Repository: envoyproxy/gateway

Issue:
Apply enforcement settings for outlier_detection
*Description*:
Right now, outlier_detection in Envoy Gateway is applied like this:

```
"outlier_detection": {
  "consecutive_5xx": 0,
  "interval": "60s",
  "base_ejection_time": "30s",
  "max_ejection_percent": 50,
  "consecutive_gateway_failure": 2,
  "split_external_local_origin_errors": true,
  "consecutive_local_origin_failure": 5
}
```


Notice that enforcement fields are missing: enforcing_consecutive_gateway_failure(default 0), enforcing_consecutive_local_origin_failure(100), and enforcing_local_origin_success_rate (100) are not set, so OD does not enforce ejections consistently.

Desired behavior

We want outlier_detection applying enforcement automatically:

```
EnforcingSuccessRate → 0.

EnforcingConsecutiveGatewayFailure → 100 if ConsecutiveGatewayErrors > 0, otherwise 0.

If SplitExternalLocalOriginErrors == true:

EnforcingLocalOriginSuccessRate → 0.

EnforcingConsecutiveLocalOriginFailure → 100 if ConsecutiveLocalOriginFailures > 0.
```

This would make the policy enforcement consistent and predictable and enforce gateway_failure errors (for now its not work).

docs:
[Outlier detection](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/outlier_detection.proto#outlier-detection-proto)


Discussion:
@Inode1: @zirain, mind to take a look,  consecutive_gateway_failure is not enforce now@arkodg: thanks for flagging this @Inode1 
+1 to default to 100 for `enforcing_local_origin_success_rate` if `consecutive_local_origin_failure` is set & the same for `enforcing_consecutive_gateway_failure` if `consecutive_gateway_failure` is set

https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/outlier_detection.proto@zirain: do we really need this for `EnforcingLocalOriginSuccessRate`?

```
	// The % chance that a host will be actually ejected when an outlier status
	// is detected through success rate statistics for locally originated errors.
	// This setting can be used to disable ejection or to ramp it up slowly. Defaults to 100.
	// Parameter takes effect only when
	// :ref:`split_external_local_origin_errors<envoy_v3_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
	// is set to true.
	EnforcingLocalOriginSuccessRate *wrapperspb.UInt32Value `protobuf:"bytes,15,opt,name=enforcing_local_origin_success_rate,json=enforcingLocalOriginSuccessRate,proto3" json:"enforcing_local_origin_success_rate,omitempty"`
	
```@arkodg: thanks @zirain , you are right, not needed for `consecutive_local_origin_failure`

Solution patch:
diff --git a/api/v1alpha1/healthcheck_types.go b/api/v1alpha1/healthcheck_types.go
index e5477c2be..7fd1cd6a1 100644
--- a/api/v1alpha1/healthcheck_types.go
+++ b/api/v1alpha1/healthcheck_types.go
@@ -52,7 +52,6 @@ type PassiveHealthCheck struct {
 
 	// ConsecutiveGatewayErrors sets the number of consecutive gateway errors triggering ejection.
 	//
-	// +kubebuilder:default=0
 	// +optional
 	ConsecutiveGatewayErrors *uint32 `json:"consecutiveGatewayErrors,omitempty"`
 
