Repository: kubernetes-sigs/gateway-api

Issue:
Gateway API validations too strict for redirect status codes
**What happened**:
Gateway API has validations that only account for 301 and 302 HTTP Redirects.
https://github.com/kubernetes-sigs/gateway-api/blob/1edf7e93ae4bb8c5ea5cc2193586cfe1e5d15e2f/apis/v1/httproute_types.go#L1069

**What you expected to happen**:
[RFC 2616](https://www.rfc-editor.org/rfc/rfc2616#section-10.3) defines several other redirects, including: 303, 304, 305, and 307.

**Anything else we need to know?**:
Ask would be to align enum validations to RFC2616 section 10.3

Thank you!

Discussion:
@youngnick: It seems very reasonable to me to ensure that all the valid redirect codes can be used in this enum.

But it does raise the question of whether we should be testing the behavior for each redirect code? Currently we are only testing `301` in the conformance tests.@shaneutt: > It seems very reasonable to me to ensure that all the valid redirect codes can be used in this enum.

+1

> But it does raise the question of whether we should be testing the behavior for each redirect code? Currently we are only testing 301 in the conformance tests.

Yes, it does seem like some simple conformance tests around this would be ideal to help reduce implementations being caught off-guard by requirements.@WojciechLuczkow-Flyr: Hello, There is actually issue linked with that:
In postman, by default, 301 and 302 redirect change request method to `GET` (unless configured to not do it).
According to Mozilla docs:
In order to ensure  guarantees that the method and the body will not be changed when the redirected request is made:
307 or 308 should be used for redirect.@danehans: >But it does raise the question of whether we should be testing the behavior for each redirect code? Currently we are only testing 301 in the conformance tests.

+1 on having conformance test coverage for the additional status codes.@k8s-triage-robot: The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:
- After 90d of inactivity, `lifecycle/stale` is applied
- After 30d of inactivity since `lifecycle/stale` was applied, `lifecycle/rotten` is applied
- After 30d of inactivity since `lifecycle/rotten` was applied, the issue is closed

You can:
- Mark this issue as fresh with `/remove-lifecycle stale`
- Close this issue with `/close`
- Offer to help out with [Issue Triage][1]

Please send feedback to sig-contributor-experience at [kubernetes/community](https://github.com/kubernetes/community).

/lifecycle stale

[1]: https://www.kubernetes.dev/docs/guide/issue-triage/@JackStromberg: /remove-lifecycle stale

To loop back around, is it acceptable to follow RFC; outstanding action being additional conformance test coverage for addition of those status codes?@robscott: > /remove-lifecycle stale
> 
> To loop back around, is it acceptable to follow RFC; outstanding action being additional conformance test coverage for addition of those status codes?

Thanks for the follow up on this. Since this is relatively small in scope, I don't think we'd really need a GEP for this, but I'd love to see it get into v1.2.@robscott: Given all the supportive comments above, I think we can mark this as accepted.

/triage accepted@robscott: @JackStromberg do you have time to work on this?@divarvel: RFC2616 is quite outdated, so the status list from the original post is incomplete.

RFC9110 adds the 308 response code as well https://httpwg.org/specs/rfc9110.html#status.308@danehans: @robscott if this is not considered a bug, can you remove the applicable label ([xref](https://github.com/kubernetes-sigs/gateway-api/issues/3828))?@robscott: /remove-kind bug
/kind feature@JackStromberg: fyi -- looks like this is being worked on.  Thank you @davidwin93!

Cross referencing: https://github.com/kubernetes-sigs/gateway-api/pull/3823

Solution patch:
diff --git a/.github/workflows/crd-validation.yml b/.github/workflows/crd-validation.yml
index 4aa88c5a..4daf0bb4 100644
--- a/.github/workflows/crd-validation.yml
+++ b/.github/workflows/crd-validation.yml
@@ -15,7 +15,7 @@ jobs:
       fail-fast: false
       matrix:
         # Available versions at https://raw.githubusercontent.com/kubernetes-sigs/controller-tools/HEAD/envtest-releases.yaml
-        k8s_version: [v1.33.0, v1.32.0, v1.31.0, v1.30.3, v1.29.5]
+        k8s_version: [v1.34.0, v1.33.0, v1.32.0, v1.31.0, v1.30.3]
         crd_channel: [standard, experimental]
     steps:
       - name: Checkout code
diff --git a/.github/workflows/mkdocs-nav-validation.yml b/.github/workflows/mkdocs-nav-validation.yml
new file mode 100644
index 00000000..b7d32c03
--- /dev/null
+++ b/.github/workflows/mkdocs-nav-validation.yml
@@ -0,0 +1,25 @@
+name: Website Table of Content Validation
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+# Remove all permissions from GITHUB_TOKEN except metadata.
+permissions: {}
+
+jobs:
+  gep-validation:
+    name: Verify if nav is updated
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+        with:
+          persist-credentials: false
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
+      - name: Run MKDocs nav Validation
+        run: |
+          make verify-mkdocs-nav
diff --git a/.yamllint.yaml b/.yamllint.yaml
index 19fdcf47..718c7763 100644
--- a/.yamllint.yaml
+++ b/.yamllint.yaml
@@ -4,6 +4,7 @@ ignore: |
   .github/
   .golangci.yml
   mkdocs.yml
+  nav.yml
   cloudbuild.yaml
   config/crd
 
diff --git a/CHANGELOG/1.4-CHANGELOG.md b/CHANGELOG/1.4-CHANGELOG.md
new file mode 100644
index 00000000..ab86248b
--- /dev/null
+++ b/CHANGELOG/1.4-CHANGELOG.md
@@ -0,0 +1,257 @@
+# v1.4 Changelog
+
+## Table of Contents
+
+- [v1.4.0-rc.2](#v140-rc2)
+- [v1.4.0-rc.1](#v140-rc1)
+
+## Changes Since v1.4.0-rc.1
+
+* Allow preprepared CoreDNS image to be used  by @aaronjwood in https://github.com/kubernetes-sigs/gateway-api/pull/3906
+* Update index.md field after moving BackendTLS struct by @kl52752 in https://github.com/kubernetes-sigs/gateway-api/pull/4041
+* Issue 3940: Move BackendTLSPolicy to standard by @candita in https://github.com/kubernetes-sigs/gateway-api/pull/4074
+* Add allowOrigins configuration to CORSAllowCredentialsBehavior and perform cleanup by @snorwin in https://github.com/kubernetes-sigs/gateway-api/pull/4094
+* fix: fix validation and wording when making gateway spec addresses value optional by @bjee19 in https://github.com/kubernetes-sigs/gateway-api/pull/4084
+* Fix broken link in TLS Configuration page by @4n86rakam1 in https://github.com/kubernetes-sigs/gateway-api/pull/4091
+* Automate GEP TOC generation and validate by @rikatz in https://github.com/kubernetes-sigs/gateway-api/pull/4075
+* conformance: fix per-test cleanup by @howardjohn in https://github.com/kubernetes-sigs/gateway-api/pull/4104
+* Added flag for running mesh conformance suite and automatically inferring supported features from Mesh.Status by @bexxmodd in https://github.com/kubernetes-sigs/gateway-api/pull/4097
+* Fixed couple of typos in conformance tests. by @bexxmodd in https://github.com/kubernetes-sigs/gateway-api/pull/4106
+* Issue 3940: Update BackendTLSPolicy GEP to move to standard by @candita in https://github.com/kubernetes-sigs/gateway-api/pull/4099
+* Removing experimental annotation from SupportedFeatures in GWC Status. by @bexxmodd in https://github.com/kubernetes-sigs/gateway-api/pull/4115
+* conformance: fix invalid BackendTLSPolicy conformance test by @howardjohn in https://github.com/kubernetes-sigs/gateway-api/pull/4105
+* fix: use inferred supported features to set extendedSupportedFeatures by @snorwin in https://github.com/kubernetes-sigs/gateway-api/pull/4113
+* conformance: make backend TLS tests IPv6-safe by @howardjohn in https://github.com/kubernetes-sigs/gateway-api/pull/4120
+* concepts/tooling.md: Add Headlamp tool by @illume in https://github.com/kubernetes-sigs/gateway-api/pull/4083
+* docs: update implements page by @zirain in https://github.com/kubernetes-sigs/gateway-api/pull/3996
+* Fix broken link in TLS Configuration page by @4n86rakam1 in https://github.com/kubernetes-sigs/gateway-api/pull/4091
+
+## New Contributors
+
+* @aaronjwood made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3906
+* @illume made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/4083
+* @4n86rakam1 made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/4091
+
+## Full Changelog
+
+**Full Changelog**: https://github.com/kubernetes-sigs/gateway-api/compare/v1.4.0-rc.1...v1.4.0-rc2
+
+# v1.4.0-rc.1
+
+## Major Changes since v1.3.0
+
+### Breaking Changes
+
+#### Experimental CORS Support in HTTPRoute - Breaking Change for AllowCredentials Field
+
+Users of the `Experimental` CORS `AllowCredentials` field can now specify false.
+The underlying API specification type has changed from a enum of type boolean to
+just a boolean, so users deploying `HTTPRoutes` via libraries and evaluating the
+experimental CORS support will need to adjust for the change in types. Please
+see #3895 for more details.
+
+#### Standard GRPCRoute - Spec Field Required (Technicality)
+
+This PR makes `grpcroute.spec` a required field. This is _technically_ a
+backward-incompatible change, as previously the field was unintentionally
+treated as optional because we erroneously used `omitempty` on `.spec` (unlike
+other APIs). Since the codebase didn't yet enforce explicit required markers,
+that `omitempty` allowed a missing `.spec`.
+
+Because `.spec` contains essential route configuration, omitting it renders a
+`GRPCRoute` unusable and causes route implementation to fail, so we expect this
+change will not have adverse effects, but wanted to call it out all the same.
+Please see #3937 for more details.
+
+### GEPs
+
+#### New Features
+
+In this release, the following major features are moving to the `Standard`
+channel and are now considered generally available:
+
+* [GEP-1897 BackendTLSPolicy] - Configuration of TLS from the Gateway to Backends
+* [GEP-3164 SupportedFeatures] - Status information about the features that an implementation supports.
+
+In this release, we introduced the following new features are moving to the
+`Experimental` channel, for implementations to evaluate:
+
+* [GEP-3949 Mesh Resource] - Mesh-wide configuration and supported features.
+* [GEP-3793 Default Gateways] - Allowing `Gateways` to program some routes by default.
+* [GEP-1494 HTTP External Auth] - Enabling External Auth for `HTTPRoute`.
+
+[GEP-1897 BackendTLSPolicy]:https://github.com/kubernetes-sigs/gateway-api/issues/1897
+[GEP-3164 SupportedFeatures]:https://github.com/kubernetes-sigs/gateway-api/issues/3164
+[GEP-3949 Mesh Resource]:https://github.com/kubernetes-sigs/gateway-api/issues/3949
+[GEP-3793 Default Gateways]:https://github.com/kubernetes-sigs/gateway-api/issues/3793
+[GEP-1494 HTTP External Auth]:https://github.com/kubernetes-sigs/gateway-api/pull/4001
+
+#### Other Iterations
+
+* GEP-1897: standardizing behavior for invalid BackendTLSPolicy by @snorwin in https://github.com/kubernetes-sigs/gateway-api/pull/3909
+* GEP-1897: describe TargetRefs conflict-resolution rules in BackendTLSPolicy by @snorwin in https://github.com/kubernetes-sigs/gateway-api/pull/4048
+* GEP-2627: DNS Configuration - Initial Provisional PR by @maleck13 in https://github.com/kubernetes-sigs/gateway-api/pull/2712
+* GEP-1713: Revisions by @dprotaso in https://github.com/kubernetes-sigs/gateway-api/pull/3744
+* GEP 91: Update Goals and Prior Art by @arkodg in https://github.com/kubernetes-sigs/gateway-api/pull/3838
+* GEP-91: Address connection coalescing security issue - API updates by @kl52752 in #3960 and #3942
+* GEP-1494: Update gRPC Auth config by @youngnick in https://github.com/kubernetes-sigs/gateway-api/pull/4061
+* GEP 3779: East/West Identity-Based Authorization by @LiorLieberman in https://github.com/kubernetes-sigs/gateway-api/pull/3822
+* GEP-3792: Off-Cluster Gateways by @kflynn in https://github.com/kubernetes-sigs/gateway-api/pull/3851
+* GEP-3798: Adding initial Provisional GEP for client ip based session persistence by @arihantg in https://github.com/kubernetes-sigs/gateway-api/pull/3844
+* GEP-696: Update the possible states by @mlavacca in https://github.com/kubernetes-sigs/gateway-api/pull/3901
+* TLSRoute: Require hostnames and bump version to v1alpha3 by @rostislavbobo in https://github.com/kubernetes-sigs/gateway-api/pull/3872
+* TLSRoute: Require hostnames via +required by @rostislavbobo in https://github.com/kubernetes-sigs/gateway-api/pull/3918
+* TLSRoute: Set MaxItems=1 for rules[] in v1alpha3 by @rostislavbobo in https://github.com/kubernetes-sigs/gateway-api/pull/3971
+* Update Auth GEP with Implementable details by @youngnick in https://github.com/kubernetes-sigs/gateway-api/pull/3884
+* add GRPCRouteExtendedFeatures to AllFeatures list by @skriss in https://github.com/kubernetes-sigs/gateway-api/pull/4046
+* Allow preprepared CoreDNS image to be used  by @aaronjwood in https://github.com/kubernetes-sigs/gateway-api/pull/3906
+* Specify SAN validation precedence over Hostname validation by @kl52752 in https://github.com/kubernetes-sigs/gateway-api/pull/4039
+* docs: move GEP-3798 to Deferred for now by @shaneutt in https://github.com/kubernetes-sigs/gateway-api/pull/3947
+
+## Bug or Regression
+
+* The boolean "TrueField" introduced for CORS can cause generator issues by @shaneutt in https://github.com/kubernetes-sigs/gateway-api/issues/3895
+* Mark grpcroutes spec as required by @rikatz in https://github.com/kubernetes-sigs/gateway-api/pull/3937
+
+## Administrative
+
+* chore: remove inactive reviewers by @shaneutt in https://github.com/kubernetes-sigs/gateway-api/pull/3829
+* Adding Lior to Mesh Leads by @robscott in https://github.com/kubernetes-sigs/gateway-api/pull/3877
+
+## Changes by Kind
+
+### API
+
+#### HTTPRoute
+
+In the `Standard` channel, we've [now added] a `Name` field to `HTTPRouteRule`
+and `HTTPRouteMatch`.
+
+[now added]:https://github.com/kubernetes-sigs/gateway-api/issues/995
+
+### Documentation
+
+* Enable dark mode switch on docs by @rikatz in https://github.com/kubernetes-sigs/gateway-api/pull/3977
+* docs: Add v1.3 conformance report table by @snorwin in https://github.com/kubernetes-sigs/gateway-api/pull/3810
+* docs: Update HTTPRoute status example by @jonstacks in https://github.com/kubernetes-sigs/gateway-api/pull/3784
+* Add time extensions to release management doc by @shaneutt in https://github.com/kubernetes-sigs/gateway-api/pull/3943
+* Update implementations.md with removal policy by @youngnick in https://github.com/kubernetes-sigs/gateway-api/pull/3863
+* TLSRoute: Hostnames godoc by @rostislavbobo in https://github.com/kubernetes-sigs/gateway-api/pull/3925
+* Make feature name required for Experimental by @youngnick in https://github.com/kubernetes-sigs/gateway-api/pull/3859
+* Support comparison of response protocol by @zirain in https://github.com/kubernetes-sigs/gateway-api/pull/3986
+* docs: note about expectations when a gep misses a release timeline by @shaneutt in https://github.com/kubernetes-sigs/gateway-api/pull/3866
+
+## CI & Testing
+
+* Enable Kubernetes API Linter by @rikatz in https://github.com/kubernetes-sigs/gateway-api/pull/3917
+* Use envtest for CRD validation tests by @rikatz in https://github.com/kubernetes-sigs/gateway-api/pull/3948
+
+## Conformance Tests
+
+* Add mesh conformance tests structure and a first test by @LiorLieberman in https://github.com/kubernetes-sigs/gateway-api/pull/3729
+* Add mesh conformance tests for httproute redirect(s) by @LiorLieberman in https://github.com/kubernetes-sigs/gateway-api/pull/3777
+* Improve feature name readability in conformance reports by @08volt in https://github.com/kubernetes-sigs/gateway-api/pull/3564
+* conformance: add Hook in ConformanceTestSuite by @zirain in https://github.com/kubernetes-sigs/gateway-api/pull/3786
+* add mesh conformance for request header modifier by @LiorLieberman in https://github.com/kubernetes-sigs/gateway-api/pull/3812
+* add httproute weight based routing mesh conformance tests by @LiorLieberman in https://github.com/kubernetes-sigs/gateway-api/pull/3827
+* Add mesh core conformance tests for httproute same-namespace attachment by @LiorLieberman in https://github.com/kubernetes-sigs/gateway-api/pull/3833
+* add httproute matching conformance mesh by @LiorLieberman in https://github.com/kubernetes-sigs/gateway-api/pull/3831
+* add mesh conformance for httproute-queryparmas-match by @LiorLieberman in https://github.com/kubernetes-sigs/gateway-api/pull/3834
+* fix meshredirectport and schemeredirect mesh conformance features by @LiorLieberman in https://github.com/kubernetes-sigs/gateway-api/pull/3847
+* Add body to http.Request and roundTripper.request to extend conformance testutil ability to send request with body. by @zetxqx in https://github.com/kubernetes-sigs/gateway-api/pull/3853
+* Infer SupportedFeatures in Conformance Tests (GEP-2162) [#3759] by @bexxmodd in https://github.com/kubernetes-sigs/gateway-api/pull/3848
+* Improve distribution tests in conformance for MeshHTTPRouteWeight by @carsontham in https://github.com/kubernetes-sigs/gateway-api/pull/3855
+* feat(conformance): validate implementation flags by @mlavacca in https://github.com/kubernetes-sigs/gateway-api/pull/3715
+* Issue 3138 - Conformance Tests for BackendTLSPolicy - normative by @candita in https://github.com/kubernetes-sigs/gateway-api/pull/3212
+* Fix(conformance report) Add Skip test count in Conformance Report if RunTest is configured. by @zetxqx in https://github.com/kubernetes-sigs/gateway-api/pull/3966
+* Add Conformance test for Invalid BackendTLSPolicy TLS settings by @kl52752 in https://github.com/kubernetes-sigs/gateway-api/pull/3930
+* Improve distribution tests in conformance for HTTPRouteWeight by @carsontham in https://github.com/kubernetes-sigs/gateway-api/pull/3880
+* BackendTLSPolicy conformance tests for observedGeneration bump by @snorwin in https://github.com/kubernetes-sigs/gateway-api/pull/3997
+* conformance: add test for optional address value by @EyalPazz in https://github.com/kubernetes-sigs/gateway-api/pull/3689
+* BackendTLSPolicy conformance tests for ResolvedRefs status condition by @snorwin in https://github.com/kubernetes-sigs/gateway-api/pull/4010
+* conformance: add test to check for proper cors allow-credentials behvior by @EyalPazz in https://github.com/kubernetes-sigs/gateway-api/pull/3990
+* Add Conformance tests for BackendTLSPolicy validating SANs with Type dsnName by @kl52752 in https://github.com/kubernetes-sigs/gateway-api/pull/3983
+* fix conformance test HTTPRouteWeight by @fabian4 in https://github.com/kubernetes-sigs/gateway-api/pull/4038
+* BackendTLSPolicy conformance tests for conflict resolution by @snorwin in https://github.com/kubernetes-sigs/gateway-api/pull/4043
+* Updated a new field on supported features inference from boolean to enum and remove from report. by @bexxmodd in https://github.com/kubernetes-sigs/gateway-api/pull/3885
+* Add GRPCRoute weighted backendRefs test by @sarthyparty in https://github.com/kubernetes-sigs/gateway-api/pull/3962
+
+## Cleanup
+
+* Remove unused dependabot config for Github actions by @FelipeYepez in https://github.com/kubernetes-sigs/gateway-api/pull/3816
+* rm duplicate explanation by @naruse666 in https://github.com/kubernetes-sigs/gateway-api/pull/3780
+* fix: remove misleading description by @snorwin in https://github.com/kubernetes-sigs/gateway-api/pull/3778
+* Fix typo for the file name case type in GEP-2162 doc. by @bexxmodd in https://github.com/kubernetes-sigs/gateway-api/pull/3807
+* fix(gep-1911): remove duplicated header in table by @davinkevin in https://github.com/kubernetes-sigs/gateway-api/pull/3818
+* Fix godoc comment for GatewaySpecAddress by @syw14 in https://github.com/kubernetes-sigs/gateway-api/pull/3845
+* Updated index.md to reflect changes in GEP-2162 by @bexxmodd in https://github.com/kubernetes-sigs/gateway-api/pull/3898
+* GEP-3792 and GEP-3793 title fixes :man_facepalming: by @kflynn in https://github.com/kubernetes-sigs/gateway-api/pull/3870
+* docs: fix typo and add contents about "ngrok Kubernetes Operator" by @Seo-yul in https://github.com/kubernetes-sigs/gateway-api/pull/3874
+* docs: Fix links to nonexistent anchors by @blake in https://github.com/kubernetes-sigs/gateway-api/pull/3862
+* kubecon talk link updated. by @kundan2707 in https://github.com/kubernetes-sigs/gateway-api/pull/3660
+* Fix Godoc for BackendTLSPolicyValidation struct for Hostname field by @mayuka-c in https://github.com/kubernetes-sigs/gateway-api/pull/3923
+* Fix malformed URL typo in index.md by @HaeyoonJo in https://github.com/kubernetes-sigs/gateway-api/pull/3926
+* Lint required optional by @rikatz in https://github.com/kubernetes-sigs/gateway-api/pull/3929
+* Fix Gateway API community meeting schedule documentation by @jgreeer in https://github.com/kubernetes-sigs/gateway-api/pull/3975
+* ListenerSet adjust PortNumber kubebuilder validations by @dprotaso in https://github.com/kubernetes-sigs/gateway-api/pull/3750
+* Fix OpenAPI validations by adding API list markers by @erikgb in https://github.com/kubernetes-sigs/gateway-api/pull/3964
+* fix typo by @maheshrijal in https://github.com/kubernetes-sigs/gateway-api/pull/3976
+* Add gateway class label to generated objects by @howardjohn in https://github.com/kubernetes-sigs/gateway-api/pull/3955
+* Change to ignore Mesh features in GWC instead of erroring out. by @bexxmodd in https://github.com/kubernetes-sigs/gateway-api/pull/3938
+* fix(docs): remove unnecessary array in incorrect example @ gep-1767 by @EyalPazz in https://github.com/kubernetes-sigs/gateway-api/pull/3991
+* Update devguide.md to include docker as a pre-req for verify by @PronomitaDey in https://github.com/kubernetes-sigs/gateway-api/pull/4000
+* Add ResolvedRefs condition for BackendTLSPolicy by @snorwin in https://github.com/kubernetes-sigs/gateway-api/pull/3994
+* Update status fields with clearer definitions by @youngnick in https://github.com/kubernetes-sigs/gateway-api/pull/4008
+* Add API changes for HTTP External Auth by @youngnick in https://github.com/kubernetes-sigs/gateway-api/pull/4001
+* remove http non mesh features from mesh profile by @LiorLieberman in https://github.com/kubernetes-sigs/gateway-api/pull/4029
+* Move BackendTLS configuration to GatewayTLSConfig by @kl52752 in https://github.com/kubernetes-sigs/gateway-api/pull/4009
+* Fix cors cel by @rikatz in https://github.com/kubernetes-sigs/gateway-api/pull/4032
+* simplify BackendTLSPolicy test infrastructure and remove unnecessary code by @snorwin in https://github.com/kubernetes-sigs/gateway-api/pull/4016
+* Upgrade dependencies to K8s 1.34 by @erikgb in https://github.com/kubernetes-sigs/gateway-api/pull/4044
+* chore(build): Clean up excessive warnings from "make generate" by @kflynn in https://github.com/kubernetes-sigs/gateway-api/pull/4045
+* Update release manager role description by @youngnick in https://github.com/kubernetes-sigs/gateway-api/pull/4040
+* Clarify terminology for gateway TLS by @kl52752 in https://github.com/kubernetes-sigs/gateway-api/pull/4036
+* add BackendTLSPolicyExtendedFeatures to AllFeatures list by @snorwin in https://github.com/kubernetes-sigs/gateway-api/pull/4047
+* Fix PortNumber type to support controller-gen by @erikgb in https://github.com/kubernetes-sigs/gateway-api/pull/4049
+* prevent controller-runtime stack traces logger by @aojea in https://github.com/kubernetes-sigs/gateway-api/pull/4054
+* Add new BackendTLSPolicy configuration options to documentation by @08volt in https://github.com/kubernetes-sigs/gateway-api/pull/3563
+* Add default timeout to UDPRoute test and improve logs by @cnvergence in https://github.com/kubernetes-sigs/gateway-api/pull/4027
+* API for default Gateways by @kflynn in https://github.com/kubernetes-sigs/gateway-api/pull/4031
+* Improve some ListenetSet gep descriptions by @rikatz in https://github.com/kubernetes-sigs/gateway-api/pull/3978
+* Update index.md field after moving BackendTLS struct by @kl52752 in https://github.com/kubernetes-sigs/gateway-api/pull/4041
+* concepts/tooling.md: Add Headlamp tool by @illume in https://github.com/kubernetes-sigs/gateway-api/pull/4083
+
+## New Contributors
+
+* @szviagintsev made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3782
+* @jonstacks made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3784
+* @naruse666 made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3780
+* @08volt made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3564
+* @bexxmodd made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3807
+* @davinkevin made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3818
+* @FelipeYepez made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3816
+* @samcrichard made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3775
+* @dawid-nowak made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3813
+* @syw14 made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3845
+* @zetxqx made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3853
+* @arihantg made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3844
+* @Seo-yul made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3874
+* @carsontham made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3855
+* @rostislavbobo made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3872
+* @mayuka-c made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3923
+* @rikatz made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3917
+* @HaeyoonJo made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3926
+* @furykerry made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3968
+* @jgreeer made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3975
+* @erikgb made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3964
+* @maheshrijal made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3976
+* @PronomitaDey made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/4000
+* @idebeijer made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/4018
+* @fabian4 made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/4038
+* @sarthyparty made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3962
+* @aaronjwood made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/3906
+* @illume made their first contribution in https://github.com/kubernetes-sigs/gateway-api/pull/4083
+
+## Full Changelog
+
+**Full Changelog**: https://github.com/kubernetes-sigs/gateway-api/compare/v1.3.0...v1.4.0-rc.1
diff --git a/CHANGELOG/1.4-TEAM.md b/CHANGELOG/1.4-TEAM.md
new file mode 100644
index 00000000..9b639167
--- /dev/null
+++ b/CHANGELOG/1.4-TEAM.md
@@ -0,0 +1,39 @@
+# v1.4 Release Team
+
+Release Manager: @shaneutt
+
+## Standard
+
+| Enhancement | Leads |
+| - | - |
+| [BackendTLSPolicy] | @candita @kl52752 @snorwin  |
+| [SupportedFeatures] | @liorlieberman @bexxmodd |
+| [Name in HTTPRouteRule & HTTPRouteMatch] | @guicassolato |
+
+[BackendTLSPolicy]:https://github.com/kubernetes-sigs/gateway-api/issues/1897
+[SupportedFeatures]:https://github.com/kubernetes-sigs/gateway-api/issues/3164
+[Name in HTTPRouteRule & HTTPRouteMatch]:https://github.com/kubernetes-sigs/gateway-api/issues/995
+
+## Experimental
+
+| Enhancement | Leads |
+| - | - |
+| [Mesh Resource] | @kflynn |
+| [Default Gateways] | @kflynn |
+
+[Mesh Resource]:https://github.com/kubernetes-sigs/gateway-api/issues/3949
+[Default Gateways]:https://github.com/kubernetes-sigs/gateway-api/issues/3793
+
+## Special Iteration
+
+> **Note**: The "special iterations" above indicate items that are either only
+> partially moving forward, were already far along in status, or have some other
+> special circumstance that brought them in scope.
+
+| Enhancement | Leads |
+| - | - |
+| [Gateway/HTTPRoute level authentication] | @youngnick |
+| [Client Certificate Verification for Gateway Listeners] | @arkodg |
+
+[Gateway/HTTPRoute level authentication]:https://github.com/kubernetes-sigs/gateway-api/issues/1494
+[Client Certificate Verification for Gateway Listeners]:https://github.com/kubernetes-sigs/gateway-api/issues/91
diff --git a/Makefile b/Makefile
index 3f2fee41..9c6f7c68 100644
--- a/Makefile
+++ b/Makefile
@@ -60,9 +60,15 @@ CEL_TEST_CRD_CHANNEL ?= standard
 
 all: generate vet fmt verify test
 
+.PHONY: clean-generated
+clean-generated:
+	rm -rf pkg/client/clientset
+	rm -rf pkg/client/listers
+	rm -rf pkg/client/informers
+
 # Run generators for protos, Deepcopy funcs, CRDs, and docs.
 .PHONY: generate
-generate: update-codegen
+generate: clean-generated update-codegen
 
 .PHONY: update-codegen
 update-codegen:
@@ -166,10 +172,13 @@ release-staging: image.multiarch.setup
 
 # Docs
 
+DOCS_BUILD_CONTAINER_NAME ?= gateway-api-mkdocs
+
 .PHONY: build-docs
 build-docs:
 	docker build --pull -t gaie/mkdocs hack/mkdocs/image
-	docker run --rm -v ${PWD}:/docs gaie/mkdocs build
+	docker rm -f $(DOCS_BUILD_CONTAINER_NAME) || true
+	docker run --name $(DOCS_BUILD_CONTAINER_NAME) --rm -v ${PWD}:/docs gaie/mkdocs build
 
 .PHONY: build-docs-netlify
 build-docs-netlify:
@@ -182,6 +191,14 @@ live-docs:
 	docker build -t gw/mkdocs hack/mkdocs/image
 	docker run --rm -it -p 3000:3000 -v ${PWD}:/docs gw/mkdocs
 
+.PHONY: verify-mkdocs-nav
+verify-mkdocs-nav:
+	hack/verify-mkdocs-nav.sh
+
+.PHONY: update-mkdocs-nav
+update-mkdocs-nav:
+	hack/update-mkdocs-nav.sh
+
 .PHONY: api-ref-docs
 api-ref-docs:
 	crd-ref-docs \
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index 207dd1d7..3de45922 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -11,7 +11,6 @@ aliases:
 
   # Reference: https://github.com/kubernetes/org/blob/main/config/kubernetes-sigs/sig-network/teams.yaml
   gateway-api-maintainers:
-    - mlavacca
     - robscott
     - shaneutt
     - youngnick
@@ -21,6 +20,7 @@ aliases:
     - danehans
     - hbagdi
     - jpeach
+    - mlavacca
 
   gateway-api-mesh-leads:
     - howardjohn
@@ -46,3 +46,4 @@ aliases:
     - gcs278
     - kflynn
     - LiorLieberman
+    - rikatz
diff --git a/README.md b/README.md
index e8ebd1ad..e6a7ebad 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ the specification and Custom Resource Definitions (CRDs).
 ## Status
 
 The latest supported version is `v1` as released by
-the [v1.3.0 release][gh_release] of this project.
+the [v1.4.0 release][gh_release] of this project.
 
 This version of the API is has GA level support for the following resources:
 
@@ -71,7 +71,7 @@ Participation in the Kubernetes community is governed by the
 [spec]: https://gateway-api.sigs.k8s.io/reference/spec/
 [concepts]: https://gateway-api.sigs.k8s.io/concepts/api-overview
 [security-model]: https://gateway-api.sigs.k8s.io/concepts/security-model
-[gh_release]: https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.3.0
+[gh_release]: https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.4.0
 [godoc]: https://pkg.go.dev/sigs.k8s.io/gateway-api
 [conformance-docs]: https://gateway-api.sigs.k8s.io/concepts/conformance/
 [reports-readme]: ./conformance/reports/README.md
diff --git a/RELEASE_MANAGEMENT.md b/RELEASE_MANAGEMENT.md
index 78d00208..9734e23e 100644
--- a/RELEASE_MANAGEMENT.md
+++ b/RELEASE_MANAGEMENT.md
@@ -1,13 +1,8 @@
 # Release Management
 
 Major and minor releases for Gateway API are managed by a "Release Manager".
-The responsibilities of the release manager include:
-
-* Creating and managing a GitHub Milestone for the release.
-* Creating and managing a GitHub Project board for the release.
-* Creating and managing a GitHub Discussion Boards announcement for the release.
-  * This includes discussions to handle scoping for each release _channel_ as well.
-* Working through the [Release Cycle](#release-phases) for the release.
+The responsibilities of the release manager are defined in the [Release Manager]
+role definition doc.
 
 This management process ultimately results in the manager of the release
 shipping the release as per the [Release Process]. We will go into more detail
@@ -19,6 +14,7 @@ about this in the sections that follow.
 
 [Release Cycle]:https://gateway-api.sigs.k8s.io/contributing/release-cycle/
 [Release Process]:/RELEASE.md
+[Release Manager]:/roles/RELEASE_MANAGER.md
 
 ## Assigning a Release Manager
 
@@ -91,18 +87,25 @@ cycle is outlined in the [Release Cycle] documentation and should be followed
 according to that.
 
 The release manager is responsible for communicating with the community and
-seeking volunteers for features to be included in the release, and thus the
-release will be considered a **feature release**. If there are few or no
-volunteers the release may simply end being a smaller **maintenance release**.
+seeking volunteers for features to be included in the release.
+
+Each enhancement included in the release must have at least two people
+responsible for it:
 
-> **Note**: Updates on the community sync and discussion boards about the
-> release process should be communicated regularly. We recommend bi-weekly
-> unless there's a clear reason to do more, or less.
+* **Owner**: This is the person who asks for the GEP to be included in the
+  release, and who is primarily responsible for doing the work to make the feature
+  happen.
+* **Shepherd**: This is the person who agrees to be the primary reviewer, and
+  to assist the feature through the GEP review process. Ideally, this person has
+  been a feature owner in the past and has experience with the GEP review process,
+  and can help smooth out any rough patches.
 
-> **Note**: Communicating whether a release is expected to be a **feature
-> release** or a **maintenance release** is largely done via the [Milestone].
-> However, the final GitHub release should also make note of this in the
-> release description.
+The Release Manager is expected to communicate regularly with Owners and Shepherds
+about the progress of their feature.
+
+Additionally, the Release Manager MUST keep the broader community updated on the
+release, including what is currently in scope for the release, and any changes
+or updates. This MUST be done at least weekly.
 
 Release candidates--and the eventual final release--must utilize the [Release
 Process](/RELEASE.md) for delivery.
@@ -116,16 +119,24 @@ final release when it is cut.
 
 ## Time Extensions
 
-Extensions to timelines may be requested by contributors. Our guidelines for
+Extensions to deadlines may be requested by contributors. Our guidelines for
 this are based on the Kubernetes process:
 
 * Extensions can be granted on a per-GEP basis
   * The owners of the GEP have to ask and provide a timeline (measured in
     days) as to when they believe the GEP will be ready for merge.
-* The request and approval for a GEP extension needs to be in public.
+* The request and approval for a GEP extension must be on the original GEP issue.
+* An extension can only be granted for a time period up to the distance from
+  the deadline when the extension is requested. So, an extension of a week
+  must be asked for at least a week out from a deadline, while an extension of
+  day must be asked for at least a day out from the deadline. Extension requests
+  not meeting this timing criteria will be denied.  
 * Extensions can only be granted with a majority agreement by maintainers
-  / release-managers
+  / release-managers.
+
+For our purposes we use GitHub issues, specifically the related GEP issue,
+as the public place for requesting/approving extensions.
 
-For our purposes we use GitHub discussions as the public place for
-requesting/approving extensions. Contributors should use an existing
-discussion for the release when feasible, otherwise create a discussion.
+This extension policy also affects reviews.
+If feedback is submitted sufficiently late that it is impossible to address within these guidelines,
+the feedback (not necessarily the GEP) may be deferred to a future release.
diff --git a/apis/v1/backendtlspolicy_types.go b/apis/v1/backendtlspolicy_types.go
new file mode 100644
index 00000000..5e44936c
--- /dev/null
+++ b/apis/v1/backendtlspolicy_types.go
@@ -0,0 +1,317 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// +genclient
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:storageversion
+// +kubebuilder:resource:categories=gateway-api,shortName=btlspolicy
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+//
+// BackendTLSPolicy is a Direct Attached Policy.
+// +kubebuilder:metadata:labels="gateway.networking.k8s.io/policy=Direct"
+
+// BackendTLSPolicy provides a way to configure how a Gateway
+// connects to a Backend via TLS.
+type BackendTLSPolicy struct {
+	metav1.TypeMeta `json:",inline"`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Spec defines the desired state of BackendTLSPolicy.
+	// +required
+	Spec BackendTLSPolicySpec `json:"spec"`
+
+	// Status defines the current state of BackendTLSPolicy.
+	// +optional
+	Status PolicyStatus `json:"status,omitempty"`
+}
+
+// BackendTLSPolicyList contains a list of BackendTLSPolicies
+// +kubebuilder:object:root=true
+type BackendTLSPolicyList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []BackendTLSPolicy `json:"items"`
+}
+
+// BackendTLSPolicySpec defines the desired state of BackendTLSPolicy.
+//
+// Support: Extended
+type BackendTLSPolicySpec struct {
+	// TargetRefs identifies an API object to apply the policy to.
+	// Only Services have Extended support. Implementations MAY support
+	// additional objects, with Implementation Specific support.
+	// Note that this config applies to the entire referenced resource
+	// by default, but this default may change in the future to provide
+	// a more granular application of the policy.
+	//
+	// TargetRefs must be _distinct_. This means either that:
+	//
+	// * They select different targets. If this is the case, then targetRef
+	//   entries are distinct. In terms of fields, this means that the
+	//   multi-part key defined by `group`, `kind`, and `name` must
+	//   be unique across all targetRef entries in the BackendTLSPolicy.
+	// * They select different sectionNames in the same target.
+	//
+	//
+	// When more than one BackendTLSPolicy selects the same target and
+	// sectionName, implementations MUST determine precedence using the
+	// following criteria, continuing on ties:
+	//
+	// * The older policy by creation timestamp takes precedence. For
+	//   example, a policy with a creation timestamp of "2021-07-15
+	//   01:02:03" MUST be given precedence over a policy with a
+	//   creation timestamp of "2021-07-15 01:02:04".
+	// * The policy appearing first in alphabetical order by {name}.
+	//   For example, a policy named `bar` is given precedence over a
+	//   policy named `baz`.
+	//
+	// For any BackendTLSPolicy that does not take precedence, the
+	// implementation MUST ensure the `Accepted` Condition is set to
+	// `status: False`, with Reason `Conflicted`.
+	//
+	// Support: Extended for Kubernetes Service
+	//
+	// Support: Implementation-specific for any other resource
+	//
+	// +required
+	// +listType=atomic
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=16
+	// +kubebuilder:validation:XValidation:message="sectionName must be specified when targetRefs includes 2 or more references to the same target",rule="self.all(p1, self.all(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName == '') == (!has(p2.sectionName) || p2.sectionName == '')) : true))"
+	// +kubebuilder:validation:XValidation:message="sectionName must be unique when targetRefs includes 2 or more references to the same target",rule="self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName == p2.sectionName))))"
+	TargetRefs []LocalPolicyTargetReferenceWithSectionName `json:"targetRefs"`
+
+	// Validation contains backend TLS validation configuration.
+	// +required
+	Validation BackendTLSPolicyValidation `json:"validation"`
+
+	// Options are a list of key/value pairs to enable extended TLS
+	// configuration for each implementation. For example, configuring the
+	// minimum TLS version or supported cipher suites.
+	//
+	// A set of common keys MAY be defined by the API in the future. To avoid
+	// any ambiguity, implementation-specific definitions MUST use
+	// domain-prefixed names, such as `example.com/my-custom-option`.
+	// Un-prefixed names are reserved for key names defined by Gateway API.
+	//
+	// Support: Implementation-specific
+	//
+	// +optional
+	// +kubebuilder:validation:MaxProperties=16
+	Options map[AnnotationKey]AnnotationValue `json:"options,omitempty"`
+}
+
+// BackendTLSPolicyValidation contains backend TLS validation configuration.
+// +kubebuilder:validation:XValidation:message="must not contain both CACertificateRefs and WellKnownCACertificates",rule="!(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
+// +kubebuilder:validation:XValidation:message="must specify either CACertificateRefs or WellKnownCACertificates",rule="(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
+type BackendTLSPolicyValidation struct {
+	// CACertificateRefs contains one or more references to Kubernetes objects that
+	// contain a PEM-encoded TLS CA certificate bundle, which is used to
+	// validate a TLS handshake between the Gateway and backend Pod.
+	//
+	// If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
+	// specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
+	// not both. If CACertificateRefs is empty or unspecified, the configuration for
+	// WellKnownCACertificates MUST be honored instead if supported by the implementation.
+	//
+	// A CACertificateRef is invalid if:
+	//
+	// * It refers to a resource that cannot be resolved (e.g., the referenced resource
+	//   does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key
+	//   named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`
+	//   and the Message of the Condition must indicate which reference is invalid and why.
+	//
+	// * It refers to an unknown or unsupported kind of resource. In this case, the Reason
+	//   must be set to `InvalidKind` and the Message of the Condition must explain which
+	//   kind of resource is unknown or unsupported.
+	//
+	// * It refers to a resource in another namespace. This may change in future
+	//   spec updates.
+	//
+	// Implementations MAY choose to perform further validation of the certificate
+	// content (e.g., checking expiry or enforcing specific formats). In such cases,
+	// an implementation-specific Reason and Message must be set for the invalid reference.
+	//
+	// In all cases, the implementation MUST ensure the `ResolvedRefs` Condition on
+	// the BackendTLSPolicy is set to `status: False`, with a Reason and Message
+	// that indicate the cause of the error. Connections using an invalid
+	// CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error
+	// response. If ALL CACertificateRefs are invalid, the implementation MUST also
+	// ensure the `Accepted` Condition on the BackendTLSPolicy is set to
+	// `status: False`, with a Reason `NoValidCACertificate`.
+	//
+	//
+	// A single CACertificateRef to a Kubernetes ConfigMap kind has "Core" support.
+	// Implementations MAY choose to support attaching multiple certificates to
+	// a backend, but this behavior is implementation-specific.
+	//
+	// Support: Core - An optional single reference to a Kubernetes ConfigMap,
+	// with the CA certificate in a key named `ca.crt`.
+	//
+	// Support: Implementation-specific - More than one reference, other kinds
+	// of resources, or a single reference that includes multiple certificates.
+	//
+	// +optional
+	// +listType=atomic
+	// +kubebuilder:validation:MaxItems=8
+	CACertificateRefs []LocalObjectReference `json:"caCertificateRefs,omitempty"`
+
+	// WellKnownCACertificates specifies whether system CA certificates may be used in
+	// the TLS handshake between the gateway and backend pod.
+	//
+	// If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
+	// must be specified with at least one entry for a valid configuration. Only one of
+	// CACertificateRefs or WellKnownCACertificates may be specified, not both.
+	// If an implementation does not support the WellKnownCACertificates field, or
+	// the supplied value is not recognized, the implementation MUST ensure the
+	// `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with
+	// a Reason `Invalid`.
+	//
+	// Support: Implementation-specific
+	//
+	// +optional
+	WellKnownCACertificates *WellKnownCACertificatesType `json:"wellKnownCACertificates,omitempty"`
+
+	// Hostname is used for two purposes in the connection between Gateways and
+	// backends:
+	//
+	// 1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
+	// 2. Hostname MUST be used for authentication and MUST match the certificate
+	//    served by the matching backend, unless SubjectAltNames is specified.
+	// 3. If SubjectAltNames are specified, Hostname can be used for certificate selection
+	//    but MUST NOT be used for authentication. If you want to use the value
+	//    of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.
+	//
+	// Support: Core
+	//
+	// +required
+	Hostname PreciseHostname `json:"hostname"`
+
+	// SubjectAltNames contains one or more Subject Alternative Names.
+	// When specified the certificate served from the backend MUST
+	// have at least one Subject Alternate Name matching one of the specified SubjectAltNames.
+	//
+	// Support: Extended
+	//
+	// +optional
+	// +listType=atomic
+	// +kubebuilder:validation:MaxItems=5
+	SubjectAltNames []SubjectAltName `json:"subjectAltNames,omitempty"`
+}
+
+// SubjectAltName represents Subject Alternative Name.
+// +kubebuilder:validation:XValidation:message="SubjectAltName element must contain Hostname, if Type is set to Hostname",rule="!(self.type == \"Hostname\" && (!has(self.hostname) || self.hostname == \"\"))"
+// +kubebuilder:validation:XValidation:message="SubjectAltName element must not contain Hostname, if Type is not set to Hostname",rule="!(self.type != \"Hostname\" && has(self.hostname) && self.hostname != \"\")"
+// +kubebuilder:validation:XValidation:message="SubjectAltName element must contain URI, if Type is set to URI",rule="!(self.type == \"URI\" && (!has(self.uri) || self.uri == \"\"))"
+// +kubebuilder:validation:XValidation:message="SubjectAltName element must not contain URI, if Type is not set to URI",rule="!(self.type != \"URI\" && has(self.uri) && self.uri != \"\")"
+type SubjectAltName struct {
+	// Type determines the format of the Subject Alternative Name. Always required.
+	//
+	// Support: Core
+	//
+	// +required
+	Type SubjectAltNameType `json:"type"`
+
+	// Hostname contains Subject Alternative Name specified in DNS name format.
+	// Required when Type is set to Hostname, ignored otherwise.
+	//
+	// Support: Core
+	//
+	// +optional
+	Hostname Hostname `json:"hostname,omitempty"`
+
+	// URI contains Subject Alternative Name specified in a full URI format.
+	// It MUST include both a scheme (e.g., "http" or "ftp") and a scheme-specific-part.
+	// Common values include SPIFFE IDs like "spiffe://mycluster.example.com/ns/myns/sa/svc1sa".
+	// Required when Type is set to URI, ignored otherwise.
+	//
+	// Support: Core
+	//
+	// +optional
+	URI AbsoluteURI `json:"uri,omitempty"`
+}
+
+// WellKnownCACertificatesType is the type of CA certificate that will be used
+// when the caCertificateRefs field is unspecified.
+// +kubebuilder:validation:Enum=System
+type WellKnownCACertificatesType string
+
+const (
+	// WellKnownCACertificatesSystem indicates that well known system CA certificates should be used.
+	WellKnownCACertificatesSystem WellKnownCACertificatesType = "System"
+)
+
+// SubjectAltNameType is the type of the Subject Alternative Name.
+// +kubebuilder:validation:Enum=Hostname;URI
+type SubjectAltNameType string
+
+const (
+	// HostnameSubjectAltNameType specifies hostname-based SAN.
+	//
+	// Support: Core
+	HostnameSubjectAltNameType SubjectAltNameType = "Hostname"
+
+	// URISubjectAltNameType specifies URI-based SAN, e.g. SPIFFE id.
+	//
+	// Support: Core
+	URISubjectAltNameType SubjectAltNameType = "URI"
+)
+
+const (
+	// This reason is used with the "Accepted" condition when it is
+	// set to false because all CACertificateRefs of the
+	// BackendTLSPolicy are invalid.
+	BackendTLSPolicyReasonNoValidCACertificate PolicyConditionReason = "NoValidCACertificate"
+)
+
+const (
+	// This condition indicates whether the controller was able to resolve all
+	// object references for the BackendTLSPolicy.
+	//
+	// Possible reasons for this condition to be True are:
+	//
+	// * "ResolvedRefs"
+	//
+	// Possible reasons for this condition to be False are:
+	//
+	// * "InvalidCACertificateRef"
+	// * "InvalidKind"
+	//
+	// Controllers may raise this condition with other reasons, but should
+	// prefer to use the reasons listed above to improve interoperability.
+	BackendTLSPolicyConditionResolvedRefs PolicyConditionType = "ResolvedRefs"
+
+	// This reason is used with the "ResolvedRefs" condition when the condition
+	// is true.
+	BackendTLSPolicyReasonResolvedRefs PolicyConditionReason = "ResolvedRefs"
+
+	// This reason is used with the "ResolvedRefs" condition when one of the
+	// BackendTLSPolicy's CACertificateRefs is invalid.
+	// A CACertificateRef is considered invalid when it refers to a nonexistent
+	// resource or when the data within that resource is malformed.
+	BackendTLSPolicyReasonInvalidCACertificateRef PolicyConditionReason = "InvalidCACertificateRef"
+
+	// This reason is used with the "ResolvedRefs" condition when one of the
+	// BackendTLSPolicy's CACertificateRefs references an unknown or unsupported
+	// Group and/or Kind.
+	BackendTLSPolicyReasonInvalidKind PolicyConditionReason = "InvalidKind"
+)
diff --git a/apis/v1/gateway_types.go b/apis/v1/gateway_types.go
index 652101ff..3b856a15 100644
--- a/apis/v1/gateway_types.go
+++ b/apis/v1/gateway_types.go
@@ -246,7 +246,7 @@ type GatewaySpec struct {
 	// Addresses requested for this Gateway. This is optional and behavior can
 	// depend on the implementation. If a value is set in the spec and the
 	// requested address is invalid or unavailable, the implementation MUST
-	// indicate this in the associated entry in GatewayStatus.Addresses.
+	// indicate this in an associated entry in GatewayStatus.Conditions.
 	//
 	// The Addresses field represents a request for the address(es) on the
 	// "outside of the Gateway", that traffic bound for this Gateway will use.
@@ -268,8 +268,8 @@ type GatewaySpec struct {
 	// +listType=atomic
 	// <gateway:validateIPAddress>
 	// +kubebuilder:validation:MaxItems=16
-	// +kubebuilder:validation:XValidation:message="IPAddress values must be unique",rule="self.all(a1, a1.type == 'IPAddress' ? self.exists_one(a2, a2.type == a1.type && a2.value == a1.value) : true )"
-	// +kubebuilder:validation:XValidation:message="Hostname values must be unique",rule="self.all(a1, a1.type == 'Hostname' ? self.exists_one(a2, a2.type == a1.type && a2.value == a1.value) : true )"
+	// +kubebuilder:validation:XValidation:message="IPAddress values must be unique",rule="self.all(a1, a1.type == 'IPAddress' && has(a1.value) ? self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value == a1.value) : true )"
+	// +kubebuilder:validation:XValidation:message="Hostname values must be unique",rule="self.all(a1, a1.type == 'Hostname'  && has(a1.value) ? self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value == a1.value) : true )"
 	Addresses []GatewaySpecAddress `json:"addresses,omitempty"`
 
 	// Infrastructure defines infrastructure level attributes about this Gateway instance.
@@ -294,6 +294,28 @@ type GatewaySpec struct {
 	// +optional
 	// <gateway:experimental>
 	TLS *GatewayTLSConfig `json:"tls,omitempty"`
+
+	// DefaultScope, when set, configures the Gateway as a default Gateway,
+	// meaning it will dynamically and implicitly have Routes (e.g. HTTPRoute)
+	// attached to it, according to the scope configured here.
+	//
+	// If unset (the default) or set to None, the Gateway will not act as a
+	// default Gateway; if set, the Gateway will claim any Route with a
+	// matching scope set in its UseDefaultGateway field, subject to the usual
+	// rules about which routes the Gateway can attach to.
+	//
+	// Think carefully before using this functionality! While the normal rules
+	// about which Route can apply are still enforced, it is simply easier for
+	// the wrong Route to be accidentally attached to this Gateway in this
+	// configuration. If the Gateway operator is not also the operator in
+	// control of the scope (e.g. namespace) with tight controls and checks on
+	// what kind of workloads and Routes get added in that scope, we strongly
+	// recommend not using this just because it seems convenient, and instead
+	// stick to direct Route attachment.
+	//
+	// +optional
+	// <gateway:experimental>
+	DefaultScope GatewayDefaultScope `json:"defaultScope,omitempty"`
 }
 
 // AllowedListeners defines which ListenerSets can be attached to this Gateway.
@@ -781,7 +803,6 @@ type AllowedRoutes struct {
 	// Support: Core
 	//
 	// +optional
-	// +listType=atomic
 	// +kubebuilder:default={from: Same}
 	Namespaces *RouteNamespaces `json:"namespaces,omitempty"`
 
@@ -862,7 +883,7 @@ type RouteGroupKind struct {
 
 // GatewaySpecAddress describes an address that can be bound to a Gateway.
 //
-// +kubebuilder:validation:XValidation:message="Hostname value must only contain valid characters (matching ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)",rule="self.type == 'Hostname' ? self.value.matches(r\"\"\"^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\"\"\"): true"
+// +kubebuilder:validation:XValidation:message="Hostname value must be empty or contain only valid characters (matching ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)",rule="self.type == 'Hostname' ? (!has(self.value) || self.value.matches(r\"\"\"^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\"\"\")): true"
 type GatewaySpecAddress struct {
 	// Type of the address.
 	//
diff --git a/apis/v1/gatewayclass_types.go b/apis/v1/gatewayclass_types.go
index f9b779c7..972d3504 100644
--- a/apis/v1/gatewayclass_types.go
+++ b/apis/v1/gatewayclass_types.go
@@ -304,7 +304,6 @@ type GatewayClassStatus struct {
 	// +optional
 	// +listType=map
 	// +listMapKey=name
-	// <gateway:experimental>
 	// +kubebuilder:validation:MaxItems=64
 	SupportedFeatures []SupportedFeature `json:"supportedFeatures,omitempty"`
 }
diff --git a/apis/v1/httproute_types.go b/apis/v1/httproute_types.go
index 5dad01e0..334245dd 100644
--- a/apis/v1/httproute_types.go
+++ b/apis/v1/httproute_types.go
@@ -1270,7 +1270,7 @@ type HTTPRequestRedirectFilter struct {
 	//
 	// +optional
 	// +kubebuilder:default=302
-	// +kubebuilder:validation:Enum=301;302
+	// +kubebuilder:validation:Enum=301;302;303;307;308
 	StatusCode *int `json:"statusCode,omitempty"`
 }
 
@@ -1665,19 +1665,13 @@ type GRPCAuthConfig struct {
 	// AllowedRequestHeaders specifies what headers from the client request
 	// will be sent to the authorization server.
 	//
-	// If this list is empty, then the following headers must be sent:
-	//
-	// - `Authorization`
-	// - `Location`
-	// - `Proxy-Authenticate`
-	// - `Set-Cookie`
-	// - `WWW-Authenticate`
+	// If this list is empty, then all headers must be sent.
 	//
 	// If the list has entries, only those entries must be sent.
 	//
 	// +optional
 	// +listType=set
-	// +kubebuilder:validation:MaxLength=64
+	// +kubebuilder:validation:MaxItems=64
 	AllowedRequestHeaders []string `json:"allowedHeaders,omitempty"`
 }
 
@@ -1725,7 +1719,7 @@ type HTTPAuthConfig struct {
 	//
 	// +optional
 	// +listType=set
-	// +kubebuilder:validation:MaxLength=64
+	// +kubebuilder:validation:MaxItems=64
 	AllowedRequestHeaders []string `json:"allowedHeaders,omitempty"`
 
 	// AllowedResponseHeaders specifies what headers from the authorization response
@@ -1736,7 +1730,7 @@ type HTTPAuthConfig struct {
 	//
 	// +optional
 	// +listType=set
-	// +kubebuilder:validation:MaxLength=64
+	// +kubebuilder:validation:MaxItems=64
 	AllowedResponseHeaders []string `json:"allowedResponseHeaders,omitempty"`
 }
 
diff --git a/apis/v1/policy_types.go b/apis/v1/policy_types.go
new file mode 100644
index 00000000..552db9bf
--- /dev/null
+++ b/apis/v1/policy_types.go
@@ -0,0 +1,279 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+const (
+	// PolicyLabelKey is the label whose presence identifies a CRD that the
+	// Gateway API Policy attachment model. The value of the label SHOULD be one
+	// of the following:
+	//  - A label value of "Inherited" indicates that this Policy is inheritable.
+	//    An example of inheritable policy is one which if applied at the Gateway
+	//    level would affect all attached HTTPRoutes and their respective
+	//    Backends.
+	//  - A label value of "Direct" indicates that the policy only affects the
+	//    resource to which it is attached and does not affect it's sub resources.
+	PolicyLabelKey = "gateway.networking.k8s.io/policy"
+)
+
+// LocalPolicyTargetReference identifies an API object to apply a direct or
+// inherited policy to. This should be used as part of Policy resources
+// that can target Gateway API resources. For more information on how this
+// policy attachment model works, and a sample Policy resource, refer to
+// the policy attachment documentation for Gateway API.
+type LocalPolicyTargetReference struct {
+	// Group is the group of the target resource.
+	// +required
+	Group Group `json:"group"`
+
+	// Kind is kind of the target resource.
+	// +required
+	Kind Kind `json:"kind"`
+
+	// Name is the name of the target resource.
+	// +required
+	Name ObjectName `json:"name"`
+}
+
+// NamespacedPolicyTargetReference identifies an API object to apply a direct or
+// inherited policy to, potentially in a different namespace. This should only
+// be used as part of Policy resources that need to be able to target resources
+// in different namespaces. For more information on how this policy attachment
+// model works, and a sample Policy resource, refer to the policy attachment
+// documentation for Gateway API.
+type NamespacedPolicyTargetReference struct {
+	// Group is the group of the target resource.
+	// +required
+	Group Group `json:"group"`
+
+	// Kind is kind of the target resource.
+	// +required
+	Kind Kind `json:"kind"`
+
+	// Name is the name of the target resource.
+	// +required
+	Name ObjectName `json:"name"`
+
+	// Namespace is the namespace of the referent. When unspecified, the local
+	// namespace is inferred. Even when policy targets a resource in a different
+	// namespace, it MUST only apply to traffic originating from the same
+	// namespace as the policy.
+	//
+	// +optional
+	Namespace *Namespace `json:"namespace,omitempty"`
+}
+
+// LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a
+// direct policy to. This should be used as part of Policy resources that can
+// target single resources. For more information on how this policy attachment
+// mode works, and a sample Policy resource, refer to the policy attachment
+// documentation for Gateway API.
+//
+// Note: This should only be used for direct policy attachment when references
+// to SectionName are actually needed. In all other cases,
+// LocalPolicyTargetReference should be used.
+type LocalPolicyTargetReferenceWithSectionName struct {
+	LocalPolicyTargetReference `json:",inline"`
+
+	// SectionName is the name of a section within the target resource. When
+	// unspecified, this targetRef targets the entire resource. In the following
+	// resources, SectionName is interpreted as the following:
+	//
+	// * Gateway: Listener name
+	// * HTTPRoute: HTTPRouteRule name
+	// * Service: Port name
+	//
+	// If a SectionName is specified, but does not exist on the targeted object,
+	// the Policy must fail to attach, and the policy implementation should record
+	// a `ResolvedRefs` or similar Condition in the Policy's status.
+	//
+	// +optional
+	SectionName *SectionName `json:"sectionName,omitempty"`
+}
+
+// PolicyConditionType is a type of condition for a policy. This type should be
+// used with a Policy resource Status.Conditions field.
+type PolicyConditionType string
+
+// PolicyConditionReason is a reason for a policy condition.
+type PolicyConditionReason string
+
+const (
+	// PolicyConditionAccepted indicates whether the policy has been accepted or
+	// rejected by a targeted resource, and why.
+	//
+	// Possible reasons for this condition to be True are:
+	//
+	// * "Accepted"
+	//
+	// Possible reasons for this condition to be False are:
+	//
+	// * "Conflicted"
+	// * "Invalid"
+	// * "TargetNotFound"
+	//
+	PolicyConditionAccepted PolicyConditionType = "Accepted"
+
+	// PolicyReasonAccepted is used with the "Accepted" condition when the policy
+	// has been accepted by the targeted resource.
+	PolicyReasonAccepted PolicyConditionReason = "Accepted"
+
+	// PolicyReasonConflicted is used with the "Accepted" condition when the
+	// policy has not been accepted by a targeted resource because there is
+	// another policy that targets the same resource and a merge is not possible.
+	PolicyReasonConflicted PolicyConditionReason = "Conflicted"
+
+	// PolicyReasonInvalid is used with the "Accepted" condition when the policy
+	// is syntactically or semantically invalid.
+	PolicyReasonInvalid PolicyConditionReason = "Invalid"
+
+	// PolicyReasonTargetNotFound is used with the "Accepted" condition when the
+	// policy is attached to an invalid target resource.
+	PolicyReasonTargetNotFound PolicyConditionReason = "TargetNotFound"
+)
+
+// PolicyAncestorStatus describes the status of a route with respect to an
+// associated Ancestor.
+//
+// Ancestors refer to objects that are either the Target of a policy or above it
+// in terms of object hierarchy. For example, if a policy targets a Service, the
+// Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
+// the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
+// useful object to place Policy status on, so we recommend that implementations
+// SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
+// have a _very_ good reason otherwise.
+//
+// In the context of policy attachment, the Ancestor is used to distinguish which
+// resource results in a distinct application of this policy. For example, if a policy
+// targets a Service, it may have a distinct result per attached Gateway.
+//
+// Policies targeting the same resource may have different effects depending on the
+// ancestors of those resources. For example, different Gateways targeting the same
+// Service may have different capabilities, especially if they have different underlying
+// implementations.
+//
+// For example, in BackendTLSPolicy, the Policy attaches to a Service that is
+// used as a backend in a HTTPRoute that is itself attached to a Gateway.
+// In this case, the relevant object for status is the Gateway, and that is the
+// ancestor object referred to in this status.
+//
+// Note that a parent is also an ancestor, so for objects where the parent is the
+// relevant object for status, this struct SHOULD still be used.
+//
+// This struct is intended to be used in a slice that's effectively a map,
+// with a composite key made up of the AncestorRef and the ControllerName.
+type PolicyAncestorStatus struct {
+	// AncestorRef corresponds with a ParentRef in the spec that this
+	// PolicyAncestorStatus struct describes the status of.
+	// +required
+	AncestorRef ParentReference `json:"ancestorRef"`
+
+	// ControllerName is a domain/path string that indicates the name of the
+	// controller that wrote this status. This corresponds with the
+	// controllerName field on GatewayClass.
+	//
+	// Example: "example.net/gateway-controller".
+	//
+	// The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+	// valid Kubernetes names
+	// (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+	//
+	// Controllers MUST populate this field when writing status. Controllers should ensure that
+	// entries to status populated with their ControllerName are cleaned up when they are no
+	// longer necessary.
+	// +required
+	ControllerName GatewayController `json:"controllerName"`
+
+	// Conditions describes the status of the Policy with respect to the given Ancestor.
+	//
+	// <gateway:util:excludeFromCRD>
+	//
+	// Notes for implementors:
+	//
+	// Conditions are a listType `map`, which means that they function like a
+	// map with a key of the `type` field _in the k8s apiserver_.
+	//
+	// This means that implementations must obey some rules when updating this
+	// section.
+	//
+	// * Implementations MUST perform a read-modify-write cycle on this field
+	//   before modifying it. That is, when modifying this field, implementations
+	//   must be confident they have fetched the most recent version of this field,
+	//   and ensure that changes they make are on that recent version.
+	// * Implementations MUST NOT remove or reorder Conditions that they are not
+	//   directly responsible for. For example, if an implementation sees a Condition
+	//   with type `special.io/SomeField`, it MUST NOT remove, change or update that
+	//   Condition.
+	// * Implementations MUST always _merge_ changes into Conditions of the same Type,
+	//   rather than creating more than one Condition of the same Type.
+	// * Implementations MUST always update the `observedGeneration` field of the
+	//   Condition to the `metadata.generation` of the Gateway at the time of update creation.
+	// * If the `observedGeneration` of a Condition is _greater than_ the value the
+	//   implementation knows about, then it MUST NOT perform the update on that Condition,
+	//   but must wait for a future reconciliation and status update. (The assumption is that
+	//   the implementation's copy of the object is stale and an update will be re-triggered
+	//   if relevant.)
+	//
+	// </gateway:util:excludeFromCRD>
+	//
+	// +required
+	// +listType=map
+	// +listMapKey=type
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=8
+	Conditions []metav1.Condition `json:"conditions,omitempty"`
+}
+
+// PolicyStatus defines the common attributes that all Policies should include within
+// their status.
+type PolicyStatus struct {
+	// Ancestors is a list of ancestor resources (usually Gateways) that are
+	// associated with the policy, and the status of the policy with respect to
+	// each ancestor. When this policy attaches to a parent, the controller that
+	// manages the parent and the ancestors MUST add an entry to this list when
+	// the controller first sees the policy and SHOULD update the entry as
+	// appropriate when the relevant ancestor is modified.
+	//
+	// Note that choosing the relevant ancestor is left to the Policy designers;
+	// an important part of Policy design is designing the right object level at
+	// which to namespace this status.
+	//
+	// Note also that implementations MUST ONLY populate ancestor status for
+	// the Ancestor resources they are responsible for. Implementations MUST
+	// use the ControllerName field to uniquely identify the entries in this list
+	// that they are responsible for.
+	//
+	// Note that to achieve this, the list of PolicyAncestorStatus structs
+	// MUST be treated as a map with a composite key, made up of the AncestorRef
+	// and ControllerName fields combined.
+	//
+	// A maximum of 16 ancestors will be represented in this list. An empty list
+	// means the Policy is not relevant for any ancestors.
+	//
+	// If this slice is full, implementations MUST NOT add further entries.
+	// Instead they MUST consider the policy unimplementable and signal that
+	// on any related resources such as the ancestor that would be referenced
+	// here. For example, if this list was full on BackendTLSPolicy, no
+	// additional Gateways would be able to reference the Service targeted by
+	// the BackendTLSPolicy.
+	//
+	// +required
+	// +listType=atomic
+	// +kubebuilder:validation:MaxItems=16
+	Ancestors []PolicyAncestorStatus `json:"ancestors"`
+}
diff --git a/apis/v1/shared_types.go b/apis/v1/shared_types.go
index 99299acd..eb880683 100644
--- a/apis/v1/shared_types.go
+++ b/apis/v1/shared_types.go
@@ -155,6 +155,25 @@ type ParentReference struct {
 	Port *PortNumber `json:"port,omitempty"`
 }
 
+// GatewayDefaultScope defines the set of default scopes that a Gateway
+// can claim, for use in any Route type. At present the only supported
+// scopes are "All" and "None". "None" is a special scope which
+// explicitly means that the Route MUST NOT attached to any default
+// Gateway.
+//
+// +kubebuilder:validation:Enum=All;None
+type GatewayDefaultScope string
+
+const (
+	// GatewayDefaultScopeAll indicates that a Gateway can claim absolutely
+	// any Route asking for a default Gateway.
+	GatewayDefaultScopeAll GatewayDefaultScope = "All"
+
+	// GatewayDefaultScopeNone indicates that a Gateway MUST NOT claim
+	// any Route asking for a default Gateway.
+	GatewayDefaultScopeNone GatewayDefaultScope = "None"
+)
+
 // CommonRouteSpec defines the common attributes that all Routes MUST include
 // within their spec.
 type CommonRouteSpec struct {
@@ -229,10 +248,27 @@ type CommonRouteSpec struct {
 	// <gateway:experimental:validation:XValidation:message="sectionName or port must be specified when parentRefs includes 2 or more references to the same parent",rule="self.all(p1, self.all(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName) || p1.sectionName == '') == (!has(p2.sectionName) || p2.sectionName == '') && (!has(p1.port) || p1.port == 0) == (!has(p2.port) || p2.port == 0)): true))">
 	// <gateway:experimental:validation:XValidation:message="sectionName or port must be unique when parentRefs includes 2 or more references to the same parent",rule="self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port) || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port == p2.port))))">
 	ParentRefs []ParentReference `json:"parentRefs,omitempty"`
+
+	// UseDefaultGateways indicates the default Gateway scope to use for this
+	// Route. If unset (the default) or set to None, the Route will not be
+	// attached to any default Gateway; if set, it will be attached to any
+	// default Gateway supporting the named scope, subject to the usual rules
+	// about which Routes a Gateway is allowed to claim.
+	//
+	// Think carefully before using this functionality! The set of default
+	// Gateways supporting the requested scope can change over time without
+	// any notice to the Route author, and in many situations it will not be
+	// appropriate to request a default Gateway for a given Route -- for
+	// example, a Route with specific security requirements should almost
+	// certainly not use a default Gateway.
+	//
+	// +optional
+	// <gateway:experimental>
+	UseDefaultGateways GatewayDefaultScope `json:"useDefaultGateways,omitempty"`
 }
 
 // PortNumber defines a network port.
-type PortNumber int32
+type PortNumber = int32
 
 // BackendRef defines how a Route should forward a request to a Kubernetes
 // resource.
diff --git a/apis/v1/zz_generated.deepcopy.go b/apis/v1/zz_generated.deepcopy.go
index be8e2485..174c2927 100644
--- a/apis/v1/zz_generated.deepcopy.go
+++ b/apis/v1/zz_generated.deepcopy.go
@@ -128,6 +128,125 @@ func (in *BackendRef) DeepCopy() *BackendRef {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BackendTLSPolicy) DeepCopyInto(out *BackendTLSPolicy) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendTLSPolicy.
+func (in *BackendTLSPolicy) DeepCopy() *BackendTLSPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(BackendTLSPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *BackendTLSPolicy) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BackendTLSPolicyList) DeepCopyInto(out *BackendTLSPolicyList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]BackendTLSPolicy, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendTLSPolicyList.
+func (in *BackendTLSPolicyList) DeepCopy() *BackendTLSPolicyList {
+	if in == nil {
+		return nil
+	}
+	out := new(BackendTLSPolicyList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *BackendTLSPolicyList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BackendTLSPolicySpec) DeepCopyInto(out *BackendTLSPolicySpec) {
+	*out = *in
+	if in.TargetRefs != nil {
+		in, out := &in.TargetRefs, &out.TargetRefs
+		*out = make([]LocalPolicyTargetReferenceWithSectionName, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	in.Validation.DeepCopyInto(&out.Validation)
+	if in.Options != nil {
+		in, out := &in.Options, &out.Options
+		*out = make(map[AnnotationKey]AnnotationValue, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendTLSPolicySpec.
+func (in *BackendTLSPolicySpec) DeepCopy() *BackendTLSPolicySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(BackendTLSPolicySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BackendTLSPolicyValidation) DeepCopyInto(out *BackendTLSPolicyValidation) {
+	*out = *in
+	if in.CACertificateRefs != nil {
+		in, out := &in.CACertificateRefs, &out.CACertificateRefs
+		*out = make([]LocalObjectReference, len(*in))
+		copy(*out, *in)
+	}
+	if in.WellKnownCACertificates != nil {
+		in, out := &in.WellKnownCACertificates, &out.WellKnownCACertificates
+		*out = new(WellKnownCACertificatesType)
+		**out = **in
+	}
+	if in.SubjectAltNames != nil {
+		in, out := &in.SubjectAltNames, &out.SubjectAltNames
+		*out = make([]SubjectAltName, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendTLSPolicyValidation.
+func (in *BackendTLSPolicyValidation) DeepCopy() *BackendTLSPolicyValidation {
+	if in == nil {
+		return nil
+	}
+	out := new(BackendTLSPolicyValidation)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CommonRouteSpec) DeepCopyInto(out *CommonRouteSpec) {
 	*out = *in
@@ -1724,6 +1843,62 @@ func (in *LocalParametersReference) DeepCopy() *LocalParametersReference {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LocalPolicyTargetReference) DeepCopyInto(out *LocalPolicyTargetReference) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalPolicyTargetReference.
+func (in *LocalPolicyTargetReference) DeepCopy() *LocalPolicyTargetReference {
+	if in == nil {
+		return nil
+	}
+	out := new(LocalPolicyTargetReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LocalPolicyTargetReferenceWithSectionName) DeepCopyInto(out *LocalPolicyTargetReferenceWithSectionName) {
+	*out = *in
+	out.LocalPolicyTargetReference = in.LocalPolicyTargetReference
+	if in.SectionName != nil {
+		in, out := &in.SectionName, &out.SectionName
+		*out = new(SectionName)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalPolicyTargetReferenceWithSectionName.
+func (in *LocalPolicyTargetReferenceWithSectionName) DeepCopy() *LocalPolicyTargetReferenceWithSectionName {
+	if in == nil {
+		return nil
+	}
+	out := new(LocalPolicyTargetReferenceWithSectionName)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NamespacedPolicyTargetReference) DeepCopyInto(out *NamespacedPolicyTargetReference) {
+	*out = *in
+	if in.Namespace != nil {
+		in, out := &in.Namespace, &out.Namespace
+		*out = new(Namespace)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamespacedPolicyTargetReference.
+func (in *NamespacedPolicyTargetReference) DeepCopy() *NamespacedPolicyTargetReference {
+	if in == nil {
+		return nil
+	}
+	out := new(NamespacedPolicyTargetReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ObjectReference) DeepCopyInto(out *ObjectReference) {
 	*out = *in
@@ -1804,6 +1979,51 @@ func (in *ParentReference) DeepCopy() *ParentReference {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PolicyAncestorStatus) DeepCopyInto(out *PolicyAncestorStatus) {
+	*out = *in
+	in.AncestorRef.DeepCopyInto(&out.AncestorRef)
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]metav1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyAncestorStatus.
+func (in *PolicyAncestorStatus) DeepCopy() *PolicyAncestorStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(PolicyAncestorStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PolicyStatus) DeepCopyInto(out *PolicyStatus) {
+	*out = *in
+	if in.Ancestors != nil {
+		in, out := &in.Ancestors, &out.Ancestors
+		*out = make([]PolicyAncestorStatus, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyStatus.
+func (in *PolicyStatus) DeepCopy() *PolicyStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(PolicyStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *RouteGroupKind) DeepCopyInto(out *RouteGroupKind) {
 	*out = *in
@@ -1964,6 +2184,21 @@ func (in *SessionPersistence) DeepCopy() *SessionPersistence {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SubjectAltName) DeepCopyInto(out *SubjectAltName) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SubjectAltName.
+func (in *SubjectAltName) DeepCopy() *SubjectAltName {
+	if in == nil {
+		return nil
+	}
+	out := new(SubjectAltName)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *SupportedFeature) DeepCopyInto(out *SupportedFeature) {
 	*out = *in
diff --git a/apis/v1/zz_generated.register.go b/apis/v1/zz_generated.register.go
index 115de0a1..1f390588 100644
--- a/apis/v1/zz_generated.register.go
+++ b/apis/v1/zz_generated.register.go
@@ -61,6 +61,8 @@ func init() {
 // Adds the list of known types to Scheme.
 func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
+		&BackendTLSPolicy{},
+		&BackendTLSPolicyList{},
 		&GRPCRoute{},
 		&GRPCRouteList{},
 		&Gateway{},
diff --git a/apis/v1alpha2/object_reference_types.go b/apis/v1alpha2/object_reference_types.go
index 13ae680c..3dea734b 100644
--- a/apis/v1alpha2/object_reference_types.go
+++ b/apis/v1alpha2/object_reference_types.go
@@ -18,43 +18,8 @@ package v1alpha2
 
 import v1 "sigs.k8s.io/gateway-api/apis/v1"
 
-// LocalObjectReference identifies an API object within the namespace of the
-// referrer.
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-//
-// References to objects with invalid Group and Kind are not valid, and must
-// be rejected by the implementation, with appropriate Conditions set
-// on the containing object.
-// +k8s:deepcopy-gen=false
 type LocalObjectReference = v1.LocalObjectReference
 
-// SecretObjectReference identifies an API object including its namespace,
-// defaulting to Secret.
-//
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-//
-// References to objects with invalid Group and Kind are not valid, and must
-// be rejected by the implementation, with appropriate Conditions set
-// on the containing object.
-// +k8s:deepcopy-gen=false
 type SecretObjectReference = v1.SecretObjectReference
 
-// BackendObjectReference defines how an ObjectReference that is
-// specific to BackendRef. It includes a few additional fields and features
-// than a regular ObjectReference.
-//
-// Note that when a namespace different than the local namespace is specified, a
-// ReferenceGrant object is required in the referent namespace to allow that
-// namespace's owner to accept the reference. See the ReferenceGrant
-// documentation for details.
-//
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-//
-// References to objects with invalid Group and Kind are not valid, and must
-// be rejected by the implementation, with appropriate Conditions set
-// on the containing object.
-// +k8s:deepcopy-gen=false
 type BackendObjectReference = v1.BackendObjectReference
diff --git a/apis/v1alpha2/policy_types.go b/apis/v1alpha2/policy_types.go
index d24bb2ee..8b8181a3 100644
--- a/apis/v1alpha2/policy_types.go
+++ b/apis/v1alpha2/policy_types.go
@@ -16,264 +16,18 @@ limitations under the License.
 
 package v1alpha2
 
-import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+import v1 "sigs.k8s.io/gateway-api/apis/v1"
 
-const (
-	// PolicyLabelKey is the label whose presence identifies a CRD that the
-	// Gateway API Policy attachment model. The value of the label SHOULD be one
-	// of the following:
-	//  - A label value of "Inherited" indicates that this Policy is inheritable.
-	//    An example of inheritable policy is one which if applied at the Gateway
-	//    level would affect all attached HTTPRoutes and their respective
-	//    Backends.
-	//  - A label value of "Direct" indicates that the policy only affects the
-	//    resource to which it is attached and does not affect it's sub resources.
-	PolicyLabelKey = "gateway.networking.k8s.io/policy"
-)
+type LocalPolicyTargetReference v1.LocalPolicyTargetReference
 
-// LocalPolicyTargetReference identifies an API object to apply a direct or
-// inherited policy to. This should be used as part of Policy resources
-// that can target Gateway API resources. For more information on how this
-// policy attachment model works, and a sample Policy resource, refer to
-// the policy attachment documentation for Gateway API.
-type LocalPolicyTargetReference struct {
-	// Group is the group of the target resource.
-	// +required
-	Group Group `json:"group"`
+type NamespacedPolicyTargetReference v1.NamespacedPolicyTargetReference
 
-	// Kind is kind of the target resource.
-	// +required
-	Kind Kind `json:"kind"`
+type LocalPolicyTargetReferenceWithSectionName v1.LocalPolicyTargetReferenceWithSectionName
 
-	// Name is the name of the target resource.
-	// +required
-	Name ObjectName `json:"name"`
-}
+type PolicyConditionType v1.PolicyConditionType
 
-// NamespacedPolicyTargetReference identifies an API object to apply a direct or
-// inherited policy to, potentially in a different namespace. This should only
-// be used as part of Policy resources that need to be able to target resources
-// in different namespaces. For more information on how this policy attachment
-// model works, and a sample Policy resource, refer to the policy attachment
-// documentation for Gateway API.
-type NamespacedPolicyTargetReference struct {
-	// Group is the group of the target resource.
-	// +required
-	Group Group `json:"group"`
+type PolicyConditionReason v1.PolicyConditionReason
 
-	// Kind is kind of the target resource.
-	// +required
-	Kind Kind `json:"kind"`
+type PolicyAncestorStatus v1.PolicyAncestorStatus
 
-	// Name is the name of the target resource.
-	// +required
-	Name ObjectName `json:"name"`
-
-	// Namespace is the namespace of the referent. When unspecified, the local
-	// namespace is inferred. Even when policy targets a resource in a different
-	// namespace, it MUST only apply to traffic originating from the same
-	// namespace as the policy.
-	//
-	// +optional
-	Namespace *Namespace `json:"namespace,omitempty"`
-}
-
-// LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a
-// direct policy to. This should be used as part of Policy resources that can
-// target single resources. For more information on how this policy attachment
-// mode works, and a sample Policy resource, refer to the policy attachment
-// documentation for Gateway API.
-//
-// Note: This should only be used for direct policy attachment when references
-// to SectionName are actually needed. In all other cases,
-// LocalPolicyTargetReference should be used.
-type LocalPolicyTargetReferenceWithSectionName struct {
-	LocalPolicyTargetReference `json:",inline"`
-
-	// SectionName is the name of a section within the target resource. When
-	// unspecified, this targetRef targets the entire resource. In the following
-	// resources, SectionName is interpreted as the following:
-	//
-	// * Gateway: Listener name
-	// * HTTPRoute: HTTPRouteRule name
-	// * Service: Port name
-	//
-	// If a SectionName is specified, but does not exist on the targeted object,
-	// the Policy must fail to attach, and the policy implementation should record
-	// a `ResolvedRefs` or similar Condition in the Policy's status.
-	//
-	// +optional
-	SectionName *SectionName `json:"sectionName,omitempty"`
-}
-
-// PolicyConditionType is a type of condition for a policy. This type should be
-// used with a Policy resource Status.Conditions field.
-type PolicyConditionType string
-
-// PolicyConditionReason is a reason for a policy condition.
-type PolicyConditionReason string
-
-const (
-	// PolicyConditionAccepted indicates whether the policy has been accepted or
-	// rejected by a targeted resource, and why.
-	//
-	// Possible reasons for this condition to be True are:
-	//
-	// * "Accepted"
-	//
-	// Possible reasons for this condition to be False are:
-	//
-	// * "Conflicted"
-	// * "Invalid"
-	// * "TargetNotFound"
-	//
-	PolicyConditionAccepted PolicyConditionType = "Accepted"
-
-	// PolicyReasonAccepted is used with the "Accepted" condition when the policy
-	// has been accepted by the targeted resource.
-	PolicyReasonAccepted PolicyConditionReason = "Accepted"
-
-	// PolicyReasonConflicted is used with the "Accepted" condition when the
-	// policy has not been accepted by a targeted resource because there is
-	// another policy that targets the same resource and a merge is not possible.
-	PolicyReasonConflicted PolicyConditionReason = "Conflicted"
-
-	// PolicyReasonInvalid is used with the "Accepted" condition when the policy
-	// is syntactically or semantically invalid.
-	PolicyReasonInvalid PolicyConditionReason = "Invalid"
-
-	// PolicyReasonTargetNotFound is used with the "Accepted" condition when the
-	// policy is attached to an invalid target resource.
-	PolicyReasonTargetNotFound PolicyConditionReason = "TargetNotFound"
-)
-
-// PolicyAncestorStatus describes the status of a route with respect to an
-// associated Ancestor.
-//
-// Ancestors refer to objects that are either the Target of a policy or above it
-// in terms of object hierarchy. For example, if a policy targets a Service, the
-// Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
-// the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
-// useful object to place Policy status on, so we recommend that implementations
-// SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
-// have a _very_ good reason otherwise.
-//
-// In the context of policy attachment, the Ancestor is used to distinguish which
-// resource results in a distinct application of this policy. For example, if a policy
-// targets a Service, it may have a distinct result per attached Gateway.
-//
-// Policies targeting the same resource may have different effects depending on the
-// ancestors of those resources. For example, different Gateways targeting the same
-// Service may have different capabilities, especially if they have different underlying
-// implementations.
-//
-// For example, in BackendTLSPolicy, the Policy attaches to a Service that is
-// used as a backend in a HTTPRoute that is itself attached to a Gateway.
-// In this case, the relevant object for status is the Gateway, and that is the
-// ancestor object referred to in this status.
-//
-// Note that a parent is also an ancestor, so for objects where the parent is the
-// relevant object for status, this struct SHOULD still be used.
-//
-// This struct is intended to be used in a slice that's effectively a map,
-// with a composite key made up of the AncestorRef and the ControllerName.
-type PolicyAncestorStatus struct {
-	// AncestorRef corresponds with a ParentRef in the spec that this
-	// PolicyAncestorStatus struct describes the status of.
-	// +required
-	AncestorRef ParentReference `json:"ancestorRef"`
-
-	// ControllerName is a domain/path string that indicates the name of the
-	// controller that wrote this status. This corresponds with the
-	// controllerName field on GatewayClass.
-	//
-	// Example: "example.net/gateway-controller".
-	//
-	// The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
-	// valid Kubernetes names
-	// (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
-	//
-	// Controllers MUST populate this field when writing status. Controllers should ensure that
-	// entries to status populated with their ControllerName are cleaned up when they are no
-	// longer necessary.
-	// +required
-	ControllerName GatewayController `json:"controllerName"`
-
-	// Conditions describes the status of the Policy with respect to the given Ancestor.
-	//
-	// <gateway:util:excludeFromCRD>
-	//
-	// Notes for implementors:
-	//
-	// Conditions are a listType `map`, which means that they function like a
-	// map with a key of the `type` field _in the k8s apiserver_.
-	//
-	// This means that implementations must obey some rules when updating this
-	// section.
-	//
-	// * Implementations MUST perform a read-modify-write cycle on this field
-	//   before modifying it. That is, when modifying this field, implementations
-	//   must be confident they have fetched the most recent version of this field,
-	//   and ensure that changes they make are on that recent version.
-	// * Implementations MUST NOT remove or reorder Conditions that they are not
-	//   directly responsible for. For example, if an implementation sees a Condition
-	//   with type `special.io/SomeField`, it MUST NOT remove, change or update that
-	//   Condition.
-	// * Implementations MUST always _merge_ changes into Conditions of the same Type,
-	//   rather than creating more than one Condition of the same Type.
-	// * Implementations MUST always update the `observedGeneration` field of the
-	//   Condition to the `metadata.generation` of the Gateway at the time of update creation.
-	// * If the `observedGeneration` of a Condition is _greater than_ the value the
-	//   implementation knows about, then it MUST NOT perform the update on that Condition,
-	//   but must wait for a future reconciliation and status update. (The assumption is that
-	//   the implementation's copy of the object is stale and an update will be re-triggered
-	//   if relevant.)
-	//
-	// </gateway:util:excludeFromCRD>
-	//
-	// +required
-	// +listType=map
-	// +listMapKey=type
-	// +kubebuilder:validation:MinItems=1
-	// +kubebuilder:validation:MaxItems=8
-	Conditions []metav1.Condition `json:"conditions,omitempty"`
-}
-
-// PolicyStatus defines the common attributes that all Policies should include within
-// their status.
-type PolicyStatus struct {
-	// Ancestors is a list of ancestor resources (usually Gateways) that are
-	// associated with the policy, and the status of the policy with respect to
-	// each ancestor. When this policy attaches to a parent, the controller that
-	// manages the parent and the ancestors MUST add an entry to this list when
-	// the controller first sees the policy and SHOULD update the entry as
-	// appropriate when the relevant ancestor is modified.
-	//
-	// Note that choosing the relevant ancestor is left to the Policy designers;
-	// an important part of Policy design is designing the right object level at
-	// which to namespace this status.
-	//
-	// Note also that implementations MUST ONLY populate ancestor status for
-	// the Ancestor resources they are responsible for. Implementations MUST
-	// use the ControllerName field to uniquely identify the entries in this list
-	// that they are responsible for.
-	//
-	// Note that to achieve this, the list of PolicyAncestorStatus structs
-	// MUST be treated as a map with a composite key, made up of the AncestorRef
-	// and ControllerName fields combined.
-	//
-	// A maximum of 16 ancestors will be represented in this list. An empty list
-	// means the Policy is not relevant for any ancestors.
-	//
-	// If this slice is full, implementations MUST NOT add further entries.
-	// Instead they MUST consider the policy unimplementable and signal that
-	// on any related resources such as the ancestor that would be referenced
-	// here. For example, if this list was full on BackendTLSPolicy, no
-	// additional Gateways would be able to reference the Service targeted by
-	// the BackendTLSPolicy.
-	//
-	// +required
-	// +listType=atomic
-	// +kubebuilder:validation:MaxItems=16
-	Ancestors []PolicyAncestorStatus `json:"ancestors"`
-}
+type PolicyStatus v1.PolicyStatus
diff --git a/apis/v1alpha2/referencegrant_types.go b/apis/v1alpha2/referencegrant_types.go
index 372022f7..2c234550 100644
--- a/apis/v1alpha2/referencegrant_types.go
+++ b/apis/v1alpha2/referencegrant_types.go
@@ -59,16 +59,8 @@ type ReferenceGrantList struct {
 	Items           []ReferenceGrant `json:"items"`
 }
 
-// ReferenceGrantSpec identifies a cross namespace relationship that is trusted
-// for Gateway API.
-// +k8s:deepcopy-gen=false
 type ReferenceGrantSpec = v1beta1.ReferenceGrantSpec
 
-// ReferenceGrantFrom describes trusted namespaces and kinds.
-// +k8s:deepcopy-gen=false
 type ReferenceGrantFrom = v1beta1.ReferenceGrantFrom
 
-// ReferenceGrantTo describes what Kinds are allowed as targets of the
-// references.
-// +k8s:deepcopy-gen=false
 type ReferenceGrantTo = v1beta1.ReferenceGrantTo
diff --git a/apis/v1alpha2/shared_types.go b/apis/v1alpha2/shared_types.go
index 3d2f7879..df39d425 100644
--- a/apis/v1alpha2/shared_types.go
+++ b/apis/v1alpha2/shared_types.go
@@ -18,45 +18,14 @@ package v1alpha2
 
 import v1 "sigs.k8s.io/gateway-api/apis/v1"
 
-// ParentReference identifies an API object (usually a Gateway) that can be considered
-// a parent of this resource (usually a route). The only kind of parent resource
-// with "Core" support is Gateway. This API may be extended in the future to
-// support additional kinds of parent resources, such as HTTPRoute.
-//
-// Note that there are specific rules for ParentRefs which cross namespace
-// boundaries. Cross-namespace references are only valid if they are explicitly
-// allowed by something in the namespace they are referring to. For example:
-// Gateway has the AllowedRoutes field, and ReferenceGrant provides a
-// generic way to enable any other kind of cross-namespace reference.
-//
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-// +k8s:deepcopy-gen=false
-type ParentReference = v1.ParentReference
-
-// CommonRouteSpec defines the common attributes that all Routes MUST include
-// within their spec.
-// +k8s:deepcopy-gen=false
-type CommonRouteSpec = v1.CommonRouteSpec
-
-// PortNumber defines a network port.
-type PortNumber = v1.PortNumber
-
-// BackendRef defines how a Route should forward a request to a Kubernetes
-// resource.
-//
-// Note that when a namespace different than the local namespace is specified, a
-// ReferenceGrant object is required in the referent namespace to allow that
-// namespace's owner to accept the reference. See the ReferenceGrant
-// documentation for details.
-// +k8s:deepcopy-gen=false
-type BackendRef = v1.BackendRef
-
-// RouteConditionType is a type of condition for a route.
-type RouteConditionType = v1.RouteConditionType
-
-// RouteConditionReason is a reason for a route condition.
-type RouteConditionReason = v1.RouteConditionReason
+type (
+	ParentReference      = v1.ParentReference
+	CommonRouteSpec      = v1.CommonRouteSpec
+	PortNumber           = v1.PortNumber
+	BackendRef           = v1.BackendRef
+	RouteConditionType   = v1.RouteConditionType
+	RouteConditionReason = v1.RouteConditionReason
+)
 
 const (
 	// This condition indicates whether the route has been accepted or rejected
@@ -140,215 +109,22 @@ const (
 	RouteReasonBackendNotFound RouteConditionReason = "BackendNotFound"
 )
 
-// RouteParentStatus describes the status of a route with respect to an
-// associated Parent.
-// +k8s:deepcopy-gen=false
-type RouteParentStatus = v1.RouteParentStatus
-
-// RouteStatus defines the common attributes that all Routes MUST include within
-// their status.
-// +k8s:deepcopy-gen=false
-type RouteStatus = v1.RouteStatus
-
-// Hostname is the fully qualified domain name of a network host. This matches
-// the RFC 1123 definition of a hostname with 2 notable exceptions:
-//
-//  1. IPs are not allowed.
-//  2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
-//     label must appear by itself as the first label.
-//
-// Hostname can be "precise" which is a domain name without the terminating
-// dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
-// domain name prefixed with a single wildcard label (e.g. `*.example.com`).
-//
-// Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
-// alphanumeric characters or '-', and must start and end with an alphanumeric
-// character. No other punctuation is allowed.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
-type Hostname = v1.Hostname
-
-// PreciseHostname is the fully qualified domain name of a network host. This
-// matches the RFC 1123 definition of a hostname with 1 notable exception that
-// numeric IP addresses are not allowed.
-//
-// Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
-// alphanumeric characters or '-', and must start and end with an alphanumeric
-// character. No other punctuation is allowed.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
-type PreciseHostname = v1.PreciseHostname
-
-// Group refers to a Kubernetes Group. It must either be an empty string or a
-// RFC 1123 subdomain.
-//
-// This validation is based off of the corresponding Kubernetes validation:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L208
-//
-// Valid values include:
-//
-// * "" - empty string implies core Kubernetes API group
-// * "networking.k8s.io"
-// * "foo.example.com"
-//
-// Invalid values include:
-//
-// * "example.com/bar" - "/" is an invalid character
-//
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
-type Group = v1.Group
-
-// Kind refers to a Kubernetes Kind.
-//
-// Valid values include:
-//
-// * "Service"
-// * "HTTPRoute"
-//
-// Invalid values include:
-//
-// * "invalid/kind" - "/" is an invalid character
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=63
-// +kubebuilder:validation:Pattern=`^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$`
-type Kind = v1.Kind
-
-// ObjectName refers to the name of a Kubernetes object.
-// Object names can have a variety of forms, including RFC1123 subdomains,
-// RFC 1123 labels, or RFC 1035 labels.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-type ObjectName = v1.ObjectName
-
-// Namespace refers to a Kubernetes namespace. It must be a RFC 1123 label.
-//
-// This validation is based off of the corresponding Kubernetes validation:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L187
-//
-// This is used for Namespace name validation here:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/api/validation/generic.go#L63
-//
-// Valid values include:
-//
-// * "example"
-//
-// Invalid values include:
-//
-// * "example.com" - "." is an invalid character
-//
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=63
-type Namespace = v1.Namespace
-
-// SectionName is the name of a section in a Kubernetes resource.
-//
-// In the following resources, SectionName is interpreted as the following:
-//
-// * Gateway: Listener name
-// * HTTPRoute: HTTPRouteRule name
-// * Service: Port name
-//
-// Section names can have a variety of forms, including RFC 1123 subdomains,
-// RFC 1123 labels, or RFC 1035 labels.
-//
-// This validation is based off of the corresponding Kubernetes validation:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L208
-//
-// Valid values include:
-//
-// * "example"
-// * "foo-example"
-// * "example.com"
-// * "foo.example.com"
-//
-// Invalid values include:
-//
-// * "example.com/bar" - "/" is an invalid character
-//
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-type SectionName = v1.SectionName
-
-// GatewayController is the name of a Gateway API controller. It must be a
-// domain prefixed path.
-//
-// Valid values include:
-//
-// * "example.com/bar"
-//
-// Invalid values include:
-//
-// * "example.com" - must include path
-// * "foo.example.com" - must include path
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$`
-type GatewayController = v1.GatewayController
-
-// AnnotationKey is the key of an annotation in Gateway API. This is used for
-// validation of maps such as TLS options. This matches the Kubernetes
-// "qualified name" validation that is used for annotations and other common
-// values.
-//
-// Valid values include:
-//
-// * example
-// * example.com
-// * example.com/path
-// * example.com/path.html
-//
-// Invalid values include:
-//
-// * example~ - "~" is an invalid character
-// * example.com. - cannot start or end with "."
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]/?)*$`
-type AnnotationKey = v1.AnnotationKey
-
-// AnnotationValue is the value of an annotation in Gateway API. This is used
-// for validation of maps such as TLS options. This roughly matches Kubernetes
-// annotation validation, although the length validation in that case is based
-// on the entire size of the annotations struct.
-//
-// +kubebuilder:validation:MinLength=0
-// +kubebuilder:validation:MaxLength=4096
-type AnnotationValue = v1.AnnotationValue
-
-// AddressType defines how a network address is represented as a text string.
-// This may take two possible forms:
-//
-// * A predefined CamelCase string identifier (currently limited to `IPAddress` or `Hostname`)
-// * A domain-prefixed string identifier (like `acme.io/CustomAddressType`)
-//
-// Values `IPAddress` and `Hostname` have Extended support.
-//
-// The `NamedAddress` value has been deprecated in favor of implementation
-// specific domain-prefixed strings.
-//
-// All other values, including domain-prefixed values have Implementation-specific support,
-// which are used in implementation-specific behaviors. Support for additional
-// predefined CamelCase identifiers may be added in future releases.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$`
-type AddressType = v1.AddressType
-
-// Duration is a string value representing a duration in time. The format is as specified
-// in GEP-2257, a strict subset of the syntax parsed by Golang time.ParseDuration.
-type Duration = v1.Duration
+type (
+	RouteParentStatus = v1.RouteParentStatus
+	RouteStatus       = v1.RouteStatus
+	Hostname          = v1.Hostname
+	PreciseHostname   = v1.PreciseHostname
+	Group             = v1.Group
+	Kind              = v1.Kind
+	ObjectName        = v1.ObjectName
+	Namespace         = v1.Namespace
+	SectionName       = v1.SectionName
+	GatewayController = v1.GatewayController
+	AnnotationKey     = v1.AnnotationKey
+	AnnotationValue   = v1.AnnotationValue
+	AddressType       = v1.AddressType
+	Duration          = v1.Duration
+)
 
 const (
 	// A textual representation of a numeric IP address. IPv4
@@ -382,7 +158,4 @@ const (
 	NamedAddressType AddressType = "NamedAddress"
 )
 
-// SessionPersistence defines the desired state of
-// SessionPersistence.
-// +k8s:deepcopy-gen=false
 type SessionPersistence = v1.SessionPersistence
diff --git a/apis/v1alpha2/zz_generated.deepcopy.go b/apis/v1alpha2/zz_generated.deepcopy.go
index 8b09c2d7..486af9f0 100644
--- a/apis/v1alpha2/zz_generated.deepcopy.go
+++ b/apis/v1alpha2/zz_generated.deepcopy.go
@@ -21,8 +21,9 @@ limitations under the License.
 package v1alpha2
 
 import (
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/gateway-api/apis/v1"
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
@@ -102,10 +103,10 @@ func (in *LocalPolicyTargetReference) DeepCopy() *LocalPolicyTargetReference {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *LocalPolicyTargetReferenceWithSectionName) DeepCopyInto(out *LocalPolicyTargetReferenceWithSectionName) {
 	*out = *in
-	in.LocalPolicyTargetReference.DeepCopyInto(&out.LocalPolicyTargetReference)
+	out.LocalPolicyTargetReference = in.LocalPolicyTargetReference
 	if in.SectionName != nil {
 		in, out := &in.SectionName, &out.SectionName
-		*out = new(SectionName)
+		*out = new(v1.SectionName)
 		**out = **in
 	}
 }
@@ -125,7 +126,7 @@ func (in *NamespacedPolicyTargetReference) DeepCopyInto(out *NamespacedPolicyTar
 	*out = *in
 	if in.Namespace != nil {
 		in, out := &in.Namespace, &out.Namespace
-		*out = new(Namespace)
+		*out = new(v1.Namespace)
 		**out = **in
 	}
 }
@@ -146,7 +147,7 @@ func (in *PolicyAncestorStatus) DeepCopyInto(out *PolicyAncestorStatus) {
 	in.AncestorRef.DeepCopyInto(&out.AncestorRef)
 	if in.Conditions != nil {
 		in, out := &in.Conditions, &out.Conditions
-		*out = make([]v1.Condition, len(*in))
+		*out = make([]metav1.Condition, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
@@ -168,7 +169,7 @@ func (in *PolicyStatus) DeepCopyInto(out *PolicyStatus) {
 	*out = *in
 	if in.Ancestors != nil {
 		in, out := &in.Ancestors, &out.Ancestors
-		*out = make([]PolicyAncestorStatus, len(*in))
+		*out = make([]v1.PolicyAncestorStatus, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
diff --git a/apis/v1alpha3/backendtlspolicy_types.go b/apis/v1alpha3/backendtlspolicy_types.go
index 9c5c019d..4917063b 100644
--- a/apis/v1alpha3/backendtlspolicy_types.go
+++ b/apis/v1alpha3/backendtlspolicy_types.go
@@ -20,283 +20,16 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
-	"sigs.k8s.io/gateway-api/apis/v1alpha2"
 )
 
