Repository: envoyproxy/gateway

Issue:
Annotate HTTPRoute when detecting an issue with EndpointSlice + Service configuration
*Description*:
When routing to a Service backend which owns a EndpointSlice with a broken owner reference, HTTPRoute should be annotated to describe the error. At the moment EnvoyGateway will add a static 500 direct response route in its place, but there is no log message or annotation on resources to convey that there is a problem.

*Repro steps*:

This is reproducible when configuring a Service backend, which owns an EndpointSlice, but the owner reference label isn't correct. **Note the incorrect owner reference label on the EndpointSlice `kubernetes.io/service-name: not-the-correct-reference`**

I was able to reproduce this using these steps:

```bash
kind create cluster --name envoy-gateway-500 --wait 300s

kubectl get namespace envoy-gateway-system || kubectl create namespace envoy-gateway-system
helm upgrade eg oci://docker.io/envoyproxy/gateway-helm --version v1.4.0 -n envoy-gateway-system --install
kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for=condition=Available

kubectl apply -f envoy-resources.yaml

egctl x status all -A

ENVOY_POD=$(kubectl get pods -n envoy-gateway-system  -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=envoy-gateway-system,gateway.envoyproxy.io/owning-gateway-name=public -o jsonpath='{.items[0].metadata.name}')
kubectl wait --for=condition=Ready pod/$ENVOY_POD -n envoy-gateway-system

ENVOY_SERVICE=$(kubectl get svc -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=envoy-gateway-system,gateway.envoyproxy.io/owning-gateway-name=public -o jsonpath='{.items[0].metadata.name}')
kubectl -n envoy-gateway-system port-forward service/${ENVOY_SERVICE} 8888:80 &

curl -v -H 'Host: www.example.com' localhost:8888/json

# Will result in a 500 error directly from envoy gateway
```

<details>
<summary>envoy-resources.yaml</summary>

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: public
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
  parametersRef:
    group: gateway.envoyproxy.io
    kind: EnvoyProxy
    namespace: envoy-gateway-system
    name: public-gateway-config
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: public-gateway-config
  namespace: envoy-gateway-system
spec:
  provider:
    type: Kubernetes
    kubernetes:
      envoyDeployment:
        replicas: 1
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: public
  namespace: envoy-gateway-system
spec:
  gatewayClassName: public
  listeners:
    - name: http
      protocol: HTTP
      port: 80
      allowedRoutes:
        namespaces:
          from: All
      hostname: "www.example.com"
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: httpbin
  namespace: envoy-gateway-system
spec:
  hostnames:
  - "www.example.com"
  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: public
    namespace: envoy-gateway-system
    sectionName: http
  rules:
  - backendRefs:
    - group: gateway.envoyproxy.io
      kind: Service
      name: httpbin
      port: 80
    filters:
    - type: URLRewrite
      urlRewrite:
        hostname: httpbingo.org
    matches:
    - path:
        type: PathPrefix
        value: /
    timeouts:
      backendRequest: 5s
      request: 5s
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin
  namespace: envoy-gateway-system
spec:
  ports:
    - port: 80
      protocol: TCP
      targetPort: 80
      name: https
---
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: httpbin
  namespace: envoy-gateway-system
  labels:
    kubernetes.io/service-name: not-the-correct-reference
addressType: FQDN
ports:
- name: https
  protocol: TCP
  port: 80
endpoints:
- addresses:
  - "httpbingo.org"
```

</details>

*Environment*:

Envoy Gateway 1.4.0

*Logs*:

<details>

<summary>Envoy Proxy logs</summary>

```
shutdown-manager 2025-06-06T21:18:22.217Z    INFO    shutdown-manager    envoy/shutdown_manager.go:74    starting shutdown manager
envoy {":authority":"www.example.com","bytes_received":0,"bytes_sent":0,"connection_termination_details":null,"downstream_local_address":"127.0.0.1:10080","downstream_remote_address":"127.0.0.1:48212","duration":0,"method":"GET","protocol":"HTTP/1.1","requested_server_name":null,"response_code":500,"response_code_details":"direct_response","response_flags":"-","route_name":"httproute/envoy-gateway-system/httpbin/rule/0/match/0/www_example_com","start_time":"2025-06-06T21:19:16.316Z","upstream_cluster":null,"upstream_host":null,"upstream_local_address":null,"upstream_transport_failure_reason":null,"user-agent":"curl/8.7.1","x-envoy-origin-path":"/json","x-envoy-upstream-service-time":null,"x-forwarded-for":"10.244.0.9","x-request-id":"49838d97-42d1-4913-9f8e-d389b2ddddce"}
```

</details>



<details>
<summary>Controller logs</summary>

```
2025-06-06T21:18:22.142Z    INFO    admin    admin/server.go:34    starting admin server    {"address": "127.0.0.1:19000", "enablePprof": false}
2025-06-06T21:18:22.143Z    INFO    metrics    metrics/register.go:179    initialized metrics pull endpoint    {"address": "0.0.0.0:19001", "endpoint": "/metrics"}
2025-06-06T21:18:22.143Z    INFO    metrics    metrics/register.go:62    starting metrics server    {"address": "0.0.0.0:19001"}
2025-06-06T21:18:22.143Z    INFO    cmd/server.go:67    Start runners
2025-06-06T21:18:22.143Z    INFO    cmd/server.go:277    Starting runner    {"name": "provider"}
2025-06-06T21:18:22.146Z    INFO    provider.controller-runtime.webhook    webhook/server.go:183    Registering webhook    {"runner": "provider", "path": "/inject-pod-topology"}
2025-06-06T21:18:22.146Z    INFO    provider    kubernetes/controller.go:141    created gatewayapi controller    {"runner": "provider"}
2025-06-06T21:18:22.158Z    INFO    provider    kubernetes/controller.go:1524    ServiceImport CRD not found, skipping ServiceImport watch    {"runner": "provider"}
2025-06-06T21:18:22.166Z    INFO    provider    kubernetes/controller.go:1878    Watching gatewayAPI related objects    {"runner": "provider"}
2025-06-06T21:18:22.168Z    INFO    provider    runner/runner.go:66    Running provider    {"runner": "provider", "type": "Kubernetes"}
2025-06-06T21:18:22.168Z    INFO    cmd/server.go:277    Starting runner    {"name": "gateway-api"}
2025-06-06T21:18:22.168Z    INFO    gateway-api    runner/runner.go:91    started    {"runner": "gateway-api"}
2025-06-06T21:18:22.168Z    INFO    cmd/server.go:277    Starting runner    {"name": "xds-translator"}
2025-06-06T21:18:22.168Z    INFO    xds-translator    runner/runner.go:53    started    {"runner": "xds-translator"}
2025-06-06T21:18:22.168Z    INFO    cmd/server.go:277    Starting runner    {"name": "infrastructure"}
2025-06-06T21:18:22.168Z    INFO    cmd/server.go:277    Starting runner    {"name": "xds-server"}
2025-06-06T21:18:22.168Z    INFO    xds-server    runner/runner.go:98    loaded TLS certificate and key    {"runner": "xds-server"}
2025-06-06T21:18:22.168Z    INFO    provider    manager/server.go:83    starting server    {"runner": "provider", "name": "health probe", "addr": "[::]:8081"}
2025-06-06T21:18:22.168Z    INFO    xds-server    runner/runner.go:149    started    {"runner": "xds-server"}
2025-06-06T21:18:22.168Z    INFO    provider.controller-runtime.metrics    server/server.go:208    Starting metrics server    {"runner": "provider"}
2025-06-06T21:18:22.168Z    INFO    provider.controller-runtime.metrics    server/server.go:247    Serving metrics server    {"runner": "provider", "bindAddress": ":8080", "secure": false}
2025-06-06T21:18:22.168Z    INFO    provider.controller-runtime.webhook    webhook/server.go:191    Starting webhook server    {"runner": "provider"}
2025-06-06T21:18:22.168Z    INFO    provider.controller-runtime.certwatcher    certwatcher/certwatcher.go:211    Updated current TLS certificate    {"runner": "provider"}
2025-06-06T21:18:22.168Z    INFO    provider.controller-runtime.webhook    webhook/server.go:242    Serving webhook server    {"runner": "provider", "host": "", "port": 9443}
2025-06-06T21:18:22.169Z    INFO    provider.controller-runtime.certwatcher    certwatcher/certwatcher.go:133    Starting certificate poll+watcher    {"runner": "provider", "interval": "10s"}
2025-06-06T21:18:22.174Z    INFO    wasm-cache    wasm/httpserver.go:111    Listening on :18002
2025-06-06T21:18:22.270Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1alpha1.HTTPRouteFilter"}
2025-06-06T21:18:22.271Z    INFO    provider    leaderelection/leaderelection.go:257    attempting to acquire leader lease envoy-gateway-system/5b9825d2.gateway.envoyproxy.io...    {"runner": "provider"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "*kubernetes.watchAndReconcileSource"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1.GatewayClass"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1.ConfigMap"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1alpha2.UDPRoute"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1.Deployment"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1.DaemonSet"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1.Gateway"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1alpha1.ClientTrafficPolicy"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1.HTTPRoute"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1alpha2.TCPRoute"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1.GRPCRoute"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1alpha1.BackendTrafficPolicy"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1alpha2.TLSRoute"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1.Service"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1alpha1.EnvoyProxy"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1.EndpointSlice"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1alpha1.EnvoyExtensionPolicy"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1.Node"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1alpha1.SecurityPolicy"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1alpha3.BackendTLSPolicy"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1.Secret"}
2025-06-06T21:18:22.271Z    INFO    provider    controller/controller.go:204    Starting EventSource    {"runner": "provider", "controller": "gatewayapi-1749244702", "source": "kind source: *v1beta1.ReferenceGrant"}
2025-06-06T21:18:22.371Z    INFO    provider    kubernetes/predicates.go:41    gatewayclass has matching controller name, processing    {"runner": "provider", "name": "public"}
2025-06-06T21:18:22.372Z    INFO    provider    controller/controller.go:239    Starting Controller    {"runner": "provider", "controller": "gatewayapi-1749244702"}
2025-06-06T21:18:22.372Z    INFO    provider    controller/controller.go:248    Starting workers    {"runner": "provider", "controller": "gatewayapi-1749244702", "worker count": 1}
2025-06-06T21:18:22.372Z    INFO    provider    kubernetes/controller.go:190    reconciling gateways    {"runner": "provider"}
2025-06-06T21:18:22.372Z    INFO    provider    kubernetes/controller.go:2029    processing EnvoyProxy    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "public-gateway-config"}
2025-06-06T21:18:22.372Z    INFO    provider    kubernetes/controller.go:1072    processing Gateway    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "public"}
2025-06-06T21:18:22.372Z    INFO    provider    kubernetes/routes.go:234    processing HTTPRoute    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "httpbin"}
2025-06-06T21:18:22.473Z    INFO    provider    kubernetes/controller.go:774    processing OIDC HMAC Secret    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "envoy-oidc-hmac"}
2025-06-06T21:18:22.573Z    INFO    provider    kubernetes/controller.go:423    processing Backend    {"runner": "provider", "kind": "Service", "namespace": "envoy-gateway-system", "name": "httpbin"}
2025-06-06T21:18:22.574Z    INFO    provider    kubernetes/controller.go:437    added Service to resource tree    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "httpbin"}
2025-06-06T21:18:22.675Z    INFO    provider    kubernetes/controller.go:362    reconciled gateways successfully    {"runner": "provider"}
2025-06-06T21:18:22.675Z    INFO    provider    kubernetes/controller.go:190    reconciling gateways    {"runner": "provider"}
2025-06-06T21:18:22.676Z    INFO    provider    kubernetes/controller.go:2029    processing EnvoyProxy    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "public-gateway-config"}
2025-06-06T21:18:22.676Z    INFO    provider    kubernetes/controller.go:1072    processing Gateway    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "public"}
2025-06-06T21:18:22.676Z    INFO    provider    kubernetes/routes.go:234    processing HTTPRoute    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "httpbin"}
2025-06-06T21:18:22.676Z    INFO    provider    kubernetes/controller.go:774    processing OIDC HMAC Secret    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "envoy-oidc-hmac"}
2025-06-06T21:18:22.676Z    INFO    provider    kubernetes/controller.go:423    processing Backend    {"runner": "provider", "kind": "Service", "namespace": "envoy-gateway-system", "name": "httpbin"}
2025-06-06T21:18:22.676Z    INFO    provider    kubernetes/controller.go:437    added Service to resource tree    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "httpbin"}
2025-06-06T21:18:22.676Z    INFO    provider    kubernetes/controller.go:362    reconciled gateways successfully    {"runner": "provider"}
2025-06-06T21:18:22.676Z    INFO    gateway-api    runner/runner.go:129    received an update    {"runner": "gateway-api"}
2025-06-06T21:18:22.680Z    INFO    xds-translator    runner/runner.go:61    received an update    {"runner": "xds-translator"}
2025-06-06T21:18:22.684Z    INFO    xds-server    runner/runner.go:195    received an update    {"runner": "xds-server"}
2025-06-06T21:18:35.860Z    INFO    xds-server    v3/simple.go:569    open delta watch ID:1 for type.googleapis.com/envoy.config.cluster.v3.Cluster Resources:map] from nodeID: "envoy-envoy-gateway-system-public-5ea56ca9-6b454dc6cb-5tzkw",  version ""
2025-06-06T21:18:35.864Z    INFO    xds-server    v3/simple.go:569    open delta watch ID:2 for type.googleapis.com/envoy.config.listener.v3.Listener Resources:map] from nodeID: "envoy-envoy-gateway-system-public-5ea56ca9-6b454dc6cb-5tzkw",  version "1"
2025-06-06T21:18:35.868Z    INFO    xds-server    v3/simple.go:569    open delta watch ID:3 for type.googleapis.com/envoy.config.route.v3.RouteConfiguration Resources:map[envoy-gateway-system/public/http:{}] from nodeID: "envoy-envoy-gateway-system-public-5ea56ca9-6b454dc6cb-5tzkw",  version "1"
2025-06-06T21:18:36.433Z    INFO    xds-server    v3/simple.go:569    open delta watch ID:4 for type.googleapis.com/envoy.config.cluster.v3.Cluster Resources:map] from nodeID: "envoy-envoy-gateway-system-public-5ea56ca9-6b454dc6cb-d9rtk",  version ""
2025-06-06T21:18:36.435Z    INFO    xds-server    v3/simple.go:569    open delta watch ID:5 for type.googleapis.com/envoy.config.listener.v3.Listener Resources:map] from nodeID: "envoy-envoy-gateway-system-public-5ea56ca9-6b454dc6cb-d9rtk",  version "1"
2025-06-06T21:18:36.435Z    INFO    xds-server    v3/simple.go:569    open delta watch ID:6 for type.googleapis.com/envoy.config.route.v3.RouteConfiguration Resources:map[envoy-gateway-system/public/http:{}] from nodeID: "envoy-envoy-gateway-system-public-5ea56ca9-6b454dc6cb-d9rtk",  version "1"
2025-06-06T21:18:38.724Z    INFO    provider    leaderelection/leaderelection.go:271    successfully acquired lease envoy-gateway-system/5b9825d2.gateway.envoyproxy.io    {"runner": "provider"}
2025-06-06T21:18:38.724Z    INFO    provider    kubernetes/status_updater.go:134    started status update handler    {"runner": "provider"}
2025-06-06T21:18:38.724Z    INFO    provider    kubernetes/controller.go:190    reconciling gateways    {"runner": "provider"}
2025-06-06T21:18:38.725Z    INFO    infrastructure    runner/runner.go:75    started    {"runner": "infrastructure"}
2025-06-06T21:18:38.725Z    INFO    provider    kubernetes/controller.go:2029    processing EnvoyProxy    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "public-gateway-config"}
2025-06-06T21:18:38.725Z    INFO    provider    kubernetes/controller.go:1072    processing Gateway    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "public"}
2025-06-06T21:18:38.725Z    INFO    provider    kubernetes/routes.go:234    processing HTTPRoute    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "httpbin"}
2025-06-06T21:18:38.725Z    INFO    provider    kubernetes/controller.go:774    processing OIDC HMAC Secret    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "envoy-oidc-hmac"}
2025-06-06T21:18:38.725Z    INFO    provider    kubernetes/controller.go:423    processing Backend    {"runner": "provider", "kind": "Service", "namespace": "envoy-gateway-system", "name": "httpbin"}
2025-06-06T21:18:38.725Z    INFO    provider    kubernetes/status_updater.go:145    received a status update    {"runner": "provider", "namespace": "", "name": "public"}
2025-06-06T21:18:38.725Z    INFO    infrastructure    runner/runner.go:100    received an update    {"runner": "infrastructure"}
2025-06-06T21:18:38.725Z    INFO    provider.public    kubernetes/status_updater.go:109    status unchanged, bypassing update    {"runner": "provider"}
2025-06-06T21:18:38.725Z    INFO    provider    kubernetes/controller.go:437    added Service to resource tree    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "httpbin"}
2025-06-06T21:18:38.726Z    INFO    provider    kubernetes/controller.go:362    reconciled gateways successfully    {"runner": "provider"}
2025-06-06T21:18:38.726Z    INFO    provider    kubernetes/status_updater.go:145    received a status update    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "httpbin"}
2025-06-06T21:18:38.726Z    INFO    gateway-api    runner/runner.go:129    received an update    {"runner": "gateway-api"}
2025-06-06T21:18:38.727Z    INFO    provider.httpbin.envoy-gateway-system    kubernetes/status_updater.go:109    status unchanged, bypassing update    {"runner": "provider"}
2025-06-06T21:18:38.727Z    INFO    provider    kubernetes/status_updater.go:145    received a status update    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "public"}
2025-06-06T21:18:38.734Z    INFO    provider    kubernetes/status_updater.go:145    received a status update    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "httpbin"}
2025-06-06T21:18:38.735Z    INFO    provider.httpbin.envoy-gateway-system    kubernetes/status_updater.go:109    status unchanged, bypassing update    {"runner": "provider"}
2025-06-06T21:18:38.735Z    INFO    provider    kubernetes/status_updater.go:145    received a status update    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "public"}
2025-06-06T21:18:41.834Z    INFO    provider    kubernetes/status_updater.go:145    received a status update    {"runner": "provider", "namespace": "envoy-gateway-system", "name": "public"}
```
</details>

Discussion:
@kkk777-7: /assign@kkk777-7: I found guidance in Gateway API PR that covers this scenario:
https://github.com/kubernetes-sigs/gateway-api/pull/3121

>// When a HTTPBackendRef refers to a Service that has no ready endpoints
>// implementations SHOULD return a 503 for requests to that backend instead.