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
index 3328819ad..767dfd67d 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
@@ -526,7 +526,6 @@ spec:
                         format: int32
                         type: integer
                       consecutiveGatewayErrors:
-                        default: 0
                         description: ConsecutiveGatewayErrors sets the number of consecutive
                           gateway errors triggering ejection.
                         format: int32
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
index d21a88167..2d057a35f 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -594,7 +594,6 @@ spec:
                                   format: int32
                                   type: integer
                                 consecutiveGatewayErrors:
-                                  default: 0
                                   description: ConsecutiveGatewayErrors sets the number
                                     of consecutive gateway errors triggering ejection.
                                   format: int32
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
index a5ead902f..e177a4e41 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -11559,7 +11559,6 @@ spec:
                                                     format: int32
                                                     type: integer
                                                   consecutiveGatewayErrors:
-                                                    default: 0
                                                     description: ConsecutiveGatewayErrors
                                                       sets the number of consecutive
                                                       gateway errors triggering ejection.
@@ -12690,7 +12689,6 @@ spec:
                                                     format: int32
                                                     type: integer
                                                   consecutiveGatewayErrors:
-                                                    default: 0
                                                     description: ConsecutiveGatewayErrors
                                                       sets the number of consecutive
                                                       gateway errors triggering ejection.
@@ -13917,7 +13915,6 @@ spec:
                                               format: int32
                                               type: integer
                                             consecutiveGatewayErrors:
-                                              default: 0
                                               description: ConsecutiveGatewayErrors
                                                 sets the number of consecutive gateway
                                                 errors triggering ejection.
@@ -15051,7 +15048,6 @@ spec:
                                         format: int32
                                         type: integer
                                       consecutiveGatewayErrors:
-                                        default: 0
                                         description: ConsecutiveGatewayErrors sets
                                           the number of consecutive gateway errors
                                           triggering ejection.
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
index e6580fe45..c91bef867 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -1110,7 +1110,6 @@ spec:
                                     format: int32
                                     type: integer
                                   consecutiveGatewayErrors:
-                                    default: 0
                                     description: ConsecutiveGatewayErrors sets the
                                       number of consecutive gateway errors triggering
                                       ejection.
@@ -2135,7 +2134,6 @@ spec:
                                     format: int32
                                     type: integer
                                   consecutiveGatewayErrors:
-                                    default: 0
                                     description: ConsecutiveGatewayErrors sets the
                                       number of consecutive gateway errors triggering
                                       ejection.
@@ -3371,7 +3369,6 @@ spec:
                                           format: int32
                                           type: integer
                                         consecutiveGatewayErrors:
-                                          default: 0
                                           description: ConsecutiveGatewayErrors sets
                                             the number of consecutive gateway errors
                                             triggering ejection.
@@ -4664,7 +4661,6 @@ spec:
                                     format: int32
                                     type: integer
                                   consecutiveGatewayErrors:
-                                    default: 0
                                     description: ConsecutiveGatewayErrors sets the
                                       number of consecutive gateway errors triggering
                                       ejection.
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
index 9d1adddb9..5df1439aa 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
@@ -525,7 +525,6 @@ spec:
                         format: int32
                         type: integer
                       consecutiveGatewayErrors:
-                        default: 0
                         description: ConsecutiveGatewayErrors sets the number of consecutive
                           gateway errors triggering ejection.
                         format: int32
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
index 49025b85a..d11914c0a 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -593,7 +593,6 @@ spec:
                                   format: int32
                                   type: integer
                                 consecutiveGatewayErrors:
-                                  default: 0
                                   description: ConsecutiveGatewayErrors sets the number
                                     of consecutive gateway errors triggering ejection.
                                   format: int32
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
index d484010ca..9df7e75ef 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -11558,7 +11558,6 @@ spec:
                                                     format: int32
                                                     type: integer
                                                   consecutiveGatewayErrors:
-                                                    default: 0
                                                     description: ConsecutiveGatewayErrors
                                                       sets the number of consecutive
                                                       gateway errors triggering ejection.
@@ -12689,7 +12688,6 @@ spec:
                                                     format: int32
                                                     type: integer
                                                   consecutiveGatewayErrors:
-                                                    default: 0
                                                     description: ConsecutiveGatewayErrors
                                                       sets the number of consecutive
                                                       gateway errors triggering ejection.
@@ -13916,7 +13914,6 @@ spec:
                                               format: int32
                                               type: integer
                                             consecutiveGatewayErrors:
-                                              default: 0
                                               description: ConsecutiveGatewayErrors
                                                 sets the number of consecutive gateway
                                                 errors triggering ejection.
@@ -15050,7 +15047,6 @@ spec:
                                         format: int32
                                         type: integer
                                       consecutiveGatewayErrors:
-                                        default: 0
                                         description: ConsecutiveGatewayErrors sets
                                           the number of consecutive gateway errors
                                           triggering ejection.
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
index c9b472819..18d6a561a 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -1109,7 +1109,6 @@ spec:
                                     format: int32
                                     type: integer
                                   consecutiveGatewayErrors:
-                                    default: 0
                                     description: ConsecutiveGatewayErrors sets the
                                       number of consecutive gateway errors triggering
                                       ejection.
@@ -2134,7 +2133,6 @@ spec:
                                     format: int32
                                     type: integer
                                   consecutiveGatewayErrors:
-                                    default: 0
                                     description: ConsecutiveGatewayErrors sets the
                                       number of consecutive gateway errors triggering
                                       ejection.
@@ -3370,7 +3368,6 @@ spec:
                                           format: int32
                                           type: integer
                                         consecutiveGatewayErrors:
-                                          default: 0
                                           description: ConsecutiveGatewayErrors sets
                                             the number of consecutive gateway errors
                                             triggering ejection.
@@ -4663,7 +4660,6 @@ spec:
                                     format: int32
                                     type: integer
                                   consecutiveGatewayErrors:
-                                    default: 0
                                     description: ConsecutiveGatewayErrors sets the
                                       number of consecutive gateway errors triggering
                                       ejection.
diff --git a/internal/provider/kubernetes/predicates.go b/internal/provider/kubernetes/predicates.go
index bc2fe23cf..7b16dce31 100644
--- a/internal/provider/kubernetes/predicates.go
+++ b/internal/provider/kubernetes/predicates.go
@@ -181,6 +181,28 @@ func (r *gatewayAPIReconciler) validateSecretForReconcile(secret *corev1.Secret)
 		}
 	}
 