 // +genclient
 // +kubebuilder:object:root=true
-// +kubebuilder:subresource:status
-// +kubebuilder:storageversion
-// +kubebuilder:resource:categories=gateway-api,shortName=btlspolicy
-// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
-//
-// BackendTLSPolicy is a Direct Attached Policy.
-// +kubebuilder:metadata:labels="gateway.networking.k8s.io/policy=Direct"
+// +kubebuilder:deprecatedversion:warning="The v1alpha3 version of BackendTLSPolicy has been deprecated and will be removed in a future release of the API. Please upgrade to v1."
+type BackendTLSPolicy v1.BackendTLSPolicy
 
-// BackendTLSPolicy provides a way to configure how a Gateway
-// connects to a Backend via TLS.
-type BackendTLSPolicy struct {
-	metav1.TypeMeta `json:",inline"`
-	// +optional
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	// Spec defines the desired state of BackendTLSPolicy.
-	// +required
-	Spec BackendTLSPolicySpec `json:"spec"`
-
-	// Status defines the current state of BackendTLSPolicy.
-	// +optional
-	Status v1alpha2.PolicyStatus `json:"status,omitempty"`
-}
-
-// BackendTLSPolicyList contains a list of BackendTLSPolicies
 // +kubebuilder:object:root=true
 type BackendTLSPolicyList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata,omitempty"`
 	Items           []BackendTLSPolicy `json:"items"`
 }
-
-// BackendTLSPolicySpec defines the desired state of BackendTLSPolicy.
-//
-// Support: Extended
-type BackendTLSPolicySpec struct {
-	// TargetRefs identifies an API object to apply the policy to.
-	// Only Services have Extended support. Implementations MAY support
-	// additional objects, with Implementation Specific support.
-	// Note that this config applies to the entire referenced resource
-	// by default, but this default may change in the future to provide
-	// a more granular application of the policy.
-	//
-	// TargetRefs must be _distinct_. This means either that:
-	//
-	// * They select different targets. If this is the case, then targetRef
-	//   entries are distinct. In terms of fields, this means that the
-	//   multi-part key defined by `group`, `kind`, and `name` must
-	//   be unique across all targetRef entries in the BackendTLSPolicy.
-	// * They select different sectionNames in the same target.
-	//
-	// Support: Extended for Kubernetes Service
-	//
-	// Support: Implementation-specific for any other resource
-	//
-	// +required
-	// +listType=atomic
-	// +kubebuilder:validation:MinItems=1
-	// +kubebuilder:validation:MaxItems=16
-	// +kubebuilder:validation:XValidation:message="sectionName must be specified when targetRefs includes 2 or more references to the same target",rule="self.all(p1, self.all(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName == '') == (!has(p2.sectionName) || p2.sectionName == '')) : true))"
-	// +kubebuilder:validation:XValidation:message="sectionName must be unique when targetRefs includes 2 or more references to the same target",rule="self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName == p2.sectionName))))"
-	TargetRefs []v1alpha2.LocalPolicyTargetReferenceWithSectionName `json:"targetRefs"`
-
-	// Validation contains backend TLS validation configuration.
-	// +required
-	Validation BackendTLSPolicyValidation `json:"validation"`
-
-	// Options are a list of key/value pairs to enable extended TLS
-	// configuration for each implementation. For example, configuring the
-	// minimum TLS version or supported cipher suites.
-	//
-	// A set of common keys MAY be defined by the API in the future. To avoid
-	// any ambiguity, implementation-specific definitions MUST use
-	// domain-prefixed names, such as `example.com/my-custom-option`.
-	// Un-prefixed names are reserved for key names defined by Gateway API.
-	//
-	// Support: Implementation-specific
-	//
-	// +optional
-	// +kubebuilder:validation:MaxProperties=16
-	Options map[v1.AnnotationKey]v1.AnnotationValue `json:"options,omitempty"`
-}
-
-// BackendTLSPolicyValidation contains backend TLS validation configuration.
-// +kubebuilder:validation:XValidation:message="must not contain both CACertificateRefs and WellKnownCACertificates",rule="!(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
-// +kubebuilder:validation:XValidation:message="must specify either CACertificateRefs or WellKnownCACertificates",rule="(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
-type BackendTLSPolicyValidation struct {
-	// CACertificateRefs contains one or more references to Kubernetes objects that
-	// contain a PEM-encoded TLS CA certificate bundle, which is used to
-	// validate a TLS handshake between the Gateway and backend Pod.
-	//
-	// If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
-	// specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
-	// not both. If CACertificateRefs is empty or unspecified, the configuration for
-	// WellKnownCACertificates MUST be honored instead if supported by the implementation.
-	//
-	// A CACertificateRef is invalid if:
-	//
-	// * It refers to a resource that cannot be resolved (e.g., the referenced resource
-	//   does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key
-	//   named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`
-	//   and the Message of the Condition must indicate which reference is invalid and why.
-	//
-	// * It refers to an unknown or unsupported kind of resource. In this case, the Reason
-	//   must be set to `InvalidKind` and the Message of the Condition must explain which
-	//   kind of resource is unknown or unsupported.
-	//
-	// * It refers to a resource in another namespace. This may change in future
-	//   spec updates.
-	//
-	// Implementations MAY choose to perform further validation of the certificate
-	// content (e.g., checking expiry or enforcing specific formats). In such cases,
-	// an implementation-specific Reason and Message must be set for the invalid reference.
-	//
-	// In all cases, the implementation MUST ensure the `ResolvedRefs` Condition on
-	// the BackendTLSPolicy is set to `status: False`, with a Reason and Message
-	// that indicate the cause of the error. Connections using an invalid
-	// CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error
-	// response. If ALL CACertificateRefs are invalid, the implementation MUST also
-	// ensure the `Accepted` Condition on the BackendTLSPolicy is set to
-	// `status: False`, with a Reason `NoValidCACertificate`.
-	//
-	//
-	// A single CACertificateRef to a Kubernetes ConfigMap kind has "Core" support.
-	// Implementations MAY choose to support attaching multiple certificates to
-	// a backend, but this behavior is implementation-specific.
-	//
-	// Support: Core - An optional single reference to a Kubernetes ConfigMap,
-	// with the CA certificate in a key named `ca.crt`.
-	//
-	// Support: Implementation-specific - More than one reference, other kinds
-	// of resources, or a single reference that includes multiple certificates.
-	//
-	// +optional
-	// +listType=atomic
-	// +kubebuilder:validation:MaxItems=8
-	CACertificateRefs []v1.LocalObjectReference `json:"caCertificateRefs,omitempty"`
-
-	// WellKnownCACertificates specifies whether system CA certificates may be used in
-	// the TLS handshake between the gateway and backend pod.
-	//
-	// If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
-	// must be specified with at least one entry for a valid configuration. Only one of
-	// CACertificateRefs or WellKnownCACertificates may be specified, not both.
-	// If an implementation does not support the WellKnownCACertificates field, or
-	// the supplied value is not recognized, the implementation MUST ensure the
-	// `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with
-	// a Reason `Invalid`.
-	//
-	// Support: Implementation-specific
-	//
-	// +optional
-	// +listType=atomic
-	WellKnownCACertificates *WellKnownCACertificatesType `json:"wellKnownCACertificates,omitempty"`
-
-	// Hostname is used for two purposes in the connection between Gateways and
-	// backends:
-	//
-	// 1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
-	// 2. Hostname MUST be used for authentication and MUST match the certificate served by the matching backend, unless SubjectAltNames is specified.
-	//
-	// Support: Core
-	//
-	// +required
-	Hostname v1.PreciseHostname `json:"hostname"`
-
-	// SubjectAltNames contains one or more Subject Alternative Names.
-	// When specified the certificate served from the backend MUST
-	// have at least one Subject Alternate Name matching one of the specified SubjectAltNames.
-	//
-	// Support: Extended
-	//
-	// +optional
-	// +listType=atomic
-	// +kubebuilder:validation:MaxItems=5
-	SubjectAltNames []SubjectAltName `json:"subjectAltNames,omitempty"`
-}
-
-// SubjectAltName represents Subject Alternative Name.
-// +kubebuilder:validation:XValidation:message="SubjectAltName element must contain Hostname, if Type is set to Hostname",rule="!(self.type == \"Hostname\" && (!has(self.hostname) || self.hostname == \"\"))"
-// +kubebuilder:validation:XValidation:message="SubjectAltName element must not contain Hostname, if Type is not set to Hostname",rule="!(self.type != \"Hostname\" && has(self.hostname) && self.hostname != \"\")"
-// +kubebuilder:validation:XValidation:message="SubjectAltName element must contain URI, if Type is set to URI",rule="!(self.type == \"URI\" && (!has(self.uri) || self.uri == \"\"))"
-// +kubebuilder:validation:XValidation:message="SubjectAltName element must not contain URI, if Type is not set to URI",rule="!(self.type != \"URI\" && has(self.uri) && self.uri != \"\")"
-type SubjectAltName struct {
-	// Type determines the format of the Subject Alternative Name. Always required.
-	//
-	// Support: Core
-	//
-	// +required
-	Type SubjectAltNameType `json:"type"`
-
-	// Hostname contains Subject Alternative Name specified in DNS name format.
-	// Required when Type is set to Hostname, ignored otherwise.
-	//
-	// Support: Core
-	//
-	// +optional
-	Hostname v1.Hostname `json:"hostname,omitempty"`
-
-	// URI contains Subject Alternative Name specified in a full URI format.
-	// It MUST include both a scheme (e.g., "http" or "ftp") and a scheme-specific-part.
-	// Common values include SPIFFE IDs like "spiffe://mycluster.example.com/ns/myns/sa/svc1sa".
-	// Required when Type is set to URI, ignored otherwise.
-	//
-	// Support: Core
-	//
-	// +optional
-	URI v1.AbsoluteURI `json:"uri,omitempty"`
-}
-
-// WellKnownCACertificatesType is the type of CA certificate that will be used
-// when the caCertificateRefs field is unspecified.
-// +kubebuilder:validation:Enum=System
-type WellKnownCACertificatesType string
-
-const (
-	// WellKnownCACertificatesSystem indicates that well known system CA certificates should be used.
-	WellKnownCACertificatesSystem WellKnownCACertificatesType = "System"
-)
-
-// SubjectAltNameType is the type of the Subject Alternative Name.
-// +kubebuilder:validation:Enum=Hostname;URI
-type SubjectAltNameType string
-
-const (
-	// HostnameSubjectAltNameType specifies hostname-based SAN.
-	//
-	// Support: Core
-	HostnameSubjectAltNameType SubjectAltNameType = "Hostname"
-
-	// URISubjectAltNameType specifies URI-based SAN, e.g. SPIFFE id.
-	//
-	// Support: Core
-	URISubjectAltNameType SubjectAltNameType = "URI"
-)
-
-const (
-	// This reason is used with the "Accepted" condition when it is
-	// set to false because all CACertificateRefs of the
-	// BackendTLSPolicy are invalid.
-	BackendTLSPolicyReasonNoValidCACertificate v1alpha2.PolicyConditionReason = "NoValidCACertificate"
-)
-
-const (
-	// This condition indicates whether the controller was able to resolve all
-	// object references for the BackendTLSPolicy.
-	//
-	// Possible reasons for this condition to be True are:
-	//
-	// * "ResolvedRefs"
-	//
-	// Possible reasons for this condition to be False are:
-	//
-	// * "InvalidCACertificateRef"
-	// * "InvalidKind"
-	//
-	// Controllers may raise this condition with other reasons, but should
-	// prefer to use the reasons listed above to improve interoperability.
-	BackendTLSPolicyConditionResolvedRefs v1alpha2.PolicyConditionType = "ResolvedRefs"
-
-	// This reason is used with the "ResolvedRefs" condition when the condition
-	// is true.
-	BackendTLSPolicyReasonResolvedRefs v1alpha2.PolicyConditionReason = "ResolvedRefs"
-
-	// This reason is used with the "ResolvedRefs" condition when one of the
-	// BackendTLSPolicy's CACertificateRefs is invalid.
-	// A CACertificateRef is considered invalid when it refers to a nonexistent
-	// resource or when the data within that resource is malformed.
-	BackendTLSPolicyReasonInvalidCACertificateRef v1alpha2.PolicyConditionReason = "InvalidCACertificateRef"
-
-	// This reason is used with the "ResolvedRefs" condition when one of the
-	// BackendTLSPolicy's CACertificateRefs references an unknown or unsupported
-	// Group and/or Kind.
-	BackendTLSPolicyReasonInvalidKind v1alpha2.PolicyConditionReason = "InvalidKind"
-)
diff --git a/apis/v1alpha3/shared_types.go b/apis/v1alpha3/shared_types.go
index fa487f96..a54a211d 100644
--- a/apis/v1alpha3/shared_types.go
+++ b/apis/v1alpha3/shared_types.go
@@ -18,72 +18,12 @@ package v1alpha3
 
 import v1 "sigs.k8s.io/gateway-api/apis/v1"
 
-// CommonRouteSpec defines the common attributes that all Routes MUST include
-// within their spec.
-// +k8s:deepcopy-gen=false
 type CommonRouteSpec = v1.CommonRouteSpec
 
-// BackendRef defines how a Route should forward a request to a Kubernetes
-// resource.
-//
-// Note that when a namespace different than the local namespace is specified, a
-// ReferenceGrant object is required in the referent namespace to allow that
-// namespace's owner to accept the reference. See the ReferenceGrant
-// documentation for details.
-// +k8s:deepcopy-gen=false
 type BackendRef = v1.BackendRef
 
-// RouteStatus defines the common attributes that all Routes MUST include within
-// their status.
-// +k8s:deepcopy-gen=false
 type RouteStatus = v1.RouteStatus
 
-// Hostname is the fully qualified domain name of a network host. This matches
-// the RFC 1123 definition of a hostname with 2 notable exceptions:
-//
-//  1. IPs are not allowed.
-//  2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
-//     label must appear by itself as the first label.
-//
-// Hostname can be "precise" which is a domain name without the terminating
-// dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
-// domain name prefixed with a single wildcard label (e.g. `*.example.com`).
-//
-// Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
-// alphanumeric characters or '-', and must start and end with an alphanumeric
-// character. No other punctuation is allowed.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
 type Hostname = v1.Hostname
 
-// SectionName is the name of a section in a Kubernetes resource.
-//
-// In the following resources, SectionName is interpreted as the following:
-//
-// * Gateway: Listener name
-// * HTTPRoute: HTTPRouteRule name
-// * Service: Port name
-//
-// Section names can have a variety of forms, including RFC 1123 subdomains,
-// RFC 1123 labels, or RFC 1035 labels.
-//
-// This validation is based off of the corresponding Kubernetes validation:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L208
-//
-// Valid values include:
-//
-// * "example"
-// * "foo-example"
-// * "example.com"
-// * "foo.example.com"
-//
-// Invalid values include:
-//
-// * "example.com/bar" - "/" is an invalid character
-//
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
 type SectionName = v1.SectionName
diff --git a/apis/v1alpha3/zz_generated.deepcopy.go b/apis/v1alpha3/zz_generated.deepcopy.go
index 9b659ead..479672b6 100644
--- a/apis/v1alpha3/zz_generated.deepcopy.go
+++ b/apis/v1alpha3/zz_generated.deepcopy.go
@@ -22,7 +22,6 @@ package v1alpha3
 
 import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
-	"sigs.k8s.io/gateway-api/apis/v1"
 	"sigs.k8s.io/gateway-api/apis/v1alpha2"
 )
 
@@ -85,81 +84,6 @@ func (in *BackendTLSPolicyList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackendTLSPolicySpec) DeepCopyInto(out *BackendTLSPolicySpec) {
-	*out = *in
-	if in.TargetRefs != nil {
-		in, out := &in.TargetRefs, &out.TargetRefs
-		*out = make([]v1alpha2.LocalPolicyTargetReferenceWithSectionName, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	in.Validation.DeepCopyInto(&out.Validation)
-	if in.Options != nil {
-		in, out := &in.Options, &out.Options
-		*out = make(map[v1.AnnotationKey]v1.AnnotationValue, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendTLSPolicySpec.
-func (in *BackendTLSPolicySpec) DeepCopy() *BackendTLSPolicySpec {
-	if in == nil {
-		return nil
-	}
-	out := new(BackendTLSPolicySpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackendTLSPolicyValidation) DeepCopyInto(out *BackendTLSPolicyValidation) {
-	*out = *in
-	if in.CACertificateRefs != nil {
-		in, out := &in.CACertificateRefs, &out.CACertificateRefs
-		*out = make([]v1.LocalObjectReference, len(*in))
-		copy(*out, *in)
-	}
-	if in.WellKnownCACertificates != nil {
-		in, out := &in.WellKnownCACertificates, &out.WellKnownCACertificates
-		*out = new(WellKnownCACertificatesType)
-		**out = **in
-	}
-	if in.SubjectAltNames != nil {
-		in, out := &in.SubjectAltNames, &out.SubjectAltNames
-		*out = make([]SubjectAltName, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendTLSPolicyValidation.
-func (in *BackendTLSPolicyValidation) DeepCopy() *BackendTLSPolicyValidation {
-	if in == nil {
-		return nil
-	}
-	out := new(BackendTLSPolicyValidation)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SubjectAltName) DeepCopyInto(out *SubjectAltName) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SubjectAltName.
-func (in *SubjectAltName) DeepCopy() *SubjectAltName {
-	if in == nil {
-		return nil
-	}
-	out := new(SubjectAltName)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TLSRoute) DeepCopyInto(out *TLSRoute) {
 	*out = *in
diff --git a/apis/v1beta1/gateway_types.go b/apis/v1beta1/gateway_types.go
index 60bac20c..6c3e1027 100644
--- a/apis/v1beta1/gateway_types.go
+++ b/apis/v1beta1/gateway_types.go
@@ -44,123 +44,34 @@ type GatewayList struct {
 	Items           []Gateway `json:"items"`
 }
 
-// GatewaySpec defines the desired state of Gateway.
-//
-// Not all possible combinations of options specified in the Spec are
-// valid. Some invalid configurations can be caught synchronously via CRD
-// validation, but there are many cases that will require asynchronous
-// signaling via the GatewayStatus block.
-// +k8s:deepcopy-gen=false
 type GatewaySpec = v1.GatewaySpec
 
-// Listener embodies the concept of a logical endpoint where a Gateway accepts
-// network connections.
-// +k8s:deepcopy-gen=false
 type Listener = v1.Listener
 
-// ProtocolType defines the application protocol accepted by a Listener.
-// Implementations are not required to accept all the defined protocols. If an
-// implementation does not support a specified protocol, it MUST set the
-// "Accepted" condition to False for the affected Listener with a reason of
-// "UnsupportedProtocol".
-//
-// Core ProtocolType values are listed in the table below.
-//
-// Implementations can define their own protocols if a core ProtocolType does not
-// exist. Such definitions must use prefixed name, such as
-// `mycompany.com/my-custom-protocol`. Un-prefixed names are reserved for core
-// protocols. Any protocol defined by implementations will fall under
-// implementation-specific conformance.
-//
-// Valid values include:
-//
-// * "HTTP" - Core support
-// * "example.com/bar" - Implementation-specific support
-//
-// Invalid values include:
-//
-// * "example.com" - must include path if domain is used
-// * "foo.example.com" - must include path if domain is used
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=255
-// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([-a-zSA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$`
-// +k8s:deepcopy-gen=false
 type ProtocolType = v1.ProtocolType
 
-// ListenerTLSConfig describes a TLS configuration.
-// +k8s:deepcopy-gen=false
 type ListenerTLSConfig = v1.ListenerTLSConfig
 
-// TLSModeType type defines how a Gateway handles TLS sessions.
-//
-// Note that values may be added to this enum, implementations
-// must ensure that unknown values will not cause a crash.
-//
-// Unknown values here must result in the implementation setting the
-// Ready Condition for the Listener to `status: False`, with a
-// Reason of `Invalid`.
-//
-// +kubebuilder:validation:Enum=Terminate;Passthrough
-// +k8s:deepcopy-gen=false
 type TLSModeType = v1.TLSModeType
 
-// AllowedRoutes defines which Routes may be attached to this Listener.
-// +k8s:deepcopy-gen=false
 type AllowedRoutes = v1.AllowedRoutes
 
-// FromNamespaces specifies namespace from which Routes may be attached to a
-// Gateway.
-//
-// Note that values may be added to this enum, implementations
-// must ensure that unknown values will not cause a crash.
-//
-// Unknown values here must result in the implementation setting the
-// Ready Condition for the Listener to `status: False`, with a
-// Reason of `Invalid`.
-//
-// +kubebuilder:validation:Enum=All;Selector;Same
-// +k8s:deepcopy-gen=false
 type FromNamespaces = v1.FromNamespaces
 
-// RouteNamespaces indicate which namespaces Routes should be selected from.
-// +k8s:deepcopy-gen=false
 type RouteNamespaces = v1.RouteNamespaces
 
-// RouteGroupKind indicates the group and kind of a Route resource.
-// +k8s:deepcopy-gen=false
 type RouteGroupKind = v1.RouteGroupKind
 
-// GatewaySpecAddress describes an address that can be bound to a Gateway.
-// +k8s:deepcopy-gen=false
 type GatewaySpecAddress = v1.GatewaySpecAddress
 
-// GatewayStatus defines the observed state of Gateway.
-// +k8s:deepcopy-gen=false
 type GatewayStatus = v1.GatewayStatus
 
-// GatewayConditionType is a type of condition associated with a
-// Gateway. This type should be used with the GatewayStatus.Conditions
-// field.
-// +k8s:deepcopy-gen=false
 type GatewayConditionType = v1.GatewayConditionType
 
-// GatewayConditionReason defines the set of reasons that explain why a
-// particular Gateway condition type has been raised.
-// +k8s:deepcopy-gen=false
 type GatewayConditionReason = v1.GatewayConditionReason
 
-// ListenerStatus is the status associated with a Listener.
-// +k8s:deepcopy-gen=false
 type ListenerStatus = v1.ListenerStatus
 
-// ListenerConditionType is a type of condition associated with the
-// listener. This type should be used with the ListenerStatus.Conditions
-// field.
-// +k8s:deepcopy-gen=false
 type ListenerConditionType = v1.ListenerConditionType
 
-// ListenerConditionReason defines the set of reasons that explain
-// why a particular Listener condition type has been raised.
-// +k8s:deepcopy-gen=false
 type ListenerConditionReason = v1.ListenerConditionReason
diff --git a/apis/v1beta1/gatewayclass_types.go b/apis/v1beta1/gatewayclass_types.go
index 0a704a78..37b47ef2 100644
--- a/apis/v1beta1/gatewayclass_types.go
+++ b/apis/v1beta1/gatewayclass_types.go
@@ -60,26 +60,12 @@ type GatewayClassList struct {
 	Items           []GatewayClass `json:"items"`
 }
 
-// GatewayClassSpec reflects the configuration of a class of Gateways.
-// +k8s:deepcopy-gen=false
 type GatewayClassSpec = v1.GatewayClassSpec
 
-// ParametersReference identifies an API object containing controller-specific
-// configuration resource within the cluster.
-// +k8s:deepcopy-gen=false
 type ParametersReference = v1.ParametersReference
 
-// GatewayClassConditionType is the type for status conditions on
-// Gateway resources. This type should be used with the
-// GatewayClassStatus.Conditions field.
-// +k8s:deepcopy-gen=false
 type GatewayClassConditionType = v1.GatewayClassConditionType
 
-// GatewayClassConditionReason defines the set of reasons that explain why a
-// particular GatewayClass condition type has been raised.
-// +k8s:deepcopy-gen=false
 type GatewayClassConditionReason = v1.GatewayClassConditionReason
 
-// GatewayClassStatus is the current status for the GatewayClass.
-// +k8s:deepcopy-gen=false
 type GatewayClassStatus = v1.GatewayClassStatus
diff --git a/apis/v1beta1/httproute_types.go b/apis/v1beta1/httproute_types.go
index 81c7e228..a1b15767 100644
--- a/apis/v1beta1/httproute_types.go
+++ b/apis/v1beta1/httproute_types.go
@@ -44,198 +44,48 @@ type HTTPRouteList struct {
 	Items           []HTTPRoute `json:"items"`
 }
 
-// HTTPRouteSpec defines the desired state of HTTPRoute
-// +k8s:deepcopy-gen=false
 type HTTPRouteSpec = v1.HTTPRouteSpec
 
-// HTTPRouteRule defines semantics for matching an HTTP request based on
-// conditions (matches), processing it (filters), and forwarding the request to
-// an API object (backendRefs).
-// +k8s:deepcopy-gen=false
 type HTTPRouteRule = v1.HTTPRouteRule
 
-// PathMatchType specifies the semantics of how HTTP paths should be compared.
-// Valid PathMatchType values, along with their conformance level, are:
-//
-// * "Exact" - Core
-// * "PathPrefix" - Core
-// * "RegularExpression" - Implementation Specific
-//
-// PathPrefix and Exact paths must be syntactically valid:
-//
-// - Must begin with the `/` character
-// - Must not contain consecutive `/` characters (e.g. `/foo///`, `//`).
-//
-// Note that values may be added to this enum, implementations
-// must ensure that unknown values will not cause a crash.
-//
-// Unknown values here must result in the implementation setting the
-// Accepted Condition for the Route to `status: False`, with a
-// Reason of `UnsupportedValue`.
-//
-// +kubebuilder:validation:Enum=Exact;PathPrefix;RegularExpression
-// +k8s:deepcopy-gen=false
 type PathMatchType = v1.PathMatchType
 
-// HTTPPathMatch describes how to select a HTTP route by matching the HTTP request path.
-// +k8s:deepcopy-gen=false
 type HTTPPathMatch = v1.HTTPPathMatch
 
-// HeaderMatchType specifies the semantics of how HTTP header values should be
-// compared. Valid HeaderMatchType values, along with their conformance levels, are:
-//
-// * "Exact" - Core
-// * "RegularExpression" - Implementation Specific
-//
-// Note that values may be added to this enum, implementations
-// must ensure that unknown values will not cause a crash.
-//
-// Unknown values here must result in the implementation setting the
-// Accepted Condition for the Route to `status: False`, with a
-// Reason of `UnsupportedValue`.
-//
-// +kubebuilder:validation:Enum=Exact;RegularExpression
-// +k8s:deepcopy-gen=false
 type HeaderMatchType = v1.HeaderMatchType
 
-// HTTPHeaderName is the name of an HTTP header.
-//
-// Valid values include:
-// * "Authorization"
-// * "Set-Cookie"
-//
-// Invalid values include:
-//
-//   - ":method" - ":" is an invalid character. This means that HTTP/2 pseudo
-//     headers are not currently supported by this type.
-//
-// * "/invalid" - "/" is an invalid character
-// +k8s:deepcopy-gen=false
 type HTTPHeaderName = v1.HTTPHeaderName
 
-// HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request
-// headers.
-// +k8s:deepcopy-gen=false
 type HTTPHeaderMatch = v1.HTTPHeaderMatch
 
-// QueryParamMatchType specifies the semantics of how HTTP query parameter
-// values should be compared. Valid QueryParamMatchType values, along with their
-// conformance levels, are:
-//
-// * "Exact" - Core
-// * "RegularExpression" - Implementation Specific
-//
-// Note that values may be added to this enum, implementations
-// must ensure that unknown values will not cause a crash.
-//
-// Unknown values here must result in the implementation setting the
-// Accepted Condition for the Route to `status: False`, with a
-// Reason of `UnsupportedValue`.
-//
-// +kubebuilder:validation:Enum=Exact;RegularExpression
-// +k8s:deepcopy-gen=false
 type QueryParamMatchType = v1.QueryParamMatchType
 
-// HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP
-// query parameters.
-// +k8s:deepcopy-gen=false
 type HTTPQueryParamMatch = v1.HTTPQueryParamMatch
 
-// HTTPMethod describes how to select a HTTP route by matching the HTTP
-// method as defined by
-// [RFC 7231](https://datatracker.ietf.org/doc/html/rfc7231#section-4) and
-// [RFC 5789](https://datatracker.ietf.org/doc/html/rfc5789#section-2).
-// The value is expected in upper case.
-//
-// Note that values may be added to this enum, implementations
-// must ensure that unknown values will not cause a crash.
-//
-// Unknown values here must result in the implementation setting the
-// Accepted Condition for the Route to `status: False`, with a
-// Reason of `UnsupportedValue`.
-//
-// +kubebuilder:validation:Enum=GET;HEAD;POST;PUT;DELETE;CONNECT;OPTIONS;TRACE;PATCH
-// +k8s:deepcopy-gen=false
 type HTTPMethod = v1.HTTPMethod
 
-// HTTPRouteMatch defines the predicate used to match requests to a given
-// action. Multiple match types are ANDed together, i.e. the match will
-// evaluate to true only if all conditions are satisfied.
-//
-// For example, the match below will match a HTTP request only if its path
-// starts with `/foo` AND it contains the `version: v1` header:
-//
-// ```
-// match:
-//
-//	path:
-//	  value: "/foo"
-//	headers:
-//	- name: "version"
-//	  value "v1"
-//
-// ```
-// +k8s:deepcopy-gen=false
 type HTTPRouteMatch = v1.HTTPRouteMatch
 
-// HTTPRouteFilter defines processing steps that must be completed during the
-// request or response lifecycle. HTTPRouteFilters are meant as an extension
-// point to express processing that may be done in Gateway implementations. Some
-// examples include request or response modification, implementing
-// authentication strategies, rate-limiting, and traffic shaping. API
-// guarantee/conformance is defined based on the type of the filter.
-// +k8s:deepcopy-gen=false
 type HTTPRouteFilter = v1.HTTPRouteFilter
 
-// HTTPRouteFilterType identifies a type of HTTPRoute filter.
-// +k8s:deepcopy-gen=false
 type HTTPRouteFilterType = v1.HTTPRouteFilterType
 
-// HTTPRouteTimeouts defines timeouts that can be configured for an HTTPRoute.
-// +k8s:deepcopy-gen=false
 type HTTPRouteTimeouts = v1.HTTPRouteTimeouts
 
-// HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.
-// +k8s:deepcopy-gen=false
 type HTTPHeader = v1.HTTPHeader
 
-// HTTPHeaderFilter defines a filter that modifies the headers of an HTTP request
-// or response.
-// +k8s:deepcopy-gen=false
 type HTTPHeaderFilter = v1.HTTPHeaderFilter
 
-// HTTPPathModifierType defines the type of path redirect or rewrite.
-// +k8s:deepcopy-gen=false
 type HTTPPathModifierType = v1.HTTPPathModifierType
 
-// HTTPPathModifier defines configuration for path modifiers.
-// <gateway:experimental>
-// +k8s:deepcopy-gen=false
 type HTTPPathModifier = v1.HTTPPathModifier
 
-// HTTPRequestRedirect defines a filter that redirects a request. This filter
-// MUST NOT be used on the same Route rule as a HTTPURLRewrite filter.
-// +k8s:deepcopy-gen=false
 type HTTPRequestRedirectFilter = v1.HTTPRequestRedirectFilter
 
-// HTTPURLRewriteFilter defines a filter that modifies a request during
-// forwarding. At most one of these filters may be used on a Route rule. This
-// MUST NOT be used on the same Route rule as a HTTPRequestRedirect filter.
-//
-// Support: Extended
-//
-// <gateway:experimental>
-// +k8s:deepcopy-gen=false
 type HTTPURLRewriteFilter = v1.HTTPURLRewriteFilter
 
-// HTTPRequestMirrorFilter defines configuration for the RequestMirror filter.
-// +k8s:deepcopy-gen=false
 type HTTPRequestMirrorFilter = v1.HTTPRequestMirrorFilter
 
-// HTTPBackendRef defines how a HTTPRoute should forward an HTTP request.
-// +k8s:deepcopy-gen=false
 type HTTPBackendRef = v1.HTTPBackendRef
 
-// HTTPRouteStatus defines the observed state of HTTPRoute.
-// +k8s:deepcopy-gen=false
 type HTTPRouteStatus = v1.HTTPRouteStatus
diff --git a/apis/v1beta1/object_reference_types.go b/apis/v1beta1/object_reference_types.go
index 64a904e1..dcb22b1a 100644
--- a/apis/v1beta1/object_reference_types.go
+++ b/apis/v1beta1/object_reference_types.go
@@ -18,43 +18,8 @@ package v1beta1
 
 import v1 "sigs.k8s.io/gateway-api/apis/v1"
 
-// LocalObjectReference identifies an API object within the namespace of the
-// referrer.
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-//
-// References to objects with invalid Group and Kind are not valid, and must
-// be rejected by the implementation, with appropriate Conditions set
-// on the containing object.
-// +k8s:deepcopy-gen=false
 type LocalObjectReference = v1.LocalObjectReference
 
-// SecretObjectReference identifies an API object including its namespace,
-// defaulting to Secret.
-//
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-//
-// References to objects with invalid Group and Kind are not valid, and must
-// be rejected by the implementation, with appropriate Conditions set
-// on the containing object.
-// +k8s:deepcopy-gen=false
 type SecretObjectReference = v1.SecretObjectReference
 
-// BackendObjectReference defines how an ObjectReference that is
-// specific to BackendRef. It includes a few additional fields and features
-// than a regular ObjectReference.
-//
-// Note that when a namespace different than the local namespace is specified, a
-// ReferenceGrant object is required in the referent namespace to allow that
-// namespace's owner to accept the reference. See the ReferenceGrant
-// documentation for details.
-//
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-//
-// References to objects with invalid Group and Kind are not valid, and must
-// be rejected by the implementation, with appropriate Conditions set
-// on the containing object.
-// +k8s:deepcopy-gen=false
 type BackendObjectReference = v1.BackendObjectReference
diff --git a/apis/v1beta1/shared_types.go b/apis/v1beta1/shared_types.go
index ce1c4306..2f924a06 100644
--- a/apis/v1beta1/shared_types.go
+++ b/apis/v1beta1/shared_types.go
@@ -18,44 +18,16 @@ package v1beta1
 
 import v1 "sigs.k8s.io/gateway-api/apis/v1"
 
-// ParentReference identifies an API object (usually a Gateway) that can be considered
-// a parent of this resource (usually a route). The only kind of parent resource
-// with "Core" support is Gateway. This API may be extended in the future to
-// support additional kinds of parent resources, such as HTTPRoute.
-//
-// Note that there are specific rules for ParentRefs which cross namespace
-// boundaries. Cross-namespace references are only valid if they are explicitly
-// allowed by something in the namespace they are referring to. For example:
-// Gateway has the AllowedRoutes field, and ReferenceGrant provides a
-// generic way to enable any other kind of cross-namespace reference.
-//
-// The API object must be valid in the cluster; the Group and Kind must
-// be registered in the cluster for this reference to be valid.
-// +k8s:deepcopy-gen=false
 type ParentReference = v1.ParentReference
 
-// CommonRouteSpec defines the common attributes that all Routes MUST include
-// within their spec.
-// +k8s:deepcopy-gen=false
 type CommonRouteSpec = v1.CommonRouteSpec
 
-// PortNumber defines a network port.
 type PortNumber = v1.PortNumber
 
-// BackendRef defines how a Route should forward a request to a Kubernetes
-// resource.
-//
-// Note that when a namespace different than the local namespace is specified, a
-// ReferenceGrant object is required in the referent namespace to allow that
-// namespace's owner to accept the reference. See the ReferenceGrant
-// documentation for details.
-// +k8s:deepcopy-gen=false
 type BackendRef = v1.BackendRef
 
-// RouteConditionType is a type of condition for a route.
 type RouteConditionType = v1.RouteConditionType
 
-// RouteConditionReason is a reason for a route condition.
 type RouteConditionReason = v1.RouteConditionReason
 
 const (
@@ -140,214 +112,32 @@ const (
 	RouteReasonBackendNotFound RouteConditionReason = "BackendNotFound"
 )
 
-// RouteParentStatus describes the status of a route with respect to an
-// associated Parent.
-// +k8s:deepcopy-gen=false
 type RouteParentStatus = v1.RouteParentStatus
 
-// RouteStatus defines the common attributes that all Routes MUST include within
-// their status.
-// +k8s:deepcopy-gen=false
 type RouteStatus = v1.RouteStatus
 
-// Hostname is the fully qualified domain name of a network host. This matches
-// the RFC 1123 definition of a hostname with 2 notable exceptions:
-//
-//  1. IPs are not allowed.
-//  2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
-//     label must appear by itself as the first label.
-//
-// Hostname can be "precise" which is a domain name without the terminating
-// dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
-// domain name prefixed with a single wildcard label (e.g. `*.example.com`).
-//
-// Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
-// alphanumeric characters or '-', and must start and end with an alphanumeric
-// character. No other punctuation is allowed.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
 type Hostname = v1.Hostname
 
-// PreciseHostname is the fully qualified domain name of a network host. This
-// matches the RFC 1123 definition of a hostname with 1 notable exception that
-// numeric IP addresses are not allowed.
-//
-// Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
-// alphanumeric characters or '-', and must start and end with an alphanumeric
-// character. No other punctuation is allowed.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
 type PreciseHostname = v1.PreciseHostname
 
-// Group refers to a Kubernetes Group. It must either be an empty string or a
-// RFC 1123 subdomain.
-//
-// This validation is based off of the corresponding Kubernetes validation:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L208
-//
-// Valid values include:
-//
-// * "" - empty string implies core Kubernetes API group
-// * "networking.k8s.io"
-// * "foo.example.com"
-//
-// Invalid values include:
-//
-// * "example.com/bar" - "/" is an invalid character
-//
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
 type Group = v1.Group
 
-// Kind refers to a Kubernetes Kind.
-//
-// Valid values include:
-//
-// * "Service"
-// * "HTTPRoute"
-//
-// Invalid values include:
-//
-// * "invalid/kind" - "/" is an invalid character
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=63
-// +kubebuilder:validation:Pattern=`^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$`
 type Kind = v1.Kind
 
-// ObjectName refers to the name of a Kubernetes object.
-// Object names can have a variety of forms, including RFC 1123 subdomains,
-// RFC 1123 labels, or RFC 1035 labels.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
 type ObjectName = v1.ObjectName
 
-// Namespace refers to a Kubernetes namespace. It must be a RFC 1123 label.
-//
-// This validation is based off of the corresponding Kubernetes validation:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L187
-//
-// This is used for Namespace name validation here:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/api/validation/generic.go#L63
-//
-// Valid values include:
-//
-// * "example"
-//
-// Invalid values include:
-//
-// * "example.com" - "." is an invalid character
-//
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=63
 type Namespace = v1.Namespace
 
-// SectionName is the name of a section in a Kubernetes resource.
-//
-// In the following resources, SectionName is interpreted as the following:
-//
-// * Gateway: Listener name
-// * HTTPRoute: HTTPRouteRule name
-// * Service: Port name
-//
-// Section names can have a variety of forms, including RFC 1123 subdomains,
-// RFC 1123 labels, or RFC 1035 labels.
-//
-// This validation is based off of the corresponding Kubernetes validation:
-// https://github.com/kubernetes/apimachinery/blob/02cfb53916346d085a6c6c7c66f882e3c6b0eca6/pkg/util/validation/validation.go#L208
-//
-// Valid values include:
-//
-// * "example"
-// * "foo-example"
-// * "example.com"
-// * "foo.example.com"
-//
-// Invalid values include:
-//
-// * "example.com/bar" - "/" is an invalid character
-//
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
 type SectionName = v1.SectionName
 
-// GatewayController is the name of a Gateway API controller. It must be a
-// domain prefixed path.
-//
-// Valid values include:
-//
-// * "example.com/bar"
-//
-// Invalid values include:
-//
-// * "example.com" - must include path
-// * "foo.example.com" - must include path
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$`
 type GatewayController = v1.GatewayController
 
-// AnnotationKey is the key of an annotation in Gateway API. This is used for
-// validation of maps such as TLS options. This matches the Kubernetes
-// "qualified name" validation that is used for annotations and other common
-// values.
-//
-// Valid values include:
-//
-// * example
-// * example.com
-// * example.com/path
-// * example.com/path.html
-//
-// Invalid values include:
-//
-// * example~ - "~" is an invalid character
-// * example.com. - cannot start or end with "."
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]/?)*$`
 type AnnotationKey = v1.AnnotationKey
 
-// AnnotationValue is the value of an annotation in Gateway API. This is used
-// for validation of maps such as TLS options. This roughly matches Kubernetes
-// annotation validation, although the length validation in that case is based
-// on the entire size of the annotations struct.
-//
-// +kubebuilder:validation:MinLength=0
-// +kubebuilder:validation:MaxLength=4096
 type AnnotationValue = v1.AnnotationValue
 
-// AddressType defines how a network address is represented as a text string.
-// This may take two possible forms:
-//
-// * A predefined CamelCase string identifier (currently limited to `IPAddress` or `Hostname`)
-// * A domain-prefixed string identifier (like `acme.io/CustomAddressType`)
-//
-// Values `IPAddress` and `Hostname` have Extended support.
-//
-// The `NamedAddress` value has been deprecated in favor of implementation
-// specific domain-prefixed strings.
-//
-// All other values, including domain-prefixed values have Implementation-specific support,
-// which are used in implementation-specific behaviors. Support for additional
-// predefined CamelCase identifiers may be added in future releases.
-//
-// +kubebuilder:validation:MinLength=1
-// +kubebuilder:validation:MaxLength=253
-// +kubebuilder:validation:Pattern=`^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$`
 type AddressType = v1.AddressType
 
-// Duration is a string value representing a duration in time. The format is as specified
-// in GEP-2257, a strict subset of the syntax parsed by Golang time.ParseDuration.
 type Duration = v1.Duration
 
 const (
diff --git a/apisx/v1alpha1/shared_types.go b/apisx/v1alpha1/shared_types.go
index 848ff53b..94851df2 100644
--- a/apisx/v1alpha1/shared_types.go
+++ b/apisx/v1alpha1/shared_types.go
@@ -18,40 +18,24 @@ package v1alpha1
 
 import (
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
-	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 )
 
 type (
-	// +k8s:deepcopy-gen=false
-	AllowedRoutes = v1.AllowedRoutes
-	// +k8s:deepcopy-gen=false
-	ListenerTLSConfig = v1.ListenerTLSConfig
-	// +k8s:deepcopy-gen=false
-	Group = v1.Group
-	// +k8s:deepcopy-gen=false
-	Hostname = v1.Hostname
-	// +k8s:deepcopy-gen=false
-	Kind = v1.Kind
-	// +k8s:deepcopy-gen=false
-	ObjectName = v1.ObjectName
-	// +k8s:deepcopy-gen=false
-	PortNumber = v1.PortNumber
-	// +k8s:deepcopy-gen=false
-	ProtocolType = v1.ProtocolType
-	// +k8s:deepcopy-gen=false
-	RouteGroupKind = v1.RouteGroupKind
-	// +k8s:deepcopy-gen=false
-	SectionName = v1.SectionName
-	// +k8s:deepcopy-gen=false
-	Namespace = v1.Namespace
-	// +k8s:deepcopy-gen=false
-	Duration = v1.Duration
-	// +k8s:deepcopy-gen=false
-	PolicyStatus = v1alpha2.PolicyStatus
-	// +k8s:deepcopy-gen=false
-	LocalPolicyTargetReference = v1alpha2.LocalPolicyTargetReference
-	// +k8s:deepcopy-gen=false
-	SessionPersistence = v1.SessionPersistence
+	AllowedRoutes              = v1.AllowedRoutes
+	ListenerTLSConfig          = v1.ListenerTLSConfig
+	Group                      = v1.Group
+	Hostname                   = v1.Hostname
+	Kind                       = v1.Kind
+	ObjectName                 = v1.ObjectName
+	PortNumber                 = v1.PortNumber
+	ProtocolType               = v1.ProtocolType
+	RouteGroupKind             = v1.RouteGroupKind
+	SectionName                = v1.SectionName
+	Namespace                  = v1.Namespace
+	Duration                   = v1.Duration
+	PolicyStatus               = v1.PolicyStatus
+	LocalPolicyTargetReference = v1.LocalPolicyTargetReference
+	SessionPersistence         = v1.SessionPersistence
 )
 
 // ParentGatewayReference identifies an API object including its namespace,
diff --git a/apisx/v1alpha1/xmesh_types.go b/apisx/v1alpha1/xmesh_types.go
new file mode 100644
index 00000000..aa622df5
--- /dev/null
+++ b/apisx/v1alpha1/xmesh_types.go
@@ -0,0 +1,183 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	gatewayapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// +genclient
+// +genclient:nonNamespaced
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:categories=gateway-api,scope=Cluster,shortName=mesh
+// +kubebuilder:subresource:status
+// +kubebuilder:storageversion
+// +kubebuilder:printcolumn:name="Accepted",type=string,JSONPath=`.status.conditions[?(@.type=="Accepted")].status`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+
+// XMesh defines mesh-wide characteristics of a GAMMA-compliant service mesh.
+type XMesh struct {
+	metav1.TypeMeta `json:",inline"`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Spec defines the desired state of XMesh.
+	// +required
+	Spec MeshSpec `json:"spec"`
+
+	// Status defines the current state of XMesh.
+	//
+	// <gateway:util:excludeFromCRD>
+	// Implementations MUST populate status on all Mesh resources which
+	// specify their controller name.
+	// </gateway:util:excludeFromCRD>
+	//
+	// +kubebuilder:default={conditions: {{type: "Accepted", status: "Unknown", reason:"Pending", message:"Waiting for controller", lastTransitionTime: "1970-01-01T00:00:00Z"}}}
+	// +optional
+	Status MeshStatus `json:"status,omitempty"`
+}
+
+// MeshSpec defines the desired state of an XMesh.
+type MeshSpec struct {
+	// ControllerName is the name of a controller that is managing Gateway API
+	// resources for mesh traffic management. The value of this field MUST be a
+	// domain prefixed path.
+	//
+	// Example: "example.com/awesome-mesh".
+	//
+	// This field is not mutable and cannot be empty.
+	//
+	// Support: Core
+	//
+	// +kubebuilder:validation:XValidation:message="Value is immutable",rule="self == oldSelf"
+	// +required
+	ControllerName gatewayapiv1.GatewayController `json:"controllerName"`
+
+	// ParametersRef is an optional reference to a resource that contains
+	// implementation-specific configuration for this Mesh. If no
+	// implementation-specific parameters are needed, this field MUST be
+	// omitted.
+	//
+	// ParametersRef can reference a standard Kubernetes resource, i.e.
+	// ConfigMap, or an implementation-specific custom resource. The resource
+	// can be cluster-scoped or namespace-scoped.
+	//
+	// If the referent cannot be found, refers to an unsupported kind, or when
+	// the data within that resource is malformed, the Mesh MUST be rejected
+	// with the "Accepted" status condition set to "False" and an
+	// "InvalidParameters" reason.
+	//
+	// Support: Implementation-specific
+	//
+	// +optional
+	ParametersRef *gatewayapiv1.ParametersReference `json:"parametersRef,omitempty"`
+
+	// Description optionally provides a human-readable description of a Mesh.
+	//
+	// +kubebuilder:validation:MaxLength=64
+	// +optional
+	Description *string `json:"description,omitempty"`
+}
+
+// MeshConditionType is the type for status conditions on Mesh resources.
+// This type should be used with the MeshStatus.Conditions field.
+type MeshConditionType string
+
+// MeshConditionReason defines the set of reasons that explain why a
+// particular Mesh condition type has been raised.
+type MeshConditionReason string
+
+const (
+	// The "Accepted" condition indicates whether the Mesh has been accepted
+	// by the controller requested in the `spec.controllerName` field.
+	//
+	// This condition defaults to Unknown, and MUST be set by a controller
+	// when it sees a Mesh using its controller string. The status of this
+	// condition MUST be set to True if the controller will accept the Mesh
+	// resource. Otherwise, this status MUST be set to False. If the status is
+	// set to False, the controller MUST set a Message and Reason as an
+	// explanation.
+	//
+	// Possible reasons for this condition to be true are:
+	//
+	// * "Accepted"
+	//
+	// Possible reasons for this condition to be False are:
+	//
+	// * "InvalidParameters"
+	//
+	// Possible reasons for this condition to be Unknown are:
+	//
+	// * "Pending"
+	//
+	// Controllers should prefer to use the values of MeshConditionReason for
+	// the corresponding Reason, where appropriate.
+	MeshConditionAccepted MeshConditionType = "Accepted"
+
+	// This reason is used with the "Accepted" condition when the condition is
+	// true.
+	MeshReasonAccepted MeshConditionReason = "Accepted"
+
+	// This reason is used with the "Accepted" condition when the Mesh was not
+	// accepted because the parametersRef field refers to
+	//
+	// * a namespaced resource but the Namespace field is not set, or
+	// * a cluster-scoped resource but the Namespace field is set, or
+	// * a nonexistent object, or
+	// * an unsupported resource or kind, or
+	// * an existing resource but the data within that resource is malformed.
+	MeshReasonInvalidParameters MeshConditionReason = "InvalidParameters"
+
+	// This reason is used with the "Accepted" condition when the status is
+	// "Unknown" and the requested controller has not yet made a decision
+	// about whether to accept the Mesh. It is the default Reason on a new
+	// Mesh.
+	MeshReasonPending MeshConditionReason = "Pending"
+)
+
+// MeshStatus is the current status for the Mesh.
+type MeshStatus struct {
+	// Conditions is the current status from the controller for
+	// this Mesh.
+	//
+	// Controllers should prefer to publish conditions using values
+	// of MeshConditionType for the type of each Condition.
+	//
+	// +optional
+	// +listType=map
+	// +listMapKey=type
+	// +kubebuilder:validation:MaxItems=8
+	// +kubebuilder:default={{type: "Accepted", status: "Unknown", reason:"Pending", message:"Waiting for controller", lastTransitionTime: "1970-01-01T00:00:00Z"},{type: "Programmed", status: "Unknown", reason:"Pending", message:"Waiting for controller", lastTransitionTime: "1970-01-01T00:00:00Z"}}
+	Conditions []metav1.Condition `json:"conditions,omitempty"`
+
+	// SupportedFeatures is the set of features the Mesh support.
+	// It MUST be sorted in ascending alphabetical order by the Name key.
+	// +optional
+	// +listType=map
+	// +listMapKey=name
+	// +kubebuilder:validation:MaxItems=64
+	SupportedFeatures []gatewayapiv1.SupportedFeature `json:"supportedFeatures,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+type XMeshList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []XMesh `json:"items"`
+}
diff --git a/apisx/v1alpha1/zz_generated.deepcopy.go b/apisx/v1alpha1/zz_generated.deepcopy.go
index 802d3719..9e93ad9e 100644
--- a/apisx/v1alpha1/zz_generated.deepcopy.go
+++ b/apisx/v1alpha1/zz_generated.deepcopy.go
@@ -23,6 +23,7 @@ package v1alpha1
 import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
@@ -31,9 +32,7 @@ func (in *BackendTrafficPolicySpec) DeepCopyInto(out *BackendTrafficPolicySpec)
 	if in.TargetRefs != nil {
 		in, out := &in.TargetRefs, &out.TargetRefs
 		*out = make([]LocalPolicyTargetReference, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
+		copy(*out, *in)
 	}
 	if in.RetryConstraint != nil {
 		in, out := &in.RetryConstraint, &out.RetryConstraint
@@ -193,6 +192,58 @@ func (in *ListenerSetStatus) DeepCopy() *ListenerSetStatus {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *MeshSpec) DeepCopyInto(out *MeshSpec) {
+	*out = *in
+	if in.ParametersRef != nil {
+		in, out := &in.ParametersRef, &out.ParametersRef
+		*out = new(apisv1.ParametersReference)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Description != nil {
+		in, out := &in.Description, &out.Description
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MeshSpec.
+func (in *MeshSpec) DeepCopy() *MeshSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(MeshSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *MeshStatus) DeepCopyInto(out *MeshStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.SupportedFeatures != nil {
+		in, out := &in.SupportedFeatures, &out.SupportedFeatures
+		*out = make([]apisv1.SupportedFeature, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MeshStatus.
+func (in *MeshStatus) DeepCopy() *MeshStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(MeshStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ParentGatewayReference) DeepCopyInto(out *ParentGatewayReference) {
 	*out = *in
@@ -390,3 +441,62 @@ func (in *XListenerSetList) DeepCopyObject() runtime.Object {
 	}
 	return nil
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *XMesh) DeepCopyInto(out *XMesh) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new XMesh.
+func (in *XMesh) DeepCopy() *XMesh {
+	if in == nil {
+		return nil
+	}
+	out := new(XMesh)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *XMesh) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *XMeshList) DeepCopyInto(out *XMeshList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]XMesh, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new XMeshList.
+func (in *XMeshList) DeepCopy() *XMeshList {
+	if in == nil {
+		return nil
+	}
+	out := new(XMeshList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *XMeshList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
diff --git a/apisx/v1alpha1/zz_generated.register.go b/apisx/v1alpha1/zz_generated.register.go
index fc131e21..c3822b2c 100644
--- a/apisx/v1alpha1/zz_generated.register.go
+++ b/apisx/v1alpha1/zz_generated.register.go
@@ -65,6 +65,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&XBackendTrafficPolicyList{},
 		&XListenerSet{},
 		&XListenerSetList{},
+		&XMesh{},
+		&XMeshList{},
 	)
 	// AddToGroupVersion allows the serialization of client types like ListOptions.
 	v1.AddToGroupVersion(scheme, SchemeGroupVersion)
diff --git a/applyconfiguration/apis/v1/backendobjectreference.go b/applyconfiguration/apis/v1/backendobjectreference.go
index 58337304..5106b76c 100644
--- a/applyconfiguration/apis/v1/backendobjectreference.go
+++ b/applyconfiguration/apis/v1/backendobjectreference.go
@@ -29,7 +29,7 @@ type BackendObjectReferenceApplyConfiguration struct {
 	Kind      *apisv1.Kind       `json:"kind,omitempty"`
 	Name      *apisv1.ObjectName `json:"name,omitempty"`
 	Namespace *apisv1.Namespace  `json:"namespace,omitempty"`
-	Port      *apisv1.PortNumber `json:"port,omitempty"`
+	Port      *int32             `json:"port,omitempty"`
 }
 
 // BackendObjectReferenceApplyConfiguration constructs a declarative configuration of the BackendObjectReference type for use with
@@ -73,7 +73,7 @@ func (b *BackendObjectReferenceApplyConfiguration) WithNamespace(value apisv1.Na
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *BackendObjectReferenceApplyConfiguration) WithPort(value apisv1.PortNumber) *BackendObjectReferenceApplyConfiguration {
+func (b *BackendObjectReferenceApplyConfiguration) WithPort(value int32) *BackendObjectReferenceApplyConfiguration {
 	b.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/backendref.go b/applyconfiguration/apis/v1/backendref.go
index 838dd6f6..cac582c7 100644
--- a/applyconfiguration/apis/v1/backendref.go
+++ b/applyconfiguration/apis/v1/backendref.go
@@ -70,7 +70,7 @@ func (b *BackendRefApplyConfiguration) WithNamespace(value apisv1.Namespace) *Ba
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *BackendRefApplyConfiguration) WithPort(value apisv1.PortNumber) *BackendRefApplyConfiguration {
+func (b *BackendRefApplyConfiguration) WithPort(value int32) *BackendRefApplyConfiguration {
 	b.BackendObjectReferenceApplyConfiguration.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/backendtlspolicy.go b/applyconfiguration/apis/v1/backendtlspolicy.go
new file mode 100644
index 00000000..4b33502d
--- /dev/null
+++ b/applyconfiguration/apis/v1/backendtlspolicy.go
@@ -0,0 +1,281 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
+)
+
+// BackendTLSPolicyApplyConfiguration represents a declarative configuration of the BackendTLSPolicy type for use
+// with apply.
+type BackendTLSPolicyApplyConfiguration struct {
+	metav1.TypeMetaApplyConfiguration    `json:",inline"`
+	*metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                                 *BackendTLSPolicySpecApplyConfiguration `json:"spec,omitempty"`
+	Status                               *PolicyStatusApplyConfiguration         `json:"status,omitempty"`
+}
+
+// BackendTLSPolicy constructs a declarative configuration of the BackendTLSPolicy type for use with
+// apply.
+func BackendTLSPolicy(name, namespace string) *BackendTLSPolicyApplyConfiguration {
+	b := &BackendTLSPolicyApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("BackendTLSPolicy")
+	b.WithAPIVersion("gateway.networking.k8s.io/v1")
+	return b
+}
+
+// ExtractBackendTLSPolicy extracts the applied configuration owned by fieldManager from
+// backendTLSPolicy. If no managedFields are found in backendTLSPolicy for fieldManager, a
+// BackendTLSPolicyApplyConfiguration is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// backendTLSPolicy must be a unmodified BackendTLSPolicy API object that was retrieved from the Kubernetes API.
+// ExtractBackendTLSPolicy provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+// Experimental!
+func ExtractBackendTLSPolicy(backendTLSPolicy *apisv1.BackendTLSPolicy, fieldManager string) (*BackendTLSPolicyApplyConfiguration, error) {
+	return extractBackendTLSPolicy(backendTLSPolicy, fieldManager, "")
+}
+
+// ExtractBackendTLSPolicyStatus is the same as ExtractBackendTLSPolicy except
+// that it extracts the status subresource applied configuration.
+// Experimental!
+func ExtractBackendTLSPolicyStatus(backendTLSPolicy *apisv1.BackendTLSPolicy, fieldManager string) (*BackendTLSPolicyApplyConfiguration, error) {
+	return extractBackendTLSPolicy(backendTLSPolicy, fieldManager, "status")
+}
+
+func extractBackendTLSPolicy(backendTLSPolicy *apisv1.BackendTLSPolicy, fieldManager string, subresource string) (*BackendTLSPolicyApplyConfiguration, error) {
+	b := &BackendTLSPolicyApplyConfiguration{}
+	err := managedfields.ExtractInto(backendTLSPolicy, internal.Parser().Type("io.k8s.sigs.gateway-api.apis.v1.BackendTLSPolicy"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName(backendTLSPolicy.Name)
+	b.WithNamespace(backendTLSPolicy.Namespace)
+
+	b.WithKind("BackendTLSPolicy")
+	b.WithAPIVersion("gateway.networking.k8s.io/v1")
+	return b, nil
+}
+func (b BackendTLSPolicyApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *BackendTLSPolicyApplyConfiguration) WithKind(value string) *BackendTLSPolicyApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *BackendTLSPolicyApplyConfiguration) WithAPIVersion(value string) *BackendTLSPolicyApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *BackendTLSPolicyApplyConfiguration) WithName(value string) *BackendTLSPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *BackendTLSPolicyApplyConfiguration) WithGenerateName(value string) *BackendTLSPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *BackendTLSPolicyApplyConfiguration) WithNamespace(value string) *BackendTLSPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *BackendTLSPolicyApplyConfiguration) WithUID(value types.UID) *BackendTLSPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *BackendTLSPolicyApplyConfiguration) WithResourceVersion(value string) *BackendTLSPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *BackendTLSPolicyApplyConfiguration) WithGeneration(value int64) *BackendTLSPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *BackendTLSPolicyApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *BackendTLSPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *BackendTLSPolicyApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *BackendTLSPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *BackendTLSPolicyApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *BackendTLSPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *BackendTLSPolicyApplyConfiguration) WithLabels(entries map[string]string) *BackendTLSPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *BackendTLSPolicyApplyConfiguration) WithAnnotations(entries map[string]string) *BackendTLSPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *BackendTLSPolicyApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *BackendTLSPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *BackendTLSPolicyApplyConfiguration) WithFinalizers(values ...string) *BackendTLSPolicyApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *BackendTLSPolicyApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *BackendTLSPolicyApplyConfiguration) WithSpec(value *BackendTLSPolicySpecApplyConfiguration) *BackendTLSPolicyApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *BackendTLSPolicyApplyConfiguration) WithStatus(value *PolicyStatusApplyConfiguration) *BackendTLSPolicyApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *BackendTLSPolicyApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *BackendTLSPolicyApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *BackendTLSPolicyApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *BackendTLSPolicyApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1/backendtlspolicyspec.go b/applyconfiguration/apis/v1/backendtlspolicyspec.go
new file mode 100644
index 00000000..b6d8d972
--- /dev/null
+++ b/applyconfiguration/apis/v1/backendtlspolicyspec.go
@@ -0,0 +1,72 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// BackendTLSPolicySpecApplyConfiguration represents a declarative configuration of the BackendTLSPolicySpec type for use
+// with apply.
+type BackendTLSPolicySpecApplyConfiguration struct {
+	TargetRefs []LocalPolicyTargetReferenceWithSectionNameApplyConfiguration `json:"targetRefs,omitempty"`
+	Validation *BackendTLSPolicyValidationApplyConfiguration                 `json:"validation,omitempty"`
+	Options    map[apisv1.AnnotationKey]apisv1.AnnotationValue               `json:"options,omitempty"`
+}
+
+// BackendTLSPolicySpecApplyConfiguration constructs a declarative configuration of the BackendTLSPolicySpec type for use with
+// apply.
+func BackendTLSPolicySpec() *BackendTLSPolicySpecApplyConfiguration {
+	return &BackendTLSPolicySpecApplyConfiguration{}
+}
+
+// WithTargetRefs adds the given value to the TargetRefs field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the TargetRefs field.
+func (b *BackendTLSPolicySpecApplyConfiguration) WithTargetRefs(values ...*LocalPolicyTargetReferenceWithSectionNameApplyConfiguration) *BackendTLSPolicySpecApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithTargetRefs")
+		}
+		b.TargetRefs = append(b.TargetRefs, *values[i])
+	}
+	return b
+}
+
+// WithValidation sets the Validation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Validation field is set to the value of the last call.
+func (b *BackendTLSPolicySpecApplyConfiguration) WithValidation(value *BackendTLSPolicyValidationApplyConfiguration) *BackendTLSPolicySpecApplyConfiguration {
+	b.Validation = value
+	return b
+}
+
+// WithOptions puts the entries into the Options field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Options field,
+// overwriting an existing map entries in Options field with the same key.
+func (b *BackendTLSPolicySpecApplyConfiguration) WithOptions(entries map[apisv1.AnnotationKey]apisv1.AnnotationValue) *BackendTLSPolicySpecApplyConfiguration {
+	if b.Options == nil && len(entries) > 0 {
+		b.Options = make(map[apisv1.AnnotationKey]apisv1.AnnotationValue, len(entries))
+	}
+	for k, v := range entries {
+		b.Options[k] = v
+	}
+	return b
+}
diff --git a/applyconfiguration/apis/v1/backendtlspolicyvalidation.go b/applyconfiguration/apis/v1/backendtlspolicyvalidation.go
new file mode 100644
index 00000000..db18fc4e
--- /dev/null
+++ b/applyconfiguration/apis/v1/backendtlspolicyvalidation.go
@@ -0,0 +1,80 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// BackendTLSPolicyValidationApplyConfiguration represents a declarative configuration of the BackendTLSPolicyValidation type for use
+// with apply.
+type BackendTLSPolicyValidationApplyConfiguration struct {
+	CACertificateRefs       []LocalObjectReferenceApplyConfiguration `json:"caCertificateRefs,omitempty"`
+	WellKnownCACertificates *apisv1.WellKnownCACertificatesType      `json:"wellKnownCACertificates,omitempty"`
+	Hostname                *apisv1.PreciseHostname                  `json:"hostname,omitempty"`
+	SubjectAltNames         []SubjectAltNameApplyConfiguration       `json:"subjectAltNames,omitempty"`
+}
+
+// BackendTLSPolicyValidationApplyConfiguration constructs a declarative configuration of the BackendTLSPolicyValidation type for use with
+// apply.
+func BackendTLSPolicyValidation() *BackendTLSPolicyValidationApplyConfiguration {
+	return &BackendTLSPolicyValidationApplyConfiguration{}
+}
+
+// WithCACertificateRefs adds the given value to the CACertificateRefs field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the CACertificateRefs field.
+func (b *BackendTLSPolicyValidationApplyConfiguration) WithCACertificateRefs(values ...*LocalObjectReferenceApplyConfiguration) *BackendTLSPolicyValidationApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithCACertificateRefs")
+		}
+		b.CACertificateRefs = append(b.CACertificateRefs, *values[i])
+	}
+	return b
+}
+
+// WithWellKnownCACertificates sets the WellKnownCACertificates field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the WellKnownCACertificates field is set to the value of the last call.
+func (b *BackendTLSPolicyValidationApplyConfiguration) WithWellKnownCACertificates(value apisv1.WellKnownCACertificatesType) *BackendTLSPolicyValidationApplyConfiguration {
+	b.WellKnownCACertificates = &value
+	return b
+}
+
+// WithHostname sets the Hostname field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Hostname field is set to the value of the last call.
+func (b *BackendTLSPolicyValidationApplyConfiguration) WithHostname(value apisv1.PreciseHostname) *BackendTLSPolicyValidationApplyConfiguration {
+	b.Hostname = &value
+	return b
+}
+
+// WithSubjectAltNames adds the given value to the SubjectAltNames field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the SubjectAltNames field.
+func (b *BackendTLSPolicyValidationApplyConfiguration) WithSubjectAltNames(values ...*SubjectAltNameApplyConfiguration) *BackendTLSPolicyValidationApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithSubjectAltNames")
+		}
+		b.SubjectAltNames = append(b.SubjectAltNames, *values[i])
+	}
+	return b
+}
diff --git a/applyconfiguration/apis/v1/commonroutespec.go b/applyconfiguration/apis/v1/commonroutespec.go
index 00dcfe71..eb6ffdce 100644
--- a/applyconfiguration/apis/v1/commonroutespec.go
+++ b/applyconfiguration/apis/v1/commonroutespec.go
@@ -18,10 +18,15 @@ limitations under the License.
 
 package v1
 
+import (
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
 // CommonRouteSpecApplyConfiguration represents a declarative configuration of the CommonRouteSpec type for use
 // with apply.
 type CommonRouteSpecApplyConfiguration struct {
-	ParentRefs []ParentReferenceApplyConfiguration `json:"parentRefs,omitempty"`
+	ParentRefs         []ParentReferenceApplyConfiguration `json:"parentRefs,omitempty"`
+	UseDefaultGateways *apisv1.GatewayDefaultScope         `json:"useDefaultGateways,omitempty"`
 }
 
 // CommonRouteSpecApplyConfiguration constructs a declarative configuration of the CommonRouteSpec type for use with
@@ -42,3 +47,11 @@ func (b *CommonRouteSpecApplyConfiguration) WithParentRefs(values ...*ParentRefe
 	}
 	return b
 }
+
+// WithUseDefaultGateways sets the UseDefaultGateways field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UseDefaultGateways field is set to the value of the last call.
+func (b *CommonRouteSpecApplyConfiguration) WithUseDefaultGateways(value apisv1.GatewayDefaultScope) *CommonRouteSpecApplyConfiguration {
+	b.UseDefaultGateways = &value
+	return b
+}
diff --git a/applyconfiguration/apis/v1/gateway.go b/applyconfiguration/apis/v1/gateway.go
index 98ee1b9a..f8e8ef1c 100644
--- a/applyconfiguration/apis/v1/gateway.go
+++ b/applyconfiguration/apis/v1/gateway.go
@@ -82,6 +82,7 @@ func extractGateway(gateway *apisv1.Gateway, fieldManager string, subresource st
 	b.WithAPIVersion("gateway.networking.k8s.io/v1")
 	return b, nil
 }
+func (b GatewayApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -257,8 +258,24 @@ func (b *GatewayApplyConfiguration) WithStatus(value *GatewayStatusApplyConfigur
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *GatewayApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *GatewayApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *GatewayApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *GatewayApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1/gatewayclass.go b/applyconfiguration/apis/v1/gatewayclass.go
index fa6792f3..6decda5d 100644
--- a/applyconfiguration/apis/v1/gatewayclass.go
+++ b/applyconfiguration/apis/v1/gatewayclass.go
@@ -80,6 +80,7 @@ func extractGatewayClass(gatewayClass *apisv1.GatewayClass, fieldManager string,
 	b.WithAPIVersion("gateway.networking.k8s.io/v1")
 	return b, nil
 }
+func (b GatewayClassApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -255,8 +256,24 @@ func (b *GatewayClassApplyConfiguration) WithStatus(value *GatewayClassStatusApp
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *GatewayClassApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *GatewayClassApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *GatewayClassApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *GatewayClassApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1/gatewayspec.go b/applyconfiguration/apis/v1/gatewayspec.go
index e976dc48..a2736fb9 100644
--- a/applyconfiguration/apis/v1/gatewayspec.go
+++ b/applyconfiguration/apis/v1/gatewayspec.go
@@ -31,6 +31,7 @@ type GatewaySpecApplyConfiguration struct {
 	Infrastructure   *GatewayInfrastructureApplyConfiguration `json:"infrastructure,omitempty"`
 	AllowedListeners *AllowedListenersApplyConfiguration      `json:"allowedListeners,omitempty"`
 	TLS              *GatewayTLSConfigApplyConfiguration      `json:"tls,omitempty"`
+	DefaultScope     *apisv1.GatewayDefaultScope              `json:"defaultScope,omitempty"`
 }
 
 // GatewaySpecApplyConfiguration constructs a declarative configuration of the GatewaySpec type for use with
@@ -96,3 +97,11 @@ func (b *GatewaySpecApplyConfiguration) WithTLS(value *GatewayTLSConfigApplyConf
 	b.TLS = value
 	return b
 }
+
+// WithDefaultScope sets the DefaultScope field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DefaultScope field is set to the value of the last call.
+func (b *GatewaySpecApplyConfiguration) WithDefaultScope(value apisv1.GatewayDefaultScope) *GatewaySpecApplyConfiguration {
+	b.DefaultScope = &value
+	return b
+}
diff --git a/applyconfiguration/apis/v1/grpcbackendref.go b/applyconfiguration/apis/v1/grpcbackendref.go
index 75465480..7f9513b5 100644
--- a/applyconfiguration/apis/v1/grpcbackendref.go
+++ b/applyconfiguration/apis/v1/grpcbackendref.go
@@ -70,7 +70,7 @@ func (b *GRPCBackendRefApplyConfiguration) WithNamespace(value apisv1.Namespace)
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *GRPCBackendRefApplyConfiguration) WithPort(value apisv1.PortNumber) *GRPCBackendRefApplyConfiguration {
+func (b *GRPCBackendRefApplyConfiguration) WithPort(value int32) *GRPCBackendRefApplyConfiguration {
 	b.BackendObjectReferenceApplyConfiguration.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/grpcroute.go b/applyconfiguration/apis/v1/grpcroute.go
index d7e0568e..03297213 100644
--- a/applyconfiguration/apis/v1/grpcroute.go
+++ b/applyconfiguration/apis/v1/grpcroute.go
@@ -82,6 +82,7 @@ func extractGRPCRoute(gRPCRoute *apisv1.GRPCRoute, fieldManager string, subresou
 	b.WithAPIVersion("gateway.networking.k8s.io/v1")
 	return b, nil
 }
+func (b GRPCRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -257,8 +258,24 @@ func (b *GRPCRouteApplyConfiguration) WithStatus(value *GRPCRouteStatusApplyConf
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *GRPCRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *GRPCRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *GRPCRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *GRPCRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1/grpcroutespec.go b/applyconfiguration/apis/v1/grpcroutespec.go
index 00c567e5..bef93cad 100644
--- a/applyconfiguration/apis/v1/grpcroutespec.go
+++ b/applyconfiguration/apis/v1/grpcroutespec.go
@@ -49,6 +49,14 @@ func (b *GRPCRouteSpecApplyConfiguration) WithParentRefs(values ...*ParentRefere
 	return b
 }
 
+// WithUseDefaultGateways sets the UseDefaultGateways field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UseDefaultGateways field is set to the value of the last call.
+func (b *GRPCRouteSpecApplyConfiguration) WithUseDefaultGateways(value apisv1.GatewayDefaultScope) *GRPCRouteSpecApplyConfiguration {
+	b.CommonRouteSpecApplyConfiguration.UseDefaultGateways = &value
+	return b
+}
+
 // WithHostnames adds the given value to the Hostnames field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Hostnames field.
diff --git a/applyconfiguration/apis/v1/httpbackendref.go b/applyconfiguration/apis/v1/httpbackendref.go
index 28fda8dd..d935ce0a 100644
--- a/applyconfiguration/apis/v1/httpbackendref.go
+++ b/applyconfiguration/apis/v1/httpbackendref.go
@@ -70,7 +70,7 @@ func (b *HTTPBackendRefApplyConfiguration) WithNamespace(value apisv1.Namespace)
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *HTTPBackendRefApplyConfiguration) WithPort(value apisv1.PortNumber) *HTTPBackendRefApplyConfiguration {
+func (b *HTTPBackendRefApplyConfiguration) WithPort(value int32) *HTTPBackendRefApplyConfiguration {
 	b.BackendObjectReferenceApplyConfiguration.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/httprequestredirectfilter.go b/applyconfiguration/apis/v1/httprequestredirectfilter.go
index a9d82b90..7a2ea005 100644
--- a/applyconfiguration/apis/v1/httprequestredirectfilter.go
+++ b/applyconfiguration/apis/v1/httprequestredirectfilter.go
@@ -28,7 +28,7 @@ type HTTPRequestRedirectFilterApplyConfiguration struct {
 	Scheme     *string                             `json:"scheme,omitempty"`
 	Hostname   *apisv1.PreciseHostname             `json:"hostname,omitempty"`
 	Path       *HTTPPathModifierApplyConfiguration `json:"path,omitempty"`
-	Port       *apisv1.PortNumber                  `json:"port,omitempty"`
+	Port       *int32                              `json:"port,omitempty"`
 	StatusCode *int                                `json:"statusCode,omitempty"`
 }
 
@@ -65,7 +65,7 @@ func (b *HTTPRequestRedirectFilterApplyConfiguration) WithPath(value *HTTPPathMo
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *HTTPRequestRedirectFilterApplyConfiguration) WithPort(value apisv1.PortNumber) *HTTPRequestRedirectFilterApplyConfiguration {
+func (b *HTTPRequestRedirectFilterApplyConfiguration) WithPort(value int32) *HTTPRequestRedirectFilterApplyConfiguration {
 	b.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/httproute.go b/applyconfiguration/apis/v1/httproute.go
index 31863abd..e3e84916 100644
--- a/applyconfiguration/apis/v1/httproute.go
+++ b/applyconfiguration/apis/v1/httproute.go
@@ -82,6 +82,7 @@ func extractHTTPRoute(hTTPRoute *apisv1.HTTPRoute, fieldManager string, subresou
 	b.WithAPIVersion("gateway.networking.k8s.io/v1")
 	return b, nil
 }
+func (b HTTPRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -257,8 +258,24 @@ func (b *HTTPRouteApplyConfiguration) WithStatus(value *HTTPRouteStatusApplyConf
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *HTTPRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *HTTPRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *HTTPRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *HTTPRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1/httproutespec.go b/applyconfiguration/apis/v1/httproutespec.go
index 439ddbd9..15fb8bd9 100644
--- a/applyconfiguration/apis/v1/httproutespec.go
+++ b/applyconfiguration/apis/v1/httproutespec.go
@@ -49,6 +49,14 @@ func (b *HTTPRouteSpecApplyConfiguration) WithParentRefs(values ...*ParentRefere
 	return b
 }
 
+// WithUseDefaultGateways sets the UseDefaultGateways field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UseDefaultGateways field is set to the value of the last call.
+func (b *HTTPRouteSpecApplyConfiguration) WithUseDefaultGateways(value apisv1.GatewayDefaultScope) *HTTPRouteSpecApplyConfiguration {
+	b.CommonRouteSpecApplyConfiguration.UseDefaultGateways = &value
+	return b
+}
+
 // WithHostnames adds the given value to the Hostnames field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Hostnames field.
diff --git a/applyconfiguration/apis/v1/listener.go b/applyconfiguration/apis/v1/listener.go
index c7d3b080..29faef1b 100644
--- a/applyconfiguration/apis/v1/listener.go
+++ b/applyconfiguration/apis/v1/listener.go
@@ -27,7 +27,7 @@ import (
 type ListenerApplyConfiguration struct {
 	Name          *apisv1.SectionName                  `json:"name,omitempty"`
 	Hostname      *apisv1.Hostname                     `json:"hostname,omitempty"`
-	Port          *apisv1.PortNumber                   `json:"port,omitempty"`
+	Port          *int32                               `json:"port,omitempty"`
 	Protocol      *apisv1.ProtocolType                 `json:"protocol,omitempty"`
 	TLS           *ListenerTLSConfigApplyConfiguration `json:"tls,omitempty"`
 	AllowedRoutes *AllowedRoutesApplyConfiguration     `json:"allowedRoutes,omitempty"`
@@ -58,7 +58,7 @@ func (b *ListenerApplyConfiguration) WithHostname(value apisv1.Hostname) *Listen
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *ListenerApplyConfiguration) WithPort(value apisv1.PortNumber) *ListenerApplyConfiguration {
+func (b *ListenerApplyConfiguration) WithPort(value int32) *ListenerApplyConfiguration {
 	b.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/localpolicytargetreference.go b/applyconfiguration/apis/v1/localpolicytargetreference.go
new file mode 100644
index 00000000..2265b318
--- /dev/null
+++ b/applyconfiguration/apis/v1/localpolicytargetreference.go
@@ -0,0 +1,61 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// LocalPolicyTargetReferenceApplyConfiguration represents a declarative configuration of the LocalPolicyTargetReference type for use
+// with apply.
+type LocalPolicyTargetReferenceApplyConfiguration struct {
+	Group *apisv1.Group      `json:"group,omitempty"`
+	Kind  *apisv1.Kind       `json:"kind,omitempty"`
+	Name  *apisv1.ObjectName `json:"name,omitempty"`
+}
+
+// LocalPolicyTargetReferenceApplyConfiguration constructs a declarative configuration of the LocalPolicyTargetReference type for use with
+// apply.
+func LocalPolicyTargetReference() *LocalPolicyTargetReferenceApplyConfiguration {
+	return &LocalPolicyTargetReferenceApplyConfiguration{}
+}
+
+// WithGroup sets the Group field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Group field is set to the value of the last call.
+func (b *LocalPolicyTargetReferenceApplyConfiguration) WithGroup(value apisv1.Group) *LocalPolicyTargetReferenceApplyConfiguration {
+	b.Group = &value
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *LocalPolicyTargetReferenceApplyConfiguration) WithKind(value apisv1.Kind) *LocalPolicyTargetReferenceApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *LocalPolicyTargetReferenceApplyConfiguration) WithName(value apisv1.ObjectName) *LocalPolicyTargetReferenceApplyConfiguration {
+	b.Name = &value
+	return b
+}
diff --git a/applyconfiguration/apis/v1/localpolicytargetreferencewithsectionname.go b/applyconfiguration/apis/v1/localpolicytargetreferencewithsectionname.go
new file mode 100644
index 00000000..a46cb5c9
--- /dev/null
+++ b/applyconfiguration/apis/v1/localpolicytargetreferencewithsectionname.go
@@ -0,0 +1,68 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// LocalPolicyTargetReferenceWithSectionNameApplyConfiguration represents a declarative configuration of the LocalPolicyTargetReferenceWithSectionName type for use
+// with apply.
+type LocalPolicyTargetReferenceWithSectionNameApplyConfiguration struct {
+	LocalPolicyTargetReferenceApplyConfiguration `json:",inline"`
+	SectionName                                  *apisv1.SectionName `json:"sectionName,omitempty"`
+}
+
+// LocalPolicyTargetReferenceWithSectionNameApplyConfiguration constructs a declarative configuration of the LocalPolicyTargetReferenceWithSectionName type for use with
+// apply.
+func LocalPolicyTargetReferenceWithSectionName() *LocalPolicyTargetReferenceWithSectionNameApplyConfiguration {
+	return &LocalPolicyTargetReferenceWithSectionNameApplyConfiguration{}
+}
+
+// WithGroup sets the Group field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Group field is set to the value of the last call.
+func (b *LocalPolicyTargetReferenceWithSectionNameApplyConfiguration) WithGroup(value apisv1.Group) *LocalPolicyTargetReferenceWithSectionNameApplyConfiguration {
+	b.LocalPolicyTargetReferenceApplyConfiguration.Group = &value
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *LocalPolicyTargetReferenceWithSectionNameApplyConfiguration) WithKind(value apisv1.Kind) *LocalPolicyTargetReferenceWithSectionNameApplyConfiguration {
+	b.LocalPolicyTargetReferenceApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *LocalPolicyTargetReferenceWithSectionNameApplyConfiguration) WithName(value apisv1.ObjectName) *LocalPolicyTargetReferenceWithSectionNameApplyConfiguration {
+	b.LocalPolicyTargetReferenceApplyConfiguration.Name = &value
+	return b
+}
+
+// WithSectionName sets the SectionName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the SectionName field is set to the value of the last call.
+func (b *LocalPolicyTargetReferenceWithSectionNameApplyConfiguration) WithSectionName(value apisv1.SectionName) *LocalPolicyTargetReferenceWithSectionNameApplyConfiguration {
+	b.SectionName = &value
+	return b
+}
diff --git a/applyconfiguration/apis/v1/parentreference.go b/applyconfiguration/apis/v1/parentreference.go
index b0cb0652..6880ca6d 100644
--- a/applyconfiguration/apis/v1/parentreference.go
+++ b/applyconfiguration/apis/v1/parentreference.go
@@ -30,7 +30,7 @@ type ParentReferenceApplyConfiguration struct {
 	Namespace   *apisv1.Namespace   `json:"namespace,omitempty"`
 	Name        *apisv1.ObjectName  `json:"name,omitempty"`
 	SectionName *apisv1.SectionName `json:"sectionName,omitempty"`
-	Port        *apisv1.PortNumber  `json:"port,omitempty"`
+	Port        *int32              `json:"port,omitempty"`
 }
 
 // ParentReferenceApplyConfiguration constructs a declarative configuration of the ParentReference type for use with
@@ -82,7 +82,7 @@ func (b *ParentReferenceApplyConfiguration) WithSectionName(value apisv1.Section
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *ParentReferenceApplyConfiguration) WithPort(value apisv1.PortNumber) *ParentReferenceApplyConfiguration {
+func (b *ParentReferenceApplyConfiguration) WithPort(value int32) *ParentReferenceApplyConfiguration {
 	b.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1/policyancestorstatus.go b/applyconfiguration/apis/v1/policyancestorstatus.go
new file mode 100644
index 00000000..7eb9953f
--- /dev/null
+++ b/applyconfiguration/apis/v1/policyancestorstatus.go
@@ -0,0 +1,67 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	metav1 "k8s.io/client-go/applyconfigurations/meta/v1"
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// PolicyAncestorStatusApplyConfiguration represents a declarative configuration of the PolicyAncestorStatus type for use
+// with apply.
+type PolicyAncestorStatusApplyConfiguration struct {
+	AncestorRef    *ParentReferenceApplyConfiguration   `json:"ancestorRef,omitempty"`
+	ControllerName *apisv1.GatewayController            `json:"controllerName,omitempty"`
+	Conditions     []metav1.ConditionApplyConfiguration `json:"conditions,omitempty"`
+}
+
+// PolicyAncestorStatusApplyConfiguration constructs a declarative configuration of the PolicyAncestorStatus type for use with
+// apply.
+func PolicyAncestorStatus() *PolicyAncestorStatusApplyConfiguration {
+	return &PolicyAncestorStatusApplyConfiguration{}
+}
+
+// WithAncestorRef sets the AncestorRef field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the AncestorRef field is set to the value of the last call.
+func (b *PolicyAncestorStatusApplyConfiguration) WithAncestorRef(value *ParentReferenceApplyConfiguration) *PolicyAncestorStatusApplyConfiguration {
+	b.AncestorRef = value
+	return b
+}
+
+// WithControllerName sets the ControllerName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ControllerName field is set to the value of the last call.
+func (b *PolicyAncestorStatusApplyConfiguration) WithControllerName(value apisv1.GatewayController) *PolicyAncestorStatusApplyConfiguration {
+	b.ControllerName = &value
+	return b
+}
+
+// WithConditions adds the given value to the Conditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Conditions field.
+func (b *PolicyAncestorStatusApplyConfiguration) WithConditions(values ...*metav1.ConditionApplyConfiguration) *PolicyAncestorStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithConditions")
+		}
+		b.Conditions = append(b.Conditions, *values[i])
+	}
+	return b
+}
diff --git a/applyconfiguration/apis/v1/policystatus.go b/applyconfiguration/apis/v1/policystatus.go
new file mode 100644
index 00000000..64de9b41
--- /dev/null
+++ b/applyconfiguration/apis/v1/policystatus.go
@@ -0,0 +1,44 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// PolicyStatusApplyConfiguration represents a declarative configuration of the PolicyStatus type for use
+// with apply.
+type PolicyStatusApplyConfiguration struct {
+	Ancestors []PolicyAncestorStatusApplyConfiguration `json:"ancestors,omitempty"`
+}
+
+// PolicyStatusApplyConfiguration constructs a declarative configuration of the PolicyStatus type for use with
+// apply.
+func PolicyStatus() *PolicyStatusApplyConfiguration {
+	return &PolicyStatusApplyConfiguration{}
+}
+
+// WithAncestors adds the given value to the Ancestors field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Ancestors field.
+func (b *PolicyStatusApplyConfiguration) WithAncestors(values ...*PolicyAncestorStatusApplyConfiguration) *PolicyStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithAncestors")
+		}
+		b.Ancestors = append(b.Ancestors, *values[i])
+	}
+	return b
+}
diff --git a/applyconfiguration/apis/v1/subjectaltname.go b/applyconfiguration/apis/v1/subjectaltname.go
new file mode 100644
index 00000000..52278686
--- /dev/null
+++ b/applyconfiguration/apis/v1/subjectaltname.go
@@ -0,0 +1,61 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// SubjectAltNameApplyConfiguration represents a declarative configuration of the SubjectAltName type for use
+// with apply.
+type SubjectAltNameApplyConfiguration struct {
+	Type     *apisv1.SubjectAltNameType `json:"type,omitempty"`
+	Hostname *apisv1.Hostname           `json:"hostname,omitempty"`
+	URI      *apisv1.AbsoluteURI        `json:"uri,omitempty"`
+}
+
+// SubjectAltNameApplyConfiguration constructs a declarative configuration of the SubjectAltName type for use with
+// apply.
+func SubjectAltName() *SubjectAltNameApplyConfiguration {
+	return &SubjectAltNameApplyConfiguration{}
+}
+
+// WithType sets the Type field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Type field is set to the value of the last call.
+func (b *SubjectAltNameApplyConfiguration) WithType(value apisv1.SubjectAltNameType) *SubjectAltNameApplyConfiguration {
+	b.Type = &value
+	return b
+}
+
+// WithHostname sets the Hostname field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Hostname field is set to the value of the last call.
+func (b *SubjectAltNameApplyConfiguration) WithHostname(value apisv1.Hostname) *SubjectAltNameApplyConfiguration {
+	b.Hostname = &value
+	return b
+}
+
+// WithURI sets the URI field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the URI field is set to the value of the last call.
+func (b *SubjectAltNameApplyConfiguration) WithURI(value apisv1.AbsoluteURI) *SubjectAltNameApplyConfiguration {
+	b.URI = &value
+	return b
+}
diff --git a/applyconfiguration/apis/v1/tlsportconfig.go b/applyconfiguration/apis/v1/tlsportconfig.go
index bc9043a1..f19c7337 100644
--- a/applyconfiguration/apis/v1/tlsportconfig.go
+++ b/applyconfiguration/apis/v1/tlsportconfig.go
@@ -18,14 +18,10 @@ limitations under the License.
 
 package v1
 
-import (
-	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
-)
-
 // TLSPortConfigApplyConfiguration represents a declarative configuration of the TLSPortConfig type for use
 // with apply.
 type TLSPortConfigApplyConfiguration struct {
-	Port *apisv1.PortNumber           `json:"port,omitempty"`
+	Port *int32                       `json:"port,omitempty"`
 	TLS  *TLSConfigApplyConfiguration `json:"tls,omitempty"`
 }
 
@@ -38,7 +34,7 @@ func TLSPortConfig() *TLSPortConfigApplyConfiguration {
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *TLSPortConfigApplyConfiguration) WithPort(value apisv1.PortNumber) *TLSPortConfigApplyConfiguration {
+func (b *TLSPortConfigApplyConfiguration) WithPort(value int32) *TLSPortConfigApplyConfiguration {
 	b.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1alpha2/grpcroute.go b/applyconfiguration/apis/v1alpha2/grpcroute.go
index 89e1e21b..63010009 100644
--- a/applyconfiguration/apis/v1alpha2/grpcroute.go
+++ b/applyconfiguration/apis/v1alpha2/grpcroute.go
@@ -83,6 +83,7 @@ func extractGRPCRoute(gRPCRoute *apisv1alpha2.GRPCRoute, fieldManager string, su
 	b.WithAPIVersion("gateway.networking.k8s.io/v1alpha2")
 	return b, nil
 }
+func (b GRPCRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -258,8 +259,24 @@ func (b *GRPCRouteApplyConfiguration) WithStatus(value *apisv1.GRPCRouteStatusAp
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *GRPCRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *GRPCRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *GRPCRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *GRPCRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1alpha2/policystatus.go b/applyconfiguration/apis/v1alpha2/policystatus.go
index b7b158b2..c2df85f6 100644
--- a/applyconfiguration/apis/v1alpha2/policystatus.go
+++ b/applyconfiguration/apis/v1alpha2/policystatus.go
@@ -18,10 +18,14 @@ limitations under the License.
 
 package v1alpha2
 
+import (
+	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
+)
+
 // PolicyStatusApplyConfiguration represents a declarative configuration of the PolicyStatus type for use
 // with apply.
 type PolicyStatusApplyConfiguration struct {
-	Ancestors []PolicyAncestorStatusApplyConfiguration `json:"ancestors,omitempty"`
+	Ancestors []v1.PolicyAncestorStatusApplyConfiguration `json:"ancestors,omitempty"`
 }
 
 // PolicyStatusApplyConfiguration constructs a declarative configuration of the PolicyStatus type for use with
@@ -33,7 +37,7 @@ func PolicyStatus() *PolicyStatusApplyConfiguration {
 // WithAncestors adds the given value to the Ancestors field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Ancestors field.
-func (b *PolicyStatusApplyConfiguration) WithAncestors(values ...*PolicyAncestorStatusApplyConfiguration) *PolicyStatusApplyConfiguration {
+func (b *PolicyStatusApplyConfiguration) WithAncestors(values ...*v1.PolicyAncestorStatusApplyConfiguration) *PolicyStatusApplyConfiguration {
 	for i := range values {
 		if values[i] == nil {
 			panic("nil value passed to WithAncestors")
diff --git a/applyconfiguration/apis/v1alpha2/referencegrant.go b/applyconfiguration/apis/v1alpha2/referencegrant.go
index 032cf361..94c63566 100644
--- a/applyconfiguration/apis/v1alpha2/referencegrant.go
+++ b/applyconfiguration/apis/v1alpha2/referencegrant.go
@@ -82,6 +82,7 @@ func extractReferenceGrant(referenceGrant *apisv1alpha2.ReferenceGrant, fieldMan
 	b.WithAPIVersion("gateway.networking.k8s.io/v1alpha2")
 	return b, nil
 }
+func (b ReferenceGrantApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -249,8 +250,24 @@ func (b *ReferenceGrantApplyConfiguration) WithSpec(value *v1beta1.ReferenceGran
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *ReferenceGrantApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *ReferenceGrantApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *ReferenceGrantApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *ReferenceGrantApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1alpha2/tcproute.go b/applyconfiguration/apis/v1alpha2/tcproute.go
index 1984f6f9..036923a4 100644
--- a/applyconfiguration/apis/v1alpha2/tcproute.go
+++ b/applyconfiguration/apis/v1alpha2/tcproute.go
@@ -82,6 +82,7 @@ func extractTCPRoute(tCPRoute *apisv1alpha2.TCPRoute, fieldManager string, subre
 	b.WithAPIVersion("gateway.networking.k8s.io/v1alpha2")
 	return b, nil
 }
+func (b TCPRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -257,8 +258,24 @@ func (b *TCPRouteApplyConfiguration) WithStatus(value *TCPRouteStatusApplyConfig
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TCPRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TCPRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *TCPRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TCPRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1alpha2/tcproutespec.go b/applyconfiguration/apis/v1alpha2/tcproutespec.go
index 67b40cc7..1844749f 100644
--- a/applyconfiguration/apis/v1alpha2/tcproutespec.go
+++ b/applyconfiguration/apis/v1alpha2/tcproutespec.go
@@ -19,6 +19,7 @@ limitations under the License.
 package v1alpha2
 
 import (
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
 	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
@@ -48,6 +49,14 @@ func (b *TCPRouteSpecApplyConfiguration) WithParentRefs(values ...*v1.ParentRefe
 	return b
 }
 
+// WithUseDefaultGateways sets the UseDefaultGateways field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UseDefaultGateways field is set to the value of the last call.
+func (b *TCPRouteSpecApplyConfiguration) WithUseDefaultGateways(value apisv1.GatewayDefaultScope) *TCPRouteSpecApplyConfiguration {
+	b.CommonRouteSpecApplyConfiguration.UseDefaultGateways = &value
+	return b
+}
+
 // WithRules adds the given value to the Rules field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Rules field.
diff --git a/applyconfiguration/apis/v1alpha2/tlsroute.go b/applyconfiguration/apis/v1alpha2/tlsroute.go
index d427cde2..759e9eda 100644
--- a/applyconfiguration/apis/v1alpha2/tlsroute.go
+++ b/applyconfiguration/apis/v1alpha2/tlsroute.go
@@ -82,6 +82,7 @@ func extractTLSRoute(tLSRoute *apisv1alpha2.TLSRoute, fieldManager string, subre
 	b.WithAPIVersion("gateway.networking.k8s.io/v1alpha2")
 	return b, nil
 }
+func (b TLSRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -257,8 +258,24 @@ func (b *TLSRouteApplyConfiguration) WithStatus(value *TLSRouteStatusApplyConfig
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TLSRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TLSRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *TLSRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TLSRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1alpha2/tlsroutespec.go b/applyconfiguration/apis/v1alpha2/tlsroutespec.go
index 7a634a78..a5199e2e 100644
--- a/applyconfiguration/apis/v1alpha2/tlsroutespec.go
+++ b/applyconfiguration/apis/v1alpha2/tlsroutespec.go
@@ -50,6 +50,14 @@ func (b *TLSRouteSpecApplyConfiguration) WithParentRefs(values ...*v1.ParentRefe
 	return b
 }
 
+// WithUseDefaultGateways sets the UseDefaultGateways field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UseDefaultGateways field is set to the value of the last call.
+func (b *TLSRouteSpecApplyConfiguration) WithUseDefaultGateways(value apisv1.GatewayDefaultScope) *TLSRouteSpecApplyConfiguration {
+	b.CommonRouteSpecApplyConfiguration.UseDefaultGateways = &value
+	return b
+}
+
 // WithHostnames adds the given value to the Hostnames field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Hostnames field.
diff --git a/applyconfiguration/apis/v1alpha2/udproute.go b/applyconfiguration/apis/v1alpha2/udproute.go
index 2403b41f..67b23c0b 100644
--- a/applyconfiguration/apis/v1alpha2/udproute.go
+++ b/applyconfiguration/apis/v1alpha2/udproute.go
@@ -82,6 +82,7 @@ func extractUDPRoute(uDPRoute *apisv1alpha2.UDPRoute, fieldManager string, subre
 	b.WithAPIVersion("gateway.networking.k8s.io/v1alpha2")
 	return b, nil
 }
+func (b UDPRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -257,8 +258,24 @@ func (b *UDPRouteApplyConfiguration) WithStatus(value *UDPRouteStatusApplyConfig
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *UDPRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *UDPRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *UDPRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *UDPRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1alpha2/udproutespec.go b/applyconfiguration/apis/v1alpha2/udproutespec.go
index 2f07c51f..e7d0612f 100644
--- a/applyconfiguration/apis/v1alpha2/udproutespec.go
+++ b/applyconfiguration/apis/v1alpha2/udproutespec.go
@@ -19,6 +19,7 @@ limitations under the License.
 package v1alpha2
 
 import (
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
 	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
@@ -48,6 +49,14 @@ func (b *UDPRouteSpecApplyConfiguration) WithParentRefs(values ...*v1.ParentRefe
 	return b
 }
 
+// WithUseDefaultGateways sets the UseDefaultGateways field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UseDefaultGateways field is set to the value of the last call.
+func (b *UDPRouteSpecApplyConfiguration) WithUseDefaultGateways(value apisv1.GatewayDefaultScope) *UDPRouteSpecApplyConfiguration {
+	b.CommonRouteSpecApplyConfiguration.UseDefaultGateways = &value
+	return b
+}
+
 // WithRules adds the given value to the Rules field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Rules field.
diff --git a/applyconfiguration/apis/v1alpha3/backendtlspolicy.go b/applyconfiguration/apis/v1alpha3/backendtlspolicy.go
index 2892af15..9a8f8721 100644
--- a/applyconfiguration/apis/v1alpha3/backendtlspolicy.go
+++ b/applyconfiguration/apis/v1alpha3/backendtlspolicy.go
@@ -24,7 +24,7 @@ import (
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
 	apisv1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
-	v1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
@@ -33,8 +33,8 @@ import (
 type BackendTLSPolicyApplyConfiguration struct {
 	v1.TypeMetaApplyConfiguration    `json:",inline"`
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	Spec                             *BackendTLSPolicySpecApplyConfiguration  `json:"spec,omitempty"`
-	Status                           *v1alpha2.PolicyStatusApplyConfiguration `json:"status,omitempty"`
+	Spec                             *apisv1.BackendTLSPolicySpecApplyConfiguration `json:"spec,omitempty"`
+	Status                           *apisv1.PolicyStatusApplyConfiguration         `json:"status,omitempty"`
 }
 
