Repository: envoyproxy/gateway

Issue:
BackendTrafficPolicy openapi schemas do not validate correctly
*Description*:
I'm trying to use kubeconform to validate BackendTrafficPolicy

I get this error:

```
stdin - BackendTrafficPolicy my-policy is invalid: problem validating schema. Check JSON formatting: jsonschema: '/spec/healthCheck/active/interval' does not validate with https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/gateway.envoyproxy.io/backendtrafficpolicy_v1alpha1.json#/properties/spec/properties/healthCheck/properties/active/properties/interval/format: '3s' is not valid 'duration'
stdin - BackendTrafficPolicy my-policy is invalid: problem validating schema. Check JSON formatting: jsonschema: '/spec/healthCheck/active/timeout' does not validate with https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/gateway.envoyproxy.io/backendtrafficpolicy_v1alpha1.json#/properties/spec/properties/healthCheck/properties/active/properties/timeout/format: '20ms' is not valid 'duration'
```

*Additional info*:
I think the openapi schemas that we're generating are wrong. Particularly this line:

https://github.com/envoyproxy/gateway/blob/6c6633c2a8bfc772415ea3bf68e14ef20064cb22/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml#L314

They say that `timeout` and `interval` are openapi durations. But they're not, they're a Kubernetes-specific duration format.


Discussion:
@arkodg: thanks for raising this, do we need to edit these to `string` instead ?
The CEL validation on the `metav1.Duration` should still kick in and allow acceptable values
https://github.com/envoyproxy/gateway/blob/6c6633c2a8bfc772415ea3bf68e14ef20064cb22/api/v1alpha1/healthcheck_types.go#L81@nicks: ya, i poked around at how Cluster API is doing it, and i think they just leave the `kubebuilder` validation off entirely?
https://github.com/kubernetes-sigs/cluster-api/blob/781d1e4c39286d3d1e93c71557b5d02c2e78961b/api/v1beta1/machinehealthcheck_types.go#L101

and it will do the right thing with the existing `metav1.Duration` type?@arkodg: ok I see an issue

we ended up using `metav1.Duration` in this API but we really should have used https://github.com/kubernetes-sigs/gateway-api/blob/962b35ea3c71ae604e0db696780c76a86b58ee17/apis/v1/shared_types.go#L765
which is used everywhere else in the project https://github.com/envoyproxy/gateway/blob/6c6633c2a8bfc772415ea3bf68e14ef20064cb22/api/v1alpha1/keepalive_types.go#L26

this has a CEL validation e.g.
https://github.com/envoyproxy/gateway/blob/6c6633c2a8bfc772415ea3bf68e14ef20064cb22/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml#L1305
, and doesnt require a kubebuilder validation

this is a breaking change, because we are tightening the validation, not loosening it

https://github.com/kubernetes/apimachinery/blob/96b97de8d6ba49bc192968551f2120ef3881f42d/pkg/apis/meta/v1/duration.go#L27

cc @envoyproxy/gateway-maintainers @arkodg: thanks for helping us find this @nicks 

we'll also need to add an entry in https://github.com/envoyproxy/gateway/blob/6c6633c2a8bfc772415ea3bf68e14ef20064cb22/tools/linter/golangci-lint/.golangci.yml#L34 to make sure this doesnt happen again@github-actions: This issue has been automatically marked as stale because it has not had activity in the last 30 days.@github-actions: This issue has been automatically marked as stale because it has not had activity in the last 30 days.@Ninir: Also faced this today for `retry.perRetry.timeout` on BackendTrafficPolicy. The duration having to be RFC3339-compliant (i.e PT60S) is not interpreted by the underlying engine, so kubeconform fails.

@arkodg As a newcomer to the Envoy Gateway world, is that something we can fix as a community? I'd love to give this a shot!@arkodg: @Ninir there's WIP PR https://github.com/envoyproxy/gateway/pull/4931 that I dropped the ball on, will pick up and make sure it gets into v1.4@arkodg: hey @Ninir would you interested in taking #4931 forward ?@Ninir: Sure! Is it about finishing the current work as in going through the last batch of files, or is there something else that would be required?
Happy to chat about it and make it cross the finish line! 🥰@arkodg: yeah @Ninir, its around making sure all API fields use `gwapiv1.Duration` instead of `metav1.Duration` . This will need to impacting three layers - `gateway-api` which reads the API field, the IR which is an intermediate representation and the `ids-translator` which set the IR values in the xds resources, tia 🙏 @github-actions: This issue has been automatically marked as stale because it has not had activity in the last 30 days.

Solution patch:
diff --git a/api/v1alpha1/cors_types.go b/api/v1alpha1/cors_types.go
index 26c87bd8a..c3d206751 100644
--- a/api/v1alpha1/cors_types.go
+++ b/api/v1alpha1/cors_types.go
@@ -5,7 +5,7 @@
 
 package v1alpha1
 
-import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+import gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 
 // Origin is defined by the scheme (protocol), hostname (domain), and port of
 // the URL used to access it. The hostname can be "precise" which is just the
@@ -61,7 +61,7 @@ type CORS struct {
 	// It specifies the value in the Access-Control-Max-Age CORS response header..
 	//
 	// +optional
-	MaxAge *metav1.Duration `json:"maxAge,omitempty"`
+	MaxAge *gwapiv1.Duration `json:"maxAge,omitempty"`
 
 	// AllowCredentials indicates whether a request can include user credentials
 	// like cookies, authentication headers, or TLS client certificates.
diff --git a/api/v1alpha1/dns_types.go b/api/v1alpha1/dns_types.go
index ed99a6ca0..2dbfd272e 100644
--- a/api/v1alpha1/dns_types.go
+++ b/api/v1alpha1/dns_types.go
@@ -5,7 +5,7 @@
 
 package v1alpha1
 
-import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+import gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 
 // DNSLookupFamily defines the behavior of Envoy when resolving DNS for hostnames
 // +enum
@@ -31,10 +31,14 @@ const (
 type DNS struct {
 	// DNSRefreshRate specifies the rate at which DNS records should be refreshed.
 	// Defaults to 30 seconds.
-	DNSRefreshRate *metav1.Duration `json:"dnsRefreshRate,omitempty"`
+	//
+	// +optional
+	DNSRefreshRate *gwapiv1.Duration `json:"dnsRefreshRate,omitempty"`
 	// RespectDNSTTL indicates whether the DNS Time-To-Live (TTL) should be respected.
 	// If the value is set to true, the DNS refresh rate will be set to the resource record’s TTL.
 	// Defaults to true.
+	//
+	// +optional
 	RespectDNSTTL *bool `json:"respectDnsTtl,omitempty"`
 	// LookupFamily determines how Envoy would resolve DNS for Routes where the backend is specified as a fully qualified domain name (FQDN).
 	// If set, this configuration overrides other defaults.
diff --git a/api/v1alpha1/envoygateway_types.go b/api/v1alpha1/envoygateway_types.go
index 022877315..a59a35658 100644
--- a/api/v1alpha1/envoygateway_types.go
+++ b/api/v1alpha1/envoygateway_types.go
@@ -143,13 +143,21 @@ type KubernetesClientRateLimit struct {
 // LeaderElection defines the desired leader election settings.
 type LeaderElection struct {
 	// LeaseDuration defines the time non-leader contenders will wait before attempting to claim leadership.
-	// It's based on the timestamp of the last acknowledged signal. The default setting is 15 seconds.
+	// It's based on the timestamp of the last acknowledged signal.
+	// The default setting is 15 seconds.
+	//
+	// +optional
 	LeaseDuration *gwapiv1.Duration `json:"leaseDuration,omitempty"`
 	// RenewDeadline represents the time frame within which the current leader will attempt to renew its leadership
-	// status before relinquishing its position. The default setting is 10 seconds.
+	// status before relinquishing its position.
+	// The default setting is 10 seconds.
+	//
+	// +optional
 	RenewDeadline *gwapiv1.Duration `json:"renewDeadline,omitempty"`
 	// RetryPeriod denotes the interval at which LeaderElector clients should perform action retries.
 	// The default setting is 2 seconds.
+	//
+	// +optional
 	RetryPeriod *gwapiv1.Duration `json:"retryPeriod,omitempty"`
 	// Disable provides the option to turn off leader election, which is enabled by default.
 	Disable *bool `json:"disable,omitempty"`
@@ -435,9 +443,9 @@ type RateLimit struct {
 
