - Core support
-// * "example.com/bar" - Implementation-specific support
-//
-// Invalid values include:
-//
-// * "example.com" - must include path if domain is used
-// * "foo.example.com" - must include path if domain is used
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=255
-// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([-a-zSA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$`
-// +k8s:deepcopy-gen=false
 type ProtocolType = v1.ProtocolType
 
-// ListenerTLSConfig describes a TLS configuration.
-// +k8s:deepcopy-gen=false
 type ListenerTLSConfig = v1.ListenerTLSConfig
 
-// TLSModeType type defines how a Gateway handles TLS sessions.
-//
-// Note that values may be added to this enum, implementations
-// must ensure that unknown values will not cause a crash.
-//
-// Unknown values here must result in the implementation setting the
-// Ready Condition for the Listener to `status: False`, with a
-// Reason of `Invalid`.
-//
-// +kubebuilder:validation:Enum=Terminate;Passthrough
-// +k8s:deepcopy-gen=false
 type TLSModeType = v1.TLSModeType
 
-// AllowedRoutes defines which Routes may be attached to this Listener.
-// +k8s:deepcopy-gen=false
 type AllowedRoutes = v1.AllowedRoutes
 
-// FromNamespaces specifies namespace from which Routes may be attached to a
-// Gateway.
-//
-// Note that values may be added to this enum, implementations
-// must ensure that unknown values will not cause a crash.
-//
-// Unknown values here must result in the implementation setting the
-// Ready Condition for the Listener to `status: False`, with a
-// Reason of `Invalid`.
-//
-// +kubebuilder:validation:Enum=All;Selector;Same
-// +k8s:deepcopy-gen=false
 type FromNamespaces = v1.FromNamespaces
 
-// RouteNamespaces indicate which namespaces Routes should be selected from.
-// +k8s:deepcopy-gen=false
 type RouteNamespaces = v1.RouteNamespaces
 
-// RouteGroupKind indicates the group and kind of a Route resource.
-// +k8s:deepcopy-gen=false
 type RouteGroupKind = v1.RouteGroupKind
 
-// GatewaySpecAddress describes an address that can be bound to a Gateway.
-// +k8s:deepcopy-gen=false
 type GatewaySpecAddress = v1.GatewaySpecAddress
 
-// GatewayStatus defines the observed state of Gateway.
-// +k8s:deepcopy-gen=false
 type GatewayStatus = v1.GatewayStatus
 
-// GatewayConditionType is a type of condition associated with a
-// Gateway. This type should be used with the GatewayStatus.Conditions
-// field.
-// +k8s:deepcopy-gen=false
 type GatewayConditionType = v1.GatewayConditionType
 
-// GatewayConditionReason defines the set of reasons that explain why a
-// particular Gateway condition type has been raised.
-// +k8s:deepcopy-gen=false
 type GatewayConditionReason = v1.GatewayConditionReason
 
-// ListenerStatus is the status associated with a Listener.
-// +k8s:deepcopy-gen=false
 type ListenerStatus = v1.ListenerStatus
 
-// ListenerConditionType is a type of condition associated with the
-// listener. This type should be used with the ListenerStatus.Conditions
-// field.
-// +k8s:deepcopy-gen=false
 type ListenerConditionType = v1.ListenerConditionType
 
-// ListenerConditionReason defines the set of reasons that explain
-// why a particular Listener condition type has been raised.
-// +k8s:deepcopy-gen=false
 type ListenerConditionReason = v1.ListenerConditionReason
diff --git a/apis/v1beta1/gatewayclass_types.go b/apis/v1beta1/gatewayclass_types.go
index 0a704a78..37b47ef2 100644
--- a/apis/v1beta1/gatewayclass_types.go
+++ b/apis/v1beta1/gatewayclass_types.go
@@ -60,26 +60,12 @@ type GatewayClassList struct {
 	Items           []GatewayClass `json:"items"`
 }
 
-// GatewayClassSpec reflects the configuration of a class of Gateways.
-// +k8s:deepcopy-gen=false
 type GatewayClassSpec = v1.GatewayClassSpec
 
-// ParametersReference identifies an API object containing controller-specific
-// configuration resource within the cluster.
-// +k8s:deepcopy-gen=false
 type ParametersReference = v1.ParametersReference
 
-// GatewayClassConditionType is the type for status conditions on
-// Gateway resources. This type should be used with the
-// GatewayClassStatus.Conditions field.
-// +k8s:deepcopy-gen=false
 type GatewayClassConditionType = v1.GatewayClassConditionType
 
-// GatewayClassConditionReason defines the set of reasons that explain why a
-// particular GatewayClass condition type has been raised.
-// +k8s:deepcopy-gen=false
 type GatewayClassConditionReason = v1.GatewayClassConditionReason
 
-// GatewayClassStatus is the current status for the GatewayClass.
-// +k8s:deepcopy-gen=false
 type GatewayClassStatus = v1.GatewayClassStatus
diff --git a/apis/v1beta1/httproute_types.go b/apis/v1beta1/httproute_types.go
index 81c7e228..a1b15767 100644
--- a/apis/v1beta1/httproute_types.go
+++ b/apis/v1beta1/httproute_types.go
@@ -44,198 +44,48 @@ type HTTPRouteList struct {
 	Items           []HTTPRoute `json:"items"`
 }
 
-// HTTPRouteSpec defines the desired state of HTTPRoute
-// +k8s:deepcopy-gen=false
 type HTTPRouteSpec = v1.HTTPRouteSpec
 
-// HTTPRouteRule defines semantics for matching an HTTP request based on
-// conditions (matches), processing it (filters), and forwarding the request to
-// an API object (backendRefs).
-// +k8s:deepcopy-gen=false
 type HTTPRouteRule = v1.HTTPRouteRule
 
-// PathMatchType specifies the semantics of how HTTP paths should be compared.
-// Valid PathMatchType values, along with their conformance level, are:
-//
-// * "Exact" - Core
-// * "PathPrefix" - Core
-// * "RegularExpression" - Implementation Specific
-//
-// PathPrefix and Exact paths must be syntactically valid:
-//
-// - Must begin with the `/` character
-// - Must not contain consecutive `/` characters (e.g. `/foo///`, `//`).
-//
-// Note that values may be added to this enum, implementations
-// must ensure that unknown values will not cause a crash.
-//
-// Unknown values here must result in the implementation setting the
-// Accepted Condition for the Route to `status: False`, with a
-// Reason of `UnsupportedValue`.
-//
-// +kubebuilder:validation:Enum=Exact;PathPrefix;RegularExpression
-// +k8s:deepcopy-gen=false
 type PathMatchType = v1.PathMatchType
 
-// HTTPPathMatch describes how to select a HTTP route by matching the HTTP request path.
-// +k8s:deepcopy-gen=false
 type HTTPPathMatch = v1.HTTPPathMatch
 
-// HeaderMatchType specifies the semantics of how HTTP header values should be
-// compared. Valid HeaderMatchType values, along with their conformance levels, are:
-//
-// * "Exact" - Core
-// * "RegularExpression" - Implementation Specific
-//
-// Note that values may be added to this enum, implementations
-// must ensure that unknown values will not cause a crash.
-//
-// Unknown values here must result in the implementation setting the
-// Accepted Condition for the Route to `status: False`, with a
-// Reason of `UnsupportedValue`.
-//
-// +kubebuilder:validation:Enum=Exact;RegularExpression
-// +k8s:deepcopy-gen=false
 type HeaderMatchType = v1.HeaderMatchType
 
-// HTTPHeaderName is the name of an HTTP header.
-//
-// Valid values include:
-// * "Authorization"
-// * "Set-Cookie"
-//
-// Invalid values include:
-//
-//   - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
-//     headers are not currently supported by this type.
-//
-// * "/invalid" - "/" is an invalid character
-// +k8s:deepcopy-gen=false
 type HTTPHeaderName = v1.HTTPHeaderName
 
-// HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request
-// headers.
-// +k8s:deepcopy-gen=false
 type HTTPHeaderMatch = v1.HTTPHeaderMatch
 
-// QueryParamMatchType specifies the semantics of how HTTP query parameter
-// values should be compared. Valid QueryParamMatchType values, along with their
-// conformance levels, are:
-//
-// * "Exact" - Core
-// * "RegularExpression" - Implementation Specific
-//
-// Note that values may be added to this enum, implementations
-// must ensure that unknown values will not cause a crash.
-//
-// Unknown values here must result in the implementation setting the
-// Accepted Condition for the Route to `status: False`, with a
-// Reason of `UnsupportedValue`.
-//
-// +kubebuilder:validation:Enum=Exact;RegularExpression
-// +k8s:deepcopy-gen=false
 type QueryParamMatchType = v1.QueryParamMatchType
 
-// HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP
-// query parameters.
-// +k8s:deepcopy-gen=false
 type HTTPQueryParamMatch = v1.HTTPQueryParamMatch
 
-// HTTPMethod describes how to select a HTTP route by matching the HTTP
-// method as defined by
-// [RFC 7231](https://datatracker.ietf.org/doc/html/rfc7231#section-4) and
-// [RFC 5789](https://datatracker.ietf.org/doc/html/rfc5789#section-2).
-// The value is expected in upper case.
-//
-// Note that values may be added to this enum, implementations
-// must ensure that unknown values will not cause a crash.
-//
-// Unknown values here must result in the implementation setting the
-// Accepted Condition for the Route to `status: False`, with a
-// Reason of `UnsupportedValue`.
-//
-// +kubebuilder:validation:Enum=GET;HEAD;POST;PUT;DELETE;CONNECT;OPTIONS;TRACE;PATCH
-// +k8s:deepcopy-gen=false
 type HTTPMethod = v1.HTTPMethod
 
-// HTTPRouteMatch defines the predicate used to match requests to a given
-// action. Multiple match types are ANDed together, i.e. the match will
-// evaluate to true only if all conditions are satisfied.
-//
-// For example, the match below will match a HTTP request only if its path
-// starts with `/foo` AND it contains the `version: v1` header:
-//
-// ```
-// match:
-//
-//	path:
-//	  value: "/foo"
-//	headers:
-//	- name: "version"
-//	  value "v1"
-//
-// ```
-// +k8s:deepcopy-gen=false
 type HTTPRouteMatch = v1.HTTPRouteMatch
 
-// HTTPRouteFilter defines processing steps that must be completed during the
-// request or response lifecycle. HTTPRouteFilters are meant as an extension
-// point to express processing that may be done in Gateway implementations. Some
-// examples include request or response modification, implementing
-// authentication strategies, rate-limiting, and traffic shaping. API
-// guarantee/conformance is defined based on the type of the filter.
-// +k8s:deepcopy-gen=false
 type HTTPRouteFilter = v1.HTTPRouteFilter
 
-// HTTPRouteFilterType identifies a type of HTTPRoute filter.
-// +k8s:deepcopy-gen=false
 type HTTPRouteFilterType = v1.HTTPRouteFilterType
 
-// HTTPRouteTimeouts defines timeouts that can be configured for an HTTPRoute.
-// +k8s:deepcopy-gen=false
 type HTTPRouteTimeouts = v1.HTTPRouteTimeouts
 
-// HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.
-// +k8s:deepcopy-gen=false
 type HTTPHeader = v1.HTTPHeader
 
-// HTTPHeaderFilter defines a filter that modifies the headers of an HTTP request
-// or response.
-// +k8s:deepcopy-gen=false
 type HTTPHeaderFilter = v1.HTTPHeaderFilter
 
-// HTTPPathModifierType defines the type of path redirect or rewrite.
-// +k8s:deepcopy-gen=false
 type HTTPPathModifierType = v1.HTTPPathModifierType
 
-// HTTPPathModifier defines configuration for path modifiers.
-// <gateway:experimental>
-// +k8s:deepcopy-gen=false
 type HTTPPathModifier = v1.HTTPPathModifier
 
-// HTTPRequestRedirect defines a filter that redirects a request. This filter
-// MUST NOT be used on the same Route rule as a HTTPURLRewrite filter.
-// +k8s:deepcopy-gen=false
 type HTTPRequestRedirectFilter = v1.HTTPRequestRedirectFilter
 
-// HTTPURLRewriteFilter defines a filter that modifies a request during
-// forwarding. At most one of these filters may be used on a Route rule. This
-// MUST NOT be used on the same Route rule as a HTTPRequestRedirect filter.
-//
-// Support: Extended
-//
-// <gateway:experimental>
-// +k8s:deepcopy-gen=false
 type HTTPURLRewriteFilter = v1.HTTPURLRewriteFilter
 
-// HTTPRequestMirrorFilter defines configuration for the RequestMirror filter.
-// +k8s:deepcopy-gen=false
 type HTTPRequestMirrorFilter = v1.HTTPRequestMirrorFilter
 
-// HTTPBackendRef defines how a HTTPRoute should forward an HTTP request.
-// +k8s:deepcopy-gen=false
 type HTTPBackendRef = v1.HTTPBackendRef
 
-// HTTPRouteStatus defines the observed state of HTTPRoute.
-// +k8s:deepcopy-gen=false
 type HTTPRouteStatus = v1.HTTPRouteStatus
diff --git a/apis/v1beta1/object_reference_types.go b/apis/v1beta1/object_reference_types.go
index 64a904e1..dcb22b1a 100644
--- a/apis/v1beta1/object_reference_types.go
+++ b/apis/v1beta1/object_reference_types.go
@@ -18,43 +18,8 @@ package v1beta1
 
 import v1 "sigs.k8s.io/gateway-api/apis/v1"
 
-// LocalObjectReference identifies an API object within the namespace of the
-// referrer.
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-//
-// References to objects with invalid Group and Kind are not valid, and must
-// be rejected by the implementation, with appropriate Conditions set
-// on the containing object.
-// +k8s:deepcopy-gen=false
 type LocalObjectReference = v1.LocalObjectReference
 
-// SecretObjectReference identifies an API object including its namespace,
-// defaulting to Secret.
-//
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-//
-// References to objects with invalid Group and Kind are not valid, and must
-// be rejected by the implementation, with appropriate Conditions set
-// on the containing object.
-// +k8s:deepcopy-gen=false
 type SecretObjectReference = v1.SecretObjectReference
 
-// BackendObjectReference defines how an ObjectReference that is
-// specific to BackendRef. It includes a few additional fields and features
-// than a regular ObjectReference.
-//
-// Note that when a namespace different than the local namespace is specified, a
-// ReferenceGrant object is required in the referent namespace to allow that
-// namespace's owner to accept the reference. See the ReferenceGrant
-// documentation for details.
-//
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-//
-// References to objects with invalid Group and Kind are not valid, and must
-// be rejected by the implementation, with appropriate Conditions set
-// on the containing object.
-// +k8s:deepcopy-gen=false
 type BackendObjectReference = v1.BackendObjectReference
diff --git a/apis/v1beta1/shared_types.go b/apis/v1beta1/shared_types.go
index ce1c4306..2f924a06 100644
--- a/apis/v1beta1/shared_types.go
+++ b/apis/v1beta1/shared_types.go
@@ -18,44 +18,16 @@ package v1beta1
 
 import v1 "sigs.k8s.io/gateway-api/apis/v1"
 
-// ParentReference identifies an API object (usually a Gateway) that can be considered
-// a parent of this resource (usually a route). The only kind of parent resource
-// with "Core" support is Gateway. This API may be extended in the future to
-// support additional kinds of parent resources, such as HTTPRoute.
-//
-// Note that there are specific rules for ParentRefs which cross namespace
-// boundaries. Cross-namespace references are only valid if they are explicitly
-// allowed by something in the namespace they are referring to. For example:
-// Gateway has the AllowedRoutes field, and ReferenceGrant provides a
-// generic way to enable any other kind of cross-namespace reference.
-//
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-// +k8s:deepcopy-gen=false
 type ParentReference = v1.ParentReference
 
-// CommonRouteSpec defines the common attributes that all Routes MUST include
-// within their spec.
-// +k8s:deepcopy-gen=false
 type CommonRouteSpec = v1.CommonRouteSpec
 
-// PortNumber defines a network port.
 type PortNumber = v1.PortNumber
 
-// BackendRef defines how a Route should forward a request to a Kubernetes
-// resource.
-//
-// Note that when a namespace different than the local namespace is specified, a
-// ReferenceGrant object is required in the referent namespace to allow that
-// namespace's owner to accept the reference. See the ReferenceGrant
-// documentation for details.
-// +k8s:deepcopy-gen=false
 type BackendRef = v1.BackendRef
 
-// RouteConditionType is a type of condition for a route.
 type RouteConditionType = v1.RouteConditionType
 
-// RouteConditionReason is a reason for a route condition.
 type RouteConditionReason = v1.RouteConditionReason
 
 const (
@@ -140,214 +112,32 @@ const (
 	RouteReasonBackendNotFound RouteConditionReason = "BackendNotFound"
 )
 
-// RouteParentStatus describes the status of a route with respect to an
-// associated Parent.
-// +k8s:deepcopy-gen=false
 type RouteParentStatus = v1.RouteParentStatus
 
-// RouteStatus defines the common attributes that all Routes MUST include within
-// their status.
-// +k8s:deepcopy-gen=false
 type RouteStatus = v1.RouteStatus
 
-// Hostname is the fully qualified domain name of a network host. This matches
-// the RFC 1123 definition of a hostname with 2 notable exceptions:
-//
-//  1. IPs are not allowed.
-//  2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
-//     label must appear by itself as the first label.
-//
-// Hostname can be "precise" which is a domain name without the terminating
-// dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
-// domain name prefixed with a single wildcard label (e.g. `*.example.com`).
-//
-// Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
-// alphanumeric characters or '-', and must start and end with an alphanumeric
-// character. No other punctuation is allowed.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
 type Hostname = v1.Hostname
 