At first, I considered setting `ResolvedRefs` to False, but in this case ResolvedRefs should remain True since the HTTPRoute can resolve the reference to the Service. 
Instead, to make the issue more visible to users, I’ll add a warning log.

To summarize...
- Return **HTTP 503** responses.
- Add a **warning log** indicating that the Service has no valid EndpointSlices.

Would this approach make sense to you?@arkodg: hey @kkk777-7 we'll need to find out why this code https://github.com/envoyproxy/gateway/blob/402cd99f56a94e0e555adc2ddfb9237fd92f5013/internal/gatewayapi/route.go#L1368 is not kicking in, a gateway-api test should help with repro@kkk777-7: thanks @arkodg , I'll look into it.@kkk777-7: In my remote branch, I can confirm that no errors have occurred.
https://github.com/kkk777-7/gateway/blob/debug-6269/internal/gatewayapi/translator_test.go#L255-L273
https://github.com/kkk777-7/gateway/blob/debug-6269/internal/gatewayapi/testdata/httproute-with-non-endpointslice.out.yaml

---

[Here](https://github.com/envoyproxy/gateway/blob/main/internal/gatewayapi/validate.go#L180),  the validation for Service appears to only check the following:
- Whether the Service specified in the backendRef exists
- Whether the port specified in the backendRef exists on that Service

Should we consider adding validation to check whether a valid EndpointSlice associated with the Service exists?
I think if we define a custom Reason(e.g. EndpointSliceNotFound) using `status.NewRouteStatusError`, we can handle the error appropriately in the subsequent processing.

https://github.com/envoyproxy/gateway/blob/main/internal/gatewayapi/route.go#L228@arkodg: thanks for confirming, 
we could return an err from https://github.com/envoyproxy/gateway/blob/32d61c492167a37311315ab04bed383fb6504b03/internal/gatewayapi/route.go#L1521 when we dont get a valid endpointslice from `GetEndpointSlicesForBackend` , which should bubble up as `RouteBackendNotFound` @kkk777-7: thanks for comment.
Since the approach is now clear, I'll begin the implementation.@github-actions: This issue has been automatically marked as stale because it has not had activity in the last 30 days.@arkodg: still looking at this one @kkk777-7  ?@kkk777-7: @arkodg 
Sorry for the late reply, I didn’t notice your reply.
I’ve addressed this in the following PR, so please take a look when you have moment.
https://github.com/envoyproxy/gateway/pull/6315@github-actions: This issue has been automatically marked as stale because it has not had activity in the last 30 days.

Solution patch:
diff --git a/api/v1alpha1/healthcheck_types.go b/api/v1alpha1/healthcheck_types.go
index d0893e7cf..e5477c2be 100644
--- a/api/v1alpha1/healthcheck_types.go
+++ b/api/v1alpha1/healthcheck_types.go
@@ -73,6 +73,15 @@ type PassiveHealthCheck struct {
 	// +kubebuilder:default=10
 	// +optional
 	MaxEjectionPercent *int32 `json:"maxEjectionPercent,omitempty"`
+
+	// FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+	// If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+	// Defaults to 85.
+	//
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:validation:Maximum=100
+	// +optional
+	FailurePercentageThreshold *uint32 `json:"failurePercentageThreshold,omitempty"`
 }
 
 // ActiveHealthCheck defines the active health check configuration.
diff --git a/api/v1alpha1/validation/envoyproxy_validate.go b/api/v1alpha1/validation/envoyproxy_validate.go
index 67eb7fa23..66230e4bd 100644
--- a/api/v1alpha1/validation/envoyproxy_validate.go
+++ b/api/v1alpha1/validation/envoyproxy_validate.go
@@ -238,10 +238,7 @@ func validateProxyAccessLog(accessLog *egv1a1.ProxyAccessLog) []error {
 					errs = append(errs, err)
 				}
 			case egv1a1.ProxyAccessLogFormatTypeJSON:
-				if setting.Format.JSON == nil {
-					err := fmt.Errorf("unable to configure access log when using JSON format but \"json\" field being empty")
-					errs = append(errs, err)
-				}
+				// TODO: add JSON format validation if needed
 			}
 		}
 
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index efef77802..fe16c185d 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -5116,6 +5116,11 @@ func (in *PassiveHealthCheck) DeepCopyInto(out *PassiveHealthCheck) {
 		*out = new(int32)
 		**out = **in
 	}
+	if in.FailurePercentageThreshold != nil {
+		in, out := &in.FailurePercentageThreshold, &out.FailurePercentageThreshold
+		*out = new(uint32)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PassiveHealthCheck.
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
index 660228f59..33e425af6 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
@@ -502,6 +502,15 @@ spec:
                           Parameter takes effect only when split_external_local_origin_errors is set to true.
                         format: int32
                         type: integer
+                      failurePercentageThreshold:
+                        description: |-
+                          FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                          If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                          Defaults to 85.
+                        format: int32
+                        maximum: 100
+                        minimum: 0
+                        type: integer
                       interval:
                         default: 3s
                         description: Interval defines the time between passive health
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
index 6b9938c7c..d7a452662 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -606,6 +606,15 @@ spec:
                                     Parameter takes effect only when split_external_local_origin_errors is set to true.
                                   format: int32
                                   type: integer
+                                failurePercentageThreshold:
+                                  description: |-
+                                    FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                    If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                    Defaults to 85.
+                                  format: int32
+                                  maximum: 100
+                                  minimum: 0
+                                  type: integer
                                 interval:
                                   default: 3s
                                   description: Interval defines the time between passive
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
index 42b759182..da916e562 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -11572,6 +11572,15 @@ spec:
                                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                                     format: int32
                                                     type: integer
+                                                  failurePercentageThreshold:
+                                                    description: |-
+                                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                                      Defaults to 85.
+                                                    format: int32
+                                                    maximum: 100
+                                                    minimum: 0
+                                                    type: integer
                                                   interval:
                                                     default: 3s
                                                     description: Interval defines
@@ -12694,6 +12703,15 @@ spec:
                                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                                     format: int32
                                                     type: integer
+                                                  failurePercentageThreshold:
+                                                    description: |-
+                                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                                      Defaults to 85.
+                                                    format: int32
+                                                    maximum: 100
+                                                    minimum: 0
+                                                    type: integer
                                                   interval:
                                                     default: 3s
                                                     description: Interval defines
@@ -13908,6 +13926,15 @@ spec:
                                                 Parameter takes effect only when split_external_local_origin_errors is set to true.
                                               format: int32
                                               type: integer
+                                            failurePercentageThreshold:
+                                              description: |-
+                                                FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                                If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                                Defaults to 85.
+                                              format: int32
+                                              maximum: 100
+                                              minimum: 0
+                                              type: integer
                                             interval:
                                               default: 3s
                                               description: Interval defines the time
@@ -15033,6 +15060,15 @@ spec:
                                           Parameter takes effect only when split_external_local_origin_errors is set to true.
                                         format: int32
                                         type: integer
+                                      failurePercentageThreshold:
+                                        description: |-
+                                          FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                          If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                          Defaults to 85.
+                                        format: int32
+                                        maximum: 100
+                                        minimum: 0
+                                        type: integer
                                       interval:
                                         default: 3s
                                         description: Interval defines the time between
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
index d6253414e..2be628d32 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -1123,6 +1123,15 @@ spec:
                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                     format: int32
                                     type: integer
+                                  failurePercentageThreshold:
+                                    description: |-
+                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                      Defaults to 85.
+                                    format: int32
+                                    maximum: 100
+                                    minimum: 0
+                                    type: integer
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
@@ -2139,6 +2148,15 @@ spec:
                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                     format: int32
                                     type: integer
+                                  failurePercentageThreshold:
+                                    description: |-
+                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                      Defaults to 85.
+                                    format: int32
+                                    maximum: 100
+                                    minimum: 0
+                                    type: integer
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
@@ -3366,6 +3384,15 @@ spec:
                                             Parameter takes effect only when split_external_local_origin_errors is set to true.
                                           format: int32
                                           type: integer
+                                        failurePercentageThreshold:
+                                          description: |-
+                                            FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                            If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                            Defaults to 85.
+                                          format: int32
+                                          maximum: 100
+                                          minimum: 0
+                                          type: integer
                                         interval:
                                           default: 3s
                                           description: Interval defines the time between
@@ -4650,6 +4677,15 @@ spec:
                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                     format: int32
                                     type: integer
+                                  failurePercentageThreshold:
+                                    description: |-
+                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                      Defaults to 85.
+                                    format: int32
+                                    maximum: 100
+                                    minimum: 0
+                                    type: integer
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
index 0e53f48f2..c2f287f35 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
@@ -501,6 +501,15 @@ spec:
                           Parameter takes effect only when split_external_local_origin_errors is set to true.
                         format: int32
                         type: integer
+                      failurePercentageThreshold:
+                        description: |-
+                          FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                          If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                          Defaults to 85.
+                        format: int32
+                        maximum: 100
+                        minimum: 0
+                        type: integer
                       interval:
                         default: 3s
                         description: Interval defines the time between passive health
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
index 783f0034d..766b87d1e 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -605,6 +605,15 @@ spec:
                                     Parameter takes effect only when split_external_local_origin_errors is set to true.
                                   format: int32
                                   type: integer
+                                failurePercentageThreshold:
+                                  description: |-
+                                    FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                    If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                    Defaults to 85.
+                                  format: int32
+                                  maximum: 100
+                                  minimum: 0
+                                  type: integer
                                 interval:
                                   default: 3s
                                   description: Interval defines the time between passive
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
index 29588cf82..27e37b8b1 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -11571,6 +11571,15 @@ spec:
                                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                                     format: int32
                                                     type: integer
+                                                  failurePercentageThreshold:
+                                                    description: |-
+                                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                                      Defaults to 85.
+                                                    format: int32
+                                                    maximum: 100
+                                                    minimum: 0
+                                                    type: integer
                                                   interval:
                                                     default: 3s
                                                     description: Interval defines
@@ -12693,6 +12702,15 @@ spec:
                                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                                     format: int32
                                                     type: integer
+                                                  failurePercentageThreshold:
+                                                    description: |-
+                                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                                      Defaults to 85.
+                                                    format: int32
+                                                    maximum: 100
+                                                    minimum: 0
+                                                    type: integer
                                                   interval:
                                                     default: 3s
                                                     description: Interval defines
@@ -13907,6 +13925,15 @@ spec:
                                                 Parameter takes effect only when split_external_local_origin_errors is set to true.
                                               format: int32
                                               type: integer
+                                            failurePercentageThreshold:
+                                              description: |-
+                                                FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                                If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                                Defaults to 85.
+                                              format: int32
+                                              maximum: 100
+                                              minimum: 0
+                                              type: integer
                                             interval:
                                               default: 3s
                                               description: Interval defines the time
@@ -15032,6 +15059,15 @@ spec:
                                           Parameter takes effect only when split_external_local_origin_errors is set to true.
                                         format: int32
                                         type: integer
+                                      failurePercentageThreshold:
+                                        description: |-
+                                          FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                          If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                          Defaults to 85.
+                                        format: int32
+                                        maximum: 100
+                                        minimum: 0
+                                        type: integer
                                       interval:
                                         default: 3s
                                         description: Interval defines the time between
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
index 1327175b0..89a904c6a 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -1122,6 +1122,15 @@ spec:
                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                     format: int32
                                     type: integer
+                                  failurePercentageThreshold:
+                                    description: |-
+                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                      Defaults to 85.
+                                    format: int32
+                                    maximum: 100
+                                    minimum: 0
+                                    type: integer
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
@@ -2138,6 +2147,15 @@ spec:
                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                     format: int32
                                     type: integer
+                                  failurePercentageThreshold:
+                                    description: |-
+                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                      Defaults to 85.
+                                    format: int32
+                                    maximum: 100
+                                    minimum: 0
+                                    type: integer
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
@@ -3365,6 +3383,15 @@ spec:
                                             Parameter takes effect only when split_external_local_origin_errors is set to true.
                                           format: int32
                                           type: integer
+                                        failurePercentageThreshold:
+                                          description: |-
+                                            FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                            If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                            Defaults to 85.
+                                          format: int32
+                                          maximum: 100
+                                          minimum: 0
+                                          type: integer
                                         interval:
                                           default: 3s
                                           description: Interval defines the time between
@@ -4649,6 +4676,15 @@ spec:
                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                     format: int32
                                     type: integer
+                                  failurePercentageThreshold:
+                                    description: |-
+                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                      Defaults to 85.