 	// Timeout specifies the timeout period for the proxy to access the ratelimit server
 	// If not set, timeout is 20ms.
+	//
 	// +optional
-	// +kubebuilder:validation:Format=duration
-	Timeout *metav1.Duration `json:"timeout,omitempty"`
+	Timeout *gwapiv1.Duration `json:"timeout,omitempty"`
 
 	// FailClosed is a switch used to control the flow of traffic
 	// when the response from the ratelimit server cannot be obtained.
diff --git a/api/v1alpha1/envoyproxy_types.go b/api/v1alpha1/envoyproxy_types.go
index af0c73702..8eeabc642 100644
--- a/api/v1alpha1/envoyproxy_types.go
+++ b/api/v1alpha1/envoyproxy_types.go
@@ -350,12 +350,12 @@ type ShutdownConfig struct {
 	// If unspecified, defaults to 60 seconds.
 	//
 	// +optional
-	DrainTimeout *metav1.Duration `json:"drainTimeout,omitempty"`
+	DrainTimeout *gwapiv1.Duration `json:"drainTimeout,omitempty"`
 	// MinDrainDuration defines the minimum drain duration allowing time for endpoint deprogramming to complete.
 	// If unspecified, defaults to 10 seconds.
 	//
 	// +optional
-	MinDrainDuration *metav1.Duration `json:"minDrainDuration,omitempty"`
+	MinDrainDuration *gwapiv1.Duration `json:"minDrainDuration,omitempty"`
 }
 
 // +kubebuilder:validation:XValidation:rule="((has(self.envoyDeployment) && !has(self.envoyDaemonSet)) || (!has(self.envoyDeployment) && has(self.envoyDaemonSet))) || (!has(self.envoyDeployment) && !has(self.envoyDaemonSet))",message="only one of envoyDeployment or envoyDaemonSet can be specified"
diff --git a/api/v1alpha1/fault_injection.go b/api/v1alpha1/fault_injection.go
index a8b7e1f54..eab92714c 100644
--- a/api/v1alpha1/fault_injection.go
+++ b/api/v1alpha1/fault_injection.go
@@ -5,7 +5,7 @@
 
 package v1alpha1
 
-import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+import gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 
 // FaultInjection defines the fault injection policy to be applied. This configuration can be used to
 // inject delays and abort requests to mimic failure scenarios such as service failures and overloads
@@ -29,7 +29,7 @@ type FaultInjectionDelay struct {
 	// FixedDelay specifies the fixed delay duration
 	//
 	// +required
-	FixedDelay *metav1.Duration `json:"fixedDelay"`
+	FixedDelay *gwapiv1.Duration `json:"fixedDelay"`
 
 	// Percentage specifies the percentage of requests to be delayed. Default 100%, if set 0, no requests will be delayed. Accuracy to 0.0001%.
 	// +optional
diff --git a/api/v1alpha1/healthcheck_types.go b/api/v1alpha1/healthcheck_types.go
index 772e78166..d0893e7cf 100644
--- a/api/v1alpha1/healthcheck_types.go
+++ b/api/v1alpha1/healthcheck_types.go
@@ -5,10 +5,7 @@
 
 package v1alpha1
 
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
-)
+import gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 
 // HealthCheck configuration to decide which endpoints
 // are healthy and can be used for routing.
@@ -42,10 +39,9 @@ type PassiveHealthCheck struct {
 
 	// Interval defines the time between passive health checks.
 	//
-	// +kubebuilder:validation:Format=duration
 	// +kubebuilder:default="3s"
 	// +optional
-	Interval *metav1.Duration `json:"interval,omitempty"`
+	Interval *gwapiv1.Duration `json:"interval,omitempty"`
 
 	// ConsecutiveLocalOriginFailures sets the number of consecutive local origin failures triggering ejection.
 	// Parameter takes effect only when split_external_local_origin_errors is set to true.
@@ -68,10 +64,9 @@ type PassiveHealthCheck struct {
 
 	// BaseEjectionTime defines the base duration for which a host will be ejected on consecutive failures.
 	//
-	// +kubebuilder:validation:Format=duration
 	// +kubebuilder:default="30s"
 	// +optional
-	BaseEjectionTime *metav1.Duration `json:"baseEjectionTime,omitempty"`
+	BaseEjectionTime *gwapiv1.Duration `json:"baseEjectionTime,omitempty"`
 
 	// MaxEjectionPercent sets the maximum percentage of hosts in a cluster that can be ejected.
 	//
@@ -90,22 +85,19 @@ type PassiveHealthCheck struct {
 type ActiveHealthCheck struct {
 	// Timeout defines the time to wait for a health check response.
 	//
-	// +kubebuilder:validation:Format=duration
 	// +kubebuilder:default="1s"
 	// +optional
-	Timeout *metav1.Duration `json:"timeout"`
+	Timeout *gwapiv1.Duration `json:"timeout"`
 
 	// Interval defines the time between active health checks.
 	//
-	// +kubebuilder:validation:Format=duration
 	// +kubebuilder:default="3s"
 	// +optional
-	Interval *metav1.Duration `json:"interval"`
+	Interval *gwapiv1.Duration `json:"interval"`
 
 	// InitialJitter defines the maximum time Envoy will wait before the first health check.
 	// Envoy will randomly select a value between 0 and the initial jitter value.
 	//
-	// +kubebuilder:validation:Format=duration
 	// +optional
 	InitialJitter *gwapiv1.Duration `json:"initialJitter,omitempty"`
 
diff --git a/api/v1alpha1/loadbalancer_types.go b/api/v1alpha1/loadbalancer_types.go
index f88a3cc19..2b177d49d 100644
--- a/api/v1alpha1/loadbalancer_types.go
+++ b/api/v1alpha1/loadbalancer_types.go
@@ -5,7 +5,7 @@
 
 package v1alpha1
 
-import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+import gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 
 // LoadBalancer defines the load balancer policy to be applied.
 // +union
@@ -119,7 +119,7 @@ type Cookie struct {
 	// Max-Age attribute value.
 	//
 	// +optional
-	TTL *metav1.Duration `json:"ttl,omitempty"`
+	TTL *gwapiv1.Duration `json:"ttl,omitempty"`
 	// Additional Attributes to set for the generated cookie.
 	//
 	// +optional
@@ -146,7 +146,7 @@ type SlowStart struct {
 	// Currently only supports linear growth of traffic. For additional details,
 	// see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
 	// +kubebuilder:validation:Required
-	Window *metav1.Duration `json:"window"`
+	Window *gwapiv1.Duration `json:"window"`
 	// TODO: Add support for non-linear traffic increases based on user usage.
 }
 
diff --git a/api/v1alpha1/oidc_types.go b/api/v1alpha1/oidc_types.go
index 64ec47b1d..cd3e4b72d 100644
--- a/api/v1alpha1/oidc_types.go
+++ b/api/v1alpha1/oidc_types.go
@@ -6,7 +6,6 @@
 package v1alpha1
 
 import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 )
 