-// PreciseHostname is the fully qualified domain name of a network host. This
-// matches the RFC 1123 definition of a hostname with 1 notable exception that
-// numeric IP addresses are not allowed.
-//
-// Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
-// alphanumeric characters or '-', and must start and end with an alphanumeric
-// character. No other punctuation is allowed.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
 type PreciseHostname = v1.PreciseHostname
 
-// Group refers to a Kubernetes Group. It must either be an empty string or a
-// RFC 1123 subdomain.
-//
-// This validation is based off of the corresponding Kubernetes validation:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L208
-//
-// Valid values include:
-//
-// * "" - empty string implies core Kubernetes API group
-// * "networking.k8s.io"
-// * "foo.example.com"
-//
-// Invalid values include:
-//
-// * "example.com/bar" - "/" is an invalid character
-//
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
 type Group = v1.Group
 
-// Kind refers to a Kubernetes Kind.
-//
-// Valid values include:
-//
-// * "Service"
-// * "HTTPRoute"
-//
-// Invalid values include:
-//
-// * "invalid/kind" - "/" is an invalid character
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=63
-// +kubebuilder:validation:Pattern=`^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$`
 type Kind = v1.Kind
 
-// ObjectName refers to the name of a Kubernetes object.
-// Object names can have a variety of forms, including RFC 1123 subdomains,
-// RFC 1123 labels, or RFC 1035 labels.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
 type ObjectName = v1.ObjectName
 
-// Namespace refers to a Kubernetes namespace. It must be a RFC 1123 label.
-//
-// This validation is based off of the corresponding Kubernetes validation:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L187
-//
-// This is used for Namespace name validation here:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/api/validation/generic.go#L63
-//
-// Valid values include:
-//
-// * "example"
-//
-// Invalid values include:
-//
-// * "example.com" - "." is an invalid character
-//
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=63
 type Namespace = v1.Namespace
 
-// SectionName is the name of a section in a Kubernetes resource.
-//
-// In the following resources, SectionName is interpreted as the following:
-//
-// * Gateway: Listener name
-// * HTTPRoute: HTTPRouteRule name
-// * Service: Port name
-//
-// Section names can have a variety of forms, including RFC 1123 subdomains,
-// RFC 1123 labels, or RFC 1035 labels.
-//
-// This validation is based off of the corresponding Kubernetes validation:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L208
-//
-// Valid values include:
-//
-// * "example"
-// * "foo-example"
-// * "example.com"
-// * "foo.example.com"
-//
-// Invalid values include:
-//
-// * "example.com/bar" - "/" is an invalid character
-//
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
 type SectionName = v1.SectionName
 
-// GatewayController is the name of a Gateway API controller. It must be a
-// domain prefixed path.
-//
-// Valid values include:
-//
-// * "example.com/bar"
-//
-// Invalid values include:
-//
-// * "example.com" - must include path
-// * "foo.example.com" - must include path
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$`
 type GatewayController = v1.GatewayController
 
-// AnnotationKey is the key of an annotation in Gateway API. This is used for
-// validation of maps such as TLS options. This matches the Kubernetes
-// "qualified name" validation that is used for annotations and other common
-// values.
-//
-// Valid values include:
-//
-// * example
-// * example.com
-// * example.com/path
-// * example.com/path.html
-//
-// Invalid values include:
-//
-// * example~ - "~" is an invalid character
-// * example.com. - cannot start or end with "."
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]/?)*$`
 type AnnotationKey = v1.AnnotationKey
 
-// AnnotationValue is the value of an annotation in Gateway API. This is used
-// for validation of maps such as TLS options. This roughly matches Kubernetes
-// annotation validation, although the length validation in that case is based
-// on the entire size of the annotations struct.
-//
-// +kubebuilder:validation:MinLength=0
-// +kubebuilder:validation:MaxLength=4096
 type AnnotationValue = v1.AnnotationValue
 
-// AddressType defines how a network address is represented as a text string.
-// This may take two possible forms:
-//
-// * A predefined CamelCase string identifier (currently limited to `IPAddress` or `Hostname`)
-// * A domain-prefixed string identifier (like `acme.io/CustomAddressType`)
-//
-// Values `IPAddress` and `Hostname` have Extended support.
-//
-// The `NamedAddress` value has been deprecated in favor of implementation
-// specific domain-prefixed strings.
-//
-// All other values, including domain-prefixed values have Implementation-specific support,
-// which are used in implementation-specific behaviors. Support for additional
-// predefined CamelCase identifiers may be added in future releases.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$`
 type AddressType = v1.AddressType
 
-// Duration is a string value representing a duration in time. The format is as specified
-// in GEP-2257, a strict subset of the syntax parsed by Golang time.ParseDuration.
 type Duration = v1.Duration
 
 const (
diff --git a/apisx/v1alpha1/shared_types.go b/apisx/v1alpha1/shared_types.go
index 848ff53b..01331bf8 100644
--- a/apisx/v1alpha1/shared_types.go
+++ b/apisx/v1alpha1/shared_types.go
@@ -22,36 +22,21 @@ import (
 )
 
 type (
-	// +k8s:deepcopy-gen=false
-	AllowedRoutes = v1.AllowedRoutes
-	// +k8s:deepcopy-gen=false
-	ListenerTLSConfig = v1.ListenerTLSConfig
-	// +k8s:deepcopy-gen=false
-	Group = v1.Group
-	// +k8s:deepcopy-gen=false
-	Hostname = v1.Hostname
-	// +k8s:deepcopy-gen=false
-	Kind = v1.Kind
-	// +k8s:deepcopy-gen=false
-	ObjectName = v1.ObjectName
-	// +k8s:deepcopy-gen=false
-	PortNumber = v1.PortNumber
-	// +k8s:deepcopy-gen=false
-	ProtocolType = v1.ProtocolType
-	// +k8s:deepcopy-gen=false
-	RouteGroupKind = v1.RouteGroupKind
-	// +k8s:deepcopy-gen=false
-	SectionName = v1.SectionName
-	// +k8s:deepcopy-gen=false
-	Namespace = v1.Namespace
-	// +k8s:deepcopy-gen=false
-	Duration = v1.Duration
-	// +k8s:deepcopy-gen=false
-	PolicyStatus = v1alpha2.PolicyStatus
-	// +k8s:deepcopy-gen=false
+	AllowedRoutes              = v1.AllowedRoutes
+	ListenerTLSConfig          = v1.ListenerTLSConfig
+	Group                      = v1.Group
+	Hostname                   = v1.Hostname
+	Kind                       = v1.Kind
+	ObjectName                 = v1.ObjectName
+	PortNumber                 = v1.PortNumber
+	ProtocolType               = v1.ProtocolType
+	RouteGroupKind             = v1.RouteGroupKind
+	SectionName                = v1.SectionName
+	Namespace                  = v1.Namespace
+	Duration                   = v1.Duration
+	PolicyStatus               = v1alpha2.PolicyStatus
 	LocalPolicyTargetReference = v1alpha2.LocalPolicyTargetReference
-	// +k8s:deepcopy-gen=false
-	SessionPersistence = v1.SessionPersistence
+	SessionPersistence         = v1.SessionPersistence
 )
 
 // ParentGatewayReference identifies an API object including its namespace,
diff --git a/applyconfiguration/apis/v1/backendobjectreference.go b/applyconfiguration/apis/v1/backendobjectreference.go
index 58337304..5106b76c 100644
--- a/applyconfiguration/apis/v1/backendobjectreference.go
+++ b/applyconfiguration/apis/v1/backendobjectreference.go
@@ -29,7 +29,7 @@ type BackendObjectReferenceApplyConfiguration struct {
 	Kind      *apisv1.Kind       `json:"kind,omitempty"`
 	Name      *apisv1.ObjectName `json:"name,omitempty"`
 	Namespace *apisv1.Namespace  `json:"namespace,omitempty"`
-	Port      *apisv1.PortNumber `json:"port,omitempty"`
+	Port      *int32             `json:"port,omitempty"`
 }
 
 // BackendObjectReferenceApplyConfiguration constructs a declarative configuration of the BackendObjectReference type for use with
@@ -73,7 +73,7 @@ func (b *BackendObjectReferenceApplyConfiguration) WithNamespace(value apisv1.Na
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *BackendObjectReferenceApplyConfiguration) WithPort(value apisv1.PortNumber) *BackendObjectReferenceApplyConfiguration {
+func (b *BackendObjectReferenceApplyConfiguration) WithPort(value int32) *BackendObjectReferenceApplyConfiguration {
 	b.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/backendref.go b/applyconfiguration/apis/v1/backendref.go
index 838dd6f6..cac582c7 100644
--- a/applyconfiguration/apis/v1/backendref.go
+++ b/applyconfiguration/apis/v1/backendref.go
@@ -70,7 +70,7 @@ func (b *BackendRefApplyConfiguration) WithNamespace(value apisv1.Namespace) *Ba
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *BackendRefApplyConfiguration) WithPort(value apisv1.PortNumber) *BackendRefApplyConfiguration {
+func (b *BackendRefApplyConfiguration) WithPort(value int32) *BackendRefApplyConfiguration {
 	b.BackendObjectReferenceApplyConfiguration.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/gateway.go b/applyconfiguration/apis/v1/gateway.go
index 98ee1b9a..f8e8ef1c 100644
--- a/applyconfiguration/apis/v1/gateway.go
+++ b/applyconfiguration/apis/v1/gateway.go
@@ -82,6 +82,7 @@ func extractGateway(gateway *apisv1.Gateway, fieldManager string, subresource st
 	b.WithAPIVersion("gateway.networking.k8s.io/v1")
 	return b, nil
 }
+func (b GatewayApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -257,8 +258,24 @@ func (b *GatewayApplyConfiguration) WithStatus(value *GatewayStatusApplyConfigur
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *GatewayApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *GatewayApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *GatewayApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *GatewayApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1/gatewayclass.go b/applyconfiguration/apis/v1/gatewayclass.go
index fa6792f3..6decda5d 100644
--- a/applyconfiguration/apis/v1/gatewayclass.go
+++ b/applyconfiguration/apis/v1/gatewayclass.go
@@ -80,6 +80,7 @@ func extractGatewayClass(gatewayClass *apisv1.GatewayClass, fieldManager string,
 	b.WithAPIVersion("gateway.networking.k8s.io/v1")
 	return b, nil
 }
+func (b GatewayClassApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -255,8 +256,24 @@ func (b *GatewayClassApplyConfiguration) WithStatus(value *GatewayClassStatusApp
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *GatewayClassApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *GatewayClassApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *GatewayClassApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *GatewayClassApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1/grpcbackendref.go b/applyconfiguration/apis/v1/grpcbackendref.go
index 75465480..7f9513b5 100644
--- a/applyconfiguration/apis/v1/grpcbackendref.go
+++ b/applyconfiguration/apis/v1/grpcbackendref.go
@@ -70,7 +70,7 @@ func (b *GRPCBackendRefApplyConfiguration) WithNamespace(value apisv1.Namespace)
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *GRPCBackendRefApplyConfiguration) WithPort(value apisv1.PortNumber) *GRPCBackendRefApplyConfiguration {
+func (b *GRPCBackendRefApplyConfiguration) WithPort(value int32) *GRPCBackendRefApplyConfiguration {
 	b.BackendObjectReferenceApplyConfiguration.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/grpcroute.go b/applyconfiguration/apis/v1/grpcroute.go
index d7e0568e..03297213 100644
--- a/applyconfiguration/apis/v1/grpcroute.go
+++ b/applyconfiguration/apis/v1/grpcroute.go
@@ -82,6 +82,7 @@ func extractGRPCRoute(gRPCRoute *apisv1.GRPCRoute, fieldManager string, subresou
 	b.WithAPIVersion("gateway.networking.k8s.io/v1")
 	return b, nil
 }
+func (b GRPCRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -257,8 +258,24 @@ func (b *GRPCRouteApplyConfiguration) WithStatus(value *GRPCRouteStatusApplyConf
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *GRPCRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *GRPCRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *GRPCRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *GRPCRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1/httpbackendref.go b/applyconfiguration/apis/v1/httpbackendref.go
index 28fda8dd..d935ce0a 100644
--- a/applyconfiguration/apis/v1/httpbackendref.go
+++ b/applyconfiguration/apis/v1/httpbackendref.go
@@ -70,7 +70,7 @@ func (b *HTTPBackendRefApplyConfiguration) WithNamespace(value apisv1.Namespace)
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *HTTPBackendRefApplyConfiguration) WithPort(value apisv1.PortNumber) *HTTPBackendRefApplyConfiguration {
+func (b *HTTPBackendRefApplyConfiguration) WithPort(value int32) *HTTPBackendRefApplyConfiguration {
 	b.BackendObjectReferenceApplyConfiguration.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/httprequestredirectfilter.go b/applyconfiguration/apis/v1/httprequestredirectfilter.go
index a9d82b90..7a2ea005 100644
--- a/applyconfiguration/apis/v1/httprequestredirectfilter.go
+++ b/applyconfiguration/apis/v1/httprequestredirectfilter.go
@@ -28,7 +28,7 @@ type HTTPRequestRedirectFilterApplyConfiguration struct {
 	Scheme     *string                             `json:"scheme,omitempty"`
 	Hostname   *apisv1.PreciseHostname             `json:"hostname,omitempty"`
 	Path       *HTTPPathModifierApplyConfiguration `json:"path,omitempty"`
-	Port       *apisv1.PortNumber                  `json:"port,omitempty"`
+	Port       *int32                              `json:"port,omitempty"`
 	StatusCode *int                                `json:"statusCode,omitempty"`
 }
 
@@ -65,7 +65,7 @@ func (b *HTTPRequestRedirectFilterApplyConfiguration) WithPath(value *HTTPPathMo
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *HTTPRequestRedirectFilterApplyConfiguration) WithPort(value apisv1.PortNumber) *HTTPRequestRedirectFilterApplyConfiguration {
+func (b *HTTPRequestRedirectFilterApplyConfiguration) WithPort(value int32) *HTTPRequestRedirectFilterApplyConfiguration {
 	b.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/httproute.go b/applyconfiguration/apis/v1/httproute.go
index 31863abd..e3e84916 100644
--- a/applyconfiguration/apis/v1/httproute.go
+++ b/applyconfiguration/apis/v1/httproute.go
@@ -82,6 +82,7 @@ func extractHTTPRoute(hTTPRoute *apisv1.HTTPRoute, fieldManager string, subresou
 	b.WithAPIVersion("gateway.networking.k8s.io/v1")
 	return b, nil
 }
+func (b HTTPRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -257,8 +258,24 @@ func (b *HTTPRouteApplyConfiguration) WithStatus(value *HTTPRouteStatusApplyConf
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *HTTPRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *HTTPRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *HTTPRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *HTTPRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1/listener.go b/applyconfiguration/apis/v1/listener.go
index c7d3b080..29faef1b 100644
--- a/applyconfiguration/apis/v1/listener.go
+++ b/applyconfiguration/apis/v1/listener.go
@@ -27,7 +27,7 @@ import (
 type ListenerApplyConfiguration struct {
 	Name          *apisv1.SectionName                  `json:"name,omitempty"`
 	Hostname      *apisv1.Hostname                     `json:"hostname,omitempty"`
-	Port          *apisv1.PortNumber                   `json:"port,omitempty"`
+	Port          *int32                               `json:"port,omitempty"`
 	Protocol      *apisv1.ProtocolType                 `json:"protocol,omitempty"`
 	TLS           *ListenerTLSConfigApplyConfiguration `json:"tls,omitempty"`
 	AllowedRoutes *AllowedRoutesApplyConfiguration     `json:"allowedRoutes,omitempty"`
@@ -58,7 +58,7 @@ func (b *ListenerApplyConfiguration) WithHostname(value apisv1.Hostname) *Listen
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *ListenerApplyConfiguration) WithPort(value apisv1.PortNumber) *ListenerApplyConfiguration {
+func (b *ListenerApplyConfiguration) WithPort(value int32) *ListenerApplyConfiguration {
 	b.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/parentreference.go b/applyconfiguration/apis/v1/parentreference.go
index b0cb0652..6880ca6d 100644
--- a/applyconfiguration/apis/v1/parentreference.go
+++ b/applyconfiguration/apis/v1/parentreference.go
@@ -30,7 +30,7 @@ type ParentReferenceApplyConfiguration struct {
 	Namespace   *apisv1.Namespace   `json:"namespace,omitempty"`
 	Name        *apisv1.ObjectName  `json:"name,omitempty"`
 	SectionName *apisv1.SectionName `json:"sectionName,omitempty"`
-	Port        *apisv1.PortNumber  `json:"port,omitempty"`
+	Port        *int32              `json:"port,omitempty"`
 }
 
 // ParentReferenceApplyConfiguration constructs a declarative configuration of the ParentReference type for use with
@@ -82,7 +82,7 @@ func (b *ParentReferenceApplyConfiguration) WithSectionName(value apisv1.Section
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *ParentReferenceApplyConfiguration) WithPort(value apisv1.PortNumber) *ParentReferenceApplyConfiguration {
+func (b *ParentReferenceApplyConfiguration) WithPort(value int32) *ParentReferenceApplyConfiguration {
 	b.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/tlsportconfig.go b/applyconfiguration/apis/v1/tlsportconfig.go
index bc9043a1..f19c7337 100644
--- a/applyconfiguration/apis/v1/tlsportconfig.go
+++ b/applyconfiguration/apis/v1/tlsportconfig.go
@@ -18,14 +18,10 @@ limitations under the License.
 
 package v1
 
-import (
-	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
-)
-
 // TLSPortConfigApplyConfiguration represents a declarative configuration of the TLSPortConfig type for use
 // with apply.
 type TLSPortConfigApplyConfiguration struct {
-	Port *apisv1.PortNumber           `json:"port,omitempty"`
+	Port *int32                       `json:"port,omitempty"`
 	TLS  *TLSConfigApplyConfiguration `json:"tls,omitempty"`
 }
 