 // BackendTLSPolicy constructs a declarative configuration of the BackendTLSPolicy type for use with
@@ -83,6 +83,7 @@ func extractBackendTLSPolicy(backendTLSPolicy *apisv1alpha3.BackendTLSPolicy, fi
 	b.WithAPIVersion("gateway.networking.k8s.io/v1alpha3")
 	return b, nil
 }
+func (b BackendTLSPolicyApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -245,7 +246,7 @@ func (b *BackendTLSPolicyApplyConfiguration) ensureObjectMetaApplyConfigurationE
 // WithSpec sets the Spec field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Spec field is set to the value of the last call.
-func (b *BackendTLSPolicyApplyConfiguration) WithSpec(value *BackendTLSPolicySpecApplyConfiguration) *BackendTLSPolicyApplyConfiguration {
+func (b *BackendTLSPolicyApplyConfiguration) WithSpec(value *apisv1.BackendTLSPolicySpecApplyConfiguration) *BackendTLSPolicyApplyConfiguration {
 	b.Spec = value
 	return b
 }
@@ -253,13 +254,29 @@ func (b *BackendTLSPolicyApplyConfiguration) WithSpec(value *BackendTLSPolicySpe
 // WithStatus sets the Status field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Status field is set to the value of the last call.
-func (b *BackendTLSPolicyApplyConfiguration) WithStatus(value *v1alpha2.PolicyStatusApplyConfiguration) *BackendTLSPolicyApplyConfiguration {
+func (b *BackendTLSPolicyApplyConfiguration) WithStatus(value *apisv1.PolicyStatusApplyConfiguration) *BackendTLSPolicyApplyConfiguration {
 	b.Status = value
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *BackendTLSPolicyApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *BackendTLSPolicyApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *BackendTLSPolicyApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *BackendTLSPolicyApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1alpha3/backendtlspolicyvalidation.go b/applyconfiguration/apis/v1alpha3/backendtlspolicyvalidation.go
index b0cf5bfa..50cd59b9 100644
--- a/applyconfiguration/apis/v1alpha3/backendtlspolicyvalidation.go
+++ b/applyconfiguration/apis/v1alpha3/backendtlspolicyvalidation.go
@@ -20,7 +20,6 @@ package v1alpha3
 
 import (
 	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
-	apisv1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
 	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 )
 
@@ -28,7 +27,7 @@ import (
 // with apply.
 type BackendTLSPolicyValidationApplyConfiguration struct {
 	CACertificateRefs       []v1.LocalObjectReferenceApplyConfiguration `json:"caCertificateRefs,omitempty"`
-	WellKnownCACertificates *apisv1alpha3.WellKnownCACertificatesType   `json:"wellKnownCACertificates,omitempty"`
+	WellKnownCACertificates *apisv1.WellKnownCACertificatesType         `json:"wellKnownCACertificates,omitempty"`
 	Hostname                *apisv1.PreciseHostname                     `json:"hostname,omitempty"`
 	SubjectAltNames         []SubjectAltNameApplyConfiguration          `json:"subjectAltNames,omitempty"`
 }
@@ -55,7 +54,7 @@ func (b *BackendTLSPolicyValidationApplyConfiguration) WithCACertificateRefs(val
 // WithWellKnownCACertificates sets the WellKnownCACertificates field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the WellKnownCACertificates field is set to the value of the last call.
-func (b *BackendTLSPolicyValidationApplyConfiguration) WithWellKnownCACertificates(value apisv1alpha3.WellKnownCACertificatesType) *BackendTLSPolicyValidationApplyConfiguration {
+func (b *BackendTLSPolicyValidationApplyConfiguration) WithWellKnownCACertificates(value apisv1.WellKnownCACertificatesType) *BackendTLSPolicyValidationApplyConfiguration {
 	b.WellKnownCACertificates = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1alpha3/subjectaltname.go b/applyconfiguration/apis/v1alpha3/subjectaltname.go
index 42823831..a024a62e 100644
--- a/applyconfiguration/apis/v1alpha3/subjectaltname.go
+++ b/applyconfiguration/apis/v1alpha3/subjectaltname.go
@@ -20,15 +20,14 @@ package v1alpha3
 
 import (
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
-	apisv1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
 )
 
 // SubjectAltNameApplyConfiguration represents a declarative configuration of the SubjectAltName type for use
 // with apply.
 type SubjectAltNameApplyConfiguration struct {
-	Type     *apisv1alpha3.SubjectAltNameType `json:"type,omitempty"`
-	Hostname *v1.Hostname                     `json:"hostname,omitempty"`
-	URI      *v1.AbsoluteURI                  `json:"uri,omitempty"`
+	Type     *v1.SubjectAltNameType `json:"type,omitempty"`
+	Hostname *v1.Hostname           `json:"hostname,omitempty"`
+	URI      *v1.AbsoluteURI        `json:"uri,omitempty"`
 }
 
 // SubjectAltNameApplyConfiguration constructs a declarative configuration of the SubjectAltName type for use with
@@ -40,7 +39,7 @@ func SubjectAltName() *SubjectAltNameApplyConfiguration {
 // WithType sets the Type field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Type field is set to the value of the last call.
-func (b *SubjectAltNameApplyConfiguration) WithType(value apisv1alpha3.SubjectAltNameType) *SubjectAltNameApplyConfiguration {
+func (b *SubjectAltNameApplyConfiguration) WithType(value v1.SubjectAltNameType) *SubjectAltNameApplyConfiguration {
 	b.Type = &value
 	return b
 }
diff --git a/applyconfiguration/apis/v1alpha3/tlsroute.go b/applyconfiguration/apis/v1alpha3/tlsroute.go
index ff65509c..766f654d 100644
--- a/applyconfiguration/apis/v1alpha3/tlsroute.go
+++ b/applyconfiguration/apis/v1alpha3/tlsroute.go
@@ -83,6 +83,7 @@ func extractTLSRoute(tLSRoute *apisv1alpha3.TLSRoute, fieldManager string, subre
 	b.WithAPIVersion("gateway.networking.k8s.io/v1alpha3")
 	return b, nil
 }
+func (b TLSRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -258,8 +259,24 @@ func (b *TLSRouteApplyConfiguration) WithStatus(value *v1alpha2.TLSRouteStatusAp
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *TLSRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *TLSRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *TLSRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *TLSRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1alpha3/tlsroutespec.go b/applyconfiguration/apis/v1alpha3/tlsroutespec.go
index 47c7e06f..4ca6b385 100644
--- a/applyconfiguration/apis/v1alpha3/tlsroutespec.go
+++ b/applyconfiguration/apis/v1alpha3/tlsroutespec.go
@@ -51,6 +51,14 @@ func (b *TLSRouteSpecApplyConfiguration) WithParentRefs(values ...*v1.ParentRefe
 	return b
 }
 
+// WithUseDefaultGateways sets the UseDefaultGateways field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UseDefaultGateways field is set to the value of the last call.
+func (b *TLSRouteSpecApplyConfiguration) WithUseDefaultGateways(value apisv1.GatewayDefaultScope) *TLSRouteSpecApplyConfiguration {
+	b.CommonRouteSpecApplyConfiguration.UseDefaultGateways = &value
+	return b
+}
+
 // WithHostnames adds the given value to the Hostnames field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Hostnames field.
diff --git a/applyconfiguration/apis/v1beta1/gateway.go b/applyconfiguration/apis/v1beta1/gateway.go
index 3b623558..cb504543 100644
--- a/applyconfiguration/apis/v1beta1/gateway.go
+++ b/applyconfiguration/apis/v1beta1/gateway.go
@@ -83,6 +83,7 @@ func extractGateway(gateway *apisv1beta1.Gateway, fieldManager string, subresour
 	b.WithAPIVersion("gateway.networking.k8s.io/v1beta1")
 	return b, nil
 }
+func (b GatewayApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -258,8 +259,24 @@ func (b *GatewayApplyConfiguration) WithStatus(value *apisv1.GatewayStatusApplyC
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *GatewayApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *GatewayApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *GatewayApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *GatewayApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1beta1/gatewayclass.go b/applyconfiguration/apis/v1beta1/gatewayclass.go
index d7cecd62..f4ecfeab 100644
--- a/applyconfiguration/apis/v1beta1/gatewayclass.go
+++ b/applyconfiguration/apis/v1beta1/gatewayclass.go
@@ -81,6 +81,7 @@ func extractGatewayClass(gatewayClass *apisv1beta1.GatewayClass, fieldManager st
 	b.WithAPIVersion("gateway.networking.k8s.io/v1beta1")
 	return b, nil
 }
+func (b GatewayClassApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -256,8 +257,24 @@ func (b *GatewayClassApplyConfiguration) WithStatus(value *apisv1.GatewayClassSt
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *GatewayClassApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *GatewayClassApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *GatewayClassApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *GatewayClassApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1beta1/httproute.go b/applyconfiguration/apis/v1beta1/httproute.go
index 18e2ca96..1bb7243e 100644
--- a/applyconfiguration/apis/v1beta1/httproute.go
+++ b/applyconfiguration/apis/v1beta1/httproute.go
@@ -83,6 +83,7 @@ func extractHTTPRoute(hTTPRoute *apisv1beta1.HTTPRoute, fieldManager string, sub
 	b.WithAPIVersion("gateway.networking.k8s.io/v1beta1")
 	return b, nil
 }
+func (b HTTPRouteApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -258,8 +259,24 @@ func (b *HTTPRouteApplyConfiguration) WithStatus(value *apisv1.HTTPRouteStatusAp
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *HTTPRouteApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *HTTPRouteApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *HTTPRouteApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *HTTPRouteApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apis/v1beta1/referencegrant.go b/applyconfiguration/apis/v1beta1/referencegrant.go
index 0ebd1cd1..e3fff69f 100644
--- a/applyconfiguration/apis/v1beta1/referencegrant.go
+++ b/applyconfiguration/apis/v1beta1/referencegrant.go
@@ -81,6 +81,7 @@ func extractReferenceGrant(referenceGrant *apisv1beta1.ReferenceGrant, fieldMana
 	b.WithAPIVersion("gateway.networking.k8s.io/v1beta1")
 	return b, nil
 }
+func (b ReferenceGrantApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -248,8 +249,24 @@ func (b *ReferenceGrantApplyConfiguration) WithSpec(value *ReferenceGrantSpecApp
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *ReferenceGrantApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *ReferenceGrantApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *ReferenceGrantApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *ReferenceGrantApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apisx/v1alpha1/backendtrafficpolicyspec.go b/applyconfiguration/apisx/v1alpha1/backendtrafficpolicyspec.go
index 205609b8..ec7a76b0 100644
--- a/applyconfiguration/apisx/v1alpha1/backendtrafficpolicyspec.go
+++ b/applyconfiguration/apisx/v1alpha1/backendtrafficpolicyspec.go
@@ -20,15 +20,14 @@ package v1alpha1
 
 import (
 	v1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
-	v1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
 )
 
 // BackendTrafficPolicySpecApplyConfiguration represents a declarative configuration of the BackendTrafficPolicySpec type for use
 // with apply.
 type BackendTrafficPolicySpecApplyConfiguration struct {
-	TargetRefs         []v1alpha2.LocalPolicyTargetReferenceApplyConfiguration `json:"targetRefs,omitempty"`
-	RetryConstraint    *RetryConstraintApplyConfiguration                      `json:"retryConstraint,omitempty"`
-	SessionPersistence *v1.SessionPersistenceApplyConfiguration                `json:"sessionPersistence,omitempty"`
+	TargetRefs         []v1.LocalPolicyTargetReferenceApplyConfiguration `json:"targetRefs,omitempty"`
+	RetryConstraint    *RetryConstraintApplyConfiguration                `json:"retryConstraint,omitempty"`
+	SessionPersistence *v1.SessionPersistenceApplyConfiguration          `json:"sessionPersistence,omitempty"`
 }
 
 // BackendTrafficPolicySpecApplyConfiguration constructs a declarative configuration of the BackendTrafficPolicySpec type for use with
@@ -40,7 +39,7 @@ func BackendTrafficPolicySpec() *BackendTrafficPolicySpecApplyConfiguration {
 // WithTargetRefs adds the given value to the TargetRefs field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the TargetRefs field.
-func (b *BackendTrafficPolicySpecApplyConfiguration) WithTargetRefs(values ...*v1alpha2.LocalPolicyTargetReferenceApplyConfiguration) *BackendTrafficPolicySpecApplyConfiguration {
+func (b *BackendTrafficPolicySpecApplyConfiguration) WithTargetRefs(values ...*v1.LocalPolicyTargetReferenceApplyConfiguration) *BackendTrafficPolicySpecApplyConfiguration {
 	for i := range values {
 		if values[i] == nil {
 			panic("nil value passed to WithTargetRefs")
diff --git a/applyconfiguration/apisx/v1alpha1/listenerentry.go b/applyconfiguration/apisx/v1alpha1/listenerentry.go
index b72cf4e0..d9f4dc9a 100644
--- a/applyconfiguration/apisx/v1alpha1/listenerentry.go
+++ b/applyconfiguration/apisx/v1alpha1/listenerentry.go
@@ -28,7 +28,7 @@ import (
 type ListenerEntryApplyConfiguration struct {
 	Name          *v1.SectionName                             `json:"name,omitempty"`
 	Hostname      *v1.Hostname                                `json:"hostname,omitempty"`
-	Port          *v1.PortNumber                              `json:"port,omitempty"`
+	Port          *int32                                      `json:"port,omitempty"`
 	Protocol      *v1.ProtocolType                            `json:"protocol,omitempty"`
 	TLS           *apisv1.ListenerTLSConfigApplyConfiguration `json:"tls,omitempty"`
 	AllowedRoutes *apisv1.AllowedRoutesApplyConfiguration     `json:"allowedRoutes,omitempty"`
@@ -59,7 +59,7 @@ func (b *ListenerEntryApplyConfiguration) WithHostname(value v1.Hostname) *Liste
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *ListenerEntryApplyConfiguration) WithPort(value v1.PortNumber) *ListenerEntryApplyConfiguration {
+func (b *ListenerEntryApplyConfiguration) WithPort(value int32) *ListenerEntryApplyConfiguration {
 	b.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apisx/v1alpha1/listenerentrystatus.go b/applyconfiguration/apisx/v1alpha1/listenerentrystatus.go
index 64d652a4..888f57d7 100644
--- a/applyconfiguration/apisx/v1alpha1/listenerentrystatus.go
+++ b/applyconfiguration/apisx/v1alpha1/listenerentrystatus.go
@@ -28,7 +28,7 @@ import (
 // with apply.
 type ListenerEntryStatusApplyConfiguration struct {
 	Name           *v1.SectionName                           `json:"name,omitempty"`
-	Port           *v1.PortNumber                            `json:"port,omitempty"`
+	Port           *int32                                    `json:"port,omitempty"`
 	SupportedKinds []apisv1.RouteGroupKindApplyConfiguration `json:"supportedKinds,omitempty"`
 	AttachedRoutes *int32                                    `json:"attachedRoutes,omitempty"`
 	Conditions     []metav1.ConditionApplyConfiguration      `json:"conditions,omitempty"`
@@ -51,7 +51,7 @@ func (b *ListenerEntryStatusApplyConfiguration) WithName(value v1.SectionName) *
 // WithPort sets the Port field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Port field is set to the value of the last call.
-func (b *ListenerEntryStatusApplyConfiguration) WithPort(value v1.PortNumber) *ListenerEntryStatusApplyConfiguration {
+func (b *ListenerEntryStatusApplyConfiguration) WithPort(value int32) *ListenerEntryStatusApplyConfiguration {
 	b.Port = &value
 	return b
 }
diff --git a/applyconfiguration/apisx/v1alpha1/meshspec.go b/applyconfiguration/apisx/v1alpha1/meshspec.go
new file mode 100644
index 00000000..df9d3ef8
--- /dev/null
+++ b/applyconfiguration/apisx/v1alpha1/meshspec.go
@@ -0,0 +1,62 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
+)
+
+// MeshSpecApplyConfiguration represents a declarative configuration of the MeshSpec type for use
+// with apply.
+type MeshSpecApplyConfiguration struct {
+	ControllerName *v1.GatewayController                         `json:"controllerName,omitempty"`
+	ParametersRef  *apisv1.ParametersReferenceApplyConfiguration `json:"parametersRef,omitempty"`
+	Description    *string                                       `json:"description,omitempty"`
+}
+
+// MeshSpecApplyConfiguration constructs a declarative configuration of the MeshSpec type for use with
+// apply.
+func MeshSpec() *MeshSpecApplyConfiguration {
+	return &MeshSpecApplyConfiguration{}
+}
+
+// WithControllerName sets the ControllerName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ControllerName field is set to the value of the last call.
+func (b *MeshSpecApplyConfiguration) WithControllerName(value v1.GatewayController) *MeshSpecApplyConfiguration {
+	b.ControllerName = &value
+	return b
+}
+
+// WithParametersRef sets the ParametersRef field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ParametersRef field is set to the value of the last call.
+func (b *MeshSpecApplyConfiguration) WithParametersRef(value *apisv1.ParametersReferenceApplyConfiguration) *MeshSpecApplyConfiguration {
+	b.ParametersRef = value
+	return b
+}
+
+// WithDescription sets the Description field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Description field is set to the value of the last call.
+func (b *MeshSpecApplyConfiguration) WithDescription(value string) *MeshSpecApplyConfiguration {
+	b.Description = &value
+	return b
+}
diff --git a/applyconfiguration/apisx/v1alpha1/meshstatus.go b/applyconfiguration/apisx/v1alpha1/meshstatus.go
new file mode 100644
index 00000000..fd1f9f9e
--- /dev/null
+++ b/applyconfiguration/apisx/v1alpha1/meshstatus.go
@@ -0,0 +1,63 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
+)
+
+// MeshStatusApplyConfiguration represents a declarative configuration of the MeshStatus type for use
+// with apply.
+type MeshStatusApplyConfiguration struct {
+	Conditions        []v1.ConditionApplyConfiguration            `json:"conditions,omitempty"`
+	SupportedFeatures []apisv1.SupportedFeatureApplyConfiguration `json:"supportedFeatures,omitempty"`
+}
+
+// MeshStatusApplyConfiguration constructs a declarative configuration of the MeshStatus type for use with
+// apply.
+func MeshStatus() *MeshStatusApplyConfiguration {
+	return &MeshStatusApplyConfiguration{}
+}
+
+// WithConditions adds the given value to the Conditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Conditions field.
+func (b *MeshStatusApplyConfiguration) WithConditions(values ...*v1.ConditionApplyConfiguration) *MeshStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithConditions")
+		}
+		b.Conditions = append(b.Conditions, *values[i])
+	}
+	return b
+}
+
+// WithSupportedFeatures adds the given value to the SupportedFeatures field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the SupportedFeatures field.
+func (b *MeshStatusApplyConfiguration) WithSupportedFeatures(values ...*apisv1.SupportedFeatureApplyConfiguration) *MeshStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithSupportedFeatures")
+		}
+		b.SupportedFeatures = append(b.SupportedFeatures, *values[i])
+	}
+	return b
+}
diff --git a/applyconfiguration/apisx/v1alpha1/xbackendtrafficpolicy.go b/applyconfiguration/apisx/v1alpha1/xbackendtrafficpolicy.go
index 427d5965..6e9de039 100644
--- a/applyconfiguration/apisx/v1alpha1/xbackendtrafficpolicy.go
+++ b/applyconfiguration/apisx/v1alpha1/xbackendtrafficpolicy.go
@@ -24,7 +24,7 @@ import (
 	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
 	apisxv1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
-	v1alpha2 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1alpha2"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
 	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
 )
 
@@ -34,7 +34,7 @@ type XBackendTrafficPolicyApplyConfiguration struct {
 	v1.TypeMetaApplyConfiguration    `json:",inline"`
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
 	Spec                             *BackendTrafficPolicySpecApplyConfiguration `json:"spec,omitempty"`
-	Status                           *v1alpha2.PolicyStatusApplyConfiguration    `json:"status,omitempty"`
+	Status                           *apisv1.PolicyStatusApplyConfiguration      `json:"status,omitempty"`
 }
 
 // XBackendTrafficPolicy constructs a declarative configuration of the XBackendTrafficPolicy type for use with
@@ -83,6 +83,7 @@ func extractXBackendTrafficPolicy(xBackendTrafficPolicy *apisxv1alpha1.XBackendT
 	b.WithAPIVersion("gateway.networking.x-k8s.io/v1alpha1")
 	return b, nil
 }
+func (b XBackendTrafficPolicyApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -253,13 +254,29 @@ func (b *XBackendTrafficPolicyApplyConfiguration) WithSpec(value *BackendTraffic
 // WithStatus sets the Status field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Status field is set to the value of the last call.
-func (b *XBackendTrafficPolicyApplyConfiguration) WithStatus(value *v1alpha2.PolicyStatusApplyConfiguration) *XBackendTrafficPolicyApplyConfiguration {
+func (b *XBackendTrafficPolicyApplyConfiguration) WithStatus(value *apisv1.PolicyStatusApplyConfiguration) *XBackendTrafficPolicyApplyConfiguration {
 	b.Status = value
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *XBackendTrafficPolicyApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *XBackendTrafficPolicyApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *XBackendTrafficPolicyApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *XBackendTrafficPolicyApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apisx/v1alpha1/xlistenerset.go b/applyconfiguration/apisx/v1alpha1/xlistenerset.go
index 75519a17..829f2d94 100644
--- a/applyconfiguration/apisx/v1alpha1/xlistenerset.go
+++ b/applyconfiguration/apisx/v1alpha1/xlistenerset.go
@@ -82,6 +82,7 @@ func extractXListenerSet(xListenerSet *apisxv1alpha1.XListenerSet, fieldManager
 	b.WithAPIVersion("gateway.networking.x-k8s.io/v1alpha1")
 	return b, nil
 }
+func (b XListenerSetApplyConfiguration) IsApplyConfiguration() {}
 
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
@@ -257,8 +258,24 @@ func (b *XListenerSetApplyConfiguration) WithStatus(value *ListenerSetStatusAppl
 	return b
 }
 
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *XListenerSetApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *XListenerSetApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
 // GetName retrieves the value of the Name field in the declarative configuration.
 func (b *XListenerSetApplyConfiguration) GetName() *string {
 	b.ensureObjectMetaApplyConfigurationExists()
 	return b.ObjectMetaApplyConfiguration.Name
 }
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *XListenerSetApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/apisx/v1alpha1/xmesh.go b/applyconfiguration/apisx/v1alpha1/xmesh.go
new file mode 100644
index 00000000..ca4dfe78
--- /dev/null
+++ b/applyconfiguration/apisx/v1alpha1/xmesh.go
@@ -0,0 +1,279 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+	internal "sigs.k8s.io/gateway-api/applyconfiguration/internal"
+)
+
+// XMeshApplyConfiguration represents a declarative configuration of the XMesh type for use
+// with apply.
+type XMeshApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *MeshSpecApplyConfiguration   `json:"spec,omitempty"`
+	Status                           *MeshStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// XMesh constructs a declarative configuration of the XMesh type for use with
+// apply.
+func XMesh(name string) *XMeshApplyConfiguration {
+	b := &XMeshApplyConfiguration{}
+	b.WithName(name)
+	b.WithKind("XMesh")
+	b.WithAPIVersion("gateway.networking.x-k8s.io/v1alpha1")
+	return b
+}
+
+// ExtractXMesh extracts the applied configuration owned by fieldManager from
+// xMesh. If no managedFields are found in xMesh for fieldManager, a
+// XMeshApplyConfiguration is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// xMesh must be a unmodified XMesh API object that was retrieved from the Kubernetes API.
+// ExtractXMesh provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+// Experimental!
+func ExtractXMesh(xMesh *apisxv1alpha1.XMesh, fieldManager string) (*XMeshApplyConfiguration, error) {
+	return extractXMesh(xMesh, fieldManager, "")
+}
+
+// ExtractXMeshStatus is the same as ExtractXMesh except
+// that it extracts the status subresource applied configuration.
+// Experimental!
+func ExtractXMeshStatus(xMesh *apisxv1alpha1.XMesh, fieldManager string) (*XMeshApplyConfiguration, error) {
+	return extractXMesh(xMesh, fieldManager, "status")
+}
+
+func extractXMesh(xMesh *apisxv1alpha1.XMesh, fieldManager string, subresource string) (*XMeshApplyConfiguration, error) {
+	b := &XMeshApplyConfiguration{}
+	err := managedfields.ExtractInto(xMesh, internal.Parser().Type("io.k8s.sigs.gateway-api.apisx.v1alpha1.XMesh"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName(xMesh.Name)
+
+	b.WithKind("XMesh")
+	b.WithAPIVersion("gateway.networking.x-k8s.io/v1alpha1")
+	return b, nil
+}
+func (b XMeshApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *XMeshApplyConfiguration) WithKind(value string) *XMeshApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *XMeshApplyConfiguration) WithAPIVersion(value string) *XMeshApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *XMeshApplyConfiguration) WithName(value string) *XMeshApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *XMeshApplyConfiguration) WithGenerateName(value string) *XMeshApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *XMeshApplyConfiguration) WithNamespace(value string) *XMeshApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *XMeshApplyConfiguration) WithUID(value types.UID) *XMeshApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *XMeshApplyConfiguration) WithResourceVersion(value string) *XMeshApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *XMeshApplyConfiguration) WithGeneration(value int64) *XMeshApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *XMeshApplyConfiguration) WithCreationTimestamp(value metav1.Time) *XMeshApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *XMeshApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *XMeshApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *XMeshApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *XMeshApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *XMeshApplyConfiguration) WithLabels(entries map[string]string) *XMeshApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *XMeshApplyConfiguration) WithAnnotations(entries map[string]string) *XMeshApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *XMeshApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *XMeshApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *XMeshApplyConfiguration) WithFinalizers(values ...string) *XMeshApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *XMeshApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *XMeshApplyConfiguration) WithSpec(value *MeshSpecApplyConfiguration) *XMeshApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *XMeshApplyConfiguration) WithStatus(value *MeshStatusApplyConfiguration) *XMeshApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *XMeshApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *XMeshApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *XMeshApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *XMeshApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/applyconfiguration/internal/internal.go b/applyconfiguration/internal/internal.go
index 974c4bd2..5fa65d15 100644
--- a/applyconfiguration/internal/internal.go
+++ b/applyconfiguration/internal/internal.go
@@ -22,7 +22,7 @@ import (
 	fmt "fmt"
 	sync "sync"
 
-	typed "sigs.k8s.io/structured-merge-diff/v4/typed"
+	typed "sigs.k8s.io/structured-merge-diff/v6/typed"
 )
 
 func Parser() *typed.Parser {
@@ -282,6 +282,67 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: weight
       type:
         scalar: numeric
+- name: io.k8s.sigs.gateway-api.apis.v1.BackendTLSPolicy
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
+      type:
+        namedType: io.k8s.sigs.gateway-api.apis.v1.BackendTLSPolicySpec
+      default: {}
+    - name: status
+      type:
+        namedType: io.k8s.sigs.gateway-api.apis.v1.PolicyStatus
+      default: {}
+- name: io.k8s.sigs.gateway-api.apis.v1.BackendTLSPolicySpec
+  map:
+    fields:
+    - name: options
+      type:
+        map:
+          elementType:
+            scalar: string
+    - name: targetRefs
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.sigs.gateway-api.apis.v1.LocalPolicyTargetReferenceWithSectionName
+          elementRelationship: atomic
+    - name: validation
+      type:
+        namedType: io.k8s.sigs.gateway-api.apis.v1.BackendTLSPolicyValidation
+      default: {}
+- name: io.k8s.sigs.gateway-api.apis.v1.BackendTLSPolicyValidation
+  map:
+    fields:
+    - name: caCertificateRefs
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.sigs.gateway-api.apis.v1.LocalObjectReference
+          elementRelationship: atomic
+    - name: hostname
+      type:
+        scalar: string
+      default: ""
+    - name: subjectAltNames
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.sigs.gateway-api.apis.v1.SubjectAltName
+          elementRelationship: atomic
+    - name: wellKnownCACertificates
+      type:
+        scalar: string
 - name: io.k8s.sigs.gateway-api.apis.v1.CookieConfig
   map:
     fields:
@@ -496,6 +557,9 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             namedType: io.k8s.sigs.gateway-api.apis.v1.GRPCRouteRule
           elementRelationship: atomic
+    - name: useDefaultGateways
+      type:
+        scalar: string
 - name: io.k8s.sigs.gateway-api.apis.v1.GRPCRouteStatus
   map:
     fields:
@@ -613,6 +677,9 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: allowedListeners
       type:
         namedType: io.k8s.sigs.gateway-api.apis.v1.AllowedListeners
+    - name: defaultScope
+      type:
+        scalar: string
     - name: gatewayClassName
       type:
         scalar: string
@@ -1045,6 +1112,9 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             namedType: io.k8s.sigs.gateway-api.apis.v1.HTTPRouteRule
           elementRelationship: atomic
+    - name: useDefaultGateways
+      type:
+        scalar: string
 - name: io.k8s.sigs.gateway-api.apis.v1.HTTPRouteStatus
   map:
     fields:
@@ -1177,6 +1247,39 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         scalar: string
       default: ""
+- name: io.k8s.sigs.gateway-api.apis.v1.LocalPolicyTargetReference
+  map:
+    fields:
+    - name: group
+      type:
+        scalar: string
+      default: ""
+    - name: kind
+      type:
+        scalar: string
+      default: ""
+    - name: name
+      type:
+        scalar: string
+      default: ""
+- name: io.k8s.sigs.gateway-api.apis.v1.LocalPolicyTargetReferenceWithSectionName
+  map:
+    fields:
+    - name: group
+      type:
+        scalar: string
+      default: ""
+    - name: kind
+      type:
+        scalar: string
+      default: ""
+    - name: name
+      type:
+        scalar: string
+      default: ""
+    - name: sectionName
+      type:
+        scalar: string
 - name: io.k8s.sigs.gateway-api.apis.v1.ObjectReference
   map:
     fields:
@@ -1235,6 +1338,34 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: sectionName
       type:
         scalar: string
+- name: io.k8s.sigs.gateway-api.apis.v1.PolicyAncestorStatus
+  map:
+    fields:
+    - name: ancestorRef
+      type:
+        namedType: io.k8s.sigs.gateway-api.apis.v1.ParentReference
+      default: {}
+    - name: conditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition
+          elementRelationship: associative
+          keys:
+          - type
+    - name: controllerName
+      type:
+        scalar: string
+      default: ""
+- name: io.k8s.sigs.gateway-api.apis.v1.PolicyStatus
+  map:
+    fields:
+    - name: ancestors
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.sigs.gateway-api.apis.v1.PolicyAncestorStatus
+          elementRelationship: atomic
 - name: io.k8s.sigs.gateway-api.apis.v1.RouteGroupKind
   map:
     fields:
@@ -1307,6 +1438,19 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: type
       type:
         scalar: string
+- name: io.k8s.sigs.gateway-api.apis.v1.SubjectAltName
+  map:
+    fields:
+    - name: hostname
+      type:
+        scalar: string
+    - name: type
+      type:
+        scalar: string
+      default: ""
+    - name: uri
+      type:
+        scalar: string
 - name: io.k8s.sigs.gateway-api.apis.v1.SupportedFeature
   map:
     fields:
@@ -1352,67 +1496,6 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         namedType: io.k8s.sigs.gateway-api.apis.v1.GRPCRouteStatus
       default: {}
-- name: io.k8s.sigs.gateway-api.apis.v1alpha2.LocalPolicyTargetReference
-  map:
-    fields:
-    - name: group
-      type:
-        scalar: string
-      default: ""
-    - name: kind
-      type:
-        scalar: string
-      default: ""
-    - name: name
-      type:
-        scalar: string
-      default: ""
-- name: io.k8s.sigs.gateway-api.apis.v1alpha2.LocalPolicyTargetReferenceWithSectionName
-  map:
-    fields:
-    - name: group
-      type:
-        scalar: string
-      default: ""
-    - name: kind
-      type:
-        scalar: string
-      default: ""
-    - name: name
-      type:
-        scalar: string
-      default: ""
-    - name: sectionName
-      type:
-        scalar: string
-- name: io.k8s.sigs.gateway-api.apis.v1alpha2.PolicyAncestorStatus
-  map:
-    fields:
-    - name: ancestorRef
-      type:
-        namedType: io.k8s.sigs.gateway-api.apis.v1.ParentReference
-      default: {}
-    - name: conditions
-      type:
-        list:
-          elementType:
-            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition
-          elementRelationship: associative
-          keys:
-          - type
-    - name: controllerName
-      type:
-        scalar: string
-      default: ""
-- name: io.k8s.sigs.gateway-api.apis.v1alpha2.PolicyStatus
-  map:
-    fields:
-    - name: ancestors
-      type:
-        list:
-          elementType:
-            namedType: io.k8s.sigs.gateway-api.apis.v1alpha2.PolicyAncestorStatus
-          elementRelationship: atomic
 - name: io.k8s.sigs.gateway-api.apis.v1alpha2.ReferenceGrant
   map:
     fields:
@@ -1478,6 +1561,9 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             namedType: io.k8s.sigs.gateway-api.apis.v1alpha2.TCPRouteRule
           elementRelationship: atomic
+    - name: useDefaultGateways
+      type:
+        scalar: string
 - name: io.k8s.sigs.gateway-api.apis.v1alpha2.TCPRouteStatus
   map:
     fields:
@@ -1541,6 +1627,9 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             namedType: io.k8s.sigs.gateway-api.apis.v1alpha2.TLSRouteRule
           elementRelationship: atomic
+    - name: useDefaultGateways
+      type:
+        scalar: string
 - name: io.k8s.sigs.gateway-api.apis.v1alpha2.TLSRouteStatus
   map:
     fields:
@@ -1598,6 +1687,9 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             namedType: io.k8s.sigs.gateway-api.apis.v1alpha2.UDPRouteRule
           elementRelationship: atomic
+    - name: useDefaultGateways
+      type:
+        scalar: string
 - name: io.k8s.sigs.gateway-api.apis.v1alpha2.UDPRouteStatus
   map:
     fields:
@@ -1622,65 +1714,12 @@ var schemaYAML = typed.YAMLObject(`types:
       default: {}
     - name: spec
       type:
-        namedType: io.k8s.sigs.gateway-api.apis.v1alpha3.BackendTLSPolicySpec
+        namedType: io.k8s.sigs.gateway-api.apis.v1.BackendTLSPolicySpec
       default: {}
     - name: status
       type:
-        namedType: io.k8s.sigs.gateway-api.apis.v1alpha2.PolicyStatus
-      default: {}
-- name: io.k8s.sigs.gateway-api.apis.v1alpha3.BackendTLSPolicySpec
-  map:
-    fields:
-    - name: options
-      type:
-        map:
-          elementType:
-            scalar: string
-    - name: targetRefs
-      type:
-        list:
-          elementType:
-            namedType: io.k8s.sigs.gateway-api.apis.v1alpha2.LocalPolicyTargetReferenceWithSectionName
-          elementRelationship: atomic
-    - name: validation
-      type:
-        namedType: io.k8s.sigs.gateway-api.apis.v1alpha3.BackendTLSPolicyValidation
+        namedType: io.k8s.sigs.gateway-api.apis.v1.PolicyStatus
       default: {}
-- name: io.k8s.sigs.gateway-api.apis.v1alpha3.BackendTLSPolicyValidation
-  map:
-    fields:
-    - name: caCertificateRefs
-      type:
-        list:
-          elementType:
-            namedType: io.k8s.sigs.gateway-api.apis.v1.LocalObjectReference
-          elementRelationship: atomic
-    - name: hostname
-      type:
-        scalar: string
-      default: ""
-    - name: subjectAltNames
-      type:
-        list:
-          elementType:
-            namedType: io.k8s.sigs.gateway-api.apis.v1alpha3.SubjectAltName
-          elementRelationship: atomic
-    - name: wellKnownCACertificates
-      type:
-        scalar: string
-- name: io.k8s.sigs.gateway-api.apis.v1alpha3.SubjectAltName
-  map:
-    fields:
-    - name: hostname
-      type:
-        scalar: string
-    - name: type
-      type:
-        scalar: string
-      default: ""
-    - name: uri
-      type:
-        scalar: string
 - name: io.k8s.sigs.gateway-api.apis.v1alpha3.TLSRoute
   map:
     fields:
@@ -1723,6 +1762,9 @@ var schemaYAML = typed.YAMLObject(`types:
           elementType:
             namedType: io.k8s.sigs.gateway-api.apis.v1alpha2.TLSRouteRule
           elementRelationship: atomic
+    - name: useDefaultGateways
+      type:
+        scalar: string
 - name: io.k8s.sigs.gateway-api.apis.v1beta1.Gateway
   map:
     fields:
@@ -1860,7 +1902,7 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         list:
           elementType:
-            namedType: io.k8s.sigs.gateway-api.apis.v1alpha2.LocalPolicyTargetReference
+            namedType: io.k8s.sigs.gateway-api.apis.v1.LocalPolicyTargetReference
           elementRelationship: associative
           keys:
           - group
@@ -1961,6 +2003,38 @@ var schemaYAML = typed.YAMLObject(`types:
           elementRelationship: associative
           keys:
           - name
+- name: io.k8s.sigs.gateway-api.apisx.v1alpha1.MeshSpec
+  map:
+    fields:
+    - name: controllerName
+      type:
+        scalar: string
+      default: ""
+    - name: description
+      type:
+        scalar: string
+    - name: parametersRef
+      type:
+        namedType: io.k8s.sigs.gateway-api.apis.v1.ParametersReference
+- name: io.k8s.sigs.gateway-api.apisx.v1alpha1.MeshStatus
+  map:
+    fields:
+    - name: conditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition
+          elementRelationship: associative
+          keys:
+          - type
+    - name: supportedFeatures
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.sigs.gateway-api.apis.v1.SupportedFeature
+          elementRelationship: associative
+          keys:
+          - name
 - name: io.k8s.sigs.gateway-api.apisx.v1alpha1.ParentGatewayReference
   map:
     fields:
@@ -2014,7 +2088,7 @@ var schemaYAML = typed.YAMLObject(`types:
       default: {}
     - name: status
       type:
-        namedType: io.k8s.sigs.gateway-api.apis.v1alpha2.PolicyStatus
+        namedType: io.k8s.sigs.gateway-api.apis.v1.PolicyStatus
       default: {}
 - name: io.k8s.sigs.gateway-api.apisx.v1alpha1.XListenerSet
   map:
@@ -2037,6 +2111,27 @@ var schemaYAML = typed.YAMLObject(`types:
       type:
         namedType: io.k8s.sigs.gateway-api.apisx.v1alpha1.ListenerSetStatus
       default: {}
+- name: io.k8s.sigs.gateway-api.apisx.v1alpha1.XMesh
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
+      type:
+        namedType: io.k8s.sigs.gateway-api.apisx.v1alpha1.MeshSpec
+      default: {}
+    - name: status
+      type:
+        namedType: io.k8s.sigs.gateway-api.apisx.v1alpha1.MeshStatus
+      default: {}
 - name: __untyped_atomic_
   scalar: untyped
   list:
diff --git a/applyconfiguration/utils.go b/applyconfiguration/utils.go
index 274736cd..23a89a00 100644
--- a/applyconfiguration/utils.go
+++ b/applyconfiguration/utils.go
@@ -21,7 +21,7 @@ package applyconfiguration
 import (
 	runtime "k8s.io/apimachinery/pkg/runtime"
 	schema "k8s.io/apimachinery/pkg/runtime/schema"
-	testing "k8s.io/client-go/testing"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
 	v1 "sigs.k8s.io/gateway-api/apis/v1"
 	v1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 	v1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
@@ -48,6 +48,12 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &apisv1.BackendObjectReferenceApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("BackendRef"):
 		return &apisv1.BackendRefApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("BackendTLSPolicy"):
+		return &apisv1.BackendTLSPolicyApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("BackendTLSPolicySpec"):
+		return &apisv1.BackendTLSPolicySpecApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("BackendTLSPolicyValidation"):
+		return &apisv1.BackendTLSPolicyValidationApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("CommonRouteSpec"):
 		return &apisv1.CommonRouteSpecApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("CookieConfig"):
@@ -156,12 +162,20 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &apisv1.LocalObjectReferenceApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("LocalParametersReference"):
 		return &apisv1.LocalParametersReferenceApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("LocalPolicyTargetReference"):
+		return &apisv1.LocalPolicyTargetReferenceApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("LocalPolicyTargetReferenceWithSectionName"):
+		return &apisv1.LocalPolicyTargetReferenceWithSectionNameApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("ObjectReference"):
 		return &apisv1.ObjectReferenceApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("ParametersReference"):
 		return &apisv1.ParametersReferenceApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("ParentReference"):
 		return &apisv1.ParentReferenceApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("PolicyAncestorStatus"):
+		return &apisv1.PolicyAncestorStatusApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("PolicyStatus"):
+		return &apisv1.PolicyStatusApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("RouteGroupKind"):
 		return &apisv1.RouteGroupKindApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("RouteNamespaces"):
@@ -174,6 +188,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &apisv1.SecretObjectReferenceApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("SessionPersistence"):
 		return &apisv1.SessionPersistenceApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("SubjectAltName"):
+		return &apisv1.SubjectAltNameApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("SupportedFeature"):
 		return &apisv1.SupportedFeatureApplyConfiguration{}
 	case v1.SchemeGroupVersion.WithKind("TLSConfig"):
@@ -184,14 +200,6 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		// Group=gateway.networking.k8s.io, Version=v1alpha2
 	case v1alpha2.SchemeGroupVersion.WithKind("GRPCRoute"):
 		return &apisv1alpha2.GRPCRouteApplyConfiguration{}
-	case v1alpha2.SchemeGroupVersion.WithKind("LocalPolicyTargetReference"):
-		return &apisv1alpha2.LocalPolicyTargetReferenceApplyConfiguration{}
-	case v1alpha2.SchemeGroupVersion.WithKind("LocalPolicyTargetReferenceWithSectionName"):
-		return &apisv1alpha2.LocalPolicyTargetReferenceWithSectionNameApplyConfiguration{}
-	case v1alpha2.SchemeGroupVersion.WithKind("PolicyAncestorStatus"):
-		return &apisv1alpha2.PolicyAncestorStatusApplyConfiguration{}
-	case v1alpha2.SchemeGroupVersion.WithKind("PolicyStatus"):
-		return &apisv1alpha2.PolicyStatusApplyConfiguration{}
 	case v1alpha2.SchemeGroupVersion.WithKind("ReferenceGrant"):
 		return &apisv1alpha2.ReferenceGrantApplyConfiguration{}
 	case v1alpha2.SchemeGroupVersion.WithKind("TCPRoute"):
@@ -222,12 +230,6 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		// Group=gateway.networking.k8s.io, Version=v1alpha3
 	case v1alpha3.SchemeGroupVersion.WithKind("BackendTLSPolicy"):
 		return &apisv1alpha3.BackendTLSPolicyApplyConfiguration{}
-	case v1alpha3.SchemeGroupVersion.WithKind("BackendTLSPolicySpec"):
-		return &apisv1alpha3.BackendTLSPolicySpecApplyConfiguration{}
-	case v1alpha3.SchemeGroupVersion.WithKind("BackendTLSPolicyValidation"):
-		return &apisv1alpha3.BackendTLSPolicyValidationApplyConfiguration{}
-	case v1alpha3.SchemeGroupVersion.WithKind("SubjectAltName"):
-		return &apisv1alpha3.SubjectAltNameApplyConfiguration{}
 	case v1alpha3.SchemeGroupVersion.WithKind("TLSRoute"):
 		return &apisv1alpha3.TLSRouteApplyConfiguration{}
 	case v1alpha3.SchemeGroupVersion.WithKind("TLSRouteSpec"):
@@ -262,6 +264,10 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &apisxv1alpha1.ListenerSetSpecApplyConfiguration{}
 	case v1alpha1.SchemeGroupVersion.WithKind("ListenerSetStatus"):
 		return &apisxv1alpha1.ListenerSetStatusApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("MeshSpec"):
+		return &apisxv1alpha1.MeshSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("MeshStatus"):
+		return &apisxv1alpha1.MeshStatusApplyConfiguration{}
 	case v1alpha1.SchemeGroupVersion.WithKind("ParentGatewayReference"):
 		return &apisxv1alpha1.ParentGatewayReferenceApplyConfiguration{}
 	case v1alpha1.SchemeGroupVersion.WithKind("RequestRate"):
@@ -272,11 +278,13 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &apisxv1alpha1.XBackendTrafficPolicyApplyConfiguration{}
 	case v1alpha1.SchemeGroupVersion.WithKind("XListenerSet"):
 		return &apisxv1alpha1.XListenerSetApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("XMesh"):
+		return &apisxv1alpha1.XMeshApplyConfiguration{}
 
 	}
 	return nil
 }
 
-func NewTypeConverter(scheme *runtime.Scheme) *testing.TypeConverter {
-	return &testing.TypeConverter{Scheme: scheme, TypeResolver: internal.Parser()}
+func NewTypeConverter(scheme *runtime.Scheme) managedfields.TypeConverter {
+	return managedfields.NewSchemeTypeConverter(scheme, internal.Parser())
 }
diff --git a/cmd/gepstoc/main.go b/cmd/gepstoc/main.go
new file mode 100644
index 00000000..7a186bde
--- /dev/null
+++ b/cmd/gepstoc/main.go
@@ -0,0 +1,174 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"bytes"
+	"flag"
+	"fmt"
+	"html/template"
+	"io/fs"
+	"log"
+	"os"
+	"path/filepath"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+
+	"sigs.k8s.io/yaml"
+
+	gep "sigs.k8s.io/gateway-api/pkg/gep"
+)
+
+var (
+	GEPSDir        string
+	MKDocsTemplate string
+	SkipGEPNumber  string
+)
+
+// Those are the GEPs that will be included in the final navigation bar
+// The order established below will be the order that the statuses will be shown
+var includeGEPStatus = []gep.GEPStatus{
+	gep.GEPStatusImplementable,
+	gep.GEPStatusExperimental,
+	gep.GEPStatusStandard,
+	gep.GEPStatusMemorandum,
+}
+
+type GEPArray []GEPList
+
+type GEPList struct {
+	GepType string
+	Geps    []uint
+}
+
+type TemplateData struct {
+	GEPData GEPArray
+}
+
+const kindDetails = "GEPDetails"
+
+func main() {
+	flag.StringVar(&GEPSDir, "g", "", "Defines the absolute path of the directory containing the GEPs")
+	flag.StringVar(&MKDocsTemplate, "t", "", "Defines the absolute path of mkdocs.yaml file")
+	flag.StringVar(&SkipGEPNumber, "s", "696", "Defines GEPs number to be skipped, should be comma-separated")
+	flag.Parse()
+
+	if GEPSDir == "" || MKDocsTemplate == "" {
+		log.Fatal("-g and -c are mandatory arguments")
+	}
+
+	if strings.Contains(SkipGEPNumber, " ") {
+		log.Fatal("-s flag should not contain spaces")
+	}
+
+	skipGep := strings.Split(SkipGEPNumber, ",")
+
+	geps, err := walkGEPs(GEPSDir, skipGep)
+	if err != nil {
+		panic(err)
+	}
+
+	tmpl, err := template.ParseFiles(MKDocsTemplate)
+	if err != nil {
+		log.Fatalf("error reading mkdocs template: %s", err)
+	}
+
+	tmplData := TemplateData{
+		GEPData: geps,
+	}
+
+	buf := &bytes.Buffer{}
+
+	if err := tmpl.Execute(buf, tmplData); err != nil {
+		panic(err)
+	}
+	fmt.Print(buf.String())
+}
+
+func walkGEPs(dir string, skipGEPs []string) (GEPArray, error) {
+	gepArray := make(GEPArray, 0)
+	tmpMap := make(map[gep.GEPStatus]GEPList)
+
+	err := filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return fmt.Errorf("error accessing %s: %w", path, err)
+		}
+		if d.IsDir() || d.Name() != "metadata.yaml" {
+			return nil
+		}
+
+		content, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+
+		gepDetail := &gep.GEPDetail{}
+		log.Printf("checking %s", path)
+		if err := yaml.Unmarshal(content, gepDetail); err != nil {
+			return err
+		}
+
+		if gepDetail.Kind != kindDetails {
+			return nil
+		}
+
+		// Skip the GEPs types we don't care
+		if !slices.Contains(includeGEPStatus, gepDetail.Status) {
+			return nil
+		}
+
+		// Skip the GEPs numbers we don't care
+		if slices.Contains(skipGEPs, strconv.FormatUint(uint64(gepDetail.Number), 10)) {
+			return nil
+		}
+
+		// Add the GEP to a map indexed by GEP types, so we can provide the sorted array
+		// easily later
+		_, ok := tmpMap[gepDetail.Status]
+		if !ok {
+			tmpMap[gepDetail.Status] = GEPList{
+				GepType: string(gepDetail.Status),
+				Geps:    make([]uint, 0),
+			}
+		}
+
+		item := tmpMap[gepDetail.Status]
+		item.Geps = append(item.Geps, gepDetail.Number)
+		tmpMap[gepDetail.Status] = item
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// Include the GEPs toc on the desired order
+	for _, v := range includeGEPStatus {
+		if geps, ok := tmpMap[v]; ok {
+			gepArray = append(gepArray, geps)
+		}
+	}
+
+	for i := range gepArray {
+		sort.SliceStable(gepArray[i].Geps, func(x, y int) bool {
+			return gepArray[i].Geps[x] < gepArray[i].Geps[y]
+		})
+	}
+
+	return gepArray, nil
+}
diff --git a/config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml b/config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml
index b5a05f1b..5f0de9ad 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   labels:
     gateway.networking.k8s.io/policy: Direct
   name: backendtlspolicies.gateway.networking.k8s.io
@@ -26,7 +25,7 @@ spec:
     - jsonPath: .metadata.creationTimestamp
       name: Age
       type: date
-    name: v1alpha3
+    name: v1
     schema:
       openAPIV3Schema:
         description: |-
@@ -93,6 +92,22 @@ spec:
                     be unique across all targetRef entries in the BackendTLSPolicy.
                   * They select different sectionNames in the same target.
 
+                  When more than one BackendTLSPolicy selects the same target and
+                  sectionName, implementations MUST determine precedence using the
+                  following criteria, continuing on ties:
+
+                  * The older policy by creation timestamp takes precedence. For
+                    example, a policy with a creation timestamp of "2021-07-15
+                    01:02:03" MUST be given precedence over a policy with a
+                    creation timestamp of "2021-07-15 01:02:04".
+                  * The policy appearing first in alphabetical order by {name}.
+                    For example, a policy named `bar` is given precedence over a
+                    policy named `baz`.
+
+                  For any BackendTLSPolicy that does not take precedence, the
+                  implementation MUST ensure the `Accepted` Condition is set to
+                  `status: False`, with Reason `Conflicted`.
+
                   Support: Extended for Kubernetes Service
 
                   Support: Implementation-specific for any other resource
@@ -257,7 +272,11 @@ spec:
                       backends:
 
                       1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
-                      2. Hostname MUST be used for authentication and MUST match the certificate served by the matching backend, unless SubjectAltNames is specified.
+                      2. Hostname MUST be used for authentication and MUST match the certificate
+                         served by the matching backend, unless SubjectAltNames is specified.
+                      3. If SubjectAltNames are specified, Hostname can be used for certificate selection
+                         but MUST NOT be used for authentication. If you want to use the value
+                         of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.
 
                       Support: Core
                     maxLength: 253
@@ -666,6 +685,667 @@ spec:
     storage: true
     subresources:
       status: {}
+  - deprecated: true
+    deprecationWarning: The v1alpha3 version of BackendTLSPolicy has been deprecated
+      and will be removed in a future release of the API. Please upgrade to v1.
+    name: v1alpha3
+    schema:
+      openAPIV3Schema:
+        description: |-
+          BackendTLSPolicy provides a way to configure how a Gateway
+          connects to a Backend via TLS.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec defines the desired state of BackendTLSPolicy.
+            properties:
+              options:
+                additionalProperties:
+                  description: |-
+                    AnnotationValue is the value of an annotation in Gateway API. This is used
+                    for validation of maps such as TLS options. This roughly matches Kubernetes
+                    annotation validation, although the length validation in that case is based
+                    on the entire size of the annotations struct.
+                  maxLength: 4096
+                  minLength: 0
+                  type: string
+                description: |-
+                  Options are a list of key/value pairs to enable extended TLS
+                  configuration for each implementation. For example, configuring the
+                  minimum TLS version or supported cipher suites.
+
+                  A set of common keys MAY be defined by the API in the future. To avoid
+                  any ambiguity, implementation-specific definitions MUST use
+                  domain-prefixed names, such as `example.com/my-custom-option`.
+                  Un-prefixed names are reserved for key names defined by Gateway API.
+
+                  Support: Implementation-specific
+                maxProperties: 16
+                type: object
+              targetRefs:
+                description: |-
+                  TargetRefs identifies an API object to apply the policy to.
+                  Only Services have Extended support. Implementations MAY support
+                  additional objects, with Implementation Specific support.
+                  Note that this config applies to the entire referenced resource
+                  by default, but this default may change in the future to provide
+                  a more granular application of the policy.
+
+                  TargetRefs must be _distinct_. This means either that:
+
+                  * They select different targets. If this is the case, then targetRef
+                    entries are distinct. In terms of fields, this means that the
+                    multi-part key defined by `group`, `kind`, and `name` must
+                    be unique across all targetRef entries in the BackendTLSPolicy.
+                  * They select different sectionNames in the same target.
+
+                  When more than one BackendTLSPolicy selects the same target and
+                  sectionName, implementations MUST determine precedence using the
+                  following criteria, continuing on ties:
+
+                  * The older policy by creation timestamp takes precedence. For
+                    example, a policy with a creation timestamp of "2021-07-15
+                    01:02:03" MUST be given precedence over a policy with a
+                    creation timestamp of "2021-07-15 01:02:04".
+                  * The policy appearing first in alphabetical order by {name}.
+                    For example, a policy named `bar` is given precedence over a
+                    policy named `baz`.
+
+                  For any BackendTLSPolicy that does not take precedence, the
+                  implementation MUST ensure the `Accepted` Condition is set to
+                  `status: False`, with Reason `Conflicted`.
+
+                  Support: Extended for Kubernetes Service
+
+                  Support: Implementation-specific for any other resource
+                items:
+                  description: |-
+                    LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a
+                    direct policy to. This should be used as part of Policy resources that can
+                    target single resources. For more information on how this policy attachment
+                    mode works, and a sample Policy resource, refer to the policy attachment
+                    documentation for Gateway API.
+
+                    Note: This should only be used for direct policy attachment when references
+                    to SectionName are actually needed. In all other cases,
+                    LocalPolicyTargetReference should be used.
+                  properties:
+                    group:
+                      description: Group is the group of the target resource.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    kind:
+                      description: Kind is kind of the target resource.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                      type: string
+                    name:
+                      description: Name is the name of the target resource.
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                    sectionName:
+                      description: |-
+                        SectionName is the name of a section within the target resource. When
+                        unspecified, this targetRef targets the entire resource. In the following
+                        resources, SectionName is interpreted as the following:
+
+                        * Gateway: Listener name
+                        * HTTPRoute: HTTPRouteRule name
+                        * Service: Port name
+
+                        If a SectionName is specified, but does not exist on the targeted object,
+                        the Policy must fail to attach, and the policy implementation should record
+                        a `ResolvedRefs` or similar Condition in the Policy's status.
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                  required:
+                  - group
+                  - kind
+                  - name
+                  type: object
+                maxItems: 16
+                minItems: 1
+                type: array
+                x-kubernetes-list-type: atomic
+                x-kubernetes-validations:
+                - message: sectionName must be specified when targetRefs includes
+                    2 or more references to the same target
+                  rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
+                    == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName
+                    == '''') == (!has(p2.sectionName) || p2.sectionName == ''''))
+                    : true))'
+                - message: sectionName must be unique when targetRefs includes 2 or
+                    more references to the same target
+                  rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
+                    == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) ||
+                    p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
+                    == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
+                    == p2.sectionName))))
+              validation:
+                description: Validation contains backend TLS validation configuration.
+                properties:
+                  caCertificateRefs:
+                    description: |-
+                      CACertificateRefs contains one or more references to Kubernetes objects that
+                      contain a PEM-encoded TLS CA certificate bundle, which is used to
+                      validate a TLS handshake between the Gateway and backend Pod.
+
+                      If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
+                      specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
+                      not both. If CACertificateRefs is empty or unspecified, the configuration for
+                      WellKnownCACertificates MUST be honored instead if supported by the implementation.
+
+                      A CACertificateRef is invalid if:
+
+                      * It refers to a resource that cannot be resolved (e.g., the referenced resource
+                        does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key
+                        named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`
+                        and the Message of the Condition must indicate which reference is invalid and why.
+
+                      * It refers to an unknown or unsupported kind of resource. In this case, the Reason
+                        must be set to `InvalidKind` and the Message of the Condition must explain which
+                        kind of resource is unknown or unsupported.
+
+                      * It refers to a resource in another namespace. This may change in future
+                        spec updates.
+
+                      Implementations MAY choose to perform further validation of the certificate
+                      content (e.g., checking expiry or enforcing specific formats). In such cases,
+                      an implementation-specific Reason and Message must be set for the invalid reference.
+
+                      In all cases, the implementation MUST ensure the `ResolvedRefs` Condition on
+                      the BackendTLSPolicy is set to `status: False`, with a Reason and Message
+                      that indicate the cause of the error. Connections using an invalid
+                      CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error
+                      response. If ALL CACertificateRefs are invalid, the implementation MUST also
+                      ensure the `Accepted` Condition on the BackendTLSPolicy is set to
+                      `status: False`, with a Reason `NoValidCACertificate`.
+
+                      A single CACertificateRef to a Kubernetes ConfigMap kind has "Core" support.
+                      Implementations MAY choose to support attaching multiple certificates to
+                      a backend, but this behavior is implementation-specific.
+
+                      Support: Core - An optional single reference to a Kubernetes ConfigMap,
+                      with the CA certificate in a key named `ca.crt`.
+
+                      Support: Implementation-specific - More than one reference, other kinds
+                      of resources, or a single reference that includes multiple certificates.
+                    items:
+                      description: |-
+                        LocalObjectReference identifies an API object within the namespace of the
+                        referrer.
+                        The API object must be valid in the cluster; the Group and Kind must
+                        be registered in the cluster for this reference to be valid.
+
+                        References to objects with invalid Group and Kind are not valid, and must
+                        be rejected by the implementation, with appropriate Conditions set
+                        on the containing object.
+                      properties:
+                        group:
+                          description: |-
+                            Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                            When unspecified or empty string, core API group is inferred.
+                          maxLength: 253
+                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                        kind:
+                          description: Kind is kind of the referent. For example "HTTPRoute"
+                            or "Service".
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                          type: string
+                        name:
+                          description: Name is the name of the referent.
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                      required:
+                      - group
+                      - kind
+                      - name
+                      type: object
+                    maxItems: 8
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  hostname:
+                    description: |-
+                      Hostname is used for two purposes in the connection between Gateways and
+                      backends:
+
+                      1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
+                      2. Hostname MUST be used for authentication and MUST match the certificate
+                         served by the matching backend, unless SubjectAltNames is specified.
+                      3. If SubjectAltNames are specified, Hostname can be used for certificate selection
+                         but MUST NOT be used for authentication. If you want to use the value
+                         of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.
+
+                      Support: Core
+                    maxLength: 253
+                    minLength: 1
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                    type: string
+                  subjectAltNames:
+                    description: |-
+                      SubjectAltNames contains one or more Subject Alternative Names.
+                      When specified the certificate served from the backend MUST
+                      have at least one Subject Alternate Name matching one of the specified SubjectAltNames.
+
+                      Support: Extended
+                    items:
+                      description: SubjectAltName represents Subject Alternative Name.
+                      properties:
+                        hostname:
+                          description: |-
+                            Hostname contains Subject Alternative Name specified in DNS name format.
+                            Required when Type is set to Hostname, ignored otherwise.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                        type:
+                          description: |-
+                            Type determines the format of the Subject Alternative Name. Always required.
+
+                            Support: Core
+                          enum:
+                          - Hostname
+                          - URI
+                          type: string
+                        uri:
+                          description: |-
+                            URI contains Subject Alternative Name specified in a full URI format.
+                            It MUST include both a scheme (e.g., "http" or "ftp") and a scheme-specific-part.
+                            Common values include SPIFFE IDs like "spiffe://mycluster.example.com/ns/myns/sa/svc1sa".
+                            Required when Type is set to URI, ignored otherwise.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                          type: string
+                      required:
+                      - type
+                      type: object
+                      x-kubernetes-validations:
+                      - message: SubjectAltName element must contain Hostname, if
+                          Type is set to Hostname
+                        rule: '!(self.type == "Hostname" && (!has(self.hostname) ||
+                          self.hostname == ""))'
+                      - message: SubjectAltName element must not contain Hostname,
+                          if Type is not set to Hostname
+                        rule: '!(self.type != "Hostname" && has(self.hostname) &&
+                          self.hostname != "")'
+                      - message: SubjectAltName element must contain URI, if Type
+                          is set to URI
+                        rule: '!(self.type == "URI" && (!has(self.uri) || self.uri
+                          == ""))'
+                      - message: SubjectAltName element must not contain URI, if Type
+                          is not set to URI
+                        rule: '!(self.type != "URI" && has(self.uri) && self.uri !=
+                          "")'
+                    maxItems: 5
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  wellKnownCACertificates:
+                    description: |-
+                      WellKnownCACertificates specifies whether system CA certificates may be used in
+                      the TLS handshake between the gateway and backend pod.
+
+                      If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
+                      must be specified with at least one entry for a valid configuration. Only one of
+                      CACertificateRefs or WellKnownCACertificates may be specified, not both.
+                      If an implementation does not support the WellKnownCACertificates field, or
+                      the supplied value is not recognized, the implementation MUST ensure the
+                      `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with
+                      a Reason `Invalid`.
+
+                      Support: Implementation-specific
+                    enum:
+                    - System
+                    type: string
+                required:
+                - hostname
+                type: object
+                x-kubernetes-validations:
+                - message: must not contain both CACertificateRefs and WellKnownCACertificates
+                  rule: '!(has(self.caCertificateRefs) && size(self.caCertificateRefs)
+                    > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates
+                    != "")'
+                - message: must specify either CACertificateRefs or WellKnownCACertificates
+                  rule: (has(self.caCertificateRefs) && size(self.caCertificateRefs)
+                    > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates
+                    != "")
+            required:
+            - targetRefs
+            - validation
+            type: object
+          status:
+            description: Status defines the current state of BackendTLSPolicy.
+            properties:
+              ancestors:
+                description: |-
+                  Ancestors is a list of ancestor resources (usually Gateways) that are
+                  associated with the policy, and the status of the policy with respect to
+                  each ancestor. When this policy attaches to a parent, the controller that
+                  manages the parent and the ancestors MUST add an entry to this list when
+                  the controller first sees the policy and SHOULD update the entry as
+                  appropriate when the relevant ancestor is modified.
+
+                  Note that choosing the relevant ancestor is left to the Policy designers;
+                  an important part of Policy design is designing the right object level at
+                  which to namespace this status.
+
+                  Note also that implementations MUST ONLY populate ancestor status for
+                  the Ancestor resources they are responsible for. Implementations MUST
+                  use the ControllerName field to uniquely identify the entries in this list
+                  that they are responsible for.
+
+                  Note that to achieve this, the list of PolicyAncestorStatus structs
+                  MUST be treated as a map with a composite key, made up of the AncestorRef
+                  and ControllerName fields combined.
+
+                  A maximum of 16 ancestors will be represented in this list. An empty list
+                  means the Policy is not relevant for any ancestors.
+
+                  If this slice is full, implementations MUST NOT add further entries.
+                  Instead they MUST consider the policy unimplementable and signal that
+                  on any related resources such as the ancestor that would be referenced
+                  here. For example, if this list was full on BackendTLSPolicy, no
+                  additional Gateways would be able to reference the Service targeted by
+                  the BackendTLSPolicy.
+                items:
+                  description: |-
+                    PolicyAncestorStatus describes the status of a route with respect to an
+                    associated Ancestor.
+
+                    Ancestors refer to objects that are either the Target of a policy or above it
+                    in terms of object hierarchy. For example, if a policy targets a Service, the
+                    Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
+                    the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
+                    useful object to place Policy status on, so we recommend that implementations
+                    SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
+                    have a _very_ good reason otherwise.
+
+                    In the context of policy attachment, the Ancestor is used to distinguish which
+                    resource results in a distinct application of this policy. For example, if a policy
+                    targets a Service, it may have a distinct result per attached Gateway.
+
+                    Policies targeting the same resource may have different effects depending on the
+                    ancestors of those resources. For example, different Gateways targeting the same
+                    Service may have different capabilities, especially if they have different underlying
+                    implementations.
+
+                    For example, in BackendTLSPolicy, the Policy attaches to a Service that is
+                    used as a backend in a HTTPRoute that is itself attached to a Gateway.
+                    In this case, the relevant object for status is the Gateway, and that is the
+                    ancestor object referred to in this status.
+
+                    Note that a parent is also an ancestor, so for objects where the parent is the
+                    relevant object for status, this struct SHOULD still be used.
+
+                    This struct is intended to be used in a slice that's effectively a map,
+                    with a composite key made up of the AncestorRef and the ControllerName.
+                  properties:
+                    ancestorRef:
+                      description: |-
+                        AncestorRef corresponds with a ParentRef in the spec that this
+                        PolicyAncestorStatus struct describes the status of.
+                      properties:
+                        group:
+                          default: gateway.networking.k8s.io
+                          description: |-
+                            Group is the group of the referent.
+                            When unspecified, "gateway.networking.k8s.io" is inferred.
+                            To set the core API group (such as for a "Service" kind referent),
+                            Group must be explicitly set to "" (empty string).
+
+                            Support: Core
+                          maxLength: 253
+                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                        kind:
+                          default: Gateway
+                          description: |-
+                            Kind is kind of the referent.
+
+                            There are two kinds of parent resources with "Core" support:
+
+                            * Gateway (Gateway conformance profile)
+                            * Service (Mesh conformance profile, ClusterIP Services only)
+
+                            Support for other resources is Implementation-Specific.
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                          type: string
+                        name:
+                          description: |-
+                            Name is the name of the referent.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                        namespace:
+                          description: |-
+                            Namespace is the namespace of the referent. When unspecified, this refers
+                            to the local namespace of the Route.
+
+                            Note that there are specific rules for ParentRefs which cross namespace
+                            boundaries. Cross-namespace references are only valid if they are explicitly
+                            allowed by something in the namespace they are referring to. For example:
+                            Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                            generic way to enable any other kind of cross-namespace reference.
+
+
+                            ParentRefs from a Route to a Service in the same namespace are "producer"
+                            routes, which apply default routing rules to inbound connections from
+                            any namespace to the Service.
+
+                            ParentRefs from a Route to a Service in a different namespace are
+                            "consumer" routes, and these routing rules are only applied to outbound
+                            connections originating from the same namespace as the Route, for which
+                            the intended destination of the connections are a Service targeted as a
+                            ParentRef of the Route.
+
+
+                            Support: Core
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                          type: string
+                        port:
+                          description: |-
+                            Port is the network port this Route targets. It can be interpreted
+                            differently based on the type of parent resource.
+
+                            When the parent resource is a Gateway, this targets all listeners
+                            listening on the specified port that also support this kind of Route(and
+                            select this Route). It's not recommended to set `Port` unless the
+                            networking behaviors specified in a Route must apply to a specific port
+                            as opposed to a listener(s) whose port(s) may be changed. When both Port
+                            and SectionName are specified, the name and port of the selected listener
+                            must match both specified values.
+
+
+                            When the parent resource is a Service, this targets a specific port in the
+                            Service spec. When both Port (experimental) and SectionName are specified,
+                            the name and port of the selected port must match both specified values.
+
+
+                            Implementations MAY choose to support other parent resources.
+                            Implementations supporting other types of parent resources MUST clearly
+                            document how/if Port is interpreted.
+
+                            For the purpose of status, an attachment is considered successful as
+                            long as the parent resource accepts it partially. For example, Gateway
+                            listeners can restrict which Routes can attach to them by Route kind,
+                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                            from the referencing Route, the Route MUST be considered successfully
+                            attached. If no Gateway listeners accept attachment from this Route,
+                            the Route MUST be considered detached from the Gateway.
+
+                            Support: Extended
+                          format: int32
+                          maximum: 65535
+                          minimum: 1
+                          type: integer
+                        sectionName:
+                          description: |-
+                            SectionName is the name of a section within the target resource. In the
+                            following resources, SectionName is interpreted as the following:
+
+                            * Gateway: Listener name. When both Port (experimental) and SectionName
+                            are specified, the name and port of the selected listener must match
+                            both specified values.
+                            * Service: Port name. When both Port (experimental) and SectionName
+                            are specified, the name and port of the selected listener must match
+                            both specified values.
+
+                            Implementations MAY choose to support attaching Routes to other resources.
+                            If that is the case, they MUST clearly document how SectionName is
+                            interpreted.
+
+                            When unspecified (empty string), this will reference the entire resource.
+                            For the purpose of status, an attachment is considered successful if at
+                            least one section in the parent resource accepts it. For example, Gateway
+                            listeners can restrict which Routes can attach to them by Route kind,
+                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                            the referencing Route, the Route MUST be considered successfully
+                            attached. If no Gateway listeners accept attachment from this Route, the
+                            Route MUST be considered detached from the Gateway.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                      required:
+                      - name
+                      type: object
+                    conditions:
+                      description: Conditions describes the status of the Policy with
+                        respect to the given Ancestor.
+                      items:
+                        description: Condition contains details for one aspect of
+                          the current state of this API Resource.
+                        properties:
+                          lastTransitionTime:
+                            description: |-
+                              lastTransitionTime is the last time the condition transitioned from one status to another.
+                              This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                            format: date-time
+                            type: string
+                          message:
+                            description: |-
+                              message is a human readable message indicating details about the transition.
+                              This may be an empty string.
+                            maxLength: 32768
+                            type: string
+                          observedGeneration:
+                            description: |-
+                              observedGeneration represents the .metadata.generation that the condition was set based upon.
+                              For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                              with respect to the current state of the instance.
+                            format: int64
+                            minimum: 0
+                            type: integer
+                          reason:
+                            description: |-
+                              reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                              Producers of specific condition types may define expected values and meanings for this field,
+                              and whether the values are considered a guaranteed API.
+                              The value should be a CamelCase string.
+                              This field may not be empty.
+                            maxLength: 1024
+                            minLength: 1
+                            pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                            type: string
+                          status:
+                            description: status of the condition, one of True, False,
+                              Unknown.
+                            enum:
+                            - "True"
+                            - "False"
+                            - Unknown
+                            type: string
+                          type:
+                            description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                            maxLength: 316
+                            pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                            type: string
+                        required:
+                        - lastTransitionTime
+                        - message
+                        - reason
+                        - status
+                        - type
+                        type: object
+                      maxItems: 8
+                      minItems: 1
+                      type: array
+                      x-kubernetes-list-map-keys:
+                      - type
+                      x-kubernetes-list-type: map
+                    controllerName:
+                      description: |-
+                        ControllerName is a domain/path string that indicates the name of the
+                        controller that wrote this status. This corresponds with the
+                        controllerName field on GatewayClass.
+
+                        Example: "example.net/gateway-controller".
+
+                        The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+                        valid Kubernetes names
+                        (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+
+                        Controllers MUST populate this field when writing status. Controllers should ensure that
+                        entries to status populated with their ControllerName are cleaned up when they are no
+                        longer necessary.
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                      type: string
+                  required:
+                  - ancestorRef
+                  - conditions
+                  - controllerName
+                  type: object
+                maxItems: 16
+                type: array
+                x-kubernetes-list-type: atomic
+            required:
+            - ancestors
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: false
 status:
   acceptedNames:
     kind: ""
diff --git a/config/crd/experimental/gateway.networking.k8s.io_gatewayclasses.yaml b/config/crd/experimental/gateway.networking.k8s.io_gatewayclasses.yaml
index 831fbf4a..ebdee857 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_gatewayclasses.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_gatewayclasses.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: gatewayclasses.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml b/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
index 6e154e95..1d271048 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: gateways.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -65,7 +64,7 @@ spec:
                   Addresses requested for this Gateway. This is optional and behavior can
                   depend on the implementation. If a value is set in the spec and the
                   requested address is invalid or unavailable, the implementation MUST
-                  indicate this in the associated entry in GatewayStatus.Addresses.
+                  indicate this in an associated entry in GatewayStatus.Conditions.
 
                   The Addresses field represents a request for the address(es) on the
                   "outside of the Gateway", that traffic bound for this Gateway will use.
@@ -120,20 +119,22 @@ spec:
                       type: string
                   type: object
                   x-kubernetes-validations:
-                  - message: Hostname value must only contain valid characters (matching
-                      ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
-                    rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
+                  - message: Hostname value must be empty or contain only valid characters
+                      (matching ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
+                    rule: 'self.type == ''Hostname'' ? (!has(self.value) || self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$""")):
                       true'
                 maxItems: 16
                 type: array
                 x-kubernetes-list-type: atomic
                 x-kubernetes-validations:
                 - message: IPAddress values must be unique
-                  rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
+                  rule: 'self.all(a1, a1.type == ''IPAddress'' && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
                 - message: Hostname values must be unique
-                  rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
+                  rule: 'self.all(a1, a1.type == ''Hostname''  && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
               allowedListeners:
                 description: |-
                   AllowedListeners defines which ListenerSets can be attached to this Gateway.
@@ -215,6 +216,29 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                 type: object
+              defaultScope:
+                description: |-
+                  DefaultScope, when set, configures the Gateway as a default Gateway,
+                  meaning it will dynamically and implicitly have Routes (e.g. HTTPRoute)
+                  attached to it, according to the scope configured here.
+
+                  If unset (the default) or set to None, the Gateway will not act as a
+                  default Gateway; if set, the Gateway will claim any Route with a
+                  matching scope set in its UseDefaultGateway field, subject to the usual
+                  rules about which routes the Gateway can attach to.
+
+                  Think carefully before using this functionality! While the normal rules
+                  about which Route can apply are still enforced, it is simply easier for
+                  the wrong Route to be accidentally attached to this Gateway in this
+                  configuration. If the Gateway operator is not also the operator in
+                  control of the scope (e.g. namespace) with tight controls and checks on
+                  what kind of workloads and Routes get added in that scope, we strongly
+                  recommend not using this just because it seems convenient, and instead
+                  stick to direct Route attachment.
+                enum:
+                - All
+                - None
+                type: string
               gatewayClassName:
                 description: |-
                   GatewayClassName used for this Gateway. This is the name of a
@@ -1617,7 +1641,7 @@ spec:
                   Addresses requested for this Gateway. This is optional and behavior can
                   depend on the implementation. If a value is set in the spec and the
                   requested address is invalid or unavailable, the implementation MUST
-                  indicate this in the associated entry in GatewayStatus.Addresses.
+                  indicate this in an associated entry in GatewayStatus.Conditions.
 
                   The Addresses field represents a request for the address(es) on the
                   "outside of the Gateway", that traffic bound for this Gateway will use.
@@ -1672,20 +1696,22 @@ spec:
                       type: string
                   type: object
                   x-kubernetes-validations:
-                  - message: Hostname value must only contain valid characters (matching
-                      ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
-                    rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
+                  - message: Hostname value must be empty or contain only valid characters
+                      (matching ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
+                    rule: 'self.type == ''Hostname'' ? (!has(self.value) || self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$""")):
                       true'
                 maxItems: 16
                 type: array
                 x-kubernetes-list-type: atomic
                 x-kubernetes-validations:
                 - message: IPAddress values must be unique
-                  rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
+                  rule: 'self.all(a1, a1.type == ''IPAddress'' && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
                 - message: Hostname values must be unique
-                  rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
+                  rule: 'self.all(a1, a1.type == ''Hostname''  && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
               allowedListeners:
                 description: |-
                   AllowedListeners defines which ListenerSets can be attached to this Gateway.
@@ -1767,6 +1793,29 @@ spec:
                         x-kubernetes-map-type: atomic
                     type: object
                 type: object
+              defaultScope:
+                description: |-
+                  DefaultScope, when set, configures the Gateway as a default Gateway,
+                  meaning it will dynamically and implicitly have Routes (e.g. HTTPRoute)
+                  attached to it, according to the scope configured here.
+
+                  If unset (the default) or set to None, the Gateway will not act as a
+                  default Gateway; if set, the Gateway will claim any Route with a
+                  matching scope set in its UseDefaultGateway field, subject to the usual
+                  rules about which routes the Gateway can attach to.
+
+                  Think carefully before using this functionality! While the normal rules
+                  about which Route can apply are still enforced, it is simply easier for
+                  the wrong Route to be accidentally attached to this Gateway in this
+                  configuration. If the Gateway operator is not also the operator in
+                  control of the scope (e.g. namespace) with tight controls and checks on
+                  what kind of workloads and Routes get added in that scope, we strongly
+                  recommend not using this just because it seems convenient, and instead
+                  stick to direct Route attachment.
+                enum:
+                - All
+                - None
+                type: string
               gatewayClassName:
                 description: |-
                   GatewayClassName used for this Gateway. This is the name of a
diff --git a/config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml
index 3a40ee23..a5a39bc7 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: grpcroutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -1939,6 +1938,24 @@ spec:
                 - message: Rule name must be unique within the route
                   rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                     && l1.name == l2.name))
+              useDefaultGateways:
+                description: |-
+                  UseDefaultGateways indicates the default Gateway scope to use for this
+                  Route. If unset (the default) or set to None, the Route will not be
+                  attached to any default Gateway; if set, it will be attached to any
+                  default Gateway supporting the named scope, subject to the usual rules
+                  about which Routes a Gateway is allowed to claim.
+
+                  Think carefully before using this functionality! The set of default
+                  Gateways supporting the requested scope can change over time without
+                  any notice to the Route author, and in many situations it will not be
+                  appropriate to request a default Gateway for a given Route -- for
+                  example, a Route with specific security requirements should almost
+                  certainly not use a default Gateway.
+                enum:
+                - All
+                - None
+                type: string
             type: object
           status:
             description: Status defines the current state of GRPCRoute.
diff --git a/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml
index 03293113..967501cb 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: httproutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -911,17 +910,12 @@ spec:
                                             AllowedRequestHeaders specifies what headers from the client request
                                             will be sent to the authorization server.
 
-                                            If this list is empty, then the following headers must be sent:
-
-                                            - `Authorization`
-                                            - `Location`
-                                            - `Proxy-Authenticate`
-                                            - `Set-Cookie`
-                                            - `WWW-Authenticate`
+                                            If this list is empty, then all headers must be sent.
 
                                             If the list has entries, only those entries must be sent.
                                           items:
                                             type: string
+                                          maxItems: 64
                                           type: array
                                           x-kubernetes-list-type: set
                                       type: object
@@ -960,6 +954,7 @@ spec:
                                             request must be set to the actual number of bytes forwarded.
                                           items:
                                             type: string
+                                          maxItems: 64
                                           type: array
                                           x-kubernetes-list-type: set
                                         allowedResponseHeaders:
@@ -971,6 +966,7 @@ spec:
                                             except Authority or Host must be copied.
                                           items:
                                             type: string
+                                          maxItems: 64
                                           type: array
                                           x-kubernetes-list-type: set
                                         path:
@@ -1464,6 +1460,9 @@ spec:
                                       enum:
                                       - 301
                                       - 302
+                                      - 303
+                                      - 307
+                                      - 308
                                       type: integer
                                   type: object
                                 responseHeaderModifier:
@@ -2397,17 +2396,12 @@ spec:
                                       AllowedRequestHeaders specifies what headers from the client request
                                       will be sent to the authorization server.
 
-                                      If this list is empty, then the following headers must be sent:
-
-                                      - `Authorization`
-                                      - `Location`
-                                      - `Proxy-Authenticate`
-                                      - `Set-Cookie`
-                                      - `WWW-Authenticate`
+                                      If this list is empty, then all headers must be sent.
 
                                       If the list has entries, only those entries must be sent.
                                     items:
                                       type: string
+                                    maxItems: 64
                                     type: array
                                     x-kubernetes-list-type: set
                                 type: object
@@ -2446,6 +2440,7 @@ spec:
                                       request must be set to the actual number of bytes forwarded.
                                     items:
                                       type: string
+                                    maxItems: 64
                                     type: array
                                     x-kubernetes-list-type: set
                                   allowedResponseHeaders:
@@ -2457,6 +2452,7 @@ spec:
                                       except Authority or Host must be copied.
                                     items:
                                       type: string
+                                    maxItems: 64
                                     type: array
                                     x-kubernetes-list-type: set
                                   path:
@@ -2946,6 +2942,9 @@ spec:
                                 enum:
                                 - 301
                                 - 302
+                                - 303
+                                - 307
+                                - 308
                                 type: integer
                             type: object
                           responseHeaderModifier:
@@ -3889,6 +3888,24 @@ spec:
                 - message: Rule name must be unique within the route
                   rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                     && l1.name == l2.name))
+              useDefaultGateways:
+                description: |-
+                  UseDefaultGateways indicates the default Gateway scope to use for this
+                  Route. If unset (the default) or set to None, the Route will not be
+                  attached to any default Gateway; if set, it will be attached to any
+                  default Gateway supporting the named scope, subject to the usual rules
+                  about which Routes a Gateway is allowed to claim.
+
+                  Think carefully before using this functionality! The set of default
+                  Gateways supporting the requested scope can change over time without
+                  any notice to the Route author, and in many situations it will not be
+                  appropriate to request a default Gateway for a given Route -- for
+                  example, a Route with specific security requirements should almost
+                  certainly not use a default Gateway.
+                enum:
+                - All
+                - None
+                type: string
             type: object
           status:
             description: Status defines the current state of HTTPRoute.
@@ -5063,17 +5080,12 @@ spec:
                                             AllowedRequestHeaders specifies what headers from the client request
                                             will be sent to the authorization server.
 
-                                            If this list is empty, then the following headers must be sent:
-
-                                            - `Authorization`
-                                            - `Location`
-                                            - `Proxy-Authenticate`
-                                            - `Set-Cookie`
-                                            - `WWW-Authenticate`
+                                            If this list is empty, then all headers must be sent.
 
                                             If the list has entries, only those entries must be sent.
                                           items:
                                             type: string
+                                          maxItems: 64
                                           type: array
                                           x-kubernetes-list-type: set
                                       type: object
@@ -5112,6 +5124,7 @@ spec:
                                             request must be set to the actual number of bytes forwarded.
                                           items:
                                             type: string
+                                          maxItems: 64
                                           type: array
                                           x-kubernetes-list-type: set
                                         allowedResponseHeaders:
@@ -5123,6 +5136,7 @@ spec:
                                             except Authority or Host must be copied.
                                           items:
                                             type: string
+                                          maxItems: 64
                                           type: array
                                           x-kubernetes-list-type: set
                                         path:
@@ -5616,6 +5630,9 @@ spec:
                                       enum:
                                       - 301
                                       - 302
+                                      - 303
+                                      - 307
+                                      - 308
                                       type: integer
                                   type: object
                                 responseHeaderModifier:
@@ -6549,17 +6566,12 @@ spec:
                                       AllowedRequestHeaders specifies what headers from the client request
                                       will be sent to the authorization server.
 
-                                      If this list is empty, then the following headers must be sent:
-
-                                      - `Authorization`
-                                      - `Location`
-                                      - `Proxy-Authenticate`
-                                      - `Set-Cookie`
-                                      - `WWW-Authenticate`
+                                      If this list is empty, then all headers must be sent.
 