@@ -110,7 +109,7 @@ type OIDC struct {
 	// OAuth flow will fail.
 	//
 	// +optional
-	DefaultTokenTTL *metav1.Duration `json:"defaultTokenTTL,omitempty"`
+	DefaultTokenTTL *gwapiv1.Duration `json:"defaultTokenTTL,omitempty"`
 
 	// RefreshToken indicates whether the Envoy should automatically refresh the
 	// id token and access token when they expire.
@@ -127,8 +126,9 @@ type OIDC struct {
 	//
 	// If not specified, defaults to 604800s (one week).
 	// Note: this field is only applicable when the "refreshToken" field is set to true.
+	//
 	// +optional
-	DefaultRefreshTokenTTL *metav1.Duration `json:"defaultRefreshTokenTTL,omitempty"`
+	DefaultRefreshTokenTTL *gwapiv1.Duration `json:"defaultRefreshTokenTTL,omitempty"`
 
 	// Skips OIDC authentication when the request contains a header that will be extracted by the JWT filter. Unless
 	// explicitly stated otherwise in the extractFrom field, this will be the "Authorization: Bearer ..." header.
diff --git a/api/v1alpha1/retry_types.go b/api/v1alpha1/retry_types.go
index d5f3eb24d..17439c7fa 100644
--- a/api/v1alpha1/retry_types.go
+++ b/api/v1alpha1/retry_types.go
@@ -6,7 +6,7 @@
 package v1alpha1
 
 import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 )
 