+	if !r.backendAPIDisabled() {
+		if r.isBackendReferencingSecret(&nsName) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (r *gatewayAPIReconciler) isBackendReferencingSecret(nsName *types.NamespacedName) bool {
+	backendList := &egv1a1.BackendList{}
+	if err := r.client.List(context.Background(), backendList, &client.ListOptions{
+		FieldSelector: fields.OneTermEqualSelector(secretBackendIndex, nsName.String()),
+	}); err != nil {
+		r.log.Error(err, "unable to find associated Backend")
+		return false
+	}
+
+	if len(backendList.Items) > 0 {
+		return true
+	}
+
 	return false
 }
 
@@ -881,6 +903,20 @@ func (r *gatewayAPIReconciler) validateConfigMapForReconcile(obj client.Object)
 		}
 	}
 
+	if !r.backendAPIDisabled() {
+		backendList := &egv1a1.BackendList{}
+		if err := r.client.List(context.Background(), backendList, &client.ListOptions{
+			FieldSelector: fields.OneTermEqualSelector(configMapBackendIndex, utils.NamespacedName(configMap).String()),
+		}); err != nil {
+			r.log.Error(err, "unable to find associated Backend")
+			return false
+		}
+
+		if len(backendList.Items) > 0 {
+			return true
+		}
+	}
+
 	return false
 }
 
diff --git a/internal/xds/translator/cluster.go b/internal/xds/translator/cluster.go
index 72cc142da..8ce566714 100644
--- a/internal/xds/translator/cluster.go
+++ b/internal/xds/translator/cluster.go
@@ -604,6 +604,7 @@ func buildXdsOutlierDetection(outlierDetection *ir.OutlierDetection) *clusterv3.
 	}
 
 	if outlierDetection.ConsecutiveGatewayErrors != nil {
+		od.EnforcingConsecutiveGatewayFailure = wrapperspb.UInt32(100)
 		od.ConsecutiveGatewayFailure = wrapperspb.UInt32(*outlierDetection.ConsecutiveGatewayErrors)
 	}
 
diff --git a/release-notes/current.yaml b/release-notes/current.yaml
index b95ceb04e..38e69f22a 100644
--- a/release-notes/current.yaml
+++ b/release-notes/current.yaml
@@ -7,6 +7,7 @@ breaking changes: |
   When a Backend resource specifies TLS settings and SNI is not specified or a BackendTLSPolicy is not attached to it, the upstream certificate is validated for DNS SAN matching the SNI value sent.
   When a MirrorPolicy is used, the shadow host suffix is not appended to the mirrored cluster name.
   When running `egctl experimental collect`, SDS will not be dumped, you can enable it by adding `--sds true`.
+  When setting the 'consecutiveGatewayFailure' will 'enforcingConsecutiveGatewayFailure set to 100.
 
 # Updates addressing vulnerabilities, security flaws, or compliance requirements.
 security updates: |



Test patch:
diff --git a/internal/provider/kubernetes/predicates_test.go b/internal/provider/kubernetes/predicates_test.go
index 425189f2b..be42beef7 100644
--- a/internal/provider/kubernetes/predicates_test.go
+++ b/internal/provider/kubernetes/predicates_test.go
@@ -186,6 +186,29 @@ func TestValidateConfigMapForReconcile(t *testing.T) {
 		configMap client.Object
 		expect    bool
 	}{
+		{
+			name: "references Backend TLS config map",
+			configs: []client.Object{
+				&egv1a1.Backend{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "static-backend",
+						Namespace: "default",
+					},
+					Spec: egv1a1.BackendSpec{
+						TLS: &egv1a1.BackendTLSSettings{
+							CACertificateRefs: []gwapiv1.LocalObjectReference{
+								{
+									Kind: gwapiv1.Kind(resource.KindConfigMap),
+									Name: gwapiv1.ObjectName("backend-ca"),
+								},
+							},
+						},
+					},
+				},
+			},
+			configMap: test.GetConfigMap(types.NamespacedName{Namespace: "default", Name: "backend-ca"}, make(map[string]string), make(map[string]string)),
+			expect:    true,
+		},
 		{
 			name: "references EnvoyExtensionPolicy Lua config map",
 			configs: []client.Object{
@@ -266,17 +289,24 @@ func TestValidateConfigMapForReconcile(t *testing.T) {
 	logger := logging.DefaultLogger(os.Stdout, egv1a1.LogLevelInfo)
 