+                                    format: int32
+                                    maximum: 100
+                                    minimum: 0
+                                    type: integer
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
diff --git a/examples/envoy-ext-auth/Dockerfile b/examples/envoy-ext-auth/Dockerfile
index a9985defb..afec60df0 100644
--- a/examples/envoy-ext-auth/Dockerfile
+++ b/examples/envoy-ext-auth/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.24.8 AS builder
+FROM golang:1.25.3 AS builder
 
 ARG GO_LDFLAGS=""
 
diff --git a/examples/envoy-ext-auth/go.mod b/examples/envoy-ext-auth/go.mod
index 1ca9d2ce1..94ccf807d 100644
--- a/examples/envoy-ext-auth/go.mod
+++ b/examples/envoy-ext-auth/go.mod
@@ -1,6 +1,6 @@
 module github.com/envoyproxy/gateway-grcp-ext-auth
 
-go 1.24.8
+go 1.25.3
 
 require (
 	github.com/envoyproxy/go-control-plane/envoy v1.35.0
diff --git a/examples/extension-server/go.mod b/examples/extension-server/go.mod
index 0c4edb7f5..a70e5ecdc 100644
--- a/examples/extension-server/go.mod
+++ b/examples/extension-server/go.mod
@@ -1,6 +1,6 @@
 module github.com/exampleorg/envoygateway-extension
 
-go 1.24.8
+go 1.25.3
 
 require (
 	github.com/envoyproxy/gateway v1.3.1
diff --git a/examples/grpc-ext-proc/Dockerfile b/examples/grpc-ext-proc/Dockerfile
index 1c0bcbaca..d527a3b44 100644
--- a/examples/grpc-ext-proc/Dockerfile
+++ b/examples/grpc-ext-proc/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.24.8 AS builder
+FROM golang:1.25.3 AS builder
 
 ARG GO_LDFLAGS=""
 
diff --git a/examples/grpc-ext-proc/go.mod b/examples/grpc-ext-proc/go.mod
index 272db4c7b..2b9c0c381 100644
--- a/examples/grpc-ext-proc/go.mod
+++ b/examples/grpc-ext-proc/go.mod
@@ -1,6 +1,6 @@
 module github.com/envoyproxy/gateway-grpc-ext-proc
 
-go 1.24.8
+go 1.25.3
 
 require (
 	github.com/envoyproxy/go-control-plane/envoy v1.35.0
diff --git a/examples/preserve-case-backend/Dockerfile b/examples/preserve-case-backend/Dockerfile
index 2c73a9300..5507788e3 100644
--- a/examples/preserve-case-backend/Dockerfile
+++ b/examples/preserve-case-backend/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.24.8 AS builder
+FROM golang:1.25.3 AS builder
 
 ARG GO_LDFLAGS=""
 
diff --git a/examples/preserve-case-backend/go.mod b/examples/preserve-case-backend/go.mod
index 65eb062d2..7eeafe075 100644
--- a/examples/preserve-case-backend/go.mod
+++ b/examples/preserve-case-backend/go.mod
@@ -1,6 +1,6 @@
 module github.com/envoyproxy/gateway-preserve-case-backend
 
-go 1.24.8
+go 1.25.3
 
 require github.com/valyala/fasthttp v1.67.0
 
diff --git a/examples/simple-extension-server/Dockerfile b/examples/simple-extension-server/Dockerfile
index 393e6404e..fc988f07e 100644
--- a/examples/simple-extension-server/Dockerfile
+++ b/examples/simple-extension-server/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.24.8 AS builder
+FROM golang:1.25.3 AS builder
 
 ARG GO_LDFLAGS=""
 
diff --git a/examples/simple-extension-server/go.mod b/examples/simple-extension-server/go.mod
index b983c93f7..1e6631c30 100644
--- a/examples/simple-extension-server/go.mod
+++ b/examples/simple-extension-server/go.mod
@@ -1,6 +1,6 @@
 module github.com/envoyproxy/gateway-simple-extension-server
 
-go 1.24.8
+go 1.25.3
 
 require (
 	github.com/envoyproxy/gateway v1.5.3
diff --git a/examples/static-file-server/Dockerfile b/examples/static-file-server/Dockerfile
index 0fb67e210..f5d9c22d2 100644
--- a/examples/static-file-server/Dockerfile
+++ b/examples/static-file-server/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.24.8 AS builder
+FROM golang:1.25.3 AS builder
 
 ARG GO_LDFLAGS=""
 
diff --git a/examples/static-file-server/go.mod b/examples/static-file-server/go.mod
index d8de50854..c9dabfb14 100644
--- a/examples/static-file-server/go.mod
+++ b/examples/static-file-server/go.mod
@@ -1,3 +1,3 @@
 module github.com/envoyproxy/static-file-server
 
-go 1.24.8
+go 1.25.3
diff --git a/go.mod b/go.mod
index 0bf65e9fe..ec9d47a08 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/envoyproxy/gateway
 
-go 1.24.8
+go 1.25.3
 
 require (
 	fortio.org/fortio v1.73.0
diff --git a/internal/gatewayapi/clustersettings.go b/internal/gatewayapi/clustersettings.go
index 41d79129b..409acd787 100644
--- a/internal/gatewayapi/clustersettings.go
+++ b/internal/gatewayapi/clustersettings.go
@@ -429,6 +429,7 @@ func buildPassiveHealthCheck(policy egv1a1.HealthCheck) *ir.OutlierDetection {
 		ConsecutiveGatewayErrors:       hc.ConsecutiveGatewayErrors,
 		Consecutive5xxErrors:           hc.Consecutive5xxErrors,
 		MaxEjectionPercent:             hc.MaxEjectionPercent,
+		FailurePercentageThreshold:     hc.FailurePercentageThreshold,
 	}
 
 	if hc.Interval != nil {
diff --git a/internal/gatewayapi/ext_service.go b/internal/gatewayapi/ext_service.go
index b65401ac8..e68477cab 100644
--- a/internal/gatewayapi/ext_service.go
+++ b/internal/gatewayapi/ext_service.go
@@ -99,15 +99,22 @@ func (t *Translator) processExtServiceDestination(
 	var (
 		backendTLS *ir.TLSUpstreamConfig
 		ds         *ir.DestinationSetting
+		err        error
 	)
 
 	backendNamespace := NamespaceDerefOr(backendRef.Namespace, policyNamespacedName.Namespace)
 
 	switch KindDerefOr(backendRef.Kind, resource.KindService) {
 	case resource.KindService:
-		ds = t.processServiceDestinationSetting(settingName, backendRef.BackendObjectReference, backendNamespace, protocol, resources, envoyProxy)
+		ds, err = t.processServiceDestinationSetting(settingName, backendRef.BackendObjectReference, backendNamespace, protocol, resources, envoyProxy)
+		if err != nil {
+			return nil, err
+		}
 	case resource.KindServiceImport:
-		ds = t.processServiceImportDestinationSetting(settingName, backendRef.BackendObjectReference, backendNamespace, protocol, resources, envoyProxy)
+		ds, err = t.processServiceImportDestinationSetting(settingName, backendRef.BackendObjectReference, backendNamespace, protocol, resources, envoyProxy)
+		if err != nil {
+			return nil, err
+		}
 	case egv1a1.KindBackend:
 		if !t.BackendEnabled {
 			return nil, fmt.Errorf("resource %s of type Backend cannot be used since Backend is disabled in Envoy Gateway configuration", string(backendRef.Name))
@@ -130,7 +137,6 @@ func (t *Translator) processExtServiceDestination(
 			"mixed endpointslice address type for the same backendRef is not supported")
 	}
 
-	var err error
 	backendTLS, err = t.applyBackendTLSSetting(
 		backendRef.BackendObjectReference,
 		backendNamespace,
diff --git a/internal/gatewayapi/globalresources.go b/internal/gatewayapi/globalresources.go
index afc542eb2..2aff4718f 100644
--- a/internal/gatewayapi/globalresources.go
+++ b/internal/gatewayapi/globalresources.go
@@ -85,7 +85,10 @@ func (t *Translator) processServiceClusterForGateway(gateway *GatewayContext, re
 		Namespace: NamespacePtr(svcCluster.Namespace),
 		Port:      PortNumPtr(svcCluster.Spec.Ports[0].Port),
 	}
-	dst := t.processServiceDestinationSetting(irKey, bRef, svcCluster.Namespace, ir.AppProtocol(svcCluster.Spec.Ports[0].Protocol), resources, resources.EnvoyProxyForGatewayClass)
+	dst, err := t.processServiceDestinationSetting(irKey, bRef, svcCluster.Namespace, ir.AppProtocol(svcCluster.Spec.Ports[0].Protocol), resources, resources.EnvoyProxyForGatewayClass)
+	if err != nil {
+		return "", nil
+	}
 
 	return irKey, &ir.RouteDestination{
 		Name:     dst.Name,
diff --git a/internal/gatewayapi/listener.go b/internal/gatewayapi/listener.go
index 122562934..93b602b46 100644
--- a/internal/gatewayapi/listener.go
+++ b/internal/gatewayapi/listener.go
@@ -837,7 +837,10 @@ func (t *Translator) processBackendRefs(name string, backendCluster egv1a1.Backe
 			if err := validateBackendRefService(ref.BackendObjectReference, resources, ns, corev1.ProtocolTCP); err != nil {
 				return nil, nil, err
 			}
-			ds := t.processServiceDestinationSetting(name, ref.BackendObjectReference, ns, ir.TCP, resources, envoyProxy)
+			ds, err := t.processServiceDestinationSetting(name, ref.BackendObjectReference, ns, ir.TCP, resources, envoyProxy)
+			if err != nil {
+				return nil, nil, err
+			}
 			result = append(result, ds)
 		case resource.KindBackend:
 			if err := t.validateBackendRefBackend(ref.BackendObjectReference, resources, ns, true); err != nil {
diff --git a/internal/gatewayapi/route.go b/internal/gatewayapi/route.go
index 3ef0456d0..e928a181c 100644
--- a/internal/gatewayapi/route.go
+++ b/internal/gatewayapi/route.go
@@ -110,19 +110,21 @@ func (t *Translator) processHTTPRouteParentRefs(httpRoute *HTTPRouteContext, res
 		// Need to compute Route rules within the parentRef loop because
 		// any conditions that come out of it have to go on each RouteParentStatus,
 		// not on the Route as a whole.
-		routeRoutes, err := t.processHTTPRouteRules(httpRoute, parentRef, resources)
+		routeRoutes, errs := t.processHTTPRouteRules(httpRoute, parentRef, resources)
 		// TODO: zhaohuabing: according to the gateway api, the RouteConditionPartiallyInvalid condition should be set
 		// to true when an HTTPRoute contains a combination of both valid and invalid rules.
-		if err != nil {
+		if len(errs) > 0 {
 			routeStatus := GetRouteStatus(httpRoute)
-			status.SetRouteStatusCondition(routeStatus,
-				parentRef.routeParentStatusIdx,
-				httpRoute.GetGeneration(),
-				err.Type(),
-				metav1.ConditionFalse,
-				err.Reason(),
-				status.Error2ConditionMsg(err),
-			)
+			for _, err := range errs {
+				status.SetRouteStatusCondition(routeStatus,
+					parentRef.routeParentStatusIdx,
+					httpRoute.GetGeneration(),
+					err.Type(),
+					metav1.ConditionFalse,
+					err.Reason(),
+					status.Error2ConditionMsg(err),
+				)
+			}
 		}
 
 		// If no negative condition has been set for ResolvedRefs, set "ResolvedRefs=True"
@@ -173,10 +175,10 @@ func (t *Translator) processHTTPRouteParentRefs(httpRoute *HTTPRouteContext, res
 	}
 }
 
-func (t *Translator) processHTTPRouteRules(httpRoute *HTTPRouteContext, parentRef *RouteParentContext, resources *resource.Resources) ([]*ir.HTTPRoute, status.Error) {
+func (t *Translator) processHTTPRouteRules(httpRoute *HTTPRouteContext, parentRef *RouteParentContext, resources *resource.Resources) ([]*ir.HTTPRoute, []status.Error) {
 	var (
-		irRoutes []*ir.HTTPRoute
-		errs     = &status.MultiStatusError{}
+		irRoutes       []*ir.HTTPRoute
+		errorCollector = &status.TypedErrorCollector{}
 	)
 	pattern := getStatPattern(httpRoute, parentRef, t.GatewayControllerName)
 
@@ -188,12 +190,12 @@ func (t *Translator) processHTTPRouteRules(httpRoute *HTTPRouteContext, parentRe
 			// e.g. Failed to resolve the BackendRef in the RequestMirror filter.
 			// Other errors should be treated as Accepted condition type.
 			if err.Type() != gwapiv1.RouteConditionResolvedRefs {
-				errs.Add(status.NewRouteStatusError(
+				errorCollector.Add(status.NewRouteStatusError(
 					fmt.Errorf("failed to process route rule %d: %w", ruleIdx, err),
 					status.ConvertToAcceptedReason(err.Reason()),
 				).WithType(gwapiv1.RouteConditionAccepted))
 			} else {
-				errs.Add(err)
+				errorCollector.Add(err)
 			}
 			continue
 		}
@@ -204,7 +206,7 @@ func (t *Translator) processHTTPRouteRules(httpRoute *HTTPRouteContext, parentRe
 		// so generate a unique Xds IR HTTPRoute per match.
 		ruleRoutes, err := t.processHTTPRouteRule(httpRoute, ruleIdx, httpFiltersContext, &rule, routeRuleMetadata)
 		if err != nil {
-			errs.Add(status.NewRouteStatusError(
+			errorCollector.Add(status.NewRouteStatusError(
 				fmt.Errorf("failed to process route rule %d: %w", ruleIdx, err),
 				status.ConvertToAcceptedReason(err.Reason()),
 			).WithType(gwapiv1.RouteConditionAccepted))
@@ -214,6 +216,7 @@ func (t *Translator) processHTTPRouteRules(httpRoute *HTTPRouteContext, parentRe
 		destName := irRouteDestinationName(httpRoute, ruleIdx)
 		allDs := make([]*ir.DestinationSetting, 0, len(rule.BackendRefs))
 		failedProcessDestination := false
+		failedNoReadyEndpoints := false
 		hasDynamicResolver := false
 		backendRefNames := make([]string, len(rule.BackendRefs))
 		backendCustomRefs := make([]*ir.UnstructuredRef, 0, len(rule.BackendRefs))
@@ -226,11 +229,21 @@ func (t *Translator) processHTTPRouteRules(httpRoute *HTTPRouteContext, parentRe
 			}
 			ds, unstructuredRef, err := t.processDestination(settingName, backendRefCtx, parentRef, httpRoute, resources)
 			if err != nil {
-				errs.Add(status.NewRouteStatusError(
-					fmt.Errorf("failed to process route rule %d backendRef %d: %w", ruleIdx, i, err),
-					err.Reason(),
-				))
-				failedProcessDestination = true
+				// Gateway API conformance: When backendRef Service exists but has no endpoints,
+				// the ResolvedRefs condition should NOT be set to False.
+				if err.Reason() == status.RouteReasonEndpointsNotFound {
+					errorCollector.Add(status.NewRouteStatusError(
+						fmt.Errorf("failed to find endpoints: %w", err),
+						err.Reason(),
+					).WithType(status.RouteConditionBackendsAvailable))
+					failedNoReadyEndpoints = true
+				} else {
+					errorCollector.Add(status.NewRouteStatusError(
+						fmt.Errorf("failed to process route rule %d backendRef %d: %w", ruleIdx, i, err),
+						err.Reason(),
+					))
+					failedProcessDestination = true
+				}
 				continue
 			}
 			if unstructuredRef != nil {
@@ -270,6 +283,12 @@ func (t *Translator) processHTTPRouteRules(httpRoute *HTTPRouteContext, parentRe
 				irRoute.DirectResponse = &ir.CustomResponse{
 					StatusCode: ptr.To(uint32(500)),
 				}
+			// return 503 if endpoints does not exist
+			// the error is already added to the error list when processing the destination
+			case failedNoReadyEndpoints && len(allDs) == 0:
+				irRoute.DirectResponse = &ir.CustomResponse{
+					StatusCode: ptr.To(uint32(503)),
+				}
 			// return 500 if the weight of all the valid destination settings(endpoints list is not empty) is 0
 			case destination.ToBackendWeights().Valid == 0:
 				irRoute.DirectResponse = &ir.CustomResponse{
@@ -293,7 +312,7 @@ func (t *Translator) processHTTPRouteRules(httpRoute *HTTPRouteContext, parentRe
 		}
 
 		if hasDynamicResolver && len(rule.BackendRefs) > 1 {
-			errs.Add(status.NewRouteStatusError(
+			errorCollector.Add(status.NewRouteStatusError(
 				fmt.Errorf(
 					"failed to process route rule %d: dynamic resolver is not supported for multiple backendRefs",
 					ruleIdx),
@@ -307,9 +326,15 @@ func (t *Translator) processHTTPRouteRules(httpRoute *HTTPRouteContext, parentRe
 
 		irRoutes = append(irRoutes, ruleRoutes...)
 	}
-	if errs.Empty() {
+	if errorCollector.Empty() {
 		return irRoutes, nil
 	}
+
+	types := errorCollector.Types()
+	errs := make([]status.Error, 0, len(types))
+	for _, t := range types {
+		errs = append(errs, errorCollector.GetError(t))
+	}
 	return irRoutes, errs
 }
 
@@ -579,17 +604,19 @@ func (t *Translator) processGRPCRouteParentRefs(grpcRoute *GRPCRouteContext, res
 		// Need to compute Route rules within the parentRef loop because
 		// any conditions that come out of it have to go on each RouteParentStatus,
 		// not on the Route as a whole.
-		routeRoutes, err := t.processGRPCRouteRules(grpcRoute, parentRef, resources)
-		if err != nil {
+		routeRoutes, errs := t.processGRPCRouteRules(grpcRoute, parentRef, resources)
+		if len(errs) > 0 {
 			routeStatus := GetRouteStatus(grpcRoute)
-			status.SetRouteStatusCondition(routeStatus,
-				parentRef.routeParentStatusIdx,
-				grpcRoute.GetGeneration(),
-				err.Type(),
-				metav1.ConditionFalse,
-				err.Reason(),
-				status.Error2ConditionMsg(err),
-			)
+			for _, err := range errs {
+				status.SetRouteStatusCondition(routeStatus,
+					parentRef.routeParentStatusIdx,
+					grpcRoute.GetGeneration(),
+					err.Type(),
+					metav1.ConditionFalse,
+					err.Reason(),
+					status.Error2ConditionMsg(err),
+				)
+			}
 		}
 
 		// If no negative condition has been set for ResolvedRefs, set "ResolvedRefs=True"
@@ -638,10 +665,10 @@ func (t *Translator) processGRPCRouteParentRefs(grpcRoute *GRPCRouteContext, res
 	}
 }
 
-func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRef *RouteParentContext, resources *resource.Resources) ([]*ir.HTTPRoute, status.Error) {
+func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRef *RouteParentContext, resources *resource.Resources) ([]*ir.HTTPRoute, []status.Error) {
 	var (
-		irRoutes []*ir.HTTPRoute
-		errs     = &status.MultiStatusError{}
+		irRoutes       []*ir.HTTPRoute
+		errorCollector = &status.TypedErrorCollector{}
 	)
 	pattern := getStatPattern(grpcRoute, parentRef, t.GatewayControllerName)
 
@@ -650,7 +677,7 @@ func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRe
 		rule := &grpcRoute.Spec.Rules[ruleIdx]
 		httpFiltersContext, err := t.ProcessGRPCFilters(parentRef, grpcRoute, rule.Filters, resources)
 		if err != nil {
-			errs.Add(status.NewRouteStatusError(
+			errorCollector.Add(status.NewRouteStatusError(
 				fmt.Errorf("failed to process route rule %d: %w", ruleIdx, err),
 				status.ConvertToAcceptedReason(err.Reason()),
 			).WithType(gwapiv1.RouteConditionAccepted))
@@ -661,7 +688,7 @@ func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRe
 		// a unique Xds IR HTTPRoute per match.
 		ruleRoutes, err := t.processGRPCRouteRule(grpcRoute, ruleIdx, httpFiltersContext, rule)
 		if err != nil {
-			errs.Add(status.NewRouteStatusError(
+			errorCollector.Add(status.NewRouteStatusError(
 				fmt.Errorf("failed to process route rule %d: %w", ruleIdx, err),
 				status.ConvertToAcceptedReason(err.Reason()),
 			).WithType(gwapiv1.RouteConditionAccepted))
@@ -671,6 +698,7 @@ func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRe
 		destName := irRouteDestinationName(grpcRoute, ruleIdx)
 		allDs := make([]*ir.DestinationSetting, 0, len(rule.BackendRefs))
 		failedProcessDestination := false
+		failedNoReadyEndpoints := false
 
 		backendRefNames := make([]string, len(rule.BackendRefs))
 		for i := range rule.BackendRefs {
@@ -681,11 +709,21 @@ func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRe
 			}
 			ds, _, err := t.processDestination(settingName, backendRefCtx, parentRef, grpcRoute, resources)
 			if err != nil {
-				errs.Add(status.NewRouteStatusError(
-					fmt.Errorf("failed to process route rule %d backendRef %d: %w", ruleIdx, i, err),
-					err.Reason(),
-				))
-				failedProcessDestination = true
+				// Gateway API conformance: When backendRef Service exists but has no endpoints,
+				// the ResolvedRefs condition should NOT be set to False.
+				if err.Reason() == status.RouteReasonEndpointsNotFound {
+					errorCollector.Add(status.NewRouteStatusError(
+						fmt.Errorf("failed to find endpoints: %w", err),
+						err.Reason(),
+					).WithType(status.RouteConditionBackendsAvailable))
+					failedNoReadyEndpoints = true
+				} else {
+					errorCollector.Add(status.NewRouteStatusError(
+						fmt.Errorf("failed to process route rule %d backendRef %d: %w", ruleIdx, i, err),
+						err.Reason(),
+					))
+					failedProcessDestination = true
+				}
 				continue
 			}
 
@@ -715,6 +753,12 @@ func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRe
 				irRoute.DirectResponse = &ir.CustomResponse{
 					StatusCode: ptr.To(uint32(500)),
 				}
+			// return 503 if endpoints does not exist
+			// the error is already added to the error list when processing the destination
+			case failedNoReadyEndpoints && len(allDs) == 0:
+				irRoute.DirectResponse = &ir.CustomResponse{
+					StatusCode: ptr.To(uint32(503)),
+				}
 			// return 500 if the weight of all the valid destination settings(endpoints list is not empty) is 0
 			case destination.ToBackendWeights().Valid == 0:
 				irRoute.DirectResponse = &ir.CustomResponse{
@@ -738,9 +782,15 @@ func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRe
 		irRoutes = append(irRoutes, ruleRoutes...)