                                       If the list has entries, only those entries must be sent.
                                     items:
                                       type: string
+                                    maxItems: 64
                                     type: array
                                     x-kubernetes-list-type: set
                                 type: object
@@ -6598,6 +6610,7 @@ spec:
                                       request must be set to the actual number of bytes forwarded.
                                     items:
                                       type: string
+                                    maxItems: 64
                                     type: array
                                     x-kubernetes-list-type: set
                                   allowedResponseHeaders:
@@ -6609,6 +6622,7 @@ spec:
                                       except Authority or Host must be copied.
                                     items:
                                       type: string
+                                    maxItems: 64
                                     type: array
                                     x-kubernetes-list-type: set
                                   path:
@@ -7098,6 +7112,9 @@ spec:
                                 enum:
                                 - 301
                                 - 302
+                                - 303
+                                - 307
+                                - 308
                                 type: integer
                             type: object
                           responseHeaderModifier:
@@ -8041,6 +8058,24 @@ spec:
                 - message: Rule name must be unique within the route
                   rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                     && l1.name == l2.name))
+              useDefaultGateways:
+                description: |-
+                  UseDefaultGateways indicates the default Gateway scope to use for this
+                  Route. If unset (the default) or set to None, the Route will not be
+                  attached to any default Gateway; if set, it will be attached to any
+                  default Gateway supporting the named scope, subject to the usual rules
+                  about which Routes a Gateway is allowed to claim.
+
+                  Think carefully before using this functionality! The set of default
+                  Gateways supporting the requested scope can change over time without
+                  any notice to the Route author, and in many situations it will not be
+                  appropriate to request a default Gateway for a given Route -- for
+                  example, a Route with specific security requirements should almost
+                  certainly not use a default Gateway.
+                enum:
+                - All
+                - None
+                type: string
             type: object
           status:
             description: Status defines the current state of HTTPRoute.
diff --git a/config/crd/experimental/gateway.networking.k8s.io_referencegrants.yaml b/config/crd/experimental/gateway.networking.k8s.io_referencegrants.yaml
index ac146b27..05336714 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_referencegrants.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_referencegrants.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: referencegrants.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml
index 9de08325..55d504b5 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: tcproutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -448,6 +447,24 @@ spec:
                 - message: Rule name must be unique within the route
                   rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                     && l1.name == l2.name))
+              useDefaultGateways:
+                description: |-
+                  UseDefaultGateways indicates the default Gateway scope to use for this
+                  Route. If unset (the default) or set to None, the Route will not be
+                  attached to any default Gateway; if set, it will be attached to any
+                  default Gateway supporting the named scope, subject to the usual rules
+                  about which Routes a Gateway is allowed to claim.
+
+                  Think carefully before using this functionality! The set of default
+                  Gateways supporting the requested scope can change over time without
+                  any notice to the Route author, and in many situations it will not be
+                  appropriate to request a default Gateway for a given Route -- for
+                  example, a Route with specific security requirements should almost
+                  certainly not use a default Gateway.
+                enum:
+                - All
+                - None
+                type: string
             required:
             - rules
             type: object
diff --git a/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml
index dce65f87..c3cb1792 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: tlsroutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -512,6 +511,24 @@ spec:
                 - message: Rule name must be unique within the route
                   rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                     && l1.name == l2.name))
+              useDefaultGateways:
+                description: |-
+                  UseDefaultGateways indicates the default Gateway scope to use for this
+                  Route. If unset (the default) or set to None, the Route will not be
+                  attached to any default Gateway; if set, it will be attached to any
+                  default Gateway supporting the named scope, subject to the usual rules
+                  about which Routes a Gateway is allowed to claim.
+
+                  Think carefully before using this functionality! The set of default
+                  Gateways supporting the requested scope can change over time without
+                  any notice to the Route author, and in many situations it will not be
+                  appropriate to request a default Gateway for a given Route -- for
+                  example, a Route with specific security requirements should almost
+                  certainly not use a default Gateway.
+                enum:
+                - All
+                - None
+                type: string
             required:
             - rules
             type: object
@@ -1290,6 +1307,24 @@ spec:
                 - message: Rule name must be unique within the route
                   rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                     && l1.name == l2.name))
+              useDefaultGateways:
+                description: |-
+                  UseDefaultGateways indicates the default Gateway scope to use for this
+                  Route. If unset (the default) or set to None, the Route will not be
+                  attached to any default Gateway; if set, it will be attached to any
+                  default Gateway supporting the named scope, subject to the usual rules
+                  about which Routes a Gateway is allowed to claim.
+
+                  Think carefully before using this functionality! The set of default
+                  Gateways supporting the requested scope can change over time without
+                  any notice to the Route author, and in many situations it will not be
+                  appropriate to request a default Gateway for a given Route -- for
+                  example, a Route with specific security requirements should almost
+                  certainly not use a default Gateway.
+                enum:
+                - All
+                - None
+                type: string
             required:
             - hostnames
             - rules
diff --git a/config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml b/config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml
index 1f7be3d3..39db999d 100644
--- a/config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml
+++ b/config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: udproutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -448,6 +447,24 @@ spec:
                 - message: Rule name must be unique within the route
                   rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
                     && l1.name == l2.name))
+              useDefaultGateways:
+                description: |-
+                  UseDefaultGateways indicates the default Gateway scope to use for this
+                  Route. If unset (the default) or set to None, the Route will not be
+                  attached to any default Gateway; if set, it will be attached to any
+                  default Gateway supporting the named scope, subject to the usual rules
+                  about which Routes a Gateway is allowed to claim.
+
+                  Think carefully before using this functionality! The set of default
+                  Gateways supporting the requested scope can change over time without
+                  any notice to the Route author, and in many situations it will not be
+                  appropriate to request a default Gateway for a given Route -- for
+                  example, a Route with specific security requirements should almost
+                  certainly not use a default Gateway.
+                enum:
+                - All
+                - None
+                type: string
             required:
             - rules
             type: object
diff --git a/config/crd/experimental/gateway.networking.x-k8s.io_xbackendtrafficpolicies.yaml b/config/crd/experimental/gateway.networking.x-k8s.io_xbackendtrafficpolicies.yaml
index 3e6d06b2..49f0474d 100644
--- a/config/crd/experimental/gateway.networking.x-k8s.io_xbackendtrafficpolicies.yaml
+++ b/config/crd/experimental/gateway.networking.x-k8s.io_xbackendtrafficpolicies.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   labels:
     gateway.networking.k8s.io/policy: Direct
   name: xbackendtrafficpolicies.gateway.networking.x-k8s.io
diff --git a/config/crd/experimental/gateway.networking.x-k8s.io_xlistenersets.yaml b/config/crd/experimental/gateway.networking.x-k8s.io_xlistenersets.yaml
index 6d5a5bd5..3d566b97 100644
--- a/config/crd/experimental/gateway.networking.x-k8s.io_xlistenersets.yaml
+++ b/config/crd/experimental/gateway.networking.x-k8s.io_xlistenersets.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: experimental
-  creationTimestamp: null
   name: xlistenersets.gateway.networking.x-k8s.io
 spec:
   group: gateway.networking.x-k8s.io
diff --git a/config/crd/experimental/gateway.networking.x-k8s.io_xmeshes.yaml b/config/crd/experimental/gateway.networking.x-k8s.io_xmeshes.yaml
new file mode 100644
index 00000000..1557b944
--- /dev/null
+++ b/config/crd/experimental/gateway.networking.x-k8s.io_xmeshes.yaml
@@ -0,0 +1,248 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
+    gateway.networking.k8s.io/bundle-version: v1.4.0
+    gateway.networking.k8s.io/channel: experimental
+  name: xmeshes.gateway.networking.x-k8s.io
+spec:
+  group: gateway.networking.x-k8s.io
+  names:
+    categories:
+    - gateway-api
+    kind: XMesh
+    listKind: XMeshList
+    plural: xmeshes
+    shortNames:
+    - mesh
+    singular: xmesh
+  scope: Cluster
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.conditions[?(@.type=="Accepted")].status
+      name: Accepted
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: XMesh defines mesh-wide characteristics of a GAMMA-compliant
+          service mesh.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec defines the desired state of XMesh.
+            properties:
+              controllerName:
+                description: |-
+                  ControllerName is the name of a controller that is managing Gateway API
+                  resources for mesh traffic management. The value of this field MUST be a
+                  domain prefixed path.
+
+                  Example: "example.com/awesome-mesh".
+
+                  This field is not mutable and cannot be empty.
+
+                  Support: Core
+                maxLength: 253
+                minLength: 1
+                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                type: string
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
+              description:
+                description: Description optionally provides a human-readable description
+                  of a Mesh.
+                maxLength: 64
+                type: string
+              parametersRef:
+                description: |-
+                  ParametersRef is an optional reference to a resource that contains
+                  implementation-specific configuration for this Mesh. If no
+                  implementation-specific parameters are needed, this field MUST be
+                  omitted.
+
+                  ParametersRef can reference a standard Kubernetes resource, i.e.
+                  ConfigMap, or an implementation-specific custom resource. The resource
+                  can be cluster-scoped or namespace-scoped.
+
+                  If the referent cannot be found, refers to an unsupported kind, or when
+                  the data within that resource is malformed, the Mesh MUST be rejected
+                  with the "Accepted" status condition set to "False" and an
+                  "InvalidParameters" reason.
+
+                  Support: Implementation-specific
+                properties:
+                  group:
+                    description: Group is the group of the referent.
+                    maxLength: 253
+                    pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                    type: string
+                  kind:
+                    description: Kind is kind of the referent.
+                    maxLength: 63
+                    minLength: 1
+                    pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                    type: string
+                  name:
+                    description: Name is the name of the referent.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                  namespace:
+                    description: |-
+                      Namespace is the namespace of the referent.
+                      This field is required when referring to a Namespace-scoped resource and
+                      MUST be unset when referring to a Cluster-scoped resource.
+                    maxLength: 63
+                    minLength: 1
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                    type: string
+                required:
+                - group
+                - kind
+                - name
+                type: object
+            required:
+            - controllerName
+            type: object
+          status:
+            default:
+              conditions:
+              - lastTransitionTime: "1970-01-01T00:00:00Z"
+                message: Waiting for controller
+                reason: Pending
+                status: Unknown
+                type: Accepted
+            description: Status defines the current state of XMesh.
+            properties:
+              conditions:
+                default:
+                - lastTransitionTime: "1970-01-01T00:00:00Z"
+                  message: Waiting for controller
+                  reason: Pending
+                  status: Unknown
+                  type: Accepted
+                - lastTransitionTime: "1970-01-01T00:00:00Z"
+                  message: Waiting for controller
+                  reason: Pending
+                  status: Unknown
+                  type: Programmed
+                description: |-
+                  Conditions is the current status from the controller for
+                  this Mesh.
+
+                  Controllers should prefer to publish conditions using values
+                  of MeshConditionType for the type of each Condition.
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                maxItems: 8
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              supportedFeatures:
+                description: |-
+                  SupportedFeatures is the set of features the Mesh support.
+                  It MUST be sorted in ascending alphabetical order by the Name key.
+                items:
+                  properties:
+                    name:
+                      description: |-
+                        FeatureName is used to describe distinct features that are covered by
+                        conformance tests.
+                      type: string
+                  required:
+                  - name
+                  type: object
+                maxItems: 64
+                type: array
+                x-kubernetes-list-map-keys:
+                - name
+                x-kubernetes-list-type: map
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/config/crd/kustomization.yaml b/config/crd/kustomization.yaml
index 3f0cb0da..c21d60cb 100644
--- a/config/crd/kustomization.yaml
+++ b/config/crd/kustomization.yaml
@@ -4,3 +4,4 @@ resources:
 - standard/gateway.networking.k8s.io_grpcroutes.yaml
 - standard/gateway.networking.k8s.io_httproutes.yaml
 - standard/gateway.networking.k8s.io_referencegrants.yaml
+- standard/gateway.networking.k8s.io_backendtlspolicies.yaml
diff --git a/config/crd/standard/gateway.networking.k8s.io_backendtlspolicies.yaml b/config/crd/standard/gateway.networking.k8s.io_backendtlspolicies.yaml
new file mode 100644
index 00000000..f90aba8b
--- /dev/null
+++ b/config/crd/standard/gateway.networking.k8s.io_backendtlspolicies.yaml
@@ -0,0 +1,1318 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
+    gateway.networking.k8s.io/bundle-version: v1.4.0
+    gateway.networking.k8s.io/channel: standard
+  labels:
+    gateway.networking.k8s.io/policy: Direct
+  name: backendtlspolicies.gateway.networking.k8s.io
+spec:
+  group: gateway.networking.k8s.io
+  names:
+    categories:
+    - gateway-api
+    kind: BackendTLSPolicy
+    listKind: BackendTLSPolicyList
+    plural: backendtlspolicies
+    shortNames:
+    - btlspolicy
+    singular: backendtlspolicy
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          BackendTLSPolicy provides a way to configure how a Gateway
+          connects to a Backend via TLS.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec defines the desired state of BackendTLSPolicy.
+            properties:
+              options:
+                additionalProperties:
+                  description: |-
+                    AnnotationValue is the value of an annotation in Gateway API. This is used
+                    for validation of maps such as TLS options. This roughly matches Kubernetes
+                    annotation validation, although the length validation in that case is based
+                    on the entire size of the annotations struct.
+                  maxLength: 4096
+                  minLength: 0
+                  type: string
+                description: |-
+                  Options are a list of key/value pairs to enable extended TLS
+                  configuration for each implementation. For example, configuring the
+                  minimum TLS version or supported cipher suites.
+
+                  A set of common keys MAY be defined by the API in the future. To avoid
+                  any ambiguity, implementation-specific definitions MUST use
+                  domain-prefixed names, such as `example.com/my-custom-option`.
+                  Un-prefixed names are reserved for key names defined by Gateway API.
+
+                  Support: Implementation-specific
+                maxProperties: 16
+                type: object
+              targetRefs:
+                description: |-
+                  TargetRefs identifies an API object to apply the policy to.
+                  Only Services have Extended support. Implementations MAY support
+                  additional objects, with Implementation Specific support.
+                  Note that this config applies to the entire referenced resource
+                  by default, but this default may change in the future to provide
+                  a more granular application of the policy.
+
+                  TargetRefs must be _distinct_. This means either that:
+
+                  * They select different targets. If this is the case, then targetRef
+                    entries are distinct. In terms of fields, this means that the
+                    multi-part key defined by `group`, `kind`, and `name` must
+                    be unique across all targetRef entries in the BackendTLSPolicy.
+                  * They select different sectionNames in the same target.
+
+                  When more than one BackendTLSPolicy selects the same target and
+                  sectionName, implementations MUST determine precedence using the
+                  following criteria, continuing on ties:
+
+                  * The older policy by creation timestamp takes precedence. For
+                    example, a policy with a creation timestamp of "2021-07-15
+                    01:02:03" MUST be given precedence over a policy with a
+                    creation timestamp of "2021-07-15 01:02:04".
+                  * The policy appearing first in alphabetical order by {name}.
+                    For example, a policy named `bar` is given precedence over a
+                    policy named `baz`.
+
+                  For any BackendTLSPolicy that does not take precedence, the
+                  implementation MUST ensure the `Accepted` Condition is set to
+                  `status: False`, with Reason `Conflicted`.
+
+                  Support: Extended for Kubernetes Service
+
+                  Support: Implementation-specific for any other resource
+                items:
+                  description: |-
+                    LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a
+                    direct policy to. This should be used as part of Policy resources that can
+                    target single resources. For more information on how this policy attachment
+                    mode works, and a sample Policy resource, refer to the policy attachment
+                    documentation for Gateway API.
+
+                    Note: This should only be used for direct policy attachment when references
+                    to SectionName are actually needed. In all other cases,
+                    LocalPolicyTargetReference should be used.
+                  properties:
+                    group:
+                      description: Group is the group of the target resource.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    kind:
+                      description: Kind is kind of the target resource.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                      type: string
+                    name:
+                      description: Name is the name of the target resource.
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                    sectionName:
+                      description: |-
+                        SectionName is the name of a section within the target resource. When
+                        unspecified, this targetRef targets the entire resource. In the following
+                        resources, SectionName is interpreted as the following:
+
+                        * Gateway: Listener name
+                        * HTTPRoute: HTTPRouteRule name
+                        * Service: Port name
+
+                        If a SectionName is specified, but does not exist on the targeted object,
+                        the Policy must fail to attach, and the policy implementation should record
+                        a `ResolvedRefs` or similar Condition in the Policy's status.
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                  required:
+                  - group
+                  - kind
+                  - name
+                  type: object
+                maxItems: 16
+                minItems: 1
+                type: array
+                x-kubernetes-list-type: atomic
+                x-kubernetes-validations:
+                - message: sectionName must be specified when targetRefs includes
+                    2 or more references to the same target
+                  rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
+                    == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName
+                    == '''') == (!has(p2.sectionName) || p2.sectionName == ''''))
+                    : true))'
+                - message: sectionName must be unique when targetRefs includes 2 or
+                    more references to the same target
+                  rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
+                    == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) ||
+                    p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
+                    == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
+                    == p2.sectionName))))
+              validation:
+                description: Validation contains backend TLS validation configuration.
+                properties:
+                  caCertificateRefs:
+                    description: |-
+                      CACertificateRefs contains one or more references to Kubernetes objects that
+                      contain a PEM-encoded TLS CA certificate bundle, which is used to
+                      validate a TLS handshake between the Gateway and backend Pod.
+
+                      If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
+                      specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
+                      not both. If CACertificateRefs is empty or unspecified, the configuration for
+                      WellKnownCACertificates MUST be honored instead if supported by the implementation.
+
+                      A CACertificateRef is invalid if:
+
+                      * It refers to a resource that cannot be resolved (e.g., the referenced resource
+                        does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key
+                        named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`
+                        and the Message of the Condition must indicate which reference is invalid and why.
+
+                      * It refers to an unknown or unsupported kind of resource. In this case, the Reason
+                        must be set to `InvalidKind` and the Message of the Condition must explain which
+                        kind of resource is unknown or unsupported.
+
+                      * It refers to a resource in another namespace. This may change in future
+                        spec updates.
+
+                      Implementations MAY choose to perform further validation of the certificate
+                      content (e.g., checking expiry or enforcing specific formats). In such cases,
+                      an implementation-specific Reason and Message must be set for the invalid reference.
+
+                      In all cases, the implementation MUST ensure the `ResolvedRefs` Condition on
+                      the BackendTLSPolicy is set to `status: False`, with a Reason and Message
+                      that indicate the cause of the error. Connections using an invalid
+                      CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error
+                      response. If ALL CACertificateRefs are invalid, the implementation MUST also
+                      ensure the `Accepted` Condition on the BackendTLSPolicy is set to
+                      `status: False`, with a Reason `NoValidCACertificate`.
+
+                      A single CACertificateRef to a Kubernetes ConfigMap kind has "Core" support.
+                      Implementations MAY choose to support attaching multiple certificates to
+                      a backend, but this behavior is implementation-specific.
+
+                      Support: Core - An optional single reference to a Kubernetes ConfigMap,
+                      with the CA certificate in a key named `ca.crt`.
+
+                      Support: Implementation-specific - More than one reference, other kinds
+                      of resources, or a single reference that includes multiple certificates.
+                    items:
+                      description: |-
+                        LocalObjectReference identifies an API object within the namespace of the
+                        referrer.
+                        The API object must be valid in the cluster; the Group and Kind must
+                        be registered in the cluster for this reference to be valid.
+
+                        References to objects with invalid Group and Kind are not valid, and must
+                        be rejected by the implementation, with appropriate Conditions set
+                        on the containing object.
+                      properties:
+                        group:
+                          description: |-
+                            Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                            When unspecified or empty string, core API group is inferred.
+                          maxLength: 253
+                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                        kind:
+                          description: Kind is kind of the referent. For example "HTTPRoute"
+                            or "Service".
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                          type: string
+                        name:
+                          description: Name is the name of the referent.
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                      required:
+                      - group
+                      - kind
+                      - name
+                      type: object
+                    maxItems: 8
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  hostname:
+                    description: |-
+                      Hostname is used for two purposes in the connection between Gateways and
+                      backends:
+
+                      1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
+                      2. Hostname MUST be used for authentication and MUST match the certificate
+                         served by the matching backend, unless SubjectAltNames is specified.
+                      3. If SubjectAltNames are specified, Hostname can be used for certificate selection
+                         but MUST NOT be used for authentication. If you want to use the value
+                         of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.
+
+                      Support: Core
+                    maxLength: 253
+                    minLength: 1
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                    type: string
+                  subjectAltNames:
+                    description: |-
+                      SubjectAltNames contains one or more Subject Alternative Names.
+                      When specified the certificate served from the backend MUST
+                      have at least one Subject Alternate Name matching one of the specified SubjectAltNames.
+
+                      Support: Extended
+                    items:
+                      description: SubjectAltName represents Subject Alternative Name.
+                      properties:
+                        hostname:
+                          description: |-
+                            Hostname contains Subject Alternative Name specified in DNS name format.
+                            Required when Type is set to Hostname, ignored otherwise.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                        type:
+                          description: |-
+                            Type determines the format of the Subject Alternative Name. Always required.
+
+                            Support: Core
+                          enum:
+                          - Hostname
+                          - URI
+                          type: string
+                        uri:
+                          description: |-
+                            URI contains Subject Alternative Name specified in a full URI format.
+                            It MUST include both a scheme (e.g., "http" or "ftp") and a scheme-specific-part.
+                            Common values include SPIFFE IDs like "spiffe://mycluster.example.com/ns/myns/sa/svc1sa".
+                            Required when Type is set to URI, ignored otherwise.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                          type: string
+                      required:
+                      - type
+                      type: object
+                      x-kubernetes-validations:
+                      - message: SubjectAltName element must contain Hostname, if
+                          Type is set to Hostname
+                        rule: '!(self.type == "Hostname" && (!has(self.hostname) ||
+                          self.hostname == ""))'
+                      - message: SubjectAltName element must not contain Hostname,
+                          if Type is not set to Hostname
+                        rule: '!(self.type != "Hostname" && has(self.hostname) &&
+                          self.hostname != "")'
+                      - message: SubjectAltName element must contain URI, if Type
+                          is set to URI
+                        rule: '!(self.type == "URI" && (!has(self.uri) || self.uri
+                          == ""))'
+                      - message: SubjectAltName element must not contain URI, if Type
+                          is not set to URI
+                        rule: '!(self.type != "URI" && has(self.uri) && self.uri !=
+                          "")'
+                    maxItems: 5
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  wellKnownCACertificates:
+                    description: |-
+                      WellKnownCACertificates specifies whether system CA certificates may be used in
+                      the TLS handshake between the gateway and backend pod.
+
+                      If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
+                      must be specified with at least one entry for a valid configuration. Only one of
+                      CACertificateRefs or WellKnownCACertificates may be specified, not both.
+                      If an implementation does not support the WellKnownCACertificates field, or
+                      the supplied value is not recognized, the implementation MUST ensure the
+                      `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with
+                      a Reason `Invalid`.
+
+                      Support: Implementation-specific
+                    enum:
+                    - System
+                    type: string
+                required:
+                - hostname
+                type: object
+                x-kubernetes-validations:
+                - message: must not contain both CACertificateRefs and WellKnownCACertificates
+                  rule: '!(has(self.caCertificateRefs) && size(self.caCertificateRefs)
+                    > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates
+                    != "")'
+                - message: must specify either CACertificateRefs or WellKnownCACertificates
+                  rule: (has(self.caCertificateRefs) && size(self.caCertificateRefs)
+                    > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates
+                    != "")
+            required:
+            - targetRefs
+            - validation
+            type: object
+          status:
+            description: Status defines the current state of BackendTLSPolicy.
+            properties:
+              ancestors:
+                description: |-
+                  Ancestors is a list of ancestor resources (usually Gateways) that are
+                  associated with the policy, and the status of the policy with respect to
+                  each ancestor. When this policy attaches to a parent, the controller that
+                  manages the parent and the ancestors MUST add an entry to this list when
+                  the controller first sees the policy and SHOULD update the entry as
+                  appropriate when the relevant ancestor is modified.
+
+                  Note that choosing the relevant ancestor is left to the Policy designers;
+                  an important part of Policy design is designing the right object level at
+                  which to namespace this status.
+
+                  Note also that implementations MUST ONLY populate ancestor status for
+                  the Ancestor resources they are responsible for. Implementations MUST
+                  use the ControllerName field to uniquely identify the entries in this list
+                  that they are responsible for.
+
+                  Note that to achieve this, the list of PolicyAncestorStatus structs
+                  MUST be treated as a map with a composite key, made up of the AncestorRef
+                  and ControllerName fields combined.
+
+                  A maximum of 16 ancestors will be represented in this list. An empty list
+                  means the Policy is not relevant for any ancestors.
+
+                  If this slice is full, implementations MUST NOT add further entries.
+                  Instead they MUST consider the policy unimplementable and signal that
+                  on any related resources such as the ancestor that would be referenced
+                  here. For example, if this list was full on BackendTLSPolicy, no
+                  additional Gateways would be able to reference the Service targeted by
+                  the BackendTLSPolicy.
+                items:
+                  description: |-
+                    PolicyAncestorStatus describes the status of a route with respect to an
+                    associated Ancestor.
+
+                    Ancestors refer to objects that are either the Target of a policy or above it
+                    in terms of object hierarchy. For example, if a policy targets a Service, the
+                    Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
+                    the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
+                    useful object to place Policy status on, so we recommend that implementations
+                    SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
+                    have a _very_ good reason otherwise.
+
+                    In the context of policy attachment, the Ancestor is used to distinguish which
+                    resource results in a distinct application of this policy. For example, if a policy
+                    targets a Service, it may have a distinct result per attached Gateway.
+
+                    Policies targeting the same resource may have different effects depending on the
+                    ancestors of those resources. For example, different Gateways targeting the same
+                    Service may have different capabilities, especially if they have different underlying
+                    implementations.
+
+                    For example, in BackendTLSPolicy, the Policy attaches to a Service that is
+                    used as a backend in a HTTPRoute that is itself attached to a Gateway.
+                    In this case, the relevant object for status is the Gateway, and that is the
+                    ancestor object referred to in this status.
+
+                    Note that a parent is also an ancestor, so for objects where the parent is the
+                    relevant object for status, this struct SHOULD still be used.
+
+                    This struct is intended to be used in a slice that's effectively a map,
+                    with a composite key made up of the AncestorRef and the ControllerName.
+                  properties:
+                    ancestorRef:
+                      description: |-
+                        AncestorRef corresponds with a ParentRef in the spec that this
+                        PolicyAncestorStatus struct describes the status of.
+                      properties:
+                        group:
+                          default: gateway.networking.k8s.io
+                          description: |-
+                            Group is the group of the referent.
+                            When unspecified, "gateway.networking.k8s.io" is inferred.
+                            To set the core API group (such as for a "Service" kind referent),
+                            Group must be explicitly set to "" (empty string).
+
+                            Support: Core
+                          maxLength: 253
+                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                        kind:
+                          default: Gateway
+                          description: |-
+                            Kind is kind of the referent.
+
+                            There are two kinds of parent resources with "Core" support:
+
+                            * Gateway (Gateway conformance profile)
+                            * Service (Mesh conformance profile, ClusterIP Services only)
+
+                            Support for other resources is Implementation-Specific.
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                          type: string
+                        name:
+                          description: |-
+                            Name is the name of the referent.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                        namespace:
+                          description: |-
+                            Namespace is the namespace of the referent. When unspecified, this refers
+                            to the local namespace of the Route.
+
+                            Note that there are specific rules for ParentRefs which cross namespace
+                            boundaries. Cross-namespace references are only valid if they are explicitly
+                            allowed by something in the namespace they are referring to. For example:
+                            Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                            generic way to enable any other kind of cross-namespace reference.
+
+                            Support: Core
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                          type: string
+                        port:
+                          description: |-
+                            Port is the network port this Route targets. It can be interpreted
+                            differently based on the type of parent resource.
+
+                            When the parent resource is a Gateway, this targets all listeners
+                            listening on the specified port that also support this kind of Route(and
+                            select this Route). It's not recommended to set `Port` unless the
+                            networking behaviors specified in a Route must apply to a specific port
+                            as opposed to a listener(s) whose port(s) may be changed. When both Port
+                            and SectionName are specified, the name and port of the selected listener
+                            must match both specified values.
+
+                            Implementations MAY choose to support other parent resources.
+                            Implementations supporting other types of parent resources MUST clearly
+                            document how/if Port is interpreted.
+
+                            For the purpose of status, an attachment is considered successful as
+                            long as the parent resource accepts it partially. For example, Gateway
+                            listeners can restrict which Routes can attach to them by Route kind,
+                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                            from the referencing Route, the Route MUST be considered successfully
+                            attached. If no Gateway listeners accept attachment from this Route,
+                            the Route MUST be considered detached from the Gateway.
+
+                            Support: Extended
+                          format: int32
+                          maximum: 65535
+                          minimum: 1
+                          type: integer
+                        sectionName:
+                          description: |-
+                            SectionName is the name of a section within the target resource. In the
+                            following resources, SectionName is interpreted as the following:
+
+                            * Gateway: Listener name. When both Port (experimental) and SectionName
+                            are specified, the name and port of the selected listener must match
+                            both specified values.
+                            * Service: Port name. When both Port (experimental) and SectionName
+                            are specified, the name and port of the selected listener must match
+                            both specified values.
+
+                            Implementations MAY choose to support attaching Routes to other resources.
+                            If that is the case, they MUST clearly document how SectionName is
+                            interpreted.
+
+                            When unspecified (empty string), this will reference the entire resource.
+                            For the purpose of status, an attachment is considered successful if at
+                            least one section in the parent resource accepts it. For example, Gateway
+                            listeners can restrict which Routes can attach to them by Route kind,
+                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                            the referencing Route, the Route MUST be considered successfully
+                            attached. If no Gateway listeners accept attachment from this Route, the
+                            Route MUST be considered detached from the Gateway.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                      required:
+                      - name
+                      type: object
+                    conditions:
+                      description: Conditions describes the status of the Policy with
+                        respect to the given Ancestor.
+                      items:
+                        description: Condition contains details for one aspect of
+                          the current state of this API Resource.
+                        properties:
+                          lastTransitionTime:
+                            description: |-
+                              lastTransitionTime is the last time the condition transitioned from one status to another.
+                              This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                            format: date-time
+                            type: string
+                          message:
+                            description: |-
+                              message is a human readable message indicating details about the transition.
+                              This may be an empty string.
+                            maxLength: 32768
+                            type: string
+                          observedGeneration:
+                            description: |-
+                              observedGeneration represents the .metadata.generation that the condition was set based upon.
+                              For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                              with respect to the current state of the instance.
+                            format: int64
+                            minimum: 0
+                            type: integer
+                          reason:
+                            description: |-
+                              reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                              Producers of specific condition types may define expected values and meanings for this field,
+                              and whether the values are considered a guaranteed API.
+                              The value should be a CamelCase string.
+                              This field may not be empty.
+                            maxLength: 1024
+                            minLength: 1
+                            pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                            type: string
+                          status:
+                            description: status of the condition, one of True, False,
+                              Unknown.
+                            enum:
+                            - "True"
+                            - "False"
+                            - Unknown
+                            type: string
+                          type:
+                            description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                            maxLength: 316
+                            pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                            type: string
+                        required:
+                        - lastTransitionTime
+                        - message
+                        - reason
+                        - status
+                        - type
+                        type: object
+                      maxItems: 8
+                      minItems: 1
+                      type: array
+                      x-kubernetes-list-map-keys:
+                      - type
+                      x-kubernetes-list-type: map
+                    controllerName:
+                      description: |-
+                        ControllerName is a domain/path string that indicates the name of the
+                        controller that wrote this status. This corresponds with the
+                        controllerName field on GatewayClass.
+
+                        Example: "example.net/gateway-controller".
+
+                        The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+                        valid Kubernetes names
+                        (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+
+                        Controllers MUST populate this field when writing status. Controllers should ensure that
+                        entries to status populated with their ControllerName are cleaned up when they are no
+                        longer necessary.
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                      type: string
+                  required:
+                  - ancestorRef
+                  - conditions
+                  - controllerName
+                  type: object
+                maxItems: 16
+                type: array
+                x-kubernetes-list-type: atomic
+            required:
+            - ancestors
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+  - deprecated: true
+    deprecationWarning: The v1alpha3 version of BackendTLSPolicy has been deprecated
+      and will be removed in a future release of the API. Please upgrade to v1.
+    name: v1alpha3
+    schema:
+      openAPIV3Schema:
+        description: |-
+          BackendTLSPolicy provides a way to configure how a Gateway
+          connects to a Backend via TLS.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec defines the desired state of BackendTLSPolicy.
+            properties:
+              options:
+                additionalProperties:
+                  description: |-
+                    AnnotationValue is the value of an annotation in Gateway API. This is used
+                    for validation of maps such as TLS options. This roughly matches Kubernetes
+                    annotation validation, although the length validation in that case is based
+                    on the entire size of the annotations struct.
+                  maxLength: 4096
+                  minLength: 0
+                  type: string
+                description: |-
+                  Options are a list of key/value pairs to enable extended TLS
+                  configuration for each implementation. For example, configuring the
+                  minimum TLS version or supported cipher suites.
+
+                  A set of common keys MAY be defined by the API in the future. To avoid
+                  any ambiguity, implementation-specific definitions MUST use
+                  domain-prefixed names, such as `example.com/my-custom-option`.
+                  Un-prefixed names are reserved for key names defined by Gateway API.
+
+                  Support: Implementation-specific
+                maxProperties: 16
+                type: object
+              targetRefs:
+                description: |-
+                  TargetRefs identifies an API object to apply the policy to.
+                  Only Services have Extended support. Implementations MAY support
+                  additional objects, with Implementation Specific support.
+                  Note that this config applies to the entire referenced resource
+                  by default, but this default may change in the future to provide
+                  a more granular application of the policy.
+
+                  TargetRefs must be _distinct_. This means either that:
+
+                  * They select different targets. If this is the case, then targetRef
+                    entries are distinct. In terms of fields, this means that the
+                    multi-part key defined by `group`, `kind`, and `name` must
+                    be unique across all targetRef entries in the BackendTLSPolicy.
+                  * They select different sectionNames in the same target.
+
+                  When more than one BackendTLSPolicy selects the same target and
+                  sectionName, implementations MUST determine precedence using the
+                  following criteria, continuing on ties:
+
+                  * The older policy by creation timestamp takes precedence. For
+                    example, a policy with a creation timestamp of "2021-07-15
+                    01:02:03" MUST be given precedence over a policy with a
+                    creation timestamp of "2021-07-15 01:02:04".
+                  * The policy appearing first in alphabetical order by {name}.
+                    For example, a policy named `bar` is given precedence over a
+                    policy named `baz`.
+
+                  For any BackendTLSPolicy that does not take precedence, the
+                  implementation MUST ensure the `Accepted` Condition is set to
+                  `status: False`, with Reason `Conflicted`.
+
+                  Support: Extended for Kubernetes Service
+
+                  Support: Implementation-specific for any other resource
+                items:
+                  description: |-
+                    LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a
+                    direct policy to. This should be used as part of Policy resources that can
+                    target single resources. For more information on how this policy attachment
+                    mode works, and a sample Policy resource, refer to the policy attachment
+                    documentation for Gateway API.
+
+                    Note: This should only be used for direct policy attachment when references
+                    to SectionName are actually needed. In all other cases,
+                    LocalPolicyTargetReference should be used.
+                  properties:
+                    group:
+                      description: Group is the group of the target resource.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    kind:
+                      description: Kind is kind of the target resource.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                      type: string
+                    name:
+                      description: Name is the name of the target resource.
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                    sectionName:
+                      description: |-
+                        SectionName is the name of a section within the target resource. When
+                        unspecified, this targetRef targets the entire resource. In the following
+                        resources, SectionName is interpreted as the following:
+
+                        * Gateway: Listener name
+                        * HTTPRoute: HTTPRouteRule name
+                        * Service: Port name
+
+                        If a SectionName is specified, but does not exist on the targeted object,
+                        the Policy must fail to attach, and the policy implementation should record
+                        a `ResolvedRefs` or similar Condition in the Policy's status.
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                  required:
+                  - group
+                  - kind
+                  - name
+                  type: object
+                maxItems: 16
+                minItems: 1
+                type: array
+                x-kubernetes-list-type: atomic
+                x-kubernetes-validations:
+                - message: sectionName must be specified when targetRefs includes
+                    2 or more references to the same target
+                  rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
+                    == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName
+                    == '''') == (!has(p2.sectionName) || p2.sectionName == ''''))
+                    : true))'
+                - message: sectionName must be unique when targetRefs includes 2 or
+                    more references to the same target
+                  rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
+                    == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) ||
+                    p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
+                    == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
+                    == p2.sectionName))))
+              validation:
+                description: Validation contains backend TLS validation configuration.
+                properties:
+                  caCertificateRefs:
+                    description: |-
+                      CACertificateRefs contains one or more references to Kubernetes objects that
+                      contain a PEM-encoded TLS CA certificate bundle, which is used to
+                      validate a TLS handshake between the Gateway and backend Pod.
+
+                      If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
+                      specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
+                      not both. If CACertificateRefs is empty or unspecified, the configuration for
+                      WellKnownCACertificates MUST be honored instead if supported by the implementation.
+
+                      A CACertificateRef is invalid if:
+
+                      * It refers to a resource that cannot be resolved (e.g., the referenced resource
+                        does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key
+                        named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`
+                        and the Message of the Condition must indicate which reference is invalid and why.
+
+                      * It refers to an unknown or unsupported kind of resource. In this case, the Reason
+                        must be set to `InvalidKind` and the Message of the Condition must explain which
+                        kind of resource is unknown or unsupported.
+
+                      * It refers to a resource in another namespace. This may change in future
+                        spec updates.
+
+                      Implementations MAY choose to perform further validation of the certificate
+                      content (e.g., checking expiry or enforcing specific formats). In such cases,
+                      an implementation-specific Reason and Message must be set for the invalid reference.
+
+                      In all cases, the implementation MUST ensure the `ResolvedRefs` Condition on
+                      the BackendTLSPolicy is set to `status: False`, with a Reason and Message
+                      that indicate the cause of the error. Connections using an invalid
+                      CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error
+                      response. If ALL CACertificateRefs are invalid, the implementation MUST also
+                      ensure the `Accepted` Condition on the BackendTLSPolicy is set to
+                      `status: False`, with a Reason `NoValidCACertificate`.
+
+                      A single CACertificateRef to a Kubernetes ConfigMap kind has "Core" support.
+                      Implementations MAY choose to support attaching multiple certificates to
+                      a backend, but this behavior is implementation-specific.
+
+                      Support: Core - An optional single reference to a Kubernetes ConfigMap,
+                      with the CA certificate in a key named `ca.crt`.
+
+                      Support: Implementation-specific - More than one reference, other kinds
+                      of resources, or a single reference that includes multiple certificates.
+                    items:
+                      description: |-
+                        LocalObjectReference identifies an API object within the namespace of the
+                        referrer.
+                        The API object must be valid in the cluster; the Group and Kind must
+                        be registered in the cluster for this reference to be valid.
+
+                        References to objects with invalid Group and Kind are not valid, and must
+                        be rejected by the implementation, with appropriate Conditions set
+                        on the containing object.
+                      properties:
+                        group:
+                          description: |-
+                            Group is the group of the referent. For example, "gateway.networking.k8s.io".
+                            When unspecified or empty string, core API group is inferred.
+                          maxLength: 253
+                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                        kind:
+                          description: Kind is kind of the referent. For example "HTTPRoute"
+                            or "Service".
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                          type: string
+                        name:
+                          description: Name is the name of the referent.
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                      required:
+                      - group
+                      - kind
+                      - name
+                      type: object
+                    maxItems: 8
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  hostname:
+                    description: |-
+                      Hostname is used for two purposes in the connection between Gateways and
+                      backends:
+
+                      1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
+                      2. Hostname MUST be used for authentication and MUST match the certificate
+                         served by the matching backend, unless SubjectAltNames is specified.
+                      3. If SubjectAltNames are specified, Hostname can be used for certificate selection
+                         but MUST NOT be used for authentication. If you want to use the value
+                         of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.
+
+                      Support: Core
+                    maxLength: 253
+                    minLength: 1
+                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                    type: string
+                  subjectAltNames:
+                    description: |-
+                      SubjectAltNames contains one or more Subject Alternative Names.
+                      When specified the certificate served from the backend MUST
+                      have at least one Subject Alternate Name matching one of the specified SubjectAltNames.
+
+                      Support: Extended
+                    items:
+                      description: SubjectAltName represents Subject Alternative Name.
+                      properties:
+                        hostname:
+                          description: |-
+                            Hostname contains Subject Alternative Name specified in DNS name format.
+                            Required when Type is set to Hostname, ignored otherwise.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                        type:
+                          description: |-
+                            Type determines the format of the Subject Alternative Name. Always required.
+
+                            Support: Core
+                          enum:
+                          - Hostname
+                          - URI
+                          type: string
+                        uri:
+                          description: |-
+                            URI contains Subject Alternative Name specified in a full URI format.
+                            It MUST include both a scheme (e.g., "http" or "ftp") and a scheme-specific-part.
+                            Common values include SPIFFE IDs like "spiffe://mycluster.example.com/ns/myns/sa/svc1sa".
+                            Required when Type is set to URI, ignored otherwise.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
+                          type: string
+                      required:
+                      - type
+                      type: object
+                      x-kubernetes-validations:
+                      - message: SubjectAltName element must contain Hostname, if
+                          Type is set to Hostname
+                        rule: '!(self.type == "Hostname" && (!has(self.hostname) ||
+                          self.hostname == ""))'
+                      - message: SubjectAltName element must not contain Hostname,
+                          if Type is not set to Hostname
+                        rule: '!(self.type != "Hostname" && has(self.hostname) &&
+                          self.hostname != "")'
+                      - message: SubjectAltName element must contain URI, if Type
+                          is set to URI
+                        rule: '!(self.type == "URI" && (!has(self.uri) || self.uri
+                          == ""))'
+                      - message: SubjectAltName element must not contain URI, if Type
+                          is not set to URI
+                        rule: '!(self.type != "URI" && has(self.uri) && self.uri !=
+                          "")'
+                    maxItems: 5
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  wellKnownCACertificates:
+                    description: |-
+                      WellKnownCACertificates specifies whether system CA certificates may be used in
+                      the TLS handshake between the gateway and backend pod.
+
+                      If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
+                      must be specified with at least one entry for a valid configuration. Only one of
+                      CACertificateRefs or WellKnownCACertificates may be specified, not both.
+                      If an implementation does not support the WellKnownCACertificates field, or
+                      the supplied value is not recognized, the implementation MUST ensure the
+                      `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with
+                      a Reason `Invalid`.
+
+                      Support: Implementation-specific
+                    enum:
+                    - System
+                    type: string
+                required:
+                - hostname
+                type: object
+                x-kubernetes-validations:
+                - message: must not contain both CACertificateRefs and WellKnownCACertificates
+                  rule: '!(has(self.caCertificateRefs) && size(self.caCertificateRefs)
+                    > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates
+                    != "")'
+                - message: must specify either CACertificateRefs or WellKnownCACertificates
+                  rule: (has(self.caCertificateRefs) && size(self.caCertificateRefs)
+                    > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates
+                    != "")
+            required:
+            - targetRefs
+            - validation
+            type: object
+          status:
+            description: Status defines the current state of BackendTLSPolicy.
+            properties:
+              ancestors:
+                description: |-
+                  Ancestors is a list of ancestor resources (usually Gateways) that are
+                  associated with the policy, and the status of the policy with respect to
+                  each ancestor. When this policy attaches to a parent, the controller that
+                  manages the parent and the ancestors MUST add an entry to this list when
+                  the controller first sees the policy and SHOULD update the entry as
+                  appropriate when the relevant ancestor is modified.
+
+                  Note that choosing the relevant ancestor is left to the Policy designers;
+                  an important part of Policy design is designing the right object level at
+                  which to namespace this status.
+
+                  Note also that implementations MUST ONLY populate ancestor status for
+                  the Ancestor resources they are responsible for. Implementations MUST
+                  use the ControllerName field to uniquely identify the entries in this list
+                  that they are responsible for.
+
+                  Note that to achieve this, the list of PolicyAncestorStatus structs
+                  MUST be treated as a map with a composite key, made up of the AncestorRef
+                  and ControllerName fields combined.
+
+                  A maximum of 16 ancestors will be represented in this list. An empty list
+                  means the Policy is not relevant for any ancestors.
+
+                  If this slice is full, implementations MUST NOT add further entries.
+                  Instead they MUST consider the policy unimplementable and signal that
+                  on any related resources such as the ancestor that would be referenced
+                  here. For example, if this list was full on BackendTLSPolicy, no
+                  additional Gateways would be able to reference the Service targeted by
+                  the BackendTLSPolicy.
+                items:
+                  description: |-
+                    PolicyAncestorStatus describes the status of a route with respect to an
+                    associated Ancestor.
+
+                    Ancestors refer to objects that are either the Target of a policy or above it
+                    in terms of object hierarchy. For example, if a policy targets a Service, the
+                    Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
+                    the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
+                    useful object to place Policy status on, so we recommend that implementations
+                    SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
+                    have a _very_ good reason otherwise.
+
+                    In the context of policy attachment, the Ancestor is used to distinguish which
+                    resource results in a distinct application of this policy. For example, if a policy
+                    targets a Service, it may have a distinct result per attached Gateway.
+
+                    Policies targeting the same resource may have different effects depending on the
+                    ancestors of those resources. For example, different Gateways targeting the same
+                    Service may have different capabilities, especially if they have different underlying
+                    implementations.
+
+                    For example, in BackendTLSPolicy, the Policy attaches to a Service that is
+                    used as a backend in a HTTPRoute that is itself attached to a Gateway.
+                    In this case, the relevant object for status is the Gateway, and that is the
+                    ancestor object referred to in this status.
+
+                    Note that a parent is also an ancestor, so for objects where the parent is the
+                    relevant object for status, this struct SHOULD still be used.
+
+                    This struct is intended to be used in a slice that's effectively a map,
+                    with a composite key made up of the AncestorRef and the ControllerName.
+                  properties:
+                    ancestorRef:
+                      description: |-
+                        AncestorRef corresponds with a ParentRef in the spec that this
+                        PolicyAncestorStatus struct describes the status of.
+                      properties:
+                        group:
+                          default: gateway.networking.k8s.io
+                          description: |-
+                            Group is the group of the referent.
+                            When unspecified, "gateway.networking.k8s.io" is inferred.
+                            To set the core API group (such as for a "Service" kind referent),
+                            Group must be explicitly set to "" (empty string).
+
+                            Support: Core
+                          maxLength: 253
+                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                        kind:
+                          default: Gateway
+                          description: |-
+                            Kind is kind of the referent.
+
+                            There are two kinds of parent resources with "Core" support:
+
+                            * Gateway (Gateway conformance profile)
+                            * Service (Mesh conformance profile, ClusterIP Services only)
+
+                            Support for other resources is Implementation-Specific.
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                          type: string
+                        name:
+                          description: |-
+                            Name is the name of the referent.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          type: string
+                        namespace:
+                          description: |-
+                            Namespace is the namespace of the referent. When unspecified, this refers
+                            to the local namespace of the Route.
+
+                            Note that there are specific rules for ParentRefs which cross namespace
+                            boundaries. Cross-namespace references are only valid if they are explicitly
+                            allowed by something in the namespace they are referring to. For example:
+                            Gateway has the AllowedRoutes field, and ReferenceGrant provides a
+                            generic way to enable any other kind of cross-namespace reference.
+
+                            Support: Core
+                          maxLength: 63
+                          minLength: 1
+                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                          type: string
+                        port:
+                          description: |-
+                            Port is the network port this Route targets. It can be interpreted
+                            differently based on the type of parent resource.
+
+                            When the parent resource is a Gateway, this targets all listeners
+                            listening on the specified port that also support this kind of Route(and
+                            select this Route). It's not recommended to set `Port` unless the
+                            networking behaviors specified in a Route must apply to a specific port
+                            as opposed to a listener(s) whose port(s) may be changed. When both Port
+                            and SectionName are specified, the name and port of the selected listener
+                            must match both specified values.
+
+                            Implementations MAY choose to support other parent resources.
+                            Implementations supporting other types of parent resources MUST clearly
+                            document how/if Port is interpreted.
+
+                            For the purpose of status, an attachment is considered successful as
+                            long as the parent resource accepts it partially. For example, Gateway
+                            listeners can restrict which Routes can attach to them by Route kind,
+                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
+                            from the referencing Route, the Route MUST be considered successfully
+                            attached. If no Gateway listeners accept attachment from this Route,
+                            the Route MUST be considered detached from the Gateway.
+
+                            Support: Extended
+                          format: int32
+                          maximum: 65535
+                          minimum: 1
+                          type: integer
+                        sectionName:
+                          description: |-
+                            SectionName is the name of a section within the target resource. In the
+                            following resources, SectionName is interpreted as the following:
+
+                            * Gateway: Listener name. When both Port (experimental) and SectionName
+                            are specified, the name and port of the selected listener must match
+                            both specified values.
+                            * Service: Port name. When both Port (experimental) and SectionName
+                            are specified, the name and port of the selected listener must match
+                            both specified values.
+
+                            Implementations MAY choose to support attaching Routes to other resources.
+                            If that is the case, they MUST clearly document how SectionName is
+                            interpreted.
+
+                            When unspecified (empty string), this will reference the entire resource.
+                            For the purpose of status, an attachment is considered successful if at
+                            least one section in the parent resource accepts it. For example, Gateway
+                            listeners can restrict which Routes can attach to them by Route kind,
+                            namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
+                            the referencing Route, the Route MUST be considered successfully
+                            attached. If no Gateway listeners accept attachment from this Route, the
+                            Route MUST be considered detached from the Gateway.
+
+                            Support: Core
+                          maxLength: 253
+                          minLength: 1
+                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                          type: string
+                      required:
+                      - name
+                      type: object
+                    conditions:
+                      description: Conditions describes the status of the Policy with
+                        respect to the given Ancestor.
+                      items:
+                        description: Condition contains details for one aspect of
+                          the current state of this API Resource.
+                        properties:
+                          lastTransitionTime:
+                            description: |-
+                              lastTransitionTime is the last time the condition transitioned from one status to another.
+                              This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                            format: date-time
+                            type: string
+                          message:
+                            description: |-
+                              message is a human readable message indicating details about the transition.
+                              This may be an empty string.
+                            maxLength: 32768
+                            type: string
+                          observedGeneration:
+                            description: |-
+                              observedGeneration represents the .metadata.generation that the condition was set based upon.
+                              For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                              with respect to the current state of the instance.
+                            format: int64
+                            minimum: 0
+                            type: integer
+                          reason:
+                            description: |-
+                              reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                              Producers of specific condition types may define expected values and meanings for this field,
+                              and whether the values are considered a guaranteed API.
+                              The value should be a CamelCase string.
+                              This field may not be empty.
+                            maxLength: 1024
+                            minLength: 1
+                            pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                            type: string
+                          status:
+                            description: status of the condition, one of True, False,
+                              Unknown.
+                            enum:
+                            - "True"
+                            - "False"
+                            - Unknown
+                            type: string
+                          type:
+                            description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                            maxLength: 316
+                            pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                            type: string
+                        required:
+                        - lastTransitionTime
+                        - message
+                        - reason
+                        - status
+                        - type
+                        type: object
+                      maxItems: 8
+                      minItems: 1
+                      type: array
+                      x-kubernetes-list-map-keys:
+                      - type
+                      x-kubernetes-list-type: map
+                    controllerName:
+                      description: |-
+                        ControllerName is a domain/path string that indicates the name of the
+                        controller that wrote this status. This corresponds with the
+                        controllerName field on GatewayClass.
+
+                        Example: "example.net/gateway-controller".
+
+                        The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
+                        valid Kubernetes names
+                        (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
+
+                        Controllers MUST populate this field when writing status. Controllers should ensure that
+                        entries to status populated with their ControllerName are cleaned up when they are no
+                        longer necessary.
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
+                      type: string
+                  required:
+                  - ancestorRef
+                  - conditions
+                  - controllerName
+                  type: object
+                maxItems: 16
+                type: array
+                x-kubernetes-list-type: atomic
+            required:
+            - ancestors
+            type: object
+        required:
+        - spec
+        type: object
+    served: false
+    storage: false
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null
diff --git a/config/crd/standard/gateway.networking.k8s.io_gatewayclasses.yaml b/config/crd/standard/gateway.networking.k8s.io_gatewayclasses.yaml
index 9268f6f1..4d54568c 100644
--- a/config/crd/standard/gateway.networking.k8s.io_gatewayclasses.yaml
+++ b/config/crd/standard/gateway.networking.k8s.io_gatewayclasses.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: standard
-  creationTimestamp: null
   name: gatewayclasses.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -237,6 +236,25 @@ spec:
                 x-kubernetes-list-map-keys:
                 - type
                 x-kubernetes-list-type: map
+              supportedFeatures:
+                description: |-
+                  SupportedFeatures is the set of features the GatewayClass support.
+                  It MUST be sorted in ascending alphabetical order by the Name key.
+                items:
+                  properties:
+                    name:
+                      description: |-
+                        FeatureName is used to describe distinct features that are covered by
+                        conformance tests.
+                      type: string
+                  required:
+                  - name
+                  type: object
+                maxItems: 64
+                type: array
+                x-kubernetes-list-map-keys:
+                - name
+                x-kubernetes-list-type: map
             type: object
         required:
         - spec
@@ -462,6 +480,25 @@ spec:
                 x-kubernetes-list-map-keys:
                 - type
                 x-kubernetes-list-type: map
+              supportedFeatures:
+                description: |-
+                  SupportedFeatures is the set of features the GatewayClass support.
+                  It MUST be sorted in ascending alphabetical order by the Name key.
+                items:
+                  properties:
+                    name:
+                      description: |-
+                        FeatureName is used to describe distinct features that are covered by
+                        conformance tests.
+                      type: string
+                  required:
+                  - name
+                  type: object
+                maxItems: 64
+                type: array
+                x-kubernetes-list-map-keys:
+                - name
+                x-kubernetes-list-type: map
             type: object
         required:
         - spec
diff --git a/config/crd/standard/gateway.networking.k8s.io_gateways.yaml b/config/crd/standard/gateway.networking.k8s.io_gateways.yaml
index 8b7b0a02..0930cff5 100644
--- a/config/crd/standard/gateway.networking.k8s.io_gateways.yaml
+++ b/config/crd/standard/gateway.networking.k8s.io_gateways.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: standard
-  creationTimestamp: null
   name: gateways.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -65,7 +64,7 @@ spec:
                   Addresses requested for this Gateway. This is optional and behavior can
                   depend on the implementation. If a value is set in the spec and the
                   requested address is invalid or unavailable, the implementation MUST
-                  indicate this in the associated entry in GatewayStatus.Addresses.
+                  indicate this in an associated entry in GatewayStatus.Conditions.
 
                   The Addresses field represents a request for the address(es) on the
                   "outside of the Gateway", that traffic bound for this Gateway will use.
@@ -120,20 +119,22 @@ spec:
                       type: string
                   type: object
                   x-kubernetes-validations:
-                  - message: Hostname value must only contain valid characters (matching
-                      ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
-                    rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
+                  - message: Hostname value must be empty or contain only valid characters
+                      (matching ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
+                    rule: 'self.type == ''Hostname'' ? (!has(self.value) || self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$""")):
                       true'
                 maxItems: 16
                 type: array
                 x-kubernetes-list-type: atomic
                 x-kubernetes-validations:
                 - message: IPAddress values must be unique
-                  rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
+                  rule: 'self.all(a1, a1.type == ''IPAddress'' && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
                 - message: Hostname values must be unique
-                  rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
+                  rule: 'self.all(a1, a1.type == ''Hostname''  && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
               gatewayClassName:
                 description: |-
                   GatewayClassName used for this Gateway. This is the name of a
@@ -1176,7 +1177,7 @@ spec:
                   Addresses requested for this Gateway. This is optional and behavior can
                   depend on the implementation. If a value is set in the spec and the
                   requested address is invalid or unavailable, the implementation MUST
-                  indicate this in the associated entry in GatewayStatus.Addresses.
+                  indicate this in an associated entry in GatewayStatus.Conditions.
 
                   The Addresses field represents a request for the address(es) on the
                   "outside of the Gateway", that traffic bound for this Gateway will use.
@@ -1231,20 +1232,22 @@ spec:
                       type: string
                   type: object
                   x-kubernetes-validations:
-                  - message: Hostname value must only contain valid characters (matching
-                      ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
-                    rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
+                  - message: Hostname value must be empty or contain only valid characters
+                      (matching ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
+                    rule: 'self.type == ''Hostname'' ? (!has(self.value) || self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$""")):
                       true'
                 maxItems: 16
                 type: array
                 x-kubernetes-list-type: atomic
                 x-kubernetes-validations:
                 - message: IPAddress values must be unique
-                  rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
+                  rule: 'self.all(a1, a1.type == ''IPAddress'' && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
                 - message: Hostname values must be unique
-                  rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2,
-                    a2.type == a1.type && a2.value == a1.value) : true )'
+                  rule: 'self.all(a1, a1.type == ''Hostname''  && has(a1.value) ?
+                    self.exists_one(a2, a2.type == a1.type && has(a2.value) && a2.value
+                    == a1.value) : true )'
               gatewayClassName:
                 description: |-
                   GatewayClassName used for this Gateway. This is the name of a
diff --git a/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml b/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml
index 4e81b088..6cb625fb 100644
--- a/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml
+++ b/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: standard
-  creationTimestamp: null
   name: grpcroutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml b/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml
index dfa6af4c..459431cb 100644
--- a/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml
+++ b/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: standard
-  creationTimestamp: null
   name: httproutes.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
@@ -880,6 +879,9 @@ spec:
                                       enum:
                                       - 301
                                       - 302
+                                      - 303
+                                      - 307
+                                      - 308
                                       type: integer
                                   type: object
                                 responseHeaderModifier:
@@ -1814,6 +1816,9 @@ spec:
                                 enum:
                                 - 301
                                 - 302
+                                - 303
+                                - 307
+                                - 308
                                 type: integer
                             type: object
                           responseHeaderModifier:
@@ -3689,6 +3694,9 @@ spec:
                                       enum:
                                       - 301
                                       - 302
+                                      - 303
+                                      - 307
+                                      - 308
                                       type: integer
                                   type: object
                                 responseHeaderModifier:
@@ -4623,6 +4631,9 @@ spec:
                                 enum:
                                 - 301
                                 - 302
+                                - 303
+                                - 307
+                                - 308
                                 type: integer
                             type: object
                           responseHeaderModifier:
diff --git a/config/crd/standard/gateway.networking.k8s.io_referencegrants.yaml b/config/crd/standard/gateway.networking.k8s.io_referencegrants.yaml
index 6a2d3689..61e9a756 100644
--- a/config/crd/standard/gateway.networking.k8s.io_referencegrants.yaml
+++ b/config/crd/standard/gateway.networking.k8s.io_referencegrants.yaml
@@ -3,9 +3,8 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
-    gateway.networking.k8s.io/bundle-version: v1.3.0
+    gateway.networking.k8s.io/bundle-version: v1.4.0
     gateway.networking.k8s.io/channel: standard
-  creationTimestamp: null
   name: referencegrants.gateway.networking.k8s.io
 spec:
   group: gateway.networking.k8s.io
diff --git a/conformance/base/manifests.yaml b/conformance/base/manifests.yaml
index d8f8c45a..63efb537 100644
--- a/conformance/base/manifests.yaml
+++ b/conformance/base/manifests.yaml
@@ -95,39 +95,6 @@ spec:
           matchLabels:
             gateway-conformance: backend
 ---
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: gateway-backendtlspolicy
-  namespace: gateway-conformance-infra
-spec:
-  gatewayClassName: "{GATEWAY_CLASS_NAME}"
-  listeners:
-  - name: http
-    port: 80
-    protocol: HTTP
-    hostname: "abc.example.com"
-    allowedRoutes:
-      namespaces:
-        from: Same
-      kinds:
-      - kind: HTTPRoute
-  - name: https
-    port: 443
-    protocol: HTTPS
-    tls:
-      mode: Terminate
-      certificateRefs:
-      - group: ""
-        kind: Secret
-        name: tls-checks-certificate
-    hostname: "abc.example.com"
-    allowedRoutes:
-      namespaces:
-        from: Same
-      kinds:
-      - kind: HTTPRoute
----
 apiVersion: v1
 kind: Service
 metadata:
@@ -737,7 +704,8 @@ spec:
       - args:
         - -conf
         - /root/Corefile
-        image: coredns/coredns
+        image: registry.k8s.io/coredns/coredns:v1.12.2
+        imagePullPolicy: IfNotPresent
         name: coredns
         securityContext:
           allowPrivilegeEscalation: false
diff --git a/conformance/conformance.go b/conformance/conformance.go
index ce7a465c..642a6eb2 100644
--- a/conformance/conformance.go
+++ b/conformance/conformance.go
@@ -36,6 +36,8 @@ import (
 	clientset "k8s.io/client-go/kubernetes"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/config"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	"sigs.k8s.io/yaml"
 )
 
@@ -43,6 +45,9 @@ import (
 // ConformanceOptions struct. It will also initialize the various clients
 // required by the tests.
 func DefaultOptions(t *testing.T) suite.ConformanceOptions {
+	// This line prevents controller-runtime from complaining about log.SetLogger never being called
+	log.SetLogger(zap.New(zap.WriteTo(os.Stdout), zap.UseDevMode(true)))
+
 	cfg, err := config.GetConfig()
 	require.NoError(t, err, "error loading Kubernetes config")
 	clientOptions := client.Options{}
@@ -88,6 +93,7 @@ func DefaultOptions(t *testing.T) suite.ConformanceOptions {
 		ExemptFeatures:             exemptFeatures,
 		ManifestFS:                 []fs.FS{&Manifests},
 		GatewayClassName:           *flags.GatewayClassName,
+		MeshName:                   *flags.MeshName,
 		Implementation:             implementation,
 		Mode:                       *flags.Mode,
 		NamespaceAnnotations:       namespaceAnnotations,
diff --git a/conformance/reports/v1.3.0/cloud-provider-kind/README.md b/conformance/reports/v1.3.0/cloud-provider-kind/README.md
new file mode 100644
index 00000000..78ef0af3
--- /dev/null
+++ b/conformance/reports/v1.3.0/cloud-provider-kind/README.md
@@ -0,0 +1,30 @@
+# Cloud Provider KIND
+
+## Table of Contents
+
+|API channel|Implementation version|Mode|Report|
+|-----------|----------------------|----|------|
+|standard|[v0.8.0-alpha.1]|default|[report](./standard-v0.8.0-alpha.1-default-report.yaml)|
+
+## Reproduce
+
+1. `[Install `cloud-provider-kind`](https://github.com/kubernetes-sigs/cloud-provider-kind/tree/v0.8.0-alpha.1?tab=readme-ov-file#install)
+
+2. [Run a `KIND` cluster](https://kind.sigs.k8s.io/docs/user/quick-start/)
+
+3. [Start the `cloud-provider-kind`](https://github.com/kubernetes-sigs/cloud-provider-kind/tree/v0.8.0-alpha.1?tab=readme-ov-file#gateway-api-support-alpha)
+
+4. Run the conformance tests:
+
+```sh
+go test ./conformance -run TestConformance \
+  --report-output /tmp/report.yaml \
+  --organization=sigs.k8s.io \
+  --project=cloud-provider-kind \
+  --url=https://github.com/kubernetes-sigs/cloud-provider-kind \
+  --version=v0.8.0-alpha.1 \
+  --contact=https://github.com/kubernetes-sigs/cloud-provider-kind/issues/new \
+  --gateway-class=cloud-provider-kind \
+  --conformance-profiles=GATEWAY-HTTP \
+  --supported-features=Gateway,HTTPRoute,ReferenceGrant
+```
\ No newline at end of file
diff --git a/conformance/reports/v1.3.0/cloud-provider-kind/standard-v0.8.0-alpha.1-default-report.yaml b/conformance/reports/v1.3.0/cloud-provider-kind/standard-v0.8.0-alpha.1-default-report.yaml
new file mode 100644
index 00000000..a9709d2f
--- /dev/null
+++ b/conformance/reports/v1.3.0/cloud-provider-kind/standard-v0.8.0-alpha.1-default-report.yaml
@@ -0,0 +1,22 @@
+apiVersion: gateway.networking.k8s.io/v1
+date: "2025-09-07T12:44:41Z"
+gatewayAPIChannel: standard
+gatewayAPIVersion: v1.3.0
+implementation:
+  contact:
+  - https://github.com/kubernetes-sigs/cloud-provider-kind/issues/new
+  organization: sigs.k8s.io
+  project: cloud-provider-kind
+  url: https://github.com/kubernetes-sigs/cloud-provider-kind
+  version: v0.8.0-alpha.1
+kind: ConformanceReport
+mode: default
+profiles:
+- core:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 33
+      Skipped: 0
+  name: GATEWAY-HTTP
+  summary: Core tests succeeded.
diff --git a/conformance/reports/v1.3.0/gke-gateway/README.md b/conformance/reports/v1.3.0/gke-gateway/README.md
new file mode 100644
index 00000000..60c30d79
--- /dev/null
+++ b/conformance/reports/v1.3.0/gke-gateway/README.md
@@ -0,0 +1,43 @@
+# GKE (Google Kubernetes Engine) Gateway
+
+## Table of Contents
+
+|API channel|Implementation version|Mode|Report|
+|-----------|----------------------|----|------|
+|standard|1.33.4-gke.1134000|gke-l7-global-external-managed|[v1.33.4 gxlb report](./standard-1.33.4-gxlb-report.yaml)|
+
+## Reproduce
+
+GKE Gateway conformance report can be reproduced by the following steps.
+
+1. create a GKE cluster with Gateway API enabled (the minimum cluster version that supports v1.3.0 CRD is `1.33.2-gke.1335000`)
+
+```
+gcloud container clusters create "${cluster_name}" --gateway-api=standard --location="${location}"
+```
+
+2. create a proxy-only subnet if using a regional Gateway following [guide](https://cloud.google.com/kubernetes-engine/docs/how-to/deploying-gateways#configure_a_proxy-only_subnet)
+
+3. run the following command from within the [GKE Gateway repo](https://github.com/GoogleCloudPlatform/gke-gateway-api)
+
+```
+go test ./conformance -run TestConformance -v -timeout=3h -args \
+    --gateway-class=gke-l7-global-external-managed \
+    --conformance-profiles=GATEWAY-HTTP \
+    --organization=GKE \
+    --project=gke-gateway \
+    --url=https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api \
+    --version=1.33.4-gke.1134000 \
+    --contact=gke-gateway-dev@google.com \
+    --report-output="/path/to/report"
+```
+
+or run a single conformance test case
+
+```
+go test ./conformance -run TestConformance -v -args \
+    --gateway-class=gke-l7-global-external-managed \
+    --run-test=HTTPRouteRequestMirror
+```
+
+Note: the repro result can be flaky in some cases because the conformance framework doesn't isolate test cases enough.
diff --git a/conformance/reports/v1.3.0/gke-gateway/standard-1.33.4-gxlb-report.yaml b/conformance/reports/v1.3.0/gke-gateway/standard-1.33.4-gxlb-report.yaml
new file mode 100644
index 00000000..007cc526
--- /dev/null
+++ b/conformance/reports/v1.3.0/gke-gateway/standard-1.33.4-gxlb-report.yaml
@@ -0,0 +1,57 @@
+apiVersion: gateway.networking.k8s.io/v1
+date: "2025-09-14T21:45:48-07:00"
+gatewayAPIChannel: standard
+gatewayAPIVersion: v1.3.0
+implementation:
+  contact:
+  - gke-gateway-dev@google.com
+  organization: GKE
+  project: gke-gateway
+  url: https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api
+  version: 1.33.4-gke.1134000
+kind: ConformanceReport
+mode: default
+profiles:
+- core:
+    result: partial
+    skippedTests:
+    - HTTPRouteHostnameIntersection
+    statistics:
+      Failed: 0
+      Passed: 32
+      Skipped: 1
+  extended:
+    result: success
+    statistics:
+      Failed: 0
+      Passed: 7
+      Skipped: 0
+    supportedFeatures:
+    - GatewayPort8080
+    - HTTPRouteHostRewrite
+    - HTTPRoutePathRedirect
+    - HTTPRouteRequestMirror
+    - HTTPRouteRequestPercentageMirror
+    - HTTPRouteResponseHeaderModification
+    - HTTPRouteSchemeRedirect
+    unsupportedFeatures:
+    - GatewayAddressEmpty
+    - GatewayHTTPListenerIsolation
+    - GatewayInfrastructurePropagation
+    - GatewayStaticAddresses
+    - HTTPRouteBackendProtocolH2C
+    - HTTPRouteBackendProtocolWebSocket
+    - HTTPRouteBackendRequestHeaderModification
+    - HTTPRouteBackendTimeout
+    - HTTPRouteDestinationPortMatching
+    - HTTPRouteMethodMatching
+    - HTTPRouteParentRefPort
+    - HTTPRoutePathRewrite
+    - HTTPRoutePortRedirect
+    - HTTPRouteQueryParamMatching
+    - HTTPRouteRequestMultipleMirrors
+    - HTTPRouteRequestTimeout
+  name: GATEWAY-HTTP
+  summary: Core tests partially succeeded with 1 test skips. Extended tests succeeded.
+succeededProvisionalTests:
+- HTTPRouteRequestPercentageMirror
diff --git a/conformance/reports/v1.3.0/traefik-traefik/README.md b/conformance/reports/v1.3.0/traefik-traefik/README.md
new file mode 100644
index 00000000..121b2bd6
--- /dev/null
+++ b/conformance/reports/v1.3.0/traefik-traefik/README.md
@@ -0,0 +1,29 @@
+# Traefik Proxy
+
+## Table of Contents
+
+| API channel  | Implementation version                                           | Mode    | Report                                                     |
+|--------------|------------------------------------------------------------------|---------|------------------------------------------------------------|
+| experimental | [v3.5.0](https://github.com/traefik/traefik/releases/tag/v3.5.0) | default | [v3.5.0 report](./experimental-v3.5.0-default-report.yaml) |
+
+## Reproduce
+
+To reproduce the results, clone the Traefik Proxy repository:
+
+```shell
+git clone https://github.com/traefik/traefik.git && cd traefik
+```
+
+Check out the desired version:
+
+```shell
+git checkout vX.Y
+```
+
+Run the conformance tests with:
+
+```shell
+make test-gateway-api-conformance
+```
+
+Check the produced report in the `./integration/conformance-reports` folder.
diff --git a/conformance/reports/v1.3.0/traefik-traefik/experimental-v3.5.0-default-report.yaml b/conformance/reports/v1.3.0/traefik-traefik/experimental-v3.5.0-default-report.yaml
new file mode 100644
index 00000000..5f11a8bf
--- /dev/null
+++ b/conformance/reports/v1.3.0/traefik-traefik/experimental-v3.5.0-default-report.yaml
@@ -0,0 +1,69 @@
+apiVersion: gateway.networking.k8s.io/v1
+date: '-'
+gatewayAPIChannel: experimental
+gatewayAPIVersion: v1.3.0
+implementation:
+  contact:
+    - '@traefik/maintainers'
+  organization: traefik
+  project: traefik
+  url: https://traefik.io/
+  version: v3.5
+kind: ConformanceReport
+mode: default
+profiles:
+  - core:
+      result: success
+      statistics:
+        Failed: 0
+        Passed: 12
+        Skipped: 0
+    name: GATEWAY-GRPC
+    summary: Core tests succeeded.
+  - core:
+      result: success
+      statistics:
+        Failed: 0
+        Passed: 33
+        Skipped: 0
+    extended:
+      result: success
+      statistics:
+        Failed: 0
+        Passed: 13
+        Skipped: 0
+      supportedFeatures:
+        - GatewayPort8080
+        - HTTPRouteBackendProtocolH2C
+        - HTTPRouteBackendProtocolWebSocket
+        - HTTPRouteDestinationPortMatching
+        - HTTPRouteHostRewrite
+        - HTTPRouteMethodMatching
+        - HTTPRoutePathRedirect
+        - HTTPRoutePathRewrite
+        - HTTPRoutePortRedirect
+        - HTTPRouteQueryParamMatching
+        - HTTPRouteResponseHeaderModification
+        - HTTPRouteSchemeRedirect
+      unsupportedFeatures:
+        - GatewayAddressEmpty
+        - GatewayHTTPListenerIsolation
+        - GatewayInfrastructurePropagation
+        - GatewayStaticAddresses
+        - HTTPRouteBackendRequestHeaderModification
+        - HTTPRouteBackendTimeout
+        - HTTPRouteParentRefPort
+        - HTTPRouteRequestMirror
+        - HTTPRouteRequestMultipleMirrors
+        - HTTPRouteRequestPercentageMirror
+        - HTTPRouteRequestTimeout
+    name: GATEWAY-HTTP
+    summary: Core tests succeeded. Extended tests succeeded.
+  - core:
+      result: success
+      statistics:
+        Failed: 0
+        Passed: 11
+        Skipped: 0
+    name: GATEWAY-TLS
+    summary: Core tests succeeded.
diff --git a/conformance/utils/echo/pod.go b/conformance/utils/echo/pod.go
index dff03ed5..1a3e40fb 100644
--- a/conformance/utils/echo/pod.go
+++ b/conformance/utils/echo/pod.go
@@ -82,7 +82,15 @@ func makeRequest(t *testing.T, exp *http.ExpectedResponse) []string {
 	if exp.Request.Host == "" {
 		exp.Request.Host = "echo"
 	}
-	if exp.Request.Method == "" {
+
+	r := exp.Request
+	protocol := strings.ToLower(r.Protocol)
+	if protocol == "" {
+		protocol = "http"
+	}
+
+	// Only set default method for HTTP protocols, not for gRPC
+	if protocol != "grpc" && exp.Request.Method == "" {
 		exp.Request.Method = "GET"
 	}
 
@@ -96,14 +104,9 @@ func makeRequest(t *testing.T, exp *http.ExpectedResponse) []string {
 		exp.Response.StatusCodes = []int{200}
 	}
 
-	r := exp.Request
-	protocol := strings.ToLower(r.Protocol)
-	if protocol == "" {
-		protocol = "http"
-	}
 	host := http.CalculateHost(t, r.Host, protocol)
 	args := []string{"client", fmt.Sprintf("%s://%s%s", protocol, host, r.Path)}
-	if r.Method != "" {
+	if protocol != "grpc" && r.Method != "" {
 		args = append(args, "--method="+r.Method)
 	}
 	for k, v := range r.Headers {
@@ -118,11 +121,32 @@ func compareRequest(exp http.ExpectedResponse, resp Response) error {
 	}
 	wantReq := exp.ExpectedRequest
 	wantResp := exp.Response
+
+	// Parse the response status code
 	statusCode, err := strconv.Atoi(resp.Code)
 	if err != nil {
 		return fmt.Errorf("invalid status code '%v': %v", resp.Code, err)
 	}
-	if !slices.Contains(wantResp.StatusCodes, statusCode) {
+
+	// Handle gRPC protocol special case for status code mapping
+	if strings.ToLower(exp.Request.Protocol) == "grpc" {
+		// For gRPC, we need to handle the status code mapping
+		// The Istio echo client reports HTTP status codes even for gRPC requests
+		expectedStatusCodes := make([]int, len(wantResp.StatusCodes))
+		copy(expectedStatusCodes, wantResp.StatusCodes)
+
+		// Map gRPC status 0 (OK) to HTTP 200 if needed
+		for i, code := range expectedStatusCodes {
+			if code == 0 {
+				expectedStatusCodes[i] = 200
+			}
+		}
+
+		if !slices.Contains(expectedStatusCodes, statusCode) {
+			return fmt.Errorf("wanted gRPC status code to be one of %v (mapped to HTTP), got %d", wantResp.StatusCodes, statusCode)
+		}
+	} else if !slices.Contains(wantResp.StatusCodes, statusCode) {
+		// For HTTP, use the status codes directly
 		return fmt.Errorf("wanted status code to be one of %v, got %d", wantResp.StatusCodes, statusCode)
 	}
 	if wantReq.Headers != nil {
diff --git a/conformance/utils/flags/flags.go b/conformance/utils/flags/flags.go
index 95da9eaa..1465df68 100644
--- a/conformance/utils/flags/flags.go
+++ b/conformance/utils/flags/flags.go
@@ -30,6 +30,7 @@ const (
 
 var (
 	GatewayClassName           = flag.String("gateway-class", "gateway-conformance", "Name of GatewayClass to use for tests")
+	MeshName                   = flag.String("mesh-name", "", "Name of Mesh to use for tests")
 	ShowDebug                  = flag.Bool("debug", false, "Whether to print debug logs")
 	CleanupBaseResources       = flag.Bool("cleanup-base-resources", true, "Whether to cleanup base test resources after the run")
 	SupportedFeatures          = flag.String("supported-features", "", "Supported features included in conformance tests suites")
diff --git a/conformance/utils/grpc/grpc.go b/conformance/utils/grpc/grpc.go
index 70adfe2e..25b1d7ab 100644
--- a/conformance/utils/grpc/grpc.go
+++ b/conformance/utils/grpc/grpc.go
@@ -35,6 +35,7 @@ import (
 	"sigs.k8s.io/gateway-api/conformance/utils/config"
 	"sigs.k8s.io/gateway-api/conformance/utils/http"
 	"sigs.k8s.io/gateway-api/conformance/utils/tlog"
+	"sigs.k8s.io/gateway-api/conformance/utils/weight"
 )
 
 const (
@@ -289,3 +290,20 @@ func MakeRequestAndExpectEventuallyConsistentResponse(t *testing.T, c Client, ti
 	http.AwaitConvergence(t, timeoutConfig.RequiredConsecutiveSuccesses, timeoutConfig.MaxTimeToConsistency, sendRPC)
 	tlog.Logf(t, "Request passed")
 }
+
+// AddEntropy adds randomness to ExpectedResponse to avoid caching issues and ensure each request is unique.
+// It randomly chooses to add a delay, random metadata, or both.
+func AddEntropy(exp *ExpectedResponse) error {
+	addRandomMetadata := func(randomValue string) error {
+		if exp.RequestMetadata == nil {
+			exp.RequestMetadata = &RequestMetadata{}
+		}
+		if exp.RequestMetadata.Metadata == nil {
+			exp.RequestMetadata.Metadata = make(map[string]string)
+		}
+		exp.RequestMetadata.Metadata["x-jitter"] = randomValue
+		return nil
+	}
+
+	return weight.AddRandomEntropy(addRandomMetadata)
+}
diff --git a/conformance/utils/http/http.go b/conformance/utils/http/http.go
index 6cd68dd0..2d116423 100644
--- a/conformance/utils/http/http.go
+++ b/conformance/utils/http/http.go
@@ -17,9 +17,7 @@ limitations under the License.
 package http
 
 import (
-	"crypto/rand"
 	"fmt"
-	"math/big"
 	"net"
 	"net/url"
 	"slices"
@@ -30,6 +28,7 @@ import (
 	"sigs.k8s.io/gateway-api/conformance/utils/config"
 	"sigs.k8s.io/gateway-api/conformance/utils/roundtripper"
 	"sigs.k8s.io/gateway-api/conformance/utils/tlog"
+	"sigs.k8s.io/gateway-api/conformance/utils/weight"
 )
 
 // ExpectedResponse defines the response expected for a given request.
@@ -497,53 +496,13 @@ func setRedirectRequestDefaults(req *roundtripper.Request, cRes *roundtripper.Ca
 	}
 }
 
-// addEntropy adds jitter to the request by adding either a delay up to 1 second, or a random header value, or both.
+// AddEntropy adds jitter to the request by adding either a delay up to 1 second, or a random header value, or both.
 func AddEntropy(exp *ExpectedResponse) error {
-	randomNumber := func(limit int64) (*int64, error) {
-		number, err := rand.Int(rand.Reader, big.NewInt(limit))
-		if err != nil {
-			return nil, err
-		}
-		n := number.Int64()
-		return &n, nil
-	}
-
-	// adds a delay
-	delay := func(limit int64) error {
-		randomSleepDuration, err := randomNumber(limit)
-		if err != nil {
-			return err
-		}
-		time.Sleep(time.Duration(*randomSleepDuration) * time.Millisecond)
-		return nil
-	}
-	// adds random header value
-	randomHeader := func(limit int64) error {
-		randomHeaderValue, err := randomNumber(limit)
-		if err != nil {
-			return err
-		}
+	addRandomHeader := func(randomValue string) error {
 		exp.Request.Headers = make(map[string]string)
-		exp.Request.Headers["X-Jitter"] = fmt.Sprintf("%d", *randomHeaderValue)
+		exp.Request.Headers["X-Jitter"] = randomValue
 		return nil
 	}
 
-	random, err := randomNumber(3)
-	if err != nil {
-		return err
-	}
-
-	switch *random {
-	case 0:
-		return delay(1000)
-	case 1:
-		return randomHeader(10000)
-	case 2:
-		if err := delay(1000); err != nil {
-			return err
-		}
-		return randomHeader(10000)
-	default:
-		return fmt.Errorf("invalid random value: %d", *random)
-	}
+	return weight.AddRandomEntropy(addRandomHeader)
 }
diff --git a/conformance/utils/kubernetes/apply.go b/conformance/utils/kubernetes/apply.go
index 1b3b01d5..3f31b308 100644
--- a/conformance/utils/kubernetes/apply.go
+++ b/conformance/utils/kubernetes/apply.go
@@ -340,18 +340,21 @@ func getContentsFromPathOrURL(manifestFS []fs.FS, location string, timeoutConfig
 		}
 		return manifests, nil
 	}
-	var err error
-	var buf []byte
+
+	var buffer bytes.Buffer
 	for _, mfs := range manifestFS {
-		buf, err = fs.ReadFile(mfs, location)
+		buf, err := fs.ReadFile(mfs, location)
 		if err != nil && errors.Is(err, fs.ErrNotExist) {
 			continue
 		} else if err != nil {
 			return nil, err
 		}
-		return bytes.NewBuffer(buf), nil
+		_, err = buffer.Write(buf)
+		if err != nil {
+			return nil, err
+		}
 	}
-	return nil, err
+	return &buffer, nil
 }
 
 // convertGatewayAddrsToPrimitives converts a slice of Gateway addresses
diff --git a/conformance/utils/kubernetes/certificate.go b/conformance/utils/kubernetes/certificate.go
index 1b2ee3af..8d9b9357 100644
--- a/conformance/utils/kubernetes/certificate.go
+++ b/conformance/utils/kubernetes/certificate.go
@@ -151,12 +151,10 @@ func generateRSACert(hosts []string, keyOut, certOut io.Writer, ca *x509.Certifi
 
 // MustCreateCACertConfigMap will create a ConfigMap containing a CA Certificate, given a TLS Secret
 // for that CA certificate.  Also returns the CA certificate.
-func MustCreateCACertConfigMap(t *testing.T, namespace, configMapName string, hosts []string) (*corev1.ConfigMap, *x509.Certificate, *rsa.PrivateKey) {
-	require.NotEmpty(t, hosts, "require a non-empty hosts for Subject Alternate Name values")
-
+func MustCreateCACertConfigMap(t *testing.T, namespace, configMapName string) (*corev1.ConfigMap, *x509.Certificate, *rsa.PrivateKey) {
 	var certData, keyData bytes.Buffer
 
-	ca, caBytes, caPrivKey, err := generateCACert(hosts)
+	ca, caBytes, caPrivKey, err := generateCACert()
 	if err != nil {
 		t.Errorf("failed to generate CA certificate and key: %v", err)
 		return nil, nil, nil
@@ -187,8 +185,8 @@ func MustCreateCACertConfigMap(t *testing.T, namespace, configMapName string, ho
 	return caConfigMap, ca, caPrivKey
 }
 
-// generateCACert generates a CA and a CA-signed certificate valid for a year.
-func generateCACert(hosts []string) (*x509.Certificate, []byte, *rsa.PrivateKey, error) {
+// generateCACert generates a CA certificate valid for a year.
+func generateCACert() (*x509.Certificate, []byte, *rsa.PrivateKey, error) {
 	var caBytes []byte
 
 	// Create the CA certificate template.
@@ -212,17 +210,6 @@ func generateCACert(hosts []string) (*x509.Certificate, []byte, *rsa.PrivateKey,
 		BasicConstraintsValid: true,
 	}
 
-	// Ensure only valid hosts make it into the CA cert.
-	for _, h := range hosts {
-		if ip := net.ParseIP(h); ip != nil {
-			ca.IPAddresses = append(ca.IPAddresses, ip)
-		} else if err := validateHost(h); err == nil {
-			ca.DNSNames = append(ca.DNSNames, h)
-		} else if u, err := url.Parse(h); err == nil {
-			ca.URIs = append(ca.URIs, u)
-		}
-	}
-
 	// Generate the private key to sign certificates.
 	caPrivKey, err := rsa.GenerateKey(rand.Reader, rsaBits)
 	if err != nil {
diff --git a/conformance/utils/kubernetes/helpers.go b/conformance/utils/kubernetes/helpers.go
index 3309c8f2..d32899e2 100644
--- a/conformance/utils/kubernetes/helpers.go
+++ b/conformance/utils/kubernetes/helpers.go
@@ -37,7 +37,6 @@ import (
 
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
 	"sigs.k8s.io/gateway-api/apis/v1alpha2"
-	"sigs.k8s.io/gateway-api/apis/v1alpha3"
 	"sigs.k8s.io/gateway-api/conformance/utils/config"
 	"sigs.k8s.io/gateway-api/conformance/utils/tlog"
 )
@@ -345,7 +344,7 @@ func GatewayAndRoutesMustBeAccepted(t *testing.T, c client.Client, timeoutConfig
 	// If the Gateway has multiple listeners, get a portless gwAddr.
 	// Otherwise, you get the first listener's port, which might not be the one you want.
 	if !usePort {
-		gwAddr, _, _ = strings.Cut(gwAddr, ":")
+		gwAddr, _, _ = net.SplitHostPort(gwAddr)
 	}
 
 	ns := gatewayv1.Namespace(gw.Namespace)
@@ -1000,7 +999,7 @@ func findPodConditionInList(t *testing.T, conditions []v1.PodCondition, condName
 func BackendTLSPolicyMustHaveCondition(t *testing.T, client client.Client, timeoutConfig config.TimeoutConfig, policyNN, gwNN types.NamespacedName, condition metav1.Condition) {
 	t.Helper()
 	waitErr := wait.PollUntilContextTimeout(context.Background(), 1*time.Second, timeoutConfig.HTTPRouteMustHaveCondition, true, func(ctx context.Context) (bool, error) {
-		policy := &v1alpha3.BackendTLSPolicy{}
+		policy := &gatewayv1.BackendTLSPolicy{}
 		err := client.Get(ctx, policyNN, policy)
 		if err != nil {
 			return false, fmt.Errorf("error fetching BackendTLSPolicy %v err: %w", policyNN, err)
@@ -1029,7 +1028,7 @@ func BackendTLSPolicyMustHaveCondition(t *testing.T, client client.Client, timeo
 
 // BackendTLSPolicyMustHaveLatestConditions will fail the test if there are
 // conditions that were not updated
-func BackendTLSPolicyMustHaveLatestConditions(t *testing.T, r *v1alpha3.BackendTLSPolicy) {
+func BackendTLSPolicyMustHaveLatestConditions(t *testing.T, r *gatewayv1.BackendTLSPolicy) {
 	t.Helper()
 
 	for _, ancestor := range r.Status.Ancestors {
diff --git a/conformance/utils/suite/conformance.go b/conformance/utils/suite/conformance.go
index 436b3ed2..12db14d6 100644
--- a/conformance/utils/suite/conformance.go
+++ b/conformance/utils/suite/conformance.go
@@ -68,7 +68,7 @@ func (test *ConformanceTest) Run(t *testing.T, suite *ConformanceTestSuite) {
 
 	for _, manifestLocation := range test.Manifests {
 		tlog.Logf(t, "Applying %s", manifestLocation)
-		suite.Applier.MustApplyWithCleanup(t, suite.Client, suite.TimeoutConfig, manifestLocation, suite.Cleanup)
+		suite.Applier.MustApplyWithCleanup(t, suite.Client, suite.TimeoutConfig, manifestLocation, true)
 	}
 
 	if featuresInfo != "" {
diff --git a/conformance/utils/suite/suite.go b/conformance/utils/suite/suite.go
index 877c030f..5df2c722 100644
--- a/conformance/utils/suite/suite.go
+++ b/conformance/utils/suite/suite.go
@@ -39,6 +39,7 @@ import (
 
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
 	"sigs.k8s.io/gateway-api/apis/v1beta1"
+	xmeshv1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
 	confv1 "sigs.k8s.io/gateway-api/conformance/apis/v1"
 	"sigs.k8s.io/gateway-api/conformance/utils/config"
 	"sigs.k8s.io/gateway-api/conformance/utils/flags"
@@ -65,6 +66,7 @@ type ConformanceTestSuite struct {
 	RoundTripper             roundtripper.RoundTripper
 	GRPCClient               grpc.Client
 	GatewayClassName         string
+	MeshName                 string
 	ControllerName           string
 	Debug                    bool
 	Cleanup                  bool
@@ -136,6 +138,7 @@ type ConformanceOptions struct {
 	Clientset            clientset.Interface
 	RestConfig           *rest.Config
 	GatewayClassName     string
+	MeshName             string
 	AddressType          string
 	Debug                bool
 	RoundTripper         roundtripper.RoundTripper
@@ -206,20 +209,23 @@ func NewConformanceTestSuite(options ConformanceOptions) (*ConformanceTestSuite,
 		supportedFeatures = features.SetsToNamesSet(features.AllFeatures)
 	} else if shouldInferSupportedFeatures(&options) {
 		var err error
-		supportedFeatures, err = fetchSupportedFeatures(options.Client, options.GatewayClassName)
-		if err != nil {
-			return nil, fmt.Errorf("cannot infer supported features: %w", err)
+		if options.GatewayClassName != "" {
+			supportedFeatures, err = fetchGatewayClassSupportedFeatures(options.Client, options.GatewayClassName)
+			if err != nil {
+				return nil, fmt.Errorf("cannot infer supported features from GWC: %w", err)
+			}
 		}
 
-		// If Mesh features are populated in the GatewayClass we remove them from the supported features set.
-		meshFeatureNames := features.SetsToNamesSet(features.MeshCoreFeatures, features.MeshExtendedFeatures)
-		for _, f := range supportedFeatures.UnsortedList() {
-			if meshFeatureNames.Has(f) {
-				supportedFeatures.Delete(f)
-				fmt.Printf("WARNING: Mesh feature %q should not be populated in GatewayClass, skipping...", f)
+		supportedMeshFeatures := FeaturesSet{}
+		if options.MeshName != "" {
+			supportedMeshFeatures, err = fetchMeshSupportedFeatures(options.Client, options.MeshName)
+			if err != nil {
+				return nil, fmt.Errorf("cannot infer supported features from XMesh: %w", err)
 			}
 		}
+
 		source = supportedFeaturesSourceInferred
+		supportedFeatures = supportedFeatures.Union(supportedMeshFeatures)
 	}
 
 	// If features were not inferred from Status, it's a GWC issue.
@@ -227,6 +233,22 @@ func NewConformanceTestSuite(options ConformanceOptions) (*ConformanceTestSuite,
 		return nil, fmt.Errorf("no supported features were determined for test suite")
 	}
 
+	extendedSupportedFeatures := make(map[ConformanceProfileName]FeaturesSet, 0)
+	extendedUnsupportedFeatures := make(map[ConformanceProfileName]FeaturesSet, 0)
+
+	for _, conformanceProfileName := range options.ConformanceProfiles.UnsortedList() {
+		conformanceProfile, err := getConformanceProfileForName(conformanceProfileName)
+		if err != nil {
+			return nil, fmt.Errorf("failed to retrieve conformance profile: %w", err)
+		}
+		// the use of a conformance profile implicitly enables any features of
+		// that profile which are supported at a Core level of support.
+		supportedFeatures = supportedFeatures.Union(conformanceProfile.CoreFeatures)
+
+		extendedSupportedFeatures[conformanceProfileName] = conformanceProfile.ExtendedFeatures.Intersection(supportedFeatures)
+		extendedUnsupportedFeatures[conformanceProfileName] = conformanceProfile.ExtendedFeatures.Difference(supportedFeatures)
+	}
+
 	config.SetupTimeoutConfig(&options.TimeoutConfig)
 
 	roundTripper := options.RoundTripper
@@ -284,8 +306,8 @@ func NewConformanceTestSuite(options ConformanceOptions) (*ConformanceTestSuite,
 		UsableNetworkAddresses:      options.UsableNetworkAddresses,
 		UnusableNetworkAddresses:    options.UnusableNetworkAddresses,
 		results:                     make(map[string]testResult),
-		extendedUnsupportedFeatures: make(map[ConformanceProfileName]sets.Set[features.FeatureName]),
-		extendedSupportedFeatures:   make(map[ConformanceProfileName]sets.Set[features.FeatureName]),
+		extendedUnsupportedFeatures: extendedUnsupportedFeatures,
+		extendedSupportedFeatures:   extendedSupportedFeatures,
 		conformanceProfiles:         options.ConformanceProfiles,
 		implementation:              options.Implementation,
 		mode:                        mode,
@@ -295,37 +317,6 @@ func NewConformanceTestSuite(options ConformanceOptions) (*ConformanceTestSuite,
 		Hook:                        options.Hook,
 	}
 
-	for _, conformanceProfileName := range options.ConformanceProfiles.UnsortedList() {
-		conformanceProfile, err := getConformanceProfileForName(conformanceProfileName)
-		if err != nil {
-			return nil, fmt.Errorf("failed to retrieve conformance profile: %w", err)
-		}
-		// the use of a conformance profile implicitly enables any features of
-		// that profile which are supported at a Core level of support.
-		for _, f := range conformanceProfile.CoreFeatures.UnsortedList() {
-			if !options.SupportedFeatures.Has(f) {
-				suite.SupportedFeatures.Insert(f)
-			}
-		}
-		for _, f := range conformanceProfile.ExtendedFeatures.UnsortedList() {
-			if options.SupportedFeatures.Has(f) {
-				if suite.extendedSupportedFeatures[conformanceProfileName] == nil {
-					suite.extendedSupportedFeatures[conformanceProfileName] = FeaturesSet{}
-				}
-				suite.extendedSupportedFeatures[conformanceProfileName].Insert(f)
-			} else {
-				if suite.extendedUnsupportedFeatures[conformanceProfileName] == nil {
-					suite.extendedUnsupportedFeatures[conformanceProfileName] = FeaturesSet{}
-				}
-				suite.extendedUnsupportedFeatures[conformanceProfileName].Insert(f)
-			}
-			// Add Exempt Features into unsupported features list
-			if options.ExemptFeatures.Has(f) {
-				suite.extendedUnsupportedFeatures[conformanceProfileName].Insert(f)
-			}
-		}
-	}
-
 	// apply defaults
 	if suite.BaseManifests == "" {
 		suite.BaseManifests = "base/manifests.yaml"
@@ -388,17 +379,14 @@ func (suite *ConformanceTestSuite) Setup(t *testing.T, tests []ConformanceTest)
 		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)
 		secret = kubernetes.MustCreateSelfSignedCertSecret(t, "gateway-conformance-app-backend", "tls-passthrough-checks-certificate", []string{"abc.example.com"})
 		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)
-		caConfigMapBST, _, _ := kubernetes.MustCreateCACertConfigMap(t, "gateway-conformance-infra", "backend-tls-mismatch-certificate", []string{"nex.example.com"})
-		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{caConfigMapBST}, suite.Cleanup)
-		caConfigMap, ca, caPrivKey := kubernetes.MustCreateCACertConfigMap(t, "gateway-conformance-infra", "backend-tls-checks-certificate", []string{"abc.example.com"})
+		caConfigMap, ca, caPrivKey := kubernetes.MustCreateCACertConfigMap(t, "gateway-conformance-infra", "tls-checks-ca-certificate")
 		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{caConfigMap}, suite.Cleanup)
-		secret = kubernetes.MustCreateCASignedCertSecret(t, "gateway-conformance-infra", "tls-checks-certificate", []string{"abc.example.com"}, ca, caPrivKey)
+		secret = kubernetes.MustCreateCASignedCertSecret(t, "gateway-conformance-infra", "tls-checks-certificate", []string{"abc.example.com", "spiffe://abc.example.com/test-identity", "other.example.com"}, ca, caPrivKey)
 		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)
-		// TODO(kl52752) Merge CA certificates for Backend TLS Policy and move Deployment to common file.
-		caConfigMap, ca, caPrivKey = kubernetes.MustCreateCACertConfigMap(t, "gateway-conformance-infra", "backend-tls-with-san-certificate", []string{"abc.example.com", "spiffe://abc.example.com/test-identity"})
+
+		// The following CA ceritficate is used for BackendTLSPolicy testing to intentionally force TLS validation to fail.
+		caConfigMap, _, _ = kubernetes.MustCreateCACertConfigMap(t, "gateway-conformance-infra", "mismatch-ca-certificate")
 		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{caConfigMap}, suite.Cleanup)
-		secret = kubernetes.MustCreateCASignedCertSecret(t, "gateway-conformance-infra", "tls-with-san-certificate", []string{"abc.example.com", "spiffe://abc.example.com/test-identity"}, ca, caPrivKey)
-		suite.Applier.MustApplyObjectsWithCleanup(t, suite.Client, suite.TimeoutConfig, []client.Object{secret}, suite.Cleanup)
 
 		tlog.Logf(t, "Test Setup: Ensuring Gateways and Pods from base manifests are ready")
 		namespaces := []string{
@@ -609,24 +597,59 @@ func ParseConformanceProfiles(p string) sets.Set[ConformanceProfileName] {
 	return res
 }
 
-func fetchSupportedFeatures(client client.Client, gatewayClassName string) (FeaturesSet, error) {
+func fetchGatewayClassSupportedFeatures(client client.Client, gatewayClassName string) (FeaturesSet, error) {
 	if gatewayClassName == "" {
 		return nil, fmt.Errorf("GatewayClass name must be provided to fetch supported features")
 	}
 	gwc := &gatewayv1.GatewayClass{}
 	err := client.Get(context.TODO(), types.NamespacedName{Name: gatewayClassName}, gwc)
 	if err != nil {
-		return nil, fmt.Errorf("fetchSupportedFeatures(): %w", err)
+		return nil, fmt.Errorf("fetchGatewayClassSupportedFeatures(): %w", err)
 	}
 
 	fs := FeaturesSet{}
 	for _, feature := range gwc.Status.SupportedFeatures {
 		fs.Insert(features.FeatureName(feature.Name))
 	}
+
+	// If Mesh features are populated in the GatewayClass we remove them from the supported features set.
+	meshFeatureNames := features.SetsToNamesSet(features.MeshCoreFeatures, features.MeshExtendedFeatures)
+	for _, f := range fs.UnsortedList() {
+		if meshFeatureNames.Has(f) {
+			fs.Delete(f)
+			fmt.Printf("WARNING: Mesh feature %q should not be populated in GatewayClass, skipping...", f)
+		}
+	}
 	fmt.Printf("Supported features for GatewayClass %s: %v\n", gatewayClassName, fs.UnsortedList())
 	return fs, nil
 }
 
+func fetchMeshSupportedFeatures(client client.Client, meshName string) (FeaturesSet, error) {
+	if meshName == "" {
+		return nil, fmt.Errorf("mesh name must be provided to fetch supported features")
+	}
+	xmesh := &xmeshv1alpha1.XMesh{}
+	err := client.Get(context.TODO(), types.NamespacedName{Name: meshName}, xmesh)
+	if err != nil {
+		return nil, fmt.Errorf("fetchMeshSupportedFeatures(): %w", err)
+	}
+
+	fs := FeaturesSet{}
+	for _, feature := range xmesh.Status.SupportedFeatures {
+		fs.Insert(features.FeatureName(feature.Name))
+	}
+
+	gwcFeatureNames := features.SetsToNamesSet(features.GatewayCoreFeatures, features.GatewayExtendedFeatures)
+	for _, f := range fs.UnsortedList() {
+		if gwcFeatureNames.Has(f) {
+			fs.Delete(f)
+			fmt.Printf("WARNING: Mesh feature %q should not be populated in XMesh.Status, skipping...", f)
+		}
+	}
+	fmt.Printf("Supported features for XMesh%s: %v\n", meshName, fs.UnsortedList())
+	return fs, nil
+}
+
 // shouldInferSupportedFeatures checks if any flags were supplied for manually
 // picking what to test. Inferred supported features are only used when no flags
 // are set.
diff --git a/conformance/utils/weight/senders.go b/conformance/utils/weight/senders.go
new file mode 100644
index 00000000..304ead0e
--- /dev/null
+++ b/conformance/utils/weight/senders.go
@@ -0,0 +1,31 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package weight
+
+// FunctionBasedSender implements RequestSender using a function
+type FunctionBasedSender struct {
+	sendFunc func() (string, error)
+}
+
+func (s *FunctionBasedSender) SendRequest() (string, error) {
+	return s.sendFunc()
+}
+
+// NewFunctionBasedSender creates a RequestSender from a function
+func NewFunctionBasedSender(sendFunc func() (string, error)) RequestSender {
+	return &FunctionBasedSender{sendFunc: sendFunc}
+}
diff --git a/conformance/utils/weight/weight.go b/conformance/utils/weight/weight.go
new file mode 100644
index 00000000..123719ae
--- /dev/null
+++ b/conformance/utils/weight/weight.go
@@ -0,0 +1,185 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package weight
+
+import (
+	"cmp"
+	"crypto/rand"
+	"errors"
+	"fmt"
+	"math"
+	"math/big"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"golang.org/x/sync/errgroup"
+)
+
+const (
+	// MaxTestRetries is the maximum number of times to retry the weight distribution test
+	// if it fails due to statistical variance before considering it a real failure
+	MaxTestRetries = 10
+)
+
+// RequestSender defines an interface for sending requests (HTTP, gRPC, or mesh)
+type RequestSender interface {
+	SendRequest() (podName string, err error)
+}
+
+// extractBackendName extracts the backend name from a pod name by removing deployment and pod hash suffixes
+func extractBackendName(podName string) string {
+	// Pod names follow the pattern: {backend-name}-{deployment-hash}-{pod-hash}
+	// We need to remove the last two dash-separated components
+	parts := strings.Split(podName, "-")
+	if len(parts) < 3 {
+		return podName // fallback to original name if pattern doesn't match
+	}
+	// Remove last two components (deployment hash and pod hash)
+	return strings.Join(parts[:len(parts)-2], "-")
+}
+
+// TestWeightedDistribution tests that requests are distributed according to expected weights
+func TestWeightedDistribution(sender RequestSender, expectedWeights map[string]float64) error {
+	const (
+		concurrentRequests  = 10
+		tolerancePercentage = 0.05
+		totalRequests       = 500
+	)
+
+	var (
+		g         errgroup.Group
+		seenMutex sync.Mutex
+		seen      = make(map[string]float64, len(expectedWeights))
+	)
+
+	g.SetLimit(concurrentRequests)
+	for i := 0; i < totalRequests; i++ {
+		g.Go(func() error {
+			podName, err := sender.SendRequest()
+			if err != nil {
+				return err
+			}
+
+			// Extract the backend name from the pod name
+			backendName := extractBackendName(podName)
+
+			seenMutex.Lock()
+			defer seenMutex.Unlock()
+
+			if _, exists := expectedWeights[backendName]; exists {
+				seen[backendName]++
+				return nil
+			}
+
+			return fmt.Errorf("request was handled by an unexpected pod %q (extracted backend: %q)", podName, backendName)
+		})
+	}
+
+	if err := g.Wait(); err != nil {
+		return fmt.Errorf("error while sending requests: %w", err)
+	}
+
+	// Count how many backends should receive traffic (weight > 0)
+	expectedActiveBackends := 0
+	for _, weight := range expectedWeights {
+		if weight > 0.0 {
+			expectedActiveBackends++
+		}
+	}
+
+	var errs []error
+	if len(seen) != expectedActiveBackends {
+		errs = append(errs, fmt.Errorf("expected %d backends to receive traffic, but got %d", expectedActiveBackends, len(seen)))
+	}
+
+	for wantBackend, wantPercent := range expectedWeights {
+		gotCount, ok := seen[wantBackend]
+
+		if !ok && wantPercent != 0.0 {
+			errs = append(errs, fmt.Errorf("expect traffic to hit backend %q - but none was received", wantBackend))
+			continue
+		}
+
+		gotPercent := gotCount / float64(totalRequests)
+
+		if math.Abs(gotPercent-wantPercent) > tolerancePercentage {
+			errs = append(errs, fmt.Errorf("backend %q weighted traffic of %v not within tolerance %v (+/-%f)",
+				wantBackend,
+				gotPercent,
+				wantPercent,
+				tolerancePercentage,
+			))
+		}
+	}
+
+	slices.SortFunc(errs, func(a, b error) int {
+		return cmp.Compare(a.Error(), b.Error())
+	})
+	return errors.Join(errs...)
+}
+
+// Entropy utilities
+
+// addRandomDelay adds a random delay up to the specified limit in milliseconds
+func addRandomDelay(limit int) {
+	n, err := rand.Int(rand.Reader, big.NewInt(int64(limit)))
+	if err != nil {
+		// Fallback to no delay if crypto/rand fails
+		return
+	}
+	randomSleepDuration := n.Int64()
+	time.Sleep(time.Duration(randomSleepDuration) * time.Millisecond)
+}
+
+// AddRandomEntropy randomly chooses to add delay, random value, or both
+// The addRandomValue function should be provided by the caller to handle
+// protocol-specific ways of adding the random value (HTTP headers, gRPC metadata, etc.)
+func AddRandomEntropy(addRandomValue func(string) error) error {
+	n, err := rand.Int(rand.Reader, big.NewInt(3))
+	if err != nil {
+		// Fallback to case 0 if crypto/rand fails
+		addRandomDelay(1000)
+		return err
+	}
+	random := n.Int64()
+
+	switch random {
+	case 0:
+		addRandomDelay(1000)
+		return nil
+	case 1:
+		valueN, err := rand.Int(rand.Reader, big.NewInt(10000))
+		if err != nil {
+			return fmt.Errorf("failed to generate random value: %w", err)
+		}
+		randomValue := valueN.Int64()
+		return addRandomValue(strconv.FormatInt(randomValue, 10))
+	case 2:
+		addRandomDelay(1000)
+		valueN, err := rand.Int(rand.Reader, big.NewInt(10000))
+		if err != nil {
+			return fmt.Errorf("failed to generate random value: %w", err)
+		}
+		randomValue := valueN.Int64()
+		return addRandomValue(strconv.FormatInt(randomValue, 10))
+	default:
+		return fmt.Errorf("invalid random value: %d", random)
+	}
+}
diff --git a/examples/experimental/v1alpha3/backendtlspolicy-ca-certs.yaml b/examples/standard/backendtlspolicy/backendtlspolicy-ca-certs.yaml
similarity index 86%
rename from examples/experimental/v1alpha3/backendtlspolicy-ca-certs.yaml
rename to examples/standard/backendtlspolicy/backendtlspolicy-ca-certs.yaml
index 574ac5a8..3cac8646 100644
--- a/examples/experimental/v1alpha3/backendtlspolicy-ca-certs.yaml
+++ b/examples/standard/backendtlspolicy/backendtlspolicy-ca-certs.yaml
@@ -1,6 +1,6 @@
 #$ Used in:
 #$ - site-src/guides/tls.md
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
   name: tls-upstream-auth
diff --git a/examples/experimental/v1alpha3/backendtlspolicy-system-certs.yaml b/examples/standard/backendtlspolicy/backendtlspolicy-system-certs.yaml
similarity index 84%
rename from examples/experimental/v1alpha3/backendtlspolicy-system-certs.yaml
rename to examples/standard/backendtlspolicy/backendtlspolicy-system-certs.yaml
index 82dd5006..b5bf80b1 100644
--- a/examples/experimental/v1alpha3/backendtlspolicy-system-certs.yaml
+++ b/examples/standard/backendtlspolicy/backendtlspolicy-system-certs.yaml
@@ -1,6 +1,6 @@
 #$ Used in:
 #$ - site-src/guides/tls.md
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
   name: tls-upstream-dev
diff --git a/examples/standard/http-redirect-rewrite/httproute-redirect-303.yaml b/examples/standard/http-redirect-rewrite/httproute-redirect-303.yaml
new file mode 100644
index 00000000..faac143b
--- /dev/null
+++ b/examples/standard/http-redirect-rewrite/httproute-redirect-303.yaml
@@ -0,0 +1,24 @@
+#$ Used in:
+#$ - site-src/guides/http-redirect-rewrite.md
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: post-redirect-get
+spec:
+  parentRefs:
+  - name: redirect-gateway
+  hostnames:
+  - forms.example.com
+  rules:
+  - matches:
+    - path:
+        type: Exact
+        value: /submit-form
+      method: POST
+    filters:
+    - type: RequestRedirect
+      requestRedirect:
+        path:
+          type: ReplaceFullPath
+          replaceFullPath: /thank-you
+        statusCode: 303
diff --git a/examples/standard/http-redirect-rewrite/httproute-redirect-307.yaml b/examples/standard/http-redirect-rewrite/httproute-redirect-307.yaml
new file mode 100644
index 00000000..1d421a1d
--- /dev/null
+++ b/examples/standard/http-redirect-rewrite/httproute-redirect-307.yaml
@@ -0,0 +1,23 @@
+#$ Used in:
+#$ - site-src/guides/http-redirect-rewrite.md
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: method-preserving-redirect
+spec:
+  parentRefs:
+  - name: redirect-gateway
+  hostnames:
+  - api.example.com
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /api/v1
+    filters:
+    - type: RequestRedirect
+      requestRedirect:
+        path:
+          type: ReplaceFullPath
+          replaceFullPath: /api/v2
+        statusCode: 307 
diff --git a/examples/standard/http-redirect-rewrite/httproute-redirect-308.yaml b/examples/standard/http-redirect-rewrite/httproute-redirect-308.yaml
new file mode 100644
index 00000000..057cc3c3
--- /dev/null
+++ b/examples/standard/http-redirect-rewrite/httproute-redirect-308.yaml
@@ -0,0 +1,23 @@
+#$ Used in:
+#$ - site-src/guides/http-redirect-rewrite.md
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: permanent-method-preserving-redirect
+spec:
+  parentRefs:
+  - name: redirect-gateway
+  hostnames:
+  - api.example.com
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /old-api
+    filters:
+    - type: RequestRedirect
+      requestRedirect:
+        path:
+          type: ReplaceFullPath
+          replaceFullPath: /new-api
+        statusCode: 308
diff --git a/geps/gep-1494/metadata.yaml b/geps/gep-1494/metadata.yaml
index 600aed9a..1e272640 100644
--- a/geps/gep-1494/metadata.yaml
+++ b/geps/gep-1494/metadata.yaml
@@ -10,7 +10,7 @@ authors:
   - jgao1025
 # references is a list of hyperlinks to relevant external references.
 # It's intended to be used for storing GitHub discussions, Google docs, etc.
-references: {}
+references: []
 # featureNames is a list of the feature names introduced by the GEP, if there
 # are any. This will allow us to track which feature was introduced by which GEP.
 featureNames:
diff --git a/geps/gep-1713/index.md b/geps/gep-1713/index.md
index c720b357..db9f7651 100644
--- a/geps/gep-1713/index.md
+++ b/geps/gep-1713/index.md
@@ -49,6 +49,9 @@ The feature will be part of the experimental channel, which implementations can
 
 This proposal introduces a new `ListenerSet` resource that has the ability to attach a set of listeners to multiple parent `Gateways`.
 