 	r := gatewayAPIReconciler{
-		classController: egv1a1.GatewayControllerName,
-		log:             logger,
-		spCRDExists:     true,
-		epCRDExists:     true,
-		eepCRDExists:    true,
+		classController:  egv1a1.GatewayControllerName,
+		log:              logger,
+		backendCRDExists: true,
+		eepCRDExists:     true,
+		envoyGateway: &egv1a1.EnvoyGateway{
+			EnvoyGatewaySpec: egv1a1.EnvoyGatewaySpec{
+				ExtensionAPIs: &egv1a1.ExtensionAPISettings{
+					EnableBackend: true,
+				},
+			},
+		},
 	}
 
 	for _, tc := range testCases {
 		r.client = fakeclient.NewClientBuilder().
 			WithScheme(envoygateway.GetScheme()).
 			WithObjects(tc.configs...).
+			WithIndex(&egv1a1.Backend{}, configMapBackendIndex, configMapBackendIndexFunc).
 			WithIndex(&egv1a1.EnvoyExtensionPolicy{}, configMapEepIndex, configMapEepIndexFunc).
 			Build()
 		t.Run(tc.name, func(t *testing.T) {
@@ -346,6 +376,29 @@ func TestValidateSecretForReconcile(t *testing.T) {
 		secret  *corev1.Secret
 		expect  bool
 	}{
+		{
+			name: "backend references TLS secret",
+			configs: []client.Object{
+				&egv1a1.Backend{
+					ObjectMeta: metav1.ObjectMeta{
+						Namespace: "default",
+						Name:      "secure-backend",
+					},
+					Spec: egv1a1.BackendSpec{
+						TLS: &egv1a1.BackendTLSSettings{
+							CACertificateRefs: []gwapiv1.LocalObjectReference{
+								{
+									Kind: gwapiv1.Kind(resource.KindSecret),
+									Name: gwapiv1.ObjectName("backend-ca-secret"),
+								},
+							},
+						},
+					},
+				},
+			},
+			secret: test.GetSecret(types.NamespacedName{Namespace: "default", Name: "backend-ca-secret"}),
+			expect: true,
+		},
 		{
 			name: "envoy proxy references a secret",
 			configs: []client.Object{
@@ -535,11 +588,19 @@ func TestValidateSecretForReconcile(t *testing.T) {
 	logger := logging.DefaultLogger(os.Stdout, egv1a1.LogLevelInfo)
 
 	r := gatewayAPIReconciler{
-		classController: egv1a1.GatewayControllerName,
-		log:             logger,
-		spCRDExists:     true,
-		epCRDExists:     true,
-		eepCRDExists:    true,
+		classController:  egv1a1.GatewayControllerName,
+		log:              logger,
+		backendCRDExists: true,
+		spCRDExists:      true,
+		epCRDExists:      true,
+		eepCRDExists:     true,
+		envoyGateway: &egv1a1.EnvoyGateway{
+			EnvoyGatewaySpec: egv1a1.EnvoyGatewaySpec{
+				ExtensionAPIs: &egv1a1.ExtensionAPISettings{
+					EnableBackend: true,
+				},
+			},
+		},
 	}
 
 	for _, tc := range testCases {
@@ -550,6 +611,7 @@ func TestValidateSecretForReconcile(t *testing.T) {
 			WithIndex(&egv1a1.SecurityPolicy{}, secretSecurityPolicyIndex, secretSecurityPolicyIndexFunc).
 			WithIndex(&egv1a1.EnvoyProxy{}, secretEnvoyProxyIndex, secretEnvoyProxyIndexFunc).
 			WithIndex(&egv1a1.EnvoyExtensionPolicy{}, secretEnvoyExtensionPolicyIndex, secretEnvoyExtensionPolicyIndexFunc).
+			WithIndex(&egv1a1.Backend{}, secretBackendIndex, secretBackendIndexFunc).
 			Build()
 		t.Run(tc.name, func(t *testing.T) {
 			res := r.validateSecretForReconcile(tc.secret)
diff --git a/internal/xds/translator/cluster_test.go b/internal/xds/translator/cluster_test.go
index e8f444806..6127fded2 100644
--- a/internal/xds/translator/cluster_test.go
+++ b/internal/xds/translator/cluster_test.go
@@ -11,10 +11,10 @@ import (
 