 // Retry defines the retry strategy to be applied.
@@ -96,8 +96,7 @@ type PerRetryPolicy struct {
 	// Timeout is the timeout per retry attempt.
 	//
 	// +optional
-	// +kubebuilder:validation:Format=duration
-	Timeout *metav1.Duration `json:"timeout,omitempty"`
+	Timeout *gwapiv1.Duration `json:"timeout,omitempty"`
 	// Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
 	// back-off algorithm for retries. For additional details,
 	// see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
@@ -109,13 +108,12 @@ type PerRetryPolicy struct {
 type BackOffPolicy struct {
 	// BaseInterval is the base interval between retries.
 	//
-	// +kubebuilder:validation:Format=duration
-	BaseInterval *metav1.Duration `json:"baseInterval,omitempty"`
+	// +optional
+	BaseInterval *gwapiv1.Duration `json:"baseInterval,omitempty"`
 	// MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
 	// The default is 10 times the base_interval
 	//
 	// +optional
-	// +kubebuilder:validation:Format=duration
-	MaxInterval *metav1.Duration `json:"maxInterval,omitempty"`
+	MaxInterval *gwapiv1.Duration `json:"maxInterval,omitempty"`
 	// we can add rate limited based backoff config here if we want to.
 }
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index e87c123b4..cdbb72f62 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -126,12 +126,12 @@ func (in *ActiveHealthCheck) DeepCopyInto(out *ActiveHealthCheck) {
 	*out = *in
 	if in.Timeout != nil {
 		in, out := &in.Timeout, &out.Timeout
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 	if in.Interval != nil {
 		in, out := &in.Interval, &out.Interval
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 	if in.InitialJitter != nil {
@@ -279,12 +279,12 @@ func (in *BackOffPolicy) DeepCopyInto(out *BackOffPolicy) {
 	*out = *in
 	if in.BaseInterval != nil {
 		in, out := &in.BaseInterval, &out.BaseInterval
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 	if in.MaxInterval != nil {
 		in, out := &in.MaxInterval, &out.MaxInterval
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 }
@@ -826,7 +826,7 @@ func (in *CORS) DeepCopyInto(out *CORS) {
 	}
 	if in.MaxAge != nil {
 		in, out := &in.MaxAge, &out.MaxAge
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 	if in.AllowCredentials != nil {
@@ -1379,7 +1379,7 @@ func (in *Cookie) DeepCopyInto(out *Cookie) {
 	*out = *in
 	if in.TTL != nil {
 		in, out := &in.TTL, &out.TTL
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 	if in.Attributes != nil {
@@ -1578,7 +1578,7 @@ func (in *DNS) DeepCopyInto(out *DNS) {
 	*out = *in
 	if in.DNSRefreshRate != nil {
 		in, out := &in.DNSRefreshRate, &out.DNSRefreshRate
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 	if in.RespectDNSTTL != nil {
@@ -2934,7 +2934,7 @@ func (in *FaultInjectionDelay) DeepCopyInto(out *FaultInjectionDelay) {
 	*out = *in
 	if in.FixedDelay != nil {
 		in, out := &in.FixedDelay, &out.FixedDelay
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 	if in.Percentage != nil {
@@ -4753,7 +4753,7 @@ func (in *OIDC) DeepCopyInto(out *OIDC) {
 	}
 	if in.DefaultTokenTTL != nil {
 		in, out := &in.DefaultTokenTTL, &out.DefaultTokenTTL
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 	if in.RefreshToken != nil {
@@ -4763,7 +4763,7 @@ func (in *OIDC) DeepCopyInto(out *OIDC) {
 	}
 	if in.DefaultRefreshTokenTTL != nil {
 		in, out := &in.DefaultRefreshTokenTTL, &out.DefaultRefreshTokenTTL
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 	if in.PassThroughAuthHeader != nil {
@@ -4971,7 +4971,7 @@ func (in *PassiveHealthCheck) DeepCopyInto(out *PassiveHealthCheck) {
 	}
 	if in.Interval != nil {
 		in, out := &in.Interval, &out.Interval
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 	if in.ConsecutiveLocalOriginFailures != nil {
@@ -4991,7 +4991,7 @@ func (in *PassiveHealthCheck) DeepCopyInto(out *PassiveHealthCheck) {
 	}
 	if in.BaseEjectionTime != nil {
 		in, out := &in.BaseEjectionTime, &out.BaseEjectionTime
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 	if in.MaxEjectionPercent != nil {
@@ -5061,7 +5061,7 @@ func (in *PerRetryPolicy) DeepCopyInto(out *PerRetryPolicy) {
 	*out = *in
 	if in.Timeout != nil {
 		in, out := &in.Timeout, &out.Timeout
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 	if in.BackOff != nil {
@@ -5611,7 +5611,7 @@ func (in *RateLimit) DeepCopyInto(out *RateLimit) {
 	in.Backend.DeepCopyInto(&out.Backend)
 	if in.Timeout != nil {
 		in, out := &in.Timeout, &out.Timeout
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 	if in.Telemetry != nil {
@@ -6339,12 +6339,12 @@ func (in *ShutdownConfig) DeepCopyInto(out *ShutdownConfig) {
 	*out = *in
 	if in.DrainTimeout != nil {
 		in, out := &in.DrainTimeout, &out.DrainTimeout
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 	if in.MinDrainDuration != nil {
 		in, out := &in.MinDrainDuration, &out.MinDrainDuration
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 }
@@ -6384,7 +6384,7 @@ func (in *SlowStart) DeepCopyInto(out *SlowStart) {
 	*out = *in
 	if in.Window != nil {
 		in, out := &in.Window, &out.Window
-		*out = new(metav1.Duration)
+		*out = new(v1.Duration)
 		**out = **in
 	}
 }
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
index 4be80d9bc..2e7ce17d4 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
@@ -177,6 +177,7 @@ spec:
                     description: |-
                       DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                       Defaults to 30 seconds.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   lookupFamily:
                     description: |-
@@ -235,6 +236,7 @@ spec:
                     properties:
                       fixedDelay:
                         description: FixedDelay specifies the fixed delay duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       percentage:
                         default: 100
@@ -349,14 +351,13 @@ spec:
                         description: |-
                           InitialJitter defines the maximum time Envoy will wait before the first health check.
                           Envoy will randomly select a value between 0 and the initial jitter value.
-                        format: duration
                         pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       interval:
                         default: 3s
                         description: Interval defines the time between active health
                           checks.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       tcp:
                         description: |-
@@ -430,7 +431,7 @@ spec:
                         default: 1s
                         description: Timeout defines the time to wait for a health
                           check response.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       type:
                         allOf:
@@ -481,7 +482,7 @@ spec:
                         default: 30s
                         description: BaseEjectionTime defines the base duration for
                           which a host will be ejected on consecutive failures.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       consecutive5XxErrors:
                         default: 5
@@ -506,7 +507,7 @@ spec:
                         default: 3s
                         description: Interval defines the time between passive health
                           checks.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       maxEjectionPercent:
                         default: 10
@@ -625,6 +626,7 @@ spec:
                             description: |-
                               TTL of the generated cookie if the cookie is not present. This value sets the
                               Max-Age attribute value.
+                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                             type: string
                         required:
                         - name
@@ -708,6 +710,7 @@ spec:
                           During slow start window, traffic sent to the newly added hosts will gradually increase.
                           Currently only supports linear growth of traffic. For additional details,
                           see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                     required:
                     - window
@@ -1643,18 +1646,18 @@ spec:
                           baseInterval:
                             description: BaseInterval is the base interval between
                               retries.
-                            format: duration
+                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                             type: string
                           maxInterval:
                             description: |-
                               MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                               The default is 10 times the base_interval
-                            format: duration
+                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                             type: string
                         type: object
                       timeout:
                         description: Timeout is the timeout per retry attempt.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                     type: object
                   retryOn:
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
index 73556e46e..cfb084ddc 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -324,6 +324,7 @@ spec:
                               description: |-
                                 DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                 Defaults to 30 seconds.
+                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                               type: string
                             lookupFamily:
                               description: |-
@@ -447,14 +448,13 @@ spec:
                                   description: |-
                                     InitialJitter defines the maximum time Envoy will wait before the first health check.
                                     Envoy will randomly select a value between 0 and the initial jitter value.
-                                  format: duration
                                   pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 interval:
                                   default: 3s
                                   description: Interval defines the time between active
                                     health checks.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 tcp:
                                   description: |-
@@ -533,7 +533,7 @@ spec:
                                   default: 1s
                                   description: Timeout defines the time to wait for
                                     a health check response.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 type:
                                   allOf:
@@ -586,7 +586,7 @@ spec:
                                   description: BaseEjectionTime defines the base duration
                                     for which a host will be ejected on consecutive
                                     failures.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 consecutive5XxErrors:
                                   default: 5
@@ -611,7 +611,7 @@ spec:
                                   default: 3s
                                   description: Interval defines the time between passive
                                     health checks.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 maxEjectionPercent:
                                   default: 10
@@ -701,6 +701,7 @@ spec:
                                       description: |-
                                         TTL of the generated cookie if the cookie is not present. This value sets the
                                         Max-Age attribute value.
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                   required:
                                   - name
@@ -787,6 +788,7 @@ spec:
                                     During slow start window, traffic sent to the newly added hosts will gradually increase.
                                     Currently only supports linear growth of traffic. For additional details,
                                     see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                               required:
                               - window
@@ -899,18 +901,18 @@ spec:
                                     baseInterval:
                                       description: BaseInterval is the base interval
                                         between retries.
-                                      format: duration
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                     maxInterval:
                                       description: |-
                                         MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                         The default is 10 times the base_interval
-                                      format: duration
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                   type: object
                                 timeout:
                                   description: Timeout is the timeout per retry attempt.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                               type: object
                             retryOn:
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
index bca62d14d..004ea44c9 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -10516,11 +10516,13 @@ spec:
                     description: |-
                       DrainTimeout defines the graceful drain timeout. This should be less than the pod's terminationGracePeriodSeconds.
                       If unspecified, defaults to 60 seconds.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   minDrainDuration:
                     description: |-
                       MinDrainDuration defines the minimum drain duration allowing time for endpoint deprogramming to complete.
                       If unspecified, defaults to 10 seconds.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                 type: object
               telemetry:
@@ -10874,6 +10876,7 @@ spec:
                                                 description: |-
                                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                                   Defaults to 30 seconds.
+                                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                 type: string
                                               lookupFamily:
                                                 description: |-
@@ -11007,7 +11010,6 @@ spec:
                                                     description: |-
                                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                                    format: duration
                                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   interval:
@@ -11015,7 +11017,7 @@ spec:
                                                     description: Interval defines
                                                       the time between active health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   tcp:
                                                     description: |-
@@ -11104,7 +11106,7 @@ spec:
                                                     description: Timeout defines the
                                                       time to wait for a health check
                                                       response.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   type:
                                                     allOf:
@@ -11167,7 +11169,7 @@ spec:
                                                       defines the base duration for
                                                       which a host will be ejected
                                                       on consecutive failures.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   consecutive5XxErrors:
                                                     default: 5
@@ -11195,7 +11197,7 @@ spec:
                                                     description: Interval defines
                                                       the time between passive health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   maxEjectionPercent:
                                                     default: 10
@@ -11290,6 +11292,7 @@ spec:
                                                         description: |-
                                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                                           Max-Age attribute value.
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     required:
                                                     - name
@@ -11384,6 +11387,7 @@ spec:
                                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                                       Currently only supports linear growth of traffic. For additional details,
                                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 required:
                                                 - window
@@ -11505,19 +11509,19 @@ spec:
                                                         description: BaseInterval
                                                           is the base interval between
                                                           retries.
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                       maxInterval:
                                                         description: |-
                                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                           The default is 10 times the base_interval
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     type: object
                                                   timeout:
                                                     description: Timeout is the timeout
                                                       per retry attempt.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 type: object
                                               retryOn:
@@ -11985,6 +11989,7 @@ spec:
                                                 description: |-
                                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                                   Defaults to 30 seconds.
+                                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                 type: string
                                               lookupFamily:
                                                 description: |-
@@ -12118,7 +12123,6 @@ spec:
                                                     description: |-
                                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                                    format: duration
                                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   interval:
@@ -12126,7 +12130,7 @@ spec:
                                                     description: Interval defines
                                                       the time between active health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   tcp:
                                                     description: |-
@@ -12215,7 +12219,7 @@ spec:
                                                     description: Timeout defines the
                                                       time to wait for a health check
                                                       response.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   type:
                                                     allOf:
@@ -12278,7 +12282,7 @@ spec:
                                                       defines the base duration for
                                                       which a host will be ejected
                                                       on consecutive failures.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   consecutive5XxErrors:
                                                     default: 5
@@ -12306,7 +12310,7 @@ spec:
                                                     description: Interval defines
                                                       the time between passive health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   maxEjectionPercent:
                                                     default: 10
@@ -12401,6 +12405,7 @@ spec:
                                                         description: |-
                                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                                           Max-Age attribute value.
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     required:
                                                     - name
@@ -12495,6 +12500,7 @@ spec:
                                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                                       Currently only supports linear growth of traffic. For additional details,
                                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 required:
                                                 - window
@@ -12616,19 +12622,19 @@ spec:
                                                         description: BaseInterval
                                                           is the base interval between
                                                           retries.
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                       maxInterval:
                                                         description: |-
                                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                           The default is 10 times the base_interval
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     type: object
                                                   timeout:
                                                     description: Timeout is the timeout
                                                       per retry attempt.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 type: object
                                               retryOn:
@@ -13204,6 +13210,7 @@ spec:
                                           description: |-
                                             DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                             Defaults to 30 seconds.
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         lookupFamily:
                                           description: |-
@@ -13332,14 +13339,13 @@ spec:
                                               description: |-
                                                 InitialJitter defines the maximum time Envoy will wait before the first health check.
                                                 Envoy will randomly select a value between 0 and the initial jitter value.
-                                              format: duration
                                               pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             interval:
                                               default: 3s
                                               description: Interval defines the time
                                                 between active health checks.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             tcp:
                                               description: |-
@@ -13423,7 +13429,7 @@ spec:
                                               default: 1s
                                               description: Timeout defines the time
                                                 to wait for a health check response.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             type:
                                               allOf:
@@ -13481,7 +13487,7 @@ spec:
                                               description: BaseEjectionTime defines
                                                 the base duration for which a host
                                                 will be ejected on consecutive failures.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             consecutive5XxErrors:
                                               default: 5
@@ -13508,7 +13514,7 @@ spec:
                                               default: 3s
                                               description: Interval defines the time
                                                 between passive health checks.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             maxEjectionPercent:
                                               default: 10
@@ -13600,6 +13606,7 @@ spec:
                                                   description: |-
                                                     TTL of the generated cookie if the cookie is not present. This value sets the
                                                     Max-Age attribute value.
+                                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                   type: string
                                               required:
                                               - name
@@ -13690,6 +13697,7 @@ spec:
                                                 During slow start window, traffic sent to the newly added hosts will gradually increase.
                                                 Currently only supports linear growth of traffic. For additional details,
                                                 see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           required:
                                           - window
@@ -13806,19 +13814,19 @@ spec:
                                                 baseInterval:
                                                   description: BaseInterval is the
                                                     base interval between retries.
-                                                  format: duration
+                                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                   type: string
                                                 maxInterval:
                                                   description: |-
                                                     MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                     The default is 10 times the base_interval
-                                                  format: duration
+                                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                   type: string
                                               type: object
                                             timeout:
                                               description: Timeout is the timeout
                                                 per retry attempt.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           type: object
                                         retryOn:
@@ -14320,6 +14328,7 @@ spec:
                                     description: |-
                                       DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                       Defaults to 30 seconds.
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   lookupFamily:
                                     description: |-
@@ -14447,14 +14456,13 @@ spec:
                                         description: |-
                                           InitialJitter defines the maximum time Envoy will wait before the first health check.
                                           Envoy will randomly select a value between 0 and the initial jitter value.
-                                        format: duration
                                         pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       interval:
                                         default: 3s
                                         description: Interval defines the time between
                                           active health checks.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       tcp:
                                         description: |-
@@ -14538,7 +14546,7 @@ spec:
                                         default: 1s
                                         description: Timeout defines the time to wait