+**Note**: While this API is experimental, its `Kind` will be `XListenerSet` and 
+once the API is gratuated to stable it will be renamed to `ListenerSet`.
+
 ### Go
 
 ```go
@@ -59,7 +62,7 @@ type GatewaySpec struct {
 }
 
 type AllowedListeners struct {
-	// +kubebuilder:default={from:Same}
+	// +kubebuilder:default={from: None}
 	Namespaces *ListenerNamespaces `json:"namespaces,omitempty"`
 }
 
@@ -69,7 +72,7 @@ type ListenerNamespaces struct {
 	// values are:
 	//
 	// * Same: Only ListenerSets in the same namespace may be attached to this Gateway.
-	// * Selector: ListenerSets in namespaces selected by the selector may be attached to this Gateway.:w
+	// * Selector: ListenerSets in namespaces selected by the selector may be attached to this Gateway.
 	// * All: ListenerSets in all namespaces may be attached to this Gateway.
 	// * None: Only listeners defined in the Gateway's spec are allowed
 	//
@@ -109,12 +112,24 @@ type ListenerSetSpec struct {
 	// Listeners in a `Gateway` and their attached `ListenerSets` are concatenated
 	// as a list when programming the underlying infrastructure.
 	//
+	// <gateway:util:excludeFromCRD>
 	// Listeners should be merged using the following precedence:
 	//
 	// 1. "parent" Gateway
 	// 2. ListenerSet ordered by creation time (oldest first)
 	// 3. ListenerSet ordered alphabetically by “{namespace}/{name}”.
 	//
+	// Regarding Conflict Management, Listeners in a ListenerSet follow the same
+	// rules of Listeners on a Gateway resource.
+	// 
+	// Listener validation should happen within all of the ListenerSets attached to a 
+	// Gateway, and the precedence of "parent Gateway" -> "oldest first" -> 
+	// "alphabetically ordered" should be respected.
+	// 
+	// ListenerSets containing conflicting Listeners MUST set the Conflicted 
+	// Condition to true and clearly indicate which Listeners are conflicted.
+	// </gateway:util:excludeFromCRD>
+	// 
 	// +listType=map
 	// +listMapKey=name
 	// +kubebuilder:validation:MinItems=1
@@ -330,7 +345,8 @@ type ParentGatewayReference struct {
 
 ### YAML
 
-The following example shows a `Gateway` with an HTTP listener and two child HTTPS `ListenerSets` with unique hostnames and certificates.
+The following example shows a `Gateway` with an HTTP listener and two child HTTPS `ListenerSets` with unique hostnames and certificates. 
+Only `ListenerSets` from the same namespace of the `Gateway` will be accepted:
 
 ```yaml
 apiVersion: gateway.networking.k8s.io/v1
@@ -339,6 +355,9 @@ metadata:
   name: parent-gateway
 spec:
   gatewayClassName: example
+  allowedListeners:
+    namespaces:
+      from: Same
   listeners:
   - name: foo
     hostname: foo.com
@@ -346,7 +365,7 @@ spec:
     port: 80
 ---
 apiVersion: gateway.networking.x-k8s.io/v1alpha1
-kind: ListenerSet
+kind: XListenerSet
 metadata:
   name: first-workload-listeners
 spec:
@@ -367,7 +386,7 @@ spec:
         name: first-workload-cert # Provisioned via HTTP01 challenge
 ---
 apiVersion: gateway.networking.x-k8s.io/v1alpha1
-kind: ListenerSet
+kind: XListenerSet
 metadata:
   name: second-workload-listeners
 spec:
@@ -397,6 +416,22 @@ spec:
 
 ## Semantics
 
+### Summary of attachments
+
+Nick Young did a great summarization of how a handshake and route attachment should behave. This is copied as/is as it is a great summary:
+
+* Routes attach to all **relevant** Listeners in their **direct Parent** object.
+* If a Route has a parentRef that is a ListenerSet, then the ListenerSet is the **direct Parent**.
+* If a Route has a parentRef that is a Gateway, then the Gateway is the **direct Parent**.
+* If the Route is using Gateway defaulting, then the default Gateway is the **direct Parent**.
+* If `sectionName` is not set, then all Listeners in the direct Parent object are **relevant**, and the Route must attach to all of them (subject to any `allowedRoutes` criteria.)
+* If `sectionName` is set, then only the Listener in the direct Parent object with the `name` field set to the same value as `sectionname` is **relevant**, and the Route must attach only to that Listener (subject to any `allowedRoutes` criteria).
+* If there are no relevant Listeners (because, for example, a sectionName is specified that does not exist on the direct Parent), then the Route has nowhere to attach to and MUST be have `Accepted` set to `false` for that `parentRef`.
+
+Route status is per-`parentRef`, so if a new parentRef is added, that attachment is independent of any existing parentRefs. A Route can be Accepted by one parentRef and not another, that's fine.
+
+If you have a Route that has a Gateway `parentRef` with a sectionName, that is Accepted already, and you add another parentRef that points to a `ListenerSet` with a `sectionName`, and the `ListenerSet` does not include a Listener with a name matching the sectionName, then the `ListenerSet parentRef` must be `Accepted status: false`. That does not affect the Gateway parentRef.
+
 ### Gateway Changes
 
 An initial experimental release of `ListenerSets` _will have no modifications_ to listener list on the `Gateway` resource. Using `ListenerSets` will  require a dummy listener to be configured.
@@ -417,15 +452,14 @@ metadata:
   name: parent-gateway
 spec:
   allowedListeners:
-  - from: Same
+    namespaces:
+      from: Same
 ```
 
 ### Route Attachment
 
 Routes MUST be able to specify a `ListenerSet` as a `parentRef`. Routes can use `sectionName`/`port` fields in `ParentReference` to help target a specific listener. If no listener is targeted (`sectionName`/`port` are unset) then the Route attaches to all the listeners in the `ListenerSet`.
 
-Routes MUST be able to attach to a `ListenerSet` and it's parent `Gateway` by having multiple `parentRefs` eg:
-
 ```yaml
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
@@ -434,11 +468,11 @@ metadata:
 spec:
   parentRefs:
   - name: second-workload-listeners
-    kind: ListenerSet
+    kind: XListenerSet
     sectionName: second
 ```
 
-For instance, the following `HTTPRoute` attempts to attach to a listener defined in the parent `Gateway` using the sectionName `foo`. This is not valid and the route's status `Accepted` condition should be set to `False`
+To attach a Route to a `XListenerSet` and its parent `Gateway`, it MUST have multiple `parentRefs` eg:
 
 ```yaml
 apiVersion: gateway.networking.k8s.io/v1
@@ -447,30 +481,132 @@ metadata:
   name: httproute-example
 spec:
   parentRefs:
-  - name: some-workload-listeners
-    kind: ListenerSet
+  - name: second-workload-listeners
+    kind: XListenerSet
+    sectionName: second
+  - name: parent-gateway
+    kind: Gateway
     sectionName: foo
 ```
 
-To attach to listeners in both a `Gateway` and `ListenerSet` the route MUST have two `parentRefs`:
+For instance, the following `HTTPRoute` attempts to attach to a listener defined in the parent `Gateway` using the sectionName `foo`, which exists on a `ListenerSet` but not on a `Gateway`.
+This is not valid and the route's status `Accepted` condition should be set to `False`
+
 ```yaml
 apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: parent-gateway
+spec:
+  gatewayClassName: example
+  allowedListeners:
+    namespaces:
+      from: Same
+  listeners:
+  - name: notfoo
+    hostname: foo.com
+    protocol: HTTP
+    port: 80
+---
+apiVersion: gateway.networking.x-k8s.io/v1alpha1
+kind: XListenerSet
+metadata:
+  name: first-workload-listeners
+spec:
+  parentRef:
+    name: parent-gateway
+    kind: Gateway
+    group: gateway.networking.k8s.io
+  listeners:
+  - name: foo
+    hostname: first.foo.com
+    protocol: HTTP
+    port: 80
+---
+apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   name: httproute-example
 spec:
   parentRefs:
-  - name: second-workload-listeners
-    kind: ListenerSet
-    sectionName: second
   - name: parent-gateway
     kind: Gateway
     sectionName: foo
 ```
 
-#### Optional Section Name
+#### Gateway parents and sectionName
+
+If a `sectionName` in a Route's `parentRef` is not set then the Route MUST attach to only the listeners in the referenced parent. As an example given a `Gateway` and it's child `ListenerSets` a route attaching to the `Gateway` with an empty `sectionName` shall only attach to the listeners in the `Gateways` immediate `spec.listeners` list. 
+
+In other words, the Route MUST attach just to the Gateway listeners specified on `.spec.listeners` and MUST NOT not attach to any listeners in the child `ListenerSets` 
+of the `Gateway`.
+
+This is necessary because, for UX reasons, the `name` field does not have to be unique across all Listeners merged into a Gateway (see the section below for details).
 
-If a `sectionName` in a Route's `parentRef` is not set then the Route MUST attach to only the listeners in the referenced parent. As an example given a `Gateway` and it's child `ListenerSets` a route attaching to the `Gateway` with an empty `sectionName` shall only attach to the listeners in the `Gateways` immediate `spec.listeners` list. In other words, the Route will not attach to any listeners in the `ListenerSets`. This is necessary because, for UX reasons, the `name` field does not have to be unique across all Listeners merged into a Gateway (see the section below for details).
+The following manifest exemplifies this situation:
+
+```yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: parent-gateway
+spec:
+  gatewayClassName: example
+  allowedListeners:
+    namespaces:
+      from: Same
+  listeners:
+  - name: foo2
+    hostname: foo.com
+    protocol: HTTP
+    port: 80
+  - name: foo3
+    hostname: foo1.com
+    protocol: HTTP
+    port: 80
+---
+apiVersion: gateway.networking.x-k8s.io/v1alpha1
+kind: XListenerSet
+metadata:
+  name: first-workload-listeners
+spec:
+  parentRef:
+    name: parent-gateway
+    kind: Gateway
+    group: gateway.networking.k8s.io
+  listeners:
+  - name: foo
+    hostname: first.foo.com
+    protocol: HTTP
+    port: 80
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: httproute-example
+spec:
+  parentRefs:
+  # No SectionName is set on this parentRef
+  - name: some-workload-listeners 
+    kind: Gateway
+```
+
+The example above SHOULD be attached only to the following listeners:
+```yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+.....
+spec:
+  listeners:
+  - name: foo2
+    hostname: foo.com
+    protocol: HTTP
+    port: 80
+  - name: foo3
+    hostname: foo1.com
+    protocol: HTTP
+    port: 80
+```
 
 ### Policy Attachment
 
@@ -545,7 +681,203 @@ Listeners should be merged using the following precedence:
 2. ListenerSet ordered by creation time (oldest first)
 3. ListenerSet ordered alphabetically by “{namespace}/{name}”.
 
-Conflicts are covered in the section 'ListenerConditions within a ListenerSet'
+Conflicts are covered in the section [Listener and ListenerSet conflicts](#listener-and-listenerset-conflicts)
+
+### Listener and ListenerSet conflicts
+
+ListenerSet conflicts should be managed similarly to [Gateway resource conflict](https://github.com/kubernetes-sigs/gateway-api/blob/372a5b06624cff12117f41dcd26c08cb1def22e7/apis/v1/gateway_types.go#L76)
+management.
+
+With ListenerSet this validation should happen within the same ListenerSet resource, 
+but MUST be validated also within a Gateway scope and all of the attached Listeners/ListenerSets. 
+The SectionName field is an exception for this validation, and while it should 
+not conflict within the same ListenerSet, it can be duplicated between different ListenerSets.
+
+This means that the validation should happen now between distinct ListenerSets 
+attached to the same Gateway, and in case of a conflict, the [Listener Precedence](#listener-precedence) 
+should be respected, so the first Listener on the precedence list MUST be accepted, 
+and should not have a `Conflicted` condition, while the conflicting listeners 
+MUST have a `Conflicted` condition set to True and with an explicit reason on its message.
+
+Following are some examples of a conflict situation:
+
+#### Conflict between ListenerSet and parent Gateway
+
+Given the following resource definitions:
+
+```yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: parent-gateway
+  namespace: infra
+spec:
+  allowedListeners:
+    namespaces:
+      from: All
+  listeners:
+  - name: foo
+    hostname: www.something.tld
+    protocol: HTTPS
+    port: 443
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - kind: Secret
+        group: ""
+        name: default-cert
+---
+apiVersion: gateway.networking.x-k8s.io/v1alpha1
+kind: XListenerSet
+metadata:
+  name: user-listenerset
+  namespace: user01
+spec:
+  parentRef:
+    name: parent-gateway
+    kind: Gateway
+    group: gateway.networking.k8s.io
+  listeners:
+  - name: myapp
+    hostname: www.something.tld
+    protocol: HTTPS
+    port: 443
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - kind: Secret
+        group: ""
+        name: app-cert
+```
+
+The ListenerSet `user-listenerset` should be marked as Conflicted, as the `parent-gateway`
+has a listener definition called `foo` that conflicts with the ListenetSet definition
+called `myapp`. The conflict happens because hostname is the same on both `ListenerSet` 
+but they use different termination TLS certificates:
+
+```yaml
+apiVersion: gateway.networking.x-k8s.io/v1alpha1
+kind: XListenerSet
+metadata:
+  name: user-listenerset
+  namespace: user01
+....
+status:
+  listeners:
+  - name: myapp
+    hostname: www.something.tld
+    protocol: HTTPS
+    port: 443
+    conditions:
+	- message: ListenerSet has conflicts with Gateway 'infra/parent-gateway'
+      reason: ParentNotAccepted
+      status: "False"
+      type: Accepted
+    - message: ListenerSet has conflicts with Gateway 'infra/parent-gateway'
+      reason: ListenerConflict
+      status: "True"
+      type: Conflicted
+```
+
+#### Conflict between two ListenerSets
+
+The following example represents a conflict between two ListenerSets on distinct
+namespaces. The controller should avoid setting any Condition that exposes information
+from other users, but still provide meaningful information of why a ListenerSet 
+was not accepted
+
+
+```yaml
+apiVersion: gateway.networking.x-k8s.io/v1alpha1
+kind: XListenerSet
+metadata:
+  creationTimestamp: "2025-08-11T15:44:05Z"
+  name: listenerset1
+  namespace: user01
+spec:
+  parentRef:
+    name: parent-gateway
+    kind: Gateway
+    group: gateway.networking.k8s.io
+  listeners:
+  - name: myapp
+    hostname: www.something.tld
+    protocol: HTTPS
+    port: 443
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - kind: Secret
+        group: ""
+        name: app-cert
+---
+apiVersion: gateway.networking.x-k8s.io/v1alpha1
+kind: XListenerSet
+metadata:
+  creationTimestamp: "2025-08-11T13:44:05Z"
+  name: listenerset2
+  namespace: user02
+spec:
+  parentRef:
+    name: parent-gateway
+    kind: Gateway
+    group: gateway.networking.k8s.io
+  listeners:
+  - name: myapp
+    hostname: www.something.tld
+    protocol: HTTPS
+    port: 443
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - kind: Secret
+        group: ""
+        name: other-app-cert
+```
+
+In this case, there's a conflict as both users are setting the same hostname and 
+port on distinct Listeners. In this case, because the ListenerSet `user02/listenerset2` 
+is older, it will be accepted while `user01/listenerset1` should not be accepted, 
+and receive a `Conflicted=True` condition.
+
+The status of ListenerSets can be defined as the following:
+
+```yaml
+apiVersion: gateway.networking.x-k8s.io/v1alpha1
+kind: XListenerSet
+metadata:
+  creationTimestamp: "2025-08-11T15:44:05Z"
+  name: listenerset1
+  namespace: user01
+status:
+  listeners:
+  - name: myapp
+    hostname: www.something.tld
+    protocol: HTTPS
+    port: 443
+    conditions:
+    - message: ListenerSet has conflicts with other listeners attached to the same Gateway
+      reason: ListenerConflict
+      status: "True"
+      type: Conflicted
+---
+apiVersion: gateway.networking.x-k8s.io/v1alpha1
+kind: XListenerSet
+metadata:
+  creationTimestamp: "2025-08-11T13:44:05Z"
+  name: listenerset2
+  namespace: user02
+status:
+  listeners:
+  - name: myapp
+    hostname: www.something.tld
+    protocol: HTTPS
+    port: 443
+    conditions:
+    - reason: Accepted
+      status: "True"
+      type: Accepted
+```
 
 ### Gateway Conditions
 
@@ -588,6 +920,8 @@ If a listener has a conflict, this should be reported in the `ListenerEntryStatu
 
 Implementations SHOULD be cautious about what information from the parent or siblings are reported to avoid accidentally leaking sensitive information that the child would not otherwise have access to. This can include contents of secrets etc.
 
+Conflicts are covered in the section [Listener and ListenerSet conflicts](#listener-and-listenerset-conflicts)
+
 ## Alternatives
 
 ### Re-using Gateway Resource
diff --git a/geps/gep-1731/metadata.yaml b/geps/gep-1731/metadata.yaml
index c85ccbcb..1a1f8daa 100644
--- a/geps/gep-1731/metadata.yaml
+++ b/geps/gep-1731/metadata.yaml
@@ -11,12 +11,12 @@ relationships:
   # obsoletes indicates that a GEP makes the linked GEP obsolete, and completely
   # replaces that GEP. The obsoleted GEP MUST have its obsoletedBy field
   # set back to this GEP, and MUST be moved to Declined.
-  obsoletes: {}
-  obsoletedBy: {}
+  obsoletes: []
+  obsoletedBy: []
   # extends indicates that a GEP extends the linked GEP, adding more detail
   # or additional implementation. The extended GEP MUST have its extendedBy
   # field set back to this GEP.
-  extends: {}
+  extends: []
   extendedBy:
     - number: 3388
       name: Retry Budgets
@@ -44,4 +44,4 @@ featureNames:
   - SupportHTTPRouteRetryConnectionError
 # changelog is a list of hyperlinks to PRs that make changes to the GEP, in
 # ascending date order.
-changelog: {}
+changelog: []
diff --git a/geps/gep-1897/index.md b/geps/gep-1897/index.md
index 149d6c64..2b2159f7 100644
--- a/geps/gep-1897/index.md
+++ b/geps/gep-1897/index.md
@@ -1,7 +1,7 @@
 # GEP-1897: BackendTLSPolicy - Explicit Backend TLS Connection Configuration
 
 * Issue: [#1897](https://github.com/kubernetes-sigs/gateway-api/issues/1897)
-* Status: Experimental
+* Status: Standard
 
 ## TLDR
 
@@ -30,11 +30,9 @@ Gateway to backend**, such as server name indication and trusted CA certificates
 ## Longer Term Goals
 
 These are worthy goals, but deserve a different GEP for proper attention.  This GEP is concerned entirely with the
-the hop between gateway client and backend.
-
-1. [TCPRoute](../../reference/spec.md#gateway.networking.k8s.io/v1alpha2.TCPRoute) and
-[GRPCRoute](../../reference/spec.md#gateway.networking.k8s.io/v1alpha2.GRPCRoute) use cases
-are not addressed here, because at this point in time these two route types are not graduated to beta.
+hop between gateway client and backend.
+1. [TCPRoute](../../apis/v1alpha2/tcproute_types.go) use cases are not addressed here, because at this point in time
+TCPRoute is not graduated to beta.
 2. Mutual TLS (mTLS) use cases are intentionally out of scope for this GEP for two reasons.  First, the design of Gateway
 API is backend-attached and does not currently support mutual authentication, and also because this GEP does not
 address the case where connections to TLS are **implicitly configured** on behalf of the user, which is the norm for mTLS.
@@ -52,18 +50,21 @@ These are worthy goals, but will not be covered by this GEP.
 2. Providing a mechanism to decorate multiple route instances
 3. TLSRoute use cases
 4. UDPRoute use cases
-5. Controlling TLS versions or cipher suites used in TLS handshakes. (Use case #5 in [Gateway API TLS Use Cases](#references))
-6. Controlling certificates used by more than one workload (#6 in [Gateway API TLS Use Cases](#references))
-7. Client certificate settings used in TLS **from external clients to the
+5. GRPCRoute use cases
+6. Controlling TLS versions or cipher suites used in TLS handshakes. (Use case #5 in [Gateway API TLS Use Cases](#references))
+7. Controlling certificates used by more than one workload (#6 in [Gateway API TLS Use Cases](#references))
+8. Client certificate settings used in TLS **from external clients to the
 Listener** (#7 in [Gateway API TLS Use Cases](#references))
-8. Service Mesh "mesh transport security".
-9. Providing a mechanism for the cluster operator to override gateway to backend TLS settings.
+9. Service Mesh "mesh transport security".
+10. Providing a mechanism for the cluster operator to override gateway to backend TLS settings.
 
-> It is very common for service mesh implementations to implement some form of transparent transport security, whether that is WireGuard, mTLS, or others.
-> This is completely orthogonal to the use cases being tackled by this GEP.
-> * The "mesh transport security" is something invisible to the user's application, and is simply used to secure communication between components in the mesh.
+> It is very common for service mesh implementations to implement some form of transparent transport security, whether
+> that is WireGuard, mTLS, or others. This is completely orthogonal to the use cases being tackled by this GEP.
+> * The "mesh transport security" is something invisible to the user's application, and is simply used to secure
+> communication between components in the mesh.
 > * This proposal, instead, explicitly calls for sending TLS **to the user's application**.
-> However, this does not mean service meshes are outside of scope for this proposal, merely that only the application-level TLS configuration is in scope.
+> However, this does not mean service meshes are outside of scope for this proposal, merely that only the
+> application-level TLS configuration is in scope.
 
 ![](images/mesh.png "Mesh transport")
 
@@ -84,7 +85,6 @@ backend pod).  As mentioned, this solution satisfies the use case in which the b
 has its own certificate and the gateway client needs to know how to connect to the backend pod.
 
 ![image depicting TLS termination types](images/1897-TLStermtypes.png "TLS termination types")
-
 Gateway API is missing a mechanism for separately providing the details for the backend TLS handshake,
 including (but not limited to):
 
@@ -157,8 +157,8 @@ substituted without blocking acceptance of the content of the API change.
 
 The selection of the applicable Gateway API persona is important in the design of BackendTLSPolicy, because it provides
 a way to explicitly describe the _expectations_ of the connection to the application.
-In this GEP, BackendTLSPolicy will be configured only by the application developer Gateway API persona to tell gateway clients how to connect to
-the application, from a TLS perspective.
+In this GEP, BackendTLSPolicy will be configured only by the application developer Gateway API persona to tell gateway
+clients how to connect to the application, from a TLS perspective.
 Future iterations *may* expand this to additionally allow consumer overrides; see [Future plans](#future-plans).
 
 During the course of discussion of this proposal, we did consider allowing the cluster operator persona to have some access
@@ -181,7 +181,8 @@ as a TLS Client:
 BackendTLSPolicy is defined as a Direct Policy Attachment without defaults or overrides, applied to a Service that
 accesses the backend in question, where the BackendTLSPolicy resides in the same namespace as the Service it is
 applied to.  For now, the BackendTLSPolicy and the Service must reside in the same namespace in order to prevent the
-complications involved with sharing trust across namespace boundaries (see [Future plans](#future-plans)).  We chose the Service resource as a target,
+complications involved with sharing trust across namespace boundaries (see [Future plans](#future-plans)).  We chose the Service
+resource as a target,
 rather than the Route resource, so that we can reuse the same BackendTLSPolicy for all the different Routes that
 might point to this Service.
 
@@ -196,7 +197,10 @@ that is appropriate, such as one of the HTTP error codes: 400 (Bad Request), 401
 other signal that makes the failure sufficiently clear to the requester without revealing too much about the transaction,
 based on established security requirements.
 
-BackendTLSPolicy applies only to TCP traffic. If a policy explicitly attaches to a UDP port of a Service (that is, the `targetRef` has a `sectionName` specifying a single port or the service has only 1 port), the `Accepted: False` Condition with `Reason: Invalid` MUST be set. If the policy attaches to a mix of TCP and UDP ports, implementations SHOULD include a warning in the `Accepted` condition message (`ancestors.conditions`); the policy will only be effective for the TCP ports.
+BackendTLSPolicy applies only to TCP traffic. If a policy explicitly attaches to a UDP port of a Service (that is, the
+`targetRef` has a `sectionName` specifying a single port or the service has only 1 port), the `Accepted: False` Condition
+with `Reason: Invalid` MUST be set. If the policy attaches to a mix of TCP and UDP ports, implementations SHOULD include
+a warning in the `Accepted` condition message (`ancestors.conditions`); the policy will only be effective for the TCP ports.
 
 All policy resources must include `TargetRefs` with the fields specified
 in [PolicyTargetReference](https://github.com/kubernetes-sigs/gateway-api/blob/a33a934af9ec6997b34fd9b00d2ecd13d143e48b/apis/v1alpha2/policy_types.go#L24-L41).
@@ -214,12 +218,20 @@ configuration. CACertificateRefs is an implementation-specific slice of
 named object references, each containing a single cert. We originally proposed to follow the convention established by the
 [CertificateRefs field on Gateway](https://github.com/kubernetes-sigs/gateway-api/blob/18e79909f7310aafc625ba7c862dfcc67b385250/apis/v1beta1/gateway_types.go#L340)
 , but the CertificateRef requires both a tls.key and tls.crt and a certificate reference only requires the tls.crt.
-If any of the CACertificateRefs cannot be resolved (e.g., the referenced resource does not exist) or is misconfigured (e.g., ConfigMap does not contain a key named `ca.crt`), the `ResolvedRefs` status condition MUST be set to `False` with `Reason: InvalidCACertificateRef`. Connections using that CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error response.
-References to objects with an unsupported Group and Kind are not valid, and MUST be rejected by the implementation with the `ResolvedRefs` status condition set to `False` and `Reason: InvalidKind`.
-Implementations MAY perform further validation of the certificate content (i.e., checking expiry or enforcing specific formats). If they do, they MUST ensure that the `ResolvedRefs` Condition is `False` and use an implementation-specific `Reason`, like `ExpiredCertificate` or similar.
-If `ResolvedRefs` Condition is `False` implementations SHOULD include a message specifying which references are invalid and explaining why.
-
-If all CertificateRefs cannot be resolved, the BackendTLSPolicy is considered invalid and the implementation MUST set the `Accepted` Condition to `False`, with a reason of `NoValidCACertificate` and a message explaining this.
+If any of the CACertificateRefs cannot be resolved (e.g., the referenced resource does not exist) or is misconfigured
+(e.g., ConfigMap does not contain a key named `ca.crt`), the `ResolvedRefs` status condition MUST be set to `False` with
+`Reason: InvalidCACertificateRef`. Connections using that CACertificateRef MUST fail, and the client MUST receive an
+HTTP 5xx error response.
+References to objects with an unsupported Group and Kind are not valid, and MUST be rejected by the implementation with
+the `ResolvedRefs` status condition set to `False` and `Reason: InvalidKind`.
+Implementations MAY perform further validation of the certificate content (i.e., checking expiry or enforcing specific
+formats). If they do, they MUST ensure that the `ResolvedRefs` Condition is `False` and use an implementation-specific
+`Reason`, like `ExpiredCertificate` or similar.
+If `ResolvedRefs` Condition is `False` implementations SHOULD include a message specifying which references are invalid
+and explaining why.
+
+If all CertificateRefs cannot be resolved, the BackendTLSPolicy is considered invalid and the implementation MUST set
+the `Accepted` Condition to `False`, with a reason of `NoValidCACertificate` and a message explaining this.
 
 WellKnownCACertificates is an optional enum that allows users to specify whether to use the set of CA certificates trusted by the
 Gateway (WellKnownCACertificates specified as "System"), or to use the existing CACertificateRefs (WellKnownCACertificates
@@ -228,13 +240,17 @@ these certificates are obtained from the underlying operating system. CACertific
 references to Kubernetes objects that contain PEM-encoded TLS certificates, which are used to establish a TLS handshake
 between the gateway and backend pod. References to a resource in a different namespace are invalid.
 If ClientCertificateRefs is unspecified, then WellKnownCACertificates must be set to "System" for a valid configuration.
-If WellKnownCACertificates is unspecified, then CACertificateRefs must be specified with at least one entry for a valid configuration.
-If an implementation does not support the WellKnownCACertificates, or the provided value is unsupported,the BackendTLSPolicy is considered invalid, and the implementation MUST set the `Accepted` Condition to `False`, with a reason of `Invalid` and a message explaining this.
+If WellKnownCACertificates is unspecified, then CACertificateRefs must be specified with at least one entry for a valid
+configuration.
+If an implementation does not support the WellKnownCACertificates, or the provided value is unsupported,the
+BackendTLSPolicy is considered invalid, and the implementation MUST set the `Accepted` Condition to `False`, with a
+reason of `Invalid` and a message explaining this.
 
 For an invalid BackendTLSPolicy, implementations MUST NOT fall back to unencrypted (plaintext) connections. 
 Instead, the corresponding TLS connection MUST fail, and the client MUST receive an HTTP 5xx error response.
 
-Implementations MUST NOT modify any status other than their own. Ownership of a status is determined by the `controllerName`, which identifies the responsible controller.
+Implementations MUST NOT modify any status other than their own. Ownership of a status is determined by the `controllerName`,
+which identifies the responsible controller.
 
 The `Hostname` field is required and is to be used to configure the SNI the Gateway should use to connect to the backend.
 Implementations must validate that at least one name in the certificate served by the backend matches this field.
@@ -245,10 +261,309 @@ but may be added in the future.
 We originally proposed allowing the configuration of expected TLS versions, but determined that this was [not needed in
 the first round](https://github.com/kubernetes-sigs/gateway-api/pull/2113#issuecomment-1696127092).
 
-Thus, the following additions would be made to the Gateway API:
+Thus, the following additions would be made to Gateway API.  See the
+[BackendTLSPolicy API](https://kubernetes-sigs/gateway-api/blob/main/apis/v1/backendtlspolicy_types.go) for more
+details.
 
 ```go
-//TODO: Will update this section once API changes from PR 2955 are approved.
+// +genclient
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:storageversion
+// +kubebuilder:resource:categories=gateway-api,shortName=btlspolicy
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+//
+// BackendTLSPolicy is a Direct Attached Policy.
+// +kubebuilder:metadata:labels="gateway.networking.k8s.io/policy=Direct"
+
+// BackendTLSPolicy provides a way to configure how a Gateway
+// connects to a Backend via TLS.
+type BackendTLSPolicy struct {
+	metav1.TypeMeta `json:",inline"`
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// Spec defines the desired state of BackendTLSPolicy.
+	// +required
+	Spec BackendTLSPolicySpec `json:"spec"`
+
+	// Status defines the current state of BackendTLSPolicy.
+	// +optional
+	Status PolicyStatus `json:"status,omitempty"`
+}
+
+// BackendTLSPolicyList contains a list of BackendTLSPolicies
+// +kubebuilder:object:root=true
+type BackendTLSPolicyList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []BackendTLSPolicy `json:"items"`
+}
+
+// BackendTLSPolicySpec defines the desired state of BackendTLSPolicy.
+//
+// Support: Extended
+type BackendTLSPolicySpec struct {
+	// TargetRefs identifies an API object to apply the policy to.
+	// Only Services have Extended support. Implementations MAY support
+	// additional objects, with Implementation Specific support.
+	// Note that this config applies to the entire referenced resource
+	// by default, but this default may change in the future to provide
+	// a more granular application of the policy.
+	//
+	// TargetRefs must be _distinct_. This means either that:
+	//
+	// * They select different targets. If this is the case, then targetRef
+	//   entries are distinct. In terms of fields, this means that the
+	//   multi-part key defined by `group`, `kind`, and `name` must
+	//   be unique across all targetRef entries in the BackendTLSPolicy.
+	// * They select different sectionNames in the same target.
+	//
+	//
+	// When more than one BackendTLSPolicy selects the same target and
+	// sectionName, implementations MUST determine precedence using the
+	// following criteria, continuing on ties:
+	//
+	// * The older policy by creation timestamp takes precedence. For
+	//   example, a policy with a creation timestamp of "2021-07-15
+	//   01:02:03" MUST be given precedence over a policy with a
+	//   creation timestamp of "2021-07-15 01:02:04".
+	// * The policy appearing first in alphabetical order by {name}.
+	//   For example, a policy named `bar` is given precedence over a
+	//   policy named `baz`.
+	//
+	// For any BackendTLSPolicy that does not take precedence, the
+	// implementation MUST ensure the `Accepted` Condition is set to
+	// `status: False`, with Reason `Conflicted`.
+	//
+	// Support: Extended for Kubernetes Service
+	//
+	// Support: Implementation-specific for any other resource
+	//
+	// +required
+	// +listType=atomic
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=16
+	// +kubebuilder:validation:XValidation:message="sectionName must be specified when targetRefs includes 2 or more references to the same target",rule="self.all(p1, self.all(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name ? ((!has(p1.sectionName) || p1.sectionName == '') == (!has(p2.sectionName) || p2.sectionName == '')) : true))"
+	// +kubebuilder:validation:XValidation:message="sectionName must be unique when targetRefs includes 2 or more references to the same target",rule="self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.sectionName) || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName == p2.sectionName))))"
+	TargetRefs []LocalPolicyTargetReferenceWithSectionName `json:"targetRefs"`
+
+	// Validation contains backend TLS validation configuration.
+	// +required
+	Validation BackendTLSPolicyValidation `json:"validation"`
+
+	// Options are a list of key/value pairs to enable extended TLS
+	// configuration for each implementation. For example, configuring the
+	// minimum TLS version or supported cipher suites.
+	//
+	// A set of common keys MAY be defined by the API in the future. To avoid
+	// any ambiguity, implementation-specific definitions MUST use
+	// domain-prefixed names, such as `example.com/my-custom-option`.
+	// Un-prefixed names are reserved for key names defined by Gateway API.
+	//
+	// Support: Implementation-specific
+	//
+	// +optional
+	// +kubebuilder:validation:MaxProperties=16
+	Options map[AnnotationKey]AnnotationValue `json:"options,omitempty"`
+}
+
+// BackendTLSPolicyValidation contains backend TLS validation configuration.
+// +kubebuilder:validation:XValidation:message="must not contain both CACertificateRefs and WellKnownCACertificates",rule="!(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
+// +kubebuilder:validation:XValidation:message="must specify either CACertificateRefs or WellKnownCACertificates",rule="(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")"
+type BackendTLSPolicyValidation struct {
+	// CACertificateRefs contains one or more references to Kubernetes objects that
+	// contain a PEM-encoded TLS CA certificate bundle, which is used to
+	// validate a TLS handshake between the Gateway and backend Pod.
+	//
+	// If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
+	// specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
+	// not both. If CACertificateRefs is empty or unspecified, the configuration for
+	// WellKnownCACertificates MUST be honored instead if supported by the implementation.
+	//
+	// A CACertificateRef is invalid if:
+	//
+	// * It refers to a resource that cannot be resolved (e.g., the referenced resource
+	//   does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key
+	//   named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`
+	//   and the Message of the Condition must indicate which reference is invalid and why.
+	//
+	// * It refers to an unknown or unsupported kind of resource. In this case, the Reason
+	//   must be set to `InvalidKind` and the Message of the Condition must explain which
+	//   kind of resource is unknown or unsupported.
+	//
+	// * It refers to a resource in another namespace. This may change in future
+	//   spec updates.
+	//
+	// Implementations MAY choose to perform further validation of the certificate
+	// content (e.g., checking expiry or enforcing specific formats). In such cases,
+	// an implementation-specific Reason and Message must be set for the invalid reference.
+	//
+	// In all cases, the implementation MUST ensure the `ResolvedRefs` Condition on
+	// the BackendTLSPolicy is set to `status: False`, with a Reason and Message
+	// that indicate the cause of the error. Connections using an invalid
+	// CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error
+	// response. If ALL CACertificateRefs are invalid, the implementation MUST also
+	// ensure the `Accepted` Condition on the BackendTLSPolicy is set to
+	// `status: False`, with a Reason `NoValidCACertificate`.
+	//
+	//
+	// A single CACertificateRef to a Kubernetes ConfigMap kind has "Core" support.
+	// Implementations MAY choose to support attaching multiple certificates to
+	// a backend, but this behavior is implementation-specific.
+	//
+	// Support: Core - An optional single reference to a Kubernetes ConfigMap,
+	// with the CA certificate in a key named `ca.crt`.
+	//
+	// Support: Implementation-specific - More than one reference, other kinds
+	// of resources, or a single reference that includes multiple certificates.
+	//
+	// +optional
+	// +listType=atomic
+	// +kubebuilder:validation:MaxItems=8
+	CACertificateRefs []LocalObjectReference `json:"caCertificateRefs,omitempty"`
+
+	// WellKnownCACertificates specifies whether system CA certificates may be used in
+	// the TLS handshake between the gateway and backend pod.
+	//
+	// If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
+	// must be specified with at least one entry for a valid configuration. Only one of
+	// CACertificateRefs or WellKnownCACertificates may be specified, not both.
+	// If an implementation does not support the WellKnownCACertificates field, or
+	// the supplied value is not recognized, the implementation MUST ensure the
+	// `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with
+	// a Reason `Invalid`.
+	//
+	// Support: Implementation-specific
+	//
+	// +optional
+	// +listType=atomic
+	WellKnownCACertificates *WellKnownCACertificatesType `json:"wellKnownCACertificates,omitempty"`
+
+	// Hostname is used for two purposes in the connection between Gateways and
+	// backends:
+	//
+	// 1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
+	// 2. Hostname MUST be used for authentication and MUST match the certificate
+	//    served by the matching backend, unless SubjectAltNames is specified.
+	// 3. If SubjectAltNames are specified, Hostname can be used for certificate selection
+	//    but MUST NOT be used for authentication. If you want to use the value
+	//    of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.
+	//
+	// Support: Core
+	//
+	// +required
+	Hostname PreciseHostname `json:"hostname"`
+
+	// SubjectAltNames contains one or more Subject Alternative Names.
+	// When specified the certificate served from the backend MUST
+	// have at least one Subject Alternate Name matching one of the specified SubjectAltNames.
+	//
+	// Support: Extended
+	//
+	// +optional
+	// +listType=atomic
+	// +kubebuilder:validation:MaxItems=5
+	SubjectAltNames []SubjectAltName `json:"subjectAltNames,omitempty"`
+}
+
+// SubjectAltName represents Subject Alternative Name.
+// +kubebuilder:validation:XValidation:message="SubjectAltName element must contain Hostname, if Type is set to Hostname",rule="!(self.type == \"Hostname\" && (!has(self.hostname) || self.hostname == \"\"))"
+// +kubebuilder:validation:XValidation:message="SubjectAltName element must not contain Hostname, if Type is not set to Hostname",rule="!(self.type != \"Hostname\" && has(self.hostname) && self.hostname != \"\")"
+// +kubebuilder:validation:XValidation:message="SubjectAltName element must contain URI, if Type is set to URI",rule="!(self.type == \"URI\" && (!has(self.uri) || self.uri == \"\"))"
+// +kubebuilder:validation:XValidation:message="SubjectAltName element must not contain URI, if Type is not set to URI",rule="!(self.type != \"URI\" && has(self.uri) && self.uri != \"\")"
+type SubjectAltName struct {
+	// Type determines the format of the Subject Alternative Name. Always required.
+	//
+	// Support: Core
+	//
+	// +required
+	Type SubjectAltNameType `json:"type"`
+
+	// Hostname contains Subject Alternative Name specified in DNS name format.
+	// Required when Type is set to Hostname, ignored otherwise.
+	//
+	// Support: Core
+	//
+	// +optional
+	Hostname Hostname `json:"hostname,omitempty"`
+
+	// URI contains Subject Alternative Name specified in a full URI format.
+	// It MUST include both a scheme (e.g., "http" or "ftp") and a scheme-specific-part.
+	// Common values include SPIFFE IDs like "spiffe://mycluster.example.com/ns/myns/sa/svc1sa".
+	// Required when Type is set to URI, ignored otherwise.
+	//
+	// Support: Core
+	//
+	// +optional
+	URI AbsoluteURI `json:"uri,omitempty"`
+}
+
+// WellKnownCACertificatesType is the type of CA certificate that will be used
+// when the caCertificateRefs field is unspecified.
+// +kubebuilder:validation:Enum=System
+type WellKnownCACertificatesType string
+
+const (
+	// WellKnownCACertificatesSystem indicates that well known system CA certificates should be used.
+	WellKnownCACertificatesSystem WellKnownCACertificatesType = "System"
+)
+
+// SubjectAltNameType is the type of the Subject Alternative Name.
+// +kubebuilder:validation:Enum=Hostname;URI
+type SubjectAltNameType string
+
+const (
+	// HostnameSubjectAltNameType specifies hostname-based SAN.
+	//
+	// Support: Core
+	HostnameSubjectAltNameType SubjectAltNameType = "Hostname"
+
+	// URISubjectAltNameType specifies URI-based SAN, e.g. SPIFFE id.
+	//
+	// Support: Core
+	URISubjectAltNameType SubjectAltNameType = "URI"
+)
+
+const (
+	// This reason is used with the "Accepted" condition when it is
+	// set to false because all CACertificateRefs of the
+	// BackendTLSPolicy are invalid.
+	BackendTLSPolicyReasonNoValidCACertificate PolicyConditionReason = "NoValidCACertificate"
+)
+
+const (
+	// This condition indicates whether the controller was able to resolve all
+	// object references for the BackendTLSPolicy.
+	//
+	// Possible reasons for this condition to be True are:
+	//
+	// * "ResolvedRefs"
+	//
+	// Possible reasons for this condition to be False are:
+	//
+	// * "InvalidCACertificateRef"
+	// * "InvalidKind"
+	//
+	// Controllers may raise this condition with other reasons, but should
+	// prefer to use the reasons listed above to improve interoperability.
+	BackendTLSPolicyConditionResolvedRefs PolicyConditionType = "ResolvedRefs"
+
+	// This reason is used with the "ResolvedRefs" condition when the condition
+	// is true.
+	BackendTLSPolicyReasonResolvedRefs PolicyConditionReason = "ResolvedRefs"
+
+	// This reason is used with the "ResolvedRefs" condition when one of the
+	// BackendTLSPolicy's CACertificateRefs is invalid.
+	// A CACertificateRef is considered invalid when it refers to a nonexistent
+	// resource or when the data within that resource is malformed.
+	BackendTLSPolicyReasonInvalidCACertificateRef PolicyConditionReason = "InvalidCACertificateRef"
+
+	// This reason is used with the "ResolvedRefs" condition when one of the
+	// BackendTLSPolicy's CACertificateRefs references an unknown or unsupported
+	// Group and/or Kind.
+	BackendTLSPolicyReasonInvalidKind PolicyConditionReason = "InvalidKind"
+)
 ```
 
 ## How a client behaves
@@ -262,12 +577,16 @@ For instance, the following will all have the gateway client add TLS if the back
 * A Gateway accepts and terminates TLS on an HTTPS listener
 * A Gateway accepts traffic on a TCP listener
 
-There is no need for a Gateway that accepts traffic with `Mode: Passthrough` to do anything differently here, but implementations MAY choose to treat TLS passthrough as a special case. Implementations that do this SHOULD clearly document their approach if BackendTLSPolicy is treated differently for TLS passthrough.
+There is no need for a Gateway that accepts traffic with `Mode: Passthrough` to do anything differently here, but
+implementations MAY choose to treat TLS passthrough as a special case. Implementations that do this SHOULD clearly
+document their approach if BackendTLSPolicy is treated differently for TLS passthrough.
 
 Note that there are cases where these patterns may result in multiple layers of TLS on a single connection.
-There may be even cases where the gateway implementation is unaware of this; for example, processing TCPRoute traffic -- the traffic may or may not be TLS, and the gateway would be unaware.
+There may be even cases where the gateway implementation is unaware of this; for example, processing TCPRoute traffic --
+the traffic may or may not be TLS, and the gateway would be unaware.
 This is intentional to allow full fidelity of the API, as this is commonly desired for tunneling scenarios.
-When users do not want this, they should ensure that the BackendTLSPolicy is not incorrectly applied to traffic that is already TLS.
+When users do not want this, they should ensure that the BackendTLSPolicy is not incorrectly applied to traffic that is
+already TLS.
 The [Future Plans](#future-plans) include more controls over the API to make this easier to manage.
 
 ## Request Flow
@@ -285,20 +604,26 @@ i.e. Service, in the cluster based on backendRefs rules of the HTTPRoute **and t
 
 ## Future plans
 
-In order to scope this GEP, some some changes are deferred to a near-future GEP.
-This GEP intends to add the ability for additional control by gateway clients to override TLS settings, following previously established patterns of [consumer and producer policies]([glossary](https://gateway-api.sigs.k8s.io/concepts/glossary/?h=gloss#producer-route)).
-Additionally, more contextual control over when to apply the policies will be explored, to enable use cases like "apply TLS only from this route" ([issue](https://github.com/kubernetes-sigs/gateway-api/issues/3856)).
+In order to scope this GEP, some changes are deferred to a near-future GEP.
+This GEP intends to add the ability for additional control by gateway clients to override TLS settings, following previously
+established patterns of [consumer and producer policies]([glossary](https://gateway-api.sigs.k8s.io/concepts/glossary/?h=gloss#producer-route)).
+Additionally, more contextual control over when to apply the policies will be explored, to enable use cases like "apply
+TLS only from this route" ([issue](https://github.com/kubernetes-sigs/gateway-api/issues/3856)).
 
-While the details of these plans are out of scope for this GEP it is important to be aware of the future plans for the API to ensure the immediate-term plans are future-proofed against the proposed plans.
+While the details of these plans are out of scope for this GEP it is important to be aware of the future plans for the
+API to ensure the immediate-term plans are future-proofed against the proposed plans.
 
-Implementations should plan for the existence of future fields that may be added that will control where the TLS policy applies.
+Implementations should plan for the existence of future fields that may be added that will control where the TLS policy
+applies.
 These may include, but are not limited to:
 
 * `spec.targetRefs.namespace`
 * `spec.targetRefs.from`
 * `spec.mode`
 
-While in some cases adding new fields may be seen as a backwards compatibility risk, due to older implementations not knowing to respect the fields, these fields (or similar, should future GEPs decide on new names) are pre-approved to be added in a future release, should the GEPs to add them are approved in the first place.
+While in some cases adding new fields may be seen as a backwards compatibility risk, due to older implementations not
+knowing to respect the fields, these fields (or similar, should future GEPs decide on new names) are pre-approved to be
+added in a future release, should the GEPs to add them are approved in the first place.
 
 ## Alternatives
 Most alternatives are enumerated in the section "The history of backend TLS".  A couple of additional
@@ -396,28 +721,37 @@ developer to provide the appropriate configuration for TLS.  The implementation
 provided by the application and verify that it satisfies the requirements of the route-as-client, including SAN
 information.  Sometimes the backend owner and route owner are the same entity.
 
-A. This was most recently addressed by
-adding hostname for SNI and removing allowed SANs.
+A. This was most recently addressed by adding hostname for SNI and removing allowed SANs.
+
+Q. Rob Scott is interested in extending the TargetRef to optionally include port, since we are targeting the entirety
+of a Service. See the discussion in https://github.com/kubernetes-sigs/gateway-api/pull/2113/files#r1231594914,
+and follow-up issue in https://github.com/kubernetes-sigs/gateway-api/issues/2147.
+
+A. TargetRef has been changed to `LocalPolicyTargetReferenceWithSectionName`, wherein the `SectionName` field is
+interpreted as a port name for a Service.
 
 ## Graduation Criteria
 
 This section is to record issues that were requested for discussion in the API section before this GEP graduates
 out of `Provisional` status.
 
-1. Rob Scott is interested in extending the TargetRef to optionally include port, since we are targeting the entirety
-of a Service. See the discussion in https://github.com/kubernetes-sigs/gateway-api/pull/2113/files#r1231594914,
-and follow up issue in https://github.com/kubernetes-sigs/gateway-api/issues/2147
-2. Michael Pleshakov asked about conflicts that could arise when multiple implementations are running in a cluster.
+1. Michael Pleshakov asked about conflicts that could arise when multiple implementations are running in a cluster.
 This is a gap in our policy attachment model that needs to be addressed.  See the discussion in
 https://github.com/kubernetes-sigs/gateway-api/pull/2113/files#r1235750540. Graduating this GEP to implementable
 requires an update to the Policy GEP to define how status can be nested to support multiple implementations. This will
 likely look very similar to Route status.
-See [comment](https://github.com/kubernetes-sigs/gateway-api/pull/2113#issuecomment-1696127092).
-3. Rob Scott [wanted to note](https://github.com/kubernetes-sigs/gateway-api/pull/2113#issuecomment-1696127092) that
+
+>This question has been converted to a Gateway API enhancement request for Policy:
+https://github.com/kubernetes-sigs/gateway-api/issues/4098.
+
+2. Rob Scott [wanted to note](https://github.com/kubernetes-sigs/gateway-api/pull/2113#issuecomment-1696127092) that
 when this graduates to the standard channel, implementations of HTTPRoute may also be
 required to watch the BackendTLSPolicy. If one of these policies is attached to a Service targeted by an HTTPRoute,
 the implementation would be required to fully implement the policy or mark the backend invalid.
 
+>This comment may be added to the release notes for v1.4.0 of Gateway API, along with other special notes for the introduction
+of the first standard Policy type.
+
 ## References
 
 [Gateway API TLS Use Cases](https://docs.google.com/document/d/17sctu2uMJtHmJTGtBi_awGB0YzoCLodtR6rUNmKMCs8/edit#heading=h.cxuq8vo8pcxm)
diff --git a/geps/gep-1897/metadata.yaml b/geps/gep-1897/metadata.yaml
index 716cf3d0..afad0e64 100644
--- a/geps/gep-1897/metadata.yaml
+++ b/geps/gep-1897/metadata.yaml
@@ -2,14 +2,19 @@ apiVersion: internal.gateway.networking.k8s.io/v1alpha1
 kind: GEPDetails
 number: 1897
 name: BackendTLSPolicy - Explicit Backend TLS Connection Configuration
-status: Experimental
+status: Standard
 authors:
   - candita
   - brianehlert
   - robscott
   - youngnick
+  - howardjohn
+  - snorwin
 relationships:
   obsoletes:
     - number: 1282
       name: Describing Backend Properties
       description: Implements just part of the Backend Properties GEP.
+extendedBy:
+  - number: 4152
+    name: Extending TLS Validation in BackendTLSPolicy
diff --git a/geps/gep-2907/index.md b/geps/gep-2907/index.md
index a44451bd..c9a57602 100644
--- a/geps/gep-2907/index.md
+++ b/geps/gep-2907/index.md
@@ -8,11 +8,14 @@ This GEP aims to define high level TLS terminology and structure within Gateway
 API to ensure that all our independent proposals related to TLS result in a
 coherent set of APIs. This will result in some adjustments to provisional and
 experimental TLS-related GEPs, specifically [BackendTLSPolicy](../gep-1897/index.md)
-and [Client Certificate Verification](../gep-91/index.md).
 
 ## Goals
-* Define high-level terminology for how we refer to TLS in Gateway API.
-* Define top level fields where TLS configuration can live.
+1. Define high-level terminology for how we refer to TLS in Gateway API.
+2. Define top level fields where TLS configuration can live for all below cases:
+* Client to Gateway (Frontend) TLS configuration.
+* Gateway to Client TLS configuration (Client Certificate Validation)
+* Gateway to backend (Gateway Client Certificate)
+3. Document how to use `BackendTLSPolicy` to support Gateway to Backend TLS configuration.
 
 ## Non-Goals
 * Add or change fields directly. (This may inspire changes in other GEPs
@@ -30,29 +33,15 @@ in scope for this GEP. In the future, this GEP may be expanded to include:
 
 ## Introduction
 
-### Where TLS could be configured
-We have three different places where we might want to configure TLS:
-
-#### A. Gateways
-Config attached at this layer will apply to everything behind a single address
-such as a virtual IP.
+### TLS mode
 
-#### B. Gateway Listeners
-Each Gateway contains multiple “Listeners”. Each HTTPS Listener in a Gateway
-must have a unique combination of protocol, port, and SNI (Server Name
-Indication). TLS configuration attached at this layer should be [isolated via
-SNI](../../guides/implementers.md#listener-isolation).
+TLS can be configured with two distinct modes:
+* **Passthrough**: The Gateway forwards encrypted traffic directly to the backend from the entity originating the connection (called later a client). The TLS connection is established between the client and the backend; the Gateway does not participate in the TLS handshake.
 
-#### C. BackendTLSPolicy
-This policy allows us to attach unique TLS configuration per Backend. Depending
-on the organization, this policy may be owned by the application owner or the
-cluster operator. Note that this configuration will be used by all Gateways
-(potentially from different implementations) that are connecting to the backend.
+* **Terminate**: The Gateway acts as a man-in-the-middle, terminating the client's TLS connection and originating a separate connection to the backend when routing the traffic. Both connections can independently support TLS and mutual TLS due to their distinct TLS configurations. The Gateway's dual role as a client or server affects the placement of TLS settings needed for given connection.
 
 ### "Frontend" and "Backend"
-A guiding principle in this naming is to use consistent naming for “Downstream”
-(1+2) and “Upstream” (3+4), similar to Envoy. To avoid the confusion with what
-is upstream and downstream, Gateway API will use “Frontend” (1+2) and “Backend”
+A guiding principle in this naming is to use consistent naming for both TLS connections “Downstream” (1+2) and “Upstream” (3+4) handled by the Gateway (similar to Envoy). To avoid the confusion with what is upstream and downstream, Gateway API will use “Frontend” (1+2) and “Backend”
 (3+4).
 
 *  **Frontend:** The entity connecting to a Gateway, typically a client
@@ -73,43 +62,34 @@ flowchart LR
 
 The above diagram depicts these four segments as edges in a graph.
 
-### TLS mode
+#### Frontend configuration
 
-TLS can be configured with two distinct modes:
+In the Frontend TLS connection Gateway acts as a server and presents Server certificate during TLS handshake. Client connects to the Gateway on domain basis and this is desired to configure Server certificates on the Listener.
+In the mutual frontend TLS Gateway needs to verify client certificates with configured CA. It was expected that CA configuration would be also defined on Listener but due to connection coalescing this solution was not secure. We decided to move client certificate validation configuration on the Gateway level and allow for per port overrides.
+
+#### Backend configuration
+
+In the Backend connection Gateway acts as a client. The nature of the connection (HTTP or HTTPS) is configured on the Service using BackendTLSPolicy. If BackendTLSPolicy is defined for a Service, the Gateway must establish an HTTPS connection with the backend. During the TLS handshake, the backend presents a Server certificate. The Gateway validates this certificate against a CA certificate (and optionally SANs) configured by BackendTLSPolicy.
+For mutual backend TLS, the Gateway's identity must be configured. This identity, a client certificate set on the Gateway object, will be presented by the Gateway. The Gateway uses the same client certificate for all backend connections originating mutual TLS.
 
-* **Terminate**: the TLS connection is instantiated between the frontend and the
-  Gateway. The connection between the Gateway and the backend is left unencrypted
- unless a new TLS connection between the two entities is configured via BackendTLSPolicy.
-* **Passthrough**: the TLS connection is instantiated between the frontend and the
-  backend. The traffic flows through the Gateway encrypted, and the Gateway is not
-  able to decrypt or inspect the encrypted portions of the TLS stream.
 
 ## Proposed Segments
-Note that this does not represent any form of commitment that any of these
-fields or concepts will exist within Gateway API. If or when they do, we propose
-the following naming structure:
 
-### 1. Validate Client Certificate provided by Frontend
+
+### 1. Gateway level configuration
+
+Gateway-level configurations are required for both Frontend and Backend connections. We propose a top-level GatewayTLSConfig that is divided into independent Backend and Frontend configurations.
 
 | Proposed Placement | Name | Status |
 |-|-|-|
-| Gateway Listener | `Listener.TLS.FrontendValidation` | Proposed |
+| Gateway | `Gateway.TLS.Frontend` | Proposed |
+| Gateway | `Gateway.TLS.Backend` | Proposed |
 
 #### Rationale
-Use FrontendValidation to leave room for concepts like trust anchors and trust
-domains. Anything not strictly tied to validation would belong to Listener.TLS
-which is now reserved exclusively for “Frontend” TLS configuration (1+2).
-
-#### Why Not Frontend.Validation?
-Part of the idea behind this GEP is that Listener.TLS is really entirely focused
-on 1+2 - the bits of TLS between frontend and Gateway. That means that if we
-were to add any additional TLS configuration in the Listener.TLS struct, it
-would tied to that limited scope, and thus we don't really need a separate
-Frontend struct.
+From the security point of view both TLS configurations require a Gateway level field. The configurations are independent and can coexist.
 
-One could make an argument that Listener.TLS.Validation should be the field name
-here to avoid any ambiguity, but in this specific context, we think that it's
-probably helpful to specifically spell out frontend.
+#### Why Not Listener.Frontend?
+Due to connection coalescing, the client certificate validation for the frontend was moved to a Gateway level field to address security concerns. [GEP-91 Update PR](https://github.com/kubernetes-sigs/gateway-api/pull/3942)
 
 #### Why Not FrontendTLSPolicy?
 It could be reasonable to try to mirror BackendTLSPolicy for Frontend TLS. As we
@@ -129,7 +109,7 @@ We don't think either of those reasons really apply to frontend TLS. Instead,
 frontend TLS could theoretically be configured either for an entire Gateway, or
 a specific Gateway listener. Given that many implementations already support
 distinguishing this config per SNI, it seems to make sense to start with
-listener level attachment. We think that the persona that would be responsible
+Listener level attachment. We think that the persona that would be responsible
 for a Gateway is not sufficiently different than the persona that would be
 responsible for frontend TLS, so the current proposal is likely the best option
 available to us.
@@ -145,17 +125,30 @@ This is already finalized in the API and so we're stuck with this name. In
 hindsight a name that was more clearly tied to frontend TLS would have been
 ideal here.
 
-### 3. Configure Client Certificate that Gateway should use to connect to Backend
+### 3. Configure Client Certificate Validation for Frontend
+
+Client certificate validation will reside at the Gateway level. This configuration will be
+either applied globally to all Listeners in the Gateway or can be overridden on a per-port basis.
 
 | Proposed Placement | Name | Status |
 |-|-|-|
-| Gateway | `Gateway.Spec.BackendTLS.ClientCertificateRef` | Not Proposed |
-| BackendTLSPolicy | `BackendTLSPolicy.Spec.ClientCertificateRef` | Not Proposed |
+| Gateway | `Gateway.TLS.Frontend.Default.Validation` | Proposed |
+| Gateway | `Gateway.TLS.Frontend.PerPort` | Proposed |
 
 #### Rationale
-It's not yet obvious which of the above options are preferable, but a case could
-be made for either or both. If we add a `BackendTLS` struct to Gateway it would
-leave room for concepts like TLS version, ALPN, cipher suites, etc.
+Gateway level configuration for client certificate validation was chosen due to security issue.
+
+#### Why per port override
+HTTPS connection can be reused between multiple Listeners sharing the same port. This might lead to bypassing client certificate validation configuration for a given Listener becasue new TLS handshake will not be triggered for different hostname.
+
+### 4. Configure Client Certificate that Gateway should use to connect to Backend
+
+| Proposed Placement | Name | Status |
+|-|-|-|
+| Gateway | `Gateway.Spec.TLS.Backend.ClientCertificateRef` | Proposed |
+
+#### Rationale
+Client certificate is part of Gateway identity and should not be overriden per backend.
 
 #### Why Not Listener level to match FrontendValidation?
 In general, we'd expect this identity to represent a Gateway as a whole, and
@@ -167,7 +160,7 @@ use when connecting to a backend, it should likely either be tied directly to
 the Gateway or Backend, but the Listener is not particularly relevant in this
 context.
 
-### 4. Validate Server Certificate that is provided by Backend
+### 5. Validate Server Certificate that is provided by Backend
 | Proposed Placement | Name | Status |
 |-|-|-|
 | Gateway | `Gateway.Spec.BackendTLS.Validation` | Not Proposed |
@@ -179,42 +172,7 @@ already clearly backend-focused, config like TLS Version, ALPN, and cipher
 suites, could live at the same level without confusion. It's also plausible that
 some Gateways may want to express Gateway-wide CAs that are trusted.
 
-#### Why BackendTLS on Gateways?
-Although this GEP is intentionally not committing to adding new fields or
-features, it's possible that at some point in the future we may want to have
-some kind of Backend TLS config at the Gateway level. For example, it may be
-useful to configure a set of CAs that a Gateway trusts or a client cert that a
-Gateway should use to connect to all backends. If this existed, there would
-likely be some overlap in config with BackendTLSPolicy, and if a future GEP
-proposed this, it would need to include how overlapping config should be
-handled.
-
-#### Why the inconsistency between Frontend and Backend TLS config on Gateways?
-If we were to populate all the possible fields described in this GEP, we'd end
-up with the following config on Gateways:
-
-```
-Gateway.Spec.Listeners.TLS.FrontendValidation
-Gateway.Spec.Listeners.TLS
-Gateway.Spec.BackendTLS.ClientCertificateRef
-Gateway.Spec.BackendTLS.Validation
-```
-
-This is all tied to the need to provide backwards compatibility with the TLS
-config that is already GA on Listeners (`Listener.TLS`). If we were naming that
-field today with the broader vision of TLS configuration throughout Gateway API
-we would almost certainly choose a more descriptive name that was more clearly
-tied to Frontend TLS. Unfortunately we're too late to change that name, but we
-can try to make the rest of the terminology clearly tied to frontend or backend
-TLS.
-
-One [suggestion by @candita](https://github.com/kubernetes-sigs/gateway-api/pull/2910#discussion_r1552534017)
-would be to introduce a Listener like resource for BackendTLS, resulting in a
-more consistent naming scheme within Gateway TLS configuration. Although it's
-not yet clear if we need this additional layer, we should reconsider it as we're
-further developing Backend TLS.
-
-### 5. Configure TLS mode
+### 6. Configure TLS mode
 
 | Proposed Placement | Name | Status |
 |-|-|-|
@@ -236,8 +194,8 @@ does not need to be provided, as the TLS termination is handled by the backend.
 
 ## Routes and TLS
 
-Multiple routes can be attached to listeners specifying TLS configuration. This section
-intends to clearly state how and when Routes can attach to listeners with TLS configuration.
+Multiple routes can be attached to Listeners specifying TLS configuration. This section
+intends to clearly state how and when Routes can attach to Listeners with TLS configuration.
 
 ### Context
 
@@ -265,12 +223,12 @@ with the compatible protocol.
 |-----------|---------|---------------|----------------|
 | HTTP      | `HTTPRoute`/`GRPCRoute` | no  | no  |
 | HTTPS     | `HTTPRoute`/`GRPCRoute` | yes | no  |
-| TLS       | `TLSRoute`  | yes | yes | 
+| TLS       | `TLSRoute`  | yes | yes |
 | TCP       | `TCPRoute`  | yes | no  |
 | UDP       | `UDPRoute`  | no  | no  |
 
 > [!NOTE]
-> When the traffic is routed to the backend via a listener configured with TLS `Passthrough`
-> and a compatible route, the packets are left untouched by the gateway. In order to
-> terminate the TLS connection to the gateway and forward the traffic unencrypted to the backend,
-> a listener configured with TLS `Terminate` and a compatible route must be used.
+> When the traffic is routed to the backend via a Listener configured with TLS `Passthrough`
+> and a compatible route, the packets are left untouched by the Gateway. In order to
+> terminate the TLS connection to the Gateway and forward the traffic unencrypted to the backend,
+> a Listener configured with TLS `Terminate` and a compatible route must be used.
diff --git a/geps/gep-3155/index.md b/geps/gep-3155/index.md
index 41477c22..0ced93ae 100644
--- a/geps/gep-3155/index.md
+++ b/geps/gep-3155/index.md
@@ -43,20 +43,24 @@ Specifying credentials at the gateway level is the default operation mode, where
 backends will be presented with a single gateway certificate. Per-service overrides are
 subject for consideration as the future work.
 
-**1. Add a new `BackendValidation` field at TLSConfig struct located in GatewayTLSConfig.Default field**
+**1. Add a new `Backend` field at GatewayTLSConfig struct located in Gateway**
 
 ```go
-// TLSConfig describes TLS configuration that can apply to multiple Listeners
-// within this Gateway.
-type TLSConfig struct {
-    ...
-	// GatewayBackendTLS describes TLS configuration for gateway when connecting
+// GatewayTLSConfig specifies frontend and backend tls configuration for gateway.
+type GatewayTLSConfig struct {
+	// Backend describes TLS configuration for gateway when connecting
 	// to backends.
+	//
+	// Note that this contains only details for the Gateway as a TLS client,
+	// and does _not_ imply behavior about how to choose which backend should
+	// get a TLS connection. That is determined by the presence of a BackendTLSPolicy.
+	//
 	// Support: Core
 	//
 	// +optional
 	// <gateway:experimental>
-	BackendValidation *GatewayBackendTLS `json:"backendValidation,omitempty"`
+	Backend *GatewayBackendTLS `json:"backend,omitempty"`
+    ...
 }
 type GatewayBackendTLS struct {
   // ClientCertificateRef is a reference to an object that contains a Client
@@ -99,6 +103,10 @@ type BackendTLSPolicyValidation struct {
   // SubjectAltNames contains one or more Subject Alternative Names.
   // When specified, the certificate served from the backend MUST have at least one
   // Subject Alternate Name matching one of the specified SubjectAltNames.
+  // If SubjectAltNames are specified, Hostname MUST NOT be used for authentication,
+  // even if this would cause a failure in the case that the SubjectAltNames do not match.
+  // If you want to use Hostname for authentication, you must add Hostname to the SubjectAltNames list.
+  //
   // +kubebuilder:validation:MaxItems=5
   SubjectAltNames []SubjectAltName `json:"subjectAltNames,omitempty"`
 }
diff --git a/geps/gep-3388/metadata.yaml b/geps/gep-3388/metadata.yaml
index 53b9ef12..1571692b 100644
--- a/geps/gep-3388/metadata.yaml
+++ b/geps/gep-3388/metadata.yaml
@@ -12,18 +12,18 @@ relationships:
   # obsoletes indicates that a GEP makes the linked GEP obsolete, and completely
   # replaces that GEP. The obsoleted GEP MUST have its obsoletedBy field
   # set back to this GEP, and MUST be moved to Declined.
-  obsoletes: {}
-  obsoletedBy: {}
+  obsoletes: []
+  obsoletedBy: []
   # extends indicates that a GEP extends the linked GEP, adding more detail
   # or additional implementation. The extended GEP MUST have its extendedBy
   # field set back to this GEP.
   extends:
     - number: 1731
       name: HTTPRoute Retries
-  extendedBy: {}
+  extendedBy: []
   # seeAlso indicates other GEPs that are relevant in some way without being
   # covered by an existing relationship.
-  seeAlso: {}
+  seeAlso: []
 # references is a list of hyperlinks to relevant external references.
 # It's intended to be used for storing GitHub discussions, Google docs, etc.
 references:
@@ -34,7 +34,7 @@ references:
   - https://github.com/kubernetes-sigs/gateway-api/pull/3695
 # featureNames is a list of the feature names introduced by the GEP, if there
 # are any. This will allow us to track which feature was introduced by which GEP.
-featureNames: {}
+featureNames: []
 # changelog is a list of hyperlinks to PRs that make changes to the GEP, in
 # ascending date order.
-changelog: {}
+changelog: []
diff --git a/geps/gep-3567/metadata.yaml b/geps/gep-3567/metadata.yaml
index be9f0fd3..d6130891 100644
--- a/geps/gep-3567/metadata.yaml
+++ b/geps/gep-3567/metadata.yaml
@@ -11,23 +11,23 @@ relationships:
   # obsoletes indicates that a GEP makes the linked GEP obsolete, and completely
   # replaces that GEP. The obsoleted GEP MUST have its obsoletedBy field
   # set back to this GEP, and MUST be moved to Declined.
-  obsoletes: {}
-  obsoletedBy: {}
+  obsoletes: []
+  obsoletedBy: []
   # extends indicates that a GEP extends the linked GEP, adding more detail
   # or additional implementation. The extended GEP MUST have its extendedBy
   # field set back to this GEP.
-  extends: {}
-  extendedBy: {}
+  extends: []
+  extendedBy: []
   # seeAlso indicates other GEPs that are relevant in some way without being
   # covered by an existing relationship.
-  seeAlso: {}
+  seeAlso: []
 # references is a list of hyperlinks to relevant external references.
 # It's intended to be used for storing GitHub discussions, Google docs, etc.
-references: {}
+references: []
 # featureNames is a list of the feature names introduced by the GEP, if there
 # are any. This will allow us to track which feature was introduced by which GEP.
 featureNames:
   - GatewayReturn421
 # changelog is a list of hyperlinks to PRs that make changes to the GEP, in
 # ascending date order.
-changelog: {}
+changelog: []
diff --git a/geps/gep-3779/metadata.yaml b/geps/gep-3779/metadata.yaml
index 3c5b9af7..a0202577 100644
--- a/geps/gep-3779/metadata.yaml
+++ b/geps/gep-3779/metadata.yaml
@@ -10,10 +10,10 @@ authors:
   - aryan16
 # references is a list of hyperlinks to relevant external references.
 # It's intended to be used for storing GitHub discussions, Google docs, etc.
-references: {}
+references: []
 # featureNames is a list of the feature names introduced by the GEP, if there
 # are any. This will allow us to track which feature was introduced by which GEP.
-featureNames: {}
+featureNames: []
 # changelog is a list of hyperlinks to PRs that make changes to the GEP, in
 # ascending date order.
-changelog: {}
+changelog: []
diff --git a/geps/gep-3792/metadata.yaml b/geps/gep-3792/metadata.yaml
index 4478b32b..fd3dfafd 100644
--- a/geps/gep-3792/metadata.yaml
+++ b/geps/gep-3792/metadata.yaml
@@ -11,23 +11,23 @@ relationships:
   # obsoletes indicates that a GEP makes the linked GEP obsolete, and completely
   # replaces that GEP. The obsoleted GEP MUST have its obsoletedBy field
   # set back to this GEP, and MUST be moved to Declined.
-  obsoletes: {}
-  obsoletedBy: {}
+  obsoletes: []
+  obsoletedBy: []
   # extends indicates that a GEP extends the linked GEP, adding more detail
   # or additional implementation. The extended GEP MUST have its extendedBy
   # field set back to this GEP.
-  extends: {}
-  extendedBy: {}
+  extends: []
+  extendedBy: []
   # seeAlso indicates other GEPs that are relevant in some way without being
   # covered by an existing relationship.
-  seeAlso: {}
+  seeAlso: []
 # references is a list of hyperlinks to relevant external references.
 # It's intended to be used for storing GitHub discussions, Google docs, etc.
-references: {}
+references: []
 # featureNames is a list of the feature names introduced by the GEP, if there
 # are any. This will allow us to track which feature was introduced by which GEP.
 # This is the value added to supportedFeatures and the conformance tests, in string form.
-featureNames: {}
+featureNames: []
 # changelog is a list of hyperlinks to PRs that make changes to the GEP, in
 # ascending date order.
-changelog: {}
+changelog: []
diff --git a/geps/gep-3793/index.md b/geps/gep-3793/index.md
index f0cad9a7..052419ff 100644
--- a/geps/gep-3793/index.md
+++ b/geps/gep-3793/index.md
@@ -275,40 +275,56 @@ GEP covers **all** intended changes to Gateway API behavior.
 Since Ana must be able to choose whether a Route is defaulted or not, marking
 a Route as defaulted must be an active configuration step she takes, rather
 than any kind of implicit behavior. To that end, the `CommonRouteSpec`
-resource will gain a new field, `useDefaultGateway`, which defines the
+resource will gain a new field, `UseDefaultGateway`, which defines the
 _scope_ for the defaulted Route:
 
 ```go
 // GatewayDefaultScope defines the set of default scopes that a Gateway
-// can claim. At present the only supported scope is "All".
+// can claim, for use in any Route type. At present the only supported
+// scopes are "All" and "None". "None" is a special scope which
+// explicitly means that the Route MUST NOT be defaulted.
 type GatewayDefaultScope string
 
 const (
   // GatewayDefaultScopeAll indicates that a Gateway can claim absolutely
   // any Route asking for a default Gateway.
   GatewayDefaultScopeAll GatewayDefaultScope = "All"
+
+  // GatewayDefaultScopeNone indicates that a Gateway MUST NOT claim
+  // any Route asking for a default Gateway.
+  GatewayDefaultScopeNone GatewayDefaultScope = "None"
 )
 
 type CommonRouteSpec struct {
-    // ... other fields ...
-    useDefaultGateway GatewayDefaultScope `json:"useDefaultGateway,omitempty"`
+  // ... other fields ...
+  // UseDefaultGateways indicates the default Gateway scope to use for this
+  // Route. If unset (the default), set to an empty string (`""`), or set to
+  // None, the Route will not be attached to any default Gateway; if set, it
+  // will be attached to any default Gateway supporting the named scope,
+  // subject to the usual rules about which Routes a Gateway is allowed to
+  // claim.
+  //
+  // +optional
+  // <gateway:experimental>
+  // +kubebuilder:validation:Enum=All;None
+  UseDefaultGateways GatewayDefaultScope `json:"useDefaultGateways,omitempty"`
 }
 ```
 
 For Ana to indicate that a Route should use a default Gateway, she MUST set
-the Route's `spec.useDefaultGateway` to the desired scope:
+the Route's `spec.useDefaultGateways` to the desired scope:
 
 ```yaml
 ...
 spec:
-  useDefaultGateway: All
+  useDefaultGateways: All
 ```
 
 A defaulted Route MUST be accepted only by Gateways that have been configured
-with a matching `spec.useDefaultGateway` scope.
+with a matching `spec.useDefaultGateways` scope.
 
 A Route MAY include explicit `parentRefs` in addition to setting
-`spec.useDefaultGateway`. In this case, the Route will be a candidate for
+`spec.useDefaultGateways`. In this case, the Route will be a candidate for
 being bound to default Gateways, but it will also be bound to its
 explicitly-specified `parentRefs`. This allows Ana to create a single Route
 that handles N/S traffic via the default Gateways and also handles E/W traffic
@@ -328,7 +344,7 @@ kind: HTTPRoute
 metadata:
   name: my-route
 spec:
-  useDefaultGateway: All
+  useDefaultGateways: All
   rules:
   - backendRefs:
     - name: my-service
@@ -346,7 +362,7 @@ kind: HTTPRoute
 metadata:
   name: ns-ew-route
 spec:
-  useDefaultGateway: All
+  useDefaultGateways: All
   parentRefs:
   - kind: Service
     name: face
@@ -357,7 +373,7 @@ spec:
       port: 80
 ```
 
-**Multiple Gateways**: A defaulted Route MAY both set `useDefaultGateway` and
+**Multiple Gateways**: A defaulted Route MAY both set `useDefaultGateways` and
 name other Gateways in `parentRefs`, although this is not expected to be
 common in practice:
 
@@ -367,7 +383,7 @@ kind: HTTPRoute
 metadata:
   name: multi-gateway-route
 spec:
-  useDefaultGateway: All
+  useDefaultGateways: All
   parentRefs:
   - kind: Gateway
     name: my-gateway
@@ -403,10 +419,10 @@ indicate that the Route has been claimed by a default Gateway. This becomes
 important if the set of default Gateways changes, or (in some situations) if
 GitOps tools are in play.
 
-If there are no default Gateways in the cluster, `spec.useDefaultGateway` MUST
-be treated as if it were set to `false` in all Routes, parallel to the
-situation where a Route specifies a Gateway by name, but no Gateway of that
-name exists in the cluster.
+If there are no default Gateways in the cluster, `spec.useDefaultGateways`
+MUST be treated as if it were unset in all Routes, parallel to the situation
+where a Route specifies a Gateway by name, but no Gateway of that name exists
+in the cluster.
 
 #### 2. Controlling which Gateways accept Defaulted Routes
 
@@ -418,18 +434,31 @@ behavior. To that end, the Gateway resource will gain a new field,
 
 ```go
 type GatewaySpec struct {
-    // ... other fields ...
-    DefaultScope GatewayDefaultScope `json:"defaultScope,omitempty"`
+  // ... other fields ...
+  // DefaultScope, when set, configures the Gateway as a default Gateway,
+  // meaning it will dynamically and implicitly have Routes (e.g. HTTPRoute)
+  // attached to it, according to the scope configured here.
+  //
+  // If unset (the default), set to an empty string (`""`), or set to None,
+  // the Gateway will not act as a default Gateway; if set, the Gateway will
+  // claim any Route with a matching scope set in its UseDefaultGateway
+  // field, subject to the usual rules about which routes the Gateway can
+  // attach to.
+	//
+	// +optional
+	// <gateway:experimental>
+  DefaultScope GatewayDefaultScope `json:"defaultScope,omitempty"`
 }
 ```
 
-Again, the only currently-defined scope is `All`.
+Again, the only currently-defined scopes are `All` and `None`, with `None`
+explicitly disabling default-Gateway functionality.
 
 If `spec.defaultScope` is set, the Gateway MUST claim Routes that have set
-`spec.useDefaultGateway` to a matching value (subject to the usual Gateway API
-rules about which Routes may be bound to a Gateway), and it MUST update its
-own `status` with a `condition` of type `DefaultGateway` and `status` true to
-indicate that it is a default Gateway and what its scope is, for example:
+`spec.useDefaultGateways` to a matching value (subject to the usual Gateway
+API rules about which Routes may be bound to a Gateway), and it MUST update
+its own `status` with a `condition` of type `DefaultGateway` and `status` true
+to indicate that it is a default Gateway and what its scope is, for example:
 
 ```yaml
 status:
@@ -455,7 +484,8 @@ from its own namespace.
 ##### Behavior with No Default Gateway
 
 If no Gateway has `spec.defaultScope` set, then all Gateways MUST ignore
-`spec.useDefaultGateway` in all Routes. A Route will be bound to only those Gateways that it specifically names in `parentRefs` entries.
+`spec.useDefaultGateways` in all Routes. A Route will be bound to only those
+Gateways that it specifically names in `parentRefs` entries.
 
 ##### Deleting a Default Gateway
 
@@ -479,7 +509,7 @@ options here.
 
 1. Don't bother with any enforcement logic.
 
-    In this case, a Route that sets `spec.useDefaultGateway` would be bound to
+    In this case, a Route that sets `spec.useDefaultGateways` would be bound to
     _all_ Gateways that have `spec.defaultScope` set a matching scope. Since
     Gateway API already allows a Route to be bound to multiple Gateways, and
     the Route `status` is already designed for it, this should function
@@ -495,7 +525,7 @@ options here.
     In this case, every Gateway with `spec.defaultScope` set would ignore it,
     with the final effect being the same as if no Gateway had
     `spec.defaultScope` set: all Gateways would ignore
-    `spec.useDefaultGateway` in all Routes, and each Gateway would only accept
+    `spec.useDefaultGateways` in all Routes, and each Gateway would only accept
     Routes that explicitly named it in `parentRefs`.
 
     Each Gateway with `spec.defaultScope` set would also update its `status`
@@ -515,9 +545,9 @@ options here.
 
     In this case, the oldest Gateway with `spec.defaultScope` set would be
     considered the only default Gateway. That oldest Gateway would be the only
-    one that honors `spec.useDefaultGateway` in Routes, and all other Gateways
-    with `spec.defaultScope` set would ignore `spec.useDefaultGateway` in
-    every Route.
+    one that honors `spec.useDefaultGateways` in Routes, and all other
+    Gateways with `spec.defaultScope` set would ignore
+    `spec.useDefaultGateways` in every Route.
 
     The oldest default Gateway would update its `status` to reflect that it
     the default Gateway; all other Gateways with `spec.defaultScope` set to
@@ -584,7 +614,7 @@ merged with other Gateways.
 #### 4. Enumerating Routes Bound to Default Gateways
 
 To enumerate Routes bound to the default Gateways, any of Ana, Chihiro, or Ian
-can look for Routes that set `spec.useDefaultGateway` to `true`, and then
+can look for Routes that set `spec.useDefaultGateways` to `true`, and then
 check the `status.parents` of those Routes to see if the Route has been
 claimed. Since this will also show _which_ Gateways have claimed a given
 defaulted Route, it neatly solves the problem of allowing Ana to determine
@@ -605,7 +635,7 @@ Mesh traffic is defined by using a Service as a `parentRef` rather than a
 Gateway. As such, there is no case where a default Gateway would be used for
 mesh traffic.
 
-As noted above, a Route MAY both set `spec.useDefaultGateway` _and_ include a
+As noted above, a Route MAY both set `spec.useDefaultGateways` _and_ include a
 `Service` `parentRef` entry, allowing a single Route to handle both N/S and
 E/W traffic. In this case, the Route will be bound to both the default Gateway
 and the mesh, and the `status` will show both parents.
diff --git a/geps/gep-3793/metadata.yaml b/geps/gep-3793/metadata.yaml
index db611f59..ccaf298f 100644
--- a/geps/gep-3793/metadata.yaml
+++ b/geps/gep-3793/metadata.yaml
@@ -11,23 +11,23 @@ relationships:
   # obsoletes indicates that a GEP makes the linked GEP obsolete, and completely
   # replaces that GEP. The obsoleted GEP MUST have its obsoletedBy field
   # set back to this GEP, and MUST be moved to Declined.
-  obsoletes: {}
-  obsoletedBy: {}
+  obsoletes: []
+  obsoletedBy: []
   # extends indicates that a GEP extends the linked GEP, adding more detail
   # or additional implementation. The extended GEP MUST have its extendedBy
   # field set back to this GEP.
-  extends: {}
-  extendedBy: {}
+  extends: []
+  extendedBy: []
   # seeAlso indicates other GEPs that are relevant in some way without being
   # covered by an existing relationship.
-  seeAlso: {}
+  seeAlso: []
 # references is a list of hyperlinks to relevant external references.
 # It's intended to be used for storing GitHub discussions, Google docs, etc.
-references: {}
+references: []
 # featureNames is a list of the feature names introduced by the GEP, if there
 # are any. This will allow us to track which feature was introduced by which GEP.
 # This is the value added to supportedFeatures and the conformance tests, in string form.
-featureNames: {}
+featureNames: []
 # changelog is a list of hyperlinks to PRs that make changes to the GEP, in
 # ascending date order.
-changelog: {}
+changelog: []
diff --git a/geps/gep-3798/metadata.yaml b/geps/gep-3798/metadata.yaml
index 85a47289..9d1408c6 100644
--- a/geps/gep-3798/metadata.yaml
+++ b/geps/gep-3798/metadata.yaml
@@ -11,13 +11,13 @@ relationships:
   # obsoletes indicates that a GEP makes the linked GEP obsolete, and completely
   # replaces that GEP. The obsoleted GEP MUST have its obsoletedBy field
   # set back to this GEP, and MUST be moved to Declined.
-  obsoletes: {}
-  obsoletedBy: {}
+  obsoletes: []
+  obsoletedBy: []
   # extends indicates that a GEP extends the linked GEP, adding more detail
   # or additional implementation. The extended GEP MUST have its extendedBy
   # field set back to this GEP.
-  extends: {}
-  extendedBy: {}
+  extends: []
+  extendedBy: []
   # seeAlso indicates other GEPs that are relevant in some way without being
   # covered by an existing relationship.
   seeAlso:
@@ -27,11 +27,11 @@ relationships:
   
 # references is a list of hyperlinks to relevant external references.
 # It's intended to be used for storing GitHub discussions, Google docs, etc.
-references: {}
+references: []
 # featureNames is a list of the feature names introduced by the GEP, if there
 # are any. This will allow us to track which feature was introduced by which GEP.
 # This is the value added to supportedFeatures and the conformance tests, in string form.
-featureNames: {}
+featureNames: []
 # changelog is a list of hyperlinks to PRs that make changes to the GEP, in
 # ascending date order.
-changelog: {}
+changelog: []
diff --git a/geps/gep-3949/index.md b/geps/gep-3949/index.md
index 26f5f205..eddb1611 100644
--- a/geps/gep-3949/index.md
+++ b/geps/gep-3949/index.md
@@ -208,8 +208,8 @@ status:
     ...
   supportedFeatures:
     # List of SupportedFeature
-    - name: MeshHTTPRoute
     - name: MeshConsumerRoute
+    - name: MeshHTTPRoute
     - name: OffClusterGateway
     ...
 ```
@@ -358,7 +358,8 @@ without requiring the mesh to be restarted.
 ### API Type Definitions
 
 ```go
-// Mesh is a Cluster level resource.
+// Mesh defines mesh-wide characteristics of a GAMMA-compliant service mesh.
+// It is a cluster-scoped resource.
 type Mesh struct {
   metav1.TypeMeta   `json:",inline"`
   metav1.ObjectMeta `json:"metadata,omitempty"`
@@ -406,6 +407,12 @@ type MeshSpec struct {
   //
   // +optional
   ParametersRef *ParametersReference `json:"parametersRef,omitempty"`
+
+  // Description optionally provides a human-readable description of a Mesh.
+  //
+  // +kubebuilder:validation:MaxLength=64
+  // +optional
+  Description *string `json:"description,omitempty"`
 }
 
 // MeshConditionType is the type for status conditions on Mesh resources.
@@ -417,8 +424,8 @@ type MeshConditionType string
 type MeshConditionReason string
 
 const (
-  // This condition indicates whether the Mesh has been accepted by the
-  // controller requested in the `spec.controller` field.
+  // The "Accepted" condition indicates whether the Mesh has been accepted
+  // by the controller requested in the `spec.controllerName` field.
   //
   // This condition defaults to Unknown, and MUST be set by a controller
   // when it sees a Mesh using its controller string. The status of this
@@ -435,27 +442,33 @@ const (
   //
   // * "InvalidParameters"
   //
+  // Possible reasons for this condition to be Unknown are:
+  //
+  // * "Pending"
+  //
   // Controllers should prefer to use the values of MeshConditionReason
   // for the corresponding Reason, where appropriate.
-  MeshConditionStatusAccepted MeshConditionType = "Accepted"
+  MeshConditionAccepted MeshConditionType = "Accepted"
 
   // This reason is used with the "Accepted" condition when the condition is
   // true.
-  MeshConditionReasonAccepted MeshConditionReason = "Accepted"
+  MeshReasonAccepted MeshConditionReason = "Accepted"
 
   // This reason is used with the "Accepted" condition when the Mesh
   // was not accepted because the parametersRef field refers to
+  //
   // * a namespaced resource but the Namespace field is not set, or
   // * a cluster-scoped resource but the Namespace field is set, or
   // * a nonexistent object, or
   // * an unsupported resource or kind, or
   // * an existing resource but the data within that resource is malformed.
-  MeshConditionReasonInvalidParameters MeshConditionReason = "InvalidParameters"
+  MeshReasonInvalidParameters MeshConditionReason = "InvalidParameters"
 
-  // This reason is used with the "Accepted" condition when the
-  // requested controller has not yet made a decision about whether
-  // to accept the Mesh. It is the default Reason on a new Mesh.
-  MeshConditionReasonPending MeshConditionReason = "Pending"
+  // This reason is used with the "Accepted" condition when the status is
+  // "Unknown" and the requested controller has not yet made a decision
+  // about whether to accept the Mesh. It is the default Reason on a new
+  // Mesh.
+  MeshReasonPending MeshConditionReason = "Pending"
 )
 
 // MeshStatus is the current status for the Mesh.
diff --git a/geps/gep-3949/metadata.yaml b/geps/gep-3949/metadata.yaml
index de9c3639..09b4cb3e 100644
--- a/geps/gep-3949/metadata.yaml
+++ b/geps/gep-3949/metadata.yaml
@@ -12,23 +12,23 @@ relationships:
   # obsoletes indicates that a GEP makes the linked GEP obsolete, and completely
   # replaces that GEP. The obsoleted GEP MUST have its obsoletedBy field
   # set back to this GEP, and MUST be moved to Declined.
-  obsoletes: {}
-  obsoletedBy: {}
+  obsoletes: []
+  obsoletedBy: []
   # extends indicates that a GEP extends the linked GEP, adding more detail
   # or additional implementation. The extended GEP MUST have its extendedBy
   # field set back to this GEP.
-  extends: {}
-  extendedBy: {}
+  extends: []
+  extendedBy: []
   # seeAlso indicates other GEPs that are relevant in some way without being
   # covered by an existing relationship.
-  seeAlso: {}
+  seeAlso: []
 # references is a list of hyperlinks to relevant external references.
 # It's intended to be used for storing GitHub discussions, Google docs, etc.
-references: {}
+references: []
 # featureNames is a list of the feature names introduced by the GEP, if there
 # are any. This will allow us to track which feature was introduced by which GEP.
 # This is the value added to supportedFeatures and the conformance tests, in string form.
-featureNames: {}
+featureNames: []
 # changelog is a list of hyperlinks to PRs that make changes to the GEP, in
 # ascending date order.
-changelog: {}
+changelog: []
diff --git a/geps/gep-4152/index.md b/geps/gep-4152/index.md
new file mode 100644
index 00000000..662db855
--- /dev/null
+++ b/geps/gep-4152/index.md
@@ -0,0 +1,67 @@
+# GEP-4152: Extending TLS Validation in BackendTLSPolicy
+
+* Issue: [#4152](https://github.com/kubernetes-sigs/gateway-api/issues/4152)
+* Status: Provisional
+
+## TLDR
+
+The ability for the `BackendTLSPolicy` to skip TLS verification or to validate
+certificates based on their fingerprint or public key hash.
+
+## Motivation
+
+The current `BackendTLSPolicy` follows a secure-by-default approach that requires
+users to provide a trusted CA certificate bundle or rely on the system’s default
+certificate store (which typically includes root CAs) to validate backend server
+certificates. However, real-world deployments include cases where strict
+certificate validation may not be possible or practical, e.g., Development and
+testing environments that use self-signed certificates generated dynamically at
+runtime.
+
+In such scenarios, users may need the flexibility to disable certificate
+verification or to use certificate pinning. Certificate pinning offers a safer
+and more controlled alternative, instead of bypassing TLS validation, the gateway
+verifies that the backend’s certificate matches a known fingerprint or public key
+hash. This preserves the confidentiality and integrity guarantees of TLS while
+removing the operational overhead of managing full certificate chains or trusted
+CA bundles.
+
+### User Stories
+
+* As an application developer, I want the option to disable backend TLS
+  certificate verification on a per-backend basis, so I can connect to services
+  using dynamically generated or self-signed certificates during development or
+  testing.
+* As an application developer, I want secure-by-default behavior, ensuring that
+  certificate verification is always enabled unless I explicitly opt out, to
+  prevent accidentally deploying insecure configurations to production.
+* As an application developer, I want an alternative to disabling verification,
+  such as certificate or SPKI pinning, so I can securely communicate with
+  backends using self-signed certificates without managing CA bundles.
+* As a gateway operator, I want to control whether skipping TLS validation is
+  permitted for specific Gateways.
+* As a security officer, I want transparency and auditability into where TLS
+  verification has been disabled.
+
+## Goals
+
+* Enable connecting to backends over TLS without requiring certificate
+  verification.
+* Support certificate and SPKI pinning as alternatives to disabling verification
+  or relying on CA trust chains.
+* Maintain a secure-by-default approach, with certificate verification enabled
+  unless explicitly opted out.
+* Provide operator-level controls so Gateway constraints can restrict or permit
+  the use of skip-verify.
+* Provide clear runtime indicators that security is degraded when TLS validation
+  is disabled.
+
+## API
+
+**TODO**: First PR will not include any implementation details, in favor of
+building consensus on the motivation, goals and non-goals first. _"How?"_ we
+implement shall be left open-ended until _"What?"_ and _"Why?"_ are solid.
+
+## References
+
+* [GEP-1897: BackendTLSPolicy - Explicit Backend TLS Connection Configuration](https://gateway-api.sigs.k8s.io/geps/gep-1897/)
diff --git a/geps/gep-4152/metadata.yaml b/geps/gep-4152/metadata.yaml
new file mode 100644
index 00000000..e1c16ce5
--- /dev/null
+++ b/geps/gep-4152/metadata.yaml
@@ -0,0 +1,10 @@
+apiVersion: internal.gateway.networking.k8s.io/v1alpha1
+kind: GEPDetails
+number: 4152
+name: Extending TLS Validation in BackendTLSPolicy
+status: Provisional
+authors:
+  - snorwin
+extends:
+  - number: 1897
+    name: BackendTLSPolicy - Explicit Backend TLS Connection Configuration
diff --git a/geps/gep-696/index.md b/geps/gep-696/index.md
index 6082b309..83bcfe94 100644
--- a/geps/gep-696/index.md
+++ b/geps/gep-696/index.md
@@ -7,23 +7,47 @@
 
 ## TLDR
 
+[required_in]: # (Provisional status and above)
+
 (1-2 sentence summary of the proposal)
 
 ## Goals
 
+[required_in]: # (Provisional status and above)
+
 (Primary goals of this proposal.)
 
+## Longer Term Goals (optional)
+
+(goals that are not covered initially on this proposal but may be considered long term)
+
 ## Non-Goals
 
+[required_in]: # (Provisional status and above)
+
 (What is out of scope for this proposal.)
 
-## Introduction
+## Introduction/Overview
+
+[required_in]: # (Provisional status and above)
 
 (Can link to external doc -- but we should bias towards copying
 the content into the GEP as online documents are easier to lose
 -- e.g. owner messes up the permissions, accidental deletion)
 
+Write here "What" we want to do. What is the proposal aiming to do?
+
+## Purpose (Why and Who)
+
+[required_in]: # (Provisional status and above)
+
+Write here "Why" we want to do it. What problems are being solved? What personas are
+the target of this proposal, and why will this proposal will make their lives better?
+
 ## API
+
+[required_in]: # (Implementable status and above)
+
 (... details, can point to PR with changes)
 
 ### Gateway for Ingress (North/South)
@@ -32,12 +56,27 @@ the content into the GEP as online documents are easier to lose
 ### Gateway For Mesh (East/West)
 (Include East/West API considerations, examples, and if different - APIs)
 
+## Request flow
+Example on the usage flow of this proposal/enhancement. It is suggested to contain
+at least one manifest as example.
+
+Example of a flow description:
+
+* A client makes a request to https://foo.example.com.
+* DNS resolves the name to a `Gateway` address.
+* The reverse proxy receives the request on a `Listener` and does something with it
+* The reverse proxy passes the request through `XPTORoute` modifying the headers to contain `XYZ`
+
 ## Conformance Details
 
+[required_in]: # (Provisional status and above)
+
 (from https://github.com/kubernetes-sigs/gateway-api/blob/main/geps/gep-2162/index.md#standardize-features-and-conformance-tests-names)
 
 #### Feature Names
 
+[required_in]: # (Experimental status and above)
+
 (Does it require separate feature(s) for mesh? Please add them if necessary)
 
 Every feature should:
@@ -49,7 +88,36 @@ Every feature should:
 
 GEPs cannot move to Experimental without a Feature Name.
 
-### Conformance tests 
+### Conformance test scenarios
+
+This section records the scenarios that Conformance tests will check.
+
+It _does not_ need to include code, although code _may_ be used to illustrate the scenarios
+if required. Tables are also acceptable for describing complex interactions.
+
+Scenarios _should_ be able to be summarized without code.
+
+These scenario summaries can then be used to determine the names of the tests and their files.
+
+#### Example test scenario 1, please remove: HTTPRoute Simple, Same Namespace
+
+A HTTPRoute with a basic routing configuration, in the same namespace as its
+parent Gateway, should route traffic to the specified backend.
+
+#### Example test scenario 2, please remove: HTTPRoute Path Rewrite
+
+A HTTPRoute with a Path Rewrite filter should rewrite the path according to
+the specification, routing traffic to the backend.
+
+* A Match of `/prefix/one` with a `ReplacePrefixMatch` of `/one` should route requests
+  to `/prefix/one/two` to `/one/two` instead.
+* A Match of `/strip-prefix` with a `ReplacePrefixMatch` of `/` should route requests to
+  `/strip-prefix/three` to `/three` instead.
+* A Match of `/full/one` with a `ReplaceFullPath` of `/one` should route requests to
+  `/full/one/two` to `/one` instead.
+* ... and so on.
+
+#### Conformance test file names
 
 Conformance tests file names should try to follow the `pascal-case-name.go` format.
 For example for `HTTPRoutePortRedirect` - the test file would be `httproute-port-redirect.go`.
@@ -60,6 +128,22 @@ In any case, the conformance tests file names should be meaningful and easy to u
 
 (Make sure to also include conformance tests that cover mesh)
 
+
+## `Standard` Graduation Criteria
+
+( This section outlines the criteria required for graduation to Standard. It MUST
+contain at least the items in the template, but more MAY be added if necessary. )
+
+( Required for Experimental status and above)
+
+* At least one Feature Name must be listed.
+* The `Conformance Details` must be filled out, with conformance test scenarios listed.
+* Conformance tests must be implemented that test all the listed test scenarios.
+* At least three (3) implementations must have submitted conformance reports that pass
+  those conformance tests.
+* At least six months must have passed from when the GEP moved to `Experimental`.
+
+
 ## Alternatives
 
 (List other design alternatives and why we did not go in that
diff --git a/geps/gep-696/metadata.yaml b/geps/gep-696/metadata.yaml
index cc3c2ce2..035546b2 100644
--- a/geps/gep-696/metadata.yaml
+++ b/geps/gep-696/metadata.yaml
@@ -15,23 +15,23 @@ relationships:
   # obsoletes indicates that a GEP makes the linked GEP obsolete, and completely
   # replaces that GEP. The obsoleted GEP MUST have its obsoletedBy field
   # set back to this GEP, and MUST be moved to Declined.
-  obsoletes: {}
-  obsoletedBy: {}
+  obsoletes: []
+  obsoletedBy: []
   # extends indicates that a GEP extends the linked GEP, adding more detail
   # or additional implementation. The extended GEP MUST have its extendedBy
   # field set back to this GEP.
-  extends: {}
-  extendedBy: {}
+  extends: []
+  extendedBy: []
   # seeAlso indicates other GEPs that are relevant in some way without being
   # covered by an existing relationship.
-  seeAlso: {}
+  seeAlso: []
 # references is a list of hyperlinks to relevant external references.
 # It's intended to be used for storing GitHub discussions, Google docs, etc.
-references: {}
+references: []
 # featureNames is a list of the feature names introduced by the GEP, if there
 # are any. This will allow us to track which feature was introduced by which GEP.
 # This is the value added to supportedFeatures and the conformance tests, in string form.
-featureNames: {}
+featureNames: []
 # changelog is a list of hyperlinks to PRs that make changes to the GEP, in
 # ascending date order.
-changelog: {}
+changelog: []
diff --git a/geps/overview.md b/geps/overview.md
index d270e820..79037f03 100644
--- a/geps/overview.md
+++ b/geps/overview.md
@@ -21,11 +21,11 @@ This diagram shows the state diagram of the GEP process at a high level, but the
 flowchart TD
     D([Discuss with<br />the community]) --> C
     C([Issue Created]) -------> Memorandum
-    C([Issue Created]) --> Provisional
-    Provisional -->|If practical <br /> work needed| Prototyping
-    Provisional -->|GEP Doc PR<br />done| Implementable
-    Prototyping -->|GEP Doc PR<br />done| Implementable
-    Implementable -->|Gateway API<br />work completed| Experimental
+    C([Issue Created]) -->|GEP PR with Who/What/Why merged| Provisional
+    Provisional -->|GEP Doc PR with _proposed_ API details merged| Prototyping
+    Provisional -->|GEP Doc PR with agreed API details merged| Implementable
+    Prototyping -->|GEP Doc PR with agreed API details merged| Implementable
+    Implementable -->|API Changes implemented in Go types and YAML| Experimental
     Experimental -->|Supported in<br />multiple implementations<br />+ Conformance tests| Standard
     Standard -->|Entire change is GA or implemented| Completed
 
@@ -111,22 +111,38 @@ Please default to GitHub discussions: they work a lot like GitHub issues which
 makes them easy to search.
 
 ### 2. Create an Issue
+
 [Create a GEP issue](https://github.com/kubernetes-sigs/gateway-api/issues/new?assignees=&labels=kind%2Ffeature&template=enhancement.md) in the repo describing your change.
 At this point, you should copy the outcome of any other conversations or documents
 into this document.
 
-### 3. Agree on the Goals
+### 3. `Provisional` - Agree on the Goals
+
 Although it can be tempting to start writing out all the details of your
 proposal, it's important to first ensure we all agree on the goals.
 
 For API GEPs, the first version of your GEP should aim for a "Provisional"
 status and leave out any implementation details, focusing primarily on
-"Goals" and "Non-Goals".
+"Goals" and "Non-Goals", and documenting "Who" the GEP is for, "What" the
+GEP will do, and "Why" it is needed. For this reason, the `Provisional`
+state is also sometimes called the "Who/What/Why" stage.
 
 For Memorandum GEPs, the first version of your GEP will be the only one, as
 Memorandums have only a single stage - `Accepted`.
 
-### 3. Document Implementation Details
+The `Provisional` state is different to other states (aside from `Memorandum`),
+in that iteration on it can occur outside of the usual Gateway API release process.
+To put this another way, until we have agreement on the "Who/What/Why",
+then the PR does not fall into the regular release process.
+
+GEPs entering the `Provisional` phase need the following to have occurred:
+
+* A GEP PR using the template in GEP-696 merged into the `geps/` directory,
+  describing the "Who", "What", and "Why" of the proposal, along with Goals
+  and Non-Goals.
+
+### 3. `Implementable` - Document Implementation Details
+
 Now that everyone agrees on the goals, it is time to start writing out your
 proposed implementation details. These implementation details should be very
 thorough, including the proposed API spec, and covering any relevant edge cases.
@@ -138,7 +154,29 @@ alternatives. Be sure to document all of these in the GEP, and why we decided
 against them. At this stage, the GEP should be targeting the "Implementable"
 stage.
 
-### 4. Implement the GEP as "Experimental"
+For a GEP to enter the `Implementable` phase, there are some additional
+requirements:
+
+* One or more Gateway API maintainers must agree that the GEP is in-scope
+  for the project.
+* At least two (2) implementations must agree that they are interested in
+  implementing the feature within six (6) months of it reaching `Experimental`.
+  This is to ensure that there's community interest outside of the GEP owner.
+* At least one "shepherd" who will help with navigating the GEP through the
+  rest of the process. This shepherd can be any community member, but someone
+  with experience of the GEP process will be the most helpful. The shepherd
+  for that GEP will be responsible for initial review, as well as to be
+  available to answer questions for the GEP owner about the process. Being
+  a GEP Shepherd is a reasonably significant time commitment, with the
+  time required scaling up sharply as a GEP becomes more complex and/or
+  controversial. This shepherd should be recorded on the GEP issue.
+* A GEP PR that updates the existing `Provisional` documentation with details
+  that will be required to actually make the changes. This must include any
+  API changes, as well as an initial set of test scenarios for implementations
+  and conformance tests to target. Note that, at this stage, _only_ changes to 
+  GEP document must be included.
+
+### 4. `Experimental` - Make the API changes
 
 With the GEP marked as "Implementable", it is time to actually make those
 proposed changes in our API. In some cases, these changes will be documentation
@@ -150,10 +188,13 @@ use the `experimental` Golang build tag to denote experimental functionality.
 
 Some other requirements must be met before marking a GEP `Experimental`:
 
-- the graduation criteria to reach `Standard` MUST be filled out
-- the GEP must have at least one Feature Name for features described inside that
+* Any API changes must be made to the Go types.
+* The graduation criteria to reach `Standard` MUST be filled out. Note that this
+  must include sufficient conformance testing at a minimum, and should include
+  any other relevant criteria for that GEP.
+* The GEP must have at least one Feature Name for features described inside that
   will need to be tested by conformance tests.
-- a proposed probationary period (see next section) must be included in the GEP
+* A proposed probationary period (see next section) must be included in the GEP
   and approved by maintainers.
 