 	bootstrapv3 "github.com/envoyproxy/go-control-plane/envoy/config/bootstrap/v3"
 	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
-	"github.com/stretchr/testify/assert"
+	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/encoding/protojson"
-	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/testing/protocmp"
 	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -32,6 +32,7 @@ const (
 
 func TestBuildXdsCluster(t *testing.T) {
 	bootstrapXdsCluster := getXdsClusterObjFromBootstrap(t)
+	require.NotNil(t, bootstrapXdsCluster)
 
 	args := &xdsClusterArgs{
 		name:         bootstrapXdsCluster.Name,
@@ -47,19 +48,20 @@ func TestBuildXdsCluster(t *testing.T) {
 	require.Equal(t, bootstrapXdsCluster.Name, dynamicXdsCluster.Name)
 	require.Equal(t, bootstrapXdsCluster.ClusterDiscoveryType, dynamicXdsCluster.ClusterDiscoveryType)
 	require.Equal(t, bootstrapXdsCluster.TransportSocket, dynamicXdsCluster.TransportSocket)
-	assert.True(t, proto.Equal(bootstrapXdsCluster.TransportSocket, dynamicXdsCluster.TransportSocket))
-	assert.True(t, proto.Equal(bootstrapXdsCluster.ConnectTimeout, dynamicXdsCluster.ConnectTimeout))
+	requireCmpNoDiff(t, bootstrapXdsCluster.TransportSocket, dynamicXdsCluster.TransportSocket)
+	requireCmpNoDiff(t, bootstrapXdsCluster.ConnectTimeout, dynamicXdsCluster.ConnectTimeout)
 }
 
 func TestBuildXdsClusterLoadAssignment(t *testing.T) {
 	bootstrapXdsCluster := getXdsClusterObjFromBootstrap(t)
+	require.NotNil(t, bootstrapXdsCluster)
 	ds := &ir.DestinationSetting{
 		Endpoints: []*ir.DestinationEndpoint{{Host: envoyGatewayXdsServerHost, Port: bootstrap.DefaultXdsServerPort}},
 	}
 	settings := []*ir.DestinationSetting{ds}
 	dynamicXdsClusterLoadAssignment := buildXdsClusterLoadAssignment(bootstrapXdsCluster.Name, settings, nil)
 
-	assert.True(t, proto.Equal(bootstrapXdsCluster.LoadAssignment.Endpoints[0].LbEndpoints[0], dynamicXdsClusterLoadAssignment.Endpoints[0].LbEndpoints[0]))
+	requireCmpNoDiff(t, bootstrapXdsCluster.LoadAssignment.Endpoints[0].LbEndpoints[0], dynamicXdsClusterLoadAssignment.Endpoints[0].LbEndpoints[0])
 }
 