                                           for a health check response.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       type:
                                         allOf:
@@ -14595,7 +14603,7 @@ spec:
                                         description: BaseEjectionTime defines the
                                           base duration for which a host will be ejected
                                           on consecutive failures.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       consecutive5XxErrors:
                                         default: 5
@@ -14622,7 +14630,7 @@ spec:
                                         default: 3s
                                         description: Interval defines the time between
                                           passive health checks.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxEjectionPercent:
                                         default: 10
@@ -14714,6 +14722,7 @@ spec:
                                             description: |-
                                               TTL of the generated cookie if the cookie is not present. This value sets the
                                               Max-Age attribute value.
+                                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                             type: string
                                         required:
                                         - name
@@ -14803,6 +14812,7 @@ spec:
                                           During slow start window, traffic sent to the newly added hosts will gradually increase.
                                           Currently only supports linear growth of traffic. For additional details,
                                           see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - window
@@ -14917,19 +14927,19 @@ spec:
                                           baseInterval:
                                             description: BaseInterval is the base
                                               interval between retries.
-                                            format: duration
+                                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                             type: string
                                           maxInterval:
                                             description: |-
                                               MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                               The default is 10 times the base_interval
-                                            format: duration
+                                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                             type: string
                                         type: object
                                       timeout:
                                         description: Timeout is the timeout per retry
                                           attempt.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   retryOn:
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
index 79af9ce40..9a5373497 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -522,6 +522,7 @@ spec:
                     description: |-
                       MaxAge defines how long the results of a preflight request can be cached.
                       It specifies the value in the Access-Control-Max-Age CORS response header..
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                 type: object
               extAuth:
@@ -828,6 +829,7 @@ spec:
                                 description: |-
                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                   Defaults to 30 seconds.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                 type: string
                               lookupFamily:
                                 description: |-
@@ -951,14 +953,13 @@ spec:
                                     description: |-
                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                    format: duration
                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
                                       active health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   tcp:
                                     description: |-
@@ -1037,7 +1038,7 @@ spec:
                                     default: 1s
                                     description: Timeout defines the time to wait
                                       for a health check response.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   type:
                                     allOf:
@@ -1092,7 +1093,7 @@ spec:
                                     description: BaseEjectionTime defines the base
                                       duration for which a host will be ejected on
                                       consecutive failures.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   consecutive5XxErrors:
                                     default: 5
@@ -1118,7 +1119,7 @@ spec:
                                     default: 3s
                                     description: Interval defines the time between
                                       passive health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   maxEjectionPercent:
                                     default: 10
@@ -1210,6 +1211,7 @@ spec:
                                         description: |-
                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                           Max-Age attribute value.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - name
@@ -1297,6 +1299,7 @@ spec:
                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                       Currently only supports linear growth of traffic. For additional details,
                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 required:
                                 - window
@@ -1411,19 +1414,19 @@ spec:
                                       baseInterval:
                                         description: BaseInterval is the base interval
                                           between retries.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxInterval:
                                         description: |-
                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                           The default is 10 times the base_interval
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   timeout:
                                     description: Timeout is the timeout per retry
                                       attempt.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 type: object
                               retryOn:
@@ -1835,6 +1838,7 @@ spec:
                                 description: |-
                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                   Defaults to 30 seconds.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                 type: string
                               lookupFamily:
                                 description: |-
@@ -1958,14 +1962,13 @@ spec:
                                     description: |-
                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                    format: duration
                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
                                       active health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   tcp:
                                     description: |-
@@ -2044,7 +2047,7 @@ spec:
                                     default: 1s
                                     description: Timeout defines the time to wait
                                       for a health check response.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   type:
                                     allOf:
@@ -2099,7 +2102,7 @@ spec:
                                     description: BaseEjectionTime defines the base
                                       duration for which a host will be ejected on
                                       consecutive failures.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   consecutive5XxErrors:
                                     default: 5
@@ -2125,7 +2128,7 @@ spec:
                                     default: 3s
                                     description: Interval defines the time between
                                       passive health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   maxEjectionPercent:
                                     default: 10
@@ -2217,6 +2220,7 @@ spec:
                                         description: |-
                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                           Max-Age attribute value.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - name
@@ -2304,6 +2308,7 @@ spec:
                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                       Currently only supports linear growth of traffic. For additional details,
                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 required:
                                 - window
@@ -2418,19 +2423,19 @@ spec:
                                       baseInterval:
                                         description: BaseInterval is the base interval
                                           between retries.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxInterval:
                                         description: |-
                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                           The default is 10 times the base_interval
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   timeout:
                                     description: Timeout is the timeout per retry
                                       attempt.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 type: object
                               retryOn:
@@ -3034,6 +3039,7 @@ spec:
                                       description: |-
                                         DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                         Defaults to 30 seconds.
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                     lookupFamily:
                                       description: |-
@@ -3161,14 +3167,13 @@ spec:
                                           description: |-
                                             InitialJitter defines the maximum time Envoy will wait before the first health check.
                                             Envoy will randomly select a value between 0 and the initial jitter value.
-                                          format: duration
                                           pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         interval:
                                           default: 3s
                                           description: Interval defines the time between
                                             active health checks.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         tcp:
                                           description: |-
@@ -3252,7 +3257,7 @@ spec:
                                           default: 1s
                                           description: Timeout defines the time to
                                             wait for a health check response.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         type:
                                           allOf:
@@ -3310,7 +3315,7 @@ spec:
                                           description: BaseEjectionTime defines the
                                             base duration for which a host will be
                                             ejected on consecutive failures.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         consecutive5XxErrors:
                                           default: 5
@@ -3337,7 +3342,7 @@ spec:
                                           default: 3s
                                           description: Interval defines the time between
                                             passive health checks.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         maxEjectionPercent:
                                           default: 10
@@ -3429,6 +3434,7 @@ spec:
                                               description: |-
                                                 TTL of the generated cookie if the cookie is not present. This value sets the
                                                 Max-Age attribute value.
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           required:
                                           - name
@@ -3518,6 +3524,7 @@ spec:
                                             During slow start window, traffic sent to the newly added hosts will gradually increase.
                                             Currently only supports linear growth of traffic. For additional details,
                                             see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                       required:
                                       - window
@@ -3633,19 +3640,19 @@ spec:
                                             baseInterval:
                                               description: BaseInterval is the base
                                                 interval between retries.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             maxInterval:
                                               description: |-
                                                 MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                 The default is 10 times the base_interval
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           type: object
                                         timeout:
                                           description: Timeout is the timeout per
                                             retry attempt.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                       type: object
                                     retryOn:
@@ -3944,6 +3951,7 @@ spec:
 