 Before changes are released they MUST be documented. GEPs that have not been
@@ -184,26 +225,28 @@ new strategy for achieving their graduation criteria can be established. Any
 such plan to take a GEP "off the shelf" must be reviewed and accepted by the
 maintainers.
 
-> **Warning**: It is extremely important** that projects which implement
+> **Warning**: It is **extremely important** that projects which implement
 > `Experimental` features clearly document that these features may be removed in
 > future releases.
 
-### 5. Graduate the GEP to "Standard"
+### 5. `Standard` - Graduate the GEP
 
 Once this feature has met the [graduation criteria](../concepts/versioning.md#graduation-criteria), it is
-time to graduate it to the "Standard" channel of the API. Depending on the feature, this may include
-any of the following:
+time to graduate it to the "Standard" channel of the API. Depending on the feature, this will usually
+include one or more of the following:
 
-1. Graduating the resource to beta
-2. Graduating fields to "standard" by removing `<gateway:experimental>` tags
-3. Graduating a concept to "standard" by updating documentation
+* Graduating the resource to `v1`, and ensuring it is included in the Standard channel API Group and
+  YAML install files.
+* Graduating fields to "standard" by removing `<gateway:experimental>` tags.
+* Graduating a concept to "standard" by updating documentation.
 
 ### 6. Close out the GEP issue
 
-The GEP issue should only be closed once the feature has:
-- Moved to the standard channel for distribution (if necessary)
-- Moved to a "v1" `apiVersion` for CRDs
-- been completely implemented and has wide acceptance (for process changes).
+The GEP issue should only be closed once the feature has been:
+
+* Moved to the standard channel for distribution (if necessary).
+* Moved to a "v1" `apiVersion` for CRDs.
+* Completely implemented and has wide acceptance (for process changes).
 
 In short, the GEP issue should only be closed when the work is "done" (whatever
 that means for that GEP).
diff --git a/go.mod b/go.mod
index bd1a6d91..717ee994 100644
--- a/go.mod
+++ b/go.mod
@@ -5,43 +5,46 @@ go 1.24.0
 require (
 	github.com/elastic/crd-ref-docs v0.2.0
 	github.com/miekg/dns v1.1.68
-	github.com/stretchr/testify v1.11.0
-	golang.org/x/net v0.43.0
-	golang.org/x/sync v0.16.0
-	google.golang.org/grpc v1.75.0
+	github.com/stretchr/testify v1.11.1
+	golang.org/x/net v0.44.0
+	golang.org/x/sync v0.17.0
+	golang.org/x/tools v0.36.0
+	google.golang.org/grpc v1.75.1
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
-	google.golang.org/protobuf v1.36.7
-	k8s.io/api v0.33.4
-	k8s.io/apiextensions-apiserver v0.33.4
-	k8s.io/apimachinery v0.33.4
-	k8s.io/client-go v0.33.4
-	k8s.io/code-generator v0.33.4
-	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
-	sigs.k8s.io/controller-runtime v0.21.0
-	sigs.k8s.io/controller-tools v0.18.0
-	sigs.k8s.io/structured-merge-diff/v4 v4.7.0
-	sigs.k8s.io/yaml v1.5.0
+	google.golang.org/protobuf v1.36.8
+	k8s.io/api v0.34.1
+	k8s.io/apiextensions-apiserver v0.34.1
+	k8s.io/apimachinery v0.34.1
+	k8s.io/client-go v0.34.1
+	k8s.io/code-generator v0.34.1
+	k8s.io/kube-openapi v0.0.0-20250814151709-d7b6acb124c3
+	k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d
+	sigs.k8s.io/controller-runtime v0.22.1
+	sigs.k8s.io/controller-tools v0.19.0
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0
+	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver v1.5.0 // indirect
 	github.com/Masterminds/sprig v2.22.0+incompatible // indirect
-	github.com/blang/semver/v4 v4.0.0 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.12.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/fatih/color v1.18.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-logr/zapr v1.3.0 // indirect
+	github.com/go-openapi/jsonpointer v0.21.2 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
 	github.com/gobuffalo/flect v1.0.3 // indirect
 	github.com/goccy/go-yaml v1.18.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
@@ -50,40 +53,43 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
-	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_golang v1.23.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.17.0 // indirect
 	github.com/spf13/cobra v1.9.1 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	golang.org/x/crypto v0.41.0 // indirect
-	golang.org/x/mod v0.26.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/crypto v0.42.0 // indirect
+	golang.org/x/mod v0.27.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sys v0.35.0 // indirect
-	golang.org/x/term v0.34.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
-	golang.org/x/time v0.9.0 // indirect
-	golang.org/x/tools v0.35.0 // indirect
+	golang.org/x/sys v0.36.0 // indirect
+	golang.org/x/term v0.35.0 // indirect
+	golang.org/x/text v0.29.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
 	golang.org/x/tools/go/expect v0.1.1-deprecated // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7 // indirect
+	k8s.io/gengo/v2 v2.0.0-20250820003526-c297c0c1eb9d // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 4120b93f..61a0cb1b 100644
--- a/go.sum
+++ b/go.sum
@@ -1,15 +1,21 @@
+cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
+cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
 github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/sprig v2.22.0+incompatible h1:z4yfnGrZ7netVz+0EDJ0Wi+5VZCSYp4Z0m2dk6cEM60=
 github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
+github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
+github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
@@ -19,28 +25,30 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/elastic/crd-ref-docs v0.2.0 h1:U17MyGX71j4qfKTvYxbR4qZGoA1hc2thy7kseGYmP+o=
 github.com/elastic/crd-ref-docs v0.2.0/go.mod h1:0bklkJhTG7nC6AVsdDi0wt5bGoqvzdZSzMMQkilZ6XM=
-github.com/emicklei/go-restful/v3 v3.12.0 h1:y2DdzBAURM29NFF94q6RaY4vjIH1rtwDapwQtU84iWk=
-github.com/emicklei/go-restful/v3 v3.12.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
+github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
 github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
-github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
-github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
-github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
-github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonpointer v0.21.2 h1:AqQaNADVwq/VnkCmQg6ogE+M3FOsKTytwges0JdwVuA=
+github.com/go-openapi/jsonpointer v0.21.2/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
 github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
-github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
-github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
+github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gobuffalo/flect v1.0.3 h1:xeWBM2nui+qnVvNM4S3foBhCAL2XgPU+a7FdpelbTq4=
@@ -51,9 +59,10 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
-github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/cel-go v0.26.0 h1:DPGjXackMpJWH680oGY4lZhYjIameYmR+/6RBdDGmaI=
+github.com/google/cel-go v0.26.0/go.mod h1:A9O8OU9rdvrK5MQyrqfIxo1a0u4g3sF8KB6PUIaryMM=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -63,6 +72,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
 github.com/huandu/xstrings v1.3.3 h1:/Gcsuc1x8JVbJ9/rlye4xZnVAbEkGauT8lbebqcQws4=
 github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/imdario/mergo v0.3.11 h1:3tnifQM4i+fbajXKBHXWEH+KvNHqojZ778UH75j3bGA=
@@ -79,8 +90,8 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
-github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
@@ -97,8 +108,9 @@ github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVO
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
@@ -109,28 +121,29 @@ github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
 github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
 github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
-github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=
-github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/onsi/gomega v1.38.1 h1:FaLA8GlcpXDwsb7m0h2A9ew2aTk3vnZMlzFgg5tz/pk=
+github.com/onsi/gomega v1.38.1/go.mod h1:LfcV8wZLvwcYRwPiJysphKAEsmcFnLMK/9c+PjvlX8g=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
-github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
-github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
-github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
-github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
-github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
+github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
+github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
+github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -140,16 +153,22 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.11.0 h1:ib4sjIrwZKxE5u/Japgo/7SJV3PvgjGiRNAvTVGqQl8=
-github.com/stretchr/testify v1.11.0/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
 go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
 go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 h1:OeNbIYk/2C15ckl7glBlOBp5+WlYsOElzTNmiPW/x60=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0/go.mod h1:7Bept48yIeqxP2OZ9/AqIpYS94h2or0aB4FypJTc8ZM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 h1:tgJ0uaNS4c98WRNUEx5U3aDlrDOI5Rs+1Vifcw4DJ8U=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0/go.mod h1:U7HYyW0zt/a9x5J1Kjs+r1f/d4ZHnYFclhYY2+YbeoE=
 go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
 go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
 go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
@@ -158,6 +177,8 @@ go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFh
 go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
 go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
 go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
+go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -166,51 +187,53 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
 go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
-go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE=
-go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
-golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
+golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
+golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
-golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
-golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
+golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I=
+golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
 golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
 golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
-golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
+golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
-golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
-golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
-golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
+golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
-golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
@@ -223,19 +246,21 @@ gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 h1:pFyd6EwwL2TqFf8emdthzeX+gZE1ElRq3iM8pui4KBY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
-google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
-google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 h1:FiusG7LWj+4byqhbvmB+Q93B/mOxJLN2DTozDuZm4EU=
+google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:kXqgZtrWaf6qS3jZOCnCH7WYfrvFjkC51bM8fz3RsCA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1 h1:pmJpJEvT846VzausCQ5d7KreSROcDqmO388w5YbnltA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1/go.mod h1:GmFNa4BdJZ2a8G+wCe9Bg3wwThLrJun751XstdJt5Og=
+google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
+google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
-google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
-google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
-gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
@@ -246,35 +271,39 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.33.4 h1:oTzrFVNPXBjMu0IlpA2eDDIU49jsuEorGHB4cvKupkk=
-k8s.io/api v0.33.4/go.mod h1:VHQZ4cuxQ9sCUMESJV5+Fe8bGnqAARZ08tSTdHWfeAc=
-k8s.io/apiextensions-apiserver v0.33.4 h1:rtq5SeXiDbXmSwxsF0MLe2Mtv3SwprA6wp+5qh/CrOU=
-k8s.io/apiextensions-apiserver v0.33.4/go.mod h1:mWXcZQkQV1GQyxeIjYApuqsn/081hhXPZwZ2URuJeSs=
-k8s.io/apimachinery v0.33.4 h1:SOf/JW33TP0eppJMkIgQ+L6atlDiP/090oaX0y9pd9s=
-k8s.io/apimachinery v0.33.4/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
-k8s.io/client-go v0.33.4 h1:TNH+CSu8EmXfitntjUPwaKVPN0AYMbc9F1bBS8/ABpw=
-k8s.io/client-go v0.33.4/go.mod h1:LsA0+hBG2DPwovjd931L/AoaezMPX9CmBgyVyBZmbCY=
-k8s.io/code-generator v0.33.4 h1:DiA801QxqApRIBh3OWULasVAUA237XnYvFNMh+E34Y8=
-k8s.io/code-generator v0.33.4/go.mod h1:ifWxKWhEl/Z1K7WmWAyOBEf3ex/i546ingCzLC8YVIY=
-k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7 h1:2OX19X59HxDprNCVrWi6jb7LW1PoqTlYqEq5H2oetog=
-k8s.io/gengo/v2 v2.0.0-20250207200755-1244d31929d7/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
+k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
+k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
+k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=
+k8s.io/apiextensions-apiserver v0.34.1/go.mod h1:hP9Rld3zF5Ay2Of3BeEpLAToP+l4s5UlxiHfqRaRcMc=
+k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
+k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/apiserver v0.34.1 h1:U3JBGdgANK3dfFcyknWde1G6X1F4bg7PXuvlqt8lITA=
+k8s.io/apiserver v0.34.1/go.mod h1:eOOc9nrVqlBI1AFCvVzsob0OxtPZUCPiUJL45JOTBG0=
+k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
+k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
+k8s.io/code-generator v0.34.1 h1:WpphT26E+j7tEgIUfFr5WfbJrktCGzB3JoJH9149xYc=
+k8s.io/code-generator v0.34.1/go.mod h1:DeWjekbDnJWRwpw3s0Jat87c+e0TgkxoR4ar608yqvg=
+k8s.io/component-base v0.34.1 h1:v7xFgG+ONhytZNFpIz5/kecwD+sUhVE6HU7qQUiRM4A=
+k8s.io/component-base v0.34.1/go.mod h1:mknCpLlTSKHzAQJJnnHVKqjxR7gBeHRv0rPXA7gdtQ0=
+k8s.io/gengo/v2 v2.0.0-20250820003526-c297c0c1eb9d h1:qUrYOinhdAUL0xxhA4gPqogPBaS9nIq2l2kTb6pmeB0=
+k8s.io/gengo/v2 v2.0.0-20250820003526-c297c0c1eb9d/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
-k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/controller-runtime v0.21.0 h1:CYfjpEuicjUecRk+KAeyYh+ouUBn4llGyDYytIGcJS8=
-sigs.k8s.io/controller-runtime v0.21.0/go.mod h1:OSg14+F65eWqIu4DceX7k/+QRAbTTvxeQSNSOQpukWM=
-sigs.k8s.io/controller-tools v0.18.0 h1:rGxGZCZTV2wJreeRgqVoWab/mfcumTMmSwKzoM9xrsE=
-sigs.k8s.io/controller-tools v0.18.0/go.mod h1:gLKoiGBriyNh+x1rWtUQnakUYEujErjXs9pf+x/8n1U=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
-sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+k8s.io/kube-openapi v0.0.0-20250814151709-d7b6acb124c3 h1:liMHz39T5dJO1aOKHLvwaCjDbf07wVh6yaUlTpunnkE=
+k8s.io/kube-openapi v0.0.0-20250814151709-d7b6acb124c3/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
+k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d h1:wAhiDyZ4Tdtt7e46e9M5ZSAJ/MnPGPs+Ki1gHw4w1R0=
+k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
+sigs.k8s.io/controller-runtime v0.22.1 h1:Ah1T7I+0A7ize291nJZdS1CabF/lB4E++WizgV24Eqg=
+sigs.k8s.io/controller-runtime v0.22.1/go.mod h1:FwiwRjkRPbiN+zp2QRp7wlTCzbUXxZ/D4OzuQUDwBHY=
+sigs.k8s.io/controller-tools v0.19.0 h1:OU7jrPPiZusryu6YK0jYSjPqg8Vhf8cAzluP9XGI5uk=
+sigs.k8s.io/controller-tools v0.19.0/go.mod h1:y5HY/iNDFkmFla2CfQoVb2AQXMsBk4ad84iR1PLANB0=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v4 v4.7.0 h1:qPeWmscJcXP0snki5IYF79Z8xrl8ETFxgMd7wez1XkI=
-sigs.k8s.io/structured-merge-diff/v4 v4.7.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
-sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ=
-sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/mkdocs-generate-conformance.py b/hack/mkdocs-generate-conformance.py
index bec9ecde..9abeaf68 100644
--- a/hack/mkdocs-generate-conformance.py
+++ b/hack/mkdocs-generate-conformance.py
@@ -22,6 +22,7 @@ from fnmatch import fnmatch
 import glob
 import os
 import re
+import semver
 
 log = logging.getLogger(f'mkdocs.plugins.{__name__}')
 
@@ -149,7 +150,7 @@ def generate_conformance_tables(reports, currVersion, mkdocsConfig):
 
     return new_file
 
-def generate_profiles_report(reports, route,version):
+def generate_profiles_report(reports, route, version):
 
     http_reports = reports.loc[reports["name"] == route]
     http_reports.set_index('organization')
@@ -159,21 +160,32 @@ def generate_profiles_report(reports, route,version):
         columns=http_reports['organization'])
 
     http_table = http_reports[['organization', 'project',
-                               'version','mode', 'extended.supportedFeatures']].T
+                               'version', 'mode', 'core.result', 'extended.supportedFeatures']].T
     http_table.columns = http_table.iloc[0]
     http_table = http_table[1:].T
+    # change core.result value
 
     for row in http_table.itertuples():
-        if type(row._4) is list:
-            for feat in row._4:
+        if row._4 == "success":
+            http_table.loc[(row.Index, 'core.result')] = ':white_check_mark:'
+        else:
+            http_table.loc[(row.Index, 'core.result')] = ':x:'
+
+        if type(row._5) is list:
+            for feat in row._5:
                 # Process feature name before using it as a column
                 processed_feat = process_feature_name(feat)
-                http_table.loc[row.Index, processed_feat] = ':white_check_mark:'
+                http_table.loc[(http_table.index == row.Index) & \
+                               (http_table['project'] == row.project) & \
+                               (http_table['version'] == row.version) & \
+                               (http_table['mode'] == row.mode), processed_feat] = ':white_check_mark:'
     http_table = http_table.fillna(':x:')
     http_table = http_table.drop(['extended.supportedFeatures'], axis=1)
 
     http_table = http_table.rename(
-        columns={"project": "Project", "version": "Version", "mode":"Mode"})
+        columns={"project": "Project", "version": "Version", "mode": "Mode", "core.result": "Core"})
+    if semver.compare(version.removeprefix('v'), '1.4.0') < 0:
+        http_table = http_table.drop(columns=["Core"])
     if version == 'v1.0.0':
         http_table = http_table.drop(columns=["Mode"])
     return http_table
diff --git a/hack/mkdocs/image/entrypoint.sh b/hack/mkdocs/image/entrypoint.sh
index 6b3fd338..067102dc 100755
--- a/hack/mkdocs/image/entrypoint.sh
+++ b/hack/mkdocs/image/entrypoint.sh
@@ -18,10 +18,10 @@ set -o errexit
 
 CMD=$1
 
-if [ "$CMD" == "build" ];
+if [ "$CMD" = "build" ];
 then
   mkdocs build
   exit 0;
 fi
 
-mkdocs serve --dev-addr=0.0.0.0:3000 --livereload
\ No newline at end of file
+mkdocs serve --dev-addr=0.0.0.0:3000 --livereload
diff --git a/hack/mkdocs/image/requirements.txt b/hack/mkdocs/image/requirements.txt
index 940b186b..92dade9d 100644
--- a/hack/mkdocs/image/requirements.txt
+++ b/hack/mkdocs/image/requirements.txt
@@ -5,14 +5,14 @@ jsmin==3.0.1
 livereload==2.7.1
 # mkdocs 2.4.1 requires Markdown < 3.4.0
 # https://github.com/kubernetes-sigs/gateway-api/pull/1671#issuecomment-1400586465
-markdown~=3.8
+markdown~=3.9
 MarkupSafe==3.0.2
 mkdocs==1.6.1
 mkdocs-awesome-pages-plugin==2.10.1
 mkdocs-macros-plugin==1.3.7
-mkdocs-material==9.6.18
+mkdocs-material==9.6.20
 mkdocs-redirects==1.2.2
-mkdocs-mermaid2-plugin==1.2.1
+mkdocs-mermaid2-plugin==1.2.2
 pandas>=2.0.3
 pep562==1.1
 Pygments==2.19.2
@@ -20,4 +20,5 @@ pymdown-extensions==10.16.1
 PyYAML==6.0.2
 six==1.17.0
 tabulate==0.9.0
-tornado==6.5.2
\ No newline at end of file
+tornado==6.5.2
+semver==3.0.4
diff --git a/hack/update-mkdocs-nav.sh b/hack/update-mkdocs-nav.sh
new file mode 100755
index 00000000..16c6c611
--- /dev/null
+++ b/hack/update-mkdocs-nav.sh
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+# Copyright 2025 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")/..
+
+GEPS_TOC_SKIP="${GEPS_TOC_SKIP:-696}"
+NAV_CONF="${NAV_CONF:-${SCRIPT_ROOT}/nav.yml}"
+NAV_TEMPLATE="${NAV_TEMPLATE:-${NAV_CONF}.tmpl}"
+GEPS_TOC_DIR=${GEPS_TOC_DIR:-${SCRIPT_ROOT}/geps}
+
+go run cmd/gepstoc/main.go -g "${GEPS_TOC_DIR}/" -t "${NAV_TEMPLATE}" -s "${GEPS_TOC_SKIP}" > "${NAV_CONF}"
diff --git a/hack/update-protos.sh b/hack/update-protos.sh
index 02828dbe..51d83484 100755
--- a/hack/update-protos.sh
+++ b/hack/update-protos.sh
@@ -87,7 +87,7 @@ go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.28
 go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.2
 
 (cd conformance/echo-basic && \
-  export PATH="$PATH:$GOPATH/bin" && \
+  export PATH="$PATH:$(go env GOPATH)/bin" && \
   "${PROTOC_BINARY}" --go_out=grpcechoserver --go_opt=paths=source_relative \
     --go-grpc_out=grpcechoserver --go-grpc_opt=paths=source_relative \
     grpcecho.proto
diff --git a/hack/verify-all.sh b/hack/verify-all.sh
index 54030229..eb7e7f68 100755
--- a/hack/verify-all.sh
+++ b/hack/verify-all.sh
@@ -52,7 +52,7 @@ if $SILENT ; then
   echo "Running in the silent mode, run with -v if you want to see script logs."
 fi
 
-EXCLUDE="verify-all.sh"
+EXCLUDE="verify-all.sh verify-mkdocs-nav.sh"
 
 SCRIPTS=$(find "${SCRIPT_ROOT}"/hack -name "verify-*.sh")
 
diff --git a/hack/verify-mkdocs-nav.sh b/hack/verify-mkdocs-nav.sh
new file mode 100755
index 00000000..c0261b1c
--- /dev/null
+++ b/hack/verify-mkdocs-nav.sh
@@ -0,0 +1,51 @@
+#!/bin/bash
+
+# Copyright 2025 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")/..
+
+TMP_DIFFROOT="${SCRIPT_ROOT}/_tmp"
+TMP_FILE="${TMP_DIFFROOT}/nav.yml"
+
+GEPS_TOC_SKIP="${GEPS_TOC_SKIP:-696}"
+NAV_CONF="${NAV_CONF:-${SCRIPT_ROOT}/nav.yml}"
+NAV_TEMPLATE="${NAV_TEMPLATE:-${NAV_CONF}.tmpl}"
+GEPS_TOC_DIR=${GEPS_TOC_DIR:-${SCRIPT_ROOT}/geps}
+
+cleanup() {
+  rm -rf "${TMP_DIFFROOT}"
+}
+trap "cleanup" EXIT SIGINT
+
+cleanup
+
+mkdir -p "${TMP_DIFFROOT}"
+
+go run cmd/gepstoc/main.go -g "${GEPS_TOC_DIR}/" -t "${NAV_TEMPLATE}" -s "${GEPS_TOC_SKIP}" > "${TMP_FILE}"
+
+echo "diffing ${NAV_CONF} against freshly generated configuration"
+ret=0
+diff -Naupr --no-dereference "${NAV_CONF}" "${TMP_FILE}" || ret=1
+
+if [[ $ret -eq 0 ]]; then
+  echo "${NAV_CONF} up to date."
+else
+  echo "${NAV_CONF} is out of date. Please run hack/update-mkdocs-nav.sh"
+  exit 1
+fi
diff --git a/mkdocs.yml b/mkdocs.yml
index 1052a445..bb14f5ba 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -1,3 +1,4 @@
+INHERIT: ./nav.yml
 site_name: Kubernetes Gateway API
 repo_url: https://github.com/kubernetes-sigs/gateway-api
 repo_name: kubernetes-sigs/gateway-api
@@ -76,127 +77,3 @@ markdown_extensions:
   - toc:
       permalink: true
   - tables
-nav:
-  - Overview:
-    - Introduction: index.md
-    - Concepts:
-      - API Overview: concepts/api-overview.md
-      - Conformance: concepts/conformance.md
-      - Roles and Personas: concepts/roles-and-personas.md
-      - Security Model: concepts/security-model.md
-      - Tools: concepts/tooling.md
-      - Use Cases: concepts/use-cases.md
-      - Versioning: concepts/versioning.md
-    - Service Mesh:
-      - Overview: mesh/index.md
-      - GAMMA Initiative: mesh/gamma.md
-      - Service Facets: mesh/service-facets.md
-    - Implementations:
-        - List: implementations.md
-        - Comparisons:
-          - v1.3: implementations/v1.3.md
-          - v1.2: implementations/v1.2.md
-          - v1.1: implementations/v1.1.md
-          - v1.0: implementations/v1.0.md
-    - FAQ: faq.md
-    - Glossary: concepts/glossary.md
-  - Guides:
-    - User Guides:
-      - Getting started: guides/index.md
-      - Simple Gateway: guides/simple-gateway.md
-      - HTTP routing: guides/http-routing.md
-      - HTTP redirects and rewrites: guides/http-redirect-rewrite.md
-      - HTTP header modifier: guides/http-header-modifier.md
-      - HTTP traffic splitting: guides/traffic-splitting.md
-      - HTTP request mirroring: guides/http-request-mirroring.md
-      - Cross-Namespace routing: guides/multiple-ns.md
-      - TLS: guides/tls.md
-      - TCP routing: guides/tcp.md
-      - gRPC Routing: guides/grpc-routing.md
-      - Migrating from Ingress: guides/migrating-from-ingress.md
-      - Backend Protocol Selection: guides/backend-protocol.md
-      - Infrastructure attributes: guides/infrastructure.md
-    - API Design: guides/api-design.md
-    - CRD Management: guides/crd-management.md
-    - Implementer's Guide: guides/implementers.md
-  - Reference:
-    - API Types:
-      - Gateway: api-types/gateway.md
-      - GatewayClass: api-types/gatewayclass.md
-      - GRPCRoute: api-types/grpcroute.md
-      - HTTPRoute: api-types/httproute.md
-      - Policy:
-        - BackendTLSPolicy: api-types/backendtlspolicy.md
-        - BackendTrafficPolicy: api-types/backendtrafficpolicy.md
-      - ReferenceGrant: api-types/referencegrant.md
-    - API specification:
-      - Standard: reference/spec.md
-      - Experimental: reference/specx.md
-    - Policy Attachment: reference/policy-attachment.md
-  - Enhancements:
-    - Overview: geps/overview.md
-    - Provisional:
-      - geps/gep-1494/index.md
-      - geps/gep-1651/index.md
-      - geps/gep-2648/index.md
-      - geps/gep-3779/index.md
-      - geps/gep-3792/index.md
-    - Implementable:
-      - geps/gep-91/index.md
-      - geps/gep-3567/index.md
-      - geps/gep-3949/index.md
-    - Experimental:
-      - geps/gep-1619/index.md
-      - geps/gep-1713/index.md
-      - geps/gep-1731/index.md
-      - geps/gep-1748/index.md
-      - geps/gep-1767/index.md
-      - geps/gep-1897/index.md
-      - geps/gep-2162/index.md
-      - geps/gep-2649/index.md
-      - geps/gep-3155/index.md
-      - geps/gep-3388/index.md
-      - geps/gep-3567/index.md
-    - Standard:
-      - geps/gep-709/index.md
-      - geps/gep-718/index.md
-      - geps/gep-724/index.md
-      - geps/gep-726/index.md
-      - geps/gep-746/index.md
-      - geps/gep-820/index.md
-      - geps/gep-851/index.md
-      - geps/gep-957/index.md
-      - geps/gep-995/index.md
-      - geps/gep-1016/index.md
-      - geps/gep-1294/index.md
-      - geps/gep-1323/index.md
-      - geps/gep-1364/index.md
-      - geps/gep-1686/index.md
-      - geps/gep-1709/index.md
-      - geps/gep-1742/index.md
-      - geps/gep-1762/index.md
-      - geps/gep-1867/index.md
-      - geps/gep-1911/index.md
-      - geps/gep-2257/index.md
-      - geps/gep-3171/index.md
-    - Memorandum:
-      - geps/gep-713/index.md
-      - geps/gep-917/index.md
-      - geps/gep-922/index.md
-      - geps/gep-1324/index.md
-      - geps/gep-2659/index.md
-      - geps/gep-2722/index.md
-      - geps/gep-2907/index.md
-    - Declined:
-      - geps/gep-735/index.md
-      - geps/gep-1282/index.md
-  - Contributing:
-    - How to Get Involved: contributing/index.md
-    - Developer Guide: contributing/devguide.md
-    - Documentation Style Guide: contributing/style-guide.md
-    - Enhancement Requests: contributing/enhancement-requests.md
-    - Release Cycle: contributing/release-cycle.md
-    - Contributor Ladder: contributing/contributor-ladder.md
-not_in_nav: |
-  /blog/*
-  /geps/gep-696/*
diff --git a/nav.yml b/nav.yml
new file mode 100644
index 00000000..570856a3
--- /dev/null
+++ b/nav.yml
@@ -0,0 +1,116 @@
+# WARNING: nav.yml file is generated from nav.yml.tmpl file
+# If you are changing nav.yml directly you SHOULDN'T, please 
+# modify nav.yml.tmpl and run the script "hack/update-mkdocs-nav.sh"
+nav:
+  - Overview:
+    - Introduction: index.md
+    - Concepts:
+      - API Overview: concepts/api-overview.md
+      - Conformance: concepts/conformance.md
+      - Roles and Personas: concepts/roles-and-personas.md
+      - Security Model: concepts/security-model.md
+      - Tools: concepts/tooling.md
+      - Use Cases: concepts/use-cases.md
+      - Versioning: concepts/versioning.md
+    - Service Mesh:
+      - Overview: mesh/index.md
+      - GAMMA Initiative: mesh/gamma.md
+      - Service Facets: mesh/service-facets.md
+    - Implementations:
+        - List: implementations.md
+        - Comparisons:
+          - v1.4: implementations/v1.4.md
+          - v1.3: implementations/v1.3.md
+          - v1.2: implementations/v1.2.md
+          - v1.1: implementations/v1.1.md
+          - v1.0: implementations/v1.0.md
+    - FAQ: faq.md
+    - Glossary: concepts/glossary.md
+  - Guides:
+    - User Guides:
+      - Getting started: guides/index.md
+      - Simple Gateway: guides/simple-gateway.md
+      - HTTP routing: guides/http-routing.md
+      - HTTP redirects and rewrites: guides/http-redirect-rewrite.md
+      - HTTP header modifier: guides/http-header-modifier.md
+      - HTTP traffic splitting: guides/traffic-splitting.md
+      - HTTP request mirroring: guides/http-request-mirroring.md
+      - Cross-Namespace routing: guides/multiple-ns.md
+      - TLS: guides/tls.md
+      - TCP routing: guides/tcp.md
+      - gRPC Routing: guides/grpc-routing.md
+      - Migrating from Ingress: guides/migrating-from-ingress.md
+      - Backend Protocol Selection: guides/backend-protocol.md
+      - Infrastructure attributes: guides/infrastructure.md
+    - API Design: guides/api-design.md
+    - CRD Management: guides/crd-management.md
+    - Implementer's Guide: guides/implementers.md
+  - Reference:
+    - API Types:
+      - Gateway: api-types/gateway.md
+      - GatewayClass: api-types/gatewayclass.md
+      - GRPCRoute: api-types/grpcroute.md
+      - HTTPRoute: api-types/httproute.md
+      - Policy:
+        - BackendTLSPolicy: api-types/backendtlspolicy.md
+        - BackendTrafficPolicy: api-types/backendtrafficpolicy.md
+      - ReferenceGrant: api-types/referencegrant.md
+    - API specification:
+      - Standard: reference/spec.md
+      - Experimental: reference/specx.md
+    - Policy Attachment: reference/policy-attachment.md
+  - Enhancements:
+    - Overview: geps/overview.md
+    - Implementable:
+      - geps/gep-1494/index.md
+      - geps/gep-3388/index.md
+      - geps/gep-3567/index.md
+      - geps/gep-3793/index.md
+      - geps/gep-3949/index.md
+    - Experimental:
+      - geps/gep-1016/index.md
+      - geps/gep-1713/index.md
+      - geps/gep-1731/index.md
+      - geps/gep-1748/index.md
+      - geps/gep-1767/index.md
+      - geps/gep-2162/index.md
+      - geps/gep-3155/index.md
+    - Standard:
+      - geps/gep-709/index.md
+      - geps/gep-718/index.md
+      - geps/gep-724/index.md
+      - geps/gep-726/index.md
+      - geps/gep-746/index.md
+      - geps/gep-820/index.md
+      - geps/gep-851/index.md
+      - geps/gep-957/index.md
+      - geps/gep-995/index.md
+      - geps/gep-1294/index.md
+      - geps/gep-1323/index.md
+      - geps/gep-1364/index.md
+      - geps/gep-1686/index.md
+      - geps/gep-1709/index.md
+      - geps/gep-1742/index.md
+      - geps/gep-1762/index.md
+      - geps/gep-1867/index.md
+      - geps/gep-1897/index.md
+      - geps/gep-1911/index.md
+      - geps/gep-2257/index.md
+      - geps/gep-3171/index.md
+    - Memorandum:
+      - geps/gep-713/index.md
+      - geps/gep-917/index.md
+      - geps/gep-922/index.md
+      - geps/gep-1324/index.md
+      - geps/gep-2722/index.md
+      - geps/gep-2907/index.md
+  - Contributing:
+    - How to Get Involved: contributing/index.md
+    - Developer Guide: contributing/devguide.md
+    - Documentation Style Guide: contributing/style-guide.md
+    - Enhancement Requests: contributing/enhancement-requests.md
+    - Release Cycle: contributing/release-cycle.md
+    - Contributor Ladder: contributing/contributor-ladder.md
+not_in_nav: |
+  /blog/*
+  /geps/gep-696/*
diff --git a/nav.yml.tmpl b/nav.yml.tmpl
new file mode 100644
index 00000000..c7c0d842
--- /dev/null
+++ b/nav.yml.tmpl
@@ -0,0 +1,81 @@
+# WARNING: nav.yml file is generated from nav.yml.tmpl file
+# If you are changing nav.yml directly you SHOULDN'T, please 
+# modify nav.yml.tmpl and run the script "hack/update-mkdocs-nav.sh"
+nav:
+  - Overview:
+    - Introduction: index.md
+    - Concepts:
+      - API Overview: concepts/api-overview.md
+      - Conformance: concepts/conformance.md
+      - Roles and Personas: concepts/roles-and-personas.md
+      - Security Model: concepts/security-model.md
+      - Tools: concepts/tooling.md
+      - Use Cases: concepts/use-cases.md
+      - Versioning: concepts/versioning.md
+    - Service Mesh:
+      - Overview: mesh/index.md
+      - GAMMA Initiative: mesh/gamma.md
+      - Service Facets: mesh/service-facets.md
+    - Implementations:
+        - List: implementations.md
+        - Comparisons:
+          - v1.4: implementations/v1.4.md
+          - v1.3: implementations/v1.3.md
+          - v1.2: implementations/v1.2.md
+          - v1.1: implementations/v1.1.md
+          - v1.0: implementations/v1.0.md
+    - FAQ: faq.md
+    - Glossary: concepts/glossary.md
+  - Guides:
+    - User Guides:
+      - Getting started: guides/index.md
+      - Simple Gateway: guides/simple-gateway.md
+      - HTTP routing: guides/http-routing.md
+      - HTTP redirects and rewrites: guides/http-redirect-rewrite.md
+      - HTTP header modifier: guides/http-header-modifier.md
+      - HTTP traffic splitting: guides/traffic-splitting.md
+      - HTTP request mirroring: guides/http-request-mirroring.md
+      - Cross-Namespace routing: guides/multiple-ns.md
+      - TLS: guides/tls.md
+      - TCP routing: guides/tcp.md
+      - gRPC Routing: guides/grpc-routing.md
+      - Migrating from Ingress: guides/migrating-from-ingress.md
+      - Backend Protocol Selection: guides/backend-protocol.md
+      - Infrastructure attributes: guides/infrastructure.md
+    - API Design: guides/api-design.md
+    - CRD Management: guides/crd-management.md
+    - Implementer's Guide: guides/implementers.md
+  - Reference:
+    - API Types:
+      - Gateway: api-types/gateway.md
+      - GatewayClass: api-types/gatewayclass.md
+      - GRPCRoute: api-types/grpcroute.md
+      - HTTPRoute: api-types/httproute.md
+      - Policy:
+        - BackendTLSPolicy: api-types/backendtlspolicy.md
+        - BackendTrafficPolicy: api-types/backendtrafficpolicy.md
+      - ReferenceGrant: api-types/referencegrant.md
+    - API specification:
+      - Standard: reference/spec.md
+      - Experimental: reference/specx.md
+    - Policy Attachment: reference/policy-attachment.md
+  - Enhancements:
+    - Overview: geps/overview.md
+    {{- with .GEPData }}
+    {{- range . }}
+    - {{ .GepType }}:
+    {{- range .Geps }}
+      - geps/gep-{{ . }}/index.md
+    {{- end }}
+    {{- end }}
+    {{- end }}
+  - Contributing:
+    - How to Get Involved: contributing/index.md
+    - Developer Guide: contributing/devguide.md
+    - Documentation Style Guide: contributing/style-guide.md
+    - Enhancement Requests: contributing/enhancement-requests.md
+    - Release Cycle: contributing/release-cycle.md
+    - Contributor Ladder: contributing/contributor-ladder.md
+not_in_nav: |
+  /blog/*
+  /geps/gep-696/*
diff --git a/pkg/client/clientset/versioned/fake/clientset_generated.go b/pkg/client/clientset/versioned/fake/clientset_generated.go
index b1600ecb..78e540a8 100644
--- a/pkg/client/clientset/versioned/fake/clientset_generated.go
+++ b/pkg/client/clientset/versioned/fake/clientset_generated.go
@@ -113,8 +113,8 @@ func NewClientset(objects ...runtime.Object) *Clientset {
 	cs.AddReactor("*", "*", testing.ObjectReaction(o))
 	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
 		var opts metav1.ListOptions
-		if watchActcion, ok := action.(testing.WatchActionImpl); ok {
-			opts = watchActcion.ListOptions
+		if watchAction, ok := action.(testing.WatchActionImpl); ok {
+			opts = watchAction.ListOptions
 		}
 		gvr := action.GetResource()
 		ns := action.GetNamespace()
diff --git a/pkg/client/clientset/versioned/typed/apis/v1/apis_client.go b/pkg/client/clientset/versioned/typed/apis/v1/apis_client.go
index 7ed0bc4d..c3a8ce11 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1/apis_client.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1/apis_client.go
@@ -28,6 +28,7 @@ import (
 
 type GatewayV1Interface interface {
 	RESTClient() rest.Interface
+	BackendTLSPoliciesGetter
 	GRPCRoutesGetter
 	GatewaysGetter
 	GatewayClassesGetter
@@ -39,6 +40,10 @@ type GatewayV1Client struct {
 	restClient rest.Interface
 }
 
+func (c *GatewayV1Client) BackendTLSPolicies(namespace string) BackendTLSPolicyInterface {
+	return newBackendTLSPolicies(c, namespace)
+}
+
 func (c *GatewayV1Client) GRPCRoutes(namespace string) GRPCRouteInterface {
 	return newGRPCRoutes(c, namespace)
 }
diff --git a/pkg/client/clientset/versioned/typed/apis/v1/backendtlspolicy.go b/pkg/client/clientset/versioned/typed/apis/v1/backendtlspolicy.go
new file mode 100644
index 00000000..8e5b2738
--- /dev/null
+++ b/pkg/client/clientset/versioned/typed/apis/v1/backendtlspolicy.go
@@ -0,0 +1,74 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
+	applyconfigurationapisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
+	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
+)
+
+// BackendTLSPoliciesGetter has a method to return a BackendTLSPolicyInterface.
+// A group's client should implement this interface.
+type BackendTLSPoliciesGetter interface {
+	BackendTLSPolicies(namespace string) BackendTLSPolicyInterface
+}
+
+// BackendTLSPolicyInterface has methods to work with BackendTLSPolicy resources.
+type BackendTLSPolicyInterface interface {
+	Create(ctx context.Context, backendTLSPolicy *apisv1.BackendTLSPolicy, opts metav1.CreateOptions) (*apisv1.BackendTLSPolicy, error)
+	Update(ctx context.Context, backendTLSPolicy *apisv1.BackendTLSPolicy, opts metav1.UpdateOptions) (*apisv1.BackendTLSPolicy, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, backendTLSPolicy *apisv1.BackendTLSPolicy, opts metav1.UpdateOptions) (*apisv1.BackendTLSPolicy, error)
+	Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error
+	Get(ctx context.Context, name string, opts metav1.GetOptions) (*apisv1.BackendTLSPolicy, error)
+	List(ctx context.Context, opts metav1.ListOptions) (*apisv1.BackendTLSPolicyList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *apisv1.BackendTLSPolicy, err error)
+	Apply(ctx context.Context, backendTLSPolicy *applyconfigurationapisv1.BackendTLSPolicyApplyConfiguration, opts metav1.ApplyOptions) (result *apisv1.BackendTLSPolicy, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, backendTLSPolicy *applyconfigurationapisv1.BackendTLSPolicyApplyConfiguration, opts metav1.ApplyOptions) (result *apisv1.BackendTLSPolicy, err error)
+	BackendTLSPolicyExpansion
+}
+
+// backendTLSPolicies implements BackendTLSPolicyInterface
+type backendTLSPolicies struct {
+	*gentype.ClientWithListAndApply[*apisv1.BackendTLSPolicy, *apisv1.BackendTLSPolicyList, *applyconfigurationapisv1.BackendTLSPolicyApplyConfiguration]
+}
+
+// newBackendTLSPolicies returns a BackendTLSPolicies
+func newBackendTLSPolicies(c *GatewayV1Client, namespace string) *backendTLSPolicies {
+	return &backendTLSPolicies{
+		gentype.NewClientWithListAndApply[*apisv1.BackendTLSPolicy, *apisv1.BackendTLSPolicyList, *applyconfigurationapisv1.BackendTLSPolicyApplyConfiguration](
+			"backendtlspolicies",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *apisv1.BackendTLSPolicy { return &apisv1.BackendTLSPolicy{} },
+			func() *apisv1.BackendTLSPolicyList { return &apisv1.BackendTLSPolicyList{} },
+		),
+	}
+}
diff --git a/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_apis_client.go b/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_apis_client.go
index 0b68bad3..b4acb441 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_apis_client.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_apis_client.go
@@ -28,6 +28,10 @@ type FakeGatewayV1 struct {
 	*testing.Fake
 }
 
+func (c *FakeGatewayV1) BackendTLSPolicies(namespace string) v1.BackendTLSPolicyInterface {
+	return newFakeBackendTLSPolicies(c, namespace)
+}
+
 func (c *FakeGatewayV1) GRPCRoutes(namespace string) v1.GRPCRouteInterface {
 	return newFakeGRPCRoutes(c, namespace)
 }
diff --git a/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_backendtlspolicy.go b/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_backendtlspolicy.go
new file mode 100644
index 00000000..986ba484
--- /dev/null
+++ b/pkg/client/clientset/versioned/typed/apis/v1/fake/fake_backendtlspolicy.go
@@ -0,0 +1,51 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	gentype "k8s.io/client-go/gentype"
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	apisv1 "sigs.k8s.io/gateway-api/applyconfiguration/apis/v1"
+	typedapisv1 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apis/v1"
+)
+
+// fakeBackendTLSPolicies implements BackendTLSPolicyInterface
+type fakeBackendTLSPolicies struct {
+	*gentype.FakeClientWithListAndApply[*v1.BackendTLSPolicy, *v1.BackendTLSPolicyList, *apisv1.BackendTLSPolicyApplyConfiguration]
+	Fake *FakeGatewayV1
+}
+
+func newFakeBackendTLSPolicies(fake *FakeGatewayV1, namespace string) typedapisv1.BackendTLSPolicyInterface {
+	return &fakeBackendTLSPolicies{
+		gentype.NewFakeClientWithListAndApply[*v1.BackendTLSPolicy, *v1.BackendTLSPolicyList, *apisv1.BackendTLSPolicyApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1.SchemeGroupVersion.WithResource("backendtlspolicies"),
+			v1.SchemeGroupVersion.WithKind("BackendTLSPolicy"),
+			func() *v1.BackendTLSPolicy { return &v1.BackendTLSPolicy{} },
+			func() *v1.BackendTLSPolicyList { return &v1.BackendTLSPolicyList{} },
+			func(dst, src *v1.BackendTLSPolicyList) { dst.ListMeta = src.ListMeta },
+			func(list *v1.BackendTLSPolicyList) []*v1.BackendTLSPolicy { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1.BackendTLSPolicyList, items []*v1.BackendTLSPolicy) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
diff --git a/pkg/client/clientset/versioned/typed/apis/v1/generated_expansion.go b/pkg/client/clientset/versioned/typed/apis/v1/generated_expansion.go
index 69d7f1f9..0ed9e12b 100644
--- a/pkg/client/clientset/versioned/typed/apis/v1/generated_expansion.go
+++ b/pkg/client/clientset/versioned/typed/apis/v1/generated_expansion.go
@@ -18,6 +18,8 @@ limitations under the License.
 
 package v1
 
+type BackendTLSPolicyExpansion interface{}
+
 type GRPCRouteExpansion interface{}
 
 type GatewayExpansion interface{}
diff --git a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/apisx_client.go b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/apisx_client.go
index 234356e4..c17563fe 100644
--- a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/apisx_client.go
+++ b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/apisx_client.go
@@ -30,6 +30,7 @@ type ExperimentalV1alpha1Interface interface {
 	RESTClient() rest.Interface
 	XBackendTrafficPoliciesGetter
 	XListenerSetsGetter
+	XMeshesGetter
 }
 
 // ExperimentalV1alpha1Client is used to interact with features provided by the gateway.networking.x-k8s.io group.
@@ -45,6 +46,10 @@ func (c *ExperimentalV1alpha1Client) XListenerSets(namespace string) XListenerSe
 	return newXListenerSets(c, namespace)
 }
 
+func (c *ExperimentalV1alpha1Client) XMeshes() XMeshInterface {
+	return newXMeshes(c)
+}
+
 // NewForConfig creates a new ExperimentalV1alpha1Client for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
diff --git a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_apisx_client.go b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_apisx_client.go
index 962c5f3e..0aa7a3c8 100644
--- a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_apisx_client.go
+++ b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_apisx_client.go
@@ -36,6 +36,10 @@ func (c *FakeExperimentalV1alpha1) XListenerSets(namespace string) v1alpha1.XLis
 	return newFakeXListenerSets(c, namespace)
 }
 
+func (c *FakeExperimentalV1alpha1) XMeshes() v1alpha1.XMeshInterface {
+	return newFakeXMeshes(c)
+}
+
 // RESTClient returns a RESTClient that is used to communicate
 // with API server by this client implementation.
 func (c *FakeExperimentalV1alpha1) RESTClient() rest.Interface {
diff --git a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_xmesh.go b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_xmesh.go
new file mode 100644
index 00000000..408eb3b0
--- /dev/null
+++ b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/fake/fake_xmesh.go
@@ -0,0 +1,49 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	gentype "k8s.io/client-go/gentype"
+	v1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/applyconfiguration/apisx/v1alpha1"
+	typedapisxv1alpha1 "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/typed/apisx/v1alpha1"
+)
+
+// fakeXMeshes implements XMeshInterface
+type fakeXMeshes struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.XMesh, *v1alpha1.XMeshList, *apisxv1alpha1.XMeshApplyConfiguration]
+	Fake *FakeExperimentalV1alpha1
+}
+
+func newFakeXMeshes(fake *FakeExperimentalV1alpha1) typedapisxv1alpha1.XMeshInterface {
+	return &fakeXMeshes{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.XMesh, *v1alpha1.XMeshList, *apisxv1alpha1.XMeshApplyConfiguration](
+			fake.Fake,
+			"",
+			v1alpha1.SchemeGroupVersion.WithResource("xmeshes"),
+			v1alpha1.SchemeGroupVersion.WithKind("XMesh"),
+			func() *v1alpha1.XMesh { return &v1alpha1.XMesh{} },
+			func() *v1alpha1.XMeshList { return &v1alpha1.XMeshList{} },
+			func(dst, src *v1alpha1.XMeshList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.XMeshList) []*v1alpha1.XMesh { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1alpha1.XMeshList, items []*v1alpha1.XMesh) { list.Items = gentype.FromPointerSlice(items) },
+		),
+		fake,
+	}
+}
diff --git a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/generated_expansion.go b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/generated_expansion.go
index bf328780..9abb54c1 100644
--- a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/generated_expansion.go
+++ b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/generated_expansion.go
@@ -21,3 +21,5 @@ package v1alpha1
 type XBackendTrafficPolicyExpansion interface{}
 
 type XListenerSetExpansion interface{}
+
+type XMeshExpansion interface{}
diff --git a/pkg/client/clientset/versioned/typed/apisx/v1alpha1/xmesh.go b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/xmesh.go
new file mode 100644
index 00000000..ffb85545
--- /dev/null
+++ b/pkg/client/clientset/versioned/typed/apisx/v1alpha1/xmesh.go
@@ -0,0 +1,74 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+	applyconfigurationapisxv1alpha1 "sigs.k8s.io/gateway-api/applyconfiguration/apisx/v1alpha1"
+	scheme "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned/scheme"
+)
+
+// XMeshesGetter has a method to return a XMeshInterface.
+// A group's client should implement this interface.
+type XMeshesGetter interface {
+	XMeshes() XMeshInterface
+}
+
+// XMeshInterface has methods to work with XMesh resources.
+type XMeshInterface interface {
+	Create(ctx context.Context, xMesh *apisxv1alpha1.XMesh, opts v1.CreateOptions) (*apisxv1alpha1.XMesh, error)
+	Update(ctx context.Context, xMesh *apisxv1alpha1.XMesh, opts v1.UpdateOptions) (*apisxv1alpha1.XMesh, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, xMesh *apisxv1alpha1.XMesh, opts v1.UpdateOptions) (*apisxv1alpha1.XMesh, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*apisxv1alpha1.XMesh, error)
+	List(ctx context.Context, opts v1.ListOptions) (*apisxv1alpha1.XMeshList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *apisxv1alpha1.XMesh, err error)
+	Apply(ctx context.Context, xMesh *applyconfigurationapisxv1alpha1.XMeshApplyConfiguration, opts v1.ApplyOptions) (result *apisxv1alpha1.XMesh, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, xMesh *applyconfigurationapisxv1alpha1.XMeshApplyConfiguration, opts v1.ApplyOptions) (result *apisxv1alpha1.XMesh, err error)
+	XMeshExpansion
+}
+
+// xMeshes implements XMeshInterface
+type xMeshes struct {
+	*gentype.ClientWithListAndApply[*apisxv1alpha1.XMesh, *apisxv1alpha1.XMeshList, *applyconfigurationapisxv1alpha1.XMeshApplyConfiguration]
+}
+
+// newXMeshes returns a XMeshes
+func newXMeshes(c *ExperimentalV1alpha1Client) *xMeshes {
+	return &xMeshes{
+		gentype.NewClientWithListAndApply[*apisxv1alpha1.XMesh, *apisxv1alpha1.XMeshList, *applyconfigurationapisxv1alpha1.XMeshApplyConfiguration](
+			"xmeshes",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			"",
+			func() *apisxv1alpha1.XMesh { return &apisxv1alpha1.XMesh{} },
+			func() *apisxv1alpha1.XMeshList { return &apisxv1alpha1.XMeshList{} },
+		),
+	}
+}
diff --git a/pkg/client/informers/externalversions/apis/v1/backendtlspolicy.go b/pkg/client/informers/externalversions/apis/v1/backendtlspolicy.go
new file mode 100644
index 00000000..281489e4
--- /dev/null
+++ b/pkg/client/informers/externalversions/apis/v1/backendtlspolicy.go
@@ -0,0 +1,102 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	gatewayapiapisv1 "sigs.k8s.io/gateway-api/apis/v1"
+	versioned "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned"
+	internalinterfaces "sigs.k8s.io/gateway-api/pkg/client/informers/externalversions/internalinterfaces"
+	apisv1 "sigs.k8s.io/gateway-api/pkg/client/listers/apis/v1"
+)
+
+// BackendTLSPolicyInformer provides access to a shared informer and lister for
+// BackendTLSPolicies.
+type BackendTLSPolicyInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() apisv1.BackendTLSPolicyLister
+}
+
+type backendTLSPolicyInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewBackendTLSPolicyInformer constructs a new informer for BackendTLSPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewBackendTLSPolicyInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredBackendTLSPolicyInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredBackendTLSPolicyInformer constructs a new informer for BackendTLSPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredBackendTLSPolicyInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.GatewayV1().BackendTLSPolicies(namespace).List(context.Background(), options)
+			},
+			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.GatewayV1().BackendTLSPolicies(namespace).Watch(context.Background(), options)
+			},
+			ListWithContextFunc: func(ctx context.Context, options metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.GatewayV1().BackendTLSPolicies(namespace).List(ctx, options)
+			},
+			WatchFuncWithContext: func(ctx context.Context, options metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.GatewayV1().BackendTLSPolicies(namespace).Watch(ctx, options)
+			},
+		},
+		&gatewayapiapisv1.BackendTLSPolicy{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *backendTLSPolicyInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredBackendTLSPolicyInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *backendTLSPolicyInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&gatewayapiapisv1.BackendTLSPolicy{}, f.defaultInformer)
+}
+
+func (f *backendTLSPolicyInformer) Lister() apisv1.BackendTLSPolicyLister {
+	return apisv1.NewBackendTLSPolicyLister(f.Informer().GetIndexer())
+}
diff --git a/pkg/client/informers/externalversions/apis/v1/interface.go b/pkg/client/informers/externalversions/apis/v1/interface.go
index 18666f97..d0fd01c9 100644
--- a/pkg/client/informers/externalversions/apis/v1/interface.go
+++ b/pkg/client/informers/externalversions/apis/v1/interface.go
@@ -24,6 +24,8 @@ import (
 
 // Interface provides access to all the informers in this group version.
 type Interface interface {
+	// BackendTLSPolicies returns a BackendTLSPolicyInformer.
+	BackendTLSPolicies() BackendTLSPolicyInformer
 	// GRPCRoutes returns a GRPCRouteInformer.
 	GRPCRoutes() GRPCRouteInformer
 	// Gateways returns a GatewayInformer.
@@ -45,6 +47,11 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
+// BackendTLSPolicies returns a BackendTLSPolicyInformer.
+func (v *version) BackendTLSPolicies() BackendTLSPolicyInformer {
+	return &backendTLSPolicyInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
 // GRPCRoutes returns a GRPCRouteInformer.
 func (v *version) GRPCRoutes() GRPCRouteInformer {
 	return &gRPCRouteInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
diff --git a/pkg/client/informers/externalversions/apisx/v1alpha1/interface.go b/pkg/client/informers/externalversions/apisx/v1alpha1/interface.go
index 9d995d42..768b0818 100644
--- a/pkg/client/informers/externalversions/apisx/v1alpha1/interface.go
+++ b/pkg/client/informers/externalversions/apisx/v1alpha1/interface.go
@@ -28,6 +28,8 @@ type Interface interface {
 	XBackendTrafficPolicies() XBackendTrafficPolicyInformer
 	// XListenerSets returns a XListenerSetInformer.
 	XListenerSets() XListenerSetInformer
+	// XMeshes returns a XMeshInformer.
+	XMeshes() XMeshInformer
 }
 
 type version struct {
@@ -50,3 +52,8 @@ func (v *version) XBackendTrafficPolicies() XBackendTrafficPolicyInformer {
 func (v *version) XListenerSets() XListenerSetInformer {
 	return &xListenerSetInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
+
+// XMeshes returns a XMeshInformer.
+func (v *version) XMeshes() XMeshInformer {
+	return &xMeshInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/pkg/client/informers/externalversions/apisx/v1alpha1/xmesh.go b/pkg/client/informers/externalversions/apisx/v1alpha1/xmesh.go
new file mode 100644
index 00000000..35d1253a
--- /dev/null
+++ b/pkg/client/informers/externalversions/apisx/v1alpha1/xmesh.go
@@ -0,0 +1,101 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	gatewayapiapisxv1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+	versioned "sigs.k8s.io/gateway-api/pkg/client/clientset/versioned"
+	internalinterfaces "sigs.k8s.io/gateway-api/pkg/client/informers/externalversions/internalinterfaces"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/pkg/client/listers/apisx/v1alpha1"
+)
+
+// XMeshInformer provides access to a shared informer and lister for
+// XMeshes.
+type XMeshInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() apisxv1alpha1.XMeshLister
+}
+
+type xMeshInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// NewXMeshInformer constructs a new informer for XMesh type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewXMeshInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredXMeshInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredXMeshInformer constructs a new informer for XMesh type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredXMeshInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ExperimentalV1alpha1().XMeshes().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ExperimentalV1alpha1().XMeshes().Watch(context.Background(), options)
+			},
+			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ExperimentalV1alpha1().XMeshes().List(ctx, options)
+			},
+			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ExperimentalV1alpha1().XMeshes().Watch(ctx, options)
+			},
+		},
+		&gatewayapiapisxv1alpha1.XMesh{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *xMeshInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredXMeshInformer(client, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *xMeshInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&gatewayapiapisxv1alpha1.XMesh{}, f.defaultInformer)
+}
+
+func (f *xMeshInformer) Lister() apisxv1alpha1.XMeshLister {
+	return apisxv1alpha1.NewXMeshLister(f.Informer().GetIndexer())
+}
diff --git a/pkg/client/informers/externalversions/generic.go b/pkg/client/informers/externalversions/generic.go
index b777993d..2f690b8f 100644
--- a/pkg/client/informers/externalversions/generic.go
+++ b/pkg/client/informers/externalversions/generic.go
@@ -57,6 +57,8 @@ func (f *genericInformer) Lister() cache.GenericLister {
 func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericInformer, error) {
 	switch resource {
 	// Group=gateway.networking.k8s.io, Version=v1
+	case v1.SchemeGroupVersion.WithResource("backendtlspolicies"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Gateway().V1().BackendTLSPolicies().Informer()}, nil
 	case v1.SchemeGroupVersion.WithResource("grpcroutes"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Gateway().V1().GRPCRoutes().Informer()}, nil
 	case v1.SchemeGroupVersion.WithResource("gateways"):
@@ -99,6 +101,8 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Experimental().V1alpha1().XBackendTrafficPolicies().Informer()}, nil
 	case v1alpha1.SchemeGroupVersion.WithResource("xlistenersets"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Experimental().V1alpha1().XListenerSets().Informer()}, nil
+	case v1alpha1.SchemeGroupVersion.WithResource("xmeshes"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Experimental().V1alpha1().XMeshes().Informer()}, nil
 
 	}
 
diff --git a/pkg/client/listers/apis/v1/backendtlspolicy.go b/pkg/client/listers/apis/v1/backendtlspolicy.go
new file mode 100644
index 00000000..a5dda655
--- /dev/null
+++ b/pkg/client/listers/apis/v1/backendtlspolicy.go
@@ -0,0 +1,70 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// BackendTLSPolicyLister helps list BackendTLSPolicies.
+// All objects returned here must be treated as read-only.
+type BackendTLSPolicyLister interface {
+	// List lists all BackendTLSPolicies in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*apisv1.BackendTLSPolicy, err error)
+	// BackendTLSPolicies returns an object that can list and get BackendTLSPolicies.
+	BackendTLSPolicies(namespace string) BackendTLSPolicyNamespaceLister
+	BackendTLSPolicyListerExpansion
+}
+
+// backendTLSPolicyLister implements the BackendTLSPolicyLister interface.
+type backendTLSPolicyLister struct {
+	listers.ResourceIndexer[*apisv1.BackendTLSPolicy]
+}
+
+// NewBackendTLSPolicyLister returns a new BackendTLSPolicyLister.
+func NewBackendTLSPolicyLister(indexer cache.Indexer) BackendTLSPolicyLister {
+	return &backendTLSPolicyLister{listers.New[*apisv1.BackendTLSPolicy](indexer, apisv1.Resource("backendtlspolicy"))}
+}
+
+// BackendTLSPolicies returns an object that can list and get BackendTLSPolicies.
+func (s *backendTLSPolicyLister) BackendTLSPolicies(namespace string) BackendTLSPolicyNamespaceLister {
+	return backendTLSPolicyNamespaceLister{listers.NewNamespaced[*apisv1.BackendTLSPolicy](s.ResourceIndexer, namespace)}
+}
+
+// BackendTLSPolicyNamespaceLister helps list and get BackendTLSPolicies.
+// All objects returned here must be treated as read-only.
+type BackendTLSPolicyNamespaceLister interface {
+	// List lists all BackendTLSPolicies in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*apisv1.BackendTLSPolicy, err error)
+	// Get retrieves the BackendTLSPolicy from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*apisv1.BackendTLSPolicy, error)
+	BackendTLSPolicyNamespaceListerExpansion
+}
+
+// backendTLSPolicyNamespaceLister implements the BackendTLSPolicyNamespaceLister
+// interface.
+type backendTLSPolicyNamespaceLister struct {
+	listers.ResourceIndexer[*apisv1.BackendTLSPolicy]
+}
diff --git a/pkg/client/listers/apis/v1/expansion_generated.go b/pkg/client/listers/apis/v1/expansion_generated.go
index 4324e255..1627fa33 100644
--- a/pkg/client/listers/apis/v1/expansion_generated.go
+++ b/pkg/client/listers/apis/v1/expansion_generated.go
@@ -18,6 +18,14 @@ limitations under the License.
 
 package v1
 
+// BackendTLSPolicyListerExpansion allows custom methods to be added to
+// BackendTLSPolicyLister.
+type BackendTLSPolicyListerExpansion interface{}
+
+// BackendTLSPolicyNamespaceListerExpansion allows custom methods to be added to
+// BackendTLSPolicyNamespaceLister.
+type BackendTLSPolicyNamespaceListerExpansion interface{}
+
 // GRPCRouteListerExpansion allows custom methods to be added to
 // GRPCRouteLister.
 type GRPCRouteListerExpansion interface{}
diff --git a/pkg/client/listers/apisx/v1alpha1/expansion_generated.go b/pkg/client/listers/apisx/v1alpha1/expansion_generated.go
index c136f658..bc7d9e33 100644
--- a/pkg/client/listers/apisx/v1alpha1/expansion_generated.go
+++ b/pkg/client/listers/apisx/v1alpha1/expansion_generated.go
@@ -33,3 +33,7 @@ type XListenerSetListerExpansion interface{}
 // XListenerSetNamespaceListerExpansion allows custom methods to be added to
 // XListenerSetNamespaceLister.
 type XListenerSetNamespaceListerExpansion interface{}
+
+// XMeshListerExpansion allows custom methods to be added to
+// XMeshLister.
+type XMeshListerExpansion interface{}
diff --git a/pkg/client/listers/apisx/v1alpha1/xmesh.go b/pkg/client/listers/apisx/v1alpha1/xmesh.go
new file mode 100644
index 00000000..8ef01deb
--- /dev/null
+++ b/pkg/client/listers/apisx/v1alpha1/xmesh.go
@@ -0,0 +1,48 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+	apisxv1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
+)
+
+// XMeshLister helps list XMeshes.
+// All objects returned here must be treated as read-only.
+type XMeshLister interface {
+	// List lists all XMeshes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*apisxv1alpha1.XMesh, err error)
+	// Get retrieves the XMesh from the index for a given name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*apisxv1alpha1.XMesh, error)
+	XMeshListerExpansion
+}
+
+// xMeshLister implements the XMeshLister interface.
+type xMeshLister struct {
+	listers.ResourceIndexer[*apisxv1alpha1.XMesh]
+}
+
+// NewXMeshLister returns a new XMeshLister.
+func NewXMeshLister(indexer cache.Indexer) XMeshLister {
+	return &xMeshLister{listers.New[*apisxv1alpha1.XMesh](indexer, apisxv1alpha1.Resource("xmesh"))}
+}
diff --git a/pkg/consts/consts.go b/pkg/consts/consts.go
index 3ef39805..715f975d 100644
--- a/pkg/consts/consts.go
+++ b/pkg/consts/consts.go
@@ -27,7 +27,7 @@ const (
 
 	// BundleVersion is the value used for the "gateway.networking.k8s.io/bundle-version" annotation.
 	// These value must be updated during the release process.
-	BundleVersion = "v1.3.0"
+	BundleVersion = "v1.4.0"
 
 	// ApprovalLink is the value used for the "api-approved.kubernetes.io" annotation.
 	// These value must be updated during the release process.
diff --git a/pkg/features/backendtlspolicy.go b/pkg/features/backendtlspolicy.go
index 12c6a24c..391e29c9 100644
--- a/pkg/features/backendtlspolicy.go
+++ b/pkg/features/backendtlspolicy.go
@@ -33,7 +33,7 @@ const (
 // TLSRouteFeature contains metadata for the TLSRoute feature.
 var BackendTLSPolicyFeature = Feature{
 	Name:    SupportBackendTLSPolicy,
-	Channel: FeatureChannelExperimental,
+	Channel: FeatureChannelStandard,
 }
 
 // BackendTLSPolicySanValidationFeature contains metadata for the BackendTLSPolicy
diff --git a/pkg/features/features.go b/pkg/features/features.go
index 2a67d006..1fbf43f0 100644
--- a/pkg/features/features.go
+++ b/pkg/features/features.go
@@ -61,7 +61,9 @@ var (
 			Insert(MeshCoreFeatures.UnsortedList()...).
 			Insert(MeshExtendedFeatures.UnsortedList()...).
 			Insert(GRPCRouteCoreFeatures.UnsortedList()...).
-			Insert(BackendTLSPolicyCoreFeatures.UnsortedList()...)
+			Insert(GRPCRouteExtendedFeatures.UnsortedList()...).
+			Insert(BackendTLSPolicyCoreFeatures.UnsortedList()...).
+			Insert(BackendTLSPolicyExtendedFeatures.UnsortedList()...)
 
 	featureMap = map[FeatureName]Feature{}
 )
diff --git a/pkg/features/httproute.go b/pkg/features/httproute.go
index 53f93afd..a38599ca 100644
--- a/pkg/features/httproute.go
+++ b/pkg/features/httproute.go
@@ -103,6 +103,14 @@ const (
 
 	// This option indicates support for the cors filter in the HTTPRouteFilter (extended conformance)
 	SupportHTTPRouteCORS FeatureName = "HTTPRouteCORS"
+	// This option indicates support for HTTPRoute additional redirect status code 303 (extended conformance)
+	SupportHTTPRoute303RedirectStatusCode FeatureName = "HTTPRoute303RedirectStatusCode"
+
+	// This option indicates support for HTTPRoute additional redirect status code 303 (extended conformance)
+	SupportHTTPRoute307RedirectStatusCode FeatureName = "HTTPRoute307RedirectStatusCode"
+
+	// This option indicates support for HTTPRoute additional redirect status code 303 (extended conformance)
+	SupportHTTPRoute308RedirectStatusCode FeatureName = "HTTPRoute308RedirectStatusCode"
 )
 
 var (
@@ -206,6 +214,21 @@ var (
 		Name:    SupportHTTPRouteCORS,
 		Channel: FeatureChannelExperimental,
 	}
+	// HTTPRoute303RedirectStatusCodeFeature contains metadata for the HTTPRoute303RedirectStatusCode feature.
+	HTTPRoute303RedirectStatusCodeFeature = Feature{
+		Name:    SupportHTTPRoute303RedirectStatusCode,
+		Channel: FeatureChannelStandard,
+	}
+	// HTTPRoute307RedirectStatusCodeFeature contains metadata for the HTTPRoute307RedirectStatusCode feature.
+	HTTPRoute307RedirectStatusCodeFeature = Feature{
+		Name:    SupportHTTPRoute307RedirectStatusCode,
+		Channel: FeatureChannelStandard,
+	}
+	// HTTPRoute308RedirectStatusCodeFeature contains metadata for the HTTPRoute308RedirectStatusCode feature.
+	HTTPRoute308RedirectStatusCodeFeature = Feature{
+		Name:    SupportHTTPRoute308RedirectStatusCode,
+		Channel: FeatureChannelStandard,
+	}
 )
 
 // HTTPRouteExtendedFeatures includes all extended features for HTTPRoute
@@ -232,4 +255,7 @@ var HTTPRouteExtendedFeatures = sets.New(
 	HTTPRouteBackendProtocolWebSocketFeature,
 	HTTPRouteNamedRouteRule,
 	HTTPRouteCORS,
+	HTTPRoute303RedirectStatusCodeFeature,
+	HTTPRoute307RedirectStatusCodeFeature,
+	HTTPRoute308RedirectStatusCodeFeature,
 )
diff --git a/pkg/generated/openapi/zz_generated.openapi.go b/pkg/generated/openapi/zz_generated.openapi.go
index 1451e17d..0968ead7 100644
--- a/pkg/generated/openapi/zz_generated.openapi.go
+++ b/pkg/generated/openapi/zz_generated.openapi.go
@@ -86,6 +86,10 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"sigs.k8s.io/gateway-api/apis/v1.AllowedRoutes":                                   schema_sigsk8sio_gateway_api_apis_v1_AllowedRoutes(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.BackendObjectReference":                          schema_sigsk8sio_gateway_api_apis_v1_BackendObjectReference(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.BackendRef":                                      schema_sigsk8sio_gateway_api_apis_v1_BackendRef(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.BackendTLSPolicy":                                schema_sigsk8sio_gateway_api_apis_v1_BackendTLSPolicy(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.BackendTLSPolicyList":                            schema_sigsk8sio_gateway_api_apis_v1_BackendTLSPolicyList(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.BackendTLSPolicySpec":                            schema_sigsk8sio_gateway_api_apis_v1_BackendTLSPolicySpec(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.BackendTLSPolicyValidation":                      schema_sigsk8sio_gateway_api_apis_v1_BackendTLSPolicyValidation(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.CommonRouteSpec":                                 schema_sigsk8sio_gateway_api_apis_v1_CommonRouteSpec(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.CookieConfig":                                    schema_sigsk8sio_gateway_api_apis_v1_CookieConfig(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.ForwardBodyConfig":                               schema_sigsk8sio_gateway_api_apis_v1_ForwardBodyConfig(ref),
@@ -144,15 +148,21 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"sigs.k8s.io/gateway-api/apis/v1.ListenerTLSConfig":                               schema_sigsk8sio_gateway_api_apis_v1_ListenerTLSConfig(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.LocalObjectReference":                            schema_sigsk8sio_gateway_api_apis_v1_LocalObjectReference(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.LocalParametersReference":                        schema_sigsk8sio_gateway_api_apis_v1_LocalParametersReference(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference":                      schema_sigsk8sio_gateway_api_apis_v1_LocalPolicyTargetReference(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReferenceWithSectionName":       schema_sigsk8sio_gateway_api_apis_v1_LocalPolicyTargetReferenceWithSectionName(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.NamespacedPolicyTargetReference":                 schema_sigsk8sio_gateway_api_apis_v1_NamespacedPolicyTargetReference(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.ObjectReference":                                 schema_sigsk8sio_gateway_api_apis_v1_ObjectReference(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.ParametersReference":                             schema_sigsk8sio_gateway_api_apis_v1_ParametersReference(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.ParentReference":                                 schema_sigsk8sio_gateway_api_apis_v1_ParentReference(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.PolicyAncestorStatus":                            schema_sigsk8sio_gateway_api_apis_v1_PolicyAncestorStatus(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.PolicyStatus":                                    schema_sigsk8sio_gateway_api_apis_v1_PolicyStatus(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.RouteGroupKind":                                  schema_sigsk8sio_gateway_api_apis_v1_RouteGroupKind(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.RouteNamespaces":                                 schema_sigsk8sio_gateway_api_apis_v1_RouteNamespaces(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.RouteParentStatus":                               schema_sigsk8sio_gateway_api_apis_v1_RouteParentStatus(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.RouteStatus":                                     schema_sigsk8sio_gateway_api_apis_v1_RouteStatus(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.SecretObjectReference":                           schema_sigsk8sio_gateway_api_apis_v1_SecretObjectReference(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.SessionPersistence":                              schema_sigsk8sio_gateway_api_apis_v1_SessionPersistence(ref),
+		"sigs.k8s.io/gateway-api/apis/v1.SubjectAltName":                                  schema_sigsk8sio_gateway_api_apis_v1_SubjectAltName(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.SupportedFeature":                                schema_sigsk8sio_gateway_api_apis_v1_SupportedFeature(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.TLSConfig":                                       schema_sigsk8sio_gateway_api_apis_v1_TLSConfig(ref),
 		"sigs.k8s.io/gateway-api/apis/v1.TLSPortConfig":                                   schema_sigsk8sio_gateway_api_apis_v1_TLSPortConfig(ref),
@@ -183,9 +193,6 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"sigs.k8s.io/gateway-api/apis/v1alpha2.UDPRouteStatus":                            schema_sigsk8sio_gateway_api_apis_v1alpha2_UDPRouteStatus(ref),
 		"sigs.k8s.io/gateway-api/apis/v1alpha3.BackendTLSPolicy":                          schema_sigsk8sio_gateway_api_apis_v1alpha3_BackendTLSPolicy(ref),
 		"sigs.k8s.io/gateway-api/apis/v1alpha3.BackendTLSPolicyList":                      schema_sigsk8sio_gateway_api_apis_v1alpha3_BackendTLSPolicyList(ref),
-		"sigs.k8s.io/gateway-api/apis/v1alpha3.BackendTLSPolicySpec":                      schema_sigsk8sio_gateway_api_apis_v1alpha3_BackendTLSPolicySpec(ref),
-		"sigs.k8s.io/gateway-api/apis/v1alpha3.BackendTLSPolicyValidation":                schema_sigsk8sio_gateway_api_apis_v1alpha3_BackendTLSPolicyValidation(ref),
-		"sigs.k8s.io/gateway-api/apis/v1alpha3.SubjectAltName":                            schema_sigsk8sio_gateway_api_apis_v1alpha3_SubjectAltName(ref),
 		"sigs.k8s.io/gateway-api/apis/v1alpha3.TLSRoute":                                  schema_sigsk8sio_gateway_api_apis_v1alpha3_TLSRoute(ref),
 		"sigs.k8s.io/gateway-api/apis/v1alpha3.TLSRouteList":                              schema_sigsk8sio_gateway_api_apis_v1alpha3_TLSRouteList(ref),
 		"sigs.k8s.io/gateway-api/apis/v1alpha3.TLSRouteSpec":                              schema_sigsk8sio_gateway_api_apis_v1alpha3_TLSRouteSpec(ref),
@@ -206,6 +213,8 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerEntryStatus":                      schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerEntryStatus(ref),
 		"sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerSetSpec":                          schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerSetSpec(ref),
 		"sigs.k8s.io/gateway-api/apisx/v1alpha1.ListenerSetStatus":                        schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerSetStatus(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.MeshSpec":                                 schema_sigsk8sio_gateway_api_apisx_v1alpha1_MeshSpec(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.MeshStatus":                               schema_sigsk8sio_gateway_api_apisx_v1alpha1_MeshStatus(ref),
 		"sigs.k8s.io/gateway-api/apisx/v1alpha1.ParentGatewayReference":                   schema_sigsk8sio_gateway_api_apisx_v1alpha1_ParentGatewayReference(ref),
 		"sigs.k8s.io/gateway-api/apisx/v1alpha1.RequestRate":                              schema_sigsk8sio_gateway_api_apisx_v1alpha1_RequestRate(ref),
 		"sigs.k8s.io/gateway-api/apisx/v1alpha1.RetryConstraint":                          schema_sigsk8sio_gateway_api_apisx_v1alpha1_RetryConstraint(ref),
@@ -213,6 +222,8 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"sigs.k8s.io/gateway-api/apisx/v1alpha1.XBackendTrafficPolicyList":                schema_sigsk8sio_gateway_api_apisx_v1alpha1_XBackendTrafficPolicyList(ref),
 		"sigs.k8s.io/gateway-api/apisx/v1alpha1.XListenerSet":                             schema_sigsk8sio_gateway_api_apisx_v1alpha1_XListenerSet(ref),
 		"sigs.k8s.io/gateway-api/apisx/v1alpha1.XListenerSetList":                         schema_sigsk8sio_gateway_api_apisx_v1alpha1_XListenerSetList(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.XMesh":                                    schema_sigsk8sio_gateway_api_apisx_v1alpha1_XMesh(ref),
+		"sigs.k8s.io/gateway-api/apisx/v1alpha1.XMeshList":                                schema_sigsk8sio_gateway_api_apisx_v1alpha1_XMeshList(ref),
 	}
 }
 
@@ -2867,14 +2878,10 @@ func schema_sigsk8sio_gateway_api_apis_v1_AllowedRoutes(ref common.ReferenceCall
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
+				Description: "AllowedRoutes defines which Routes may be attached to this Listener.",
+				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"namespaces": {
-						VendorExtensible: spec.VendorExtensible{
-							Extensions: spec.Extensions{
-								"x-kubernetes-list-type": "atomic",
-							},
-						},
 						SchemaProps: spec.SchemaProps{
 							Description: "Namespaces indicates namespaces from which Routes may be attached to this Listener. This is restricted to the namespace of this Gateway by default.\n\nSupport: Core",
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.RouteNamespaces"),
@@ -2961,7 +2968,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_BackendRef(ref common.ReferenceCallbac
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "BackendRef defines how a Route should forward a request to a Kubernetes resource.\n\nNote that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.",
+				Description: "BackendRef defines how a Route should forward a request to a Kubernetes resource.\n\nNote that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.\n\n<gateway:experimental:description>\n\nWhen the BackendRef points to a Kubernetes Service, implementations SHOULD honor the appProtocol field if it is set for the target Service Port.\n\nImplementations supporting appProtocol SHOULD recognize the Kubernetes Standard Application Protocols defined in KEP-3726.\n\nIf a Service appProtocol isn't specified, an implementation MAY infer the backend protocol through its own means. Implementations MAY infer the protocol from the Route type referring to the backend Service.\n\nIf a Route is not able to send traffic to the backend using the specified protocol then the backend is considered invalid. Implementations MUST set the \"ResolvedRefs\" condition to \"False\" with the \"UnsupportedProtocol\" reason.\n\n</gateway:experimental:description>\n\nNote that when the BackendTLSPolicy object is enabled by the implementation, there are some extra rules about validity to consider here. See the fields where this struct is used for more information about the exact behavior.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
@@ -3014,6 +3021,232 @@ func schema_sigsk8sio_gateway_api_apis_v1_BackendRef(ref common.ReferenceCallbac
 	}
 }
 
+func schema_sigsk8sio_gateway_api_apis_v1_BackendTLSPolicy(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "BackendTLSPolicy provides a way to configure how a Gateway connects to a Backend via TLS.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
+						},
+					},
+					"spec": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Spec defines the desired state of BackendTLSPolicy.",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.BackendTLSPolicySpec"),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Status defines the current state of BackendTLSPolicy.",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.PolicyStatus"),
+						},
+					},
+				},
+				Required: []string{"spec"},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta", "sigs.k8s.io/gateway-api/apis/v1.BackendTLSPolicySpec", "sigs.k8s.io/gateway-api/apis/v1.PolicyStatus"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apis_v1_BackendTLSPolicyList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "BackendTLSPolicyList contains a list of BackendTLSPolicies",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1.BackendTLSPolicy"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"items"},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta", "sigs.k8s.io/gateway-api/apis/v1.BackendTLSPolicy"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apis_v1_BackendTLSPolicySpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "BackendTLSPolicySpec defines the desired state of BackendTLSPolicy.\n\nSupport: Extended",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"targetRefs": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "TargetRefs identifies an API object to apply the policy to. Only Services have Extended support. Implementations MAY support additional objects, with Implementation Specific support. Note that this config applies to the entire referenced resource by default, but this default may change in the future to provide a more granular application of the policy.\n\nTargetRefs must be _distinct_. This means either that:\n\n* They select different targets. If this is the case, then targetRef\n  entries are distinct. In terms of fields, this means that the\n  multi-part key defined by `group`, `kind`, and `name` must\n  be unique across all targetRef entries in the BackendTLSPolicy.\n* They select different sectionNames in the same target.\n\nWhen more than one BackendTLSPolicy selects the same target and sectionName, implementations MUST determine precedence using the following criteria, continuing on ties:\n\n* The older policy by creation timestamp takes precedence. For\n  example, a policy with a creation timestamp of \"2021-07-15\n  01:02:03\" MUST be given precedence over a policy with a\n  creation timestamp of \"2021-07-15 01:02:04\".\n* The policy appearing first in alphabetical order by {name}.\n  For example, a policy named `bar` is given precedence over a\n  policy named `baz`.\n\nFor any BackendTLSPolicy that does not take precedence, the implementation MUST ensure the `Accepted` Condition is set to `status: False`, with Reason `Conflicted`.\n\nSupport: Extended for Kubernetes Service\n\nSupport: Implementation-specific for any other resource",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReferenceWithSectionName"),
+									},
+								},
+							},
+						},
+					},
+					"validation": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Validation contains backend TLS validation configuration.",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.BackendTLSPolicyValidation"),
+						},
+					},
+					"options": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Options are a list of key/value pairs to enable extended TLS configuration for each implementation. For example, configuring the minimum TLS version or supported cipher suites.\n\nA set of common keys MAY be defined by the API in the future. To avoid any ambiguity, implementation-specific definitions MUST use domain-prefixed names, such as `example.com/my-custom-option`. Un-prefixed names are reserved for key names defined by Gateway API.\n\nSupport: Implementation-specific",
+							Type:        []string{"object"},
+							AdditionalProperties: &spec.SchemaOrBool{
+								Allows: true,
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: "",
+										Type:    []string{"string"},
+										Format:  "",
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"targetRefs", "validation"},
+			},
+		},
+		Dependencies: []string{
+			"sigs.k8s.io/gateway-api/apis/v1.BackendTLSPolicyValidation", "sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReferenceWithSectionName"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apis_v1_BackendTLSPolicyValidation(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "BackendTLSPolicyValidation contains backend TLS validation configuration.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"caCertificateRefs": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "CACertificateRefs contains one or more references to Kubernetes objects that contain a PEM-encoded TLS CA certificate bundle, which is used to validate a TLS handshake between the Gateway and backend Pod.\n\nIf CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified, not both. If CACertificateRefs is empty or unspecified, the configuration for WellKnownCACertificates MUST be honored instead if supported by the implementation.\n\nA CACertificateRef is invalid if:\n\n* It refers to a resource that cannot be resolved (e.g., the referenced resource\n  does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key\n  named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`\n  and the Message of the Condition must indicate which reference is invalid and why.\n\n* It refers to an unknown or unsupported kind of resource. In this case, the Reason\n  must be set to `InvalidKind` and the Message of the Condition must explain which\n  kind of resource is unknown or unsupported.\n\n* It refers to a resource in another namespace. This may change in future\n  spec updates.\n\nImplementations MAY choose to perform further validation of the certificate content (e.g., checking expiry or enforcing specific formats). In such cases, an implementation-specific Reason and Message must be set for the invalid reference.\n\nIn all cases, the implementation MUST ensure the `ResolvedRefs` Condition on the BackendTLSPolicy is set to `status: False`, with a Reason and Message that indicate the cause of the error. Connections using an invalid CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error response. If ALL CACertificateRefs are invalid, the implementation MUST also ensure the `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with a Reason `NoValidCACertificate`.\n\nA single CACertificateRef to a Kubernetes ConfigMap kind has \"Core\" support. Implementations MAY choose to support attaching multiple certificates to a backend, but this behavior is implementation-specific.\n\nSupport: Core - An optional single reference to a Kubernetes ConfigMap, with the CA certificate in a key named `ca.crt`.\n\nSupport: Implementation-specific - More than one reference, other kinds of resources, or a single reference that includes multiple certificates.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1.LocalObjectReference"),
+									},
+								},
+							},
+						},
+					},
+					"wellKnownCACertificates": {
+						SchemaProps: spec.SchemaProps{
+							Description: "WellKnownCACertificates specifies whether system CA certificates may be used in the TLS handshake between the gateway and backend pod.\n\nIf WellKnownCACertificates is unspecified or empty (\"\"), then CACertificateRefs must be specified with at least one entry for a valid configuration. Only one of CACertificateRefs or WellKnownCACertificates may be specified, not both. If an implementation does not support the WellKnownCACertificates field, or the supplied value is not recognized, the implementation MUST ensure the `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with a Reason `Invalid`.\n\nSupport: Implementation-specific",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"hostname": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Hostname is used for two purposes in the connection between Gateways and backends:\n\n1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066). 2. Hostname MUST be used for authentication and MUST match the certificate\n   served by the matching backend, unless SubjectAltNames is specified.\n3. If SubjectAltNames are specified, Hostname can be used for certificate selection\n   but MUST NOT be used for authentication. If you want to use the value\n   of the Hostname field for authentication, you MUST add it to the SubjectAltNames list.\n\nSupport: Core",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"subjectAltNames": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "SubjectAltNames contains one or more Subject Alternative Names. When specified the certificate served from the backend MUST have at least one Subject Alternate Name matching one of the specified SubjectAltNames.\n\nSupport: Extended",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1.SubjectAltName"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"hostname"},
+			},
+		},
+		Dependencies: []string{
+			"sigs.k8s.io/gateway-api/apis/v1.LocalObjectReference", "sigs.k8s.io/gateway-api/apis/v1.SubjectAltName"},
+	}
+}
+
 func schema_sigsk8sio_gateway_api_apis_v1_CommonRouteSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -3040,6 +3273,13 @@ func schema_sigsk8sio_gateway_api_apis_v1_CommonRouteSpec(ref common.ReferenceCa
 							},
 						},
 					},
+					"useDefaultGateways": {
+						SchemaProps: spec.SchemaProps{
+							Description: "UseDefaultGateways indicates the default Gateway scope to use for this Route. If unset (the default) or set to None, the Route will not be attached to any default Gateway; if set, it will be attached to any default Gateway supporting the named scope, subject to the usual rules about which Routes a Gateway is allowed to claim.\n\nThink carefully before using this functionality! The set of default Gateways supporting the requested scope can change over time without any notice to the Route author, and in many situations it will not be appropriate to request a default Gateway for a given Route -- for example, a Route with specific security requirements should almost certainly not use a default Gateway.\n\n<gateway:experimental>",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 				},
 			},
 		},
@@ -3215,7 +3455,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_GRPCAuthConfig(ref common.ReferenceCal
 							},
 						},
 						SchemaProps: spec.SchemaProps{
-							Description: "AllowedRequestHeaders specifies what headers from the client request will be sent to the authorization server.\n\nIf this list is empty, then the following headers must be sent:\n\n- `Authorization` - `Location` - `Proxy-Authenticate` - `Set-Cookie` - `WWW-Authenticate`\n\nIf the list has entries, only those entries must be sent.",
+							Description: "AllowedRequestHeaders specifies what headers from the client request will be sent to the authorization server.\n\nIf this list is empty, then all headers must be sent.\n\nIf the list has entries, only those entries must be sent.",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
@@ -3684,6 +3924,13 @@ func schema_sigsk8sio_gateway_api_apis_v1_GRPCRouteSpec(ref common.ReferenceCall
 							},
 						},
 					},
+					"useDefaultGateways": {
+						SchemaProps: spec.SchemaProps{
+							Description: "UseDefaultGateways indicates the default Gateway scope to use for this Route. If unset (the default) or set to None, the Route will not be attached to any default Gateway; if set, it will be attached to any default Gateway supporting the named scope, subject to the usual rules about which Routes a Gateway is allowed to claim.\n\nThink carefully before using this functionality! The set of default Gateways supporting the requested scope can change over time without any notice to the Route author, and in many situations it will not be appropriate to request a default Gateway for a given Route -- for example, a Route with specific security requirements should almost certainly not use a default Gateway.\n\n<gateway:experimental>",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 					"hostnames": {
 						VendorExtensible: spec.VendorExtensible{
 							Extensions: spec.Extensions{
@@ -4012,7 +4259,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewayClassStatus(ref common.Referenc
 							},
 						},
 						SchemaProps: spec.SchemaProps{
-							Description: "SupportedFeatures is the set of features the GatewayClass support. It MUST be sorted in ascending alphabetical order by the Name key. <gateway:experimental>",
+							Description: "SupportedFeatures is the set of features the GatewayClass support. It MUST be sorted in ascending alphabetical order by the Name key.",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
@@ -4177,7 +4424,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewaySpec(ref common.ReferenceCallba
 							},
 						},
 						SchemaProps: spec.SchemaProps{
-							Description: "Addresses requested for this Gateway. This is optional and behavior can depend on the implementation. If a value is set in the spec and the requested address is invalid or unavailable, the implementation MUST indicate this in the associated entry in GatewayStatus.Addresses.\n\nThe Addresses field represents a request for the address(es) on the \"outside of the Gateway\", that traffic bound for this Gateway will use. This could be the IP address or hostname of an external load balancer or other networking infrastructure, or some other address that traffic will be sent to.\n\nIf no Addresses are specified, the implementation MAY schedule the Gateway in an implementation-specific manner, assigning an appropriate set of Addresses.\n\nThe implementation MUST bind all Listeners to every GatewayAddress that it assigns to the Gateway and add a corresponding entry in GatewayStatus.Addresses.\n\nSupport: Extended\n\n<gateway:validateIPAddress>",
+							Description: "Addresses requested for this Gateway. This is optional and behavior can depend on the implementation. If a value is set in the spec and the requested address is invalid or unavailable, the implementation MUST indicate this in an associated entry in GatewayStatus.Conditions.\n\nThe Addresses field represents a request for the address(es) on the \"outside of the Gateway\", that traffic bound for this Gateway will use. This could be the IP address or hostname of an external load balancer or other networking infrastructure, or some other address that traffic will be sent to.\n\nIf no Addresses are specified, the implementation MAY schedule the Gateway in an implementation-specific manner, assigning an appropriate set of Addresses.\n\nThe implementation MUST bind all Listeners to every GatewayAddress that it assigns to the Gateway and add a corresponding entry in GatewayStatus.Addresses.\n\nSupport: Extended\n\n<gateway:validateIPAddress>",
 							Type:        []string{"array"},
 							Items: &spec.SchemaOrArray{
 								Schema: &spec.Schema{
@@ -4207,6 +4454,13 @@ func schema_sigsk8sio_gateway_api_apis_v1_GatewaySpec(ref common.ReferenceCallba
 							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.GatewayTLSConfig"),
 						},
 					},
+					"defaultScope": {
+						SchemaProps: spec.SchemaProps{
+							Description: "DefaultScope, when set, configures the Gateway as a default Gateway, meaning it will dynamically and implicitly have Routes (e.g. HTTPRoute) attached to it, according to the scope configured here.\n\nIf unset (the default) or set to None, the Gateway will not act as a default Gateway; if set, the Gateway will claim any Route with a matching scope set in its UseDefaultGateway field, subject to the usual rules about which routes the Gateway can attach to.\n\nThink carefully before using this functionality! While the normal rules about which Route can apply are still enforced, it is simply easier for the wrong Route to be accidentally attached to this Gateway in this configuration. If the Gateway operator is not also the operator in control of the scope (e.g. namespace) with tight controls and checks on what kind of workloads and Routes get added in that scope, we strongly recommend not using this just because it seems convenient, and instead stick to direct Route attachment.\n\n<gateway:experimental>",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 				},
 				Required: []string{"gatewayClassName", "listeners"},
 			},
@@ -4441,7 +4695,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPBackendRef(ref common.ReferenceCal
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "HTTPBackendRef defines how a HTTPRoute should forward an HTTP request.",
+				Description: "HTTPBackendRef defines how a HTTPRoute forwards a HTTP request.\n\nNote that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.\n\n<gateway:experimental:description>\n\nWhen the BackendRef points to a Kubernetes Service, implementations SHOULD honor the appProtocol field if it is set for the target Service Port.\n\nImplementations supporting appProtocol SHOULD recognize the Kubernetes Standard Application Protocols defined in KEP-3726.\n\nIf a Service appProtocol isn't specified, an implementation MAY infer the backend protocol through its own means. Implementations MAY infer the protocol from the Route type referring to the backend Service.\n\nIf a Route is not able to send traffic to the backend using the specified protocol then the backend is considered invalid. Implementations MUST set the \"ResolvedRefs\" condition to \"False\" with the \"UnsupportedProtocol\" reason.\n\n</gateway:experimental:description>",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
@@ -4704,7 +4958,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPHeaderFilter(ref common.ReferenceC
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "HTTPHeaderFilter defines a filter that modifies the headers of an HTTP request or response.",
+				Description: "HTTPHeaderFilter defines a filter that modifies the headers of an HTTP request or response. Only one action for a given header name is permitted. Filters specifying multiple actions of the same or different type for any one header name are invalid. Configuration to set or add multiple values for a header must use RFC 7230 header value formatting, separating each value with a comma.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"set": {
@@ -4847,7 +5101,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPPathModifier(ref common.ReferenceC
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "HTTPPathModifier defines configuration for path modifiers. <gateway:experimental>",
+				Description: "HTTPPathModifier defines configuration for path modifiers.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"type": {
@@ -5055,7 +5309,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPRouteFilter(ref common.ReferenceCa
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "HTTPRouteFilter defines processing steps that must be completed during the request or response lifecycle. HTTPRouteFilters are meant as an extension point to express processing that may be done in Gateway implementations. Some examples include request or response modification, implementing authentication strategies, rate-limiting, and traffic shaping. API guarantee/conformance is defined based on the type of the filter.",
+				Description: "HTTPRouteFilter defines processing steps that must be completed during the request or response lifecycle. HTTPRouteFilters are meant as an extension point to express processing that may be done in Gateway implementations. Some examples include request or response modification, implementing authentication strategies, rate-limiting, and traffic shaping. API guarantee/conformance is defined based on the type of the filter.\n\n<gateway:experimental:validation:XValidation:message=\"filter.cors must be nil if the filter.type is not CORS\",rule=\"!(has(self.cors) && self.type != 'CORS')\"> <gateway:experimental:validation:XValidation:message=\"filter.cors must be specified for CORS filter.type\",rule=\"!(!has(self.cors) && self.type == 'CORS')\"> <gateway:experimental:validation:XValidation:message=\"filter.externalAuth must be nil if the filter.type is not ExternalAuth\",rule=\"!(has(self.externalAuth) && self.type != 'ExternalAuth')\"> <gateway:experimental:validation:XValidation:message=\"filter.externalAuth must be specified for ExternalAuth filter.type\",rule=\"!(!has(self.externalAuth) && self.type == 'ExternalAuth')\">",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"type": {
@@ -5414,6 +5668,13 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPRouteSpec(ref common.ReferenceCall
 							},
 						},
 					},
+					"useDefaultGateways": {
+						SchemaProps: spec.SchemaProps{
+							Description: "UseDefaultGateways indicates the default Gateway scope to use for this Route. If unset (the default) or set to None, the Route will not be attached to any default Gateway; if set, it will be attached to any default Gateway supporting the named scope, subject to the usual rules about which Routes a Gateway is allowed to claim.\n\nThink carefully before using this functionality! The set of default Gateways supporting the requested scope can change over time without any notice to the Route author, and in many situations it will not be appropriate to request a default Gateway for a given Route -- for example, a Route with specific security requirements should almost certainly not use a default Gateway.\n\n<gateway:experimental>",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 					"hostnames": {
 						VendorExtensible: spec.VendorExtensible{
 							Extensions: spec.Extensions{
@@ -5500,7 +5761,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPRouteTimeouts(ref common.Reference
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "HTTPRouteTimeouts defines timeouts that can be configured for an HTTPRoute.",
+				Description: "HTTPRouteTimeouts defines timeouts that can be configured for an HTTPRoute. Timeout values are represented with Gateway API Duration formatting.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"request": {
@@ -5527,7 +5788,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_HTTPURLRewriteFilter(ref common.Refere
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "HTTPURLRewriteFilter defines a filter that modifies a request during forwarding. At most one of these filters may be used on a Route rule. This MUST NOT be used on the same Route rule as a HTTPRequestRedirect filter.\n\nSupport: Extended\n\n<gateway:experimental>",
+				Description: "HTTPURLRewriteFilter defines a filter that modifies a request during forwarding. At most one of these filters may be used on a Route rule. This MUST NOT be used on the same Route rule as a HTTPRequestRedirect filter.\n\nSupport: Extended",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"hostname": {
@@ -5715,7 +5976,8 @@ func schema_sigsk8sio_gateway_api_apis_v1_ListenerTLSConfig(ref common.Reference
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
+				Description: "ListenerTLSConfig describes a TLS configuration for a listener.",
+				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"mode": {
 						SchemaProps: spec.SchemaProps{
@@ -5843,16 +6105,16 @@ func schema_sigsk8sio_gateway_api_apis_v1_LocalParametersReference(ref common.Re
 	}
 }
 
-func schema_sigsk8sio_gateway_api_apis_v1_ObjectReference(ref common.ReferenceCallback) common.OpenAPIDefinition {
+func schema_sigsk8sio_gateway_api_apis_v1_LocalPolicyTargetReference(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "ObjectReference identifies an API object including its namespace.\n\nThe API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid.\n\nReferences to objects with invalid Group and Kind are not valid, and must be rejected by the implementation, with appropriate Conditions set on the containing object.",
+				Description: "LocalPolicyTargetReference identifies an API object to apply a direct or inherited policy to. This should be used as part of Policy resources that can target Gateway API resources. For more information on how this policy attachment model works, and a sample Policy resource, refer to the policy attachment documentation for Gateway API.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\". When set to the empty string, core API group is inferred.",
+							Description: "Group is the group of the target resource.",
 							Default:     "",
 							Type:        []string{"string"},
 							Format:      "",
@@ -5860,7 +6122,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_ObjectReference(ref common.ReferenceCa
 					},
 					"kind": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Kind is kind of the referent. For example \"ConfigMap\" or \"Service\".",
+							Description: "Kind is kind of the target resource.",
 							Default:     "",
 							Type:        []string{"string"},
 							Format:      "",
@@ -5868,19 +6130,12 @@ func schema_sigsk8sio_gateway_api_apis_v1_ObjectReference(ref common.ReferenceCa
 					},
 					"name": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Name is the name of the referent.",
+							Description: "Name is the name of the target resource.",
 							Default:     "",
 							Type:        []string{"string"},
 							Format:      "",
 						},
 					},
-					"namespace": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Namespace is the namespace of the referenced object. When unspecified, the local namespace is inferred.\n\nNote that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.\n\nSupport: Core",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
 				},
 				Required: []string{"group", "kind", "name"},
 			},
@@ -5888,11 +6143,146 @@ func schema_sigsk8sio_gateway_api_apis_v1_ObjectReference(ref common.ReferenceCa
 	}
 }
 