 func getXdsClusterObjFromBootstrap(t *testing.T) *clusterv3.Cluster {
@@ -132,15 +134,16 @@ func TestBuildXdsOutlierDetection(t *testing.T) {
 				FailurePercentageThreshold:     ptr.To[uint32](85),
 			},
 			expected: &clusterv3.OutlierDetection{
-				SplitExternalLocalOriginErrors: true,
-				Interval:                       durationpb.New(10 * time.Second),
-				ConsecutiveLocalOriginFailure:  wrapperspb.UInt32(3),
-				ConsecutiveGatewayFailure:      wrapperspb.UInt32(2),
-				Consecutive_5Xx:                wrapperspb.UInt32(5),
-				BaseEjectionTime:               durationpb.New(30 * time.Second),
-				MaxEjectionPercent:             wrapperspb.UInt32(10),
-				FailurePercentageThreshold:     wrapperspb.UInt32(85),
-				EnforcingFailurePercentage:     wrapperspb.UInt32(100),
+				SplitExternalLocalOriginErrors:     true,
+				Interval:                           durationpb.New(10 * time.Second),
+				ConsecutiveLocalOriginFailure:      wrapperspb.UInt32(3),
+				EnforcingConsecutiveGatewayFailure: wrapperspb.UInt32(100),
+				ConsecutiveGatewayFailure:          wrapperspb.UInt32(2),
+				Consecutive_5Xx:                    wrapperspb.UInt32(5),
+				BaseEjectionTime:                   durationpb.New(30 * time.Second),
+				MaxEjectionPercent:                 wrapperspb.UInt32(10),
+				FailurePercentageThreshold:         wrapperspb.UInt32(85),
+				EnforcingFailurePercentage:         wrapperspb.UInt32(100),
 			},
 		},
 	}
@@ -148,7 +151,11 @@ func TestBuildXdsOutlierDetection(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			result := buildXdsOutlierDetection(tc.input)
-			assert.True(t, proto.Equal(tc.expected, result), "Expected and actual outlier detection configurations are not equal")
+			requireCmpNoDiff(t, tc.expected, result)
 		})
 	}
 }
+
+func requireCmpNoDiff(t *testing.T, expected, actual interface{}) {
+	require.Empty(t, cmp.Diff(expected, actual, protocmp.Transform()))
+}
diff --git a/internal/xds/translator/testdata/out/xds-ir/accesslog-als-tcp.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/accesslog-als-tcp.clusters.yaml
index dfc236fe0..ccbf5dc34 100755
--- a/internal/xds/translator/testdata/out/xds-ir/accesslog-als-tcp.clusters.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/accesslog-als-tcp.clusters.yaml
@@ -26,6 +26,7 @@
     consecutive5xx: 5
     consecutiveGatewayFailure: 4
     consecutiveLocalOriginFailure: 5
+    enforcingConsecutiveGatewayFailure: 100
     interval: 5s
     maxEjectionPercent: 10
   perConnectionBufferLimitBytes: 20971520
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc-with-traffic-settings.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc-with-traffic-settings.clusters.yaml
index e008f4717..c0ae4804d 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ext-proc-with-traffic-settings.clusters.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-proc-with-traffic-settings.clusters.yaml
@@ -75,6 +75,7 @@
     consecutive5xx: 5
     consecutiveGatewayFailure: 4
     consecutiveLocalOriginFailure: 5
+    enforcingConsecutiveGatewayFailure: 100
     interval: 5s
     maxEjectionPercent: 10
   perConnectionBufferLimitBytes: 20971520
diff --git a/internal/xds/translator/testdata/out/xds-ir/health-check.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/health-check.clusters.yaml
index 3c797c2ff..3ccb320b4 100644
--- a/internal/xds/translator/testdata/out/xds-ir/health-check.clusters.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/health-check.clusters.yaml
@@ -40,6 +40,7 @@
     consecutive5xx: 5
     consecutiveGatewayFailure: 0
     consecutiveLocalOriginFailure: 5
+    enforcingConsecutiveGatewayFailure: 100
     interval: 2s
     maxEjectionPercent: 100
   perConnectionBufferLimitBytes: 32768
@@ -84,6 +85,7 @@
     consecutive5xx: 5
     consecutiveGatewayFailure: 0
     consecutiveLocalOriginFailure: 5
+    enforcingConsecutiveGatewayFailure: 100
     interval: 1s
     maxEjectionPercent: 100
   perConnectionBufferLimitBytes: 32768
@@ -125,6 +127,7 @@
     consecutive5xx: 5
     consecutiveGatewayFailure: 0
     consecutiveLocalOriginFailure: 5
+    enforcingConsecutiveGatewayFailure: 100
     interval: 1s
     maxEjectionPercent: 100
   perConnectionBufferLimitBytes: 32768
@@ -166,6 +169,7 @@
     consecutive5xx: 5
     consecutiveGatewayFailure: 0
     consecutiveLocalOriginFailure: 5
+    enforcingConsecutiveGatewayFailure: 100
     interval: 1s
     maxEjectionPercent: 90
     splitExternalLocalOriginErrors: true
diff --git a/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.clusters.yaml
index 0387fef6e..9290f1ef5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.clusters.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/passive-failure-percentage.clusters.yaml
@@ -25,6 +25,7 @@
     consecutive5xx: 5
     consecutiveGatewayFailure: 0
     consecutiveLocalOriginFailure: 5
+    enforcingConsecutiveGatewayFailure: 100
     enforcingFailurePercentage: 100
     failurePercentageThreshold: 90
     interval: 5s
diff --git a/internal/xds/translator/testdata/out/xds-ir/tracing.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/tracing.clusters.yaml
index 523ecad2b..28d736bc1 100644
--- a/internal/xds/translator/testdata/out/xds-ir/tracing.clusters.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/tracing.clusters.yaml
@@ -59,6 +59,7 @@
     consecutive5xx: 5
     consecutiveGatewayFailure: 4
     consecutiveLocalOriginFailure: 5
+    enforcingConsecutiveGatewayFailure: 100
     interval: 5s
     maxEjectionPercent: 10
   perConnectionBufferLimitBytes: 20971520
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 62fb487b3..fc870f979 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -3567,7 +3567,7 @@ _Appears in:_
 | `splitExternalLocalOriginErrors` | _boolean_ |  false  | false | SplitExternalLocalOriginErrors enables splitting of errors between external and local origin. |
 | `interval` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#duration)_ |  false  | 3s | Interval defines the time between passive health checks. |
 | `consecutiveLocalOriginFailures` | _integer_ |  false  | 5 | ConsecutiveLocalOriginFailures sets the number of consecutive local origin failures triggering ejection.<br />Parameter takes effect only when split_external_local_origin_errors is set to true. |
-| `consecutiveGatewayErrors` | _integer_ |  false  | 0 | ConsecutiveGatewayErrors sets the number of consecutive gateway errors triggering ejection. |
+| `consecutiveGatewayErrors` | _integer_ |  false  |  | ConsecutiveGatewayErrors sets the number of consecutive gateway errors triggering ejection. |
 | `consecutive5XxErrors` | _integer_ |  false  | 5 | Consecutive5xxErrors sets the number of consecutive 5xx errors triggering ejection. |
 | `baseEjectionTime` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#duration)_ |  false  | 30s | BaseEjectionTime defines the base duration for which a host will be ejected on consecutive failures. |
 | `maxEjectionPercent` | _integer_ |  false  | 10 | MaxEjectionPercent sets the maximum percentage of hosts in a cluster that can be ejected. |
diff --git a/test/fuzz/oss_fuzz_build.sh b/test/fuzz/oss_fuzz_build.sh
index 854ed9393..dea5382dd 100755
--- a/test/fuzz/oss_fuzz_build.sh
+++ b/test/fuzz/oss_fuzz_build.sh
@@ -9,13 +9,8 @@
 # from the source file https://github.com/istio/istio/blob/master/tests/fuzz/oss_fuzz_build.sh
 # and is provided here subject to the following: Copyright Istio Authors SPDX-License-Identifier: Apache-2.0
 