 	}
 
-	if errs.Empty() {
+	if errorCollector.Empty() {
 		return irRoutes, nil
 	}
+
+	types := errorCollector.Types()
+	errs := make([]status.Error, 0, len(types))
+	for _, t := range types {
+		errs = append(errs, errorCollector.GetError(t))
+	}
 	return irRoutes, errs
 }
 
@@ -1426,10 +1476,15 @@ func (t *Translator) processDestination(name string, backendRefContext BackendRe
 
 	switch KindDerefOr(backendRef.Kind, resource.KindService) {
 	case resource.KindServiceImport:
-		ds = t.processServiceImportDestinationSetting(name, backendRef.BackendObjectReference, backendNamespace, protocol, resources, envoyProxy)
-
+		ds, err = t.processServiceImportDestinationSetting(name, backendRef.BackendObjectReference, backendNamespace, protocol, resources, envoyProxy)
+		if err != nil {
+			return nil, nil, err
+		}
 	case resource.KindService:
-		ds = t.processServiceDestinationSetting(name, backendRef.BackendObjectReference, backendNamespace, protocol, resources, envoyProxy)
+		ds, err = t.processServiceDestinationSetting(name, backendRef.BackendObjectReference, backendNamespace, protocol, resources, envoyProxy)
+		if err != nil {
+			return nil, nil, err
+		}
 		svc := resources.GetService(backendNamespace, string(backendRef.Name))
 		ds.IPFamily = getServiceIPFamily(svc)
 		ds.PreferLocal = processPreferLocalZone(svc)
@@ -1537,7 +1592,7 @@ func (t *Translator) processServiceImportDestinationSetting(
 	protocol ir.AppProtocol,
 	resources *resource.Resources,
 	envoyProxy *egv1a1.EnvoyProxy,
-) *ir.DestinationSetting {
+) (*ir.DestinationSetting, status.Error) {
 	var (
 		endpoints []*ir.DestinationEndpoint
 		addrType  *ir.DestinationAddressType
@@ -1560,6 +1615,12 @@ func (t *Translator) processServiceImportDestinationSetting(
 	if !t.IsEnvoyServiceRouting(envoyProxy) {
 		endpointSlices := resources.GetEndpointSlicesForBackend(backendNamespace, string(backendRef.Name), resource.KindServiceImport)
 		endpoints, addrType = getIREndpointsFromEndpointSlices(endpointSlices, servicePort.Name, servicePort.Protocol)
+		if len(endpoints) == 0 {
+			return nil, status.NewRouteStatusError(
+				fmt.Errorf("no ready endpoints for the related ServiceImport %s/%s", backendNamespace, backendRef.Name),
+				status.RouteReasonEndpointsNotFound,
+			)
+		}
 	} else {
 		// Fall back to Service ClusterIP routing
 		backendIps := resources.GetServiceImport(backendNamespace, string(backendRef.Name)).Spec.IPs
@@ -1575,7 +1636,7 @@ func (t *Translator) processServiceImportDestinationSetting(
 		Endpoints:   endpoints,
 		AddressType: addrType,
 		Metadata:    buildResourceMetadata(serviceImport, ptr.To(gwapiv1.SectionName(strconv.Itoa(int(*backendRef.Port))))),
-	}
+	}, nil
 }
 
 func (t *Translator) processServiceDestinationSetting(
@@ -1585,7 +1646,7 @@ func (t *Translator) processServiceDestinationSetting(
 	protocol ir.AppProtocol,
 	resources *resource.Resources,
 	envoyProxy *egv1a1.EnvoyProxy,
-) *ir.DestinationSetting {
+) (*ir.DestinationSetting, status.Error) {
 	var (
 		endpoints []*ir.DestinationEndpoint
 		addrType  *ir.DestinationAddressType
@@ -1609,6 +1670,12 @@ func (t *Translator) processServiceDestinationSetting(
 	if !t.IsEnvoyServiceRouting(envoyProxy) {
 		endpointSlices := resources.GetEndpointSlicesForBackend(backendNamespace, string(backendRef.Name), KindDerefOr(backendRef.Kind, resource.KindService))
 		endpoints, addrType = getIREndpointsFromEndpointSlices(endpointSlices, servicePort.Name, servicePort.Protocol)
+		if len(endpoints) == 0 {
+			return nil, status.NewRouteStatusError(
+				fmt.Errorf("no ready endpoints for the related Service %s/%s", backendNamespace, backendRef.Name),
+				status.RouteReasonEndpointsNotFound,
+			)
+		}
 	} else {
 		// Fall back to Service ClusterIP routing
 		ep := ir.NewDestEndpoint(nil, service.Spec.ClusterIP, uint32(*backendRef.Port), false, nil)
@@ -1622,7 +1689,7 @@ func (t *Translator) processServiceDestinationSetting(
 		AddressType: addrType,
 		PreferLocal: processPreferLocalZone(service),
 		Metadata:    buildResourceMetadata(service, ptr.To(gwapiv1.SectionName(strconv.Itoa(int(*backendRef.Port))))),
-	}
+	}, nil
 }
 
 func getBackendFilters(routeType gwapiv1.Kind, backendRefContext BackendRefContext) (backendFilters any) {
diff --git a/internal/gatewayapi/status/error.go b/internal/gatewayapi/status/error.go
index bcad0e751..51cc82975 100644
--- a/internal/gatewayapi/status/error.go
+++ b/internal/gatewayapi/status/error.go
@@ -6,6 +6,7 @@
 package status
 
 import (
+	"errors"
 	"sort"
 	"strings"
 
@@ -28,6 +29,10 @@ const (
 	RouteReasonPortNotSpecified       gwapiv1.RouteConditionReason = "PortNotSpecified"
 	RouteReasonUnsupportedAddressType gwapiv1.RouteConditionReason = "UnsupportedAddressType"
 	RouteReasonInvalidAddress         gwapiv1.RouteConditionReason = "InvalidAddress"
+	RouteReasonEndpointsNotFound      gwapiv1.RouteConditionReason = "EndpointsNotFound"
+
+	// Network configuration related condition types
+	RouteConditionBackendsAvailable gwapiv1.RouteConditionType = "BackendsAvailable"
 )
 
 // Error is an error interface that represents errors that need to be reflected
@@ -83,7 +88,7 @@ func (s *RouteStatusError) Reason() gwapiv1.RouteConditionReason {
 // Type returns the route condition type associated with this error.
 func (s *RouteStatusError) Type() gwapiv1.RouteConditionType {
 	// Default to ResolvedRefs because it's the most common type.
-	if s == nil {
+	if s == nil || s.RouteConditionType == "" {
 		return gwapiv1.RouteConditionResolvedRefs
 	}
 	return s.RouteConditionType
@@ -169,6 +174,57 @@ func (m *MultiStatusError) Type() gwapiv1.RouteConditionType {
 	return gwapiv1.RouteConditionResolvedRefs
 }
 
+// TypedErrorCollector collects and organizes status errors by their condition type.
+// It automatically groups errors of the same type together, making it easy to
+// process and report errors for each distinct condition type separately.
+//
+// This is particularly useful when processing routes that may have multiple
+// validation errors across different types. (e.g., ResolvedRefs, Accepted, BackendsAvailable).
+type TypedErrorCollector struct {
+	// errs groups errors by their condition type for efficient retrieval
+	errs map[gwapiv1.RouteConditionType]*MultiStatusError
+}
+
+func (c *TypedErrorCollector) Empty() bool {
+	return len(c.errs) == 0
+}
+
+// Types returns all unique condition types for which errors have been collected.
+func (c *TypedErrorCollector) Types() []gwapiv1.RouteConditionType {
+	if len(c.errs) == 0 {
+		return nil
+	}
+	types := make([]gwapiv1.RouteConditionType, 0, len(c.errs))
+	for t := range c.errs {
+		types = append(types, t)
+	}
+	return types
+}
+
+// Add appends a new error to the collector, automatically grouping it with
+// other errors of the same condition type.
+func (c *TypedErrorCollector) Add(err Error) {
+	if err == nil {
+		return
+	}
+	if c.errs == nil {
+		c.errs = make(map[gwapiv1.RouteConditionType]*MultiStatusError)
+	}
+	if _, exist := c.errs[err.Type()]; !exist {
+		c.errs[err.Type()] = &MultiStatusError{}
+	}
+	c.errs[err.Type()].Add(err)
+}
+
+// GetError returns all errors of the specified condition type as a single RouteStatusError.
+// Multiple errors of the same type are consolidated into one error with combined messages and reasons.
+func (c *TypedErrorCollector) GetError(t gwapiv1.RouteConditionType) Error {
+	if len(c.errs) == 0 {
+		return nil
+	}
+	return NewRouteStatusError(errors.New(c.errs[t].Error()), c.errs[t].Reason()).WithType(t)
+}
+
 func isAcceptedReason(reason gwapiv1.RouteConditionReason) bool {
 	return reason == gwapiv1.RouteReasonNotAllowedByListeners ||
 		reason == gwapiv1.RouteReasonNoMatchingListenerHostname ||
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
index 1ca6562d2..1dd7f2d17 100644
--- a/internal/ir/xds.go
+++ b/internal/ir/xds.go
@@ -2681,6 +2681,8 @@ type OutlierDetection struct {
 	BaseEjectionTime *metav1.Duration `json:"baseEjectionTime,omitempty" yaml:"baseEjectionTime,omitempty"`
 	// MaxEjectionPercent sets the maximum percentage of hosts in a cluster that can be ejected.
 	MaxEjectionPercent *int32 `json:"maxEjectionPercent,omitempty" yaml:"maxEjectionPercent,omitempty"`
+	// FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+	FailurePercentageThreshold *uint32 `json:"failurePercentageThreshold,omitempty" yaml:"failurePercentageThreshold,omitempty"`
 }
 
 // ActiveHealthCheck defines active health check settings
diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go
index 22f0bf41e..31f220378 100644
--- a/internal/ir/zz_generated.deepcopy.go
+++ b/internal/ir/zz_generated.deepcopy.go
@@ -2699,6 +2699,11 @@ func (in *OutlierDetection) DeepCopyInto(out *OutlierDetection) {
 		*out = new(int32)
 		**out = **in
 	}
+	if in.FailurePercentageThreshold != nil {
+		in, out := &in.FailurePercentageThreshold, &out.FailurePercentageThreshold
+		*out = new(uint32)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OutlierDetection.
diff --git a/internal/xds/translator/cluster.go b/internal/xds/translator/cluster.go
index 14ace4285..72cc142da 100644
--- a/internal/xds/translator/cluster.go
+++ b/internal/xds/translator/cluster.go
@@ -607,6 +607,11 @@ func buildXdsOutlierDetection(outlierDetection *ir.OutlierDetection) *clusterv3.
 		od.ConsecutiveGatewayFailure = wrapperspb.UInt32(*outlierDetection.ConsecutiveGatewayErrors)
 	}
 
+	if outlierDetection.FailurePercentageThreshold != nil {
+		od.FailurePercentageThreshold = wrapperspb.UInt32(*outlierDetection.FailurePercentageThreshold)
+		od.EnforcingFailurePercentage = wrapperspb.UInt32(100)
+	}
+
 	return od
 }
 
diff --git a/release-notes/current.yaml b/release-notes/current.yaml
index 4ccd83c35..327197841 100644
--- a/release-notes/current.yaml
+++ b/release-notes/current.yaml
@@ -19,8 +19,10 @@ new features: |
   Added cacheDuration for remoteJWKS in SecurityPolicy.
   Added support for DisableTokenEncryption in OIDC authn to disable encryption of ID and access tokens stored in cookies.
   Added support for OCSP stapling in the listener TLS certificates.
+  Added support for returning 503 responses when no valid backend endpoints exist.
   Added support for CSRFTokenTTL in OIDC authn to configure the lifetime of the CSRF token used during the OAuth2 authorization code flow.
 
+
 bug fixes: |
   Fixed %ROUTE_KIND% operator to be lower-cased when used by clusterStatName in EnvoyProxy API.
   Fixed maxAcceptPerSocketEvent being ignored in ClientTrafficPolicy.
diff --git a/site/content/en/v1.5/tasks/operations/customize-envoyproxy.md b/site/content/en/v1.5/tasks/operations/customize-envoyproxy.md
index e183ea896..3b094d3dd 100644
--- a/site/content/en/v1.5/tasks/operations/customize-envoyproxy.md
+++ b/site/content/en/v1.5/tasks/operations/customize-envoyproxy.md
@@ -6,6 +6,8 @@ Envoy Gateway provides an [EnvoyProxy][] CRD that can be linked to the Parameter
 in a Gateway and GatewayClass, allowing cluster admins to customize the managed EnvoyProxy Deployment and
 Service. To learn more about GatewayClass and ParametersRef, please refer to [Gateway API documentation][].
 
+**Note**: We recommend creating a [EnvoyProxy][] resource before creating a Gateway or GatewayClass that references it to avoid temporary disruption.
+
 ## Prerequisites
 
 {{< boilerplate prerequisites >}}
diff --git a/site/go.mod b/site/go.mod
index 6f33df425..7f0e2f805 100644
--- a/site/go.mod
+++ b/site/go.mod
@@ -1,6 +1,6 @@
 module github.com/google/docsy-example
 
-go 1.24.8
+go 1.25.3
 
 require (
 	github.com/FortAwesome/Font-Awesome v0.0.0-20241216213156-af620534bfc3 // indirect
diff --git a/tools/go.mod b/tools/go.mod
index d3aaa3d49..60a0f2a1c 100644
--- a/tools/go.mod
+++ b/tools/go.mod
@@ -1,6 +1,6 @@
 module tools
 
-go 1.24.8
+go 1.25.3
 
 tool (
 	github.com/bufbuild/buf/cmd/buf
diff --git a/tools/hack/bump-golang.sh b/tools/hack/bump-golang.sh
index 09a5c626e..492db1d2f 100755
--- a/tools/hack/bump-golang.sh
+++ b/tools/hack/bump-golang.sh
@@ -2,17 +2,16 @@
 
 # shellcheck disable=SC2038
 
-FROM_GOLANG_VERSION=${1:-"1.23.6"}
-TO_GOLANG_VERSION=${2:-"1.24.0"}
+TO_GOLANG_VERSION=${1:-"1.25.3"}
 
 echo "Bumping golang version from $FROM_GOLANG_VERSION to $TO_GOLANG_VERSION"
 
 # detect gnu-sed or sed
 GNU_SED=$(sed --version >/dev/null 2>&1 && echo "yes" || echo "no")
 if [ "$GNU_SED" == "yes" ]; then
-    find . -type f -name "Dockerfile" | xargs sed -i'' "s/FROM golang:$FROM_GOLANG_VERSION AS builder/FROM golang:$TO_GOLANG_VERSION AS builder/g"
-    find . -type f -name "go.mod" | xargs sed -i'' "s/go $FROM_GOLANG_VERSION/go $TO_GOLANG_VERSION/g"
+    find . -type f -name "Dockerfile" | xargs sed -i'' "s/^FROM golang:.*\$/FROM golang:$TO_GOLANG_VERSION AS builder/g"
+    find . -type f -name "go.mod" | xargs sed -i'' "s/^go.*\$/go $TO_GOLANG_VERSION/g"
 else
-    find . -type f -name "Dockerfile" | xargs sed -i '' "s/FROM golang:$FROM_GOLANG_VERSION AS builder/FROM golang:$TO_GOLANG_VERSION AS builder/g"
-    find . -type f -name "go.mod" | xargs sed -i '' "s/go $FROM_GOLANG_VERSION/go $TO_GOLANG_VERSION/g"
+    find . -type f -name "Dockerfile" | xargs sed -i '' "s/^FROM golang:.*\$/FROM golang:$TO_GOLANG_VERSION AS builder/g"
+    find . -type f -name "go.mod" | xargs sed -i '' "s/^go.*\$/go $TO_GOLANG_VERSION/g"
 fi



Test patch:
diff --git a/internal/gatewayapi/backendtrafficpolicy_test.go b/internal/gatewayapi/backendtrafficpolicy_test.go
index fd420d51f..8d4a2794a 100644
--- a/internal/gatewayapi/backendtrafficpolicy_test.go
+++ b/internal/gatewayapi/backendtrafficpolicy_test.go
@@ -9,9 +9,12 @@ import (
 	"math"
 	"reflect"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
 	"github.com/envoyproxy/gateway/internal/ir"
@@ -194,3 +197,87 @@ func TestBuildHTTPProtocolUpgradeConfig(t *testing.T) {
 		})
 	}
 }
+
+func TestBuildPassiveHealthCheck(t *testing.T) {
+	cases := []struct {
+		name     string
+		policy   egv1a1.HealthCheck
+		expected *ir.OutlierDetection
+	}{
+		{
+			name: "nil passive health check",
+			policy: egv1a1.HealthCheck{
+				Passive: nil,
+			},
+			expected: nil,
+		},
+		{
+			name: "basic passive health check",
+			policy: egv1a1.HealthCheck{
+				Passive: &egv1a1.PassiveHealthCheck{
+					Interval:             ptr.To(gwapiv1.Duration("10s")),
+					BaseEjectionTime:     ptr.To(gwapiv1.Duration("30s")),
+					MaxEjectionPercent:   ptr.To[int32](10),
+					Consecutive5xxErrors: ptr.To[uint32](5),
+				},
+			},
+			expected: &ir.OutlierDetection{
+				Interval:             ptr.To(metav1.Duration{Duration: 10 * time.Second}),
+				BaseEjectionTime:     ptr.To(metav1.Duration{Duration: 30 * time.Second}),
+				MaxEjectionPercent:   ptr.To[int32](10),
+				Consecutive5xxErrors: ptr.To[uint32](5),
+			},
+		},
+		{
+			name: "passive health check with failure percentage threshold",
+			policy: egv1a1.HealthCheck{
+				Passive: &egv1a1.PassiveHealthCheck{
+					Interval:                   ptr.To(gwapiv1.Duration("10s")),
+					BaseEjectionTime:           ptr.To(gwapiv1.Duration("30s")),
+					MaxEjectionPercent:         ptr.To[int32](10),
+					Consecutive5xxErrors:       ptr.To[uint32](5),
+					FailurePercentageThreshold: ptr.To[uint32](90),
+				},
+			},
+			expected: &ir.OutlierDetection{
+				Interval:                   ptr.To(metav1.Duration{Duration: 10 * time.Second}),
+				BaseEjectionTime:           ptr.To(metav1.Duration{Duration: 30 * time.Second}),
+				MaxEjectionPercent:         ptr.To[int32](10),
+				Consecutive5xxErrors:       ptr.To[uint32](5),
+				FailurePercentageThreshold: ptr.To[uint32](90),
+			},
+		},
+		{
+			name: "passive health check with all fields",
+			policy: egv1a1.HealthCheck{
+				Passive: &egv1a1.PassiveHealthCheck{
+					SplitExternalLocalOriginErrors: ptr.To(true),
+					Interval:                       ptr.To(gwapiv1.Duration("10s")),
+					ConsecutiveLocalOriginFailures: ptr.To[uint32](3),
+					ConsecutiveGatewayErrors:       ptr.To[uint32](2),
+					Consecutive5xxErrors:           ptr.To[uint32](5),
+					BaseEjectionTime:               ptr.To(gwapiv1.Duration("30s")),
+					MaxEjectionPercent:             ptr.To[int32](10),
+					FailurePercentageThreshold:     ptr.To[uint32](85),
+				},
+			},
+			expected: &ir.OutlierDetection{
+				SplitExternalLocalOriginErrors: ptr.To(true),
+				Interval:                       ptr.To(metav1.Duration{Duration: 10 * time.Second}),
+				ConsecutiveLocalOriginFailures: ptr.To[uint32](3),
+				ConsecutiveGatewayErrors:       ptr.To[uint32](2),
+				Consecutive5xxErrors:           ptr.To[uint32](5),
+				BaseEjectionTime:               ptr.To(metav1.Duration{Duration: 30 * time.Second}),
+				MaxEjectionPercent:             ptr.To[int32](10),
+				FailurePercentageThreshold:     ptr.To[uint32](85),
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := buildPassiveHealthCheck(tc.policy)
+			require.Equal(t, tc.expected, got)
+		})
+	}
+}
diff --git a/internal/gatewayapi/listener_test.go b/internal/gatewayapi/listener_test.go
index f10b93148..e0533178c 100644
--- a/internal/gatewayapi/listener_test.go
+++ b/internal/gatewayapi/listener_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
+	discoveryv1 "k8s.io/api/discovery/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/utils/ptr"
@@ -869,6 +870,32 @@ func TestProcessTracingServiceName(t *testing.T) {
 				},
 			)
 
+			// Mock endpointSlice to resolve Service
+			resources.EndpointSlices = append(resources.EndpointSlices,
+				&discoveryv1.EndpointSlice{
+					ObjectMeta: metav1.ObjectMeta{
+						Namespace: "monitoring",
+						Name:      "otel-collector",
+						Labels: map[string]string{
+							"kubernetes.io/service-name": "otel-collector",
+						},
+					},
+					Endpoints: []discoveryv1.Endpoint{
+						{
+							Addresses: []string{"10.0.0.1"},
+						},
+					},
+					Ports: []discoveryv1.EndpointPort{
+						{
+							Name:        ptr.To("grpc"),
+							Protocol:    ptr.To(corev1.ProtocolTCP),
+							Port:        ptr.To(int32(4317)),
+							AppProtocol: ptr.To("grpc"),
+						},
+					},
+				},
+			)
+
 			result, err := translator.processTracing(tc.gateway, tc.envoyProxy, tc.mergeGateways, resources)
 
 			if tc.expectError {
diff --git a/internal/gatewayapi/testdata/accesslog-als-grpc.in.yaml b/internal/gatewayapi/testdata/accesslog-als-grpc.in.yaml
index 2c354193a..47899f87d 100644
--- a/internal/gatewayapi/testdata/accesslog-als-grpc.in.yaml
+++ b/internal/gatewayapi/testdata/accesslog-als-grpc.in.yaml
@@ -44,3 +44,18 @@ services:
           name: grpc
           protocol: TCP
           targetPort: 50051
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-access-logger
+      namespace: default
+      labels:
+        kubernetes.io/service-name: access-logger
+    ports:
+      - name: grpc
+        protocol: TCP
+        port: 50051
+    endpoints:
+      - addresses:
+          - 7.7.7.7
diff --git a/internal/gatewayapi/testdata/accesslog-als-grpc.out.yaml b/internal/gatewayapi/testdata/accesslog-als-grpc.out.yaml
index 415d7ff9f..68a9888b4 100644
--- a/internal/gatewayapi/testdata/accesslog-als-grpc.out.yaml
+++ b/internal/gatewayapi/testdata/accesslog-als-grpc.out.yaml
@@ -89,7 +89,11 @@ xdsIR:
             namespace: envoy-gateway-system
           name: accesslog_als_0_0
           settings:
-          - metadata:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 50051
+            metadata:
               kind: Service
               name: access-logger
               namespace: default
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-default-ns-targetrefs.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-default-ns-targetrefs.out.yaml
index 7ea680e10..325581943 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-default-ns-targetrefs.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-default-ns-targetrefs.out.yaml
@@ -270,13 +270,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-btls2-41698b8b
+          name: envoy-envoy-gateway-gateway-btls-a945b5bb
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-btls
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-btls2-41698b8b
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-btls-a945b5bb
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-btls
@@ -360,6 +365,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-btls2-41698b8b
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-btls2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-btls2-41698b8b
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-btls2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 81
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-status-conditions-truncated.in.yaml b/internal/gatewayapi/testdata/backendtlspolicy-status-conditions-truncated.in.yaml
index 9bb97f989..056f9715e 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-status-conditions-truncated.in.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-status-conditions-truncated.in.yaml
@@ -437,3 +437,32 @@ services:
     - port: 8443
       name: https
       protocol: TCP
+endpointSlices:
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-http-backend
+    namespace: envoy-gateway
+    labels:
+      kubernetes.io/service-name: http-backend
+  ports:
+  - name: https
+    protocol: TCP
+    port: 8443
+  endpoints:
+  - addresses:
+    - 7.7.7.7
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-http-backend-2
+    namespace: envoy-gateway
+    labels:
+      kubernetes.io/service-name: http-backend-2
+  ports:
+  - name: https
+    protocol: TCP
+    port: 8443
+  endpoints:
+  - addresses:
+    - 8.8.8.8
diff --git a/internal/gatewayapi/testdata/backendtlspolicy-status-conditions-truncated.out.yaml b/internal/gatewayapi/testdata/backendtlspolicy-status-conditions-truncated.out.yaml
index 3ed578bf1..7270cfbe3 100644
--- a/internal/gatewayapi/testdata/backendtlspolicy-status-conditions-truncated.out.yaml
+++ b/internal/gatewayapi/testdata/backendtlspolicy-status-conditions-truncated.out.yaml
@@ -2083,6 +2083,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2100,8 +2119,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2135,6 +2177,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2152,8 +2213,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2187,6 +2271,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-3
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-3-32e857a6
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-3
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2204,8 +2307,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2239,6 +2365,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-4
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-4-a293650b
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-4
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2256,8 +2401,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2291,6 +2459,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-5
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-5-e35ee57f
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-5
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2308,8 +2495,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2343,6 +2553,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-6-703894b8
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-6
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-6-703894b8
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-6
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2360,8 +2589,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2395,6 +2647,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-7-8f166bcc
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-7
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-7-8f166bcc
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-7
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2412,8 +2683,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2447,6 +2741,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-8-18a274e2
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-8
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-8-18a274e2
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-8
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2464,8 +2777,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2499,6 +2835,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-9
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-9
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2516,8 +2871,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2551,6 +2929,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-10-323a05f0
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-10
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-10-323a05f0
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-10
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2568,8 +2965,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2603,6 +3023,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-11-7cd86d79
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-11
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-11-7cd86d79
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-11
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2620,8 +3059,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2655,6 +3117,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-12-b05135f7
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-12
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-12-b05135f7
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-12
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2672,8 +3153,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2707,6 +3211,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-13-5ef9b255
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-13
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-13-5ef9b255
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-13
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2724,8 +3247,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2759,6 +3305,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-14-2b849e6e
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-14
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-14-2b849e6e
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-14
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2776,8 +3341,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2811,6 +3399,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-15-473da5fd
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-15
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-15-473da5fd
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-15
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2828,8 +3435,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2863,6 +3493,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-16
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-16
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2880,8 +3529,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2915,6 +3587,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-17-686d5dd1
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-17
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-17-686d5dd1
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-17
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2932,8 +3623,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
@@ -2970,13 +3684,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-18-80e55fa6
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-18