-func schema_sigsk8sio_gateway_api_apis_v1_ParametersReference(ref common.ReferenceCallback) common.OpenAPIDefinition {
+func schema_sigsk8sio_gateway_api_apis_v1_LocalPolicyTargetReferenceWithSectionName(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "ParametersReference identifies an API object containing controller-specific configuration resource within the cluster.",
+				Description: "LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a direct policy to. This should be used as part of Policy resources that can target single resources. For more information on how this policy attachment mode works, and a sample Policy resource, refer to the policy attachment documentation for Gateway API.\n\nNote: This should only be used for direct policy attachment when references to SectionName are actually needed. In all other cases, LocalPolicyTargetReference should be used.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"group": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Group is the group of the target resource.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is kind of the target resource.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Name is the name of the target resource.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"sectionName": {
+						SchemaProps: spec.SchemaProps{
+							Description: "SectionName is the name of a section within the target resource. When unspecified, this targetRef targets the entire resource. In the following resources, SectionName is interpreted as the following:\n\n* Gateway: Listener name * HTTPRoute: HTTPRouteRule name * Service: Port name\n\nIf a SectionName is specified, but does not exist on the targeted object, the Policy must fail to attach, and the policy implementation should record a `ResolvedRefs` or similar Condition in the Policy's status.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"group", "kind", "name"},
+			},
+		},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apis_v1_NamespacedPolicyTargetReference(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "NamespacedPolicyTargetReference identifies an API object to apply a direct or inherited policy to, potentially in a different namespace. This should only be used as part of Policy resources that need to be able to target resources in different namespaces. For more information on how this policy attachment model works, and a sample Policy resource, refer to the policy attachment documentation for Gateway API.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"group": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Group is the group of the target resource.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is kind of the target resource.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Name is the name of the target resource.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"namespace": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Namespace is the namespace of the referent. When unspecified, the local namespace is inferred. Even when policy targets a resource in a different namespace, it MUST only apply to traffic originating from the same namespace as the policy.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"group", "kind", "name"},
+			},
+		},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apis_v1_ObjectReference(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "ObjectReference identifies an API object including its namespace.\n\nThe API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid.\n\nReferences to objects with invalid Group and Kind are not valid, and must be rejected by the implementation, with appropriate Conditions set on the containing object.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"group": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\". When set to the empty string, core API group is inferred.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is kind of the referent. For example \"ConfigMap\" or \"Service\".",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Name is the name of the referent.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"namespace": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Namespace is the namespace of the referenced object. When unspecified, the local namespace is inferred.\n\nNote that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.\n\nSupport: Core",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"group", "kind", "name"},
+			},
+		},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apis_v1_ParametersReference(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "ParametersReference identifies an API object containing controller-specific configuration resource within the cluster.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
@@ -5937,7 +6327,7 @@ func schema_sigsk8sio_gateway_api_apis_v1_ParentReference(ref common.ReferenceCa
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources, such as HTTPRoute.\n\nNote that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference.\n\nThe API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid.",
+				Description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). There are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile) * Service (Mesh conformance profile, ClusterIP Services only)\n\nThis API may be extended in the future to support additional kinds of parent resources.\n\nThe API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid.",
 				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
@@ -5990,11 +6380,100 @@ func schema_sigsk8sio_gateway_api_apis_v1_ParentReference(ref common.ReferenceCa
 	}
 }
 
+func schema_sigsk8sio_gateway_api_apis_v1_PolicyAncestorStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "PolicyAncestorStatus describes the status of a route with respect to an associated Ancestor.\n\nAncestors refer to objects that are either the Target of a policy or above it in terms of object hierarchy. For example, if a policy targets a Service, the Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most useful object to place Policy status on, so we recommend that implementations SHOULD use Gateway as the PolicyAncestorStatus object unless the designers have a _very_ good reason otherwise.\n\nIn the context of policy attachment, the Ancestor is used to distinguish which resource results in a distinct application of this policy. For example, if a policy targets a Service, it may have a distinct result per attached Gateway.\n\nPolicies targeting the same resource may have different effects depending on the ancestors of those resources. For example, different Gateways targeting the same Service may have different capabilities, especially if they have different underlying implementations.\n\nFor example, in BackendTLSPolicy, the Policy attaches to a Service that is used as a backend in a HTTPRoute that is itself attached to a Gateway. In this case, the relevant object for status is the Gateway, and that is the ancestor object referred to in this status.\n\nNote that a parent is also an ancestor, so for objects where the parent is the relevant object for status, this struct SHOULD still be used.\n\nThis struct is intended to be used in a slice that's effectively a map, with a composite key made up of the AncestorRef and the ControllerName.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"ancestorRef": {
+						SchemaProps: spec.SchemaProps{
+							Description: "AncestorRef corresponds with a ParentRef in the spec that this PolicyAncestorStatus struct describes the status of.",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.ParentReference"),
+						},
+					},
+					"controllerName": {
+						SchemaProps: spec.SchemaProps{
+							Description: "ControllerName is a domain/path string that indicates the name of the controller that wrote this status. This corresponds with the controllerName field on GatewayClass.\n\nExample: \"example.net/gateway-controller\".\n\nThe format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).\n\nControllers MUST populate this field when writing status. Controllers should ensure that entries to status populated with their ControllerName are cleaned up when they are no longer necessary.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"conditions": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"type",
+								},
+								"x-kubernetes-list-type": "map",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "Conditions describes the status of the Policy with respect to the given Ancestor.\n\n<gateway:util:excludeFromCRD>\n\nNotes for implementors:\n\nConditions are a listType `map`, which means that they function like a map with a key of the `type` field _in the k8s apiserver_.\n\nThis means that implementations must obey some rules when updating this section.\n\n* Implementations MUST perform a read-modify-write cycle on this field\n  before modifying it. That is, when modifying this field, implementations\n  must be confident they have fetched the most recent version of this field,\n  and ensure that changes they make are on that recent version.\n* Implementations MUST NOT remove or reorder Conditions that they are not\n  directly responsible for. For example, if an implementation sees a Condition\n  with type `special.io/SomeField`, it MUST NOT remove, change or update that\n  Condition.\n* Implementations MUST always _merge_ changes into Conditions of the same Type,\n  rather than creating more than one Condition of the same Type.\n* Implementations MUST always update the `observedGeneration` field of the\n  Condition to the `metadata.generation` of the Gateway at the time of update creation.\n* If the `observedGeneration` of a Condition is _greater than_ the value the\n  implementation knows about, then it MUST NOT perform the update on that Condition,\n  but must wait for a future reconciliation and status update. (The assumption is that\n  the implementation's copy of the object is stale and an update will be re-triggered\n  if relevant.)\n\n</gateway:util:excludeFromCRD>",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.Condition"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"ancestorRef", "controllerName", "conditions"},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.Condition", "sigs.k8s.io/gateway-api/apis/v1.ParentReference"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apis_v1_PolicyStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "PolicyStatus defines the common attributes that all Policies should include within their status.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"ancestors": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-type": "atomic",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "Ancestors is a list of ancestor resources (usually Gateways) that are associated with the policy, and the status of the policy with respect to each ancestor. When this policy attaches to a parent, the controller that manages the parent and the ancestors MUST add an entry to this list when the controller first sees the policy and SHOULD update the entry as appropriate when the relevant ancestor is modified.\n\nNote that choosing the relevant ancestor is left to the Policy designers; an important part of Policy design is designing the right object level at which to namespace this status.\n\nNote also that implementations MUST ONLY populate ancestor status for the Ancestor resources they are responsible for. Implementations MUST use the ControllerName field to uniquely identify the entries in this list that they are responsible for.\n\nNote that to achieve this, the list of PolicyAncestorStatus structs MUST be treated as a map with a composite key, made up of the AncestorRef and ControllerName fields combined.\n\nA maximum of 16 ancestors will be represented in this list. An empty list means the Policy is not relevant for any ancestors.\n\nIf this slice is full, implementations MUST NOT add further entries. Instead they MUST consider the policy unimplementable and signal that on any related resources such as the ancestor that would be referenced here. For example, if this list was full on BackendTLSPolicy, no additional Gateways would be able to reference the Service targeted by the BackendTLSPolicy.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1.PolicyAncestorStatus"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"ancestors"},
+			},
+		},
+		Dependencies: []string{
+			"sigs.k8s.io/gateway-api/apis/v1.PolicyAncestorStatus"},
+	}
+}
+
 func schema_sigsk8sio_gateway_api_apis_v1_RouteGroupKind(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
+				Description: "RouteGroupKind indicates the group and kind of a Route resource.",
+				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
 						SchemaProps: spec.SchemaProps{
@@ -6181,7 +6660,8 @@ func schema_sigsk8sio_gateway_api_apis_v1_SessionPersistence(ref common.Referenc
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
+				Description: "SessionPersistence defines the desired state of SessionPersistence.",
+				Type:        []string{"object"},
 				Properties: map[string]spec.Schema{
 					"sessionName": {
 						SchemaProps: spec.SchemaProps{
@@ -6225,6 +6705,42 @@ func schema_sigsk8sio_gateway_api_apis_v1_SessionPersistence(ref common.Referenc
 	}
 }
 
+func schema_sigsk8sio_gateway_api_apis_v1_SubjectAltName(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "SubjectAltName represents Subject Alternative Name.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"type": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Type determines the format of the Subject Alternative Name. Always required.\n\nSupport: Core",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"hostname": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Hostname contains Subject Alternative Name specified in DNS name format. Required when Type is set to Hostname, ignored otherwise.\n\nSupport: Core",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"uri": {
+						SchemaProps: spec.SchemaProps{
+							Description: "URI contains Subject Alternative Name specified in a full URI format. It MUST include both a scheme (e.g., \"http\" or \"ftp\") and a scheme-specific-part. Common values include SPIFFE IDs like \"spiffe://mycluster.example.com/ns/myns/sa/svc1sa\". Required when Type is set to URI, ignored otherwise.\n\nSupport: Core",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"type"},
+			},
+		},
+	}
+}
+
 func schema_sigsk8sio_gateway_api_apis_v1_SupportedFeature(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -6455,8 +6971,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_LocalPolicyTargetReferenceWithSe
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a direct policy to. This should be used as part of Policy resources that can target single resources. For more information on how this policy attachment mode works, and a sample Policy resource, refer to the policy attachment documentation for Gateway API.\n\nNote: This should only be used for direct policy attachment when references to SectionName are actually needed. In all other cases, LocalPolicyTargetReference should be used.",
-				Type:        []string{"object"},
+				Type: []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
 						SchemaProps: spec.SchemaProps{
@@ -6500,8 +7015,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_NamespacedPolicyTargetReference(
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "NamespacedPolicyTargetReference identifies an API object to apply a direct or inherited policy to, potentially in a different namespace. This should only be used as part of Policy resources that need to be able to target resources in different namespaces. For more information on how this policy attachment model works, and a sample Policy resource, refer to the policy attachment documentation for Gateway API.",
-				Type:        []string{"object"},
+				Type: []string{"object"},
 				Properties: map[string]spec.Schema{
 					"group": {
 						SchemaProps: spec.SchemaProps{
@@ -6545,8 +7059,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_PolicyAncestorStatus(ref common.
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "PolicyAncestorStatus describes the status of a route with respect to an associated Ancestor.\n\nAncestors refer to objects that are either the Target of a policy or above it in terms of object hierarchy. For example, if a policy targets a Service, the Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most useful object to place Policy status on, so we recommend that implementations SHOULD use Gateway as the PolicyAncestorStatus object unless the designers have a _very_ good reason otherwise.\n\nIn the context of policy attachment, the Ancestor is used to distinguish which resource results in a distinct application of this policy. For example, if a policy targets a Service, it may have a distinct result per attached Gateway.\n\nPolicies targeting the same resource may have different effects depending on the ancestors of those resources. For example, different Gateways targeting the same Service may have different capabilities, especially if they have different underlying implementations.\n\nFor example, in BackendTLSPolicy, the Policy attaches to a Service that is used as a backend in a HTTPRoute that is itself attached to a Gateway. In this case, the relevant object for status is the Gateway, and that is the ancestor object referred to in this status.\n\nNote that a parent is also an ancestor, so for objects where the parent is the relevant object for status, this struct SHOULD still be used.\n\nThis struct is intended to be used in a slice that's effectively a map, with a composite key made up of the AncestorRef and the ControllerName.",
-				Type:        []string{"object"},
+				Type: []string{"object"},
 				Properties: map[string]spec.Schema{
 					"ancestorRef": {
 						SchemaProps: spec.SchemaProps{
@@ -6613,7 +7126,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_PolicyStatus(ref common.Referenc
 								Schema: &spec.Schema{
 									SchemaProps: spec.SchemaProps{
 										Default: map[string]interface{}{},
-										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1alpha2.PolicyAncestorStatus"),
+										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1.PolicyAncestorStatus"),
 									},
 								},
 							},
@@ -6624,7 +7137,7 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_PolicyStatus(ref common.Referenc
 			},
 		},
 		Dependencies: []string{
-			"sigs.k8s.io/gateway-api/apis/v1alpha2.PolicyAncestorStatus"},
+			"sigs.k8s.io/gateway-api/apis/v1.PolicyAncestorStatus"},
 	}
 }
 
@@ -6886,6 +7399,13 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_TCPRouteSpec(ref common.Referenc
 							},
 						},
 					},
+					"useDefaultGateways": {
+						SchemaProps: spec.SchemaProps{
+							Description: "UseDefaultGateways indicates the default Gateway scope to use for this Route. If unset (the default) or set to None, the Route will not be attached to any default Gateway; if set, it will be attached to any default Gateway supporting the named scope, subject to the usual rules about which Routes a Gateway is allowed to claim.\n\nThink carefully before using this functionality! The set of default Gateways supporting the requested scope can change over time without any notice to the Route author, and in many situations it will not be appropriate to request a default Gateway for a given Route -- for example, a Route with specific security requirements should almost certainly not use a default Gateway.\n\n<gateway:experimental>",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 					"rules": {
 						VendorExtensible: spec.VendorExtensible{
 							Extensions: spec.Extensions{
@@ -7116,6 +7636,13 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_TLSRouteSpec(ref common.Referenc
 							},
 						},
 					},
+					"useDefaultGateways": {
+						SchemaProps: spec.SchemaProps{
+							Description: "UseDefaultGateways indicates the default Gateway scope to use for this Route. If unset (the default) or set to None, the Route will not be attached to any default Gateway; if set, it will be attached to any default Gateway supporting the named scope, subject to the usual rules about which Routes a Gateway is allowed to claim.\n\nThink carefully before using this functionality! The set of default Gateways supporting the requested scope can change over time without any notice to the Route author, and in many situations it will not be appropriate to request a default Gateway for a given Route -- for example, a Route with specific security requirements should almost certainly not use a default Gateway.\n\n<gateway:experimental>",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 					"hostnames": {
 						VendorExtensible: spec.VendorExtensible{
 							Extensions: spec.Extensions{
@@ -7366,6 +7893,13 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_UDPRouteSpec(ref common.Referenc
 							},
 						},
 					},
+					"useDefaultGateways": {
+						SchemaProps: spec.SchemaProps{
+							Description: "UseDefaultGateways indicates the default Gateway scope to use for this Route. If unset (the default) or set to None, the Route will not be attached to any default Gateway; if set, it will be attached to any default Gateway supporting the named scope, subject to the usual rules about which Routes a Gateway is allowed to claim.\n\nThink carefully before using this functionality! The set of default Gateways supporting the requested scope can change over time without any notice to the Route author, and in many situations it will not be appropriate to request a default Gateway for a given Route -- for example, a Route with specific security requirements should almost certainly not use a default Gateway.\n\n<gateway:experimental>",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 					"rules": {
 						VendorExtensible: spec.VendorExtensible{
 							Extensions: spec.Extensions{
@@ -7432,267 +7966,97 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha2_UDPRouteStatus(ref common.Refere
 func schema_sigsk8sio_gateway_api_apis_v1alpha3_BackendTLSPolicy(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "BackendTLSPolicy provides a way to configure how a Gateway connects to a Backend via TLS.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
-						},
-					},
-					"spec": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Spec defines the desired state of BackendTLSPolicy.",
-							Default:     map[string]interface{}{},
-							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1alpha3.BackendTLSPolicySpec"),
-						},
-					},
-					"status": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Status defines the current state of BackendTLSPolicy.",
-							Default:     map[string]interface{}{},
-							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1alpha2.PolicyStatus"),
-						},
-					},
-				},
-				Required: []string{"spec"},
-			},
-		},
-		Dependencies: []string{
-			"k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta", "sigs.k8s.io/gateway-api/apis/v1alpha2.PolicyStatus", "sigs.k8s.io/gateway-api/apis/v1alpha3.BackendTLSPolicySpec"},
-	}
-}
-
-func schema_sigsk8sio_gateway_api_apis_v1alpha3_BackendTLSPolicyList(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "BackendTLSPolicyList contains a list of BackendTLSPolicies",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"kind": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"apiVersion": {
-						SchemaProps: spec.SchemaProps{
-							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
-							Type:        []string{"string"},
-							Format:      "",
-						},
-					},
-					"metadata": {
-						SchemaProps: spec.SchemaProps{
-							Default: map[string]interface{}{},
-							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
-						},
-					},
-					"items": {
-						SchemaProps: spec.SchemaProps{
-							Type: []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Default: map[string]interface{}{},
-										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1alpha3.BackendTLSPolicy"),
-									},
-								},
-							},
-						},
-					},
-				},
-				Required: []string{"items"},
-			},
-		},
-		Dependencies: []string{
-			"k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta", "sigs.k8s.io/gateway-api/apis/v1alpha3.BackendTLSPolicy"},
-	}
-}
-
-func schema_sigsk8sio_gateway_api_apis_v1alpha3_BackendTLSPolicySpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "BackendTLSPolicySpec defines the desired state of BackendTLSPolicy.\n\nSupport: Extended",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"targetRefs": {
-						VendorExtensible: spec.VendorExtensible{
-							Extensions: spec.Extensions{
-								"x-kubernetes-list-type": "atomic",
-							},
-						},
-						SchemaProps: spec.SchemaProps{
-							Description: "TargetRefs identifies an API object to apply the policy to. Only Services have Extended support. Implementations MAY support additional objects, with Implementation Specific support. Note that this config applies to the entire referenced resource by default, but this default may change in the future to provide a more granular application of the policy.\n\nTargetRefs must be _distinct_. This means either that:\n\n* They select different targets. If this is the case, then targetRef\n  entries are distinct. In terms of fields, this means that the\n  multi-part key defined by `group`, `kind`, and `name` must\n  be unique across all targetRef entries in the BackendTLSPolicy.\n* They select different sectionNames in the same target.\n\nSupport: Extended for Kubernetes Service\n\nSupport: Implementation-specific for any other resource",
-							Type:        []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Default: map[string]interface{}{},
-										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1alpha2.LocalPolicyTargetReferenceWithSectionName"),
-									},
-								},
-							},
-						},
-					},
-					"validation": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Validation contains backend TLS validation configuration.",
-							Default:     map[string]interface{}{},
-							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1alpha3.BackendTLSPolicyValidation"),
-						},
-					},
-					"options": {
-						SchemaProps: spec.SchemaProps{
-							Description: "Options are a list of key/value pairs to enable extended TLS configuration for each implementation. For example, configuring the minimum TLS version or supported cipher suites.\n\nA set of common keys MAY be defined by the API in the future. To avoid any ambiguity, implementation-specific definitions MUST use domain-prefixed names, such as `example.com/my-custom-option`. Un-prefixed names are reserved for key names defined by Gateway API.\n\nSupport: Implementation-specific",
-							Type:        []string{"object"},
-							AdditionalProperties: &spec.SchemaOrBool{
-								Allows: true,
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Default: "",
-										Type:    []string{"string"},
-										Format:  "",
-									},
-								},
-							},
-						},
-					},
-				},
-				Required: []string{"targetRefs", "validation"},
-			},
-		},
-		Dependencies: []string{
-			"sigs.k8s.io/gateway-api/apis/v1alpha2.LocalPolicyTargetReferenceWithSectionName", "sigs.k8s.io/gateway-api/apis/v1alpha3.BackendTLSPolicyValidation"},
-	}
-}
-
-func schema_sigsk8sio_gateway_api_apis_v1alpha3_BackendTLSPolicyValidation(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Description: "BackendTLSPolicyValidation contains backend TLS validation configuration.",
-				Type:        []string{"object"},
-				Properties: map[string]spec.Schema{
-					"caCertificateRefs": {
-						VendorExtensible: spec.VendorExtensible{
-							Extensions: spec.Extensions{
-								"x-kubernetes-list-type": "atomic",
-							},
-						},
-						SchemaProps: spec.SchemaProps{
-							Description: "CACertificateRefs contains one or more references to Kubernetes objects that contain a PEM-encoded TLS CA certificate bundle, which is used to validate a TLS handshake between the Gateway and backend Pod.\n\nIf CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified, not both. If CACertificateRefs is empty or unspecified, the configuration for WellKnownCACertificates MUST be honored instead if supported by the implementation.\n\nA CACertificateRef is invalid if:\n\n* It refers to a resource that cannot be resolved (e.g., the referenced resource\n  does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key\n  named `ca.crt`). In this case, the Reason must be set to `InvalidCACertificateRef`\n  and the Message of the Condition must indicate which reference is invalid and why.\n\n* It refers to an unknown or unsupported kind of resource. In this case, the Reason\n  must be set to `InvalidKind` and the Message of the Condition must explain which\n  kind of resource is unknown or unsupported.\n\n* It refers to a resource in another namespace. This may change in future\n  spec updates.\n\nImplementations MAY choose to perform further validation of the certificate content (e.g., checking expiry or enforcing specific formats). In such cases, an implementation-specific Reason and Message must be set for the invalid reference.\n\nIn all cases, the implementation MUST ensure the `ResolvedRefs` Condition on the BackendTLSPolicy is set to `status: False`, with a Reason and Message that indicate the cause of the error. Connections using an invalid CACertificateRef MUST fail, and the client MUST receive an HTTP 5xx error response. If ALL CACertificateRefs are invalid, the implementation MUST also ensure the `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with a Reason `NoValidCACertificate`.\n\nA single CACertificateRef to a Kubernetes ConfigMap kind has \"Core\" support. Implementations MAY choose to support attaching multiple certificates to a backend, but this behavior is implementation-specific.\n\nSupport: Core - An optional single reference to a Kubernetes ConfigMap, with the CA certificate in a key named `ca.crt`.\n\nSupport: Implementation-specific - More than one reference, other kinds of resources, or a single reference that includes multiple certificates.",
-							Type:        []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Default: map[string]interface{}{},
-										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1.LocalObjectReference"),
-									},
-								},
-							},
-						},
-					},
-					"wellKnownCACertificates": {
-						VendorExtensible: spec.VendorExtensible{
-							Extensions: spec.Extensions{
-								"x-kubernetes-list-type": "atomic",
-							},
-						},
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
 						SchemaProps: spec.SchemaProps{
-							Description: "WellKnownCACertificates specifies whether system CA certificates may be used in the TLS handshake between the gateway and backend pod.\n\nIf WellKnownCACertificates is unspecified or empty (\"\"), then CACertificateRefs must be specified with at least one entry for a valid configuration. Only one of CACertificateRefs or WellKnownCACertificates may be specified, not both. If an implementation does not support the WellKnownCACertificates field, or the supplied value is not recognized, the implementation MUST ensure the `Accepted` Condition on the BackendTLSPolicy is set to `status: False`, with a Reason `Invalid`.\n\nSupport: Implementation-specific",
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
 							Type:        []string{"string"},
 							Format:      "",
 						},
 					},
-					"hostname": {
+					"apiVersion": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Hostname is used for two purposes in the connection between Gateways and backends:\n\n1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066). 2. Hostname MUST be used for authentication and MUST match the certificate served by the matching backend, unless SubjectAltNames is specified.\n\nSupport: Core",
-							Default:     "",
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
 							Type:        []string{"string"},
 							Format:      "",
 						},
 					},
-					"subjectAltNames": {
-						VendorExtensible: spec.VendorExtensible{
-							Extensions: spec.Extensions{
-								"x-kubernetes-list-type": "atomic",
-							},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
 						},
+					},
+					"spec": {
 						SchemaProps: spec.SchemaProps{
-							Description: "SubjectAltNames contains one or more Subject Alternative Names. When specified the certificate served from the backend MUST have at least one Subject Alternate Name matching one of the specified SubjectAltNames.\n\nSupport: Extended",
-							Type:        []string{"array"},
-							Items: &spec.SchemaOrArray{
-								Schema: &spec.Schema{
-									SchemaProps: spec.SchemaProps{
-										Default: map[string]interface{}{},
-										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1alpha3.SubjectAltName"),
-									},
-								},
-							},
+							Description: "Spec defines the desired state of BackendTLSPolicy.",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.BackendTLSPolicySpec"),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Status defines the current state of BackendTLSPolicy.",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.PolicyStatus"),
 						},
 					},
 				},
-				Required: []string{"hostname"},
+				Required: []string{"spec"},
 			},
 		},
 		Dependencies: []string{
-			"sigs.k8s.io/gateway-api/apis/v1.LocalObjectReference", "sigs.k8s.io/gateway-api/apis/v1alpha3.SubjectAltName"},
+			"k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta", "sigs.k8s.io/gateway-api/apis/v1.BackendTLSPolicySpec", "sigs.k8s.io/gateway-api/apis/v1.PolicyStatus"},
 	}
 }
 
-func schema_sigsk8sio_gateway_api_apis_v1alpha3_SubjectAltName(ref common.ReferenceCallback) common.OpenAPIDefinition {
+func schema_sigsk8sio_gateway_api_apis_v1alpha3_BackendTLSPolicyList(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
 			SchemaProps: spec.SchemaProps{
-				Description: "SubjectAltName represents Subject Alternative Name.",
-				Type:        []string{"object"},
+				Type: []string{"object"},
 				Properties: map[string]spec.Schema{
-					"type": {
+					"kind": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Type determines the format of the Subject Alternative Name. Always required.\n\nSupport: Core",
-							Default:     "",
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
 							Type:        []string{"string"},
 							Format:      "",
 						},
 					},
-					"hostname": {
+					"apiVersion": {
 						SchemaProps: spec.SchemaProps{
-							Description: "Hostname contains Subject Alternative Name specified in DNS name format. Required when Type is set to Hostname, ignored otherwise.\n\nSupport: Core",
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
 							Type:        []string{"string"},
 							Format:      "",
 						},
 					},
-					"uri": {
+					"metadata": {
 						SchemaProps: spec.SchemaProps{
-							Description: "URI contains Subject Alternative Name specified in a full URI format. It MUST include both a scheme (e.g., \"http\" or \"ftp\") and a scheme-specific-part. Common values include SPIFFE IDs like \"spiffe://mycluster.example.com/ns/myns/sa/svc1sa\". Required when Type is set to URI, ignored otherwise.\n\nSupport: Core",
-							Type:        []string{"string"},
-							Format:      "",
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1alpha3.BackendTLSPolicy"),
+									},
+								},
+							},
 						},
 					},
 				},
-				Required: []string{"type"},
+				Required: []string{"items"},
 			},
 		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta", "sigs.k8s.io/gateway-api/apis/v1alpha3.BackendTLSPolicy"},
 	}
 }
 
@@ -7821,6 +8185,13 @@ func schema_sigsk8sio_gateway_api_apis_v1alpha3_TLSRouteSpec(ref common.Referenc
 							},
 						},
 					},
+					"useDefaultGateways": {
+						SchemaProps: spec.SchemaProps{
+							Description: "UseDefaultGateways indicates the default Gateway scope to use for this Route. If unset (the default) or set to None, the Route will not be attached to any default Gateway; if set, it will be attached to any default Gateway supporting the named scope, subject to the usual rules about which Routes a Gateway is allowed to claim.\n\nThink carefully before using this functionality! The set of default Gateways supporting the requested scope can change over time without any notice to the Route author, and in many situations it will not be appropriate to request a default Gateway for a given Route -- for example, a Route with specific security requirements should almost certainly not use a default Gateway.\n\n<gateway:experimental>",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
 					"hostnames": {
 						VendorExtensible: spec.VendorExtensible{
 							Extensions: spec.Extensions{
@@ -8411,7 +8782,7 @@ func schema_sigsk8sio_gateway_api_apisx_v1alpha1_BackendTrafficPolicySpec(ref co
 								Schema: &spec.Schema{
 									SchemaProps: spec.SchemaProps{
 										Default: map[string]interface{}{},
-										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1alpha2.LocalPolicyTargetReference"),
+										Ref:     ref("sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference"),
 									},
 								},
 							},
@@ -8434,7 +8805,7 @@ func schema_sigsk8sio_gateway_api_apisx_v1alpha1_BackendTrafficPolicySpec(ref co
 			},
 		},
 		Dependencies: []string{
-			"sigs.k8s.io/gateway-api/apis/v1.SessionPersistence", "sigs.k8s.io/gateway-api/apis/v1alpha2.LocalPolicyTargetReference", "sigs.k8s.io/gateway-api/apisx/v1alpha1.RetryConstraint"},
+			"sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference", "sigs.k8s.io/gateway-api/apis/v1.SessionPersistence", "sigs.k8s.io/gateway-api/apisx/v1alpha1.RetryConstraint"},
 	}
 }
 
@@ -8706,6 +9077,101 @@ func schema_sigsk8sio_gateway_api_apisx_v1alpha1_ListenerSetStatus(ref common.Re
 	}
 }
 
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_MeshSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "MeshSpec defines the desired state of an XMesh.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"controllerName": {
+						SchemaProps: spec.SchemaProps{
+							Description: "ControllerName is the name of a controller that is managing Gateway API resources for mesh traffic management. The value of this field MUST be a domain prefixed path.\n\nExample: \"example.com/awesome-mesh\".\n\nThis field is not mutable and cannot be empty.\n\nSupport: Core",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"parametersRef": {
+						SchemaProps: spec.SchemaProps{
+							Description: "ParametersRef is an optional reference to a resource that contains implementation-specific configuration for this Mesh. If no implementation-specific parameters are needed, this field MUST be omitted.\n\nParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap, or an implementation-specific custom resource. The resource can be cluster-scoped or namespace-scoped.\n\nIf the referent cannot be found, refers to an unsupported kind, or when the data within that resource is malformed, the Mesh MUST be rejected with the \"Accepted\" status condition set to \"False\" and an \"InvalidParameters\" reason.\n\nSupport: Implementation-specific",
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.ParametersReference"),
+						},
+					},
+					"description": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Description optionally provides a human-readable description of a Mesh.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"controllerName"},
+			},
+		},
+		Dependencies: []string{
+			"sigs.k8s.io/gateway-api/apis/v1.ParametersReference"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_MeshStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "MeshStatus is the current status for the Mesh.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"conditions": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"type",
+								},
+								"x-kubernetes-list-type": "map",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "Conditions is the current status from the controller for this Mesh.\n\nControllers should prefer to publish conditions using values of MeshConditionType for the type of each Condition.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.Condition"),
+									},
+								},
+							},
+						},
+					},
+					"supportedFeatures": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"name",
+								},
+								"x-kubernetes-list-type": "map",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "SupportedFeatures is the set of features the Mesh support. It MUST be sorted in ascending alphabetical order by the Name key.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Ref: ref("sigs.k8s.io/gateway-api/apis/v1.SupportedFeature"),
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.Condition", "sigs.k8s.io/gateway-api/apis/v1.SupportedFeature"},
+	}
+}
+
 func schema_sigsk8sio_gateway_api_apisx_v1alpha1_ParentGatewayReference(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -8841,7 +9307,7 @@ func schema_sigsk8sio_gateway_api_apisx_v1alpha1_XBackendTrafficPolicy(ref commo
 						SchemaProps: spec.SchemaProps{
 							Description: "Status defines the current state of BackendTrafficPolicy.",
 							Default:     map[string]interface{}{},
-							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1alpha2.PolicyStatus"),
+							Ref:         ref("sigs.k8s.io/gateway-api/apis/v1.PolicyStatus"),
 						},
 					},
 				},
@@ -8849,7 +9315,7 @@ func schema_sigsk8sio_gateway_api_apisx_v1alpha1_XBackendTrafficPolicy(ref commo
 			},
 		},
 		Dependencies: []string{
-			"k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta", "sigs.k8s.io/gateway-api/apis/v1alpha2.PolicyStatus", "sigs.k8s.io/gateway-api/apisx/v1alpha1.BackendTrafficPolicySpec"},
+			"k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta", "sigs.k8s.io/gateway-api/apis/v1.PolicyStatus", "sigs.k8s.io/gateway-api/apisx/v1alpha1.BackendTrafficPolicySpec"},
 	}
 }
 
@@ -8999,3 +9465,101 @@ func schema_sigsk8sio_gateway_api_apisx_v1alpha1_XListenerSetList(ref common.Ref
 			"k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta", "sigs.k8s.io/gateway-api/apisx/v1alpha1.XListenerSet"},
 	}
 }
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_XMesh(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "XMesh defines mesh-wide characteristics of a GAMMA-compliant service mesh.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
+						},
+					},
+					"spec": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Spec defines the desired state of XMesh.",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apisx/v1alpha1.MeshSpec"),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Status defines the current state of XMesh.\n\n<gateway:util:excludeFromCRD> Implementations MUST populate status on all Mesh resources which specify their controller name. </gateway:util:excludeFromCRD>",
+							Default:     map[string]interface{}{},
+							Ref:         ref("sigs.k8s.io/gateway-api/apisx/v1alpha1.MeshStatus"),
+						},
+					},
+				},
+				Required: []string{"spec"},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta", "sigs.k8s.io/gateway-api/apisx/v1alpha1.MeshSpec", "sigs.k8s.io/gateway-api/apisx/v1alpha1.MeshStatus"},
+	}
+}
+
+func schema_sigsk8sio_gateway_api_apisx_v1alpha1_XMeshList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Default: map[string]interface{}{},
+							Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Type: []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("sigs.k8s.io/gateway-api/apisx/v1alpha1.XMesh"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"items"},
+			},
+		},
+		Dependencies: []string{
+			"k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta", "sigs.k8s.io/gateway-api/apisx/v1alpha1.XMesh"},
+	}
+}
diff --git a/pkg/generator/main.go b/pkg/generator/main.go
index 1149e1a9..1559e1e6 100644
--- a/pkg/generator/main.go
+++ b/pkg/generator/main.go
@@ -23,6 +23,7 @@ import (
 	"regexp"
 	"strings"
 
+	"golang.org/x/tools/go/packages"
 	apiext "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"sigs.k8s.io/controller-tools/pkg/crd"
 	"sigs.k8s.io/controller-tools/pkg/loader"
@@ -33,11 +34,12 @@ import (
 )
 
 var standardKinds = map[string]bool{
-	"GatewayClass":   true,
-	"Gateway":        true,
-	"GRPCRoute":      true,
-	"HTTPRoute":      true,
-	"ReferenceGrant": true,
+	"GatewayClass":     true,
+	"Gateway":          true,
+	"GRPCRoute":        true,
+	"HTTPRoute":        true,
+	"ReferenceGrant":   true,
+	"BackendTLSPolicy": true,
 }
 
 // This generation code is largely copied from
@@ -134,6 +136,10 @@ func main() {
 			}
 		}
 	}
+
+	if loader.PrintErrors(roots, packages.TypeError) {
+		log.Fatalf("not all generators ran successfully")
+	}
 }
 
 func gatewayTweaksMap(channel string, props map[string]apiext.JSONSchemaProps) map[string]apiext.JSONSchemaProps {
diff --git a/pkg/gep/gepdetail.go b/pkg/gep/gepdetail.go
index a8c2d1c7..7d903ed3 100644
--- a/pkg/gep/gepdetail.go
+++ b/pkg/gep/gepdetail.go
@@ -84,9 +84,9 @@ type GEPRelationships struct {
 	// The GEP is Obsoleted by the listed GEPs.
 	ObsoletedBy []GEPRelationship `json:"obsoletedBy,omitempty"`
 	// The GEP Updates the listed GEPs.
-	Extends []GEPRelationship `json:"updates,omitempty"`
+	Extends []GEPRelationship `json:"extends,omitempty"`
 	// The GEP is Updated by the listed GEPs.
-	ExtendedBy []GEPRelationship `json:"updatedBy,omitempty"`
+	ExtendedBy []GEPRelationship `json:"extendedBy,omitempty"`
 	// The listed GEPs are relevant for some other reason.
 	SeeAlso []GEPRelationship `json:"seeAlso,omitempty"`
 }
diff --git a/roles/RELEASE_MANAGER.md b/roles/RELEASE_MANAGER.md
new file mode 100644
index 00000000..2fa5f0f9
--- /dev/null
+++ b/roles/RELEASE_MANAGER.md
@@ -0,0 +1,120 @@
+# Gateway API Release Manager
+
+## Overview
+
+The Gateway API release manager role is responsible for coordinating and managing the release, taking ultimate accountability for the success of the release, and ensuring that a retrospective happens.
+
+This role is based on the Release Lead role in Kubernetes SIG-Release, and is intended to be similar - a servant leader of the release, not the primary decision maker.
+
+As a Release Manager, you should expect to spend a lot of time talking to people about the status of changes, tracking changes yourself, and updating the community about what changes are in and out of scope for the release.
+
+## Authority and Responsibility
+
+The release manager has the authority to:
+
+* Bring together the project’s leadership (including maintainers and other leads) to coordinate decisions about what is in scope for the release  
+* Bring together the project’s leadership to coordinate decisions about granting extensions to deadlines in specific cases  
+* Perform the actual release  
+* Call the community (or some parts of it) together for status and retrospective meetings outside of the normal meeting cadence  
+* Remind reviewers and approvers of outstanding work that needs to be done  
+* Delegate these authorities to others (with the agreement of the maintainer team)
+
+The release manager has the responsibility to:
+
+* Ensure that the release has agreed-on dates for the final release, and for as many phases as possible. The community has indicated a clear preference for dates communicated up front as much as possible.  
+* Ensure the release happens on the agreed upon date, or as close as possible, including assisting the community in meeting agreed-upon deadlines  
+* Ensure that the community is informed about the progress of the release during the burndown process, particularly what is in and out of scope of the release. This can be by the maintenance of Github Boards or Milestones, or any other method that the Release Manager agrees with the leadership team and the community  
+* Notify feature owners if their feature is at risk of or has fallen out of scope for the release  
+* Refine the design of and improve documentation for the release process itself  
+* Prepare the change log for the release  
+* Coordinate the blog post for the release  
+* Perform the implementation page review process after the release
+
+There are some practical requirements that fall out of these lists.
+
+The release manager must
+
+* Update the community no less than weekly on work that is currently slated for the release  
+* Try to minimize the amount of reviews required in short time frames (that is, try to remind people to spread out the work across the release as much as possible, rather than happening just before or on the deadlines)
+
+## Time commitments
+
+The release manager is expected to keep both themselves and the community up to date about what is happening, which will require a reasonably large amount of time each week, and that time should be expected to increase when deadlines are approaching. You should plan on, *at a minimum*, **1 to 2 hours per working day** to begin with, with probably **half your time** spent on the release at busy times, and an **entire day or two** for the actual release cutting process.
+
+## Release dates and deadlines
+
+The Release Manager is responsible for:
+
+* Ensuring that a final release date is picked as early as possible and communicated to the community for planning purposes. This is the most important date, and should be designed so that any timing mistakes have a minimal impact on it, as the community will depend on the release being on or *very* close to this date.  
+* Ensuring that intermediate deadlines are chosen and communicated as early as possible, and that any changes to those deadlines are both discussed by the leadership team and communicated to the community well in advance of them being relevant.  
+* Ensuring that deadline extensions are kept to a minimum, and are on a case-by-case basis only. Feature leads MUST ask for extensions before they can be granted, and there MUST be enough time for the entire leadership team to see and agree with the extension before it is granted. Practically, this means that there must be a *minimum* of 24-48 hours (not counting weekends) between an extension being asked for and the deadline that is being extended.
+
+## Work examples in the current release phases
+
+### Scoping
+
+The scoping phase is about determining what will get focus in the next release.
+
+The way that the community determines what work is in scope for the release is ultimately up to the release manager, although they are expected to build some consensus amongst both the maintainers and the community about the method.
+
+In the interest of ensuring that the changes we include are what the community is interested in, and that we are doing necessary but boring work like tech debt reduction, scoping MUST involve:
+
+* Community feedback  
+* Maintainer input (to ensure we try to solve underlying issues as well as new features)  
+* Reviewer input (to ensure that we keep changes deliverable within a release cycle)  
+* Ensuring that features are moving towards Standard, and are not stuck in Experimental
+
+In all cases, the Release Manager *must* ensure that all the factors involved in the scoping decisions are publicly available.
+
+For example, for v1.4, we had scoping performed using the votes on the Github discussions that proposed inclusion (which are publicly visible, and attributable to individuals), and for v1.3, we used community votes plus some additional factors like “difficulty of change” and “future importance”. In the v1.3 case, those weights were agreed upon by the maintainers and made available in a [world-readable Google sheet](https://docs.google.com/spreadsheets/d/1tLVmYHCyVuRLwnvMJuYMhiEtVX0fUF1aLHBLIc7mBKE/edit?gid=0#gid=0).
+
+### GEP Refinement
+
+The GEP refinement phase is about getting the agreed-upon GEPs to the phase they need to be at so that required API changes can be made in the next phase.
+
+Generally, this involves the feature owners pushing PRs with their proposed changes, and their reviewer sponsor coordinating getting the changes reviewed.
+
+The release manager’s most important role here is reminding everyone what changes are on the table, and poking feature owners to ensure they are actually working on the required changes. This is *much* more work than it sounds, particularly because contentious changes can often run to hundreds of comments that need to be tracked and followed up.
+
+Generally, tracking requested changes should be the role of the feature owner and/or the reviewer sponsor, but the Release Manager should feel confident to chase things that look like they may have been missed.
+
+The Release Manager is encouraged to set deadlines within this phase for gates like “GEP PR is open” “GEP PR is merged at Provisional”, “GEP PR is merged at Implementable”. Note that once a GEP is Implementable, this phase is complete for that GEP.
+
+The Release Manager should also feel free to perform reviews themselves if they have the context and bandwidth to do so.
+
+The Release Manager is responsible for notifying feature owners if their feature has fallen out of scope due to missing deadlines.
+
+The Release Manager is the final arbiter for approving extensions for deadlines in this phase, and should do so *only* if the extension is requested in public, and on a case-by-case basis. No extensions for everything.
+
+### API implementation phase
+
+In this phase, we expect to merge any required changes to the API itself into the repo, preferably with conformance tests to ensure that implementations do things correctly when implementing the new changes.
+
+The Release Manager’s role here is to:
+
+* Keep track of changes as they happen  
+* Remind feature owners of upcoming deadlines  
+* Communicate what features are ongoing, what at risk, and what are out of scope  
+* Ensure that deadlines are met  
+* Grant extensions for deadlines, if required, on a case-by-case basis. 
+
+Generally, in this phase, most of the changes are relatively straightforward, as most argument happens during the design phase in GEP Refinement. However, sometimes actually making the changes to the API, and in particular writing conformance tests, can show problems with the APIs as designed that may need further API changes to fix. Part of the Release Manager’s role is to be the arbiter of judgement calls about if further API changes are deliverable in the required timeframe, or if the change should be pushed back to the next version.
+
+### API Review and Release Candidate phase
+
+In this phase, we MUST get sign-off from SIG-Network API reviewers for *all* API changes. This is a requirement of having an official [`k8s.io`](http://k8s.io) API, and is not negotiable. Practically, API reviewers are usually very busy, and it can be difficult to get time with them, so it’s important to ensure that all the pending API changes are completed before getting the API reviewers to look.
+
+The API reviewers *may* review an RC build, which would coincide with making the RC available to the community. That does run the risk that early implementers may need to change things as a result of API review feedback (this has definitely happened before).
+
+The Release Candidate builds are intended to allow implementations to get started on actually implementing the API changes from the release early, so that they can provide feedback about the implementation experience, and source early user feedback if possible.
+
+We generally try to do at least two candidate releases, with the requirement being that there MUST NOT be any changes between the final RC and the actual release.
+
+## Measuring success
+
+Getting a release out at all is a success!
+
+But to be able to quantify releases a bit, and evaluate if changes to the release process are helping or not, we track some metrics about each release, which can be summarized into two main buckets:
+
+* Release size (How many features, and how large is each feature? How many new conformance tests added? Any process changes during the release timeframe?)  
+* Release timeliness (Was the release released on the targeted date? Did we meet agreed upon deadlines within the release schedule? How many extensions did we need to grant during the release?)
diff --git a/site-src/api-types/backendtlspolicy.md b/site-src/api-types/backendtlspolicy.md
index ac57bd04..084d338e 100644
--- a/site-src/api-types/backendtlspolicy.md
+++ b/site-src/api-types/backendtlspolicy.md
@@ -36,11 +36,13 @@ The specification of a [BackendTLSPolicy][backendtlspolicy] consists of:
 - [Validation][validation] - Defines the configuration for TLS, including hostname, CACertificateRefs, and
 WellKnownCACertificates.
 - [Hostname][hostname] - Defines the Server Name Indication (SNI) that the Gateway uses to connect to the backend.
+- [SubjectAltNames][subjectAltNames] - Specifies one or more Subject Alternative Names that the backend certificate must match. When specified, the certificate must have at least one matching SAN. This field enables separation between SNI (hostname) and certificate identity validation.  A maximum of 5 SANs are allowed.  
 - [CACertificateRefs][caCertificateRefs] - Defines one or more references to objects that contain PEM-encoded TLS certificates,
 which are used to establish a TLS handshake between the Gateway and backend Pod.  Either CACertificateRefs or
 WellKnownCACertificates may be specified, but not both.
 - [WellKnownCACertificates][wellKnownCACertificates] - Specifies whether system CA certificates may be used in the TLS
 handshake between the Gateway and backend Pod.  Either CACertificateRefs or WellKnownCACertificates may be specified, but not both.
+- [Options][options] - A map of key/value pairs enabling extended TLS configuration for implementations that choose to provide support.  Check your implementation's documentation for details.  
 
 The following chart outlines the object definitions and relationship:
 ```mermaid
@@ -48,7 +50,7 @@ flowchart LR
     backendTLSPolicy[["<b>backendTLSPolicy</b> <hr><align=left>BackendTLSPolicySpec: spec<br>PolicyStatus: status</align>"]]
     spec[["<b>spec</b><hr>PolicyTargetReferenceWithSectionName: targetRefs <br> BackendTLSPolicyValidation: tls"]]
     status[["<b>status</b><hr>[ ]PolicyAncestorStatus: ancestors"]]
-    validation[["<b>tls</b><hr>LocalObjectReference: caCertificateRefs<br>wellKnownCACertificatesType: wellKnownCACertificates/<br>PreciseHostname: hostname"]]
+    validation[["<b>tls</b><hr>LocalObjectReference: caCertificateRefs<br>wellKnownCACertificatesType: wellKnownCACertificates<br>PreciseHostname: hostname<br>[]SubjectAltName: subjectAltNames"]]  
     ancestorStatus[["<b>ancestors</b><hr>AncestorRef: parentReference<br>GatewayController: controllerName<br>[]Condition: conditions"]]
     targetRefs[[<b>targetRefs</b><hr>]]
     service["<b>service</>"]
@@ -111,6 +113,34 @@ Also note:
 
     - Wildcard hostnames are not allowed.
 
+#### Subject Alternative Names
+
+??? example "Experimental Channel since v1.2.0"
+
+    This field was added to BackendTLSPolicy in `v1.2.0`
+The subjectAltNames field enables basic mutual TLS configuration between Gateways and backends, as well as the optional use of SPIFFE. When subjectAltNames is specified, the certificate served by the backend must have at least one Subject Alternative Name matching one of the specified values. This is particularly useful for SPIFFE implementations where URI-based SANs may not be valid SNIs.  
+Subject Alternative Names may contain one of either a Hostname or URI field, and must contain a Type specifying whether Hostname or URI is chosen.  
+
+!!! info "Restrictions"  
+
+    - IP addresses and wildcard hostnames are not allowed. (see the description for Hostname above for more details). 
+    - Hostname: DNS name format
+    - URI: URI format (e.g., SPIFFE ID)
+
+#### TLS Options
+
+??? example "Experimental Channel since v1.2.0"
+
+    This field was added to BackendTLSPolicy in `v1.2.0`
+The options field allows specification of implementation-specific TLS configurations. This can include:  
+
+- Vendor-specific mutual TLS automation configuration  
+- Minimum supported TLS version restrictions
+- Supported cipher suite configurations
+
+Check your implementation documentation for details.  
+
+###
 #### Certificates
 
 The BackendTLSPolicyValidation must contain a certificate reference of some kind, and contains two ways to configure the
@@ -145,4 +175,6 @@ uses `PolicyAncestorStatus` to allow you to know which parentReference set that
 [wellKnownCACertificates]: ../reference/spec.md#gateway.networking.k8s.io/v1alpha3.BackendTLSPolicyValidation.WellKnownCACertificates
 [hostname]: ../reference/spec.md#gateway.networking.k8s.io/v1.PreciseHostname
 [rfc-3986]: https://tools.ietf.org/html/rfc3986
-[targetRefs]: ../reference/spec.md#gateway.networking.k8s.io/v1alpha2.PolicyTargetReference
+[targetRefs]: ../references/spec/#gateway.networking.k8s.io/v1alpha2.PolicyTargetReference
+[subjectAltNames]: ../references/spec/#gateway.networking.k8s.io/v1alpha3.BackendTLSPolicyValidation 
+[options]: ../references/spec/#gateway.networking.k8s.io/v1alpha3.GatewayTLSConfig
diff --git a/site-src/concepts/api-overview.md b/site-src/concepts/api-overview.md
index 20db51b0..e220471e 100644
--- a/site-src/concepts/api-overview.md
+++ b/site-src/concepts/api-overview.md
@@ -116,9 +116,11 @@ modifying them in-flight.
     our [versioning guide](versioning.md).
 
 TLSRoute is for multiplexing TLS connections, discriminated via SNI. It's intended
-for where you want to use the SNI as the main routing method, and are not interested
-in properties of the higher-level protocols like HTTP.  The byte stream of the
-connection is proxied without any inspection to the backend.
+for where you want to route based on TLS metadata, and are not interested in properties
+of the higher-level protocols like HTTP. When using a `Passthrough` TLS listener, the
+encrypted byte stream of the connection is proxied directly to the destination backend,
+which is then responsible for decrypting the stream. When using a `Terminate` TLS
+listener, encryption is terminated at the gateway.
 
 #### TCPRoute and UDPRoute
 
@@ -157,7 +159,7 @@ to allow multiple Routes to share ports on the Listener.
 |------|---------|---------------------|-----------|-------|
 |HTTPRoute| Layer 7 | Anything in the HTTP Protocol | Terminated only | HTTP and HTTPS Routing|
 |TLSRoute| Somewhere between layer 4 and 7| SNI or other TLS properties| Passthrough or Terminated | Routing of TLS protocols including HTTPS where inspection of the HTTP stream is not required.|
-|TCPRoute| Layer 4| destination port | Passthrough or Terminated | Allows for forwarding of a TCP stream from the Listener to the Backends |
+|TCPRoute| Layer 4| destination port | Terminated | Allows for forwarding of a TCP stream from the Listener to the Backends |
 |UDPRoute| Layer 4| destination port | None | Allows for forwarding of a UDP stream from the Listener to the Backends. |
 |GRPCRoute| Layer 7 | Anything in the gRPC Protocol | Terminated only | gRPC Routing over HTTP/2 and HTTP/2 cleartext|
 
diff --git a/site-src/concepts/tooling.md b/site-src/concepts/tooling.md
index c8e6a240..5f4e853b 100644
--- a/site-src/concepts/tooling.md
+++ b/site-src/concepts/tooling.md
@@ -14,6 +14,12 @@ A command line tool for managing your Gateway API resources. Explore your polici
 
 Get started with [kubernetes-sigs/gwctl: installation](https://github.com/kubernetes-sigs/gwctl?tab=readme-ov-file#installation)!
 
+## `Headlamp`
+
+A UI for Kubernetes which has Gateway API support built in. View Gateway API resources in a map view, or in data tables. Updated in real time, with links between Kubernetes resources to make it easier to see relationships.
+
+Get started with [kubernetes-sigs/headlamp: installation](https://github.com/kubernetes-sigs/headlamp?tab=readme-ov-file#quickstart)!
+
 ## Third-Party Tooling
 
 ### `policy-machinery`
diff --git a/site-src/contributing/devguide.md b/site-src/contributing/devguide.md
index ee5e5bd4..ae3dfae2 100644
--- a/site-src/contributing/devguide.md
+++ b/site-src/contributing/devguide.md
@@ -61,7 +61,7 @@ outside $GOPATH as well.
 
 ### Build the Code
 
-The project uses `make` to drive the build. `make` will run code generators, and
+The project uses `make` to drive the build. `make` will clean up previously generated code, run code generators, and
 run static analysis against the code and generate Kubernetes CRDs. You can kick
 off an overall build from the top-level makefile:
 
diff --git a/site-src/guides/http-redirect-rewrite.md b/site-src/guides/http-redirect-rewrite.md
index 37a887d0..645387f5 100644
--- a/site-src/guides/http-redirect-rewrite.md
+++ b/site-src/guides/http-redirect-rewrite.md
@@ -16,6 +16,20 @@ filters](../reference/spec.md#gateway.networking.k8s.io/v1.HTTPRequestRedirectFi
 instruct Gateways to emit a redirect response to requests matching a filtered
 HTTPRoute rule.
 
+### Supported Status Codes
+
+Gateway API supports the following HTTP redirect status codes:
+
+- **301 (Moved Permanently)**: Indicates that the resource has permanently moved to a new location. Search engines and clients will update their references to use the new URL. Use this for permanent redirects like HTTP to HTTPS upgrades or permanent URL changes.
+
+- **302 (Found)**: Indicates that the resource is temporarily available at a different location. This is the default status code if none is specified. Use this for temporary redirects where the original URL may be valid again in the future.
+
+- **303 (See Other)**: Indicates that the response to the request can be found at a different URL using a GET method. This is commonly used after POST requests to redirect to a confirmation page and prevent duplicate form submissions.
+
+- **307 (Temporary Redirect)**: Similar to 302, but guarantees that the HTTP method will not change when following the redirect. Use this when you need to preserve the original HTTP method (POST, PUT, etc.) in the redirect.
+
+- **308 (Permanent Redirect)**: Similar to 301, but guarantees that the HTTP method will not change when following the redirect. Use this for permanent redirects where the HTTP method must be preserved.
+
 Redirect filters can substitute various URL components independently. For
 example, to issue a permanent redirect (301) from HTTP to HTTPS, configure
 `requestRedirect.statusCode=301` and `requestRedirect.scheme="https"`:
@@ -31,6 +45,28 @@ example, the request `GET http://redirect.example/cinnamon` will result in a
 hostname (`redirect.example`), path (`/cinnamon`), and port (implicit) remain
 unchanged.
 
+### Method-Preserving Redirects
+
+When you need to ensure that the HTTP method is preserved during a redirect, use status codes 307 or 308:
+
+```yaml
+{% include 'standard/http-redirect-rewrite/httproute-redirect-307.yaml' %}
+```
+
+For permanent redirects that must preserve the HTTP method, use status code 308:
+
+```yaml
+{% include 'standard/http-redirect-rewrite/httproute-redirect-308.yaml' %}
+```
+
+### POST-Redirect-GET Pattern
+
+For implementing the POST-Redirect-GET pattern, use status code 303 to redirect POST requests to a GET endpoint:
+
+```yaml
+{% include 'standard/http-redirect-rewrite/httproute-redirect-303.yaml' %}
+```
+
 ### HTTP-to-HTTPS redirects
 
 To redirect HTTP traffic to HTTPS, you need to have a Gateway with both HTTP
@@ -61,7 +97,9 @@ HTTPS traffic to application backends.
 
 Path redirects use an HTTP Path Modifier to replace either entire paths or path
 prefixes. For example, the HTTPRoute below will issue a 302 redirect to all
-`redirect.example` requests whose path begins with `/cayenne` to `/paprika`:
+`redirect.example` requests whose path begins with `/cayenne` to `/paprika`.
+Note that you can use any of the supported status codes (301, 302, 303, 307, 308)
+depending on your specific requirements:
 
 ```yaml
 {% include 'standard/http-redirect-rewrite/httproute-redirect-full.yaml' %}
diff --git a/site-src/guides/index.md b/site-src/guides/index.md
index 21fbe942..6d941159 100644
--- a/site-src/guides/index.md
+++ b/site-src/guides/index.md
@@ -45,7 +45,7 @@ beta, including GatewayClass, Gateway, HTTPRoute, and ReferenceGrant. To install
 this channel, run the following kubectl command:
 
 ```bash
-kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
+kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/standard-install.yaml
 ```
 
 ### Install Experimental Channel
@@ -63,7 +63,7 @@ documentation](../concepts/versioning.md).
 To install the experimental channel, run the following kubectl command:
 
 ```bash
-kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/experimental-install.yaml
+kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/experimental-install.yaml
 ```
 
 ### v1.2 Upgrade Notes
diff --git a/site-src/guides/tls.md b/site-src/guides/tls.md
index be3281ee..a7c7612a 100644
--- a/site-src/guides/tls.md
+++ b/site-src/guides/tls.md
@@ -12,7 +12,7 @@ implementation(s) you're using with Gateway API.
 
 !!! info "Experimental Channel"
 
-    The `TLSRoute` and `BackendTLSPolicy` resources described below are currently only included in the
+    The `TLSRoute` resource described below is currently only included in the
     "Experimental" channel of Gateway API. For more information on release
     channels, refer to our [versioning guide](../concepts/versioning.md).
 
@@ -26,14 +26,15 @@ For Gateways, there are two connections involved:
 - **upstream**: This is the connection between the Gateway and backend resources
    specified by routes. These backend resources will usually be Services.
 
-With Gateway API, TLS configuration of downstream and
-upstream connections is managed independently.
+With Gateway API, TLS configuration of downstream and upstream connections is 
+managed independently.
 
 For downstream connections, depending on the Listener Protocol, different TLS modes and Route types are supported.
 
 | Listener Protocol | TLS Mode    | Route Type Supported |
 |-------------------|-------------|---------------------|
 | TLS               | Passthrough | TLSRoute            |
+| TLS               | Terminate   | TLSRoute (extended) |
 | TLS               | Terminate   | TCPRoute            |
 | HTTPS             | Terminate   | HTTPRoute           |
 | GRPC              | Terminate   | GRPCRoute           |
@@ -47,6 +48,10 @@ upstream TLS configuration. For `HTTPRoute`, the use of both `Terminate` TLS mod
 Using these together provides what is commonly known as a connection that is terminated and then re-encrypted at
 the Gateway.
 
+The use of `Terminate` on `TLSRoute` is available on `Extended` [Support Level].
+
+[Support Level]: https://gateway-api.sigs.k8s.io/concepts/conformance/#2-support-levels
+
 ## Downstream TLS
 
 Downstream TLS settings are configured using listeners at the Gateway level.
@@ -145,7 +150,7 @@ TLS-encrypted upstream connection where Pods backing the `dev` Service are expec
 certificate for `dev.example.com`.
 
 ```yaml
-{% include 'experimental/v1alpha3/backendtlspolicy-system-certs.yaml' %}
+{% include 'standard/backendtlspolicy/backendtlspolicy-system-certs.yaml' %}
 ```
 
 #### Using Explicit CA Certificates
@@ -155,7 +160,7 @@ map `auth-cert` to connect with a TLS-encrypted upstream connection where Pods b
 are expected to serve a valid certificate for `auth.example.com`.
 
 ```yaml
-{% include 'experimental/v1alpha3/backendtlspolicy-ca-certs.yaml' %}
+{% include 'standard/backendtlspolicy/backendtlspolicy-ca-certs.yaml' %}
 ```
 
 ## Extensions
diff --git a/site-src/implementations.md b/site-src/implementations.md
index dc12477c..c52210e8 100644
--- a/site-src/implementations.md
+++ b/site-src/implementations.md
@@ -170,7 +170,7 @@ other functions (like managing DNS or creating certificates).
 [37]:#kgateway
 [38]:#google-cloud-service-mesh
 [39]:#kubvernor
-[40]:#agentgateway-with-kgateway
+[40]:#agent-gateway-with-kgateway
 [41]:#kruise-rollouts
 
 
@@ -199,7 +199,7 @@ In this section you will find specific links to blog posts, documentation and ot
 ### Airlock Microgateway
 [![Conformance](https://img.shields.io/badge/Gateway%20API%20Conformance%20v1.3.0-Airlock%20Microgateway-green)](https://github.com/kubernetes-sigs/gateway-api/blob/main/conformance/reports/v1.3.0/airlock-microgateway)
 
-[Airlock Microgateway][airlock-microgateway] is a Kubernetes native WAAP (Web Application and API Protection, formerly known as WAF) solution optimized for Kubernetes environments and certified for RedHat OpenShift.
+[Airlock Microgateway][airlock-microgateway] is a Kubernetes native WAAP (Web Application and API Protection, formerly known as WAF) solution optimized for Kubernetes environments and certified for Red Hat OpenShift.
 Modern application security is embedded in the development workflow and follows DevSecOps paradigms.
 Airlock Microgateway protects your applications and microservices with the tried-and-tested Airlock security features against attacks, while also providing a high degree of scalability.
 
@@ -386,7 +386,7 @@ Google Cloud Service Mesh supports [Envoy-based sidecar mesh][envoy-sidecar-mesh
 
 ### Google Kubernetes Engine
 
-[![Conformance](https://img.shields.io/badge/Gateway_API_Partial_Conformance_v1.1.0-Google_Kubernetes_Engine-orange)](https://github.com/kubernetes-sigs/gateway-api/blob/main/conformance/reports/v1.1.0/gke-gateway)
+[![Conformance](https://img.shields.io/badge/Gateway_API_Partial_Conformance_v1.3.0-Google_Kubernetes_Engine-orange)](https://github.com/kubernetes-sigs/gateway-api/blob/main/conformance/reports/v1.3.0/gke-gateway)
 
 [Google Kubernetes Engine (GKE)][gke] is a managed Kubernetes platform offered
 by Google Cloud. GKE's implementation of the Gateway API is through the [GKE
@@ -399,7 +399,7 @@ advanced routing, multi-cluster load balancing and more. See the docs to deploy
 Gateways][gke-multi-cluster-gateway].
 
 The GKE Gateway controller passes all the core Gateway API conformance tests in the
-v1.1.0 release for the GATEWAY_HTTP conformance profile except `HTTPRouteHostnameIntersection`.
+v1.3.0 release for the GATEWAY_HTTP conformance profile except `HTTPRouteHostnameIntersection`.
 
 [gke]:https://cloud.google.com/kubernetes-engine
 [gke-gateway]:https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api
@@ -600,11 +600,11 @@ STUNner currently supports version `v1alpha2` of the Gateway API specification.
 
 ### Traefik Proxy
 
-[![Conformance](https://img.shields.io/badge/Gateway%20API%20Conformance%20v1.2.1-Traefik Proxy-green)](https://github.com/kubernetes-sigs/gateway-api/blob/main/conformance/reports/v1.2.1/traefik-traefik)
+[![Conformance](https://img.shields.io/badge/Gateway%20API%20Conformance%20v1.3.0-Traefik Proxy-green)](https://github.com/kubernetes-sigs/gateway-api/blob/main/conformance/reports/v1.3.0/traefik-traefik)
 
 [Traefik Proxy][traefik-proxy] is an open source cloud-native application proxy.
 
-Traefik Proxy currently supports version `v1.2.1` of the Gateway API specification, check the [Kubernetes Gateway Provider Documentation][traefik-proxy-gateway-api-doc] for more information on how to deploy and use it.
+Traefik Proxy currently supports version `v1.3.0` of the Gateway API specification, check the [Kubernetes Gateway Provider Documentation][traefik-proxy-gateway-api-doc] for more information on how to deploy and use it.
 Traefik Proxy's implementation passes all HTTP core and some extended conformance tests, like GRPCRoute, but also supports TCPRoute and TLSRoute features from the Experimental channel.
 
 For help and support with Traefik Proxy, [create an issue][traefik-proxy-issue-new] or ask for help in the [Traefik Labs Community Forum][traefiklabs-community-forum].
diff --git a/site-src/implementations/v1.2.md b/site-src/implementations/v1.2.md
index a3728f6a..640baf0e 100644
--- a/site-src/implementations/v1.2.md
+++ b/site-src/implementations/v1.2.md
@@ -16,30 +16,30 @@ Implementations only appear in this page if they pass Core conformance for the r
 
 ### HTTPRoute
 
-| Organization    | Project                            | Version   | Mode                   | HTTPRoute Host Rewrite   | HTTPRoute Method Matching   | HTTPRoute Path Rewrite   | HTTPRoute Query Param Matching   | HTTPRoute Response Header Modification   | HTTPRoute Destination Port Matching   | HTTPRoute Path Redirect   | HTTPRoute Port Redirect   | HTTPRoute Scheme Redirect   | Gateway Infrastructure Propagation   | Gateway Port 8080   | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Timeout   | HTTPRoute Parent Ref Port   | HTTPRoute Request Timeout   | Gateway HTTP Listener Isolation   | Gateway Static Addresses   | HTTPRoute Backend Request Header Modification   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   |
-|:----------------|:-----------------------------------|:----------|:-----------------------|:-------------------------|:----------------------------|:-------------------------|:---------------------------------|:-----------------------------------------|:--------------------------------------|:--------------------------|:--------------------------|:----------------------------|:-------------------------------------|:--------------------|:---------------------------------|:----------------------------------------|:----------------------------|:----------------------------|:----------------------------|:----------------------------------|:---------------------------|:------------------------------------------------|:---------------------------|:-------------------------------------|
-| Kong            | kubernetes-ingress-controller      | v3.4.0    | expressions            | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :x:                       | :x:                       | :x:                         | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| Kong            | kubernetes-ingress-controller      | v3.4.0    | traditional_compatible | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :x:                       | :x:                       | :x:                         | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| Microsoft Azure | Application Gateway for Containers | 1.7.9     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| airlock         | microgateway                       | 4.5.0     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| airlock         | microgateway                       | 4.6.0     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| airlock         | microgateway                       | 4.7.0     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| cilium          | cilium                             | v1.17     | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :x:                         | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
-| envoyproxy      | envoy-gateway                      | latest    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :white_check_mark:                | :x:                        | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
-| istio           | istio                              | 1.24      | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
-| kgateway-dev    | kgateway                           | v2.0.0    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :x:                 | :white_check_mark:               | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :white_check_mark:         | :x:                                  |
-| kubvernor       | kubvernor                          | 0.1.0     | default                | :x:                      | :x:                         | :x:                      | :x:                              | :x:                                      | :x:                                   | :x:                       | :x:                       | :x:                         | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
-| nginx           | nginx-gateway-fabric               | v1.6.0    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :white_check_mark:                | :x:                        | :x:                                             | :white_check_mark:         | :white_check_mark:                   |
-| nginx           | nginx-gateway-fabric               | v2.0.2    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :x:                                   | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :white_check_mark:                | :x:                        | :x:                                             | :white_check_mark:         | :white_check_mark:                   |
-| projectcontour  | contour                            | v1.31.0   | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
-| traefik         | traefik                            | v3.2.2    | default                | :white_check_mark:       | :white_check_mark:          | :white_check_mark:       | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| Organization    | Project                            | Version   | Mode                   | HTTPRoute Host Rewrite   | HTTPRoute Path Rewrite   | HTTPRoute Response Header Modification   | HTTPRoute Method Matching   | HTTPRoute Query Param Matching   | HTTPRoute Destination Port Matching   | HTTPRoute Path Redirect   | HTTPRoute Port Redirect   | HTTPRoute Scheme Redirect   | Gateway Infrastructure Propagation   | Gateway Port 8080   | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Timeout   | HTTPRoute Parent Ref Port   | HTTPRoute Request Timeout   | Gateway HTTP Listener Isolation   | Gateway Static Addresses   | HTTPRoute Backend Request Header Modification   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   |
+|:----------------|:-----------------------------------|:----------|:-----------------------|:-------------------------|:-------------------------|:-----------------------------------------|:----------------------------|:---------------------------------|:--------------------------------------|:--------------------------|:--------------------------|:----------------------------|:-------------------------------------|:--------------------|:---------------------------------|:----------------------------------------|:----------------------------|:----------------------------|:----------------------------|:----------------------------------|:---------------------------|:------------------------------------------------|:---------------------------|:-------------------------------------|
+| Kong            | kubernetes-ingress-controller      | v3.4.0    | traditional_compatible | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                   | :x:                       | :x:                       | :x:                         | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| Kong            | kubernetes-ingress-controller      | v3.4.0    | expressions            | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                   | :x:                       | :x:                       | :x:                         | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| Microsoft Azure | Application Gateway for Containers | 1.7.9     | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| airlock         | microgateway                       | 4.5.0     | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| airlock         | microgateway                       | 4.6.0     | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| airlock         | microgateway                       | 4.7.0     | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| cilium          | cilium                             | v1.17     | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :x:                         | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
+| envoyproxy      | envoy-gateway                      | latest    | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :white_check_mark:                | :x:                        | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
+| istio           | istio                              | 1.24      | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
+| kgateway-dev    | kgateway                           | v2.0.0    | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                   | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :x:                 | :white_check_mark:               | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :white_check_mark:         | :x:                                  |
+| kubvernor       | kubvernor                          | 0.1.0     | default                | :x:                      | :x:                      | :x:                                      | :x:                         | :x:                              | :x:                                   | :x:                       | :x:                       | :x:                         | :x:                                  | :x:                 | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
+| nginx           | nginx-gateway-fabric               | v1.6.0    | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                   | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :white_check_mark:                | :x:                        | :x:                                             | :white_check_mark:         | :white_check_mark:                   |
+| nginx           | nginx-gateway-fabric               | v2.0.2    | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :x:                                   | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :x:                              | :x:                                     | :x:                         | :x:                         | :x:                         | :white_check_mark:                | :x:                        | :x:                                             | :white_check_mark:         | :white_check_mark:                   |
+| projectcontour  | contour                            | v1.31.0   | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:          | :white_check_mark:          | :white_check_mark:          | :white_check_mark:                | :white_check_mark:         | :white_check_mark:                              | :white_check_mark:         | :white_check_mark:                   |
+| traefik         | traefik                            | v3.2.2    | default                | :white_check_mark:       | :white_check_mark:       | :white_check_mark:                       | :white_check_mark:          | :white_check_mark:               | :white_check_mark:                    | :white_check_mark:        | :white_check_mark:        | :white_check_mark:          | :x:                                  | :white_check_mark:  | :white_check_mark:               | :white_check_mark:                      | :x:                         | :x:                         | :x:                         | :x:                               | :x:                        | :x:                                             | :x:                        | :x:                                  |
 
 ### GRPCRoute
 
 | Organization    | Project                            | Version   | Mode                   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   |
 |:----------------|:-----------------------------------|:----------|:-----------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|
-| Kong            | kubernetes-ingress-controller      | v3.4.0    | expressions            | :x:                               | :x:                                  | :x:                 | :x:                        |
 | Kong            | kubernetes-ingress-controller      | v3.4.0    | traditional_compatible | :x:                               | :x:                                  | :x:                 | :x:                        |
+| Kong            | kubernetes-ingress-controller      | v3.4.0    | expressions            | :x:                               | :x:                                  | :x:                 | :x:                        |
 | Microsoft Azure | Application Gateway for Containers | 1.7.9     | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
 | cilium          | cilium                             | v1.17     | default                | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
 | envoyproxy      | envoy-gateway                      | latest    | default                | :x:                               | :x:                                  | :x:                 | :x:                        |
diff --git a/site-src/implementations/v1.3.md b/site-src/implementations/v1.3.md
index 653a8b80..19bcb531 100644
--- a/site-src/implementations/v1.3.md
+++ b/site-src/implementations/v1.3.md
@@ -16,18 +16,20 @@ Implementations only appear in this page if they pass Core conformance for the r
 
 ### HTTPRoute
 
-| Organization   | Project              | Version     | Mode             | Gateway Address Empty   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Request Header Modification   | HTTPRoute Backend Timeout   | HTTPRoute Destination Port Matching   | HTTPRoute Host Rewrite   | HTTPRoute Method Matching   | HTTPRoute Parent Ref Port   | HTTPRoute Path Redirect   | HTTPRoute Path Rewrite   | HTTPRoute Port Redirect   | HTTPRoute Query Param Matching   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   | HTTPRoute Request Percentage Mirror   | HTTPRoute Request Timeout   | HTTPRoute Response Header Modification   | HTTPRoute Scheme Redirect   |
-|:---------------|:---------------------|:------------|:-----------------|:------------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|:---------------------------------|:----------------------------------------|:------------------------------------------------|:----------------------------|:--------------------------------------|:-------------------------|:----------------------------|:----------------------------|:--------------------------|:-------------------------|:--------------------------|:---------------------------------|:---------------------------|:-------------------------------------|:--------------------------------------|:----------------------------|:-----------------------------------------|:----------------------------|
-| agentgateway   | agentgateway         | v0.6.0-dev  | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
-| airlock        | microgateway         | 4.6.0       | default          | :x:                     | :x:                               | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :x:                                             | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :x:                        | :x:                                  | :x:                                   | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
-| airlock        | microgateway         | 4.7.0       | default          | :x:                     | :x:                               | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :x:                                             | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :x:                        | :x:                                  | :x:                                   | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
-| cilium         | cilium               | main        | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
-| envoyproxy     | envoy-gateway        | v1.5.0      | GatewayNamespace | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
-| envoyproxy     | envoy-gateway        | v1.5.0      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
-| istio          | istio                | 1.26.1      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
-| kgateway-dev   | kgateway             | v2.1.0-main | default          | :x:                     | :x:                               | :x:                                  | :x:                 | :x:                        | :white_check_mark:               | :white_check_mark:                      | :x:                                             | :white_check_mark:          | :x:                                   | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :x:                                  | :x:                                   | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
-| nginx          | nginx-gateway-fabric | v2.0.0      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :x:                              | :white_check_mark:                      | :x:                                             | :x:                         | :x:                                   | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :x:                         | :white_check_mark:                       | :white_check_mark:          |
-| nginx          | nginx-gateway-fabric | v2.1.0      | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :x:                              | :white_check_mark:                      | :x:                                             | :x:                         | :x:                                   | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :x:                         | :white_check_mark:                       | :white_check_mark:          |
+| Organization   | Project              | Version        | Mode             | Gateway Address Empty   | Gateway HTTP Listener Isolation   | Gateway Infrastructure Propagation   | Gateway Port 8080   | Gateway Static Addresses   | HTTPRoute Backend Protocol H2C   | HTTPRoute Backend Protocol Web Socket   | HTTPRoute Backend Request Header Modification   | HTTPRoute Backend Timeout   | HTTPRoute Destination Port Matching   | HTTPRoute Host Rewrite   | HTTPRoute Method Matching   | HTTPRoute Parent Ref Port   | HTTPRoute Path Redirect   | HTTPRoute Path Rewrite   | HTTPRoute Port Redirect   | HTTPRoute Query Param Matching   | HTTPRoute Request Mirror   | HTTPRoute Request Multiple Mirrors   | HTTPRoute Request Percentage Mirror   | HTTPRoute Request Timeout   | HTTPRoute Response Header Modification   | HTTPRoute Scheme Redirect   |
+|:---------------|:---------------------|:---------------|:-----------------|:------------------------|:----------------------------------|:-------------------------------------|:--------------------|:---------------------------|:---------------------------------|:----------------------------------------|:------------------------------------------------|:----------------------------|:--------------------------------------|:-------------------------|:----------------------------|:----------------------------|:--------------------------|:-------------------------|:--------------------------|:---------------------------------|:---------------------------|:-------------------------------------|:--------------------------------------|:----------------------------|:-----------------------------------------|:----------------------------|
+| agentgateway   | agentgateway         | v0.6.0-dev     | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| airlock        | microgateway         | 4.6.0          | default          | :x:                     | :x:                               | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :x:                                             | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :x:                        | :x:                                  | :x:                                   | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| airlock        | microgateway         | 4.7.0          | default          | :x:                     | :x:                               | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :x:                                             | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :x:                        | :x:                                  | :x:                                   | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| cilium         | cilium               | main           | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| envoyproxy     | envoy-gateway        | v1.5.0         | GatewayNamespace | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| envoyproxy     | envoy-gateway        | v1.5.0         | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| istio          | istio                | 1.26.1         | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         | :white_check_mark:               | :white_check_mark:                      | :white_check_mark:                              | :white_check_mark:          | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :white_check_mark:          | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| kgateway-dev   | kgateway             | v2.1.0-main    | default          | :x:                     | :x:                               | :x:                                  | :x:                 | :x:                        | :white_check_mark:               | :white_check_mark:                      | :x:                                             | :white_check_mark:          | :x:                                   | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :x:                                  | :x:                                   | :white_check_mark:          | :white_check_mark:                       | :white_check_mark:          |
+| nginx          | nginx-gateway-fabric | v2.0.0         | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :x:                              | :white_check_mark:                      | :x:                                             | :x:                         | :x:                                   | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :x:                         | :white_check_mark:                       | :white_check_mark:          |
+| nginx          | nginx-gateway-fabric | v2.1.0         | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        | :x:                              | :white_check_mark:                      | :x:                                             | :x:                         | :x:                                   | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :white_check_mark:         | :white_check_mark:                   | :white_check_mark:                    | :x:                         | :white_check_mark:                       | :white_check_mark:          |
+| sigs.k8s.io    | cloud-provider-kind  | v0.8.0-alpha.1 | default          | :x:                     | :x:                               | :x:                                  | :x:                 | :x:                        | :x:                              | :x:                                     | :x:                                             | :x:                         | :x:                                   | :x:                      | :x:                         | :x:                         | :x:                       | :x:                      | :x:                       | :x:                              | :x:                        | :x:                                  | :x:                                   | :x:                         | :x:                                      | :x:                         |
+| traefik        | traefik              | v3.5           | default          | :x:                     | :x:                               | :x:                                  | :white_check_mark:  | :x:                        | :white_check_mark:               | :white_check_mark:                      | :x:                                             | :x:                         | :white_check_mark:                    | :white_check_mark:       | :white_check_mark:          | :x:                         | :white_check_mark:        | :white_check_mark:       | :white_check_mark:        | :white_check_mark:               | :x:                        | :x:                                  | :x:                                   | :x:                         | :white_check_mark:                       | :white_check_mark:          |
 
 ### GRPCRoute
 
@@ -39,6 +41,7 @@ Implementations only appear in this page if they pass Core conformance for the r
 | istio          | istio                | 1.26.1    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
 | nginx          | nginx-gateway-fabric | v2.0.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
 | nginx          | nginx-gateway-fabric | v2.1.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| traefik        | traefik              | v3.5      | default          | :x:                     | :x:                               | :x:                                  | :x:                 | :x:                        |
 
 ### TLSRoute
 
@@ -50,6 +53,7 @@ Implementations only appear in this page if they pass Core conformance for the r
 | istio          | istio                | 1.26.1    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :white_check_mark:         |
 | nginx          | nginx-gateway-fabric | v2.0.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
 | nginx          | nginx-gateway-fabric | v2.1.0    | default          | :white_check_mark:      | :white_check_mark:                | :white_check_mark:                   | :white_check_mark:  | :x:                        |
+| traefik        | traefik              | v3.5      | default          | :x:                     | :x:                               | :x:                                  | :x:                 | :x:                        |
 
 ## Mesh Profile
 



Test patch:
diff --git a/conformance/tests/backendtlspolicy-conflict-resolution.go b/conformance/tests/backendtlspolicy-conflict-resolution.go
new file mode 100644
index 00000000..906d60c6
--- /dev/null
+++ b/conformance/tests/backendtlspolicy-conflict-resolution.go
@@ -0,0 +1,154 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tests
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+
+	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
+	h "sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	ConformanceTests = append(ConformanceTests, BackendTLSPolicyConflictResolution)
+}
+
+var BackendTLSPolicyConflictResolution = suite.ConformanceTest{
+	ShortName:   "BackendTLSPolicyConflictResolution",
+	Description: "Verifies that when multiple BackendTLSPolicies target the same Service, only one policy is accepted while conflicting policies are rejected, and traffic continues to route successfully.",
+	Features: []features.FeatureName{
+		features.SupportGateway,
+		features.SupportHTTPRoute,
+		features.SupportBackendTLSPolicy,
+	},
+	Manifests: []string{"tests/backendtlspolicy-conflict-resolution.yaml"},
+	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
+		ns := "gateway-conformance-infra"
+		routeNN := types.NamespacedName{Name: "backendtlspolicy-conflict-resolution", Namespace: ns}
+		gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
+
+		kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ns})
+		gwAddr := kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &gatewayv1.HTTPRoute{}, false, routeNN)
+		kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
+
+		acceptedCond := metav1.Condition{
+			Type:   string(gatewayv1.PolicyConditionAccepted),
+			Status: metav1.ConditionTrue,
+			Reason: string(gatewayv1.PolicyReasonAccepted),
+		}
+		conflictedCond := metav1.Condition{
+			Type:   string(gatewayv1.PolicyConditionAccepted),
+			Status: metav1.ConditionFalse,
+			Reason: string(gatewayv1.PolicyReasonConflicted),
+		}
+
+		t.Run("Conflicting BackendTLSPolicies targeting the same Service without a section name", func(t *testing.T) {
+			t.Run("First BackendTLSPolicy should be accepted", func(t *testing.T) {
+				policyNN := types.NamespacedName{Name: "conflicted-without-section-name-1", Namespace: ns}
+				kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, acceptedCond)
+			})
+
+			t.Run("Second BackendTLSPolicy should have a false Accepted condition with reason Conflicted ", func(t *testing.T) {
+				// This is not specific to BackendTLSPolicy, it follows the conflict-resolution rules, as defined in GEP-713.
+				conflictedPolicyNN := types.NamespacedName{Name: "conflicted-without-section-name-2", Namespace: ns}
+				kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, conflictedPolicyNN, gwNN, conflictedCond)
+			})
+
+			t.Run("HTTP request sent to Service using the accepted BackendTLSPolicy should succeed", func(t *testing.T) {
+				h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+					h.ExpectedResponse{
+						Namespace: ns,
+						Request: h.Request{
+							Host: "abc.example.com",
+							Path: "/backendtlspolicy-conflicted-without-section-name",
+							SNI:  "other.example.com",
+						},
+						Response: h.Response{StatusCode: 200},
+					})
+			})
+		})
+
+		t.Run("Conflicting BackendTLSPolicies targeting the same Service with the same section name", func(t *testing.T) {
+			t.Run("First BackendTLSPolicy should be accepted", func(t *testing.T) {
+				policyNN := types.NamespacedName{Name: "conflicted-with-section-name-1", Namespace: ns}
+				kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, acceptedCond)
+			})
+
+			t.Run("Second BackendTLSPolicy should have a false Accepted condition with reason Conflicted ", func(t *testing.T) {
+				// This is not specific to BackendTLSPolicy, it follows the conflict-resolution rules, as defined in GEP-713.
+				conflictedPolicyNN := types.NamespacedName{Name: "conflicted-with-section-name-2", Namespace: ns}
+				kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, conflictedPolicyNN, gwNN, conflictedCond)
+			})
+
+			t.Run("HTTP request sent to Service using the accepted BackendTLSPolicy should succeed", func(t *testing.T) {
+				h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+					h.ExpectedResponse{
+						Namespace: ns,
+						Request: h.Request{
+							Host: "abc.example.com",
+							Path: "/backendtlspolicy-conflicted-with-section-name",
+							SNI:  "other.example.com",
+						},
+						Response: h.Response{StatusCode: 200},
+					})
+			})
+		})
+
+		t.Run("BackendTLSPolicies targeting the same Service with and without a section name", func(t *testing.T) {
+			t.Run("BackendTLSPolicy with section name should be accepted", func(t *testing.T) {
+				policyNN := types.NamespacedName{Name: "not-conflicted-with-section-name", Namespace: ns}
+				kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, acceptedCond)
+			})
+
+			t.Run("BackendTLSPolicy without section name should be accepted", func(t *testing.T) {
+				policyNN := types.NamespacedName{Name: "not-conflicted-without-section-name", Namespace: ns}
+				kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, acceptedCond)
+			})
+
+			t.Run("HTTP request sent to Service using the BackendTLSPolicy with section name should succeed", func(t *testing.T) {
+				h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+					h.ExpectedResponse{
+						Namespace: ns,
+						Request: h.Request{
+							Host: "abc.example.com",
+							Path: "/backendtlspolicy-not-conflicted-with-section-name",
+							SNI:  "other.example.com",
+						},
+						Response: h.Response{StatusCode: 200},
+					})
+			})
+			t.Run("HTTP request sent to Service using the BackendTLSPolicy without section name should succeed", func(t *testing.T) {
+				h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+					h.ExpectedResponse{
+						Namespace: ns,
+						Request: h.Request{
+							Host: "abc.example.com",
+							Path: "/backendtlspolicy-not-conflicted-without-section-name",
+							SNI:  "abc.example.com",
+						},
+						Response: h.Response{StatusCode: 200},
+					})
+			})
+		})
+	},
+}
diff --git a/conformance/tests/backendtlspolicy-conflict-resolution.yaml b/conformance/tests/backendtlspolicy-conflict-resolution.yaml
new file mode 100644
index 00000000..b5817f62
--- /dev/null
+++ b/conformance/tests/backendtlspolicy-conflict-resolution.yaml
@@ -0,0 +1,214 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: backendtlspolicy-conflict-resolution
+  namespace: gateway-conformance-infra
+spec:
+  parentRefs:
+    - name: same-namespace
+  hostnames:
+    - abc.example.com
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backendtlspolicy-conflicted-without-section-name-test
+          port: 443
+      matches:
+        - path:
+            type: Exact
+            value: /backendtlspolicy-conflicted-without-section-name
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backendtlspolicy-conflicted-with-section-name-test
+          port: 443
+      matches:
+        - path:
+            type: Exact
+            value: /backendtlspolicy-conflicted-with-section-name
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backendtlspolicy-not-conflicted-test
+          port: 443
+      matches:
+        - path:
+            type: Exact
+            value: /backendtlspolicy-not-conflicted-with-section-name
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backendtlspolicy-not-conflicted-test
+          port: 8443
+      matches:
+        - path:
+            type: Exact
+            value: /backendtlspolicy-not-conflicted-without-section-name
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-conflicted-without-section-name-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: tls-backend
+  ports:
+    - name: "https"
+      protocol: TCP
+      port: 443
+      targetPort: 8443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-conflicted-with-section-name-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: tls-backend
+  ports:
+    - name: "https-1"
+      protocol: TCP
+      port: 443
+      targetPort: 8443
+    - name: "https-2"
+      protocol: TCP
+      port: 8443
+      targetPort: 8443
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backendtlspolicy-not-conflicted-test
+  namespace: gateway-conformance-infra
+spec:
+  selector:
+    app: tls-backend
+  ports:
+    - name: "https-1"
+      protocol: TCP
+      port: 443
+      targetPort: 8443
+    - name: "https-2"
+      protocol: TCP
+      port: 8443
+      targetPort: 8443
+---
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  name: conflicted-without-section-name-1
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+    - group: ""
+      kind: Service
+      name: "backendtlspolicy-conflicted-without-section-name-test"
+  validation:
+    caCertificateRefs:
+      - group: ""
+        kind: ConfigMap
+        # This ConfigMap is generated dynamically by the test suite.
+        # It contains the CA certificate used to sign the tls-backend serving certificate.
+        name: "tls-checks-ca-certificate"
+    hostname: "other.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: BackendTLSPolicy
+metadata:
+  name: conflicted-without-section-name-2
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+    - group: ""
+      kind: Service
+      name: "backendtlspolicy-conflicted-without-section-name-test"
+  validation:
+    caCertificateRefs:
+      - group: ""
+        kind: ConfigMap
+        # This ConfigMap is generated dynamically by the test suite.
+        # It contains the CA certificate used to sign the tls-backend serving certificate.
+        name: "tls-checks-ca-certificate"
+    hostname: "abc.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: BackendTLSPolicy
+metadata:
+  name: conflicted-with-section-name-1
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+    - group: ""
+      kind: Service
+      name: "backendtlspolicy-conflicted-with-section-name-test"
+      sectionName: "https-1"
+  validation:
+    caCertificateRefs:
+      - group: ""
+        kind: ConfigMap
+        # This ConfigMap is generated dynamically by the test suite.
+        # It contains the CA certificate used to sign the tls-backend serving certificate.
+        name: "tls-checks-ca-certificate"
+    hostname: "other.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: BackendTLSPolicy
+metadata:
+  name: conflicted-with-section-name-2
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+    - group: ""
+      kind: Service
+      name: "backendtlspolicy-conflicted-with-section-name-test"
+      sectionName: "https-1"
+  validation:
+    caCertificateRefs:
+      - group: ""
+        kind: ConfigMap
+        # This ConfigMap is generated dynamically by the test suite.
+        # It contains the CA certificate used to sign the tls-backend serving certificate.
+        name: "tls-checks-ca-certificate"
+    hostname: "abc.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: BackendTLSPolicy
+metadata:
+  name: not-conflicted-with-section-name
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+    - group: ""
+      kind: Service
+      name: "backendtlspolicy-not-conflicted-test"
+      sectionName: "https-1"
+  validation:
+    caCertificateRefs:
+      - group: ""
+        kind: ConfigMap
+        # This ConfigMap is generated dynamically by the test suite.
+        # It contains the CA certificate used to sign the tls-backend serving certificate.
+        name: "tls-checks-ca-certificate"
+    hostname: "other.example.com"
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: BackendTLSPolicy
+metadata:
+  name: not-conflicted-without-section-name
+  namespace: gateway-conformance-infra
+spec:
+  targetRefs:
+    - group: ""
+      kind: Service
+      name: "backendtlspolicy-not-conflicted-test"
+  validation:
+    caCertificateRefs:
+      - group: ""
+        kind: ConfigMap
+        # This ConfigMap is generated dynamically by the test suite.
+        # It contains the CA certificate used to sign the tls-backend serving certificate.
+        name: "tls-checks-ca-certificate"
+    hostname: "abc.example.com"
diff --git a/conformance/tests/backendtlspolicy-invalid-ca-certificate-ref.go b/conformance/tests/backendtlspolicy-invalid-ca-certificate-ref.go
index 824d8dd1..54908a23 100644
--- a/conformance/tests/backendtlspolicy-invalid-ca-certificate-ref.go
+++ b/conformance/tests/backendtlspolicy-invalid-ca-certificate-ref.go
@@ -23,8 +23,6 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
-	gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
-	gatewayv1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
 	h "sigs.k8s.io/gateway-api/conformance/utils/http"
 	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
 	"sigs.k8s.io/gateway-api/conformance/utils/suite"
@@ -61,9 +59,9 @@ var BackendTLSPolicyInvalidCACertificateRef = suite.ConformanceTest{
 			t.Run("BackendTLSPolicy_"+policyNN.Name, func(t *testing.T) {
 				t.Run("BackendTLSPolicy with a single invalid CACertificateRef has a Accepted Condition with status False and Reason NoValidCACertificate", func(t *testing.T) {
 					acceptedCond := metav1.Condition{
-						Type:   string(gatewayv1alpha2.PolicyConditionAccepted),
+						Type:   string(gatewayv1.PolicyConditionAccepted),
 						Status: metav1.ConditionFalse,
-						Reason: string(gatewayv1alpha3.BackendTLSPolicyReasonNoValidCACertificate),
+						Reason: string(gatewayv1.BackendTLSPolicyReasonNoValidCACertificate),
 					}
 
 					kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, acceptedCond)
@@ -71,9 +69,9 @@ var BackendTLSPolicyInvalidCACertificateRef = suite.ConformanceTest{
 
 				t.Run("BackendTLSPolicy with a single invalid CACertificateRef has a ResolvedRefs Condition with status False and Reason InvalidCACertificateRef", func(t *testing.T) {
 					resolvedRefsCond := metav1.Condition{
-						Type:   string(gatewayv1alpha3.BackendTLSPolicyConditionResolvedRefs),
+						Type:   string(gatewayv1.BackendTLSPolicyConditionResolvedRefs),
 						Status: metav1.ConditionFalse,
-						Reason: string(gatewayv1alpha3.BackendTLSPolicyReasonInvalidCACertificateRef),
+						Reason: string(gatewayv1.BackendTLSPolicyReasonInvalidCACertificateRef),
 					}
 
 					kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, resolvedRefsCond)
diff --git a/conformance/tests/backendtlspolicy-invalid-ca-certificate-ref.yaml b/conformance/tests/backendtlspolicy-invalid-ca-certificate-ref.yaml
index 138812fd..fbb08c30 100644
--- a/conformance/tests/backendtlspolicy-invalid-ca-certificate-ref.yaml
+++ b/conformance/tests/backendtlspolicy-invalid-ca-certificate-ref.yaml
@@ -55,7 +55,7 @@ spec:
       port: 443
       targetPort: 8443
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
   name: nonexistent-ca-certificate-ref
@@ -72,7 +72,7 @@ spec:
         name: "nonexistent-ca-certificate"
     hostname: "abc.example.com"
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
   name: malformed-ca-certificate-ref
diff --git a/conformance/tests/backendtlspolicy-invalid-kind.go b/conformance/tests/backendtlspolicy-invalid-kind.go
index 5a3bba59..35f30fd2 100644
--- a/conformance/tests/backendtlspolicy-invalid-kind.go
+++ b/conformance/tests/backendtlspolicy-invalid-kind.go
@@ -23,8 +23,6 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
-	gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
-	gatewayv1alpha3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
 	h "sigs.k8s.io/gateway-api/conformance/utils/http"
 	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
 	"sigs.k8s.io/gateway-api/conformance/utils/suite"
@@ -58,9 +56,9 @@ var BackendTLSPolicyInvalidKind = suite.ConformanceTest{
 
 		t.Run("BackendTLSPolicy with a single invalid CACertificateRef has a Accepted Condition with status False and Reason NoValidCACertificate", func(t *testing.T) {
 			acceptedCond := metav1.Condition{
-				Type:   string(gatewayv1alpha2.PolicyConditionAccepted),
+				Type:   string(gatewayv1.PolicyConditionAccepted),
 				Status: metav1.ConditionFalse,
-				Reason: string(gatewayv1alpha3.BackendTLSPolicyReasonNoValidCACertificate),
+				Reason: string(gatewayv1.BackendTLSPolicyReasonNoValidCACertificate),
 			}
 
 			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, acceptedCond)
@@ -68,9 +66,9 @@ var BackendTLSPolicyInvalidKind = suite.ConformanceTest{
 
 		t.Run("BackendTLSPolicy with a single invalid CACertificateRef has a ResolvedRefs Condition with status False and Reason InvalidKind", func(t *testing.T) {
 			resolvedRefsCond := metav1.Condition{
-				Type:   string(gatewayv1alpha3.BackendTLSPolicyConditionResolvedRefs),
+				Type:   string(gatewayv1.BackendTLSPolicyConditionResolvedRefs),
 				Status: metav1.ConditionFalse,
-				Reason: string(gatewayv1alpha3.BackendTLSPolicyReasonInvalidKind),
+				Reason: string(gatewayv1.BackendTLSPolicyReasonInvalidKind),
 			}
 
 			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, resolvedRefsCond)
diff --git a/conformance/tests/backendtlspolicy-invalid-kind.yaml b/conformance/tests/backendtlspolicy-invalid-kind.yaml
index a7eaeb5d..858856c6 100644
--- a/conformance/tests/backendtlspolicy-invalid-kind.yaml
+++ b/conformance/tests/backendtlspolicy-invalid-kind.yaml
@@ -33,7 +33,7 @@ spec:
       port: 443
       targetPort: 8443
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
   name: invalid-kind
diff --git a/conformance/tests/backendtlspolicy-observed-generation-bump.go b/conformance/tests/backendtlspolicy-observed-generation-bump.go
index a3cd4000..85f44a70 100644
--- a/conformance/tests/backendtlspolicy-observed-generation-bump.go
+++ b/conformance/tests/backendtlspolicy-observed-generation-bump.go
@@ -21,12 +21,13 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"sigs.k8s.io/gateway-api/apis/v1alpha2"
-	"sigs.k8s.io/gateway-api/apis/v1alpha3"
+	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
 	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
 	"sigs.k8s.io/gateway-api/conformance/utils/suite"
 	"sigs.k8s.io/gateway-api/pkg/features"
@@ -38,7 +39,7 @@ func init() {
 
 var BackendTLSPolicyObservedGenerationBump = suite.ConformanceTest{
 	ShortName:   "BackendTLSPolicyObservedGenerationBump",
-	Description: "A BackendTLSPolicy in the gateway-conformance-infra namespace should update the observedGeneration in all of it's Status.Conditions after an update to the spec",
+	Description: "A BackendTLSPolicy in the gateway-conformance-infra namespace should update the observedGeneration in all of its Status.Conditions after an update to the spec",
 	Features: []features.FeatureName{
 		features.SupportGateway,
 		features.SupportHTTPRoute,
@@ -57,7 +58,7 @@ var BackendTLSPolicyObservedGenerationBump = suite.ConformanceTest{
 			namespaces := []string{"gateway-conformance-infra"}
 			kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, namespaces)
 
-			original := &v1alpha3.BackendTLSPolicy{}
+			original := &gatewayv1.BackendTLSPolicy{}
 			err := suite.Client.Get(ctx, policyNN, original)
 			require.NoError(t, err, "error getting HTTPRoute")
 
@@ -70,12 +71,12 @@ var BackendTLSPolicyObservedGenerationBump = suite.ConformanceTest{
 			require.NoError(t, err, "error patching the BackendTLSPolicy")
 
 			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, metav1.Condition{
-				Type:   string(v1alpha2.PolicyConditionAccepted),
+				Type:   string(gatewayv1.PolicyConditionAccepted),
 				Status: metav1.ConditionTrue,
 				Reason: "", // any reason
 			})
 
-			updated := &v1alpha3.BackendTLSPolicy{}
+			updated := &gatewayv1.BackendTLSPolicy{}
 			err = suite.Client.Get(ctx, policyNN, updated)
 			require.NoError(t, err, "error getting BackendTLSPolicy")
 
diff --git a/conformance/tests/backendtlspolicy-observed-generation-bump.yaml b/conformance/tests/backendtlspolicy-observed-generation-bump.yaml
index c21bd45b..8a46c8ea 100644
--- a/conformance/tests/backendtlspolicy-observed-generation-bump.yaml
+++ b/conformance/tests/backendtlspolicy-observed-generation-bump.yaml
@@ -25,7 +25,7 @@ spec:
       port: 443
       targetPort: 8443
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
   name: observed-generation-bump
@@ -41,5 +41,5 @@ spec:
       - group: ""
         kind: ConfigMap
         # This ConfigMap is generated dynamically by the test suite.
-        name: "backend-tls-checks-certificate"
+        name: "tls-checks-ca-certificate"
     hostname: "abc.example.com"
diff --git a/conformance/tests/backendtlspolicy-san.go b/conformance/tests/backendtlspolicy-san.go
index 38e7a2b4..2bc91acc 100644
--- a/conformance/tests/backendtlspolicy-san.go
+++ b/conformance/tests/backendtlspolicy-san.go
@@ -23,7 +23,6 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
-	"sigs.k8s.io/gateway-api/apis/v1alpha2"
 	h "sigs.k8s.io/gateway-api/conformance/utils/http"
 	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
 	"sigs.k8s.io/gateway-api/conformance/utils/suite"
@@ -46,24 +45,24 @@ var BackendTLSPolicySANValidation = suite.ConformanceTest{
 	Manifests: []string{"tests/backendtlspolicy-san.yaml"},
 	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
 		ns := "gateway-conformance-infra"
-		routeNN := types.NamespacedName{Name: "route-backendtlspolicy-san-test", Namespace: ns}
-		gwNN := types.NamespacedName{Name: "gateway-backendtlspolicy", Namespace: ns}
+		routeNN := types.NamespacedName{Name: "backendtlspolicy-san-test", Namespace: ns}
+		gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
 
 		kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ns})
 		gwAddr := kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &gatewayv1.HTTPRoute{}, false, routeNN)
 		kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
 
 		policyCond := metav1.Condition{
-			Type:   string(v1alpha2.PolicyConditionAccepted),
+			Type:   string(gatewayv1.PolicyConditionAccepted),
 			Status: metav1.ConditionTrue,
-			Reason: string(v1alpha2.PolicyReasonAccepted),
+			Reason: string(gatewayv1.PolicyReasonAccepted),
 		}
 
 		serverStr := "abc.example.com"
 
 		// Verify that the request sent to Service with valid BackendTLSPolicy containing dns SAN should succeed.
 		t.Run("HTTP request sent to Service with valid BackendTLSPolicy containing dns SAN should succeed", func(t *testing.T) {
-			policyNN := types.NamespacedName{Name: "backendtlspolicy-san-dns", Namespace: ns}
+			policyNN := types.NamespacedName{Name: "san-dns", Namespace: ns}
 			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
 
 			h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
@@ -71,16 +70,16 @@ var BackendTLSPolicySANValidation = suite.ConformanceTest{
 					Namespace: ns,
 					Request: h.Request{
 						Host: serverStr,
-						Path: "/backendTLSSanDns",
+						Path: "/backendtlspolicy-san-dns",
 						SNI:  serverStr,
 					},
-					Response: h.Response{StatusCode: 200},
+					Response: h.Response{StatusCodes: []int{200}},
 				})
 		})
 