                       If not specified, defaults to 604800s (one week).
                       Note: this field is only applicable when the "refreshToken" field is set to true.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   defaultTokenTTL:
                     description: |-
@@ -3955,6 +3963,7 @@ spec:
                       If not specified, defaults to 0. In this case, the "expires_in" field in
                       the authorization response must be set by the authorization server, or the
                       OAuth flow will fail.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   denyRedirect:
                     description: |-
@@ -4297,6 +4306,7 @@ spec:
                                 description: |-
                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                   Defaults to 30 seconds.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                 type: string
                               lookupFamily:
                                 description: |-
@@ -4420,14 +4430,13 @@ spec:
                                     description: |-
                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                    format: duration
                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
                                       active health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   tcp:
                                     description: |-
@@ -4506,7 +4515,7 @@ spec:
                                     default: 1s
                                     description: Timeout defines the time to wait
                                       for a health check response.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   type:
                                     allOf:
@@ -4561,7 +4570,7 @@ spec:
                                     description: BaseEjectionTime defines the base
                                       duration for which a host will be ejected on
                                       consecutive failures.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   consecutive5XxErrors:
                                     default: 5
@@ -4587,7 +4596,7 @@ spec:
                                     default: 3s
                                     description: Interval defines the time between
                                       passive health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   maxEjectionPercent:
                                     default: 10
@@ -4679,6 +4688,7 @@ spec:
                                         description: |-
                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                           Max-Age attribute value.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - name
@@ -4766,6 +4776,7 @@ spec:
                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                       Currently only supports linear growth of traffic. For additional details,
                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 required:
                                 - window
@@ -4880,19 +4891,19 @@ spec:
                                       baseInterval:
                                         description: BaseInterval is the base interval
                                           between retries.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxInterval:
                                         description: |-
                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                           The default is 10 times the base_interval
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   timeout:
                                     description: Timeout is the timeout per retry
                                       attempt.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 type: object
                               retryOn:
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
index f87cb9596..1200bdf0c 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
@@ -176,6 +176,7 @@ spec:
                     description: |-
                       DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                       Defaults to 30 seconds.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   lookupFamily:
                     description: |-
@@ -234,6 +235,7 @@ spec:
                     properties:
                       fixedDelay:
                         description: FixedDelay specifies the fixed delay duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       percentage:
                         default: 100
@@ -348,14 +350,13 @@ spec:
                         description: |-
                           InitialJitter defines the maximum time Envoy will wait before the first health check.
                           Envoy will randomly select a value between 0 and the initial jitter value.
-                        format: duration
                         pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       interval:
                         default: 3s
                         description: Interval defines the time between active health
                           checks.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       tcp:
                         description: |-
@@ -429,7 +430,7 @@ spec:
                         default: 1s
                         description: Timeout defines the time to wait for a health
                           check response.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       type:
                         allOf:
@@ -480,7 +481,7 @@ spec:
                         default: 30s
                         description: BaseEjectionTime defines the base duration for
                           which a host will be ejected on consecutive failures.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       consecutive5XxErrors:
                         default: 5
@@ -505,7 +506,7 @@ spec:
                         default: 3s
                         description: Interval defines the time between passive health
                           checks.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       maxEjectionPercent:
                         default: 10
@@ -624,6 +625,7 @@ spec:
                             description: |-
                               TTL of the generated cookie if the cookie is not present. This value sets the
                               Max-Age attribute value.
+                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                             type: string
                         required:
                         - name
@@ -707,6 +709,7 @@ spec:
                           During slow start window, traffic sent to the newly added hosts will gradually increase.
                           Currently only supports linear growth of traffic. For additional details,
                           see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                     required:
                     - window
@@ -1642,18 +1645,18 @@ spec:
                           baseInterval:
                             description: BaseInterval is the base interval between
                               retries.
-                            format: duration
+                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                             type: string
                           maxInterval:
                             description: |-
                               MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                               The default is 10 times the base_interval
-                            format: duration
+                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                             type: string
                         type: object
                       timeout:
                         description: Timeout is the timeout per retry attempt.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                     type: object
                   retryOn:
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
index 2ed348e21..aeed98b11 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -323,6 +323,7 @@ spec:
                               description: |-
                                 DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                 Defaults to 30 seconds.
+                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                               type: string
                             lookupFamily:
                               description: |-
@@ -446,14 +447,13 @@ spec:
                                   description: |-
                                     InitialJitter defines the maximum time Envoy will wait before the first health check.
                                     Envoy will randomly select a value between 0 and the initial jitter value.
-                                  format: duration
                                   pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 interval:
                                   default: 3s
                                   description: Interval defines the time between active
                                     health checks.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 tcp:
                                   description: |-
@@ -532,7 +532,7 @@ spec:
                                   default: 1s
                                   description: Timeout defines the time to wait for
                                     a health check response.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 type:
                                   allOf:
@@ -585,7 +585,7 @@ spec:
                                   description: BaseEjectionTime defines the base duration
                                     for which a host will be ejected on consecutive
                                     failures.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 consecutive5XxErrors:
                                   default: 5
@@ -610,7 +610,7 @@ spec:
                                   default: 3s
                                   description: Interval defines the time between passive
                                     health checks.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 maxEjectionPercent:
                                   default: 10
@@ -700,6 +700,7 @@ spec:
                                       description: |-
                                         TTL of the generated cookie if the cookie is not present. This value sets the
                                         Max-Age attribute value.
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                   required:
                                   - name
@@ -786,6 +787,7 @@ spec:
                                     During slow start window, traffic sent to the newly added hosts will gradually increase.
                                     Currently only supports linear growth of traffic. For additional details,
                                     see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                               required:
                               - window
@@ -898,18 +900,18 @@ spec:
                                     baseInterval:
                                       description: BaseInterval is the base interval
                                         between retries.
-                                      format: duration
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                     maxInterval:
                                       description: |-
                                         MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                         The default is 10 times the base_interval
-                                      format: duration
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                   type: object
                                 timeout:
                                   description: Timeout is the timeout per retry attempt.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                               type: object
                             retryOn:
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
index fe454279c..7d9935607 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -10515,11 +10515,13 @@ spec:
                     description: |-
                       DrainTimeout defines the graceful drain timeout. This should be less than the pod's terminationGracePeriodSeconds.
                       If unspecified, defaults to 60 seconds.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   minDrainDuration:
                     description: |-
                       MinDrainDuration defines the minimum drain duration allowing time for endpoint deprogramming to complete.
                       If unspecified, defaults to 10 seconds.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                 type: object
               telemetry:
@@ -10873,6 +10875,7 @@ spec:
                                                 description: |-
                                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                                   Defaults to 30 seconds.
+                                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                 type: string
                                               lookupFamily:
                                                 description: |-
@@ -11006,7 +11009,6 @@ spec:
                                                     description: |-
                                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                                    format: duration
                                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   interval:
@@ -11014,7 +11016,7 @@ spec:
                                                     description: Interval defines
                                                       the time between active health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   tcp:
                                                     description: |-
@@ -11103,7 +11105,7 @@ spec:
                                                     description: Timeout defines the
                                                       time to wait for a health check
                                                       response.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   type:
                                                     allOf:
@@ -11166,7 +11168,7 @@ spec:
                                                       defines the base duration for
                                                       which a host will be ejected
                                                       on consecutive failures.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   consecutive5XxErrors:
                                                     default: 5
@@ -11194,7 +11196,7 @@ spec:
                                                     description: Interval defines
                                                       the time between passive health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   maxEjectionPercent:
                                                     default: 10
@@ -11289,6 +11291,7 @@ spec:
                                                         description: |-
                                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                                           Max-Age attribute value.
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     required:
                                                     - name
@@ -11383,6 +11386,7 @@ spec:
                                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                                       Currently only supports linear growth of traffic. For additional details,
                                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 required:
                                                 - window
@@ -11504,19 +11508,19 @@ spec:
                                                         description: BaseInterval
                                                           is the base interval between
                                                           retries.
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                       maxInterval:
                                                         description: |-
                                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                           The default is 10 times the base_interval
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     type: object
                                                   timeout:
                                                     description: Timeout is the timeout
                                                       per retry attempt.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 type: object
                                               retryOn:
@@ -11984,6 +11988,7 @@ spec:
                                                 description: |-
                                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                                   Defaults to 30 seconds.
+                                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                 type: string
                                               lookupFamily:
                                                 description: |-
@@ -12117,7 +12122,6 @@ spec:
                                                     description: |-
                                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                                    format: duration
                                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   interval:
@@ -12125,7 +12129,7 @@ spec:
                                                     description: Interval defines
                                                       the time between active health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   tcp:
                                                     description: |-
@@ -12214,7 +12218,7 @@ spec:
                                                     description: Timeout defines the
                                                       time to wait for a health check
                                                       response.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   type:
                                                     allOf:
@@ -12277,7 +12281,7 @@ spec:
                                                       defines the base duration for
                                                       which a host will be ejected
                                                       on consecutive failures.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   consecutive5XxErrors:
                                                     default: 5
@@ -12305,7 +12309,7 @@ spec:
                                                     description: Interval defines
                                                       the time between passive health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   maxEjectionPercent:
                                                     default: 10
@@ -12400,6 +12404,7 @@ spec:
                                                         description: |-
                                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                                           Max-Age attribute value.
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     required:
                                                     - name
@@ -12494,6 +12499,7 @@ spec:
                                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                                       Currently only supports linear growth of traffic. For additional details,
                                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 required:
                                                 - window
@@ -12615,19 +12621,19 @@ spec:
                                                         description: BaseInterval
                                                           is the base interval between
                                                           retries.
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                       maxInterval:
                                                         description: |-
                                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                           The default is 10 times the base_interval
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     type: object