-# Required by `compile_native_go_fuzzer`
-# Ref: https://google.github.io/oss-fuzz/getting-started/new-project-guide/go-lang/#buildsh
-cd "$SRC"
-git clone --depth=1 https://github.com/AdamKorcz/go-118-fuzz-build --branch=include-all-test-files
-cd go-118-fuzz-build
-go build .
-mv go-118-fuzz-build /root/go/bin/
+# Using `compile_native_go_fuzzer_v2`
+# Ref: https://github.com/google/oss-fuzz/pull/13835
 
 cd "$SRC"/gateway
 
@@ -24,16 +19,8 @@ set -o pipefail
 set -o errexit
 set -x
 
-# Create empty file that imports "github.com/AdamKorcz/go-118-fuzz-build/testing"
-# This is a small hack to install this dependency, since it is not used anywhere,
-# and Go would therefore remove it from go.mod once we run "go mod tidy && go mod vendor".
-printf "package envoygateway\nimport _ \"github.com/AdamKorcz/go-118-fuzz-build/testing\"\n" > register.go
-go mod edit -replace github.com/AdamKorcz/go-118-fuzz-build="$SRC"/go-118-fuzz-build
-go mod tidy
-
-
 # compile native-format fuzzers
-compile_native_go_fuzzer github.com/envoyproxy/gateway/test/fuzz FuzzGatewayAPIToXDS FuzzGatewayAPIToXDS
+compile_native_go_fuzzer_v2 github.com/envoyproxy/gateway/test/fuzz FuzzGatewayAPIToXDS FuzzGatewayAPIToXDS
 