 		// Verify that the request sent to a Service targeted by a BackendTLSPolicy with mismatched dns SAN should fail.
 		t.Run("HTTP request sent to Service targeted by BackendTLSPolicy with mismatched dns SAN should return an HTTP error", func(t *testing.T) {
-			policyNN := types.NamespacedName{Name: "backendtlspolicy-san-dns-mismatch", Namespace: ns}
+			policyNN := types.NamespacedName{Name: "san-dns-mismatch", Namespace: ns}
 			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
 
 			h.MakeRequestAndExpectFailure(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
@@ -88,7 +87,7 @@ var BackendTLSPolicySANValidation = suite.ConformanceTest{
 					Namespace: ns,
 					Request: h.Request{
 						Host: serverStr,
-						Path: "/backendTLSSanDnsMismatch",
+						Path: "/backendtlspolicy-san-dns-mismatch",
 						SNI:  serverStr,
 					},
 				})
@@ -96,7 +95,7 @@ var BackendTLSPolicySANValidation = suite.ConformanceTest{
 
 		// Verify that the request sent to Service with valid BackendTLSPolicy containing uri SAN should succeed.
 		t.Run("HTTP request sent to Service with valid BackendTLSPolicy containing uri SAN should succeed", func(t *testing.T) {
-			policyNN := types.NamespacedName{Name: "backendtlspolicy-san-uri", Namespace: ns}
+			policyNN := types.NamespacedName{Name: "san-uri", Namespace: ns}
 			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
 
 			h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
@@ -104,16 +103,16 @@ var BackendTLSPolicySANValidation = suite.ConformanceTest{
 					Namespace: ns,
 					Request: h.Request{
 						Host: serverStr,
-						Path: "/backendTLSSanUri",
+						Path: "/backendtlspolicy-san-uri",
 						SNI:  serverStr,
 					},
-					Response: h.Response{StatusCode: 200},
+					Response: h.Response{StatusCodes: []int{200}},
 				})
 		})
 
 		// Verify that the request sent to a Service targeted by a BackendTLSPolicy with mismatched uri SAN should fail.
 		t.Run("HTTP request sent to Service targeted by BackendTLSPolicy with mismatched uri SAN should return an HTTP error", func(t *testing.T) {
-			policyNN := types.NamespacedName{Name: "backendtlspolicy-san-uri-mismatch", Namespace: ns}
+			policyNN := types.NamespacedName{Name: "san-uri-mismatch", Namespace: ns}
 			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
 
 			h.MakeRequestAndExpectFailure(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
@@ -121,7 +120,7 @@ var BackendTLSPolicySANValidation = suite.ConformanceTest{
 					Namespace: ns,
 					Request: h.Request{
 						Host: serverStr,
-						Path: "/backendTLSSanUriMismatch",
+						Path: "/backendtlspolicy-san-uri-mismatch",
 						SNI:  serverStr,
 					},
 				})
@@ -129,7 +128,7 @@ var BackendTLSPolicySANValidation = suite.ConformanceTest{
 
 		// Verify that the request sent to Service with valid BackendTLSPolicy containing multi SANs should succeed.
 		t.Run("HTTP request sent to Service with valid BackendTLSPolicy containing multi SAN should succeed", func(t *testing.T) {
-			policyNN := types.NamespacedName{Name: "backendtlspolicy-multiple-sans", Namespace: ns}
+			policyNN := types.NamespacedName{Name: "multiple-sans", Namespace: ns}
 			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
 
 			h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
@@ -137,16 +136,16 @@ var BackendTLSPolicySANValidation = suite.ConformanceTest{
 					Namespace: ns,
 					Request: h.Request{
 						Host: serverStr,
-						Path: "/backendTLSMultiSans",
+						Path: "/backendtlspolicy-multiple-sans",
 						SNI:  serverStr,
 					},
-					Response: h.Response{StatusCode: 200},
+					Response: h.Response{StatusCodes: []int{200}},
 				})
 		})
 
 		// Verify that the request sent to a Service targeted by a BackendTLSPolicy with mismatched multi SAN should fail.
 		t.Run("HTTP request sent to Service targeted by BackendTLSPolicy with mismatched multi SAN should return an HTTP error", func(t *testing.T) {
-			policyNN := types.NamespacedName{Name: "backendtlspolicy-multiple-mismatch-sans", Namespace: ns}
+			policyNN := types.NamespacedName{Name: "multiple-mismatch-sans", Namespace: ns}
 			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, policyNN, gwNN, policyCond)
 
 			h.MakeRequestAndExpectFailure(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
@@ -154,7 +153,7 @@ var BackendTLSPolicySANValidation = suite.ConformanceTest{
 					Namespace: ns,
 					Request: h.Request{
 						Host: serverStr,
-						Path: "/backendTLSMultiMismatchSans",
+						Path: "/backendtlspolicy-multiple-mismatch-sans",
 						SNI:  serverStr,
 					},
 				})
diff --git a/conformance/tests/backendtlspolicy-san.yaml b/conformance/tests/backendtlspolicy-san.yaml
index e3e0f79b..6bab519d 100644
--- a/conformance/tests/backendtlspolicy-san.yaml
+++ b/conformance/tests/backendtlspolicy-san.yaml
@@ -1,11 +1,11 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: route-backendtlspolicy-san-test
+  name: backendtlspolicy-san-test
   namespace: gateway-conformance-infra
 spec:
   parentRefs:
-  - name: gateway-backendtlspolicy
+  - name: same-namespace
     namespace: gateway-conformance-infra
   hostnames:
   - abc.example.com
@@ -18,7 +18,7 @@ spec:
     matches:
     - path:
         type: Exact
-        value: /backendTLSSanDns
+        value: /backendtlspolicy-san-dns
   - backendRefs:
     - group: ""
       kind: Service
@@ -27,7 +27,7 @@ spec:
     matches:
     - path:
         type: Exact
-        value: /backendTLSSanDnsMismatch
+        value: /backendtlspolicy-san-dns-mismatch
   - backendRefs:
     - group: ""
       kind: Service
@@ -36,7 +36,7 @@ spec:
     matches:
     - path:
         type: Exact
-        value: /backendTLSSanUri
+        value: /backendtlspolicy-san-uri
   - backendRefs:
     - group: ""
       kind: Service
@@ -45,7 +45,7 @@ spec:
     matches:
     - path:
         type: Exact
-        value: /backendTLSSanUriMismatch
+        value: /backendtlspolicy-san-uri-mismatch
   - backendRefs:
     - group: ""
       kind: Service
@@ -54,7 +54,7 @@ spec:
     matches:
     - path:
         type: Exact
-        value: /backendTLSMultiSans
+        value: /backendtlspolicy-multiple-sans
   - backendRefs:
     - group: ""
       kind: Service
@@ -63,7 +63,7 @@ spec:
     matches:
     - path:
         type: Exact
-        value: /backendTLSMultiMismatchSans
+        value: /backendtlspolicy-multiple-mismatch-sans
 ---
 apiVersion: v1
 kind: Service
@@ -72,7 +72,7 @@ metadata:
   namespace: gateway-conformance-infra
 spec:
   selector:
-    app: backendtlspolicy-san-test
+    app: tls-backend
   ports:
   - name: "btls"
     protocol: TCP
@@ -86,7 +86,7 @@ metadata:
   namespace: gateway-conformance-infra
 spec:
   selector:
-    app: backendtlspolicy-san-test
+    app: tls-backend
   ports:
   - name: "btls"
     protocol: TCP
@@ -101,7 +101,7 @@ metadata:
   namespace: gateway-conformance-infra
 spec:
   selector:
-    app: backendtlspolicy-san-test
+    app: tls-backend
   ports:
   - name: "btls"
     protocol: TCP
@@ -116,7 +116,7 @@ metadata:
   namespace: gateway-conformance-infra
 spec:
   selector:
-    app: backendtlspolicy-san-test
+    app: tls-backend
   ports:
   - name: "btls"
     protocol: TCP
@@ -131,7 +131,7 @@ metadata:
   namespace: gateway-conformance-infra
 spec:
   selector:
-    app: backendtlspolicy-san-test
+    app: tls-backend
   ports:
   - name: "btls"
     protocol: TCP
@@ -146,7 +146,7 @@ metadata:
   namespace: gateway-conformance-infra
 spec:
   selector:
-    app: backendtlspolicy-san-test
+    app: tls-backend
   ports:
   - name: "btls"
     protocol: TCP
@@ -154,60 +154,10 @@ spec:
     port: 443
     targetPort: 8443
 ---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: backendtlspolicy-san-test
-  namespace: gateway-conformance-infra
-  labels:
-    app: backendtlspolicy-san-test
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: backendtlspolicy-san-test
-  template:
-    metadata:
-      labels:
-        app: backendtlspolicy-san-test
-    spec:
-      containers:
-      - name: backendtlspolicy-san-test
-        image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
-        volumeMounts:
-        - name: secret-volume
-          mountPath: /etc/secret-volume
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: TLS_SERVER_CERT
-          value: /etc/secret-volume/crt
-        - name: TLS_SERVER_PRIVKEY
-          value: /etc/secret-volume/key
-        resources:
-          requests:
-            cpu: 10m
-      volumes:
-      - name: secret-volume
-        secret:
-          # This secret is generated dynamically by the test suite.
-          secretName: tls-with-san-certificate
-          items:
-          - key: tls.crt
-            path: crt
-          - key: tls.key
-            path: key
----
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
-  name: backendtlspolicy-san-dns
+  name: san-dns
   namespace: gateway-conformance-infra
 spec:
   targetRefs:
@@ -219,17 +169,18 @@ spec:
     caCertificateRefs:
     - group: ""
       kind: ConfigMap
-      # This secret is generated dynamically by the test suite.
-      name: "backend-tls-with-san-certificate"
+      # This ConfigMap is generated dynamically by the test suite.
+      # It contains the CA certificate used to sign the tls-backend serving certificate.
+      name: "tls-checks-ca-certificate"
     hostname: "abc.example.com"
     subjectAltNames:
     - type: "Hostname"
       hostname: "abc.example.com"
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
-  name: backendtlspolicy-san-dns-mismatch
+  name: san-dns-mismatch
   namespace: gateway-conformance-infra
 spec:
   targetRefs:
@@ -241,17 +192,18 @@ spec:
     caCertificateRefs:
     - group: ""
       kind: ConfigMap
-      # This secret is generated dynamically by the test suite.
-      name: "backend-tls-with-san-certificate"
+      # This ConfigMap is generated dynamically by the test suite.
+      # It contains the CA certificate used to sign the tls-backend serving certificate.
+      name: "tls-checks-ca-certificate"
     hostname: "abc.example.com"
     subjectAltNames:
     - type: "Hostname"
       hostname: "dce.example.com"
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
-  name: backendtlspolicy-san-uri
+  name: san-uri
   namespace: gateway-conformance-infra
 spec:
   targetRefs:
@@ -263,17 +215,18 @@ spec:
     caCertificateRefs:
     - group: ""
       kind: ConfigMap
-      # This secret is generated dynamically by the test suite.
-      name: "backend-tls-with-san-certificate"
+      # This ConfigMap is generated dynamically by the test suite.
+      # It contains the CA certificate used to sign the tls-backend serving certificate.
+      name: "tls-checks-ca-certificate"
     hostname: "abc.example.com"
     subjectAltNames:
     - type: "URI"
       uri: "spiffe://abc.example.com/test-identity"
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
-  name: backendtlspolicy-san-uri-mismatch
+  name: san-uri-mismatch
   namespace: gateway-conformance-infra
 spec:
   targetRefs:
@@ -285,17 +238,18 @@ spec:
     caCertificateRefs:
     - group: ""
       kind: ConfigMap
-      # This secret is generated dynamically by the test suite.
-      name: "backend-tls-with-san-certificate"
+      # This ConfigMap is generated dynamically by the test suite.
+      # It contains the CA certificate used to sign the tls-backend serving certificate.
+      name: "tls-checks-ca-certificate"
     hostname: "abc.example.com"
     subjectAltNames:
     - type: "URI"
       uri: "spiffe://def.example.com/test-identity"
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
-  name: backendtlspolicy-multiple-sans
+  name: multiple-sans
   namespace: gateway-conformance-infra
 spec:
   targetRefs:
@@ -307,8 +261,9 @@ spec:
     caCertificateRefs:
     - group: ""
       kind: ConfigMap
-      # This secret is generated dynamically by the test suite.
-      name: "backend-tls-with-san-certificate"
+      # This ConfigMap is generated dynamically by the test suite.
+      # It contains the CA certificate used to sign the tls-backend serving certificate.
+      name: "tls-checks-ca-certificate"
     hostname: "abc.example.com"
     subjectAltNames:
     - type: "URI"
@@ -316,10 +271,10 @@ spec:
     - type: "Hostname"
       hostname: "abc.example.com"
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
-  name: backendtlspolicy-multiple-mismatch-sans
+  name: multiple-mismatch-sans
   namespace: gateway-conformance-infra
 spec:
   targetRefs:
@@ -331,8 +286,9 @@ spec:
     caCertificateRefs:
     - group: ""
       kind: ConfigMap
-      # This secret is generated dynamically by the test suite.
-      name: "backend-tls-with-san-certificate"
+      # This ConfigMap is generated dynamically by the test suite.
+      # It contains the CA certificate used to sign the tls-backend serving certificate.
+      name: "tls-checks-ca-certificate"
     hostname: "abc.example.com"
     subjectAltNames:
     - type: "URI"
diff --git a/conformance/tests/backendtlspolicy.go b/conformance/tests/backendtlspolicy.go
index 62ed54c4..f4552d69 100644
--- a/conformance/tests/backendtlspolicy.go
+++ b/conformance/tests/backendtlspolicy.go
@@ -23,8 +23,6 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
-	"sigs.k8s.io/gateway-api/apis/v1alpha2"
-	"sigs.k8s.io/gateway-api/apis/v1alpha3"
 	h "sigs.k8s.io/gateway-api/conformance/utils/http"
 	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
 	"sigs.k8s.io/gateway-api/conformance/utils/suite"
@@ -47,67 +45,83 @@ var BackendTLSPolicy = suite.ConformanceTest{
 	Manifests: []string{"tests/backendtlspolicy.yaml"},
 	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
 		ns := "gateway-conformance-infra"
-		routeNN := types.NamespacedName{Name: "gateway-conformance-infra-test", Namespace: ns}
-		gwNN := types.NamespacedName{Name: "gateway-backendtlspolicy", Namespace: ns}
-
-		kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ns})
-		gwAddr := kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &gatewayv1.HTTPRoute{}, false, routeNN)
-		kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
 
 		acceptedCond := metav1.Condition{
-			Type:   string(v1alpha2.PolicyConditionAccepted),
+			Type:   string(gatewayv1.PolicyConditionAccepted),
 			Status: metav1.ConditionTrue,
-			Reason: string(v1alpha2.PolicyReasonAccepted),
+			Reason: string(gatewayv1.PolicyReasonAccepted),
 		}
 		resolvedRefsCond := metav1.Condition{
-			Type:   string(v1alpha3.BackendTLSPolicyConditionResolvedRefs),
+			Type:   string(gatewayv1.BackendTLSPolicyConditionResolvedRefs),
 			Status: metav1.ConditionTrue,
-			Reason: string(v1alpha3.BackendTLSPolicyReasonResolvedRefs),
+			Reason: string(gatewayv1.BackendTLSPolicyReasonResolvedRefs),
 		}
 
-		validPolicyNN := types.NamespacedName{Name: "normative-test-backendtlspolicy", Namespace: ns}
-		kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, validPolicyNN, gwNN, acceptedCond)
-		kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, validPolicyNN, gwNN, resolvedRefsCond)
-
-		serverStr := "abc.example.com"
-
-		// Verify that the request sent to Service with valid BackendTLSPolicy should succeed.
-		t.Run("HTTP request sent to Service with valid BackendTLSPolicy should succeed", func(t *testing.T) {
-			h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
+		t.Run("Re-encrypt HTTPS request sent to Service with valid BackendTLSPolicy should succeed", func(t *testing.T) {
+			routeNN := types.NamespacedName{Name: "backendtlspolicy-reencrypt", Namespace: ns}
+			gwNN := types.NamespacedName{Name: "same-namespace-with-https-listener", Namespace: ns}
+
+			kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ns})
+			gwAddr := kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &gatewayv1.HTTPRoute{}, false, routeNN)
+			kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
+
+			validPolicyNN := types.NamespacedName{Name: "normative-test", Namespace: ns}
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, validPolicyNN, gwNN, acceptedCond)
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, validPolicyNN, gwNN, resolvedRefsCond)
+
+			// For the re-encrypt case, we need to use the cert for the frontend tls listener.
+			certNN := types.NamespacedName{Name: "tls-validity-checks-certificate", Namespace: ns}
+			cPem, keyPem, err := GetTLSSecret(suite.Client, certNN)
+			if err != nil {
+				t.Fatalf("unexpected error finding TLS secret: %v", err)
+			}
+			// Verify that the request to a re-encrypted call to /backendTLS should succeed.
+			tls.MakeTLSRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, cPem, keyPem, "https-listener.org",
 				h.ExpectedResponse{
 					Namespace: ns,
 					Request: h.Request{
-						Host: serverStr,
-						Path: "/backendTLS",
-						SNI:  serverStr,
+						Host: "https-listener.org",
+						Path: "/backendtlspolicy",
+						SNI:  "https-listener.org",
+					},
+					ExpectedRequest: &h.ExpectedRequest{
+						Request: h.Request{
+							Path: "/backendtlspolicy",
+							SNI:  "abc.example.com",
+						},
 					},
-					Response: h.Response{StatusCode: 200},
+					Response: h.Response{StatusCodes: []int{200}},
 				})
 		})
 
-		// For the re-encrypt case, we need to use the cert for the frontend tls listener.
-		certNN := types.NamespacedName{Name: "tls-checks-certificate", Namespace: ns}
-		cPem, keyPem, err := GetTLSSecret(suite.Client, certNN)
-		if err != nil {
-			t.Fatalf("unexpected error finding TLS secret: %v", err)
-		}
-		// Verify that the request to a re-encrypted call to /backendTLS should succeed.
-		t.Run("Re-encrypt HTTPS request sent to Service with valid BackendTLSPolicy should succeed", func(t *testing.T) {
-			tls.MakeTLSRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, cPem, keyPem, serverStr,
+		routeNN := types.NamespacedName{Name: "backendtlspolicy", Namespace: ns}
+		gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
+
+		kubernetes.NamespacesMustBeReady(t, suite.Client, suite.TimeoutConfig, []string{ns})
+		gwAddr := kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &gatewayv1.HTTPRoute{}, false, routeNN)
+		kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
+
+		// Verify that the request sent to Service with valid BackendTLSPolicy should succeed.
+		t.Run("HTTP request sent to Service with valid BackendTLSPolicy should succeed", func(t *testing.T) {
+			validPolicyNN := types.NamespacedName{Name: "normative-test", Namespace: ns}
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, validPolicyNN, gwNN, acceptedCond)
+			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, validPolicyNN, gwNN, resolvedRefsCond)
+
+			h.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr,
 				h.ExpectedResponse{
 					Namespace: ns,
 					Request: h.Request{
-						Host: serverStr,
-						Path: "/backendTLS",
-						SNI:  serverStr,
+						Host: "abc.example.com",
+						Path: "/backendtlspolicy",
+						SNI:  "abc.example.com",
 					},
-					Response: h.Response{StatusCode: 200},
+					Response: h.Response{StatusCodes: []int{200}},
 				})
 		})
 
 		// Verify that the request sent to a Service targeted by a BackendTLSPolicy with mismatched host will fail.
 		t.Run("HTTP request sent to Service targeted by BackendTLSPolicy with mismatched hostname should return an HTTP error", func(t *testing.T) {
-			invalidPolicyNN := types.NamespacedName{Name: "backendtlspolicy-host-mismatch", Namespace: ns}
+			invalidPolicyNN := types.NamespacedName{Name: "host-mismatch", Namespace: ns}
 			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, invalidPolicyNN, gwNN, acceptedCond)
 			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, invalidPolicyNN, gwNN, resolvedRefsCond)
 
@@ -115,16 +129,16 @@ var BackendTLSPolicy = suite.ConformanceTest{
 				h.ExpectedResponse{
 					Namespace: ns,
 					Request: h.Request{
-						Host: serverStr,
-						Path: "/backendTLSHostMismatch",
-						SNI:  serverStr,
+						Host: "abc.example.org",
+						Path: "/backendtlspolicy-host-mismatch",
+						SNI:  "abc.example.com",
 					},
 				})
 		})
 
-		// Verify that request sent to Service targeted by BackendTLSPolicy with mismatched cert should failed.
+		// Verify that request sent to Service targeted by BackendTLSPolicy with mismatched cert should fail.
 		t.Run("HTTP request send to Service targeted by BackendTLSPolicy with mismatched cert should return HTTP error", func(t *testing.T) {
-			invalidCertPolicyNN := types.NamespacedName{Name: "backendtlspolicy-cert-mismatch", Namespace: ns}
+			invalidCertPolicyNN := types.NamespacedName{Name: "cert-mismatch", Namespace: ns}
 			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, invalidCertPolicyNN, gwNN, acceptedCond)
 			kubernetes.BackendTLSPolicyMustHaveCondition(t, suite.Client, suite.TimeoutConfig, invalidCertPolicyNN, gwNN, resolvedRefsCond)
 
@@ -132,9 +146,9 @@ var BackendTLSPolicy = suite.ConformanceTest{
 				h.ExpectedResponse{
 					Namespace: ns,
 					Request: h.Request{
-						Host: serverStr,
-						Path: "/backendTLSCertMismatch",
-						SNI:  serverStr,
+						Host: "abc.example.com",
+						Path: "/backendtlspolicy-cert-mismatch",
+						SNI:  "abc.example.com",
 					},
 				})
 		})
diff --git a/conformance/tests/backendtlspolicy.yaml b/conformance/tests/backendtlspolicy.yaml
index 6d0cab8e..80f634df 100644
--- a/conformance/tests/backendtlspolicy.yaml
+++ b/conformance/tests/backendtlspolicy.yaml
@@ -1,11 +1,11 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: gateway-conformance-infra-test
+  name: backendtlspolicy
   namespace: gateway-conformance-infra
 spec:
   parentRefs:
-  - name: gateway-backendtlspolicy
+  - name: same-namespace
     namespace: gateway-conformance-infra
   hostnames:
   - abc.example.com
@@ -18,7 +18,7 @@ spec:
     matches:
     - path:
         type: Exact
-        value: /backendTLS
+        value: /backendtlspolicy
   - backendRefs:
     - group: ""
       kind: Service
@@ -27,7 +27,7 @@ spec:
     matches:
     - path:
         type: Exact
-        value: /backendTLSHostMismatch
+        value: /backendtlspolicy-host-mismatch
   - backendRefs:
     - group: ""
       kind: Service
@@ -36,7 +36,29 @@ spec:
     matches:
     - path:
         type: Exact
-        value: /backendTLSCertMismatch
+        value: /backendtlspolicy-cert-mismatch
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: backendtlspolicy-reencrypt
+  namespace: gateway-conformance-infra
+spec:
+  parentRefs:
+  - name: same-namespace-with-https-listener
+    namespace: gateway-conformance-infra
+  hostnames:
+  - https-listener.org
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backendtlspolicy-test
+      port: 443
+    matches:
+    - path:
+        type: Exact
+        value: /backendtlspolicy
 ---
 apiVersion: v1
 kind: Service
@@ -45,7 +67,7 @@ metadata:
   namespace: gateway-conformance-infra
 spec:
   selector:
-    app: backendtlspolicy-test
+    app: tls-backend
   ports:
   - name: "btls"
     protocol: TCP
@@ -59,7 +81,7 @@ metadata:
   namespace: gateway-conformance-infra
 spec:
   selector:
-    app: backendtlspolicy-test
+    app: tls-backend
   ports:
   - name: "btls"
     protocol: TCP
@@ -74,7 +96,7 @@ metadata:
   namespace: gateway-conformance-infra
 spec:
   selector:
-    app: backendtlspolicy-test
+    app: tls-backend
   ports:
   - name: "btls"
     protocol: TCP
@@ -82,76 +104,10 @@ spec:
     port: 443
     targetPort: 8443
 ---
-# Deployment must not be applied until after the secret is generated.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: backendtlspolicy-test
-  namespace: gateway-conformance-infra
-  labels:
-    app: backendtlspolicy-test
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: backendtlspolicy-test
-  template:
-    metadata:
-      labels:
-        app: backendtlspolicy-test
-    spec:
-      containers:
-      - name: backendtlspolicy-test
-        image: gcr.io/k8s-staging-gateway-api/echo-basic:v20240412-v1.0.0-394-g40c666fd
-        volumeMounts:
-        - name: ca-volume
-          mountPath: /etc/ca-volume
-        - name: secret-volume
-          mountPath: /etc/secret-volume
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: CA_CERT
-          value: /etc/ca-volume/crt
-        - name: CA_CERT_KEY
-          value: /etc/ca-volume/key
-        - name: TLS_SERVER_CERT
-          value: /etc/secret-volume/crt
-        - name: TLS_SERVER_PRIVKEY
-          value: /etc/secret-volume/key
-        resources:
-          requests:
-            cpu: 10m
-      volumes:
-      - name: ca-volume
-        configMap:
-          # This configMap is generated dynamically by the test suite.
-          name: backend-tls-checks-certificate
-          items:
-          - key: ca.crt
-            path: crt
-          - key: key.crt
-            path: key
-      - name: secret-volume
-        secret:
-          # This secret is generated dynamically by the test suite.
-          secretName: tls-checks-certificate
-          items:
-          - key: tls.crt
-            path: crt
-          - key: tls.key
-            path: key
----
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
-  name: normative-test-backendtlspolicy
+  name: normative-test
   namespace: gateway-conformance-infra
 spec:
   targetRefs:
@@ -163,14 +119,15 @@ spec:
     caCertificateRefs:
     - group: ""
       kind: ConfigMap
-      # This secret is generated dynamically by the test suite.
-      name: "backend-tls-checks-certificate"
+      # This ConfigMap is generated dynamically by the test suite.
+      # It contains the CA certificate used to sign the tls-backend serving certificate.
+      name: "tls-checks-ca-certificate"
     hostname: "abc.example.com"
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
-  name: backendtlspolicy-host-mismatch
+  name: host-mismatch
   namespace: gateway-conformance-infra
 spec:
   targetRefs:
@@ -182,14 +139,15 @@ spec:
     caCertificateRefs:
     - group: ""
       kind: ConfigMap
-      # This secret is generated dynamically by the test suite.
-      name: "backend-tls-checks-certificate"
+      # This ConfigMap is generated dynamically by the test suite.
+      # It contains the CA certificate used to sign the tls-backend serving certificate.
+      name: "tls-checks-ca-certificate"
     hostname: "mismatch.example.com"
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha3
+apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
-  name: backendtlspolicy-cert-mismatch
+  name: cert-mismatch
   namespace: gateway-conformance-infra
 spec:
   targetRefs:
@@ -201,6 +159,7 @@ spec:
     caCertificateRefs:
     - group: ""
       kind: ConfigMap
-      # This secret is generated dynamically by the test suite.
-      name: "backend-tls-mismatch-certificate"
+      # This ConfigMap is generated dynamically by the test suite.
+      # It contains a random, unused CA certificate to force validation to fail.
+      name: "mismatch-ca-certificate"
     hostname: "abc.example.com"
diff --git a/conformance/tests/gateway-static-addresses.go b/conformance/tests/gateway-static-addresses.go
index fcee1b3f..89654c9e 100644
--- a/conformance/tests/gateway-static-addresses.go
+++ b/conformance/tests/gateway-static-addresses.go
@@ -135,8 +135,8 @@ var GatewayStaticAddresses = suite.ConformanceTest{
 		kubernetes.GatewayStatusMustHaveListeners(t, s.Client, s.TimeoutConfig, gwNN, finalExpectedListenerState)
 		require.Len(t, currentGW.Spec.Addresses, 1, "expected only 1 address left specified on Gateway")
 		statusAddresses := extractStatusAddresses(currentGW.Status.Addresses)
-		require.NotContains(t, statusAddresses, unusableAddress.Value, "should contain the unusable address")
-		require.NotContains(t, statusAddresses, invalidAddress.Value, "should contain the invalid address")
+		require.NotContains(t, statusAddresses, unusableAddress.Value, "should not contain the unusable address")
+		require.NotContains(t, statusAddresses, invalidAddress.Value, "should not contain the invalid address")
 		require.Contains(t, statusAddresses, usableAddress.Value, "should contain the usable address")
 		for _, addr := range currentGW.Status.Addresses {
 			if usableAddress.Value != addr.Value {
diff --git a/conformance/tests/grpcroute-named-rule.go b/conformance/tests/grpcroute-named-rule.go
index 2c738a56..c5b80ab6 100644
--- a/conformance/tests/grpcroute-named-rule.go
+++ b/conformance/tests/grpcroute-named-rule.go
@@ -35,7 +35,7 @@ func init() {
 
 var GRPCRouteNamedRule = suite.ConformanceTest{
 	ShortName:   "GRPCRouteNamedRule",
-	Description: "An GRPCRoute with a named GRPCRouteRule",
+	Description: "A GRPCRoute with a named GRPCRouteRule",
 	Manifests:   []string{"tests/grpcroute-named-rule.yaml"},
 	Features: []features.FeatureName{
 		features.SupportGateway,
diff --git a/conformance/tests/grpcroute-weight.go b/conformance/tests/grpcroute-weight.go
new file mode 100644
index 00000000..64434912
--- /dev/null
+++ b/conformance/tests/grpcroute-weight.go
@@ -0,0 +1,98 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tests
+
+import (
+	"fmt"
+	"testing"
+
+	"google.golang.org/grpc/codes"
+	"k8s.io/apimachinery/pkg/types"
+
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+	pb "sigs.k8s.io/gateway-api/conformance/echo-basic/grpcechoserver"
+	"sigs.k8s.io/gateway-api/conformance/utils/grpc"
+	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/conformance/utils/weight"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	ConformanceTests = append(ConformanceTests, GRPCRouteWeight)
+}
+
+var GRPCRouteWeight = suite.ConformanceTest{
+	ShortName:   "GRPCRouteWeight",
+	Description: "A GRPCRoute with weighted backends",
+	Manifests:   []string{"tests/grpcroute-weight.yaml"},
+	Features: []features.FeatureName{
+		features.SupportGateway,
+		features.SupportGRPCRoute,
+	},
+	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
+		var (
+			ns      = "gateway-conformance-infra"
+			routeNN = types.NamespacedName{Name: "weighted-backends", Namespace: ns}
+			gwNN    = types.NamespacedName{Name: "same-namespace", Namespace: ns}
+			gwAddr  = kubernetes.GatewayAndRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), &v1.GRPCRoute{}, true, routeNN)
+		)
+
+		t.Run("Requests should have a distribution that matches the weight", func(t *testing.T) {
+			expected := grpc.ExpectedResponse{
+				EchoRequest: &pb.EchoRequest{},
+				Response:    grpc.Response{Code: codes.OK},
+				Namespace:   "gateway-conformance-infra",
+			}
+
+			// Assert request succeeds before doing our distribution check
+			grpc.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.GRPCClient, suite.TimeoutConfig, gwAddr, expected)
+
+			expectedWeights := map[string]float64{
+				"grpc-infra-backend-v1": 0.7,
+				"grpc-infra-backend-v2": 0.3,
+				"grpc-infra-backend-v3": 0.0,
+			}
+
+			sender := weight.NewFunctionBasedSender(func() (string, error) {
+				uniqueExpected := expected
+				if err := grpc.AddEntropy(&uniqueExpected); err != nil {
+					return "", fmt.Errorf("error adding entropy: %w", err)
+				}
+				client := &grpc.DefaultClient{}
+				defer client.Close()
+				resp, err := client.SendRPC(t, gwAddr, uniqueExpected, suite.TimeoutConfig.MaxTimeToConsistency)
+				if err != nil {
+					return "", fmt.Errorf("failed to send gRPC request: %w", err)
+				}
+				if resp.Code != codes.OK {
+					return "", fmt.Errorf("expected OK response, got %v", resp.Code)
+				}
+				return resp.Response.GetAssertions().GetContext().GetPod(), nil
+			})
+
+			for i := 0; i < weight.MaxTestRetries; i++ {
+				if err := weight.TestWeightedDistribution(sender, expectedWeights); err != nil {
+					t.Logf("Traffic distribution test failed (%d/%d): %s", i+1, weight.MaxTestRetries, err)
+				} else {
+					return
+				}
+			}
+			t.Fatal("Weighted distribution tests failed")
+		})
+	},
+}
diff --git a/conformance/tests/grpcroute-weight.yaml b/conformance/tests/grpcroute-weight.yaml
new file mode 100644
index 00000000..944d3b74
--- /dev/null
+++ b/conformance/tests/grpcroute-weight.yaml
@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: GRPCRoute
+metadata:
+  name: weighted-backends
+  namespace: gateway-conformance-infra
+spec:
+  parentRefs:
+  - name: same-namespace
+  rules:
+  - backendRefs:
+    - name: grpc-infra-backend-v1
+      port: 8080
+      weight: 70
+    - name: grpc-infra-backend-v2
+      port: 8080
+      weight: 30
+    - name: grpc-infra-backend-v3
+      port: 8080
+      weight: 0
diff --git a/conformance/tests/httproute-303-redirect.go b/conformance/tests/httproute-303-redirect.go
new file mode 100644
index 00000000..52c98d49
--- /dev/null
+++ b/conformance/tests/httproute-303-redirect.go
@@ -0,0 +1,78 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tests
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/types"
+
+	"sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
+	"sigs.k8s.io/gateway-api/conformance/utils/roundtripper"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	ConformanceTests = append(ConformanceTests, HTTPRoute303Redirect)
+}
+
+var HTTPRoute303Redirect = suite.ConformanceTest{
+	ShortName:   "HTTPRoute303Redirect",
+	Description: "An HTTPRoute with a 303 redirect filter",
+	Manifests:   []string{"tests/httproute-303-redirect.yaml"},
+	Provisional: true,
+	Features: []features.FeatureName{
+		features.SupportGateway,
+		features.SupportHTTPRoute,
+		features.SupportHTTPRoute303RedirectStatusCode,
+	},
+	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
+		ns := "gateway-conformance-infra"
+		routeNN := types.NamespacedName{Name: "redirect-path", Namespace: ns}
+		gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
+		gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
+		kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
+
+		testCases := []http.ExpectedResponse{
+			{
+				Request: http.Request{
+					Path:             "/see-other",
+					UnfollowRedirect: true,
+					Method:           "POST",
+				},
+				Response: http.Response{
+					StatusCode: 303,
+				},
+				RedirectRequest: &roundtripper.RedirectRequest{
+					Path: "/see-other",
+				},
+				Namespace: ns,
+			},
+		}
+		for i := range testCases {
+			// Declare tc here to avoid loop variable
+			// reuse issues across parallel tests.
+			tc := testCases[i]
+			t.Run(tc.GetTestCaseName(i), func(t *testing.T) {
+				t.Parallel()
+				http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, tc)
+			})
+		}
+	},
+}
diff --git a/conformance/tests/httproute-303-redirect.yaml b/conformance/tests/httproute-303-redirect.yaml
new file mode 100644
index 00000000..11f1a5d6
--- /dev/null
+++ b/conformance/tests/httproute-303-redirect.yaml
@@ -0,0 +1,18 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: 303-redirect
+  namespace: gateway-conformance-infra
+spec:
+  parentRefs:
+  - name: same-namespace
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /see-other
+    filters:
+    - type: RequestRedirect
+      requestRedirect:
+        statusCode: 303
+
diff --git a/conformance/tests/httproute-307-redirect.go b/conformance/tests/httproute-307-redirect.go
new file mode 100644
index 00000000..59bb5be3
--- /dev/null
+++ b/conformance/tests/httproute-307-redirect.go
@@ -0,0 +1,77 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tests
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/types"
+
+	"sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
+	"sigs.k8s.io/gateway-api/conformance/utils/roundtripper"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	ConformanceTests = append(ConformanceTests, HTTPRoute307Redirect)
+}
+
+var HTTPRoute307Redirect = suite.ConformanceTest{
+	ShortName:   "HTTPRoute307Redirect",
+	Description: "An HTTPRoute with a 307 path redirect filter",
+	Manifests:   []string{"tests/httproute-307-redirect.yaml"},
+	Provisional: true,
+	Features: []features.FeatureName{
+		features.SupportGateway,
+		features.SupportHTTPRoute,
+		features.SupportHTTPRoute307RedirectStatusCode,
+	},
+	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
+		ns := "gateway-conformance-infra"
+		routeNN := types.NamespacedName{Name: "redirect-path", Namespace: ns}
+		gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
+		gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
+		kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
+
+		testCases := []http.ExpectedResponse{
+			{
+				Request: http.Request{
+					Path:             "/temporary",
+					UnfollowRedirect: true,
+				},
+				Response: http.Response{
+					StatusCode: 307,
+				},
+				RedirectRequest: &roundtripper.RedirectRequest{
+					Path: "/temporary",
+				},
+				Namespace: ns,
+			},
+		}
+		for i := range testCases {
+			// Declare tc here to avoid loop variable
+			// reuse issues across parallel tests.
+			tc := testCases[i]
+			t.Run(tc.GetTestCaseName(i), func(t *testing.T) {
+				t.Parallel()
+				http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, tc)
+			})
+		}
+	},
+}
diff --git a/conformance/tests/httproute-307-redirect.yaml b/conformance/tests/httproute-307-redirect.yaml
new file mode 100644
index 00000000..7683efdd
--- /dev/null
+++ b/conformance/tests/httproute-307-redirect.yaml
@@ -0,0 +1,18 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: 307-redirect
+  namespace: gateway-conformance-infra
+spec:
+  parentRefs:
+  - name: same-namespace
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /temporary
+    filters:
+    - type: RequestRedirect
+      requestRedirect:
+        statusCode: 307
+
diff --git a/conformance/tests/httproute-308-redirect.go b/conformance/tests/httproute-308-redirect.go
new file mode 100644
index 00000000..3648a36b
--- /dev/null
+++ b/conformance/tests/httproute-308-redirect.go
@@ -0,0 +1,77 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tests
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/types"
+
+	"sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
+	"sigs.k8s.io/gateway-api/conformance/utils/roundtripper"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	ConformanceTests = append(ConformanceTests, HTTPRoute308Redirect)
+}
+
+var HTTPRoute308Redirect = suite.ConformanceTest{
+	ShortName:   "HTTPRoute308Redirect",
+	Description: "An HTTPRoute with a 308 path redirect filter",
+	Manifests:   []string{"tests/httproute-308-redirect.yaml"},
+	Provisional: true,
+	Features: []features.FeatureName{
+		features.SupportGateway,
+		features.SupportHTTPRoute,
+		features.SupportHTTPRoute308RedirectStatusCode,
+	},
+	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
+		ns := "gateway-conformance-infra"
+		routeNN := types.NamespacedName{Name: "redirect-path", Namespace: ns}
+		gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
+		gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
+		kubernetes.HTTPRouteMustHaveResolvedRefsConditionsTrue(t, suite.Client, suite.TimeoutConfig, routeNN, gwNN)
+
+		testCases := []http.ExpectedResponse{
+			{
+				Request: http.Request{
+					Path:             "/permanent",
+					UnfollowRedirect: true,
+				},
+				Response: http.Response{
+					StatusCode: 308,
+				},
+				RedirectRequest: &roundtripper.RedirectRequest{
+					Path: "/permanent",
+				},
+				Namespace: ns,
+			},
+		}
+		for i := range testCases {
+			// Declare tc here to avoid loop variable
+			// reuse issues across parallel tests.
+			tc := testCases[i]
+			t.Run(tc.GetTestCaseName(i), func(t *testing.T) {
+				t.Parallel()
+				http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, tc)
+			})
+		}
+	},
+}
diff --git a/conformance/tests/httproute-308-redirect.yaml b/conformance/tests/httproute-308-redirect.yaml
new file mode 100644
index 00000000..2f44bf06
--- /dev/null
+++ b/conformance/tests/httproute-308-redirect.yaml
@@ -0,0 +1,18 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: 308-redirect
+  namespace: gateway-conformance-infra
+spec:
+  parentRefs:
+  - name: same-namespace
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /permanent
+    filters:
+    - type: RequestRedirect
+      requestRedirect:
+        statusCode: 308
+
diff --git a/conformance/tests/cors-allow-credentials-behavior.go b/conformance/tests/httproute-cors-allow-credentials-behavior.go
similarity index 76%
rename from conformance/tests/cors-allow-credentials-behavior.go
rename to conformance/tests/httproute-cors-allow-credentials-behavior.go
index 391b3cee..c550dc0b 100644
--- a/conformance/tests/cors-allow-credentials-behavior.go
+++ b/conformance/tests/httproute-cors-allow-credentials-behavior.go
@@ -28,13 +28,13 @@ import (
 )
 
 func init() {
-	ConformanceTests = append(ConformanceTests, CORSAllowCredentialsBehavior)
+	ConformanceTests = append(ConformanceTests, HTTPRouteCORSAllowCredentialsBehavior)
 }
 
-var CORSAllowCredentialsBehavior = suite.ConformanceTest{
-	ShortName:   "CORSAllowCredentialsBehavior",
-	Description: "Validate ACA-Credentials responses",
-	Manifests:   []string{"tests/cors-allow-credentials-behavior.yaml"},
+var HTTPRouteCORSAllowCredentialsBehavior = suite.ConformanceTest{
+	ShortName:   "HTTPRouteCORSAllowCredentialsBehavior",
+	Description: "An HTTPRoute with CORS includes Access-Control-Allow-Credentials only when configured as 'true', and then only alongside a matching Access-Control-Allow-Origin.",
+	Manifests:   []string{"tests/httproute-cors-allow-credentials-behavior.yaml"},
 	Features: []features.FeatureName{
 		features.SupportGateway,
 		features.SupportHTTPRoute,
@@ -66,6 +66,22 @@ var CORSAllowCredentialsBehavior = suite.ConformanceTest{
 				},
 				Namespace: ns,
 			},
+			{
+				Request: http.Request{
+					Method: "GET",
+					Path:   "/cors-behavior-creds-true",
+					Headers: map[string]string{
+						"Origin":        "http://not-app.example",
+						"Cookie":        "sid=abc123",
+						"Authorization": "Bearer test",
+					},
+				},
+				Response: http.Response{
+					StatusCode:    200,
+					AbsentHeaders: []string{"Access-Control-Allow-Credentials"},
+				},
+				Namespace: ns,
+			},
 			{
 				Request: http.Request{
 					Method: "GET",
diff --git a/conformance/tests/cors-allow-credentials-behavior.yaml b/conformance/tests/httproute-cors-allow-credentials-behavior.yaml
similarity index 86%
rename from conformance/tests/cors-allow-credentials-behavior.yaml
rename to conformance/tests/httproute-cors-allow-credentials-behavior.yaml
index 13992e28..e4b5a390 100644
--- a/conformance/tests/cors-allow-credentials-behavior.yaml
+++ b/conformance/tests/httproute-cors-allow-credentials-behavior.yaml
@@ -16,6 +16,8 @@ spec:
       port: 8080
     filters:
     - cors:
+        allowOrigins:
+        - https://app.example
         allowCredentials: false
       type: CORS
   - matches:
@@ -27,6 +29,8 @@ spec:
       port: 8080
     filters:
     - cors:
+        allowOrigins:
+        - https://app.example
         allowCredentials: true
       type: CORS
 
diff --git a/conformance/tests/httproute-weight.go b/conformance/tests/httproute-weight.go
index bafd768a..f7a1254f 100644
--- a/conformance/tests/httproute-weight.go
+++ b/conformance/tests/httproute-weight.go
@@ -17,21 +17,15 @@ limitations under the License.
 package tests
 
 import (
-	"cmp"
-	"errors"
 	"fmt"
-	"math"
-	"slices"
-	"strings"
-	"sync"
 	"testing"
 
-	"golang.org/x/sync/errgroup"
 	"k8s.io/apimachinery/pkg/types"
 
 	"sigs.k8s.io/gateway-api/conformance/utils/http"
 	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
 	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/conformance/utils/weight"
 	"sigs.k8s.io/gateway-api/pkg/features"
 )
 
@@ -69,9 +63,31 @@ var HTTPRouteWeight = suite.ConformanceTest{
 			// Assert request succeeds before doing our distribution check
 			http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expected)
 
-			for i := 0; i < 10; i++ {
-				if err := testDistribution(t, suite, gwAddr, expected); err != nil {
-					t.Logf("Traffic distribution test failed (%d/10): %s", i+1, err)
+			expectedWeights := map[string]float64{
+				"infra-backend-v1": 0.7,
+				"infra-backend-v2": 0.3,
+				"infra-backend-v3": 0.0,
+			}
+
+			sender := weight.NewFunctionBasedSender(func() (string, error) {
+				uniqueExpected := expected
+				if err := http.AddEntropy(&uniqueExpected); err != nil {
+					return "", fmt.Errorf("error adding entropy: %w", err)
+				}
+				req := http.MakeRequest(t, &uniqueExpected, gwAddr, "HTTP", "http")
+				cReq, cRes, err := suite.RoundTripper.CaptureRoundTrip(req)
+				if err != nil {
+					return "", fmt.Errorf("failed to roundtrip request: %w", err)
+				}
+				if err := http.CompareRoundTrip(t, &req, cReq, cRes, expected); err != nil {
+					return "", fmt.Errorf("response expectation failed for request: %w", err)
+				}
+				return cReq.Pod, nil
+			})
+
+			for i := 0; i < weight.MaxTestRetries; i++ {
+				if err := weight.TestWeightedDistribution(sender, expectedWeights); err != nil {
+					t.Logf("Traffic distribution test failed (%d/%d): %s", i+1, weight.MaxTestRetries, err)
 				} else {
 					return
 				}
@@ -80,85 +96,3 @@ var HTTPRouteWeight = suite.ConformanceTest{
 		})
 	},
 }
-
-func testDistribution(t *testing.T, suite *suite.ConformanceTestSuite, gwAddr string, expected http.ExpectedResponse) error {
-	const (
-		concurrentRequests  = 10
-		tolerancePercentage = 0.05
-		totalRequests       = 500.0
-	)
-	var (
-		roundTripper = suite.RoundTripper
-
-		g               errgroup.Group
-		seenMutex       sync.Mutex
-		seen            = make(map[string]float64, 3 /* number of backends */)
-		expectedWeights = map[string]float64{
-			"infra-backend-v1": 0.7,
-			"infra-backend-v2": 0.3,
-			"infra-backend-v3": 0.0,
-		}
-	)
-	g.SetLimit(concurrentRequests)
-	for i := 0.0; i < totalRequests; i++ {
-		g.Go(func() error {
-			uniqueExpected := expected
-			if err := http.AddEntropy(&uniqueExpected); err != nil {
-				return fmt.Errorf("error adding entropy: %w", err)
-			}
-			req := http.MakeRequest(t, &uniqueExpected, gwAddr, "HTTP", "http")
-			cReq, cRes, err := roundTripper.CaptureRoundTrip(req)
-			if err != nil {
-				return fmt.Errorf("failed to roundtrip request: %w", err)
-			}
-			if err := http.CompareRoundTrip(t, &req, cReq, cRes, expected); err != nil {
-				return fmt.Errorf("response expectation failed for request: %w", err)
-			}
-
-			seenMutex.Lock()
-			defer seenMutex.Unlock()
-
-			for expectedBackend := range expectedWeights {
-				if strings.HasPrefix(cReq.Pod, expectedBackend) {
-					seen[expectedBackend]++
-					return nil
-				}
-			}
-
-			return fmt.Errorf("request was handled by an unexpected pod %q", cReq.Pod)
-		})
-	}
-
-	if err := g.Wait(); err != nil {
-		return fmt.Errorf("error while sending requests: %w", err)
-	}
-
-	var errs []error
-	if len(seen) != 2 {
-		errs = append(errs, fmt.Errorf("expected only two backends to receive traffic"))
-	}
-
-	for wantBackend, wantPercent := range expectedWeights {
-		gotCount, ok := seen[wantBackend]
-
-		if !ok && wantPercent != 0.0 {
-			errs = append(errs, fmt.Errorf("expect traffic to hit backend %q - but none was received", wantBackend))
-			continue
-		}
-
-		gotPercent := gotCount / totalRequests
-
-		if math.Abs(gotPercent-wantPercent) > tolerancePercentage {
-			errs = append(errs, fmt.Errorf("backend %q weighted traffic of %v not within tolerance %v (+/-%f)",
-				wantBackend,
-				gotPercent,
-				wantPercent,
-				tolerancePercentage,
-			))
-		}
-	}
-	slices.SortFunc(errs, func(a, b error) int {
-		return cmp.Compare(a.Error(), b.Error())
-	})
-	return errors.Join(errs...)
-}
diff --git a/conformance/tests/mesh/grpcroute-weight.go b/conformance/tests/mesh/grpcroute-weight.go
new file mode 100644
index 00000000..01571196
--- /dev/null
+++ b/conformance/tests/mesh/grpcroute-weight.go
@@ -0,0 +1,83 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meshtests
+
+import (
+	"fmt"
+	"testing"
+
+	"sigs.k8s.io/gateway-api/conformance/utils/echo"
+	"sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/conformance/utils/weight"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	MeshConformanceTests = append(MeshConformanceTests, MeshGRPCRouteWeight)
+}
+
+var MeshGRPCRouteWeight = suite.ConformanceTest{
+	ShortName:   "MeshGRPCRouteWeight",
+	Description: "A GRPCRoute with weighted backends in mesh mode",
+	Manifests:   []string{"tests/mesh/grpcroute-weight.yaml"},
+	Features: []features.FeatureName{
+		features.SupportMesh,
+		features.SupportGRPCRoute,
+	},
+	Test: func(t *testing.T, s *suite.ConformanceTestSuite) {
+		client := echo.ConnectToApp(t, s, echo.MeshAppEchoV1)
+
+		t.Run("Requests should have a distribution that matches the weight", func(t *testing.T) {
+			// Create a gRPC request using the mesh client framework
+			expected := http.ExpectedResponse{
+				Request:   http.Request{Protocol: "grpc", Path: "", Host: "echo:7070"},
+				Response:  http.Response{StatusCode: 200},
+				Namespace: "gateway-conformance-mesh",
+			}
+
+			// Assert request succeeds before doing our distribution check
+			client.MakeRequestAndExpectEventuallyConsistentResponse(t, expected, s.TimeoutConfig)
+
+			expectedWeights := map[string]float64{
+				"echo-v1": 0.7,
+				"echo-v2": 0.3,
+			}
+
+			sender := weight.NewFunctionBasedSender(func() (string, error) {
+				uniqueExpected := expected
+				if err := http.AddEntropy(&uniqueExpected); err != nil {
+					return "", fmt.Errorf("error adding entropy: %w", err)
+				}
+				_, cRes, err := client.CaptureRequestResponseAndCompare(t, uniqueExpected)
+				if err != nil {
+					return "", fmt.Errorf("failed gRPC mesh request: %w", err)
+				}
+				return cRes.Hostname, nil
+			})
+
+			for i := 0; i < weight.MaxTestRetries; i++ {
+				if err := weight.TestWeightedDistribution(sender, expectedWeights); err != nil {
+					t.Logf("Traffic distribution test failed (%d/%d): %s", i+1, weight.MaxTestRetries, err)
+				} else {
+					return
+				}
+			}
+			t.Fatal("Weighted distribution tests failed")
+		})
+	},
+}
diff --git a/conformance/tests/mesh/grpcroute-weight.yaml b/conformance/tests/mesh/grpcroute-weight.yaml
new file mode 100644
index 00000000..b14eb777
--- /dev/null
+++ b/conformance/tests/mesh/grpcroute-weight.yaml
@@ -0,0 +1,22 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: GRPCRoute
+metadata:
+  name: mesh-grpc-weighted-backends
+  namespace: gateway-conformance-mesh
+spec:
+  parentRefs:
+  - group: ""
+    kind: Service
+    name: echo
+    port: 7070
+  rules:
+  - backendRefs:
+    - name: echo-v1
+      port: 7070
+      weight: 70
+    - name: echo-v2
+      port: 7070
+      weight: 30
+    - name: echo-v3
+      port: 7070
+      weight: 0
diff --git a/conformance/tests/mesh/httproute-303-redirect.go b/conformance/tests/mesh/httproute-303-redirect.go
new file mode 100644
index 00000000..63b1b37d
--- /dev/null
+++ b/conformance/tests/mesh/httproute-303-redirect.go
@@ -0,0 +1,72 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meshtests
+
+import (
+	"testing"
+
+	"sigs.k8s.io/gateway-api/conformance/utils/echo"
+	"sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/roundtripper"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	MeshConformanceTests = append(MeshConformanceTests, MeshHTTPRoute303Redirect)
+}
+
+var MeshHTTPRoute303Redirect = suite.ConformanceTest{
+	ShortName:   "MeshHTTPRoute303Redirect",
+	Description: "An HTTPRoute with statusCode 303 redirect filter",
+	Provisional: true,
+	Features: []features.FeatureName{
+		features.SupportMesh,
+		features.SupportHTTPRoute,
+		features.SupportHTTPRoute303RedirectStatusCode,
+	},
+	Manifests: []string{"tests/mesh/httproute-303-redirect.yaml"},
+	Test: func(t *testing.T, s *suite.ConformanceTestSuite) {
+		ns := "gateway-conformance-mesh"
+		client := echo.ConnectToApp(t, s, echo.MeshAppEchoV1)
+
+		testCases := []http.ExpectedResponse{
+			{
+				Request: http.Request{
+					Path:             "/redirect",
+					UnfollowRedirect: true,
+				},
+				Response: http.Response{
+					StatusCode: 303,
+				},
+				RedirectRequest: &roundtripper.RedirectRequest{
+					Path: "/redirect",
+				},
+				Namespace: ns,
+			},
+		}
+		for i := range testCases {
+			// Declare tc here to avoid loop variable
+			// reuse issues across parallel tests.
+			tc := testCases[i]
+			t.Run(tc.GetTestCaseName(i), func(t *testing.T) {
+				t.Parallel()
+				client.MakeRequestAndExpectEventuallyConsistentResponse(t, tc, s.TimeoutConfig)
+			})
+		}
+	},
+}
diff --git a/conformance/tests/mesh/httproute-303-redirect.yaml b/conformance/tests/mesh/httproute-303-redirect.yaml
new file mode 100644
index 00000000..f5949faf
--- /dev/null
+++ b/conformance/tests/mesh/httproute-303-redirect.yaml
@@ -0,0 +1,21 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: mesh-303-redirect
+  namespace: gateway-conformance-mesh
+spec:
+  parentRefs:
+  - group: ""
+    kind: Service
+    name: echo
+    port: 80
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /redirect
+    filters:
+    - type: RequestRedirect
+      requestRedirect:
+        statusCode: 303
+
diff --git a/conformance/tests/mesh/httproute-307-redirect.go b/conformance/tests/mesh/httproute-307-redirect.go
new file mode 100644
index 00000000..abee3ba1
--- /dev/null
+++ b/conformance/tests/mesh/httproute-307-redirect.go
@@ -0,0 +1,72 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meshtests
+
+import (
+	"testing"
+
+	"sigs.k8s.io/gateway-api/conformance/utils/echo"
+	"sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/roundtripper"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	MeshConformanceTests = append(MeshConformanceTests, MeshHTTPRoute307Redirect)
+}
+
+var MeshHTTPRoute307Redirect = suite.ConformanceTest{
+	ShortName:   "MeshHTTPRoute307Redirect",
+	Description: "An HTTPRoute with statusCode 307 redirect filter",
+	Provisional: true,
+	Features: []features.FeatureName{
+		features.SupportMesh,
+		features.SupportHTTPRoute,
+		features.SupportHTTPRoute307RedirectStatusCode,
+	},
+	Manifests: []string{"tests/mesh/httproute-303-redirect.yaml"},
+	Test: func(t *testing.T, s *suite.ConformanceTestSuite) {
+		ns := "gateway-conformance-mesh"
+		client := echo.ConnectToApp(t, s, echo.MeshAppEchoV1)
+
+		testCases := []http.ExpectedResponse{
+			{
+				Request: http.Request{
+					Path:             "/temporary",
+					UnfollowRedirect: true,
+				},
+				Response: http.Response{
+					StatusCode: 307,
+				},
+				RedirectRequest: &roundtripper.RedirectRequest{
+					Path: "/temporary",
+				},
+				Namespace: ns,
+			},
+		}
+		for i := range testCases {
+			// Declare tc here to avoid loop variable
+			// reuse issues across parallel tests.
+			tc := testCases[i]
+			t.Run(tc.GetTestCaseName(i), func(t *testing.T) {
+				t.Parallel()
+				client.MakeRequestAndExpectEventuallyConsistentResponse(t, tc, s.TimeoutConfig)
+			})
+		}
+	},
+}
diff --git a/conformance/tests/mesh/httproute-307-redirect.yaml b/conformance/tests/mesh/httproute-307-redirect.yaml
new file mode 100644
index 00000000..63965b3c
--- /dev/null
+++ b/conformance/tests/mesh/httproute-307-redirect.yaml
@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: mesh-307-redirect
+  namespace: gateway-conformance-mesh
+spec:
+  parentRefs:
+  - group: ""
+    kind: Service
+    name: echo
+    port: 80
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /temporary
+    filters:
+    - type: RequestRedirect
+      requestRedirect:
+        statusCode: 307
diff --git a/conformance/tests/mesh/httproute-308-redirect.go b/conformance/tests/mesh/httproute-308-redirect.go
new file mode 100644
index 00000000..75efc2fa
--- /dev/null
+++ b/conformance/tests/mesh/httproute-308-redirect.go
@@ -0,0 +1,72 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package meshtests
+
+import (
+	"testing"
+
+	"sigs.k8s.io/gateway-api/conformance/utils/echo"
+	"sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/roundtripper"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/pkg/features"
+)
+
+func init() {
+	MeshConformanceTests = append(MeshConformanceTests, MeshHTTPRoute308Redirect)
+}
+
+var MeshHTTPRoute308Redirect = suite.ConformanceTest{
+	ShortName:   "MeshHTTPRoute308Redirect",
+	Description: "An HTTPRoute with statusCode 308 redirect filter",
+	Provisional: true,
+	Features: []features.FeatureName{
+		features.SupportMesh,
+		features.SupportHTTPRoute,
+		features.SupportHTTPRoute308RedirectStatusCode,
+	},
+	Manifests: []string{"tests/mesh/httproute-308-redirect.yaml"},
+	Test: func(t *testing.T, s *suite.ConformanceTestSuite) {
+		ns := "gateway-conformance-mesh"
+		client := echo.ConnectToApp(t, s, echo.MeshAppEchoV1)
+
+		testCases := []http.ExpectedResponse{
+			{
+				Request: http.Request{
+					Path:             "/permanent",
+					UnfollowRedirect: true,
+				},
+				Response: http.Response{
+					StatusCode: 308,
+				},
+				RedirectRequest: &roundtripper.RedirectRequest{
+					Path: "/permanent",
+				},
+				Namespace: ns,
+			},
+		}
+		for i := range testCases {
+			// Declare tc here to avoid loop variable
+			// reuse issues across parallel tests.
+			tc := testCases[i]
+			t.Run(tc.GetTestCaseName(i), func(t *testing.T) {
+				t.Parallel()
+				client.MakeRequestAndExpectEventuallyConsistentResponse(t, tc, s.TimeoutConfig)
+			})
+		}
+	},
+}
diff --git a/conformance/tests/mesh/httproute-308-redirect.yaml b/conformance/tests/mesh/httproute-308-redirect.yaml
new file mode 100644
index 00000000..a7e26216
--- /dev/null
+++ b/conformance/tests/mesh/httproute-308-redirect.yaml
@@ -0,0 +1,21 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: mesh-308-redirect
+  namespace: gateway-conformance-mesh
+spec:
+  parentRefs:
+  - group: ""
+    kind: Service
+    name: echo
+    port: 80
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /permanent
+    filters:
+    - type: RequestRedirect
+      requestRedirect:
+        statusCode: 308
+
diff --git a/conformance/tests/mesh/httproute-weight.go b/conformance/tests/mesh/httproute-weight.go
index 844d5471..ceccca95 100644
--- a/conformance/tests/mesh/httproute-weight.go
+++ b/conformance/tests/mesh/httproute-weight.go
@@ -17,20 +17,13 @@ limitations under the License.
 package meshtests
 
 import (
-	"cmp"
-	"errors"
 	"fmt"
-	"math"
-	"slices"
-	"strings"
-	"sync"
 	"testing"
 
-	"golang.org/x/sync/errgroup"
-
 	"sigs.k8s.io/gateway-api/conformance/utils/echo"
 	"sigs.k8s.io/gateway-api/conformance/utils/http"
 	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/conformance/utils/weight"
 	"sigs.k8s.io/gateway-api/pkg/features"
 )
 
@@ -59,89 +52,32 @@ var MeshHTTPRouteWeight = suite.ConformanceTest{
 
 			// Assert request succeeds before doing our distribution check
 			client.MakeRequestAndExpectEventuallyConsistentResponse(t, expected, s.TimeoutConfig)
-			for i := 0; i < 10; i++ {
-				if err := testDistribution(t, client, expected); err != nil {
-					t.Logf("Traffic distribution test failed (%d/10): %s", i+1, err)
-				} else {
-					return
-				}
-			}
-			t.Fatal("Weighted distribution tests failed")
-		})
-	},
-}
 
-func testDistribution(t *testing.T, client echo.MeshPod, expected http.ExpectedResponse) error {
-	const (
-		concurrentRequests  = 10
-		tolerancePercentage = 0.05
-		totalRequests       = 500.0
-	)
-	var (
-		g               errgroup.Group
-		seenMutex       sync.Mutex
-		seen            = make(map[string]float64, 2 /* number of backends */)
-		expectedWeights = map[string]float64{
-			"echo-v1": 0.7,
-			"echo-v2": 0.3,
-		}
-	)
-	g.SetLimit(concurrentRequests)
-	for i := 0.0; i < totalRequests; i++ {
-		g.Go(func() error {
-			uniqueExpected := expected
-			if err := http.AddEntropy(&uniqueExpected); err != nil {
-				return fmt.Errorf("error adding entropy: %w", err)
-			}
-			_, cRes, err := client.CaptureRequestResponseAndCompare(t, uniqueExpected)
-			if err != nil {
-				return fmt.Errorf("failed: %w", err)
+			expectedWeights := map[string]float64{
+				"echo-v1": 0.7,
+				"echo-v2": 0.3,
 			}
 
-			seenMutex.Lock()
-			defer seenMutex.Unlock()
+			sender := weight.NewFunctionBasedSender(func() (string, error) {
+				uniqueExpected := expected
+				if err := http.AddEntropy(&uniqueExpected); err != nil {
+					return "", fmt.Errorf("error adding entropy: %w", err)
+				}
+				_, cRes, err := client.CaptureRequestResponseAndCompare(t, uniqueExpected)
+				if err != nil {
+					return "", fmt.Errorf("failed mesh request: %w", err)
+				}
+				return cRes.Hostname, nil
+			})
 
-			for expectedBackend := range expectedWeights {
-				if strings.HasPrefix(cRes.Hostname, expectedBackend) {
-					seen[expectedBackend]++
-					return nil
+			for i := 0; i < weight.MaxTestRetries; i++ {
+				if err := weight.TestWeightedDistribution(sender, expectedWeights); err != nil {
+					t.Logf("Traffic distribution test failed (%d/%d): %s", i+1, weight.MaxTestRetries, err)
+				} else {
+					return
 				}
 			}
-
-			return fmt.Errorf("request was handled by an unexpected pod %q", cRes.Hostname)
+			t.Fatal("Weighted distribution tests failed")
 		})
-	}
-
-	if err := g.Wait(); err != nil {
-		return fmt.Errorf("error while sending requests: %w", err)
-	}
-
-	var errs []error
-	if len(seen) != 2 {
-		errs = append(errs, fmt.Errorf("expected only two backends to receive traffic"))
-	}
-
-	for wantBackend, wantPercent := range expectedWeights {
-		gotCount, ok := seen[wantBackend]
-
-		if !ok && wantPercent != 0.0 {
-			errs = append(errs, fmt.Errorf("expect traffic to hit backend %q - but none was received", wantBackend))
-			continue
-		}
-
-		gotPercent := gotCount / totalRequests
-
-		if math.Abs(gotPercent-wantPercent) > tolerancePercentage {
-			errs = append(errs, fmt.Errorf("backend %q weighted traffic of %v not within tolerance %v (+/-%f)",
-				wantBackend,
-				gotPercent,
-				wantPercent,
-				tolerancePercentage,
-			))
-		}
-	}
-	slices.SortFunc(errs, func(a, b error) int {
-		return cmp.Compare(a.Error(), b.Error())
-	})
-	return errors.Join(errs...)
+	},
 }
diff --git a/conformance/tests/udproute-simple.go b/conformance/tests/udproute-simple.go
index 8945d3fe..defc1201 100644
--- a/conformance/tests/udproute-simple.go
+++ b/conformance/tests/udproute-simple.go
@@ -27,6 +27,7 @@ import (
 
 	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
 	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+	"sigs.k8s.io/gateway-api/conformance/utils/tlog"
 	"sigs.k8s.io/gateway-api/pkg/features"
 )
 
@@ -53,15 +54,15 @@ var UDPRouteTest = suite.ConformanceTest{
 
 			msg := new(dns.Msg)
 			msg.SetQuestion(domain, dns.TypeA)
-
-			if err := wait.PollUntilContextTimeout(context.TODO(), time.Second, time.Minute, true,
+			tlog.Logf(t, "performing DNS query %s on %s", domain, gwAddr)
+			if err := wait.PollUntilContextTimeout(context.TODO(), time.Second, suite.TimeoutConfig.DefaultTestTimeout, true,
 				func(_ context.Context) (done bool, err error) {
-					t.Logf("performing DNS query %s on %s", domain, gwAddr)
-					_, err = dns.Exchange(msg, gwAddr)
+					r, err := dns.Exchange(msg, gwAddr)
 					if err != nil {
-						t.Logf("failed to perform a UDP query: %v", err)
+						tlog.Logf(t, "failed to perform a UDP query: %v", err)
 						return false, nil
 					}
+					tlog.Logf(t, "got DNS response: %s", r.String())
 					return true, nil
 				}); err != nil {
 				t.Errorf("failed to perform DNS query: %v", err)
diff --git a/conformance/utils/kubernetes/certificate_test.go b/conformance/utils/kubernetes/certificate_test.go
deleted file mode 100644
index f6c78048..00000000
--- a/conformance/utils/kubernetes/certificate_test.go
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
-Copyright 2024 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package kubernetes
-
-import (
-	"bytes"
-	"crypto/x509"
-	"encoding/pem"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func Test_generateCACert(t *testing.T) {
-	tests := []struct {
-		name        string
-		hosts       []string
-		expectedErr []string
-	}{
-		{
-			name:  "one host generates cert with no host",
-			hosts: []string{},
-		},
-		{
-			name:  "one host generates cert for same host",
-			hosts: []string{"abc.example.com"},
-		},
-		{
-			name:  "wildcard generates cert for same host",
-			hosts: []string{"*.example.com"},
-		},
-		{
-			name:  "two hosts generates cert for both hosts",
-			hosts: []string{"abc.example.com", "def.example.com"},
-		},
-		{
-			name:        "bad host generates cert for no host",
-			hosts:       []string{"--abc.example.com"},
-			expectedErr: []string{"x509: certificate is not valid for any names, but wanted to match --abc.example.com"},
-		},
-		{
-			name:        "one good host and one bad host generates cert for only good host",
-			hosts:       []string{"---.example.com", "def.example.com"},
-			expectedErr: []string{"x509: certificate is valid xxx for def.example.com, not ---.example.com", ""},
-		},
-	}
-
-	var serverKey, serverCert bytes.Buffer
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			serverCert.Reset()
-			serverKey.Reset()
-			// Test the function generateCACert.  We can only test normative function
-			// and hostnames, everything else is hardcoded.
-			_, caBytes, caPrivKey, err := generateCACert(tc.hosts)
-			require.NoError(t, err, "unexpected error generating RSA certificate")
-
-			var certData bytes.Buffer
-			if err := pem.Encode(&certData, &pem.Block{Type: "CERTIFICATE", Bytes: caBytes}); err != nil {
-				require.NoError(t, err, "failed to create certificater")
-			}
-
-			var keyData bytes.Buffer
-			if err := pem.Encode(&keyData, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(caPrivKey)}); err != nil {
-				require.NoError(t, err, "failed to create key")
-			}
-
-			// Test that the CA certificate is decodable, parseable, and has the configured hostname/s.
-			block, _ := pem.Decode(certData.Bytes())
-			if block == nil {
-				require.FailNow(t, "failed to decode PEM block containing cert")
-			} else if block.Type == "CERTIFICATE" {
-				cert, err := x509.ParseCertificate(block.Bytes)
-				require.NoError(t, err, "failed to parse certificate")
-				for idx, h := range tc.hosts {
-					err = cert.VerifyHostname(h)
-					if err != nil && len(tc.expectedErr) > 0 && tc.expectedErr[idx] == "" {
-						require.EqualValues(t, tc.expectedErr[idx], err.Error(), "certificate verification failed")
-					} else if err == nil && len(tc.expectedErr) > 0 && tc.expectedErr[idx] != "" {
-						require.EqualValues(t, tc.expectedErr[idx], err, "expected an error but certification verification succeeded")
-					}
-				}
-			}
-		})
-	}
-}
diff --git a/conformance/utils/suite/suite_test.go b/conformance/utils/suite/suite_test.go
index 778afa71..0b692b56 100644
--- a/conformance/utils/suite/suite_test.go
+++ b/conformance/utils/suite/suite_test.go
@@ -28,6 +28,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
+	xmeshv1alpha1 "sigs.k8s.io/gateway-api/apisx/v1alpha1"
 	confv1 "sigs.k8s.io/gateway-api/conformance/apis/v1"
 	"sigs.k8s.io/gateway-api/pkg/consts"
 	"sigs.k8s.io/gateway-api/pkg/features"
@@ -411,31 +412,32 @@ func TestSuiteReport(t *testing.T) {
 	}
 }
 
-var statusFeatureNames = []string{
+var gwcStatusFeatureNames = []string{
 	"Gateway",
 	"GatewayPort8080",
 	"HTTPRoute",
 	"HTTPRouteHostRewrite",
 	"HTTPRouteMethodMatching",
 	"HTTPRoutePathRewrite",
-	"TTPRouteQueryParamMatching",
+	"HTTPRouteQueryParamMatching",
 	"HTTPRouteResponseHeaderModification",
 	"ReferenceGrant",
 }
 
-func TestInferSupportedFeatures(t *testing.T) {
+func TestInferGWCSupportedFeatures(t *testing.T) {
 	testCases := []struct {
-		name               string
-		allowAllFeatures   bool
-		supportedFeatures  FeaturesSet
-		exemptFeatures     FeaturesSet
-		ConformanceProfile sets.Set[ConformanceProfileName]
-		expectedFeatures   FeaturesSet
-		expectedSource     supportedFeaturesSource
+		name                     string
+		allowAllFeatures         bool
+		supportedFeatures        FeaturesSet
+		exemptFeatures           FeaturesSet
+		ConformanceProfile       sets.Set[ConformanceProfileName]
+		expectedFeatures         FeaturesSet
+		expectedExtendedFeatures map[ConformanceProfileName]sets.Set[features.FeatureName]
+		expectedSource           supportedFeaturesSource
 	}{
 		{
 			name:             "properly infer supported features",
-			expectedFeatures: namesToFeatureSet(statusFeatureNames),
+			expectedFeatures: namesToFeatureSet(gwcStatusFeatureNames),
 			expectedSource:   supportedFeaturesSourceInferred,
 		},
 		{
@@ -458,10 +460,32 @@ func TestInferSupportedFeatures(t *testing.T) {
 			expectedSource:   supportedFeaturesSourceManual,
 		},
 		{
-			name:               "supports conformance profile - core",
+			name:               "supports conformance profile core with specified extended features",
+			ConformanceProfile: sets.New(GatewayHTTPConformanceProfileName),
+			supportedFeatures:  sets.New[features.FeatureName]("GatewayPort8080"),
+			expectedFeatures:   sets.New[features.FeatureName]("Gateway", "HTTPRoute", "GatewayPort8080", "ReferenceGrant"),
+			expectedSource:     supportedFeaturesSourceManual,
+			expectedExtendedFeatures: map[ConformanceProfileName]sets.Set[features.FeatureName]{
+				GatewayHTTPConformanceProfileName: namesToFeatureSet([]string{
+					"GatewayPort8080",
+				}),
+			},
+		},
+		{
+			name:               "supports conformance profile core with inferred extended features",
 			ConformanceProfile: sets.New(GatewayHTTPConformanceProfileName),
-			expectedFeatures:   namesToFeatureSet(statusFeatureNames),
+			expectedFeatures:   namesToFeatureSet(gwcStatusFeatureNames),
 			expectedSource:     supportedFeaturesSourceInferred,
+			expectedExtendedFeatures: map[ConformanceProfileName]sets.Set[features.FeatureName]{
+				GatewayHTTPConformanceProfileName: namesToFeatureSet([]string{
+					"GatewayPort8080",
+					"HTTPRouteHostRewrite",
+					"HTTPRouteMethodMatching",
+					"HTTPRoutePathRewrite",
+					"HTTPRouteQueryParamMatching",
+					"HTTPRouteResponseHeaderModification",
+				}),
+			},
 		},
 	}
 
@@ -482,7 +506,7 @@ func TestInferSupportedFeatures(t *testing.T) {
 					Message: "GatewayClass is accepted and ready for use",
 				},
 			},
-			SupportedFeatures: featureNamesToSet(statusFeatureNames),
+			SupportedFeatures: featureNamesToSet(gwcStatusFeatureNames),
 		},
 	}
 	scheme := runtime.NewScheme()
@@ -507,6 +531,118 @@ func TestInferSupportedFeatures(t *testing.T) {
 			Client:                     fakeClient,
 		}
 
+		t.Run(tc.name, func(t *testing.T) {
+			cSuite, err := NewConformanceTestSuite(options)
+			if err != nil {
+				t.Fatalf("error initializing conformance suite: %v", err)
+			}
+
+			if cSuite.supportedFeaturesSource != tc.expectedSource {
+				t.Errorf("InferredSupportedFeatures mismatch: got %v, want %v", cSuite.supportedFeaturesSource, tc.expectedSource)
+			}
+
+			if equal := cSuite.SupportedFeatures.Equal(tc.expectedFeatures); !equal {
+				t.Errorf("SupportedFeatures mismatch: got %v, want %v", cSuite.SupportedFeatures.UnsortedList(), tc.expectedFeatures.UnsortedList())
+			}
+
+			if tc.expectedExtendedFeatures == nil {
+				tc.expectedExtendedFeatures = make(map[ConformanceProfileName]sets.Set[features.FeatureName])
+			}
+			assert.Equal(t, tc.expectedExtendedFeatures, cSuite.extendedSupportedFeatures, "expectedExtendedFeatures mismatch")
+		})
+	}
+}
+
+var meshStatusFeatureNames = []string{
+	"Mesh",
+	"MeshClusterIPMatching",
+	"MeshNamespaceSelector",
+	"MeshServiceAccountSelector",
+	"MeshTLS",
+	"MeshTLSClientCert",
+	"MeshTrafficSplit",
+	"MeshAccessControl",
+	"HTTPRoute",
+}
+
+func TestXMeshInferSupportedFeatures(t *testing.T) {
+	testCases := []struct {
+		name               string
+		allowAllFeatures   bool
+		supportedFeatures  FeaturesSet
+		exemptFeatures     FeaturesSet
+		ConformanceProfile sets.Set[ConformanceProfileName]
+		expectedFeatures   FeaturesSet
+		expectedSource     supportedFeaturesSource
+	}{
+		{
+			name:             "properly infer mesh supported features",
+			expectedFeatures: namesToFeatureSet(meshStatusFeatureNames),
+			expectedSource:   supportedFeaturesSourceInferred,
+		},
+		{
+			name:              "no features",
+			supportedFeatures: sets.New[features.FeatureName]("Mesh"),
+			expectedFeatures:  sets.New[features.FeatureName]("Mesh"),
+			expectedSource:    supportedFeaturesSourceManual,
+		},
+		{
+			name:              "remove exempt features",
+			supportedFeatures: sets.New[features.FeatureName]("MeshTLS", "MeshAccessControl"),
+			exemptFeatures:    sets.New[features.FeatureName]("MeshAccessControl"),
+			expectedFeatures:  sets.New[features.FeatureName]("MeshTLS"),
+			expectedSource:    supportedFeaturesSourceManual,
+		},
+		{
+			name:               "supports conformance profile - core",
+			ConformanceProfile: sets.New(MeshHTTPConformanceProfileName),
+			expectedFeatures:   namesToFeatureSet(meshStatusFeatureNames),
+			expectedSource:     supportedFeaturesSourceInferred,
+		},
+	}
+
+	meshName := "xochopintre"
+	xmesh := &xmeshv1alpha1.XMesh{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: meshName,
+		},
+		Spec: xmeshv1alpha1.MeshSpec{
+			ControllerName: "example.com/mesh-controller",
+		},
+		Status: xmeshv1alpha1.MeshStatus{
+			Conditions: []metav1.Condition{
+				{
+					Type:    string(xmeshv1alpha1.MeshConditionAccepted),
+					Status:  metav1.ConditionTrue,
+					Reason:  "Accepted",
+					Message: "XMesh is accepted and ready for use",
+				},
+			},
+			SupportedFeatures: featureNamesToSet(meshStatusFeatureNames),
+		},
+	}
+	scheme := runtime.NewScheme()
+	scheme.AddKnownTypes(xmeshv1alpha1.SchemeGroupVersion, &xmeshv1alpha1.XMesh{})
+	fakeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(xmesh).
+		WithLists(&apiextensionsv1.CustomResourceDefinitionList{}).
+		Build()
+
+	xmeshv1alpha1.Install(fakeClient.Scheme())
+	apiextensionsv1.AddToScheme(fakeClient.Scheme())
+
+	for _, tc := range testCases {
+		options := ConformanceOptions{
+			AllowCRDsMismatch:          true,
+			MeshName:                   meshName,
+			EnableAllSupportedFeatures: tc.allowAllFeatures,
+			SupportedFeatures:          tc.supportedFeatures,
+			ExemptFeatures:             tc.exemptFeatures,
+			ConformanceProfiles:        tc.ConformanceProfile,
+			Client:                     fakeClient,
+		}
+
 		t.Run(tc.name, func(t *testing.T) {
 			cSuite, err := NewConformanceTestSuite(options)
 			if err != nil {
diff --git a/pkg/test/cel/backendtlspolicy_test.go b/pkg/test/cel/backendtlspolicy_test.go
index d035ef6f..2be7fa5b 100644
--- a/pkg/test/cel/backendtlspolicy_test.go
+++ b/pkg/test/cel/backendtlspolicy_test.go
@@ -1,6 +1,3 @@
-//go:build experimental
-// +build experimental
-
 /*
 Copyright 2023 The Kubernetes Authors.
 
@@ -26,31 +23,31 @@ import (
 	"time"
 
 	corev1 "k8s.io/api/core/v1"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	gatewayv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
-	gatewayv1a3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
-	v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+
+	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
 )
 
 func TestBackendTLSPolicyTargetRefs(t *testing.T) {
 	tests := []struct {
 		name       string
 		wantErrors []string
-		targetRefs []gatewayv1a2.LocalPolicyTargetReferenceWithSectionName
+		targetRefs []gatewayv1.LocalPolicyTargetReferenceWithSectionName
 	}{
 		{
 			name:       "invalid because duplicate target refs without section name",
 			wantErrors: []string{"sectionName must be unique when targetRefs includes 2 or more references to the same target"},
-			targetRefs: []gatewayv1a2.LocalPolicyTargetReferenceWithSectionName{{
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+			targetRefs: []gatewayv1.LocalPolicyTargetReferenceWithSectionName{{
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
 			}, {
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
 			}},
@@ -58,60 +55,60 @@ func TestBackendTLSPolicyTargetRefs(t *testing.T) {
 		{
 			name:       "invalid because duplicate target refs with only one section name",
 			wantErrors: []string{"sectionName must be specified when targetRefs includes 2 or more references to the same target"},
-			targetRefs: []gatewayv1a2.LocalPolicyTargetReferenceWithSectionName{{
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+			targetRefs: []gatewayv1.LocalPolicyTargetReferenceWithSectionName{{
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
 			}, {
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example2",
 				},
 			}, {
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("foo")),
+				SectionName: ptrTo(gatewayv1.SectionName("foo")),
 			}},
 		},
 		{
 			name:       "invalid because duplicate target refs with duplicate section names",
 			wantErrors: []string{"sectionName must be unique when targetRefs includes 2 or more references to the same target"},
-			targetRefs: []gatewayv1a2.LocalPolicyTargetReferenceWithSectionName{{
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+			targetRefs: []gatewayv1.LocalPolicyTargetReferenceWithSectionName{{
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("foo")),
+				SectionName: ptrTo(gatewayv1.SectionName("foo")),
 			}, {
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("bar")),
+				SectionName: ptrTo(gatewayv1.SectionName("bar")),
 			}, {
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("foo")),
+				SectionName: ptrTo(gatewayv1.SectionName("foo")),
 			}},
 		},
 		{
 			name:       "valid single targetRef without sectionName",
 			wantErrors: []string{},
-			targetRefs: []gatewayv1a2.LocalPolicyTargetReferenceWithSectionName{{
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+			targetRefs: []gatewayv1.LocalPolicyTargetReferenceWithSectionName{{
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
 			}},
@@ -119,117 +116,117 @@ func TestBackendTLSPolicyTargetRefs(t *testing.T) {
 		{
 			name:       "valid single targetRef with sectionName",
 			wantErrors: []string{},
-			targetRefs: []gatewayv1a2.LocalPolicyTargetReferenceWithSectionName{{
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+			targetRefs: []gatewayv1.LocalPolicyTargetReferenceWithSectionName{{
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("foo")),
+				SectionName: ptrTo(gatewayv1.SectionName("foo")),
 			}},
 		},
 		{
 			name:       "valid because duplicate target refs with different section names",
 			wantErrors: []string{},
-			targetRefs: []gatewayv1a2.LocalPolicyTargetReferenceWithSectionName{{
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+			targetRefs: []gatewayv1.LocalPolicyTargetReferenceWithSectionName{{
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("foo")),
+				SectionName: ptrTo(gatewayv1.SectionName("foo")),
 			}, {
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("bar")),
+				SectionName: ptrTo(gatewayv1.SectionName("bar")),
 			}, {
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("jin")),
+				SectionName: ptrTo(gatewayv1.SectionName("jin")),
 			}},
 		},
 		{
 			name:       "valid because duplicate target refs with different names",
 			wantErrors: []string{},
-			targetRefs: []gatewayv1a2.LocalPolicyTargetReferenceWithSectionName{{
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+			targetRefs: []gatewayv1.LocalPolicyTargetReferenceWithSectionName{{
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("foo")),
+				SectionName: ptrTo(gatewayv1.SectionName("foo")),
 			}, {
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example2",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("foo")),
+				SectionName: ptrTo(gatewayv1.SectionName("foo")),
 			}, {
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example3",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("foo")),
+				SectionName: ptrTo(gatewayv1.SectionName("foo")),
 			}},
 		},
 		{
 			name:       "valid because duplicate target refs with different kinds",
 			wantErrors: []string{},
-			targetRefs: []gatewayv1a2.LocalPolicyTargetReferenceWithSectionName{{
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+			targetRefs: []gatewayv1.LocalPolicyTargetReferenceWithSectionName{{
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("foo")),
+				SectionName: ptrTo(gatewayv1.SectionName("foo")),
 			}, {
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("NotService"),
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("NotService"),
 					Name:  "example",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("foo")),
+				SectionName: ptrTo(gatewayv1.SectionName("foo")),
 			}},
 		},
 		{
 			name:       "valid because duplicate target refs with different groups",
 			wantErrors: []string{},
-			targetRefs: []gatewayv1a2.LocalPolicyTargetReferenceWithSectionName{{
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group(corev1.GroupName),
-					Kind:  gatewayv1a2.Kind("Service"),
+			targetRefs: []gatewayv1.LocalPolicyTargetReferenceWithSectionName{{
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group(corev1.GroupName),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("foo")),
+				SectionName: ptrTo(gatewayv1.SectionName("foo")),
 			}, {
-				LocalPolicyTargetReference: gatewayv1a2.LocalPolicyTargetReference{
-					Group: gatewayv1a2.Group("svc.other.io"),
-					Kind:  gatewayv1a2.Kind("Service"),
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Group: gatewayv1.Group("svc.other.io"),
+					Kind:  gatewayv1.Kind("Service"),
 					Name:  "example",
 				},
-				SectionName: ptrTo(gatewayv1a2.SectionName("foo")),
+				SectionName: ptrTo(gatewayv1.SectionName("foo")),
 			}},
 		},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			policy := &gatewayv1a3.BackendTLSPolicy{
+			policy := &gatewayv1.BackendTLSPolicy{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      fmt.Sprintf("foo-%v", time.Now().UnixNano()),
 					Namespace: metav1.NamespaceDefault,
 				},
-				Spec: gatewayv1a3.BackendTLSPolicySpec{
+				Spec: gatewayv1.BackendTLSPolicySpec{
 					TargetRefs: tc.targetRefs,
-					Validation: gatewayv1a3.BackendTLSPolicyValidation{
-						WellKnownCACertificates: ptrTo(gatewayv1a3.WellKnownCACertificatesType("System")),
+					Validation: gatewayv1.BackendTLSPolicyValidation{
+						WellKnownCACertificates: ptrTo(gatewayv1.WellKnownCACertificatesType("System")),
 						Hostname:                "foo.example.com",
 					},
 				},
@@ -243,20 +240,20 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 	tests := []struct {
 		name             string
 		wantErrors       []string
-		policyValidation gatewayv1a3.BackendTLSPolicyValidation
+		policyValidation gatewayv1.BackendTLSPolicyValidation
 	}{
 		{
 			name: "valid BackendTLSPolicyValidation with WellKnownCACertificates",
-			policyValidation: gatewayv1a3.BackendTLSPolicyValidation{
-				WellKnownCACertificates: ptrTo(gatewayv1a3.WellKnownCACertificatesType("System")),
+			policyValidation: gatewayv1.BackendTLSPolicyValidation{
+				WellKnownCACertificates: ptrTo(gatewayv1.WellKnownCACertificatesType("System")),
 				Hostname:                "foo.example.com",
 			},
 			wantErrors: []string{},
 		},
 		{
 			name: "valid BackendTLSPolicyValidation with CACertificateRefs",
-			policyValidation: gatewayv1a3.BackendTLSPolicyValidation{
-				CACertificateRefs: []v1beta1.LocalObjectReference{
+			policyValidation: gatewayv1.BackendTLSPolicyValidation{
+				CACertificateRefs: []gatewayv1.LocalObjectReference{
 					{
 						Group: "group",
 						Kind:  "kind",
@@ -269,20 +266,20 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 		},
 		{
 			name:             "invalid BackendTLSPolicyValidation with missing fields",
-			policyValidation: gatewayv1a3.BackendTLSPolicyValidation{},
+			policyValidation: gatewayv1.BackendTLSPolicyValidation{},
 			wantErrors:       []string{"spec.validation.hostname in body should be at least 1 chars long", "must specify either CACertificateRefs or WellKnownCACertificates"},
 		},
 		{
 			name: "invalid BackendTLSPolicyValidation with both CACertificateRefs and WellKnownCACertificates",
-			policyValidation: gatewayv1a3.BackendTLSPolicyValidation{
-				CACertificateRefs: []v1beta1.LocalObjectReference{
+			policyValidation: gatewayv1.BackendTLSPolicyValidation{
+				CACertificateRefs: []gatewayv1.LocalObjectReference{
 					{
 						Group: "group",
 						Kind:  "kind",
 						Name:  "name",
 					},
 				},
-				WellKnownCACertificates: ptrTo(gatewayv1a3.WellKnownCACertificatesType("System")),
+				WellKnownCACertificates: ptrTo(gatewayv1.WellKnownCACertificatesType("System")),
 				Hostname:                "foo.example.com",
 			},
 
@@ -290,16 +287,16 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 		},
 		{
 			name: "invalid BackendTLSPolicyValidation with Unsupported value for WellKnownCACertificates",
-			policyValidation: gatewayv1a3.BackendTLSPolicyValidation{
-				WellKnownCACertificates: ptrTo(gatewayv1a3.WellKnownCACertificatesType("bar")),
+			policyValidation: gatewayv1.BackendTLSPolicyValidation{
+				WellKnownCACertificates: ptrTo(gatewayv1.WellKnownCACertificatesType("bar")),
 				Hostname:                "foo.example.com",
 			},
 			wantErrors: []string{"supported values: \"System\""},
 		},
 		{
 			name: "invalid BackendTLSPolicyValidation with empty Hostname field",
-			policyValidation: gatewayv1a3.BackendTLSPolicyValidation{
-				CACertificateRefs: []v1beta1.LocalObjectReference{
+			policyValidation: gatewayv1.BackendTLSPolicyValidation{
+				CACertificateRefs: []gatewayv1.LocalObjectReference{
 					{
 						Group: "group",
 						Kind:  "kind",
@@ -312,8 +309,8 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 		},
 		{
 			name: "valid BackendTLSPolicyValidation with SubjectAltName type Hostname",
-			policyValidation: gatewayv1a3.BackendTLSPolicyValidation{
-				CACertificateRefs: []v1beta1.LocalObjectReference{
+			policyValidation: gatewayv1.BackendTLSPolicyValidation{
+				CACertificateRefs: []gatewayv1.LocalObjectReference{
 					{
 						Group: "group",
 						Kind:  "kind",
@@ -321,7 +318,7 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 					},
 				},
 				Hostname: "foo.example.com",
-				SubjectAltNames: []gatewayv1a3.SubjectAltName{
+				SubjectAltNames: []gatewayv1.SubjectAltName{
 					{
 						Type:     "Hostname",
 						Hostname: "foo.example.com",
@@ -332,8 +329,8 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 		},
 		{
 			name: "valid BackendTLSPolicyValidation with SubjectAltName type URI",
-			policyValidation: gatewayv1a3.BackendTLSPolicyValidation{
-				CACertificateRefs: []v1beta1.LocalObjectReference{
+			policyValidation: gatewayv1.BackendTLSPolicyValidation{
+				CACertificateRefs: []gatewayv1.LocalObjectReference{
 					{
 						Group: "group",
 						Kind:  "kind",
@@ -341,7 +338,7 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 					},
 				},
 				Hostname: "foo.example.com",
-				SubjectAltNames: []gatewayv1a3.SubjectAltName{
+				SubjectAltNames: []gatewayv1.SubjectAltName{
 					{
 						Type: "URI",
 						URI:  "spiffe://mycluster.example",
@@ -352,8 +349,8 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 		},
 		{
 			name: "invalid BackendTLSPolicyValidation with SubjectAltName type Hostname and empty Hostname field",
-			policyValidation: gatewayv1a3.BackendTLSPolicyValidation{
-				CACertificateRefs: []v1beta1.LocalObjectReference{
+			policyValidation: gatewayv1.BackendTLSPolicyValidation{
+				CACertificateRefs: []gatewayv1.LocalObjectReference{
 					{
 						Group: "group",
 						Kind:  "kind",
@@ -361,7 +358,7 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 					},
 				},
 				Hostname: "foo.example.com",
-				SubjectAltNames: []gatewayv1a3.SubjectAltName{
+				SubjectAltNames: []gatewayv1.SubjectAltName{
 					{
 						Type:     "Hostname",
 						Hostname: "",
@@ -372,8 +369,8 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 		},
 		{
 			name: "invalid BackendTLSPolicyValidation with SubjectAltName type URI and non-empty Hostname field",
-			policyValidation: gatewayv1a3.BackendTLSPolicyValidation{
-				CACertificateRefs: []v1beta1.LocalObjectReference{
+			policyValidation: gatewayv1.BackendTLSPolicyValidation{
+				CACertificateRefs: []gatewayv1.LocalObjectReference{
 					{
 						Group: "group",
 						Kind:  "kind",
@@ -381,7 +378,7 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 					},
 				},
 				Hostname: "foo.example.com",
-				SubjectAltNames: []gatewayv1a3.SubjectAltName{
+				SubjectAltNames: []gatewayv1.SubjectAltName{
 					{
 						Type:     "URI",
 						Hostname: "foo.example.com",
@@ -392,8 +389,8 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 		},
 		{
 			name: "invalid BackendTLSPolicyValidation with SubjectAltName type URI and empty URI field",
-			policyValidation: gatewayv1a3.BackendTLSPolicyValidation{
-				CACertificateRefs: []v1beta1.LocalObjectReference{
+			policyValidation: gatewayv1.BackendTLSPolicyValidation{
+				CACertificateRefs: []gatewayv1.LocalObjectReference{
 					{
 						Group: "group",
 						Kind:  "kind",
@@ -401,7 +398,7 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 					},
 				},
 				Hostname: "foo.example.com",
-				SubjectAltNames: []gatewayv1a3.SubjectAltName{
+				SubjectAltNames: []gatewayv1.SubjectAltName{
 					{
 						Type: "URI",
 						URI:  "",
@@ -412,8 +409,8 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 		},
 		{
 			name: "invalid BackendTLSPolicyValidation with SubjectAltName type Hostname and non-empty URI field",
-			policyValidation: gatewayv1a3.BackendTLSPolicyValidation{
-				CACertificateRefs: []v1beta1.LocalObjectReference{
+			policyValidation: gatewayv1.BackendTLSPolicyValidation{
+				CACertificateRefs: []gatewayv1.LocalObjectReference{
 					{
 						Group: "group",
 						Kind:  "kind",
@@ -421,7 +418,7 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 					},
 				},
 				Hostname: "foo.example.com",
-				SubjectAltNames: []gatewayv1a3.SubjectAltName{
+				SubjectAltNames: []gatewayv1.SubjectAltName{
 					{
 						Type: "Hostname",
 						URI:  "test",
@@ -432,8 +429,8 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 		},
 		{
 			name: "invalid BackendTLSPolicyValidation with SubjectAltName type Hostname and both Hostname and URI specified",
-			policyValidation: gatewayv1a3.BackendTLSPolicyValidation{
-				CACertificateRefs: []v1beta1.LocalObjectReference{
+			policyValidation: gatewayv1.BackendTLSPolicyValidation{
+				CACertificateRefs: []gatewayv1.LocalObjectReference{
 					{
 						Group: "group",
 						Kind:  "kind",
@@ -441,7 +438,7 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 					},
 				},
 				Hostname: "foo.example.com",
-				SubjectAltNames: []gatewayv1a3.SubjectAltName{
+				SubjectAltNames: []gatewayv1.SubjectAltName{
 					{
 						Type:     "Hostname",
 						Hostname: "foo.example.com",
@@ -453,8 +450,8 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 		},
 		{
 			name: "invalid BackendTLSPolicyValidation incorrect URI SAN",
-			policyValidation: gatewayv1a3.BackendTLSPolicyValidation{
-				CACertificateRefs: []v1beta1.LocalObjectReference{
+			policyValidation: gatewayv1.BackendTLSPolicyValidation{
+				CACertificateRefs: []gatewayv1.LocalObjectReference{
 					{
 						Group: "group",
 						Kind:  "kind",
@@ -462,7 +459,7 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 					},
 				},
 				Hostname: "foo.example.com",
-				SubjectAltNames: []gatewayv1a3.SubjectAltName{
+				SubjectAltNames: []gatewayv1.SubjectAltName{
 					{
 						Type: "URI",
 						URI:  "foo.example.com",
@@ -475,21 +472,21 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			policy := &gatewayv1a3.BackendTLSPolicy{
+			policy := &gatewayv1.BackendTLSPolicy{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      fmt.Sprintf("foo-%v", time.Now().UnixNano()),
 					Namespace: metav1.NamespaceDefault,
 				},
-				Spec: gatewayv1a3.BackendTLSPolicySpec{
-					TargetRefs: []gatewayv1a2.LocalPolicyTargetReferenceWithSectionName{
+				Spec: gatewayv1.BackendTLSPolicySpec{
+					TargetRefs: []gatewayv1.LocalPolicyTargetReferenceWithSectionName{
 						{
-							gatewayv1a2.LocalPolicyTargetReference{
+							LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
 								Group: "group",
 								Kind:  "kind",
 								Name:  "name",
 							},
 							// SectionName cannot contain capital letters.
-							ptrTo(gatewayv1a2.SectionName("section")),
+							SectionName: ptrTo(gatewayv1.SectionName("section")),
 						},
 					},
 					Validation: tc.policyValidation,
@@ -500,7 +497,7 @@ func TestBackendTLSPolicyValidation(t *testing.T) {
 	}
 }
 
-func validateBackendTLSPolicy(t *testing.T, policy *gatewayv1a3.BackendTLSPolicy, wantErrors []string) {
+func validateBackendTLSPolicy(t *testing.T, policy *gatewayv1.BackendTLSPolicy, wantErrors []string) {
 	t.Helper()
 
 	ctx := context.Background()
diff --git a/pkg/test/cel/gateway_test.go b/pkg/test/cel/gateway_test.go
index ba85b50f..0bff6093 100644
--- a/pkg/test/cel/gateway_test.go
+++ b/pkg/test/cel/gateway_test.go
@@ -584,6 +584,54 @@ func TestValidateGateway(t *testing.T) {
 			},
 			wantErrors: []string{"IPAddress values must be unique", "Hostname values must be unique"},
 		},
+		{
+			desc: "optional ip address or hostname values",
+			mutate: func(gw *gatewayv1.Gateway) {
+				gw.Spec.Addresses = []gatewayv1.GatewaySpecAddress{
+					{
+						Type: ptrTo(gatewayv1.IPAddressType),
+					},
+					{
+						Type: ptrTo(gatewayv1.HostnameAddressType),
+					},
+				}
+			},
+		},
+		{
+			desc: "multiple optional ip address or hostname values alongside defined values",
+			mutate: func(gw *gatewayv1.Gateway) {
+				gw.Spec.Addresses = []gatewayv1.GatewaySpecAddress{
+					{
+						Type: ptrTo(gatewayv1.HostnameAddressType),
+					},
+					{
+						Type: ptrTo(gatewayv1.IPAddressType),
+					},
+					{
+						Type:  ptrTo(gatewayv1.IPAddressType),
+						Value: "1.2.3.4",
+					},
+					{
+						Type:  ptrTo(gatewayv1.HostnameAddressType),
+						Value: "foo.bar",
+					},
+					{
+						Type: ptrTo(gatewayv1.IPAddressType),
+					},
+					{
+						Type: ptrTo(gatewayv1.HostnameAddressType),
+					},
+					{
+						Type:  ptrTo(gatewayv1.IPAddressType),
+						Value: "2.3.4.5",
+					},
+					{
+						Type:  ptrTo(gatewayv1.HostnameAddressType),
+						Value: "bar.bar",
+					},
+				}
+			},
+		},
 	}
 
 	for _, tc := range testCases {