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-18-80e55fa6
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-18
@@ -2998,8 +3717,31 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-1
+            namespace: envoy-gateway
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8443
+            metadata:
+              kind: Service
+              name: http-backend
+              namespace: envoy-gateway
+              sectionName: "8443"
+            name: httproute/envoy-gateway/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/envoy-gateway-ca
+              sni: example.com
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-out-of-range-error.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-out-of-range-error.out.yaml
index 7a8be7b47..469935924 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-out-of-range-error.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-out-of-range-error.out.yaml
@@ -250,6 +250,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -311,13 +330,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-with-invalid-value.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-with-invalid-value.out.yaml
index 04e4396b4..ebbc35eff 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-with-invalid-value.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit-with-invalid-value.out.yaml
@@ -250,6 +250,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -311,13 +330,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit.out.yaml
index 09349d0af..2c625a7d6 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-buffer-limit.out.yaml
@@ -254,6 +254,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -315,13 +334,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.in.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.in.yaml
index 9fcec7945..91d1f3b3b 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.in.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.in.yaml
@@ -94,6 +94,21 @@ services:
           name: http1
           protocol: TCP
           targetPort: 8080
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-access-logger
+      namespace: default
+      labels:
+        kubernetes.io/service-name: logs
+    ports:
+      - name: http1
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - 7.7.7.7
 backends:
   - apiVersion: gateway.envoyproxy.io/v1alpha1
     kind: Backend
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml
index 323edfbca..e543d2d16 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml
@@ -348,7 +348,11 @@ xdsIR:
             namespace: envoy-gateway
           name: accesslog_otel_0_1
           settings:
-          - metadata:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            metadata:
               kind: Service
               name: logs
               namespace: default
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-request-buffer.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-request-buffer.out.yaml
index 5074f9937..9e2dad3aa 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-request-buffer.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-request-buffer.out.yaml
@@ -250,6 +250,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -311,13 +330,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions-truncated.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions-truncated.out.yaml
index 58222bfe0..8b36072ca 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions-truncated.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions-truncated.out.yaml
@@ -2386,6 +2386,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2440,6 +2459,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2494,6 +2532,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-3
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-3-32e857a6
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-3
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2548,6 +2605,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-4
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-4-a293650b
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-4
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2602,6 +2678,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-5
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-5-e35ee57f
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-5
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2656,6 +2751,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-6-703894b8
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-6
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-6-703894b8
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-6
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2710,6 +2824,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-7-8f166bcc
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-7
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-7-8f166bcc
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-7
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2764,6 +2897,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-8-18a274e2
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-8
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-8-18a274e2
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-8
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2818,6 +2970,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-9
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-9
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2872,6 +3043,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-10-323a05f0
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-10
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-10-323a05f0
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-10
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2926,6 +3116,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-11-7cd86d79
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-11
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-11-7cd86d79
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-11
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2980,6 +3189,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-12-b05135f7
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-12
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-12-b05135f7
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-12
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3034,6 +3262,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-13-5ef9b255
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-13
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-13-5ef9b255
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-13
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3088,6 +3335,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-14-2b849e6e
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-14
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-14-2b849e6e
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-14
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3142,6 +3408,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-15-473da5fd
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-15
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-15-473da5fd
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-15
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3196,6 +3481,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-16
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-16
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3250,6 +3554,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-17-686d5dd1
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-17
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-17-686d5dd1
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-17
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3307,13 +3630,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-18-80e55fa6
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-18
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-18-80e55fa6
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-18
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
index ffda1a345..abedb8d04 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
@@ -520,13 +520,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-another-namespace-not-same-namespace-gateway-8778384d
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: another-namespace/not-same-namespace-gateway
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-another-namespace-not-same-namespace-gateway-8778384d
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: another-namespace/not-same-namespace-gateway
@@ -556,6 +561,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -613,6 +637,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
index b169d1fbe..428d2dd7e 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
@@ -328,6 +328,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -390,13 +409,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-global-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-global-ratelimit.out.yaml
index 37f998e2f..c9191d15b 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-global-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-global-ratelimit.out.yaml
@@ -306,6 +306,24 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -401,13 +419,18 @@ xdsIR:
         privateKey: '[redacted]'
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-local-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-local-ratelimit.out.yaml
index 00b7e4a4d..a145ee2b1 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-local-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-local-ratelimit.out.yaml
@@ -299,6 +299,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -391,13 +410,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-gw-rl.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-gw-rl.out.yaml
index 50a87d209..816dea9ad 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-gw-rl.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-gw-rl.out.yaml
@@ -301,6 +301,24 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -395,13 +413,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-httproute-rl.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-httproute-rl.out.yaml
index cf67d34b6..2077db86e 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-httproute-rl.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-only-httproute-rl.out.yaml
@@ -301,6 +301,24 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -399,13 +417,18 @@ xdsIR:
         privateKey: '[redacted]'
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-with-multi-parents.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-with-multi-parents.out.yaml
index 61a5ab9e0..7233ebea7 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-with-multi-parents.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-strategic-merge-with-multi-parents.out.yaml
@@ -275,6 +275,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -345,13 +364,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
index 657bb603b..f46846708 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
@@ -310,6 +310,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -366,13 +385,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
index 9c7dce004..9dbc222eb 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
@@ -254,6 +254,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -315,13 +334,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-dns-settings.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-dns-settings.out.yaml
index 53a5eb4e6..c2347f807 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-dns-settings.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-dns-settings.out.yaml
@@ -317,6 +317,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -379,13 +398,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
index a914b5e13..719bd0a04 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
@@ -741,6 +741,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -886,13 +905,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-http2.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-http2.out.yaml
index 8cf8e2a74..8dff33058 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-http2.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-http2.out.yaml
@@ -252,6 +252,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -312,13 +331,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
index 0c3ab9f86..5335f36ed 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
@@ -423,6 +423,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -480,13 +499,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-panic-threshold.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-panic-threshold.out.yaml
index 43e2bf94b..6bc5f44f9 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-panic-threshold.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-panic-threshold.out.yaml
@@ -314,6 +314,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -375,13 +394,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
index deaa0cea1..73f36d652 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
@@ -246,6 +246,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -303,13 +322,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
index 3681cf073..d69afacfc 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
@@ -283,6 +283,24 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -359,13 +377,18 @@ xdsIR:
         privateKey: '[redacted]'
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override-invalid-valueref.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override-invalid-valueref.out.yaml
index 27b1515cb..e0e4345fc 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override-invalid-valueref.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override-invalid-valueref.out.yaml
@@ -295,6 +295,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-default-gateway-1-bfd08ef4
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: default/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-1-bfd08ef4
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: default/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -351,13 +370,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-default-gateway-1-bfd08ef4
+          name: envoy-default-gateway-2-5e70ed84
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: default/gateway-2
         settings:
-        - metadata:
-            name: envoy-default-gateway-1-bfd08ef4
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-2-5e70ed84
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: default/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override.out.yaml
index 1bf2a372e..ce3cafb9e 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override.out.yaml
@@ -445,6 +445,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-default-gateway-1-bfd08ef4
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: default/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-1-bfd08ef4
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: default/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -532,13 +551,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-default-gateway-1-bfd08ef4
+          name: envoy-default-gateway-2-5e70ed84
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: default/gateway-2
         settings:
-        - metadata:
-            name: envoy-default-gateway-1-bfd08ef4
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-2-5e70ed84
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: default/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml
index 46a56da06..efd8c5a5e 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml
@@ -401,6 +401,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -466,13 +485,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-shared-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-shared-ratelimit.out.yaml
index cbca68960..786349e3d 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-shared-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-shared-ratelimit.out.yaml
@@ -284,6 +284,24 @@ xdsIR:
         certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
         name: envoy-gateway-system/envoy
         privateKey: '[redacted]'
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -361,13 +379,18 @@ xdsIR:
         privateKey: '[redacted]'
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
index 0bf963de4..08f460adb 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
@@ -250,6 +250,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -309,13 +328,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-targetrefs.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-targetrefs.out.yaml
index bc5b65772..3be78c79e 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-targetrefs.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-targetrefs.out.yaml
@@ -239,6 +239,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -301,13 +320,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml
index 4178583cb..44c54696c 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml
@@ -258,6 +258,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -320,13 +339,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-invalid-settings.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-invalid-settings.out.yaml
index 9329d3436..444206ee6 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-invalid-settings.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-invalid-settings.out.yaml
@@ -810,6 +810,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-default-gateway-1-bfd08ef4
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: default/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-1-bfd08ef4
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: default/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -994,6 +1013,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-default-gateway-2-5e70ed84
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: default/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-2-5e70ed84
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: default/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -1080,13 +1118,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-default-gateway-1-bfd08ef4
+          name: envoy-default-gateway-3-206418d2
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: default/gateway-3
         settings:
-        - metadata:
-            name: envoy-default-gateway-1-bfd08ef4
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-3-206418d2
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: default/gateway-3
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-client-verification.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-client-verification.out.yaml
index a434702dc..e8ba0842d 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-client-verification.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-client-verification.out.yaml
@@ -478,6 +478,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -530,6 +549,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -569,13 +607,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-3-32e857a6
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-3
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-3-32e857a6
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-3
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-clustertrustbundle.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-clustertrustbundle.out.yaml
index 6c9190766..2981331b7 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-clustertrustbundle.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-clustertrustbundle.out.yaml
@@ -549,6 +549,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -609,6 +628,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -650,6 +688,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-3
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-3-32e857a6
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-3
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -693,6 +750,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-4
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-4-a293650b
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-4
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -741,13 +817,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-5
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-5-e35ee57f
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-5
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert-custom-data.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert-custom-data.out.yaml
index 49f31c6a5..d945ed3fe 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert-custom-data.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert-custom-data.out.yaml
@@ -553,6 +553,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -613,6 +632,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -654,6 +692,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-3
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-3-32e857a6
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-3
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -697,6 +754,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-4
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-4-a293650b
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-4
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -745,13 +821,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-5
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-5-e35ee57f
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-5
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert.out.yaml
index 209992b9c..67dc37f9a 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls-forward-client-cert.out.yaml
@@ -540,6 +540,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -600,6 +619,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -641,6 +679,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-3
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-3-32e857a6
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-3
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -682,6 +739,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-4
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-4-a293650b
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-4
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -726,13 +802,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-5
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-5-e35ee57f
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-5
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls.out.yaml
index ecd837211..34da8932e 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-mtls.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-mtls.out.yaml
@@ -234,6 +234,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -289,13 +308,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case-multiple-targets.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case-multiple-targets.out.yaml
index 51db08a52..2351ba61d 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case-multiple-targets.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-preserve-case-multiple-targets.out.yaml
@@ -202,6 +202,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -233,13 +252,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-proxyprotocol-legacy-mixed.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-proxyprotocol-legacy-mixed.out.yaml
index 819b9d24b..c4b3ff1fd 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-proxyprotocol-legacy-mixed.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-proxyprotocol-legacy-mixed.out.yaml
@@ -285,6 +285,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-legacy-only-77ed7bb0
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-legacy-only
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-legacy-only-77ed7bb0
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-legacy-only
+          protocol: TCP
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
@@ -316,13 +335,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-precedence-test-6c6824c3
+          name: envoy-envoy-gateway-gateway-new-api-only-384278b9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-new-api-only
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-precedence-test-6c6824c3
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-new-api-only-384278b9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-new-api-only
@@ -353,6 +377,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-precedence-test-6c6824c3
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-precedence-test
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-precedence-test-6c6824c3
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-precedence-test
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions-truncated.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions-truncated.out.yaml
index 545b58a09..222a5ab56 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions-truncated.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions-truncated.out.yaml
@@ -1588,6 +1588,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1613,6 +1632,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1638,6 +1676,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-3
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-3-32e857a6
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-3
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1663,6 +1720,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-4
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-4-a293650b
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-4
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1688,6 +1764,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-5
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-5-e35ee57f
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-5
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1713,6 +1808,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-6-703894b8
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-6
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-6-703894b8
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-6
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1738,6 +1852,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-7-8f166bcc
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-7
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-7-8f166bcc
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-7
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1763,6 +1896,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-8-18a274e2
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-8
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-8-18a274e2
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-8
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1788,6 +1940,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-9
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-9
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1813,6 +1984,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-10-323a05f0
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-10
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-10-323a05f0