@@ -38,7 +34,7 @@ func TLSPortConfig() *TLSPortConfigApplyConfiguration {
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *TLSPortConfigApplyConfiguration) WithPort(value apisv1.PortNumber) *TLSPortConfigApplyConfiguration {
+func (b *TLSPortConfigApplyConfiguration) WithPort(value int32) *TLSPortConfigApplyConfiguration {
 	b.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1alpha2/grpcroute.go b/applyconfiguration/apis/v1alpha2/grpcroute.go
index 89e1e21b..63010009 100644
--- a/applyconfiguration/apis/v1alpha2/grpcroute.go
+++ b/applyconfiguration/apis/v1alpha2/grpcroute.go
@@ -83,6 +83,7 @@ func extractGRPCRoute(gRPCRoute *apisv1alpha2.GRPCRoute, fieldManager string, su
 	b.WithAPIVersion("gateway.networking.k8s.io/v1alpha2")
 	return b, nil
 }
+func (b GRPCRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -258,8 +259,24 @@ func (b *GRPCRouteApplyConfiguration) WithStatus(value *apisv1.GRPCRouteStatusAp
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *GRPCRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *GRPCRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *GRPCRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *GRPCRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1alpha2/referencegrant.go b/applyconfiguration/apis/v1alpha2/referencegrant.go
index 032cf361..94c63566 100644
--- a/applyconfiguration/apis/v1alpha2/referencegrant.go
+++ b/applyconfiguration/apis/v1alpha2/referencegrant.go
@@ -82,6 +82,7 @@ func extractReferenceGrant(referenceGrant *apisv1alpha2.ReferenceGrant, fieldMan
 	b.WithAPIVersion("gateway.networking.k8s.io/v1alpha2")
 	return b, nil
 }
+func (b ReferenceGrantApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -249,8 +250,24 @@ func (b *ReferenceGrantApplyConfiguration) WithSpec(value *v1beta1.ReferenceGran
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *ReferenceGrantApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *ReferenceGrantApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *ReferenceGrantApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *ReferenceGrantApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1alpha2/tcproute.go b/applyconfiguration/apis/v1alpha2/tcproute.go
index 1984f6f9..036923a4 100644
--- a/applyconfiguration/apis/v1alpha2/tcproute.go
+++ b/applyconfiguration/apis/v1alpha2/tcproute.go
@@ -82,6 +82,7 @@ func extractTCPRoute(tCPRoute *apisv1alpha2.TCPRoute, fieldManager string, subre
 	b.WithAPIVersion("gateway.networking.k8s.io/v1alpha2")
 	return b, nil
 }
+func (b TCPRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -257,8 +258,24 @@ func (b *TCPRouteApplyConfiguration) WithStatus(value *TCPRouteStatusApplyConfig
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TCPRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TCPRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *TCPRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TCPRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1alpha2/tlsroute.go b/applyconfiguration/apis/v1alpha2/tlsroute.go
index d427cde2..759e9eda 100644
--- a/applyconfiguration/apis/v1alpha2/tlsroute.go
+++ b/applyconfiguration/apis/v1alpha2/tlsroute.go
@@ -82,6 +82,7 @@ func extractTLSRoute(tLSRoute *apisv1alpha2.TLSRoute, fieldManager string, subre
 	b.WithAPIVersion("gateway.networking.k8s.io/v1alpha2")
 	return b, nil
 }
+func (b TLSRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -257,8 +258,24 @@ func (b *TLSRouteApplyConfiguration) WithStatus(value *TLSRouteStatusApplyConfig
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TLSRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TLSRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *TLSRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TLSRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1alpha2/udproute.go b/applyconfiguration/apis/v1alpha2/udproute.go
index 2403b41f..67b23c0b 100644
--- a/applyconfiguration/apis/v1alpha2/udproute.go
+++ b/applyconfiguration/apis/v1alpha2/udproute.go
@@ -82,6 +82,7 @@ func extractUDPRoute(uDPRoute *apisv1alpha2.UDPRoute, fieldManager string, subre
 	b.WithAPIVersion("gateway.networking.k8s.io/v1alpha2")
 	return b, nil
 }
+func (b UDPRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -257,8 +258,24 @@ func (b *UDPRouteApplyConfiguration) WithStatus(value *UDPRouteStatusApplyConfig
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *UDPRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *UDPRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *UDPRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *UDPRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1alpha3/backendtlspolicy.go b/applyconfiguration/apis/v1alpha3/backendtlspolicy.go
index 2892af15..dc518021 100644
--- a/applyconfiguration/apis/v1alpha3/backendtlspolicy.go
+++ b/applyconfiguration/apis/v1alpha3/backendtlspolicy.go
@@ -83,6 +83,7 @@ func extractBackendTLSPolicy(backendTLSPolicy *apisv1alpha3.BackendTLSPolicy, fi
 	b.WithAPIVersion("gateway.networking.k8s.io/v1alpha3")
 	return b, nil
 }
+func (b BackendTLSPolicyApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -258,8 +259,24 @@ func (b *BackendTLSPolicyApplyConfiguration) WithStatus(value *v1alpha2.PolicySt
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *BackendTLSPolicyApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *BackendTLSPolicyApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *BackendTLSPolicyApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *BackendTLSPolicyApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1alpha3/tlsroute.go b/applyconfiguration/apis/v1alpha3/tlsroute.go
index ff65509c..766f654d 100644
--- a/applyconfiguration/apis/v1alpha3/tlsroute.go
+++ b/applyconfiguration/apis/v1alpha3/tlsroute.go
@@ -83,6 +83,7 @@ func extractTLSRoute(tLSRoute *apisv1alpha3.TLSRoute, fieldManager string, subre
 	b.WithAPIVersion("gateway.networking.k8s.io/v1alpha3")
 	return b, nil
 }
+func (b TLSRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -258,8 +259,24 @@ func (b *TLSRouteApplyConfiguration) WithStatus(value *v1alpha2.TLSRouteStatusAp
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TLSRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TLSRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *TLSRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TLSRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1beta1/gateway.go b/applyconfiguration/apis/v1beta1/gateway.go
index 3b623558..cb504543 100644
--- a/applyconfiguration/apis/v1beta1/gateway.go
+++ b/applyconfiguration/apis/v1beta1/gateway.go
@@ -83,6 +83,7 @@ func extractGateway(gateway *apisv1beta1.Gateway, fieldManager string, subresour
 	b.WithAPIVersion("gateway.networking.k8s.io/v1beta1")
 	return b, nil
 }
+func (b GatewayApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -258,8 +259,24 @@ func (b *GatewayApplyConfiguration) WithStatus(value *apisv1.GatewayStatusApplyC
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *GatewayApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *GatewayApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *GatewayApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *GatewayApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1beta1/gatewayclass.go b/applyconfiguration/apis/v1beta1/gatewayclass.go
index d7cecd62..f4ecfeab 100644
--- a/applyconfiguration/apis/v1beta1/gatewayclass.go
+++ b/applyconfiguration/apis/v1beta1/gatewayclass.go
@@ -81,6 +81,7 @@ func extractGatewayClass(gatewayClass *apisv1beta1.GatewayClass, fieldManager st
 	b.WithAPIVersion("gateway.networking.k8s.io/v1beta1")
 	return b, nil
 }
+func (b GatewayClassApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -256,8 +257,24 @@ func (b *GatewayClassApplyConfiguration) WithStatus(value *apisv1.GatewayClassSt
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *GatewayClassApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *GatewayClassApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *GatewayClassApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *GatewayClassApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1beta1/httproute.go b/applyconfiguration/apis/v1beta1/httproute.go
index 18e2ca96..1bb7243e 100644
--- a/applyconfiguration/apis/v1beta1/httproute.go
+++ b/applyconfiguration/apis/v1beta1/httproute.go
@@ -83,6 +83,7 @@ func extractHTTPRoute(hTTPRoute *apisv1beta1.HTTPRoute, fieldManager string, sub
 	b.WithAPIVersion("gateway.networking.k8s.io/v1beta1")
 	return b, nil
 }
+func (b HTTPRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -258,8 +259,24 @@ func (b *HTTPRouteApplyConfiguration) WithStatus(value *apisv1.HTTPRouteStatusAp
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *HTTPRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *HTTPRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *HTTPRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *HTTPRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1beta1/referencegrant.go b/applyconfiguration/apis/v1beta1/referencegrant.go
index 0ebd1cd1..e3fff69f 100644
--- a/applyconfiguration/apis/v1beta1/referencegrant.go
+++ b/applyconfiguration/apis/v1beta1/referencegrant.go
@@ -81,6 +81,7 @@ func extractReferenceGrant(referenceGrant *apisv1beta1.ReferenceGrant, fieldMana
 	b.WithAPIVersion("gateway.networking.k8s.io/v1beta1")
 	return b, nil
 }
+func (b ReferenceGrantApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -248,8 +249,24 @@ func (b *ReferenceGrantApplyConfiguration) WithSpec(value *ReferenceGrantSpecApp
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *ReferenceGrantApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *ReferenceGrantApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *ReferenceGrantApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *ReferenceGrantApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apisx/v1alpha1/listenerentry.go b/applyconfiguration/apisx/v1alpha1/listenerentry.go
index b72cf4e0..d9f4dc9a 100644
--- a/applyconfiguration/apisx/v1alpha1/listenerentry.go
+++ b/applyconfiguration/apisx/v1alpha1/listenerentry.go
@@ -28,7 +28,7 @@ import (
 type ListenerEntryApplyConfiguration struct {
 	Name          *v1.SectionName                             `json:"name,omitempty"`
 	Hostname      *v1.Hostname                                `json:"hostname,omitempty"`
-	Port          *v1.PortNumber                              `json:"port,omitempty"`
+	Port          *int32                                      `json:"port,omitempty"`
 	Protocol      *v1.ProtocolType                            `json:"protocol,omitempty"`
 	TLS           *apisv1.ListenerTLSConfigApplyConfiguration `json:"tls,omitempty"`
 	AllowedRoutes *apisv1.AllowedRoutesApplyConfiguration     `json:"allowedRoutes,omitempty"`
@@ -59,7 +59,7 @@ func (b *ListenerEntryApplyConfiguration) WithHostname(value v1.Hostname) *Liste
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *ListenerEntryApplyConfiguration) WithPort(value v1.PortNumber) *ListenerEntryApplyConfiguration {
+func (b *ListenerEntryApplyConfiguration) WithPort(value int32) *ListenerEntryApplyConfiguration {
 	b.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apisx/v1alpha1/listenerentrystatus.go b/applyconfiguration/apisx/v1alpha1/listenerentrystatus.go
index 64d652a4..888f57d7 100644
--- a/applyconfiguration/apisx/v1alpha1/listenerentrystatus.go
+++ b/applyconfiguration/apisx/v1alpha1/listenerentrystatus.go
@@ -28,7 +28,7 @@ import (
 // with apply.
 type ListenerEntryStatusApplyConfiguration struct {
 	Name           *v1.SectionName                           `json:"name,omitempty"`
-	Port           *v1.PortNumber                            `json:"port,omitempty"`
+	Port           *int32                                    `json:"port,omitempty"`
 	SupportedKinds []apisv1.RouteGroupKindApplyConfiguration `json:"supportedKinds,omitempty"`
 	AttachedRoutes *int32                                    `json:"attachedRoutes,omitempty"`
 	Conditions     []metav1.ConditionApplyConfiguration      `json:"conditions,omitempty"`
@@ -51,7 +51,7 @@ func (b *ListenerEntryStatusApplyConfiguration) WithName(value v1.SectionName) *
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *ListenerEntryStatusApplyConfiguration) WithPort(value v1.PortNumber) *ListenerEntryStatusApplyConfiguration {
+func (b *ListenerEntryStatusApplyConfiguration) WithPort(value int32) *ListenerEntryStatusApplyConfiguration {
 	b.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apisx/v1alpha1/xbackendtrafficpolicy.go b/applyconfiguration/apisx/v1alpha1/xbackendtrafficpolicy.go
index 427d5965..99a39f03 100644
--- a/applyconfiguration/apisx/v1alpha1/xbackendtrafficpolicy.go
+++ b/applyconfiguration/apisx/v1alpha1/xbackendtrafficpolicy.go
@@ -83,6 +83,7 @@ func extractXBackendTrafficPolicy(xBackendTrafficPolicy *apisxv1alpha1.XBackendT
 	b.WithAPIVersion("gateway.networking.x-k8s.io/v1alpha1")
 	return b, nil
 }
+func (b XBackendTrafficPolicyApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -258,8 +259,24 @@ func (b *XBackendTrafficPolicyApplyConfiguration) WithStatus(value *v1alpha2.Pol
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *XBackendTrafficPolicyApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *XBackendTrafficPolicyApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *XBackendTrafficPolicyApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *XBackendTrafficPolicyApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apisx/v1alpha1/xlistenerset.go b/applyconfiguration/apisx/v1alpha1/xlistenerset.go
index 75519a17..829f2d94 100644
--- a/applyconfiguration/apisx/v1alpha1/xlistenerset.go
+++ b/applyconfiguration/apisx/v1alpha1/xlistenerset.go
@@ -82,6 +82,7 @@ func extractXListenerSet(xListenerSet *apisxv1alpha1.XListenerSet, fieldManager
 	b.WithAPIVersion("gateway.networking.x-k8s.io/v1alpha1")
 	return b, nil
 }
+func (b XListenerSetApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -257,8 +258,24 @@ func (b *XListenerSetApplyConfiguration) WithStatus(value *ListenerSetStatusAppl
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *XListenerSetApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *XListenerSetApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *XListenerSetApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *XListenerSetApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/internal/internal.go b/applyconfiguration/internal/internal.go
index 974c4bd2..131b10d8 100644
--- a/applyconfiguration/internal/internal.go
+++ b/applyconfiguration/internal/internal.go
@@ -22,7 +22,7 @@ import (
 	fmt "fmt"
 	sync "sync"
 
-	typed "sigs.k8s.io/structured-merge-diff/v4/typed"
+	typed "sigs.k8s.io/structured-merge-diff/v6/typed"
 )
 
 func Parser() *typed.Parser {
diff --git a/applyconfiguration/utils.go b/applyconfiguration/utils.go
index 274736cd..06ea3793 100644
--- a/applyconfiguration/utils.go
+++ b/applyconfiguration/utils.go
@@ -21,7 +21,7 @@ package applyconfiguration
 import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	testing "k8s.io/client-go/testing"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 	v1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
@@ -277,6 +277,6 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 	return nil
 }
 
-func NewTypeConverter(scheme *runtime.Scheme) *testing.TypeConverter {
-	return &testing.TypeConverter{Scheme: scheme, TypeResolver: internal.Parser()}
+func NewTypeConverter(scheme *runtime.Scheme) managedfields.TypeConverter {
+	return managedfields.NewSchemeTypeConverter(scheme, internal.Parser())
 }
diff --git a/config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml b/config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml
index b5a05f1b..b110a95a 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   labels:
     gateway.networking.k8s.io/policy: Direct
   name: backendtlspolicies.gateway.networking.k8s.io
@@ -93,6 +92,22 @@ spec:
                     be unique across all targetRef entries in the BackendTLSPolicy.
                   * They select different sectionNames in the same target.
 
+                  When more than one BackendTLSPolicy selects the same target and
+                  sectionName, implementations MUST determine precedence using the
+                  following criteria, continuing on ties:
+
+                  * The older policy by creation timestamp takes precedence. For
+                    example, a policy with a creation timestamp of "2021-07-15
+                    01:02:03" MUST be given precedence over a policy with a
+                    creation timestamp of "2021-07-15 01:02:04".
+                  * The policy appearing first in alphabetical order by {name}.
+                    For example, a policy named `bar` is given precedence over a
+                    policy named `baz`.
+
+                  For any BackendTLSPolicy that does not take precedence, the
+                  implementation MUST ensure the `Accepted` Condition is set to
+                  `status: False`, with Reason `Conflicted`.
+
                   Support: Extended for Kubernetes Service
 
                   Support: Implementation-specific for any other resource
@@ -257,7 +272,11 @@ spec:
                       backends:
 
                       1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
-                      2. Hostname MUST be used for authentication and MUST match the certificate served by the matching backend, unless SubjectAltNames is specified.
+                      2. Hostname MUST be used for authentication and MUST match the certificate
+                         served by the matching backend, unless SubjectAltNames is specified.
+                      3. If SubjectAltNames are specified, Hostname can be used for certificate selection
+                         but MUST NOT be used for authentication. If you want to use the value
+                         of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.
 