 # add seed corpus
 zip -j $OUT/FuzzGatewayAPIToXDS_seed_corpus.zip "$SRC"/gateway/test/fuzz/testdata/FuzzGatewayAPIToXDS/*
diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml
index 111bb67f1..4fc7a9a93 100644
--- a/test/helm/gateway-crds-helm/all.out.yaml
+++ b/test/helm/gateway-crds-helm/all.out.yaml
@@ -21527,7 +21527,6 @@ spec:
                         format: int32
                         type: integer
                       consecutiveGatewayErrors:
-                        default: 0
                         description: ConsecutiveGatewayErrors sets the number of consecutive
                           gateway errors triggering ejection.
                         format: int32
@@ -25890,7 +25889,6 @@ spec:
                                   format: int32
                                   type: integer
                                 consecutiveGatewayErrors:
-                                  default: 0
                                   description: ConsecutiveGatewayErrors sets the number
                                     of consecutive gateway errors triggering ejection.
                                   format: int32
@@ -39416,7 +39414,6 @@ spec:
                                                     format: int32
                                                     type: integer
                                                   consecutiveGatewayErrors:
-                                                    default: 0
                                                     description: ConsecutiveGatewayErrors
                                                       sets the number of consecutive
                                                       gateway errors triggering ejection.
@@ -40547,7 +40544,6 @@ spec:
                                                     format: int32
                                                     type: integer
                                                   consecutiveGatewayErrors:
-                                                    default: 0
                                                     description: ConsecutiveGatewayErrors
                                                       sets the number of consecutive
                                                       gateway errors triggering ejection.
@@ -41774,7 +41770,6 @@ spec:
                                               format: int32
                                               type: integer
                                             consecutiveGatewayErrors:
-                                              default: 0
                                               description: ConsecutiveGatewayErrors
                                                 sets the number of consecutive gateway
                                                 errors triggering ejection.
@@ -42908,7 +42903,6 @@ spec:
                                         format: int32
                                         type: integer
                                       consecutiveGatewayErrors:
-                                        default: 0
                                         description: ConsecutiveGatewayErrors sets
                                           the number of consecutive gateway errors
                                           triggering ejection.
@@ -45017,7 +45011,6 @@ spec:
                                     format: int32
                                     type: integer
                                   consecutiveGatewayErrors:
-                                    default: 0
                                     description: ConsecutiveGatewayErrors sets the
                                       number of consecutive gateway errors triggering
                                       ejection.
@@ -46042,7 +46035,6 @@ spec:
                                     format: int32
                                     type: integer
                                   consecutiveGatewayErrors:
-                                    default: 0
                                     description: ConsecutiveGatewayErrors sets the
                                       number of consecutive gateway errors triggering
                                       ejection.
@@ -47278,7 +47270,6 @@ spec:
                                           format: int32
                                           type: integer
                                         consecutiveGatewayErrors:
-                                          default: 0
                                           description: ConsecutiveGatewayErrors sets
                                             the number of consecutive gateway errors
                                             triggering ejection.
@@ -48571,7 +48562,6 @@ spec:
                                     format: int32
                                     type: integer
                                   consecutiveGatewayErrors:
-                                    default: 0
                                     description: ConsecutiveGatewayErrors sets the
                                       number of consecutive gateway errors triggering
                                       ejection.
diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
index 6c3d83e33..894b3589c 100644
--- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
+++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
@@ -871,7 +871,6 @@ spec:
                         format: int32
                         type: integer
                       consecutiveGatewayErrors:
-                        default: 0
                         description: ConsecutiveGatewayErrors sets the number of consecutive
                           gateway errors triggering ejection.
                         format: int32
@@ -5234,7 +5233,6 @@ spec:
                                   format: int32
                                   type: integer
                                 consecutiveGatewayErrors:
-                                  default: 0
                                   description: ConsecutiveGatewayErrors sets the number
                                     of consecutive gateway errors triggering ejection.
                                   format: int32
@@ -18760,7 +18758,6 @@ spec:
                                                     format: int32
                                                     type: integer
                                                   consecutiveGatewayErrors:
-                                                    default: 0
                                                     description: ConsecutiveGatewayErrors
                                                       sets the number of consecutive
                                                       gateway errors triggering ejection.
@@ -19891,7 +19888,6 @@ spec:
                                                     format: int32
                                                     type: integer
                                                   consecutiveGatewayErrors:
-                                                    default: 0
                                                     description: ConsecutiveGatewayErrors
                                                       sets the number of consecutive
                                                       gateway errors triggering ejection.
@@ -21118,7 +21114,6 @@ spec:
                                               format: int32
                                               type: integer
                                             consecutiveGatewayErrors:
-                                              default: 0
                                               description: ConsecutiveGatewayErrors
                                                 sets the number of consecutive gateway
                                                 errors triggering ejection.
@@ -22252,7 +22247,6 @@ spec:
                                         format: int32
                                         type: integer
                                       consecutiveGatewayErrors:
-                                        default: 0
                                         description: ConsecutiveGatewayErrors sets
                                           the number of consecutive gateway errors
                                           triggering ejection.
@@ -24361,7 +24355,6 @@ spec:
                                     format: int32
                                     type: integer
                                   consecutiveGatewayErrors:
-                                    default: 0
                                     description: ConsecutiveGatewayErrors sets the
                                       number of consecutive gateway errors triggering
                                       ejection.
@@ -25386,7 +25379,6 @@ spec:
                                     format: int32
                                     type: integer
                                   consecutiveGatewayErrors:
-                                    default: 0
                                     description: ConsecutiveGatewayErrors sets the
                                       number of consecutive gateway errors triggering
                                       ejection.
@@ -26622,7 +26614,6 @@ spec:
                                           format: int32
                                           type: integer
                                         consecutiveGatewayErrors:
-                                          default: 0
                                           description: ConsecutiveGatewayErrors sets
                                             the number of consecutive gateway errors
                                             triggering ejection.
@@ -27915,7 +27906,6 @@ spec:
                                     format: int32
                                     type: integer
                                   consecutiveGatewayErrors:
-                                    default: 0
                                     description: ConsecutiveGatewayErrors sets the
                                       number of consecutive gateway errors triggering
                                       ejection.