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-10
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1838,6 +2028,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-11-7cd86d79
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-11
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-11-7cd86d79
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-11
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1863,6 +2072,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-12-b05135f7
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-12
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-12-b05135f7
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-12
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1888,6 +2116,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-13-5ef9b255
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-13
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-13-5ef9b255
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-13
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1913,6 +2160,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-14-2b849e6e
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-14
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-14-2b849e6e
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-14
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1938,6 +2204,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-15-473da5fd
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-15
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-15-473da5fd
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-15
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1963,6 +2248,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-16
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-16
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -1988,6 +2292,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-17-686d5dd1
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-17
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-17-686d5dd1
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-17
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2016,13 +2339,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-18-80e55fa6
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-18
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-18-80e55fa6
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-18
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml
index 25054bb3d..44efce673 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-status-conditions.out.yaml
@@ -504,6 +504,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -529,6 +548,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -564,6 +602,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-3
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-3-32e857a6
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-3
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -592,13 +649,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-not-same-namespace-not-same-namespace-gateway-f21c7840
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: not-same-namespace/not-same-namespace-gateway
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-not-same-namespace-not-same-namespace-gateway-f21c7840
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: not-same-namespace/not-same-namespace-gateway
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-tls-settings.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-tls-settings.out.yaml
index a99ad69de..bbf8432fe 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-tls-settings.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-tls-settings.out.yaml
@@ -327,6 +327,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -386,6 +405,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 443
@@ -422,13 +460,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-3-32e857a6
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-3
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-3-32e857a6
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-3
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.in.yaml
index f9c917559..ebd62eaec 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.in.yaml
@@ -19,6 +19,41 @@ services:
     - port: 8000
       name: grpc
       protocol: TCP
+endpointSlices:
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-grpc-backend
+    namespace: envoy-gateway
+    labels:
+      kubernetes.io/service-name: grpc-backend
+  addressType: IPv4
+  ports:
+  - name: grpc
+    protocol: TCP
+    port: 9000
+  endpoints:
+  - addresses:
+    - 7.7.7.1
+    conditions:
+      ready: true
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-grpc-backend-2
+    namespace: default
+    labels:
+      kubernetes.io/service-name: grpc-backend-2
+  addressType: IPv4
+  ports:
+  - name: grpc
+    protocol: TCP
+    port: 8000
+  endpoints:
+  - addresses:
+    - 7.7.7.2
+    conditions:
+      ready: true
 gateways:
 - apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
index f8d3a9cd3..b2cf1c803 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml
@@ -328,7 +328,11 @@ xdsIR:
                 namespace: default
               name: envoyextensionpolicy/default/policy-for-route-1/extproc/0
               settings:
-              - metadata:
+              - addressType: IP
+                endpoints:
+                - host: 7.7.7.2
+                  port: 8000
+                metadata:
                   kind: Service
                   name: grpc-backend-2
                   namespace: default
@@ -376,7 +380,11 @@ xdsIR:
                 namespace: envoy-gateway
               name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/extproc/0
               settings:
-              - metadata:
+              - addressType: IP
+                endpoints:
+                - host: 7.7.7.1
+                  port: 9000
+                metadata:
                   kind: Service
                   name: grpc-backend
                   namespace: envoy-gateway
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-section-name-override.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-section-name-override.in.yaml
index bbf9fb006..f552eaad0 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-section-name-override.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-section-name-override.in.yaml
@@ -39,6 +39,75 @@ services:
     - port: 8004
       name: grpc
       protocol: TCP
+endpointSlices:
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-grpc-backend-1
+    namespace: envoy-gateway
+    labels:
+      kubernetes.io/service-name: grpc-backend-1
+  addressType: IPv4
+  ports:
+  - name: grpc
+    protocol: TCP
+    port: 8001
+  endpoints:
+  - addresses:
+    - 7.7.7.1
+    conditions:
+      ready: true
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-grpc-backend-2
+    namespace: envoy-gateway
+    labels:
+      kubernetes.io/service-name: grpc-backend-2
+  addressType: IPv4
+  ports:
+  - name: grpc
+    protocol: TCP
+    port: 8002
+  endpoints:
+  - addresses:
+    - 7.7.7.2
+    conditions:
+      ready: true
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-grpc-backend-3
+    namespace: default
+    labels:
+      kubernetes.io/service-name: grpc-backend-3
+  addressType: IPv4
+  ports:
+  - name: grpc
+    protocol: TCP
+    port: 8003
+  endpoints:
+  - addresses:
+    - 7.7.7.3
+    conditions:
+      ready: true
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-grpc-backend-4
+    namespace: default
+    labels:
+      kubernetes.io/service-name: grpc-backend-4
+  addressType: IPv4
+  ports:
+  - name: grpc
+    protocol: TCP
+    port: 8004
+  endpoints:
+  - addresses:
+    - 7.7.7.4
+    conditions:
+      ready: true
 gateways:
 - apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-section-name-override.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-section-name-override.out.yaml
index 585addc2d..4d0511663 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-section-name-override.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-section-name-override.out.yaml
@@ -382,7 +382,11 @@ xdsIR:
                 namespace: default
               name: envoyextensionpolicy/default/policy-for-route-1-rule-1/extproc/0
               settings:
-              - metadata:
+              - addressType: IP
+                endpoints:
+                - host: 7.7.7.4
+                  port: 8004
+                metadata:
                   kind: Service
                   name: grpc-backend-4
                   namespace: default
@@ -432,7 +436,11 @@ xdsIR:
                 namespace: default
               name: envoyextensionpolicy/default/policy-for-route-1/extproc/0
               settings:
-              - metadata:
+              - addressType: IP
+                endpoints:
+                - host: 7.7.7.3
+                  port: 8003
+                metadata:
                   kind: Service
                   name: grpc-backend-3
                   namespace: default
@@ -482,7 +490,11 @@ xdsIR:
                 namespace: envoy-gateway
               name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1-listener-1/extproc/0
               settings:
-              - metadata:
+              - addressType: IP
+                endpoints:
+                - host: 7.7.7.2
+                  port: 8002
+                metadata:
                   kind: Service
                   name: grpc-backend-2
                   namespace: envoy-gateway
@@ -548,7 +560,11 @@ xdsIR:
                 namespace: envoy-gateway
               name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/extproc/0
               settings:
-              - metadata:
+              - addressType: IP
+                endpoints:
+                - host: 7.7.7.1
+                  port: 8001
+                metadata:
                   kind: Service
                   name: grpc-backend-1
                   namespace: envoy-gateway
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions-truncated.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions-truncated.out.yaml
index 087a0b1c3..689523896 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions-truncated.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions-truncated.out.yaml
@@ -2386,6 +2386,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2440,6 +2459,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2494,6 +2532,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-3
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-3-32e857a6
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-3
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2548,6 +2605,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-4
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-4-a293650b
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-4
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2602,6 +2678,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-5
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-5-e35ee57f
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-5
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2656,6 +2751,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-6-703894b8
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-6
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-6-703894b8
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-6
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2710,6 +2824,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-7-8f166bcc
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-7
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-7-8f166bcc
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-7
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2764,6 +2897,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-8-18a274e2
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-8
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-8-18a274e2
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-8
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2818,6 +2970,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-9
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-9
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2872,6 +3043,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-10-323a05f0
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-10
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-10-323a05f0
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-10
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2926,6 +3116,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-11-7cd86d79
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-11
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-11-7cd86d79
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-11
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2980,6 +3189,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-12-b05135f7
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-12
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-12-b05135f7
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-12
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3034,6 +3262,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-13-5ef9b255
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-13
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-13-5ef9b255
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-13
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3088,6 +3335,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-14-2b849e6e
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-14
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-14-2b849e6e
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-14
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3142,6 +3408,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-15-473da5fd
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-15
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-15-473da5fd
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-15
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3196,6 +3481,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-16
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-16
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3250,6 +3554,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-17-686d5dd1
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-17
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-17-686d5dd1
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-17
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3307,13 +3630,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-18-80e55fa6
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-18
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-18-80e55fa6
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-18
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml
index 32f151b3d..1d82d35b3 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-status-conditions.out.yaml
@@ -520,13 +520,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-another-namespace-not-same-namespace-gateway-8778384d
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: another-namespace/not-same-namespace-gateway
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-another-namespace-not-same-namespace-gateway-8778384d
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: another-namespace/not-same-namespace-gateway
@@ -556,6 +561,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -613,6 +637,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.in.yaml
index c1aeda28d..945f67982 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.in.yaml
@@ -83,7 +83,7 @@ endpointSlices:
       kubernetes.io/service-name: grpc-backend
   addressType: IPv4
   ports:
-  - name: http
+  - name: grpc
     protocol: TCP
     port: 8000
   endpoints:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
index cea0cf654..f58bf26e4 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml
@@ -355,6 +355,9 @@ xdsIR:
               name: envoyextensionpolicy/default/policy-for-gateway/extproc/0
               settings:
               - addressType: IP
+                endpoints:
+                - host: 7.7.7.7
+                  port: 8000
                 metadata:
                   kind: Service
                   name: grpc-backend
@@ -426,6 +429,9 @@ xdsIR:
               name: envoyextensionpolicy/default/policy-for-gateway/extproc/0
               settings:
               - addressType: IP
+                endpoints:
+                - host: 7.7.7.7
+                  port: 8000
                 metadata:
                   kind: Service
                   name: grpc-backend
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.in.yaml
index 5e5dc68a3..af1ba120b 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.in.yaml
@@ -86,7 +86,7 @@ endpointSlices:
       kubernetes.io/service-name: grpc-backend
   addressType: IPv4
   ports:
-  - name: http
+  - name: grpc
     protocol: TCP
     port: 8000
   endpoints:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
index 23ba0ea1e..c00c40367 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-multiple-backendrefs.out.yaml
@@ -342,6 +342,9 @@ xdsIR:
               name: envoyextensionpolicy/default/policy-for-http-route/extproc/0
               settings:
               - addressType: IP
+                endpoints:
+                - host: 7.7.7.7
+                  port: 8000
                 metadata:
                   kind: Service
                   name: grpc-backend
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.in.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.in.yaml
index 614a841e6..72d3cea77 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.in.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.in.yaml
@@ -83,7 +83,7 @@ endpointSlices:
       kubernetes.io/service-name: grpc-backend
   addressType: IPv4
   ports:
-  - name: http
+  - name: grpc
     protocol: TCP
     port: 8000
   endpoints:
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.out.yaml
index 89ee6eee4..ccd0362fa 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-traffic-features.out.yaml
@@ -369,6 +369,9 @@ xdsIR:
               name: envoyextensionpolicy/default/policy-for-http-route/extproc/0
               settings:
               - addressType: IP
+                endpoints:
+                - host: 7.7.7.7
+                  port: 8000
                 metadata:
                   kind: Service
                   name: grpc-backend
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-invalid-configuration.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-invalid-configuration.out.yaml
index b3cced6b1..62fdb219e 100644
--- a/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-invalid-configuration.out.yaml
+++ b/internal/gatewayapi/testdata/envoyextensionpolicy-with-wasm-invalid-configuration.out.yaml
@@ -686,6 +686,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-default-gateway-1-bfd08ef4
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: default/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-1-bfd08ef4
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: default/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -834,6 +853,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-default-gateway-2-5e70ed84
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: default/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-2-5e70ed84
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: default/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -921,13 +959,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-default-gateway-1-bfd08ef4
+          name: envoy-default-gateway-3-206418d2
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: default/gateway-3
         settings:
-        - metadata:
-            name: envoy-default-gateway-1-bfd08ef4
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-3-206418d2
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: default/gateway-3
diff --git a/internal/gatewayapi/testdata/envoyproxy-priority-backend.in.yaml b/internal/gatewayapi/testdata/envoyproxy-priority-backend.in.yaml
index fb48d771c..6dda3a2ff 100644
--- a/internal/gatewayapi/testdata/envoyproxy-priority-backend.in.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-priority-backend.in.yaml
@@ -83,7 +83,7 @@ endpointSlices:
         kubernetes.io/service-name: grpc-backend
     addressType: IPv4
     ports:
-      - name: http
+      - name: grpc
         protocol: TCP
         port: 8000
     endpoints:
diff --git a/internal/gatewayapi/testdata/envoyproxy-priority-backend.out.yaml b/internal/gatewayapi/testdata/envoyproxy-priority-backend.out.yaml
index 703766b1f..9fd0470b2 100644
--- a/internal/gatewayapi/testdata/envoyproxy-priority-backend.out.yaml
+++ b/internal/gatewayapi/testdata/envoyproxy-priority-backend.out.yaml
@@ -343,6 +343,9 @@ xdsIR:
               name: envoyextensionpolicy/default/policy-for-http-route/extproc/0
               settings:
               - addressType: IP
+                endpoints:
+                - host: 7.7.7.7
+                  port: 8000
                 metadata:
                   kind: Service
                   name: grpc-backend
diff --git a/internal/gatewayapi/testdata/extensions/extensionpolicy-with-valid-target-array.out.yaml b/internal/gatewayapi/testdata/extensions/extensionpolicy-with-valid-target-array.out.yaml
index f458322ab..dae15d4c7 100644
--- a/internal/gatewayapi/testdata/extensions/extensionpolicy-with-valid-target-array.out.yaml
+++ b/internal/gatewayapi/testdata/extensions/extensionpolicy-with-valid-target-array.out.yaml
@@ -204,6 +204,23 @@ xdsIR:
               status: "True"
               type: Accepted
             controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       extensionRefs:
@@ -316,12 +333,17 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             sectionName: "8080"
           name: envoy-gateway/gateway-2
           protocol: TCP
diff --git a/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.in.yaml b/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.in.yaml
index 3e2632f21..522828019 100644
--- a/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.in.yaml
+++ b/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.in.yaml
@@ -118,30 +118,36 @@ services:
           port: 8080
           protocol: TCP
           targetPort: 8080
-  - apiVersion: v1
-    kind: Service
-    metadata:
-      namespace: default
-      name: service-2
-    spec:
-      clusterIP: 2.2.2.2
-      ports:
-        - name: http
-          port: 8080
-          protocol: TCP
-          targetPort: 8080
   - apiVersion: v1
     kind: Service
     metadata:
       namespace: test-ns
       name: service-3
     spec:
-      clusterIP: 2.2.2.2
+      clusterIP: 3.3.3.3
       ports:
         - name: http
           port: 8080
           protocol: TCP
           targetPort: 8080
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      namespace: test-ns
+      name: endpointslice-service-3
+      labels:
+        kubernetes.io/service-name: service-3
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - 7.7.7.7
+        conditions:
+          ready: true
 namespaces:
   - apiVersion: v1
     kind: Namespace
diff --git a/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.out.yaml b/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.out.yaml
index cf5be1fa2..7352cc404 100644
--- a/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-namespace-mode-infra-httproute.out.yaml
@@ -282,6 +282,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: gateway-1
+          namespace: default
+          sectionName: "8080"
+        name: default/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: gateway-1
+            namespace: default
+            sectionName: "8080"
+          name: default/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -338,6 +357,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: gateway-2
+          namespace: default
+          sectionName: "8080"
+        name: default/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: gateway-2
+            namespace: default
+            sectionName: "8080"
+          name: default/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -402,7 +440,12 @@ xdsIR:
           sectionName: "8080"
         name: test-ns/gateway-3
         settings:
-        - metadata:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
             name: gateway-3
             namespace: test-ns
             sectionName: "8080"
@@ -425,8 +468,25 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-3
+            namespace: test-ns
+          name: httproute/test-ns/httproute-3/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            metadata:
+              kind: Service
+              name: service-3
+              namespace: test-ns
+              sectionName: "8080"
+            name: httproute/test-ns/httproute-3/rule/0/backend/0
+            protocol: HTTP
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
diff --git a/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml b/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
index 76ae28d3d..1c4a7be47 100644
--- a/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
@@ -255,6 +255,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -316,13 +335,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/httproute-retry.out.yaml b/internal/gatewayapi/testdata/httproute-retry.out.yaml
index 813159bde..64408de21 100644
--- a/internal/gatewayapi/testdata/httproute-retry.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-retry.out.yaml
@@ -240,6 +240,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -268,13 +287,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/httproute-with-backendref-no-endpoints.in.yaml b/internal/gatewayapi/testdata/httproute-with-backendref-no-endpoints.in.yaml
new file mode 100644
index 000000000..07a9c7115
--- /dev/null
+++ b/internal/gatewayapi/testdata/httproute-with-backendref-no-endpoints.in.yaml
@@ -0,0 +1,59 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          type: Exact
+          value: "/"
+      backendRefs:
+      - name: service-with-no-endpoints
+        port: 8080
+services:
+- apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: default
+    name: service-with-no-endpoints
+  spec:
+    clusterIP: 1.1.1.1
+    ports:
+    - name: http
+      port: 8080
+      protocol: TCP
+      targetPort: 8080
+endpointSlices:
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    namespace: default
+    name: endpointslice-service-with-no-endpoints
+    labels:
+      kubernetes.io/service-name: service-with-no-endpoints
+  addressType: IPv4
+  ports:
+  - name: http
+    port: 8080
+    protocol: TCP
diff --git a/internal/gatewayapi/testdata/httproute-with-backendref-no-endpoints.out.yaml b/internal/gatewayapi/testdata/httproute-with-backendref-no-endpoints.out.yaml
new file mode 100644
index 000000000..921467169
--- /dev/null
+++ b/internal/gatewayapi/testdata/httproute-with-backendref-no-endpoints.out.yaml
@@ -0,0 +1,160 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-with-no-endpoints
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'Failed to find endpoints: no ready endpoints for the related Service
+          default/service-with-no-endpoints.'