                       Support: Core
                     maxLength: 253
diff --git a/config/crd/experimental/gateway.networking.k8s.io_gatewayclasses.yaml b/config/crd/experimental/gateway.networking.k8s.io_gatewayclasses.yaml
index 831fbf4a..e022113f 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_gatewayclasses.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_gatewayclasses.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: gatewayclasses.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml b/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
index 6e154e95..349b14cd 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: gateways.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml
index 3a40ee23..e714fd0f 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: grpcroutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml
index 03293113..9170ad2a 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: httproutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/experimental/gateway.networking.k8s.io_referencegrants.yaml b/config/crd/experimental/gateway.networking.k8s.io_referencegrants.yaml
index ac146b27..65afd84f 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_referencegrants.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_referencegrants.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: referencegrants.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml
index 9de08325..35a9e01a 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: tcproutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml
index dce65f87..d8b177e3 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: tlsroutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml
index 1f7be3d3..305ddaba 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: udproutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/experimental/gateway.networking.x-k8s.io_xbackendtrafficpolicies.yaml b/config/crd/experimental/gateway.networking.x-k8s.io_xbackendtrafficpolicies.yaml
index 3e6d06b2..1a388175 100644
--- a/config/crd/experimental/gateway.networking.x-k8s.io_xbackendtrafficpolicies.yaml
+++ b/config/crd/experimental/gateway.networking.x-k8s.io_xbackendtrafficpolicies.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   labels:
     gateway.networking.k8s.io/policy: Direct
   name: xbackendtrafficpolicies.gateway.networking.x-k8s.io
diff --git a/config/crd/experimental/gateway.networking.x-k8s.io_xlistenersets.yaml b/config/crd/experimental/gateway.networking.x-k8s.io_xlistenersets.yaml
index 6d5a5bd5..0d5def81 100644
--- a/config/crd/experimental/gateway.networking.x-k8s.io_xlistenersets.yaml
+++ b/config/crd/experimental/gateway.networking.x-k8s.io_xlistenersets.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: xlistenersets.gateway.networking.x-k8s.io
 spec:
   group: gateway.networking.x-k8s.io
diff --git a/config/crd/standard/gateway.networking.k8s.io_gatewayclasses.yaml b/config/crd/standard/gateway.networking.k8s.io_gatewayclasses.yaml
index 9268f6f1..a1973f5b 100644
--- a/config/crd/standard/gateway.networking.k8s.io_gatewayclasses.yaml
+++ b/config/crd/standard/gateway.networking.k8s.io_gatewayclasses.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: standard
-  creationTimestamp: null
   name: gatewayclasses.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/standard/gateway.networking.k8s.io_gateways.yaml b/config/crd/standard/gateway.networking.k8s.io_gateways.yaml
index 8b7b0a02..98914347 100644
--- a/config/crd/standard/gateway.networking.k8s.io_gateways.yaml
+++ b/config/crd/standard/gateway.networking.k8s.io_gateways.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: standard
-  creationTimestamp: null
   name: gateways.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml b/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml
index 4e81b088..b02f9a41 100644
--- a/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml
+++ b/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: standard
-  creationTimestamp: null
   name: grpcroutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml b/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml
index dfa6af4c..b57a508f 100644
--- a/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml
+++ b/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: standard
-  creationTimestamp: null
   name: httproutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/standard/gateway.networking.k8s.io_referencegrants.yaml b/config/crd/standard/gateway.networking.k8s.io_referencegrants.yaml
index 6a2d3689..d25ccd27 100644
--- a/config/crd/standard/gateway.networking.k8s.io_referencegrants.yaml
+++ b/config/crd/standard/gateway.networking.k8s.io_referencegrants.yaml
@@ -5,7 +5,6 @@ metadata:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
     gateway.networking.k8s.io/bundle-version: v1.3.0
     gateway.networking.k8s.io/channel: standard
-  creationTimestamp: null
   name: referencegrants.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/conformance/utils/echo/pod.go b/conformance/utils/echo/pod.go
index dff03ed5..1a3e40fb 100644
--- a/conformance/utils/echo/pod.go
+++ b/conformance/utils/echo/pod.go
@@ -82,7 +82,15 @@ func makeRequest(t *testing.T, exp *http.ExpectedResponse) []string {
 	if exp.Request.Host == "" {
 		exp.Request.Host = "echo"
 	}
-	if exp.Request.Method == "" {
+
+	r := exp.Request
+	protocol := strings.ToLower(r.Protocol)
+	if protocol == "" {
+		protocol = "http"
+	}
+
+	// Only set default method for HTTP protocols, not for gRPC
+	if protocol != "grpc" && exp.Request.Method == "" {
 		exp.Request.Method = "GET"
 	}
 
@@ -96,14 +104,9 @@ func makeRequest(t *testing.T, exp *http.ExpectedResponse) []string {
 		exp.Response.StatusCodes = []int{200}
 	}
 
-	r := exp.Request
-	protocol := strings.ToLower(r.Protocol)
-	if protocol == "" {
-		protocol = "http"
-	}
 	host := http.CalculateHost(t, r.Host, protocol)
 	args := []string{"client", fmt.Sprintf("%s://%s%s", protocol, host, r.Path)}
-	if r.Method != "" {
+	if protocol != "grpc" && r.Method != "" {
 		args = append(args, "--method="+r.Method)
 	}
 	for k, v := range r.Headers {
@@ -118,11 +121,32 @@ func compareRequest(exp http.ExpectedResponse, resp Response) error {
 	}
 	wantReq := exp.ExpectedRequest
 	wantResp := exp.Response
+
+	// Parse the response status code
 	statusCode, err := strconv.Atoi(resp.Code)
 	if err != nil {
 		return fmt.Errorf("invalid status code '%v': %v", resp.Code, err)
 	}
-	if !slices.Contains(wantResp.StatusCodes, statusCode) {
+
+	// Handle gRPC protocol special case for status code mapping
+	if strings.ToLower(exp.Request.Protocol) == "grpc" {
+		// For gRPC, we need to handle the status code mapping
+		// The Istio echo client reports HTTP status codes even for gRPC requests
+		expectedStatusCodes := make([]int, len(wantResp.StatusCodes))
+		copy(expectedStatusCodes, wantResp.StatusCodes)
+
+		// Map gRPC status 0 (OK) to HTTP 200 if needed
+		for i, code := range expectedStatusCodes {
+			if code == 0 {
+				expectedStatusCodes[i] = 200
+			}
+		}
+
+		if !slices.Contains(expectedStatusCodes, statusCode) {
+			return fmt.Errorf("wanted gRPC status code to be one of %v (mapped to HTTP), got %d", wantResp.StatusCodes, statusCode)
+		}
+	} else if !slices.Contains(wantResp.StatusCodes, statusCode) {
+		// For HTTP, use the status codes directly
 		return fmt.Errorf("wanted status code to be one of %v, got %d", wantResp.StatusCodes, statusCode)
 	}
 	if wantReq.Headers != nil {
diff --git a/conformance/utils/grpc/grpc.go b/conformance/utils/grpc/grpc.go
index 70adfe2e..25b1d7ab 100644
--- a/conformance/utils/grpc/grpc.go
+++ b/conformance/utils/grpc/grpc.go
@@ -35,6 +35,7 @@ import (
 	"sigs.k8s.io/gateway-api/conformance/utils/config"
 	"sigs.k8s.io/gateway-api/conformance/utils/http"
 	"sigs.k8s.io/gateway-api/conformance/utils/tlog"
+	"sigs.k8s.io/gateway-api/conformance/utils/weight"
 )
 
 const (
@@ -289,3 +290,20 @@ func MakeRequestAndExpectEventuallyConsistentResponse(t *testing.T, c Client, ti
 	http.AwaitConvergence(t, timeoutConfig.RequiredConsecutiveSuccesses, timeoutConfig.MaxTimeToConsistency, sendRPC)
 	tlog.Logf(t, "Request passed")
 }
+
+// AddEntropy adds randomness to ExpectedResponse to avoid caching issues and ensure each request is unique.
+// It randomly chooses to add a delay, random metadata, or both.
+func AddEntropy(exp *ExpectedResponse) error {
+	addRandomMetadata := func(randomValue string) error {
+		if exp.RequestMetadata == nil {
+			exp.RequestMetadata = &RequestMetadata{}
+		}
+		if exp.RequestMetadata.Metadata == nil {
+			exp.RequestMetadata.Metadata = make(map[string]string)
+		}
+		exp.RequestMetadata.Metadata["x-jitter"] = randomValue
+		return nil
+	}
+
+	return weight.AddRandomEntropy(addRandomMetadata)
+}
diff --git a/conformance/utils/http/http.go b/conformance/utils/http/http.go
index 6cd68dd0..2d116423 100644
--- a/conformance/utils/http/http.go
+++ b/conformance/utils/http/http.go
@@ -17,9 +17,7 @@ limitations under the License.
 package http
 
 import (
-	"crypto/rand"
 	"fmt"
-	"math/big"
 	"net"
 	"net/url"
 	"slices"
@@ -30,6 +28,7 @@ import (
 	"sigs.k8s.io/gateway-api/conformance/utils/config"
 	"sigs.k8s.io/gateway-api/conformance/utils/roundtripper"
 	"sigs.k8s.io/gateway-api/conformance/utils/tlog"
+	"sigs.k8s.io/gateway-api/conformance/utils/weight"
 )
 
 // ExpectedResponse defines the response expected for a given request.
@@ -497,53 +496,13 @@ func setRedirectRequestDefaults(req *roundtripper.Request, cRes *roundtripper.Ca
 	}
 }
 
-// addEntropy adds jitter to the request by adding either a delay up to 1 second, or a random header value, or both.
+// AddEntropy adds jitter to the request by adding either a delay up to 1 second, or a random header value, or both.
 func AddEntropy(exp *ExpectedResponse) error {
-	randomNumber := func(limit int64) (*int64, error) {
-		number, err := rand.Int(rand.Reader, big.NewInt(limit))
-		if err != nil {
-			return nil, err
-		}
-		n := number.Int64()
-		return &n, nil
-	}
-
-	// adds a delay
-	delay := func(limit int64) error {
-		randomSleepDuration, err := randomNumber(limit)
-		if err != nil {
-			return err
-		}
-		time.Sleep(time.Duration(*randomSleepDuration) * time.Millisecond)
-		return nil
-	}
-	// adds random header value
-	randomHeader := func(limit int64) error {
-		randomHeaderValue, err := randomNumber(limit)
-		if err != nil {
-			return err
-		}
+	addRandomHeader := func(randomValue string) error {
 		exp.Request.Headers = make(map[string]string)
-		exp.Request.Headers["X-Jitter"] = fmt.Sprintf("%d", *randomHeaderValue)
+		exp.Request.Headers["X-Jitter"] = randomValue
 		return nil
 	}
 
-	random, err := randomNumber(3)
-	if err != nil {
-		return err
-	}
-
-	switch *random {
-	case 0:
-		return delay(1000)
-	case 1:
-		return randomHeader(10000)
-	case 2:
-		if err := delay(1000); err != nil {
-			return err
-		}
-		return randomHeader(10000)
-	default:
-		return fmt.Errorf("invalid random value: %d", *random)
-	}
+	return weight.AddRandomEntropy(addRandomHeader)
 }
diff --git a/conformance/utils/suite/suite.go b/conformance/utils/suite/suite.go
index e3c098a8..31db06c5 100644
--- a/conformance/utils/suite/suite.go
+++ b/conformance/utils/suite/suite.go
@@ -390,7 +390,7 @@ func (suite *ConformanceTestSuite) Setup(t *testing.T, tests []ConformanceTest)
 		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)
 		caConfigMap, ca, caPrivKey := kubernetes.MustCreateCACertConfigMap(t, "gateway-conformance-infra", "tls-checks-ca-certificate")
 		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{caConfigMap}, suite.Cleanup)
-		secret = kubernetes.MustCreateCASignedCertSecret(t, "gateway-conformance-infra", "tls-checks-certificate", []string{"abc.example.com", "spiffe://abc.example.com/test-identity"}, ca, caPrivKey)
+		secret = kubernetes.MustCreateCASignedCertSecret(t, "gateway-conformance-infra", "tls-checks-certificate", []string{"abc.example.com", "spiffe://abc.example.com/test-identity", "other.example.com"}, ca, caPrivKey)
 		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)
 
 		// The following CA ceritficate is used for BackendTLSPolicy testing to intentionally force TLS validation to fail.
diff --git a/conformance/utils/weight/senders.go b/conformance/utils/weight/senders.go
new file mode 100644
index 00000000..304ead0e
--- /dev/null
+++ b/conformance/utils/weight/senders.go
@@ -0,0 +1,31 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package weight
+
+// FunctionBasedSender implements RequestSender using a function
+type FunctionBasedSender struct {
+	sendFunc func() (string, error)
+}
+
+func (s *FunctionBasedSender) SendRequest() (string, error) {
+	return s.sendFunc()
+}
+
+// NewFunctionBasedSender creates a RequestSender from a function
+func NewFunctionBasedSender(sendFunc func() (string, error)) RequestSender {
+	return &FunctionBasedSender{sendFunc: sendFunc}
+}
diff --git a/conformance/utils/weight/weight.go b/conformance/utils/weight/weight.go
new file mode 100644
index 00000000..123719ae
--- /dev/null
+++ b/conformance/utils/weight/weight.go
@@ -0,0 +1,185 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package weight
+
+import (
+	"cmp"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"math"
+	"math/big"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"golang.org/x/sync/errgroup"
+)
+
+const (
+	// MaxTestRetries is the maximum number of times to retry the weight distribution test
+	// if it fails due to statistical variance before considering it a real failure
+	MaxTestRetries = 10
+)
+
+// RequestSender defines an interface for sending requests (HTTP, gRPC, or mesh)
+type RequestSender interface {
+	SendRequest() (podName string, err error)
+}
+
+// extractBackendName extracts the backend name from a pod name by removing deployment and pod hash suffixes
+func extractBackendName(podName string) string {
+	// Pod names follow the pattern: {backend-name}-{deployment-hash}-{pod-hash}
+	// We need to remove the last two dash-separated components
+	parts := strings.Split(podName, "-")
+	if len(parts) < 3 {
+		return podName // fallback to original name if pattern doesn't match
+	}
+	// Remove last two components (deployment hash and pod hash)
+	return strings.Join(parts[:len(parts)-2], "-")
+}
+
+// TestWeightedDistribution tests that requests are distributed according to expected weights
+func TestWeightedDistribution(sender RequestSender, expectedWeights map[string]float64) error {
+	const (
+		concurrentRequests  = 10
+		tolerancePercentage = 0.05
+		totalRequests       = 500
+	)
+
+	var (
+		g         errgroup.Group
+		seenMutex sync.Mutex
+		seen      = make(map[string]float64, len(expectedWeights))
+	)
+
+	g.SetLimit(concurrentRequests)
+	for i := 0; i < totalRequests; i++ {
+		g.Go(func() error {
+			podName, err := sender.SendRequest()
+			if err != nil {
+				return err
+			}
+
+			// Extract the backend name from the pod name
+			backendName := extractBackendName(podName)
+
+			seenMutex.Lock()
+			defer seenMutex.Unlock()
+
+			if _, exists := expectedWeights[backendName]; exists {
+				seen[backendName]++
+				return nil
+			}
+
+			return fmt.Errorf("request was handled by an unexpected pod %q (extracted backend: %q)", podName, backendName)
+		})
+	}
+
+	if err := g.Wait(); err != nil {
+		return fmt.Errorf("error while sending requests: %w", err)
+	}
+
+	// Count how many backends should receive traffic (weight > 0)
+	expectedActiveBackends := 0
+	for _, weight := range expectedWeights {
+		if weight > 0.0 {
+			expectedActiveBackends++
+		}
+	}
+
+	var errs []error
+	if len(seen) != expectedActiveBackends {
+		errs = append(errs, fmt.Errorf("expected %d backends to receive traffic, but got %d", expectedActiveBackends, len(seen)))
+	}
+
+	for wantBackend, wantPercent := range expectedWeights {
+		gotCount, ok := seen[wantBackend]
+
+		if !ok && wantPercent != 0.0 {
+			errs = append(errs, fmt.Errorf("expect traffic to hit backend %q - but none was received", wantBackend))
+			continue
+		}
+
+		gotPercent := gotCount / float64(totalRequests)
+
+		if math.Abs(gotPercent-wantPercent) > tolerancePercentage {
+			errs = append(errs, fmt.Errorf("backend %q weighted traffic of %v not within tolerance %v (+/-%f)",
+				wantBackend,
+				gotPercent,
+				wantPercent,
+				tolerancePercentage,
+			))
+		}
+	}
+
+	slices.SortFunc(errs, func(a, b error) int {
+		return cmp.Compare(a.Error(), b.Error())
+	})
+	return errors.Join(errs...)
+}
+
+// Entropy utilities
+
+// addRandomDelay adds a random delay up to the specified limit in milliseconds
+func addRandomDelay(limit int) {
+	n, err := rand.Int(rand.Reader, big.NewInt(int64(limit)))
+	if err != nil {
+		// Fallback to no delay if crypto/rand fails
+		return
+	}
+	randomSleepDuration := n.Int64()
+	time.Sleep(time.Duration(randomSleepDuration) * time.Millisecond)
+}
+
+// AddRandomEntropy randomly chooses to add delay, random value, or both
+// The addRandomValue function should be provided by the caller to handle
+// protocol-specific ways of adding the random value (HTTP headers, gRPC metadata, etc.)
+func AddRandomEntropy(addRandomValue func(string) error) error {
+	n, err := rand.Int(rand.Reader, big.NewInt(3))
+	if err != nil {
+		// Fallback to case 0 if crypto/rand fails
+		addRandomDelay(1000)
+		return err
+	}
+	random := n.Int64()
+
+	switch random {
+	case 0:
+		addRandomDelay(1000)
+		return nil
+	case 1:
+		valueN, err := rand.Int(rand.Reader, big.NewInt(10000))
+		if err != nil {
+			return fmt.Errorf("failed to generate random value: %w", err)
+		}
+		randomValue := valueN.Int64()
+		return addRandomValue(strconv.FormatInt(randomValue, 10))
+	case 2:
+		addRandomDelay(1000)
+		valueN, err := rand.Int(rand.Reader, big.NewInt(10000))
+		if err != nil {
+			return fmt.Errorf("failed to generate random value: %w", err)
+		}
+		randomValue := valueN.Int64()
+		return addRandomValue(strconv.FormatInt(randomValue, 10))
+	default:
+		return fmt.Errorf("invalid random value: %d", random)
+	}
+}
diff --git a/geps/gep-2907/index.md b/geps/gep-2907/index.md
index a44451bd..c9a57602 100644
--- a/geps/gep-2907/index.md
+++ b/geps/gep-2907/index.md
@@ -8,11 +8,14 @@ This GEP aims to define high level TLS terminology and structure within Gateway
 API to ensure that all our independent proposals related to TLS result in a
 coherent set of APIs. This will result in some adjustments to provisional and
 experimental TLS-related GEPs, specifically [BackendTLSPolicy](../gep-1897/index.md)
-and [Client Certificate Verification](../gep-91/index.md).
 