+        reason: EndpointsNotFound
+        status: "False"
+        type: BackendsAvailable
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http-80
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          gateway.envoyproxy.io/owning-gateway-name: gateway-1
+          gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
+        ownerReference:
+          kind: GatewayClass
+          name: envoy-gateway-class
+      name: envoy-gateway/gateway-1
+      namespace: envoy-gateway-system
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      json:
+      - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
+    http:
+    - address: 0.0.0.0
+      externalPort: 80
+      hostnames:
+      - '*'
+      isHTTP2: false
+      metadata:
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - directResponse:
+          statusCode: 503
+        hostname: '*'
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-1
+          namespace: default
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /
+          name: ""
+    readyListener:
+      address: 0.0.0.0
+      ipFamily: IPv4
+      path: /ready
+      port: 19003
diff --git a/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.in.yaml b/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.in.yaml
index f8894d999..bf01b26a5 100644
--- a/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.in.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.in.yaml
@@ -36,7 +36,27 @@ services:
   spec:
     clusterIP: None
     ports:
-    - port: 80
+    - name: http
+      protocol: TCP
+      port: 80
+endpointSlices:
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    namespace: default
+    name: endpointslice-headless-service
+    labels:
+      kubernetes.io/service-name: headless-service
+  addressType: IPv4
+  ports:
+  - name: http
+    protocol: TCP
+    port: 80
+  endpoints:
+  - addresses:
+    - 7.7.7.7
+    conditions:
+      ready: true
 envoyProxyForGatewayClass:
   apiVersion: gateway.envoyproxy.io/v1alpha1
   kind: EnvoyProxy
diff --git a/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.out.yaml b/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.out.yaml
index bdfc797a3..213c547e8 100644
--- a/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-headless-service-endpoint-routing.out.yaml
@@ -140,8 +140,25 @@ xdsIR:
         mergeSlashes: true
       port: 10080
       routes:
-      - directResponse:
-          statusCode: 500
+      - destination:
+          metadata:
+            kind: HTTPRoute
+            name: httproute-headless
+            namespace: default
+          name: httproute/default/httproute-headless/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 80
+            metadata:
+              kind: Service
+              name: headless-service
+              namespace: default
+              sectionName: "80"
+            name: httproute/default/httproute-headless/rule/0/backend/0
+            protocol: HTTP
+            weight: 1
         hostname: '*'
         isHTTP2: false
         metadata:
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-regex.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-regex.out.yaml
index bb4ce7868..19c127317 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-regex.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-regex.out.yaml
@@ -157,6 +157,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -185,13 +204,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/httproute-with-multi-gateways-notmatch.out.yaml b/internal/gatewayapi/testdata/httproute-with-multi-gateways-notmatch.out.yaml
index 2f53d423e..08205e323 100644
--- a/internal/gatewayapi/testdata/httproute-with-multi-gateways-notmatch.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-multi-gateways-notmatch.out.yaml
@@ -121,6 +121,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -149,13 +168,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/httproute-with-multi-gateways-with-same-name.out.yaml b/internal/gatewayapi/testdata/httproute-with-multi-gateways-with-same-name.out.yaml
index 866bc375e..f99ee95fa 100644
--- a/internal/gatewayapi/testdata/httproute-with-multi-gateways-with-same-name.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-multi-gateways-with-same-name.out.yaml
@@ -156,13 +156,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-default-gateway-1-bfd08ef4
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: default/gateway-1
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-1-bfd08ef4
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: default/gateway-1
@@ -222,6 +227,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
diff --git a/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-different-ns.out.yaml b/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-different-ns.out.yaml
index a6bff6115..5b3b1f255 100644
--- a/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-different-ns.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-different-ns.out.yaml
@@ -185,6 +185,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-default-gateway-a-573db404
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: default/gateway-a
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-a-573db404
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: default/gateway-a
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -248,13 +267,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-default-gateway-a-573db404
+          name: envoy-envoy-gateway-gateway-b-3a004b3a
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-b
         settings:
-        - metadata:
-            name: envoy-default-gateway-a-573db404
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-b-3a004b3a
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-b
diff --git a/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-same-ns.out.yaml b/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-same-ns.out.yaml
index 44279011f..b59e1e05a 100644
--- a/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-same-ns.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-multiple-gateways-from-same-ns.out.yaml
@@ -180,6 +180,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-a-37c12ef1
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-a
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-a-37c12ef1
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-a
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -226,13 +245,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-a-37c12ef1
+          name: envoy-envoy-gateway-gateway-b-3a004b3a
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-b
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-a-37c12ef1
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-b-3a004b3a
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-b
diff --git a/internal/gatewayapi/testdata/securitypolicy-status-conditions-truncated.out.yaml b/internal/gatewayapi/testdata/securitypolicy-status-conditions-truncated.out.yaml
index d03238ce9..df206e9b0 100644
--- a/internal/gatewayapi/testdata/securitypolicy-status-conditions-truncated.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-status-conditions-truncated.out.yaml
@@ -2386,6 +2386,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2440,6 +2459,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2494,6 +2532,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-3-32e857a6
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-3
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-3-32e857a6
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-3
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2548,6 +2605,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-4-a293650b
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-4
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-4-a293650b
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-4
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2602,6 +2678,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-5-e35ee57f
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-5
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-5-e35ee57f
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-5
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2656,6 +2751,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-6-703894b8
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-6
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-6-703894b8
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-6
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2710,6 +2824,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-7-8f166bcc
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-7
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-7-8f166bcc
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-7
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2764,6 +2897,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-8-18a274e2
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-8
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-8-18a274e2
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-8
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2818,6 +2970,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-9
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-9-3f4aa2eb
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-9
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2872,6 +3043,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-10-323a05f0
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-10
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-10-323a05f0
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-10
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2926,6 +3116,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-11-7cd86d79
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-11
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-11-7cd86d79
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-11
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -2980,6 +3189,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-12-b05135f7
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-12
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-12-b05135f7
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-12
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3034,6 +3262,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-13-5ef9b255
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-13
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-13-5ef9b255
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-13
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3088,6 +3335,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-14-2b849e6e
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-14
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-14-2b849e6e
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-14
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3142,6 +3408,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-15-473da5fd
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-15
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-15-473da5fd
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-15
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3196,6 +3481,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-16
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-16-bc2b5d3e
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-16
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3250,6 +3554,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-17-686d5dd1
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-17
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-17-686d5dd1
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-17
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -3307,13 +3630,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-18-80e55fa6
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-18
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-18-80e55fa6
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-18
diff --git a/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
index 29962a2f8..7c3d0f6f1 100644
--- a/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
@@ -412,6 +412,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -461,13 +480,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml
index a78d8820a..119f23ebf 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml
@@ -346,6 +346,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -403,6 +422,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -445,13 +483,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-3-32e857a6
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-3
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-3-32e857a6
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-3
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
index 942dd9002..da37fddff 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
@@ -404,6 +404,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -477,6 +496,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -554,13 +592,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-3-32e857a6
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-3
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-3-32e857a6
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-3
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendrefs.in.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendrefs.in.yaml
index 316e4298f..681c554a6 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendrefs.in.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendrefs.in.yaml
@@ -123,7 +123,7 @@ endpointSlices:
       name: endpointslice-http-backend2
       namespace: envoy-gateway
       labels:
-        kubernetes.io/service-name: http-backend
+        kubernetes.io/service-name: http-backend2
     addressType: IPv4
     ports:
       - name: http
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendrefs.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendrefs.out.yaml
index 90a5a338f..56ec00b85 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendrefs.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-backendrefs.out.yaml
@@ -450,8 +450,6 @@ xdsIR:
                   endpoints:
                   - host: 7.7.7.7
                     port: 80
-                  - host: 7.7.7.8
-                    port: 80
                   metadata:
                     kind: Service
                     name: http-backend
@@ -460,7 +458,11 @@ xdsIR:
                   name: securitypolicy/default/policy-for-gateway-1/extauth/0/backend/0
                   protocol: HTTP
                   weight: 1
-                - metadata:
+                - addressType: IP
+                  endpoints:
+                  - host: 7.7.7.8
+                    port: 80
+                  metadata:
                     kind: Service
                     name: http-backend2
                     namespace: envoy-gateway
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
index 28c4a1a39..f2785edd9 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
@@ -553,6 +553,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-default-gateway-1-bfd08ef4
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: default/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-1-bfd08ef4
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: default/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -673,6 +692,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-default-gateway-2-5e70ed84
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: default/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-2-5e70ed84
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: default/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -732,13 +770,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-default-gateway-1-bfd08ef4
+          name: envoy-default-gateway-3-206418d2
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: default/gateway-3
         settings:
-        - metadata:
-            name: envoy-default-gateway-1-bfd08ef4
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-3-206418d2
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: default/gateway-3
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport-retry.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport-retry.out.yaml
index 338362f0c..7886e04f1 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport-retry.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport-retry.out.yaml
@@ -236,9 +236,9 @@ securityPolicies:
         namespace: default
       conditions:
       - lastTransitionTime: null
-        message: Policy has been accepted.
-        reason: Accepted
-        status: "True"
+        message: 'ExtAuth: no ready endpoints for the related ServiceImport envoy-gateway/http-backend.'
+        reason: Invalid
+        status: "False"
         type: Accepted
       - lastTransitionTime: null
         message: 'This policy is being overridden by other securityPolicies for these
@@ -448,6 +448,8 @@ xdsIR:
             name: httproute/default/httproute-2/rule/0/backend/0
             protocol: HTTP
             weight: 1
+        directResponse:
+          statusCode: 500
         hostname: www.bar.com
         isHTTP2: false
         metadata:
@@ -459,46 +461,7 @@ xdsIR:
           distinct: false
           name: ""
           prefix: /bar
-        security:
-          extAuth:
-            failOpen: false
-            http:
-              authority: http-backend.envoy-gateway:80
-              destination:
-                metadata:
-                  kind: SecurityPolicy
-                  name: policy-for-gateway-1
-                  namespace: default
-                name: securitypolicy/default/policy-for-gateway-1/extauth/0
-                settings:
-                - addressType: IP
-                  metadata:
-                    kind: ServiceImport
-                    name: http-backend
-                    namespace: envoy-gateway
-                    sectionName: "80"
-                  name: securitypolicy/default/policy-for-gateway-1/extauth/0/backend/0
-                  protocol: HTTP
-                  weight: 1
-              headersToBackend:
-              - header1
-              - header2
-              path: /auth
-            name: securitypolicy/default/policy-for-gateway-1
-            traffic:
-              retry:
-                numRetries: 2
-                perRetry:
-                  backOff:
-                    baseInterval: 200ms
-                    maxInterval: 3s
-                  timeout: 3s
-                retryOn:
-                  triggers:
-                  - 5xx
-                  - deadline-exceeded
-                  - internal
-                  - unavailable
+        security: {}
     readyListener:
       address: 0.0.0.0
       ipFamily: IPv4
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport.in.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport.in.yaml
index 96718f375..1c697b4f6 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport.in.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport.in.yaml
@@ -70,7 +70,7 @@ serviceImports:
       ports:
         - port: 80
           name: http
-          # Missing protocol here is intentional to test the default protocol handling.
+          protocol: TCP
   - apiVersion: multicluster.x-k8s.io/v1alpha1
     kind: ServiceImport
     metadata:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport.out.yaml
index 4eb6d93e9..fb64f1540 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-serviceimport.out.yaml
@@ -416,6 +416,9 @@ xdsIR:
                 name: securitypolicy/default/policy-for-gateway-1/extauth/0
                 settings:
                 - addressType: IP
+                  endpoints:
+                  - host: 7.7.7.7
+                    port: 80
                   metadata:
                     kind: ServiceImport
                     name: http-backend
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-optional.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-optional.out.yaml
index 34ba62c74..9dfc0f50f 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-optional.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-optional.out.yaml
@@ -282,6 +282,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -357,13 +376,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
index d4caa07c3..9d505a285 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
@@ -281,6 +281,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -356,13 +375,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml
index efab9614f..54ce075cb 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml
@@ -273,6 +273,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -348,13 +367,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
index 5d4b2b767..6575a879f 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
@@ -286,6 +286,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-default-gateway-1-bfd08ef4
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: default/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-1-bfd08ef4
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: default/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -311,6 +330,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-default-gateway-2-5e70ed84
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: default/gateway-2
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-2-5e70ed84
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: default/gateway-2
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -339,13 +377,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-default-gateway-1-bfd08ef4
+          name: envoy-default-gateway-3-206418d2
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: default/gateway-3
         settings:
-        - metadata:
-            name: envoy-default-gateway-1-bfd08ef4
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-default-gateway-3-206418d2
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: default/gateway-3
diff --git a/internal/gatewayapi/testdata/tracing-multiple-routes.out.yaml b/internal/gatewayapi/testdata/tracing-multiple-routes.out.yaml
index 07dbded5e..817088ea1 100644
--- a/internal/gatewayapi/testdata/tracing-multiple-routes.out.yaml
+++ b/internal/gatewayapi/testdata/tracing-multiple-routes.out.yaml
@@ -256,6 +256,25 @@ xdsIR:
     accessLog:
       json:
       - path: /dev/stdout
+    globalResources:
+      proxyServiceCluster:
+        metadata:
+          name: envoy-envoy-gateway-gateway-1-196ae069
+          namespace: envoy-gateway-system
+          sectionName: "8080"
+        name: envoy-gateway/gateway-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-1-196ae069
+            namespace: envoy-gateway-system
+            sectionName: "8080"
+          name: envoy-gateway/gateway-1
+          protocol: TCP
     http:
     - address: 0.0.0.0
       externalPort: 80
@@ -336,13 +355,18 @@ xdsIR:
     globalResources:
       proxyServiceCluster:
         metadata:
-          name: envoy-envoy-gateway-gateway-1-196ae069
+          name: envoy-envoy-gateway-gateway-2-4a0e4eb9
           namespace: envoy-gateway-system
           sectionName: "8080"
         name: envoy-gateway/gateway-2
         settings:
-        - metadata:
-            name: envoy-envoy-gateway-gateway-1-196ae069
+        - addressType: IP
+          endpoints:
+          - host: 7.6.5.4
+            port: 8080
+            zone: zone1
+          metadata:
+            name: envoy-envoy-gateway-gateway-2-4a0e4eb9
             namespace: envoy-gateway-system
             sectionName: "8080"
           name: envoy-gateway/gateway-2
diff --git a/internal/gatewayapi/translator_test.go b/internal/gatewayapi/translator_test.go
index 89195f72e..763e222e0 100644
--- a/internal/gatewayapi/translator_test.go
+++ b/internal/gatewayapi/translator_test.go
@@ -372,7 +372,7 @@ func TestTranslate(t *testing.T) {
 				resources.EndpointSlices = append(resources.EndpointSlices, &endPtSlice)
 			} else {
 				for _, g := range resources.Gateways {
-					gSvc := svc
+					gSvc := svc.DeepCopy()
 					if gatewayNamespaceMode {
 						// In gateway namespace mode, the service name is the same as the gateway name
 						// and the namespace is the gateway namespace.
@@ -384,13 +384,14 @@ func TestTranslate(t *testing.T) {
 
 					gSvc.Labels[OwningGatewayNameLabel] = g.Name
 					gSvc.Labels[OwningGatewayNamespaceLabel] = g.Namespace
-					gEndPtSlice := endPtSlice
+					gEndPtSlice := endPtSlice.DeepCopy()
 					gEndPtSlice.Name = gSvc.Name
+					gEndPtSlice.Namespace = gSvc.Namespace
 					gEndPtSlice.Labels[discoveryv1.LabelServiceName] = gSvc.Name
 					gEndPtSlice.Labels[OwningGatewayNameLabel] = g.Name
 					gEndPtSlice.Labels[OwningGatewayNamespaceLabel] = g.Namespace
-					resources.Services = append(resources.Services, &gSvc)
-					resources.EndpointSlices = append(resources.EndpointSlices, &gEndPtSlice)
+					resources.Services = append(resources.Services, gSvc)
+					resources.EndpointSlices = append(resources.EndpointSlices, gEndPtSlice)
 				}
 			}
 
@@ -650,7 +651,7 @@ func TestTranslateWithExtensionKinds(t *testing.T) {
 					if g == nil {
 						panic("nil Gateway")
 					}
-					gSvc := svc
+					gSvc := svc.DeepCopy()
 					gSvc.