 ## Goals
-* Define high-level terminology for how we refer to TLS in Gateway API.
-* Define top level fields where TLS configuration can live.
+1. Define high-level terminology for how we refer to TLS in Gateway API.
+2. Define top level fields where TLS configuration can live for all below cases:
+* Client to Gateway (Frontend) TLS configuration.
+* Gateway to Client TLS configuration (Client Certificate Validation)
+* Gateway to backend (Gateway Client Certificate)
+3. Document how to use `BackendTLSPolicy` to support Gateway to Backend TLS configuration.
 
 ## Non-Goals
 * Add or change fields directly. (This may inspire changes in other GEPs
@@ -30,29 +33,15 @@ in scope for this GEP. In the future, this GEP may be expanded to include:
 
 ## Introduction
 
-### Where TLS could be configured
-We have three different places where we might want to configure TLS:
-
-#### A. Gateways
-Config attached at this layer will apply to everything behind a single address
-such as a virtual IP.
+### TLS mode
 
-#### B. Gateway Listeners
-Each Gateway contains multiple “Listeners”. Each HTTPS Listener in a Gateway
-must have a unique combination of protocol, port, and SNI (Server Name
-Indication). TLS configuration attached at this layer should be [isolated via
-SNI](../../guides/implementers.md#listener-isolation).
+TLS can be configured with two distinct modes:
+* **Passthrough**: The Gateway forwards encrypted traffic directly to the backend from the entity originating the connection (called later a client). The TLS connection is established between the client and the backend; the Gateway does not participate in the TLS handshake.
 
-#### C. BackendTLSPolicy
-This policy allows us to attach unique TLS configuration per Backend. Depending
-on the organization, this policy may be owned by the application owner or the
-cluster operator. Note that this configuration will be used by all Gateways
-(potentially from different implementations) that are connecting to the backend.
+* **Terminate**: The Gateway acts as a man-in-the-middle, terminating the client's TLS connection and originating a separate connection to the backend when routing the traffic. Both connections can independently support TLS and mutual TLS due to their distinct TLS configurations. The Gateway's dual role as a client or server affects the placement of TLS settings needed for given connection.
 
 ### "Frontend" and "Backend"
-A guiding principle in this naming is to use consistent naming for “Downstream”
-(1+2) and “Upstream” (3+4), similar to Envoy. To avoid the confusion with what
-is upstream and downstream, Gateway API will use “Frontend” (1+2) and “Backend”
+A guiding principle in this naming is to use consistent naming for both TLS connections “Downstream” (1+2) and “Upstream” (3+4) handled by the Gateway (similar to Envoy). To avoid the confusion with what is upstream and downstream, Gateway API will use “Frontend” (1+2) and “Backend”
 (3+4).
 
 *  **Frontend:** The entity connecting to a Gateway, typically a client
@@ -73,43 +62,34 @@ flowchart LR
 
 The above diagram depicts these four segments as edges in a graph.
 
-### TLS mode
+#### Frontend configuration
 
-TLS can be configured with two distinct modes:
+In the Frontend TLS connection Gateway acts as a server and presents Server certificate during TLS handshake. Client connects to the Gateway on domain basis and this is desired to configure Server certificates on the Listener.
+In the mutual frontend TLS Gateway needs to verify client certificates with configured CA. It was expected that CA configuration would be also defined on Listener but due to connection coalescing this solution was not secure. We decided to move client certificate validation configuration on the Gateway level and allow for per port overrides.
+
+#### Backend configuration
+
+In the Backend connection Gateway acts as a client. The nature of the connection (HTTP or HTTPS) is configured on the Service using BackendTLSPolicy. If BackendTLSPolicy is defined for a Service, the Gateway must establish an HTTPS connection with the backend. During the TLS handshake, the backend presents a Server certificate. The Gateway validates this certificate against a CA certificate (and optionally SANs) configured by BackendTLSPolicy.
+For mutual backend TLS, the Gateway's identity must be configured. This identity, a client certificate set on the Gateway object, will be presented by the Gateway. The Gateway uses the same client certificate for all backend connections originating mutual TLS.
 
-* **Terminate**: the TLS connection is instantiated between the frontend and the
-  Gateway. The connection between the Gateway and the backend is left unencrypted
- unless a new TLS connection between the two entities is configured via BackendTLSPolicy.
-* **Passthrough**: the TLS connection is instantiated between the frontend and the
-  backend. The traffic flows through the Gateway encrypted, and the Gateway is not
-  able to decrypt or inspect the encrypted portions of the TLS stream.
 
 ## Proposed Segments
-Note that this does not represent any form of commitment that any of these
-fields or concepts will exist within Gateway API. If or when they do, we propose
-the following naming structure:
 
-### 1. Validate Client Certificate provided by Frontend
+
+### 1. Gateway level configuration
+
+Gateway-level configurations are required for both Frontend and Backend connections. We propose a top-level GatewayTLSConfig that is divided into independent Backend and Frontend configurations.
 
 | Proposed Placement | Name | Status |
 |-|-|-|
-| Gateway Listener | `Listener.TLS.FrontendValidation` | Proposed |
+| Gateway | `Gateway.TLS.Frontend` | Proposed |
+| Gateway | `Gateway.TLS.Backend` | Proposed |
 
 #### Rationale
-Use FrontendValidation to leave room for concepts like trust anchors and trust
-domains. Anything not strictly tied to validation would belong to Listener.TLS
-which is now reserved exclusively for “Frontend” TLS configuration (1+2).
-
-#### Why Not Frontend.Validation?
-Part of the idea behind this GEP is that Listener.TLS is really entirely focused
-on 1+2 - the bits of TLS between frontend and Gateway. That means that if we
-were to add any additional TLS configuration in the Listener.TLS struct, it
-would tied to that limited scope, and thus we don't really need a separate
-Frontend struct.
+From the security point of view both TLS configurations require a Gateway level field. The configurations are independent and can coexist.
 
-One could make an argument that Listener.TLS.Validation should be the field name
-here to avoid any ambiguity, but in this specific context, we think that it's
-probably helpful to specifically spell out frontend.
+#### Why Not Listener.Frontend?
+Due to connection coalescing, the client certificate validation for the frontend was moved to a Gateway level field to address security concerns. [GEP-91 Update PR](https://github.com/kubernetes-sigs/gateway-api/pull/3942)
 
 #### Why Not FrontendTLSPolicy?
 It could be reasonable to try to mirror BackendTLSPolicy for Frontend TLS. As we
@@ -129,7 +109,7 @@ We don't think either of those reasons really apply to frontend TLS. Instead,
 frontend TLS could theoretically be configured either for an entire Gateway, or
 a specific Gateway listener. Given that many implementations already support
 distinguishing this config per SNI, it seems to make sense to start with
-listener level attachment. We think that the persona that would be responsible
+Listener level attachment. We think that the persona that would be responsible
 for a Gateway is not sufficiently different than the persona that would be
 responsible for frontend TLS, so the current proposal is likely the best option
 available to us.
@@ -145,17 +125,30 @@ This is already finalized in the API and so we're stuck with this name. In
 hindsight a name that was more clearly tied to frontend TLS would have been
 ideal here.
 
-### 3. Configure Client Certificate that Gateway should use to connect to Backend
+### 3. Configure Client Certificate Validation for Frontend
+
+Client certificate validation will reside at the Gateway level. This configuration will be
+either applied globally to all Listeners in the Gateway or can be overridden on a per-port basis.
 
 | Proposed Placement | Name | Status |
 |-|-|-|
-| Gateway | `Gateway.Spec.BackendTLS.ClientCertificateRef` | Not Proposed |
-| BackendTLSPolicy | `BackendTLSPolicy.Spec.ClientCertificateRef` | Not Proposed |
+| Gateway | `Gateway.TLS.Frontend.Default.Validation` | Proposed |
+| Gateway | `Gateway.TLS.Frontend.PerPort` | Proposed |
 
 #### Rationale
-It's not yet obvious which of the above options are preferable, but a case could
-be made for either or both. If we add a `BackendTLS` struct to Gateway it would
-leave room for concepts like TLS version, ALPN, cipher suites, etc.
+Gateway level configuration for client certificate validation was chosen due to security issue.
+
+#### Why per port override
+HTTPS connection can be reused between multiple Listeners sharing the same port. This might lead to bypassing client certificate validation configuration for a given Listener becasue new TLS handshake will not be triggered for different hostname.
+
+### 4. Configure Client Certificate that Gateway should use to connect to Backend
+
+| Proposed Placement | Name | Status |
+|-|-|-|
+| Gateway | `Gateway.Spec.TLS.Backend.ClientCertificateRef` | Proposed |
+
+#### Rationale
+Client certificate is part of Gateway identity and should not be overriden per backend.
 
 #### Why Not Listener level to match FrontendValidation?
 In general, we'd expect this identity to represent a Gateway as a whole, and
@@ -167,7 +160,7 @@ use when connecting to a backend, it should likely either be tied directly to
 the Gateway or Backend, but the Listener is not particularly relevant in this
 context.
 
-### 4. Validate Server Certificate that is provided by Backend
+### 5. Validate Server Certificate that is provided by Backend
 | Proposed Placement | Name | Status |
 |-|-|-|
 | Gateway | `Gateway.Spec.BackendTLS.Validation` | Not Proposed |
@@ -179,42 +172,7 @@ already clearly backend-focused, config like TLS Version, ALPN, and cipher
 suites, could live at the same level without confusion. It's also plausible that
 some Gateways may want to express Gateway-wide CAs that are trusted.
 
-#### Why BackendTLS on Gateways?
-Although this GEP is intentionally not committing to adding new fields or
-features, it's possible that at some point in the future we may want to have
-some kind of Backend TLS config at the Gateway level. For example, it may be
-useful to configure a set of CAs that a Gateway trusts or a client cert that a
-Gateway should use to connect to all backends. If this existed, there would
-likely be some overlap in config with BackendTLSPolicy, and if a future GEP
-proposed this, it would need to include how overlapping config should be
-handled.
-
-#### Why the inconsistency between Frontend and Backend TLS config on Gateways?
-If we were to populate all the possible fields described in this GEP, we'd end
-up with the following config on Gateways:
-
-```
-Gateway.Spec.Listeners.TLS.FrontendValidation
-Gateway.Spec.Listeners.TLS
-Gateway.Spec.BackendTLS.ClientCertificateRef
-Gateway.Spec.BackendTLS.Validation
-```
-
-This is all tied to the need to provide backwards compatibility with the TLS
-config that is already GA on Listeners (`Listener.TLS`). If we were naming that
-field today with the broader vision of TLS configuration throughout Gateway API
-we would almost certainly choose a more descriptive name that was more clearly
-tied to Frontend TLS. Unfortunately we're too late to change that name, but we
-can try to make the rest of the terminology clearly tied to frontend or backend
-TLS.
-
-One [suggestion by @candita](https://github.com/kubernetes-sigs/gateway-api/pull/2910#discussion_r1552534017)
-would be to introduce a Listener like resource for BackendTLS, resulting in a
-more consistent naming scheme within Gateway TLS configuration. Although it's
-not yet clear if we need this additional layer, we should reconsider it as we're
-further developing Backend TLS.
-
-### 5. Configure TLS mode
+### 6. Configure TLS mode
 
 | Proposed Placement | Name | Status |
 |-|-|-|
@@ -236,8 +194,8 @@ does not need to be provided, as the TLS termination is handled by the backend.
 
 ## Routes and TLS
 
-Multiple routes can be attached to listeners specifying TLS configuration. This section
-intends to clearly state how and when Routes can attach to listeners with TLS configuration.
+Multiple routes can be attached to Listeners specifying TLS configuration. This section
+intends to clearly state how and when Routes can attach to Listeners with TLS configuration.
 
 ### Context
 
@@ -265,12 +223,12 @@ with the compatible protocol.
 |-----------|---------|---------------|----------------|
 | HTTP      | `HTTPRoute`/`GRPCRoute` | no  | no  |
 | HTTPS     | `HTTPRoute`/`GRPCRoute` | yes | no  |
-| TLS       | `TLSRoute`  | yes | yes | 
+| TLS       | `TLSRoute`  | yes | yes |
 | TCP       | `TCPRoute`  | yes | no  |
 | UDP       | `UDPRoute`  | no  | no  |
 
 > [!NOTE]
-> When the traffic is routed to the backend via a listener configured with TLS `Passthrough`
-> and a compatible route, the packets are left untouched by the gateway. In order to
-> terminate the TLS connection to the gateway and forward the traffic unencrypted to the backend,
-> a listener configured with TLS `Terminate` and a compatible route must be used.
+> When the traffic is routed to the backend via a Listener configured with TLS `Passthrough`
+> and a compatible route, the packets are left untouched by the Gateway. In order to
+> terminate the TLS connection to the Gateway and forward the traffic unencrypted to the backend,
+> a Listener configured with TLS `Terminate` and a compatible route must be used.
diff --git a/geps/gep-3155/index.md b/geps/gep-3155/index.md
index 41477c22..06324f68 100644
--- a/geps/gep-3155/index.md
+++ b/geps/gep-3155/index.md
@@ -99,6 +99,10 @@ type BackendTLSPolicyValidation struct {
   // SubjectAltNames contains one or more Subject Alternative Names.
   // When specified, the certificate served from the backend MUST have at least one
   // Subject Alternate Name matching one of the specified SubjectAltNames.
+  // If SubjectAltNames are specified, Hostname MUST NOT be used for authentication,
+  // even if this would cause a failure in the case that the SubjectAltNames do not match.
+  // If you want to use Hostname for authentication, you must add Hostname to the SubjectAltNames list.
+  //
   // +kubebuilder:validation:MaxItems=5
   SubjectAltNames []SubjectAltName `json:"subjectAltNames,omitempty"`
 }
diff --git a/go.mod b/go.mod
index bd1a6d91..3359ba2e 100644
--- a/go.mod
+++ b/go.mod
@@ -10,18 +10,18 @@ require (
 	golang.org/x/sync v0.16.0
 	google.golang.org/grpc v1.75.0
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
-	google.golang.org/protobuf v1.36.7
-	k8s.io/api v0.33.4
-	k8s.io/apiextensions-apiserver v0.33.4
-	k8s.io/apimachinery v0.33.4
-	k8s.io/client-go v0.33.4
-	k8s.io/code-generator v0.33.4
-	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
+	google.golang.org/protobuf v1.36.8
+	k8s.io/api v0.34.0
+	k8s.io/apiextensions-apiserver v0.34.0
+	k8s.io/apimachinery v0.34.0
+	k8s.io/client-go v0.34.0
+	k8s.io/code-generator v0.34.0
+	k8s.io/kube-openapi v0.0.0-20250814151709-d7b6acb124c3
+	k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
 	sigs.k8s.io/controller-runtime v0.21.0
 	sigs.k8s.io/controller-tools v0.18.0
-	sigs.k8s.io/structured-merge-diff/v4 v4.7.0
-	sigs.k8s.io/yaml v1.5.0
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0
+	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
@@ -30,18 +30,18 @@ require (
 	github.com/Masterminds/sprig v2.22.0+incompatible // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.12.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/fatih/color v1.18.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonpointer v0.21.2 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
 	github.com/gobuffalo/flect v1.0.3 // indirect
 	github.com/goccy/go-yaml v1.18.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
@@ -50,40 +50,42 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
-	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_golang v1.23.0 // indirect
+	github.com/prometheus/procfs v0.17.0 // indirect
 	github.com/spf13/cobra v1.9.1 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.41.0 // indirect
-	golang.org/x/mod v0.26.0 // indirect
+	golang.org/x/mod v0.27.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/sys v0.35.0 // indirect
 	golang.org/x/term v0.34.0 // indirect
 	golang.org/x/text v0.28.0 // indirect
-	golang.org/x/time v0.9.0 // indirect
-	golang.org/x/tools v0.35.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+	golang.org/x/tools v0.36.0 // indirect
 	golang.org/x/tools/go/expect v0.1.1-deprecated // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7 // indirect
+	k8s.io/gengo/v2 v2.0.0-20250820003526-c297c0c1eb9d // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 4120b93f..6abcd96c 100644
--- a/go.sum
+++ b/go.sum
@@ -19,28 +19,28 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/elastic/crd-ref-docs v0.2.0 h1:U17MyGX71j4qfKTvYxbR4qZGoA1hc2thy7kseGYmP+o=
 github.com/elastic/crd-ref-docs v0.2.0/go.mod h1:0bklkJhTG7nC6AVsdDi0wt5bGoqvzdZSzMMQkilZ6XM=
-github.com/emicklei/go-restful/v3 v3.12.0 h1:y2DdzBAURM29NFF94q6RaY4vjIH1rtwDapwQtU84iWk=
-github.com/emicklei/go-restful/v3 v3.12.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
+github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
 github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
-github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
-github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
-github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
-github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonpointer v0.21.2 h1:AqQaNADVwq/VnkCmQg6ogE+M3FOsKTytwges0JdwVuA=
+github.com/go-openapi/jsonpointer v0.21.2/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
 github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
-github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
-github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
+github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gobuffalo/flect v1.0.3 h1:xeWBM2nui+qnVvNM4S3foBhCAL2XgPU+a7FdpelbTq4=
@@ -51,9 +51,8 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
-github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -79,8 +78,8 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
-github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
@@ -97,8 +96,9 @@ github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVO
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
@@ -111,26 +111,25 @@ github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg
 github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
 github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=
 github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
-github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
-github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
-github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
-github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
+github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
+github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -166,8 +165,8 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
 go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
-go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE=
-go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -175,8 +174,8 @@ golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
 golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
-golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -203,14 +202,14 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
 golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
-golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
-golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
-golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
@@ -223,19 +222,19 @@ gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 h1:pFyd6EwwL2TqFf8emdthzeX+gZE1ElRq3iM8pui4KBY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1 h1:pmJpJEvT846VzausCQ5d7KreSROcDqmO388w5YbnltA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1/go.mod h1:GmFNa4BdJZ2a8G+wCe9Bg3wwThLrJun751XstdJt5Og=
 google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
 google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
-google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
-google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
-gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
@@ -246,35 +245,33 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.33.4 h1:oTzrFVNPXBjMu0IlpA2eDDIU49jsuEorGHB4cvKupkk=
-k8s.io/api v0.33.4/go.mod h1:VHQZ4cuxQ9sCUMESJV5+Fe8bGnqAARZ08tSTdHWfeAc=
-k8s.io/apiextensions-apiserver v0.33.4 h1:rtq5SeXiDbXmSwxsF0MLe2Mtv3SwprA6wp+5qh/CrOU=
-k8s.io/apiextensions-apiserver v0.33.4/go.mod h1:mWXcZQkQV1GQyxeIjYApuqsn/081hhXPZwZ2URuJeSs=
-k8s.io/apimachinery v0.33.4 h1:SOf/JW33TP0eppJMkIgQ+L6atlDiP/090oaX0y9pd9s=
-k8s.io/apimachinery v0.33.4/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
-k8s.io/client-go v0.33.4 h1:TNH+CSu8EmXfitntjUPwaKVPN0AYMbc9F1bBS8/ABpw=
-k8s.io/client-go v0.33.4/go.mod h1:LsA0+hBG2DPwovjd931L/AoaezMPX9CmBgyVyBZmbCY=
-k8s.io/code-generator v0.33.4 h1:DiA801QxqApRIBh3OWULasVAUA237XnYvFNMh+E34Y8=
-k8s.io/code-generator v0.33.4/go.mod h1:ifWxKWhEl/Z1K7WmWAyOBEf3ex/i546ingCzLC8YVIY=
-k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7 h1:2OX19X59HxDprNCVrWi6jb7LW1PoqTlYqEq5H2oetog=
-k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
+k8s.io/api v0.34.0 h1:L+JtP2wDbEYPUeNGbeSa/5GwFtIA662EmT2YSLOkAVE=
+k8s.io/api v0.34.0/go.mod h1:YzgkIzOOlhl9uwWCZNqpw6RJy9L2FK4dlJeayUoydug=
+k8s.io/apiextensions-apiserver v0.34.0 h1:B3hiB32jV7BcyKcMU5fDaDxk882YrJ1KU+ZSkA9Qxoc=
+k8s.io/apiextensions-apiserver v0.34.0/go.mod h1:hLI4GxE1BDBy9adJKxUxCEHBGZtGfIg98Q+JmTD7+g0=
+k8s.io/apimachinery v0.34.0 h1:eR1WO5fo0HyoQZt1wdISpFDffnWOvFLOOeJ7MgIv4z0=
+k8s.io/apimachinery v0.34.0/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/client-go v0.34.0 h1:YoWv5r7bsBfb0Hs2jh8SOvFbKzzxyNo0nSb0zC19KZo=
+k8s.io/client-go v0.34.0/go.mod h1:ozgMnEKXkRjeMvBZdV1AijMHLTh3pbACPvK7zFR+QQY=
+k8s.io/code-generator v0.34.0 h1:Ze2i1QsvUprIlX3oHiGv09BFQRLCz+StA8qKwwFzees=
+k8s.io/code-generator v0.34.0/go.mod h1:Py2+4w2HXItL8CGhks8uI/wS3Y93wPKO/9mBQUYNua0=
+k8s.io/gengo/v2 v2.0.0-20250820003526-c297c0c1eb9d h1:qUrYOinhdAUL0xxhA4gPqogPBaS9nIq2l2kTb6pmeB0=
+k8s.io/gengo/v2 v2.0.0-20250820003526-c297c0c1eb9d/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kube-openapi v0.0.0-20250814151709-d7b6acb124c3 h1:liMHz39T5dJO1aOKHLvwaCjDbf07wVh6yaUlTpunnkE=
+k8s.io/kube-openapi v0.0.0-20250814151709-d7b6acb124c3/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
+k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d h1:wAhiDyZ4Tdtt7e46e9M5ZSAJ/MnPGPs+Ki1gHw4w1R0=
+k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/controller-runtime v0.21.0 h1:CYfjpEuicjUecRk+KAeyYh+ouUBn4llGyDYytIGcJS8=
 sigs.k8s.io/controller-runtime v0.21.0/go.mod h1:OSg14+F65eWqIu4DceX7k/+QRAbTTvxeQSNSOQpukWM=
 sigs.k8s.io/controller-tools v0.18.0 h1:rGxGZCZTV2wJreeRgqVoWab/mfcumTMmSwKzoM9xrsE=
 sigs.k8s.io/controller-tools v0.18.0/go.mod h1:gLKoiGBriyNh+x1rWtUQnakUYEujErjXs9pf+x/8n1U=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.7.0 h1:qPeWmscJcXP0snki5IYF79Z8xrl8ETFxgMd7wez1XkI=
-sigs.k8s.io/structured-merge-diff/v4 v4.7.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
-sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ=
-sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/pkg/client/clientset/versioned/fake/clientset_generated.go b/pkg/client/clientset/versioned/fake/clientset_generated.go
index b1600ecb..78e540a8 100644
--- a/pkg/client/clientset/versioned/fake/clientset_generated.go
+++ b/pkg/client/clientset/versioned/fake/clientset_generated.go
@@ -113,8 +113,8 @@ func NewClientset(objects ...runtime.Object) *Clientset {
 	cs.AddReactor("*", "*", testing.ObjectReaction(o))
 	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
 		var opts metav1.ListOptions
-		if watchActcion, ok := action.(testing.WatchActionImpl); ok {
-			opts = watchActcion.ListOptions
+		if watchAction, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchAction.ListOptions
 		}
 		gvr := action.GetResource()
 		ns := action.GetNamespace()
diff --git a/pkg/features/features.go b/pkg/features/features.go
index 2a67d006..1fbf43f0 100644
--- a/pkg/features/features.go
+++ b/pkg/features/features.go
@@ -61,7 +61,9 @@ var (
 			Insert(MeshCoreFeatures.UnsortedList()...).
 			Insert(MeshExtendedFeatures.UnsortedList()...).
 			Insert(GRPCRouteCoreFeatures.UnsortedList()...).
-			Insert(BackendTLSPolicyCoreFeatures.UnsortedList()...)
+			Insert(GRPCRouteExtendedFeatures.UnsortedList()...).
+			Insert(BackendTLSPolicyCoreFeatures.UnsortedList()...).
+			Insert(BackendTLSPolicyExtendedFeatures.UnsortedList()...)
 
 	featureMap = map[FeatureName]Feature{}
 )
diff --git a/pkg/generated/openapi/zz_generated.openapi.go b/pkg/generated/openapi/zz_generated.openapi.go
index 1451e17d..dd27f75e 100644
--- a/pkg/generated/openapi/zz_generated.openapi.go
+++ b/pkg/generated/openapi/zz_generated.openapi.go
@@ -2867,7 +2867,8 @@ func schema_sigsk8sio_gateway_api_apis_v1_AllowedRoutes(ref common.ReferenceCall
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
+				Description: "AllowedRoutes defines which Routes may be attached to this Listener.",
+				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"namespaces": {
 						VendorExtensible: spec.VendorExtensible{
@@ -2961,7 +2962,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_BackendRef(ref common.ReferenceCallbac
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "BackendRef defines how a Route should forward a request to a Kubernetes resource.\n\nNote that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.",
+				Description: "BackendRef defines how a Route should forward a request to a Kubernetes resource.\n\nNote that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.\n\n<gateway:experimental:description>\n\nWhen the BackendRef points to a Kubernetes Service, implementations SHOULD honor the appProtocol field if it is set for the target Service Port.\n\nImplementations supporting appProtocol SHOULD recognize the Kubernetes Standard Application Protocols defined in KEP-3726.\n\nIf a Service appProtocol isn't specified, an implementation MAY infer the backend protocol through its own means. Implementations MAY infer the protocol from the Route type referring to the backend Service.\n\nIf a Route is not able to send traffic to the backend using the specified protocol then the backend is considered invalid. Implementations MUST set the \"ResolvedRefs\" condition to \"False\" with the \"UnsupportedProtocol\" reason.\n\n</gateway:experimental:description>\n\nNote that when the BackendTLSPolicy object is enabled by the implementation, there are some extra rules about validity to consider here. See the fields where this struct is used for more information about the exact behavior.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
@@ -4441,7 +4442,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPBackendRef(ref common.ReferenceCal
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "HTTPBackendRef defines how a HTTPRoute should forward an HTTP request.",
+				Description: "HTTPBackendRef defines how a HTTPRoute forwards a HTTP request.\n\nNote that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.\n\n<gateway:experimental:description>\n\nWhen the BackendRef points to a Kubernetes Service, implementations SHOULD honor the appProtocol field if it is set for the target Service Port.\n\nImplementations supporting appProtocol SHOULD recognize the Kubernetes Standard Application Protocols defined in KEP-3726.\n\nIf a Service appProtocol isn't specified, an implementation MAY infer the backend protocol through its own means. Implementations MAY infer the protocol from the Route type referring to the backend Service.\n\nIf a Route is not able to send traffic to the backend using the specified protocol then the backend is considered invalid. Implementations MUST set the \"ResolvedRefs\" condition to \"False\" with the \"UnsupportedProtocol\" reason.\n\n</gateway:experimental:description>",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
@@ -4704,7 +4705,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPHeaderFilter(ref common.ReferenceC
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "HTTPHeaderFilter defines a filter that modifies the headers of an HTTP request or response.",
+				Description: "HTTPHeaderFilter defines a filter that modifies the headers of an HTTP request or response. Only one action for a given header name is permitted. Filters specifying multiple actions of the same or different type for any one header name are invalid. Configuration to set or add multiple values for a header must use RFC 7230 header value formatting, separating each value with a comma.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"set": {
@@ -4847,7 +4848,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPPathModifier(ref common.ReferenceC
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "HTTPPathModifier defines configuration for path modifiers. <gateway:experimental>",
+				Description: "HTTPPathModifier defines configuration for path modifiers.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"type": {
@@ -5055,7 +5056,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPRouteFilter(ref common.ReferenceCa
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "HTTPRouteFilter defines processing steps that must be completed during the request or response lifecycle. HTTPRouteFilters are meant as an extension point to express processing that may be done in Gateway implementations. Some examples include request or response modification, implementing authentication strategies, rate-limiting, and traffic shaping. API guarantee/conformance is defined based on the type of the filter.",
+				Description: "HTTPRouteFilter defines processing steps that must be completed during the request or response lifecycle. HTTPRouteFilters are meant as an extension point to express processing that may be done in Gateway implementations. Some examples include request or response modification, implementing authentication strategies, rate-limiting, and traffic shaping. API guarantee/conformance is defined based on the type of the filter.\n\n<gateway:experimental:validation:XValidation:message=\"filter.cors must be nil if the filter.type is not CORS\",rule=\"!(has(self.cors) && self.type != 'CORS')\"> <gateway:experimental:validation:XValidation:message=\"filter.cors must be specified for CORS filter.type\",rule=\"!(!has(self.cors) && self.type == 'CORS')\"> <gateway:experimental:validation:XValidation:message=\"filter.externalAuth must be nil if the filter.type is not ExternalAuth\",rule=\"!(has(self.externalAuth) && self.type != 'ExternalAuth')\"> <gateway:experimental:validation:XValidation:message=\"filter.externalAuth must be specified for ExternalAuth filter.type\",rule=\"!(!has(self.externalAuth) && self.type == 'ExternalAuth')\">",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"type": {
@@ -5500,7 +5501,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPRouteTimeouts(ref common.Reference
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "HTTPRouteTimeouts defines timeouts that can be configured for an HTTPRoute.",
+				Description: "HTTPRouteTimeouts defines timeouts that can be configured for an HTTPRoute. Timeout values are represented with Gateway API Duration formatting.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"request": {
@@ -5527,7 +5528,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPURLRewriteFilter(ref common.Refere
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "HTTPURLRewriteFilter defines a filter that modifies a request during forwarding. At most one of these filters may be used on a Route rule. This MUST NOT be used on the same Route rule as a HTTPRequestRedirect filter.\n\nSupport: Extended\n\n<gateway:experimental>",
+				Description: "HTTPURLRewriteFilter defines a filter that modifies a request during forwarding. At most one of these filters may be used on a Route rule. This MUST NOT be used on the same Route rule as a HTTPRequestRedirect filter.\n\nSupport: Extended",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"hostname": {
@@ -5715,7 +5716,8 @@ func schema_sigsk8sio_gateway_api_apis_v1_ListenerTLSConfig(ref common.Reference
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
+				Description: "ListenerTLSConfig describes a TLS configuration for a listener.",
+				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"mode": {
 						SchemaProps: spec.SchemaProps{
@@ -5937,7 +5939,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_ParentReference(ref common.ReferenceCa
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources, such as HTTPRoute.\n\nNote that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference.\n\nThe API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid.",
+				Description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). There are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile) * Service (Mesh conformance profile, ClusterIP Services only)\n\nThis API may be extended in the future to support additional kinds of parent resources.\n\nThe API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
@@ -5994,7 +5996,8 @@ func schema_sigsk8sio_gateway_api_apis_v1_RouteGroupKind(ref common.ReferenceCal
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
+				Description: "RouteGroupKind indicates the group and kind of a Route resource.",
+				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
 						SchemaProps: spec.SchemaProps{
@@ -6181,7 +6184,8 @@ func schema_sigsk8sio_gateway_api_apis_v1_SessionPersistence(ref common.Referenc
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
+				Description: "SessionPersistence defines the desired state of SessionPersistence.",
+				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"sessionName": {
 						SchemaProps: spec.SchemaProps{
@@ -6418,7 +6422,8 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_LocalPolicyTargetReference(ref c
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
+				Description: "LocalPolicyTargetReference identifies an API object to apply a direct or inherited policy to. This should be used as part of Policy resources that can target Gateway API resources. For more information on how this policy attachment model works, and a sample Policy resource, refer to the policy attachment documentation for Gateway API.",
+				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
 						SchemaProps: spec.SchemaProps{
@@ -6598,7 +6603,8 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_PolicyStatus(ref common.Referenc
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
+				Description: "PolicyStatus defines the common attributes that all Policies should include within their status.",
+				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"ancestors": {
 						VendorExtensible: spec.VendorExtensible{
@@ -7542,7 +7548,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha3_BackendTLSPolicySpec(ref common.
 							},
 						},
 						SchemaProps: spec.SchemaProps{
-							Description: "TargetRefs identifies an API object to apply the policy to. Only Services have Extended support. Implementations MAY support additional objects, with Implementation Specific support. Note that this config applies to the entire referenced resource by default, but this default may change in the future to provide a more granular application of the policy.\n\nTargetRefs must be _distinct_. This means either that:\n\n* They select different targets. If this is the case, then targetRef\n  entries are distinct. In terms of fields, this means that the\n  multi-part key defined by `group`, `kind`, and `name` must\n  be unique across all targetRef entries in the BackendTLSPolicy.\n* They select different sectionNames in the same target.\n\nSupport: Extended for Kubernetes Service\n\nSupport: Implementation-specific for any other resource",
+							Description: "TargetRefs identifies an API object to apply the policy to. Only Services have Extended support. Implementations MAY support additional objects, with Implementation Specific support. Note that this config applies to the entire referenced resource by default, but this default may change in the future to provide a more granular application of the policy.\n\nTargetRefs must be _distinct_. This means either that:\n\n* They select different targets. If this is the case, then targetRef\n  entries are distinct. In terms of fields, this means that the\n  multi-part key defined by `group`, `kind`, and `name` must\n  be unique across all targetRef entries in the BackendTLSPolicy.\n* They select different sectionNames in the same target.\n\nWhen more than one BackendTLSPolicy selects the same target and sectionName, implementations MUST determine precedence using the following criteria, continuing on ties:\n\n* The older policy by creation timestamp takes precedence. For\n  example, a policy with a creation timestamp of \"2021-07-15\n  01:02:03\" MUST be given precedence over a policy with a\n  creation timestamp of \"2021-07-15 01:02:04\".\n* The policy appearing first in alphabetical order by {name}.\n  For example, a policy named `bar` is given precedence over a\n  policy named `baz`.\n\nFor any BackendTLSPolicy that does not take precedence, the implementation MUST ensure the `Accepted` Condition is set to `status: False`, with Reason `Conflicted`.\n\nSupport: Extended for Kubernetes Service\n\nSupport: Implementation-specific for any other resource",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
@@ -7626,7 +7632,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha3_BackendTLSPolicyValidation(ref c
 					},
 					"hostname": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Hostname is used for two purposes in the connection between Gateways and backends:\n\n1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066). 2. Hostname MUST be used for authentication and MUST match the certificate served by the matching backend, unless SubjectAltNames is specified.\n\nSupport: Core",
+							Description: "Hostname is used for two purposes in the connection between Gateways and backends:\n\n1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066). 2. Hostname MUST be used for authentication and MUST match the certificate\n   served by the matching backend, unless SubjectAltNames is specified.\n3. If SubjectAltNames are specified, Hostname can be used for certificate selection\n   but MUST NOT be used for authentication. If you want to use the value\n   of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.\n\nSupport: Core",
 							Default:     "",
 							Type:        []string{"string"},
 							Format:      "",
diff --git a/roles/RELEASE_MANAGER.md b/roles/RELEASE_MANAGER.md
new file mode 100644
index 00000000..2fa5f0f9
--- /dev/null
+++ b/roles/RELEASE_MANAGER.md
@@ -0,0 +1,120 @@
+# Gateway API Release Manager
+
+## Overview
+
+The Gateway API release manager role is responsible for coordinating and managing the release, taking ultimate accountability for the success of the release, and ensuring that a retrospective happens.
+
+This role is based on the Release Lead role in Kubernetes SIG-Release, and is intended to be similar - a servant leader of the release, not the primary decision maker.
+
+As a Release Manager, you should expect to spend a lot of time talking to people about the status of changes, tracking changes yourself, and updating the community about what changes are in and out of scope for the release.
+
+## Authority and Responsibility
+
+The release manager has the authority to:
+
+* Bring together the project’s leadership (including maintainers and other leads) to coordinate decisions about what is in scope for the release  
+* Bring together the project’s leadership to coordinate decisions about granting extensions to deadlines in specific cases  
+* Perform the actual release  
+* Call the community (or some parts of it) together for status and retrospective meetings outside of the normal meeting cadence  
+* Remind reviewers and approvers of outstanding work that needs to be done  
+* Delegate these authorities to others (with the agreement of the maintainer team)
+
+The release manager has the responsibility to:
+
+* Ensure that the release has agreed-on dates for the final release, and for as many phases as possible. The community has indicated a clear preference for dates communicated up front as much as possible.  
+* Ensure the release happens on the agreed upon date, or as close as possible, including assisting the community in meeting agreed-upon deadlines  
+* Ensure that the community is informed about the progress of the release during the burndown process, particularly what is in and out of scope of the release. This can be by the maintenance of Github Boards or Milestones, or any other method that the Release Manager agrees with the leadership team and the community  
+* Notify feature owners if their feature is at risk of or has fallen out of scope for the release  
+* Refine the design of and improve documentation for the release process itself  
+* Prepare the change log for the release  
+* Coordinate the blog post for the release  
+* Perform the implementation page review process after the release
+
+There are some practical requirements that fall out of these lists.
+
+The release manager must
+
+* Update the community no less than weekly on work that is currently slated for the release  
+* Try to minimize the amount of reviews required in short time frames (that is, try to remind people to spread out the work across the release as much as possible, rather than happening just before or on the deadlines)
+
+## Time commitments
+
+The release manager is expected to keep both themselves and the community up to date about what is happening, which will require a reasonably large amount of time each week, and that time should be expected to increase when deadlines are approaching. You should plan on, *at a minimum*, **1 to 2 hours per working day** to begin with, with probably **half your time** spent on the release at busy times, and an **entire day or two** for the actual release cutting process.
+
+## Release dates and deadlines
+
+The Release Manager is responsible for:
+
+* Ensuring that a final release date is picked as early as possible and communicated to the community for planning purposes. This is the most important date, and should be designed so that any timing mistakes have a minimal impact on it, as the community will depend on the release being on or *very* close to this date.  
+* Ensuring that intermediate deadlines are chosen and communicated as early as possible, and that any changes to those deadlines are both discussed by the leadership team and communicated to the community well in advance of them being relevant.  
+* Ensuring that deadline extensions are kept to a minimum, and are on a case-by-case basis only. Feature leads MUST ask for extensions before they can be granted, and there MUST be enough time for the entire leadership team to see and agree with the extension before it is granted. Practically, this means that there must be a *minimum* of 24-48 hours (not counting weekends) between an extension being asked for and the deadline that is being extended.
+
+## Work examples in the current release phases
+
+### Scoping
+
+The scoping phase is about determining what will get focus in the next release.
+
+The way that the community determines what work is in scope for the release is ultimately up to the release manager, although they are expected to build some consensus amongst both the maintainers and the community about the method.
+
+In the interest of ensuring that the changes we include are what the community is interested in, and that we are doing necessary but boring work like tech debt reduction, scoping MUST involve:
+
+* Community feedback  
+* Maintainer input (to ensure we try to solve underlying issues as well as new features)  
+* Reviewer input (to ensure that we keep changes deliverable within a release cycle)  
+* Ensuring that features are moving towards Standard, and are not stuck in Experimental
+
+In all cases, the Release Manager *must* ensure that all the factors involved in the scoping decisions are publicly available.
+
+For example, for v1.4, we had scoping performed using the votes on the Github discussions that proposed inclusion (which are publicly visible, and attributable to individuals), and for v1.3, we used community votes plus some additional factors like “difficulty of change” and “future importance”. In the v1.3 case, those weights were agreed upon by the maintainers and made available in a [world-readable Google sheet](https://docs.google.com/spreadsheets/d/1tLVmYHCyVuRLwnvMJuYMhiEtVX0fUF1aLHBLIc7mBKE/edit?gid=0#gid=0).
+
+### GEP Refinement
+
+The GEP refinement phase is about getting the agreed-upon GEPs to the phase they need to be at so that required API changes can be made in the next phase.
+
+Generally, this involves the feature owners pushing PRs with their proposed changes, and their reviewer sponsor coordinating getting the changes reviewed.
+
+The release manager’s most important role here is reminding everyone what changes are on the table, and poking feature owners to ensure they are actually working on the required changes. This is *much* more work than it sounds, particularly because contentious changes can often run to hundreds of comments that need to be tracked and followed up.
+
+Generally, tracking requested changes should be the role of the feature owner and/or the reviewer sponsor, but the Release Manager should feel confident to chase things that look like they may have been missed.
+
+The Release Manager is encouraged to set deadlines within this phase for gates like “GEP PR is open” “GEP PR is merged at Provisional”, “GEP PR is merged at Implementable”. Note that once a GEP is Implementable, this phase is complete for that GEP.
+
+The Release Manager should also feel free to perform reviews themselves if they have the context and bandwidth to do so.
+
+The Release Manager is responsible for notifying feature owners if their feature has fallen out of scope due to missing deadlines.
+
+The Release Manager is the final arbiter for approving extensions for deadlines in this phase, and should do so *only* if the extension is requested in public, and on a case-by-case basis. No extensions for everything.
+
+### API implementation phase
+
+In this phase, we expect to merge any required changes to the API itself into the repo, preferably with conformance tests to ensure that implementations do things correctly when implementing the new changes.
+
+The Release Manager’s role here is to:
+
+* Keep track of changes as they happen  
+* Remind feature owners of upcoming deadlines  
+* Communicate what features are ongoing, what at risk, and what are out of scope  
+* Ensure that deadlines are met  
+* Grant extensions for deadlines, if required, on a case-by-case basis. 
+
+Generally, in this phase, most of the changes are relatively straightforward, as most argument happens during the design phase in GEP Refinement. However, sometimes actually making the changes to the API, and in particular writing conformance tests, can show problems with the APIs as designed that may need further API changes to fix. Part of the Release Manager’s role is to be the arbiter of judgement calls about if further API changes are deliverable in the required timeframe, or if the change should be pushed back to the next version.
+
+### API Review and Release Candidate phase
+
+In this phase, we MUST get sign-off from SIG-Network API reviewers for *all* API changes. This is a requirement of having an official [`k8s.io`](http://k8s.io) API, and is not negotiable. Practically, API reviewers are usually very busy, and it can be difficult to get time with them, so it’s important to ensure that all the pending API changes are completed before getting the API reviewers to look.
+
+The API reviewers *may* review an RC build, which would coincide with making the RC available to the community. That does run the risk that early implementers may need to change things as a result of API review feedback (this has definitely happened before).
+
+The Release Candidate builds are intended to allow implementations to get started on actually implementing the API changes from the release early, so that they can provide feedback about the implementation experience, and source early user feedback if possible.
+
+We generally try to do at least two candidate releases, with the requirement being that there MUST NOT be any changes between the final RC and the actual release.
+
+## Measuring success
+
+Getting a release out at all is a success!
+
+But to be able to quantify releases a bit, and evaluate if changes to the release process are helping or not, we track some metrics about each release, which can be summarized into two main buckets:
+
+* Release size (How many features, and how large is each feature? How many new conformance tests added? Any process changes during the release timeframe?)  
+* Release timeliness (Was the release released on the targeted date? Did we meet agreed upon deadlines within the release schedule? How many extensions did we need to grant during the release?)