 						Labels[OwningGatewayNameLabel] = g.
 						Name
@@ -658,13 +659,13 @@ func TestTranslateWithExtensionKinds(t *testing.T) {
 						Namespace
 					// Matches proxy.ExpectedResourceHashedName()
 					gSvc.Name = fmt.Sprintf("%s-%s", config.EnvoyPrefix, utils.GetHashedName(fmt.Sprintf("%s/%s", g.Namespace, g.Name), 48))
-					gEndPtSlice := endPtSlice
+					gEndPtSlice := endPtSlice.DeepCopy()
 					gEndPtSlice.Name = gSvc.Name
 					gEndPtSlice.Labels[discoveryv1.LabelServiceName] = gSvc.Name
 					gEndPtSlice.Labels[OwningGatewayNameLabel] = g.Name
 					gEndPtSlice.Labels[OwningGatewayNamespaceLabel] = g.Namespace
-					resources.Services = append(resources.Services, &gSvc)
-					resources.EndpointSlices = append(resources.EndpointSlices, &gEndPtSlice)
+					resources.Services = append(resources.Services, gSvc)
+					resources.EndpointSlices = append(resources.EndpointSlices, gEndPtSlice)
 				}
 			}
 
diff --git a/internal/xds/translator/cluster_test.go b/internal/xds/translator/cluster_test.go
index 80cce5d54..e8f444806 100644
--- a/internal/xds/translator/cluster_test.go
+++ b/internal/xds/translator/cluster_test.go
@@ -7,6 +7,7 @@ package translator
 
 import (
 	"testing"
+	"time"
 
 	bootstrapv3 "github.com/envoyproxy/go-control-plane/envoy/config/bootstrap/v3"
 	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
@@ -14,6 +15,9 @@ import (
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/encoding/protojson"
 	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/yaml"
 
@@ -75,3 +79,76 @@ func getXdsClusterObjFromBootstrap(t *testing.T) *clusterv3.Cluster {
 
 	return nil
 }
+
+func TestBuildXdsOutlierDetection(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    *ir.OutlierDetection
+		expected *clusterv3.OutlierDetection
+	}{
+		{
+			name: "basic outlier detection",
+			input: &ir.OutlierDetection{
+				Interval:             ptr.To(metav1.Duration{Duration: 10 * time.Second}),
+				BaseEjectionTime:     ptr.To(metav1.Duration{Duration: 30 * time.Second}),
+				MaxEjectionPercent:   ptr.To[int32](10),
+				Consecutive5xxErrors: ptr.To[uint32](5),
+			},
+			expected: &clusterv3.OutlierDetection{
+				Interval:           durationpb.New(10 * time.Second),
+				BaseEjectionTime:   durationpb.New(30 * time.Second),
+				MaxEjectionPercent: wrapperspb.UInt32(10),
+				Consecutive_5Xx:    wrapperspb.UInt32(5),
+			},
+		},
+		{
+			name: "outlier detection with failure percentage threshold",
+			input: &ir.OutlierDetection{
+				Interval:                   ptr.To(metav1.Duration{Duration: 10 * time.Second}),
+				BaseEjectionTime:           ptr.To(metav1.Duration{Duration: 30 * time.Second}),
+				MaxEjectionPercent:         ptr.To[int32](10),
+				Consecutive5xxErrors:       ptr.To[uint32](5),
+				FailurePercentageThreshold: ptr.To[uint32](90),
+			},
+			expected: &clusterv3.OutlierDetection{
+				Interval:                   durationpb.New(10 * time.Second),
+				BaseEjectionTime:           durationpb.New(30 * time.Second),
+				MaxEjectionPercent:         wrapperspb.UInt32(10),
+				Consecutive_5Xx:            wrapperspb.UInt32(5),
+				FailurePercentageThreshold: wrapperspb.UInt32(90),
+				EnforcingFailurePercentage: wrapperspb.UInt32(100),
+			},
+		},
+		{
+			name: "outlier detection with all fields",
+			input: &ir.OutlierDetection{
+				SplitExternalLocalOriginErrors: ptr.To(true),
+				Interval:                       ptr.To(metav1.Duration{Duration: 10 * time.Second}),
+				ConsecutiveLocalOriginFailures: ptr.To[uint32](3),
+				ConsecutiveGatewayErrors:       ptr.To[uint32](2),
+				Consecutive5xxErrors:           ptr.To[uint32](5),
+				BaseEjectionTime:               ptr.To(metav1.Duration{Duration: 30 * time.Second}),
+				MaxEjectionPercent:             ptr.To[int32](10),
+				FailurePercentageThreshold:     ptr.To[uint32](85),
+			},
+			expected: &clusterv3.OutlierDetection{
+				SplitExternalLocalOriginErrors: true,
+				Interval:                       durationpb.New(10 * time.Second),
+				ConsecutiveLocalOriginFailure:  wrapperspb.UInt32(3),
+				ConsecutiveGatewayFailure:      wrapperspb.UInt32(2),
+				Consecutive_5Xx:                wrapperspb.UInt32(5),
+				BaseEjectionTime:               durationpb.New(30 * time.Second),
+				MaxEjectionPercent:             wrapperspb.UInt32(10),
+				FailurePercentageThreshold:     wrapperspb.UInt32(85),
+				EnforcingFailurePercentage:     wrapperspb.UInt32(100),
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			result := buildXdsOutlierDetection(tc.input)
+			assert.True(t, proto.Equal(tc.expected, result), "Expected and actual outlier detection configurations are not equal")
+		})
+	}
+}
diff --git a/internal/xds/translator/testdata/in/xds-ir/passive-failure-percentage.yaml b/internal/xds/translator/testdata/in/xds-ir/passive-failure-percentage.yaml
new file mode 100644
index 000000000..8d698a3ec
--- /dev/null
+++ b/internal/xds/translator/testdata/in/xds-ir/passive-failure-percentage.yaml
@@ -0,0 +1,32 @@
+name: "passive-failure-percentage"
+http:
+- name: "listener-1"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "route-1"
+    hostname: "*"
+    destination:
+      name: "dest-1"
+      settings:
+      - endpoints:
+        - host: "7.7.7.7"
+          port: 8080
+        name: "dest-1/backend/0"
+        protocol: HTTP
+    traffic:
+      healthCheck:
+        passive:
+          interval: 5s
+          baseEjectionTime: 30s
+          maxEjectionPercent: 50
+          consecutive5XxErrors: 5
+          consecutiveGatewayErrors: 0
+          consecutiveLocalOriginFailures: 5
+          splitExternalLocalOriginErrors: false
+          failurePercentageThreshold: 90
diff --git a/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.clusters.yaml
new file mode 100644
index 000000000..0387fef6e
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.clusters.yaml
@@ -0,0 +1,33 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_PREFERRED
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: dest-1
+  ignoreHealthOnHostRemoval: true
+  lbPolicy: LEAST_REQUEST
+  loadBalancingPolicy:
+    policies:
+    - typedExtensionConfig:
+        name: envoy.load_balancing_policies.least_request
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+          localityLbConfig:
+            localityWeightedLbConfig: {}
+  name: dest-1
+  outlierDetection:
+    baseEjectionTime: 30s
+    consecutive5xx: 5
+    consecutiveGatewayFailure: 0
+    consecutiveLocalOriginFailure: 5
+    enforcingFailurePercentage: 100
+    failurePercentageThreshold: 90
+    interval: 5s
+    maxEjectionPercent: 50
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.endpoints.yaml
new file mode 100644
index 000000000..6a2507a30
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: dest-1
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: dest-1/backend/0
diff --git a/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.listeners.yaml
new file mode 100644
index 000000000..0debce904
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.listeners.yaml
@@ -0,0 +1,35 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: listener-1
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http-10080
+        useRemoteAddress: true
+    name: listener-1
+  maxConnectionsToAcceptPerSocketEvent: 1
+  name: listener-1
+  perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.routes.yaml
new file mode 100644
index 000000000..00cdf3adc
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: listener-1
+  virtualHosts:
+  - domains:
+    - '*'
+    name: listener-1/*
+    routes:
+    - match:
+        prefix: /
+      name: route-1
+      route:
+        cluster: dest-1
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 7104e1d91..dc3ba11f3 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -3568,6 +3568,7 @@ _Appears in:_
 | `consecutive5XxErrors` | _integer_ |  false  | 5 | Consecutive5xxErrors sets the number of consecutive 5xx errors triggering ejection. |
 | `baseEjectionTime` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  | 30s | BaseEjectionTime defines the base duration for which a host will be ejected on consecutive failures. |
 | `maxEjectionPercent` | _integer_ |  false  | 10 | MaxEjectionPercent sets the maximum percentage of hosts in a cluster that can be ejected. |
+| `failurePercentageThreshold` | _integer_ |  false  |  | FailurePercentageThreshold sets the failure percentage threshold for outlier detection.<br />If the failure percentage of a given host is greater than or equal to this value, it will be ejected.<br />Defaults to 85. |
 
 
 #### PathEscapedSlashAction
diff --git a/site/content/en/latest/tasks/operations/customize-envoyproxy.md b/site/content/en/latest/tasks/operations/customize-envoyproxy.md
index e183ea896..3b094d3dd 100644
--- a/site/content/en/latest/tasks/operations/customize-envoyproxy.md
+++ b/site/content/en/latest/tasks/operations/customize-envoyproxy.md
@@ -6,6 +6,8 @@ Envoy Gateway provides an [EnvoyProxy][] CRD that can be linked to the Parameter
 in a Gateway and GatewayClass, allowing cluster admins to customize the managed EnvoyProxy Deployment and
 Service. To learn more about GatewayClass and ParametersRef, please refer to [Gateway API documentation][].
 
+**Note**: We recommend creating a [EnvoyProxy][] resource before creating a Gateway or GatewayClass that references it to avoid temporary disruption.
+
 ## Prerequisites
 
 {{< boilerplate prerequisites >}}
diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml
index cee98a8e2..f9322ebc1 100644
--- a/test/helm/gateway-crds-helm/all.out.yaml
+++ b/test/helm/gateway-crds-helm/all.out.yaml
@@ -18159,6 +18159,15 @@ spec:
                           Parameter takes effect only when split_external_local_origin_errors is set to true.
                         format: int32
                         type: integer
+                      failurePercentageThreshold:
+                        description: |-
+                          FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                          If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                          Defaults to 85.
+                        format: int32
+                        maximum: 100
+                        minimum: 0
+                        type: integer
                       interval:
                         default: 3s
                         description: Interval defines the time between passive health
@@ -22449,6 +22458,15 @@ spec:
                                     Parameter takes effect only when split_external_local_origin_errors is set to true.
                                   format: int32
                                   type: integer
+                                failurePercentageThreshold:
+                                  description: |-
+                                    FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                    If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                    Defaults to 85.
+                                  format: int32
+                                  maximum: 100
+                                  minimum: 0
+                                  type: integer
                                 interval:
                                   default: 3s
                                   description: Interval defines the time between passive
@@ -35903,6 +35921,15 @@ spec:
                                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                                     format: int32
                                                     type: integer
+                                                  failurePercentageThreshold:
+                                                    description: |-
+                                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                                      Defaults to 85.
+                                                    format: int32
+                                                    maximum: 100
+                                                    minimum: 0
+                                                    type: integer
                                                   interval:
                                                     default: 3s
                                                     description: Interval defines
@@ -37025,6 +37052,15 @@ spec:
                                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                                     format: int32
                                                     type: integer
+                                                  failurePercentageThreshold:
+                                                    description: |-
+                                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                                      Defaults to 85.
+                                                    format: int32
+                                                    maximum: 100
+                                                    minimum: 0
+                                                    type: integer
                                                   interval:
                                                     default: 3s
                                                     description: Interval defines
@@ -38239,6 +38275,15 @@ spec:
                                                 Parameter takes effect only when split_external_local_origin_errors is set to true.
                                               format: int32
                                               type: integer
+                                            failurePercentageThreshold:
+                                              description: |-
+                                                FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                                If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                                Defaults to 85.
+                                              format: int32
+                                              maximum: 100
+                                              minimum: 0
+                                              type: integer
                                             interval:
                                               default: 3s
                                               description: Interval defines the time
@@ -39364,6 +39409,15 @@ spec:
                                           Parameter takes effect only when split_external_local_origin_errors is set to true.
                                         format: int32
                                         type: integer
+                                      failurePercentageThreshold:
+                                        description: |-
+                                          FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                          If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                          Defaults to 85.
+                                        format: int32
+                                        maximum: 100
+                                        minimum: 0
+                                        type: integer
                                       interval:
                                         default: 3s
                                         description: Interval defines the time between
@@ -41464,6 +41518,15 @@ spec:
                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                     format: int32
                                     type: integer
+                                  failurePercentageThreshold:
+                                    description: |-
+                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                      Defaults to 85.
+                                    format: int32
+                                    maximum: 100
+                                    minimum: 0
+                                    type: integer
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
@@ -42480,6 +42543,15 @@ spec:
                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                     format: int32
                                     type: integer
+                                  failurePercentageThreshold:
+                                    description: |-
+                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                      Defaults to 85.
+                                    format: int32
+                                    maximum: 100
+                                    minimum: 0
+                                    type: integer
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
@@ -43707,6 +43779,15 @@ spec:
                                             Parameter takes effect only when split_external_local_origin_errors is set to true.
                                           format: int32
                                           type: integer
+                                        failurePercentageThreshold:
+                                          description: |-
+                                            FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                            If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                            Defaults to 85.
+                                          format: int32
+                                          maximum: 100
+                                          minimum: 0
+                                          type: integer
                                         interval:
                                           default: 3s
                                           description: Interval defines the time between
@@ -44991,6 +45072,15 @@ spec:
                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                     format: int32
                                     type: integer
+                                  failurePercentageThreshold:
+                                    description: |-
+                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                      Defaults to 85.
+                                    format: int32
+                                    maximum: 100
+                                    minimum: 0
+                                    type: integer
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
index c2f14a04f..a3091229f 100644
--- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
+++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
@@ -847,6 +847,15 @@ spec:
                           Parameter takes effect only when split_external_local_origin_errors is set to true.
                         format: int32
                         type: integer
+                      failurePercentageThreshold:
+                        description: |-
+                          FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                          If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                          Defaults to 85.
+                        format: int32
+                        maximum: 100
+                        minimum: 0
+                        type: integer
                       interval:
                         default: 3s
                         description: Interval defines the time between passive health
@@ -5137,6 +5146,15 @@ spec:
                                     Parameter takes effect only when split_external_local_origin_errors is set to true.
                                   format: int32
                                   type: integer
+                                failurePercentageThreshold:
+                                  description: |-
+                                    FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                    If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                    Defaults to 85.
+                                  format: int32
+                                  maximum: 100
+                                  minimum: 0
+                                  type: integer
                                 interval:
                                   default: 3s
                                   description: Interval defines the time between passive
@@ -18591,6 +18609,15 @@ spec:
                                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                                     format: int32
                                                     type: integer
+                                                  failurePercentageThreshold:
+                                                    description: |-
+                                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                                      Defaults to 85.
+                                                    format: int32
+                                                    maximum: 100
+                                                    minimum: 0
+                                                    type: integer
                                                   interval:
                                                     default: 3s
                                                     description: Interval defines
@@ -19713,6 +19740,15 @@ spec:
                                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                                     format: int32
                                                     type: integer
+                                                  failurePercentageThreshold:
+                                                    description: |-
+                                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                                      Defaults to 85.
+                                                    format: int32
+                                                    maximum: 100
+                                                    minimum: 0
+                                                    type: integer
                                                   interval:
                                                     default: 3s
                                                     description: Interval defines
@@ -20927,6 +20963,15 @@ spec:
                                                 Parameter takes effect only when split_external_local_origin_errors is set to true.
                                               format: int32
                                               type: integer
+                                            failurePercentageThreshold:
+                                              description: |-
+                                                FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                                If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                                Defaults to 85.
+                                              format: int32
+                                              maximum: 100
+                                              minimum: 0
+                                              type: integer
                                             interval:
                                               default: 3s
                                               description: Interval defines the time
@@ -22052,6 +22097,15 @@ spec:
                                           Parameter takes effect only when split_external_local_origin_errors is set to true.
                                         format: int32
                                         type: integer
+                                      failurePercentageThreshold:
+                                        description: |-
+                                          FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                          If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                          Defaults to 85.
+                                        format: int32
+                                        maximum: 100
+                                        minimum: 0
+                                        type: integer
                                       interval:
                                         default: 3s
                                         description: Interval defines the time between
@@ -24152,6 +24206,15 @@ spec:
                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                     format: int32
                                     type: integer
+                                  failurePercentageThreshold:
+                                    description: |-
+                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                      Defaults to 85.
+                                    format: int32
+                                    maximum: 100
+                                    minimum: 0
+                                    type: integer
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
@@ -25168,6 +25231,15 @@ spec:
                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                     format: int32
                                     type: integer
+                                  failurePercentageThreshold:
+                                    description: |-
+                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                      Defaults to 85.
+                                    format: int32
+                                    maximum: 100
+                                    minimum: 0
+                                    type: integer
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
@@ -26395,6 +26467,15 @@ spec:
                                             Parameter takes effect only when split_external_local_origin_errors is set to true.
                                           format: int32
                                           type: integer
+                                        failurePercentageThreshold:
+                                          description: |-
+                                            FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                            If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                            Defaults to 85.
+                                          format: int32
+                                          maximum: 100
+                                          minimum: 0
+                                          type: integer
                                         interval:
                                           default: 3s
                                           description: Interval defines the time between
@@ -27679,6 +27760,15 @@ spec:
                                       Parameter takes effect only when split_external_local_origin_errors is set to true.
                                     format: int32
                                     type: integer
+                                  failurePercentageThreshold:
+                                    description: |-
+                                      FailurePercentageThreshold sets the failure percentage threshold for outlier detection.
+                                      If the failure percentage of a given host is greater than or equal to this value, it will be ejected.
+                                      Defaults to 85.
+                                    format: int32
+                                    maximum: 100
+                                    minimum: 0
+                                    type: integer
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between