Test patch:
diff --git a/conformance/tests/backendtlspolicy-conflict-resolution.go b/conformance/tests/backendtlspolicy-conflict-resolution.go
new file mode 100644
index 00000000..6aac39c9
--- /dev/null
+++ b/conformance/tests/backendtlspolicy-conflict-resolution.go
@@ -0,0 +1,155 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tests
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+
+	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
+	"sigs.k8s.io/gateway-api/apis/v1alpha2"
+	h "sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	ConformanceTests = append(ConformanceTests, BackendTLSPolicyConflictResolution)
+}
+
+var BackendTLSPolicyConflictResolution = suite.ConformanceTest{
+	ShortName:   "BackendTLSPolicyConflictResolution",
+	Description: "Verifies that when multiple BackendTLSPolicies target the same Service, only one policy is accepted while conflicting policies are rejected, and traffic continues to route successfully.",
+	Features: []features.FeatureName{
+		features.SupportGateway,
+		features.SupportHTTPRoute,
+		features.SupportBackendTLSPolicy,
+	},
+	Manifests: []string{"tests/backendtlspolicy-conflict-resolution.yaml"},
+	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
+		ns := "gateway-conformance-infra"
+		routeNN := types.NamespacedName{Name: "backendtlspolicy-conflict-resolution", Namespace: ns}
+		gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
+
+		kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ns})
+		gwAddr := kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &gatewayv1.HTTPRoute{}, false, routeNN)
+		kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
+
+		acceptedCond := metav1.Condition{
+			Type:   string(v1alpha2.PolicyConditionAccepted),
+			Status: metav1.ConditionTrue,
+			Reason: string(v1alpha2.PolicyReasonAccepted),
+		}
+		conflictedCond := metav1.Condition{
+			Type:   string(v1alpha2.PolicyConditionAccepted),
+			Status: metav1.ConditionFalse,
+			Reason: string(v1alpha2.PolicyReasonConflicted),
+		}
+
+		t.Run("Conflicting BackendTLSPolicies targeting the same Service without a section name", func(t *testing.T) {
+			t.Run("First BackendTLSPolicy should be accepted", func(t *testing.T) {
+				policyNN := types.NamespacedName{Name: "conflicted-without-section-name-1", Namespace: ns}
+				kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, acceptedCond)
+			})
+
+			t.Run("Second BackendTLSPolicy should have a false Accepted condition with reason Conflicted ", func(t *testing.T) {
+				// This is not specific to BackendTLSPolicy, it follows the conflict-resolution rules, as defined in GEP-713.
+				conflictedPolicyNN := types.NamespacedName{Name: "conflicted-without-section-name-2", Namespace: ns}
+				kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, conflictedPolicyNN, gwNN, conflictedCond)
+			})
+
+			t.Run("HTTP request sent to Service using the accepted BackendTLSPolicy should succeed", func(t *testing.T) {
+				h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+					h.ExpectedResponse{
+						Namespace: ns,
+						Request: h.Request{
+							Host: "abc.example.com",
+							Path: "/backendtlspolicy-conflicted-without-section-name",
+							SNI:  "other.example.com",
+						},
+						Response: h.Response{StatusCode: 200},
+					})
+			})
+		})
+
+		t.Run("Conflicting BackendTLSPolicies targeting the same Service with the same section name", func(t *testing.T) {
+			t.Run("First BackendTLSPolicy should be accepted", func(t *testing.T) {
+				policyNN := types.NamespacedName{Name: "conflicted-with-section-name-1", Namespace: ns}
+				kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, acceptedCond)
+			})
+
+			t.Run("Second BackendTLSPolicy should have a false Accepted condition with reason Conflicted ", func(t *testing.T) {
+				// This is not specific to BackendTLSPolicy, it follows the conflict-resolution rules, as defined in GEP-713.
+				conflictedPolicyNN := types.NamespacedName{Name: "conflicted-with-section-name-2", Namespace: ns}
+				kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, conflictedPolicyNN, gwNN, conflictedCond)
+			})
+
+			t.Run("HTTP request sent to Service using the accepted BackendTLSPolicy should succeed", func(t *testing.T) {
+				h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+					h.ExpectedResponse{
+						Namespace: ns,
+						Request: h.Request{
+							Host: "abc.example.com",
+							Path: "/backendtlspolicy-conflicted-with-section-name",
+							SNI:  "other.example.com",
+						},
+						Response: h.Response{StatusCode: 200},
+					})
+			})
+		})
+
+		t.Run("BackendTLSPolicies targeting the same Service with and without a section name", func(t *testing.T) {
+			t.Run("BackendTLSPolicy with section name should be accepted", func(t *testing.T) {
+				policyNN := types.NamespacedName{Name: "not-conflicted-with-section-name", Namespace: ns}
+				kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, acceptedCond)
+			})
+
+			t.Run("BackendTLSPolicy without section name should be accepted", func(t *testing.T) {
+				policyNN := types.NamespacedName{Name: "not-conflicted-without-section-name", Namespace: ns}
+				kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, acceptedCond)
+			})
+
+			t.Run("HTTP request sent to Service using the BackendTLSPolicy with section name should succeed", func(t *testing.T) {
+				h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+					h.ExpectedResponse{
+						Namespace: ns,
+						Request: h.Request{
+							Host: "abc.example.com",
+							Path: "/backendtlspolicy-not-conflicted-with-section-name",
+							SNI:  "other.example.com",
+						},
+						Response: h.Response{StatusCode: 200},
+					})
+			})
+			t.Run("HTTP request sent to Service using the BackendTLSPolicy without section name should succeed", func(t *testing.T) {
+				h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+					h.ExpectedResponse{
+						Namespace: ns,
+						Request: h.Request{
+							Host: "abc.example.com",
+							Path: "/backendtlspolicy-not-conflicted-without-section-name",
+							SNI:  "abc.example.com",
+						},
+						Response: h.Response{StatusCode: 200},
+					})
+			})
+		})
+	},
+}
diff --git a/conformance/tests/backendtlspolicy-conflict-resolution.yaml b/conformance/tests/backendtlspolicy-conflict-resolution.yaml
new file mode 100644
index 00000000..5d5e6583
--- /dev/null
+++ b/conformance/tests/backendtlspolicy-conflict-resolution.yaml
@@ -0,0 +1,214 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: backendtlspolicy-conflict-resolution
+  namespace: gateway-conformance-infra
+spec:
+  parentRefs:
+    - name: same-namespace
+  hostnames:
+    - abc.example.com
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backendtlspolicy-conflicted-without-section-name-test
+          port: 443
+      matches:
+        - path:
+            type: Exact
+            value: /backendtlspolicy-conflicted-without-section-name
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backendtlspolicy-conflicted-with-section-name-test
+          port: 443
+      matches:
+        - path:
+            type: Exact
+            value: /backendtlspolicy-conflicted-with-section-name
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backendtlspolicy-not-conflicted-test
+          port: 443
+      matches:
+        - path:
+            type: Exact
+            value: /backendtlspolicy-not-conflicted-with-section-name
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backendtlspolicy-not-conflicted-test
+          port: 8443
+      matches:
+        - path:
+            type: Exact
+            value: /backendtlspolicy-not-conflicted-without-section-name
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-conflicted-without-section-name-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: tls-backend
+  ports:
+    - name: "https"
+      protocol: TCP
+      port: 443
+      targetPort: 8443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-conflicted-with-section-name-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: tls-backend
+  ports:
+    - name: "https-1"
+      protocol: TCP
+      port: 443
+      targetPort: 8443
+    - name: "https-2"
+      protocol: TCP
+      port: 8443
+      targetPort: 8443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-not-conflicted-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: tls-backend
+  ports:
+    - name: "https-1"
+      protocol: TCP
+      port: 443
+      targetPort: 8443
+    - name: "https-2"
+      protocol: TCP
+      port: 8443
+      targetPort: 8443
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: conflicted-without-section-name-1
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+    - group: ""
+      kind: Service
+      name: "backendtlspolicy-conflicted-without-section-name-test"
+  validation:
+    caCertificateRefs:
+      - group: ""
+        kind: ConfigMap
+        # This ConfigMap is generated dynamically by the test suite.
+        # It contains the CA certificate used to sign the tls-backend serving certificate.
+        name: "tls-checks-ca-certificate"
+    hostname: "other.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: conflicted-without-section-name-2
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+    - group: ""
+      kind: Service
+      name: "backendtlspolicy-conflicted-without-section-name-test"
+  validation:
+    caCertificateRefs:
+      - group: ""
+        kind: ConfigMap
+        # This ConfigMap is generated dynamically by the test suite.
+        # It contains the CA certificate used to sign the tls-backend serving certificate.
+        name: "tls-checks-ca-certificate"
+    hostname: "abc.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: conflicted-with-section-name-1
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+    - group: ""
+      kind: Service
+      name: "backendtlspolicy-conflicted-with-section-name-test"
+      sectionName: "https-1"
+  validation:
+    caCertificateRefs:
+      - group: ""
+        kind: ConfigMap
+        # This ConfigMap is generated dynamically by the test suite.
+        # It contains the CA certificate used to sign the tls-backend serving certificate.
+        name: "tls-checks-ca-certificate"
+    hostname: "other.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: conflicted-with-section-name-2
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+    - group: ""
+      kind: Service
+      name: "backendtlspolicy-conflicted-with-section-name-test"
+      sectionName: "https-1"
+  validation:
+    caCertificateRefs:
+      - group: ""
+        kind: ConfigMap
+        # This ConfigMap is generated dynamically by the test suite.
+        # It contains the CA certificate used to sign the tls-backend serving certificate.
+        name: "tls-checks-ca-certificate"
+    hostname: "abc.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: not-conflicted-with-section-name
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+    - group: ""
+      kind: Service
+      name: "backendtlspolicy-not-conflicted-test"
+      sectionName: "https-1"
+  validation:
+    caCertificateRefs:
+      - group: ""
+        kind: ConfigMap
+        # This ConfigMap is generated dynamically by the test suite.
+        # It contains the CA certificate used to sign the tls-backend serving certificate.
+        name: "tls-checks-ca-certificate"
+    hostname: "other.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: not-conflicted-without-section-name
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+    - group: ""
+      kind: Service
+      name: "backendtlspolicy-not-conflicted-test"
+  validation:
+    caCertificateRefs:
+      - group: ""
+        kind: ConfigMap
+        # This ConfigMap is generated dynamically by the test suite.
+        # It contains the CA certificate used to sign the tls-backend serving certificate.
+        name: "tls-checks-ca-certificate"
+    hostname: "abc.example.com"
diff --git a/conformance/tests/grpcroute-weight.go b/conformance/tests/grpcroute-weight.go
new file mode 100644
index 00000000..ba5a4d56
--- /dev/null
+++ b/conformance/tests/grpcroute-weight.go
@@ -0,0 +1,98 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tests
+
+import (
+	"fmt"
+	"testing"
+
+	"google.golang.org/grpc/codes"
+	"k8s.io/apimachinery/pkg/types"
+
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	pb "sigs.k8s.io/gateway-api/conformance/echo-basic/grpcechoserver"
+	"sigs.k8s.io/gateway-api/conformance/utils/grpc"
+	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/conformance/utils/weight"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	ConformanceTests = append(ConformanceTests, GRPCRouteWeight)
+}
+
+var GRPCRouteWeight = suite.ConformanceTest{
+	ShortName:   "GRPCRouteWeight",
+	Description: "An GRPCRoute with weighted backends",
+	Manifests:   []string{"tests/grpcroute-weight.yaml"},
+	Features: []features.FeatureName{
+		features.SupportGateway,
+		features.SupportGRPCRoute,
+	},
+	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
+		var (
+			ns      = "gateway-conformance-infra"
+			routeNN = types.NamespacedName{Name: "weighted-backends", Namespace: ns}
+			gwNN    = types.NamespacedName{Name: "same-namespace", Namespace: ns}
+			gwAddr  = kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &v1.GRPCRoute{}, true, routeNN)
+		)
+
+		t.Run("Requests should have a distribution that matches the weight", func(t *testing.T) {
+			expected := grpc.ExpectedResponse{
+				EchoRequest: &pb.EchoRequest{},
+				Response:    grpc.Response{Code: codes.OK},
+				Namespace:   "gateway-conformance-infra",
+			}
+
+			// Assert request succeeds before doing our distribution check
+			grpc.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.GRPCClient, suite.TimeoutConfig, gwAddr, expected)
+
+			expectedWeights := map[string]float64{
+				"grpc-infra-backend-v1": 0.7,
+				"grpc-infra-backend-v2": 0.3,
+				"grpc-infra-backend-v3": 0.0,
+			}
+
+			sender := weight.NewFunctionBasedSender(func() (string, error) {
+				uniqueExpected := expected
+				if err := grpc.AddEntropy(&uniqueExpected); err != nil {
+					return "", fmt.Errorf("error adding entropy: %w", err)
+				}
+				client := &grpc.DefaultClient{}
+				defer client.Close()
+				resp, err := client.SendRPC(t, gwAddr, uniqueExpected, suite.TimeoutConfig.MaxTimeToConsistency)
+				if err != nil {
+					return "", fmt.Errorf("failed to send gRPC request: %w", err)
+				}
+				if resp.Code != codes.OK {
+					return "", fmt.Errorf("expected OK response, got %v", resp.Code)
+				}
+				return resp.Response.GetAssertions().GetContext().GetPod(), nil
+			})
+
+			for i := 0; i < weight.MaxTestRetries; i++ {
+				if err := weight.TestWeightedDistribution(sender, expectedWeights); err != nil {
+					t.Logf("Traffic distribution test failed (%d/%d): %s", i+1, weight.MaxTestRetries, err)
+				} else {
+					return
+				}
+			}
+			t.Fatal("Weighted distribution tests failed")
+		})
+	},
+}
diff --git a/conformance/tests/grpcroute-weight.yaml b/conformance/tests/grpcroute-weight.yaml
new file mode 100644
index 00000000..944d3b74
--- /dev/null
+++ b/conformance/tests/grpcroute-weight.yaml
@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: GRPCRoute
+metadata:
+  name: weighted-backends
+  namespace: gateway-conformance-infra
+spec:
+  parentRefs:
+  - name: same-namespace
+  rules:
+  - backendRefs:
+    - name: grpc-infra-backend-v1
+      port: 8080
+      weight: 70
+    - name: grpc-infra-backend-v2
+      port: 8080
+      weight: 30
+    - name: grpc-infra-backend-v3
+      port: 8080
+      weight: 0
diff --git a/conformance/tests/httproute-weight.go b/conformance/tests/httproute-weight.go
index bafd768a..f7a1254f 100644
--- a/conformance/tests/httproute-weight.go
+++ b/conformance/tests/httproute-weight.go
@@ -17,21 +17,15 @@ limitations under the License.
 package tests
 
 import (
-	"cmp"
-	"errors"
 	"fmt"
-	"math"
-	"slices"
-	"strings"
-	"sync"
 	"testing"
 
-	"golang.org/x/sync/errgroup"
 	"k8s.io/apimachinery/pkg/types"
 
 	"sigs.k8s.io/gateway-api/conformance/utils/http"
 	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
 	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/conformance/utils/weight"
 	"sigs.k8s.io/gateway-api/pkg/features"
 )
 
@@ -69,9 +63,31 @@ var HTTPRouteWeight = suite.ConformanceTest{
 			// Assert request succeeds before doing our distribution check
 			http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expected)
 
-			for i := 0; i < 10; i++ {
-				if err := testDistribution(t, suite, gwAddr, expected); err != nil {
-					t.Logf("Traffic distribution test failed (%d/10): %s", i+1, err)
+			expectedWeights := map[string]float64{
+				"infra-backend-v1": 0.7,
+				"infra-backend-v2": 0.3,
+				"infra-backend-v3": 0.0,
+			}
+
+			sender := weight.NewFunctionBasedSender(func() (string, error) {
+				uniqueExpected := expected
+				if err := http.AddEntropy(&uniqueExpected); err != nil {
+					return "", fmt.Errorf("error adding entropy: %w", err)
+				}
+				req := http.MakeRequest(t, &uniqueExpected, gwAddr, "HTTP", "http")
+				cReq, cRes, err := suite.RoundTripper.CaptureRoundTrip(req)
+				if err != nil {
+					return "", fmt.Errorf("failed to roundtrip request: %w", err)
+				}
+				if err := http.CompareRoundTrip(t, &req, cReq, cRes, expected); err != nil {
+					return "", fmt.Errorf("response expectation failed for request: %w", err)
+				}
+				return cReq.Pod, nil
+			})
+
+			for i := 0; i < weight.MaxTestRetries; i++ {
+				if err := weight.TestWeightedDistribution(sender, expectedWeights); err != nil {
+					t.Logf("Traffic distribution test failed (%d/%d): %s", i+1, weight.MaxTestRetries, err)
 				} else {
 					return
 				}
@@ -80,85 +96,3 @@ var HTTPRouteWeight = suite.ConformanceTest{
 		})
 	},
 }
-
-func testDistribution(t *testing.T, suite *suite.ConformanceTestSuite, gwAddr string, expected http.ExpectedResponse) error {
-	const (
-		concurrentRequests  = 10
-		tolerancePercentage = 0.05
-		totalRequests       = 500.0
-	)
-	var (
-		roundTripper = suite.RoundTripper
-
-		g               errgroup.Group
-		seenMutex       sync.Mutex
-		seen            = make(map[string]float64, 3 /* number of backends */)
-		expectedWeights = map[string]float64{
-			"infra-backend-v1": 0.7,
-			"infra-backend-v2": 0.3,
-			"infra-backend-v3": 0.0,
-		}
-	)
-	g.SetLimit(concurrentRequests)
-	for i := 0.0; i < totalRequests; i++ {
-		g.Go(func() error {
-			uniqueExpected := expected
-			if err := http.AddEntropy(&uniqueExpected); err != nil {
-				return fmt.Errorf("error adding entropy: %w", err)
-			}
-			req := http.MakeRequest(t, &uniqueExpected, gwAddr, "HTTP", "http")
-			cReq, cRes, err := roundTripper.CaptureRoundTrip(req)
-			if err != nil {
-				return fmt.Errorf("failed to roundtrip request: %w", err)
-			}
-			if err := http.CompareRoundTrip(t, &req, cReq, cRes, expected); err != nil {
-				return fmt.Errorf("response expectation failed for request: %w", err)
-			}
-
-			seenMutex.Lock()
-			defer seenMutex.Unlock()
-
-			for expectedBackend := range expectedWeights {
-				if strings.HasPrefix(cReq.Pod, expectedBackend) {
-					seen[expectedBackend]++
-					return nil
-				}
-			}
-
-			return fmt.Errorf("request was handled by an unexpected pod %q", cReq.Pod)
-		})
-	}
-
-	if err := g.Wait(); err != nil {
-		return fmt.Errorf("error while sending requests: %w", err)
-	}
-
-	var errs []error
-	if len(seen) != 2 {
-		errs = append(errs, fmt.Errorf("expected only two backends to receive traffic"))
-	}
-
-	for wantBackend, wantPercent := range expectedWeights {
-		gotCount, ok := seen[wantBackend]
-
-		if !ok && wantPercent != 0.0 {
-			errs = append(errs, fmt.Errorf("expect traffic to hit backend %q - but none was received", wantBackend))
-			continue
-		}
-
-		gotPercent := gotCount / totalRequests
-
-		if math.Abs(gotPercent-wantPercent) > tolerancePercentage {
-			errs = append(errs, fmt.Errorf("backend %q weighted traffic of %v not within tolerance %v (+/-%f)",
-				wantBackend,
-				gotPercent,
-				wantPercent,
-				tolerancePercentage,
-			))
-		}
-	}
-	slices.SortFunc(errs, func(a, b error) int {
-		return cmp.Compare(a.Error(), b.Error())
-	})
-	return errors.Join(errs...)
-}
diff --git a/conformance/tests/mesh/grpcroute-weight.go b/conformance/tests/mesh/grpcroute-weight.go
new file mode 100644
index 00000000..01571196
--- /dev/null
+++ b/conformance/tests/mesh/grpcroute-weight.go
@@ -0,0 +1,83 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meshtests
+
+import (
+	"fmt"
+	"testing"
+
+	"sigs.k8s.io/gateway-api/conformance/utils/echo"
+	"sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/conformance/utils/weight"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	MeshConformanceTests = append(MeshConformanceTests, MeshGRPCRouteWeight)
+}
+
+var MeshGRPCRouteWeight = suite.ConformanceTest{
+	ShortName:   "MeshGRPCRouteWeight",
+	Description: "A GRPCRoute with weighted backends in mesh mode",
+	Manifests:   []string{"tests/mesh/grpcroute-weight.yaml"},
+	Features: []features.FeatureName{
+		features.SupportMesh,
+		features.SupportGRPCRoute,
+	},
+	Test: func(t *testing.T, s *suite.ConformanceTestSuite) {
+		client := echo.ConnectToApp(t, s, echo.MeshAppEchoV1)
+
+		t.Run("Requests should have a distribution that matches the weight", func(t *testing.T) {
+			// Create a gRPC request using the mesh client framework
+			expected := http.ExpectedResponse{
+				Request:   http.Request{Protocol: "grpc", Path: "", Host: "echo:7070"},
+				Response:  http.Response{StatusCode: 200},
+				Namespace: "gateway-conformance-mesh",
+			}
+
+			// Assert request succeeds before doing our distribution check
+			client.MakeRequestAndExpectEventuallyConsistentResponse(t, expected, s.TimeoutConfig)
+
+			expectedWeights := map[string]float64{
+				"echo-v1": 0.7,
+				"echo-v2": 0.3,
+			}
+
+			sender := weight.NewFunctionBasedSender(func() (string, error) {
+				uniqueExpected := expected
+				if err := http.AddEntropy(&uniqueExpected); err != nil {
+					return "", fmt.Errorf("error adding entropy: %w", err)
+				}
+				_, cRes, err := client.CaptureRequestResponseAndCompare(t, uniqueExpected)
+				if err != nil {
+					return "", fmt.Errorf("failed gRPC mesh request: %w", err)
+				}
+				return cRes.Hostname, nil
+			})
+
+			for i := 0; i < weight.MaxTestRetries; i++ {
+				if err := weight.TestWeightedDistribution(sender, expectedWeights); err != nil {
+					t.Logf("Traffic distribution test failed (%d/%d): %s", i+1, weight.MaxTestRetries, err)
+				} else {
+					return
+				}
+			}
+			t.Fatal("Weighted distribution tests failed")
+		})
+	},
+}
diff --git a/conformance/tests/mesh/grpcroute-weight.yaml b/conformance/tests/mesh/grpcroute-weight.yaml
new file mode 100644
index 00000000..b14eb777
--- /dev/null
+++ b/conformance/tests/mesh/grpcroute-weight.yaml
@@ -0,0 +1,22 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: GRPCRoute
+metadata:
+  name: mesh-grpc-weighted-backends
+  namespace: gateway-conformance-mesh
+spec:
+  parentRefs:
+  - group: ""
+    kind: Service
+    name: echo
+    port: 7070
+  rules:
+  - backendRefs:
+    - name: echo-v1
+      port: 7070
+      weight: 70
+    - name: echo-v2
+      port: 7070
+      weight: 30
+    - name: echo-v3
+      port: 7070
+      weight: 0
diff --git a/conformance/tests/mesh/httproute-weight.go b/conformance/tests/mesh/httproute-weight.go
index 844d5471..ceccca95 100644
--- a/conformance/tests/mesh/httproute-weight.go
+++ b/conformance/tests/mesh/httproute-weight.go
@@ -17,20 +17,13 @@ limitations under the License.
 package meshtests
 
 import (
-	"cmp"
-	"errors"
 	"fmt"
-	"math"
-	"slices"
-	"strings"
-	"sync"
 	"testing"
 
-	"golang.org/x/sync/errgroup"
-
 	"sigs.k8s.io/gateway-api/conformance/utils/echo"
 	"sigs.k8s.io/gateway-api/conformance/utils/http"
 	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/conformance/utils/weight"
 	"sigs.k8s.io/gateway-api/pkg/features"
 )
 
@@ -59,89 +52,32 @@ var MeshHTTPRouteWeight = suite.ConformanceTest{
 
 			// Assert request succeeds before doing our distribution check
 			client.MakeRequestAndExpectEventuallyConsistentResponse(t, expected, s.TimeoutConfig)
-			for i := 0; i < 10; i++ {
-				if err := testDistribution(t, client, expected); err != nil {
-					t.Logf("Traffic distribution test failed (%d/10): %s", i+1, err)
-				} else {
-					return
-				}
-			}
-			t.Fatal("Weighted distribution tests failed")
-		})
-	},
-}
 
-func testDistribution(t *testing.T, client echo.MeshPod, expected http.ExpectedResponse) error {
-	const (
-		concurrentRequests  = 10
-		tolerancePercentage = 0.05
-		totalRequests       = 500.0
-	)
-	var (
-		g               errgroup.Group
-		seenMutex       sync.Mutex
-		seen            = make(map[string]float64, 2 /* number of backends */)
-		expectedWeights = map[string]float64{
-			"echo-v1": 0.7,
-			"echo-v2": 0.3,
-		}
-	)
-	g.SetLimit(concurrentRequests)
-	for i := 0.0; i < totalRequests; i++ {
-		g.Go(func() error {
-			uniqueExpected := expected
-			if err := http.AddEntropy(&uniqueExpected); err != nil {
-				return fmt.Errorf("error adding entropy: %w", err)
-			}
-			_, cRes, err := client.CaptureRequestResponseAndCompare(t, uniqueExpected)
-			if err != nil {
-				return fmt.Errorf("failed: %w", err)
+			expectedWeights := map[string]float64{
+				"echo-v1": 0.7,
+				"echo-v2": 0.3,
 			}
 
-			seenMutex.Lock()
-			defer seenMutex.Unlock()
+			sender := weight.NewFunctionBasedSender(func() (string, error) {
+				uniqueExpected := expected
+				if err := http.AddEntropy(&uniqueExpected); err != nil {
+					return "", fmt.Errorf("error adding entropy: %w", err)
+				}
+				_, cRes, err := client.CaptureRequestResponseAndCompare(t, uniqueExpected)
+				if err != nil {
+					return "", fmt.Errorf("failed mesh request: %w", err)
+				}
+				return cRes.Hostname, nil
+			})
 
-			for expectedBackend := range expectedWeights {
-				if strings.HasPrefix(cRes.Hostname, expectedBackend) {
-					seen[expectedBackend]++
-					return nil
+			for i := 0; i < weight.MaxTestRetries; i++ {
+				if err := weight.TestWeightedDistribution(sender, expectedWeights); err != nil {
+					t.Logf("Traffic distribution test failed (%d/%d): %s", i+1, weight.MaxTestRetries, err)
+				} else {
+					return
 				}
 			}
-
-			return fmt.Errorf("request was handled by an unexpected pod %q", cRes.Hostname)
+			t.Fatal("Weighted distribution tests failed")
 		})
-	}
-
-	if err := g.Wait(); err != nil {
-		return fmt.Errorf("error while sending requests: %w", err)
-	}
-
-	var errs []error
-	if len(seen) != 2 {
-		errs = append(errs, fmt.Errorf("expected only two backends to receive traffic"))
-	}
-
-	for wantBackend, wantPercent := range expectedWeights {
-		gotCount, ok := seen[wantBackend]
-
-		if !ok && wantPercent != 0.0 {
-			errs = append(errs, fmt.Errorf("expect traffic to hit backend %q - but none was received", wantBackend))
-			continue
-		}
-
-		gotPercent := gotCount / totalRequests
-
-		if math.Abs(gotPercent-wantPercent) > tolerancePercentage {
-			errs = append(errs, fmt.Errorf("backend %q weighted traffic of %v not within tolerance %v (+/-%f)",
-				wantBackend,
-				gotPercent,
-				wantPercent,
-				tolerancePercentage,
-			))
-		}
-	}
-	slices.SortFunc(errs, func(a, b error) int {
-		return cmp.Compare(a.Error(), b.Error())
-	})
-	return errors.Join(errs...)
+	},
 }