                                                   timeout:
                                                     description: Timeout is the timeout
                                                       per retry attempt.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 type: object
                                               retryOn:
@@ -13203,6 +13209,7 @@ spec:
                                           description: |-
                                             DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                             Defaults to 30 seconds.
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         lookupFamily:
                                           description: |-
@@ -13331,14 +13338,13 @@ spec:
                                               description: |-
                                                 InitialJitter defines the maximum time Envoy will wait before the first health check.
                                                 Envoy will randomly select a value between 0 and the initial jitter value.
-                                              format: duration
                                               pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             interval:
                                               default: 3s
                                               description: Interval defines the time
                                                 between active health checks.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             tcp:
                                               description: |-
@@ -13422,7 +13428,7 @@ spec:
                                               default: 1s
                                               description: Timeout defines the time
                                                 to wait for a health check response.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             type:
                                               allOf:
@@ -13480,7 +13486,7 @@ spec:
                                               description: BaseEjectionTime defines
                                                 the base duration for which a host
                                                 will be ejected on consecutive failures.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             consecutive5XxErrors:
                                               default: 5
@@ -13507,7 +13513,7 @@ spec:
                                               default: 3s
                                               description: Interval defines the time
                                                 between passive health checks.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             maxEjectionPercent:
                                               default: 10
@@ -13599,6 +13605,7 @@ spec:
                                                   description: |-
                                                     TTL of the generated cookie if the cookie is not present. This value sets the
                                                     Max-Age attribute value.
+                                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                   type: string
                                               required:
                                               - name
@@ -13689,6 +13696,7 @@ spec:
                                                 During slow start window, traffic sent to the newly added hosts will gradually increase.
                                                 Currently only supports linear growth of traffic. For additional details,
                                                 see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           required:
                                           - window
@@ -13805,19 +13813,19 @@ spec:
                                                 baseInterval:
                                                   description: BaseInterval is the
                                                     base interval between retries.
-                                                  format: duration
+                                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                   type: string
                                                 maxInterval:
                                                   description: |-
                                                     MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                     The default is 10 times the base_interval
-                                                  format: duration
+                                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                   type: string
                                               type: object
                                             timeout:
                                               description: Timeout is the timeout
                                                 per retry attempt.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           type: object
                                         retryOn:
@@ -14319,6 +14327,7 @@ spec:
                                     description: |-
                                       DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                       Defaults to 30 seconds.
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   lookupFamily:
                                     description: |-
@@ -14446,14 +14455,13 @@ spec:
                                         description: |-
                                           InitialJitter defines the maximum time Envoy will wait before the first health check.
                                           Envoy will randomly select a value between 0 and the initial jitter value.
-                                        format: duration
                                         pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       interval:
                                         default: 3s
                                         description: Interval defines the time between
                                           active health checks.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       tcp:
                                         description: |-
@@ -14537,7 +14545,7 @@ spec:
                                         default: 1s
                                         description: Timeout defines the time to wait
                                           for a health check response.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       type:
                                         allOf:
@@ -14594,7 +14602,7 @@ spec:
                                         description: BaseEjectionTime defines the
                                           base duration for which a host will be ejected
                                           on consecutive failures.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       consecutive5XxErrors:
                                         default: 5
@@ -14621,7 +14629,7 @@ spec:
                                         default: 3s
                                         description: Interval defines the time between
                                           passive health checks.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxEjectionPercent:
                                         default: 10
@@ -14713,6 +14721,7 @@ spec:
                                             description: |-
                                               TTL of the generated cookie if the cookie is not present. This value sets the
                                               Max-Age attribute value.
+                                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                             type: string
                                         required:
                                         - name
@@ -14802,6 +14811,7 @@ spec:
                                           During slow start window, traffic sent to the newly added hosts will gradually increase.
                                           Currently only supports linear growth of traffic. For additional details,
                                           see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - window
@@ -14916,19 +14926,19 @@ spec:
                                           baseInterval:
                                             description: BaseInterval is the base
                                               interval between retries.
-                                            format: duration
+                                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                             type: string
                                           maxInterval:
                                             description: |-
                                               MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                               The default is 10 times the base_interval
-                                            format: duration
+                                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                             type: string
                                         type: object
                                       timeout:
                                         description: Timeout is the timeout per retry
                                           attempt.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   retryOn:
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
index ea1b263ac..090a8f8e2 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -521,6 +521,7 @@ spec:
                     description: |-
                       MaxAge defines how long the results of a preflight request can be cached.
                       It specifies the value in the Access-Control-Max-Age CORS response header..
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                 type: object
               extAuth:
@@ -827,6 +828,7 @@ spec:
                                 description: |-
                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                   Defaults to 30 seconds.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                 type: string
                               lookupFamily:
                                 description: |-
@@ -950,14 +952,13 @@ spec:
                                     description: |-
                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                    format: duration
                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
                                       active health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   tcp:
                                     description: |-
@@ -1036,7 +1037,7 @@ spec:
                                     default: 1s
                                     description: Timeout defines the time to wait
                                       for a health check response.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   type:
                                     allOf:
@@ -1091,7 +1092,7 @@ spec:
                                     description: BaseEjectionTime defines the base
                                       duration for which a host will be ejected on
                                       consecutive failures.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   consecutive5XxErrors:
                                     default: 5
@@ -1117,7 +1118,7 @@ spec:
                                     default: 3s
                                     description: Interval defines the time between
                                       passive health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   maxEjectionPercent:
                                     default: 10
@@ -1209,6 +1210,7 @@ spec:
                                         description: |-
                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                           Max-Age attribute value.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - name
@@ -1296,6 +1298,7 @@ spec:
                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                       Currently only supports linear growth of traffic. For additional details,
                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 required:
                                 - window
@@ -1410,19 +1413,19 @@ spec:
                                       baseInterval:
                                         description: BaseInterval is the base interval
                                           between retries.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxInterval:
                                         description: |-
                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                           The default is 10 times the base_interval
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   timeout:
                                     description: Timeout is the timeout per retry
                                       attempt.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 type: object
                               retryOn:
@@ -1834,6 +1837,7 @@ spec:
                                 description: |-
                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                   Defaults to 30 seconds.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                 type: string
                               lookupFamily:
                                 description: |-
@@ -1957,14 +1961,13 @@ spec:
                                     description: |-
                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                    format: duration
                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
                                       active health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   tcp:
                                     description: |-
@@ -2043,7 +2046,7 @@ spec:
                                     default: 1s
                                     description: Timeout defines the time to wait
                                       for a health check response.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   type:
                                     allOf:
@@ -2098,7 +2101,7 @@ spec:
                                     description: BaseEjectionTime defines the base
                                       duration for which a host will be ejected on
                                       consecutive failures.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   consecutive5XxErrors:
                                     default: 5
@@ -2124,7 +2127,7 @@ spec:
                                     default: 3s
                                     description: Interval defines the time between
                                       passive health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   maxEjectionPercent:
                                     default: 10
@@ -2216,6 +2219,7 @@ spec:
                                         description: |-
                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                           Max-Age attribute value.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - name
@@ -2303,6 +2307,7 @@ spec:
                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                       Currently only supports linear growth of traffic. For additional details,
                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 required:
                                 - window
@@ -2417,19 +2422,19 @@ spec:
                                       baseInterval:
                                         description: BaseInterval is the base interval
                                           between retries.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxInterval:
                                         description: |-
                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                           The default is 10 times the base_interval
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   timeout:
                                     description: Timeout is the timeout per retry
                                       attempt.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 type: object
                               retryOn:
@@ -3033,6 +3038,7 @@ spec:
                                       description: |-
                                         DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                         Defaults to 30 seconds.
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                     lookupFamily:
                                       description: |-
@@ -3160,14 +3166,13 @@ spec:
                                           description: |-
                                             InitialJitter defines the maximum time Envoy will wait before the first health check.
                                             Envoy will randomly select a value between 0 and the initial jitter value.
-                                          format: duration
                                           pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         interval:
                                           default: 3s
                                           description: Interval defines the time between
                                             active health checks.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         tcp:
                                           description: |-
@@ -3251,7 +3256,7 @@ spec:
                                           default: 1s
                                           description: Timeout defines the time to
                                             wait for a health check response.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         type:
                                           allOf:
@@ -3309,7 +3314,7 @@ spec:
                                           description: BaseEjectionTime defines the
                                             base duration for which a host will be
                                             ejected on consecutive failures.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         consecutive5XxErrors:
                                           default: 5
@@ -3336,7 +3341,7 @@ spec:
                                           default: 3s
                                           description: Interval defines the time between
                                             passive health checks.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         maxEjectionPercent:
                                           default: 10
@@ -3428,6 +3433,7 @@ spec:
                                               description: |-
                                                 TTL of the generated cookie if the cookie is not present. This value sets the
                                                 Max-Age attribute value.
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           required:
                                           - name
@@ -3517,6 +3523,7 @@ spec:
                                             During slow start window, traffic sent to the newly added hosts will gradually increase.
                                             Currently only supports linear growth of traffic. For additional details,
                                             see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                       required:
                                       - window
@@ -3632,19 +3639,19 @@ spec:
                                             baseInterval:
                                               description: BaseInterval is the base
                                                 interval between retries.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             maxInterval:
                                               description: |-
                                                 MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                 The default is 10 times the base_interval
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           type: object
                                         timeout:
                                           description: Timeout is the timeout per
                                             retry attempt.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                       type: object
                                     retryOn:
@@ -3943,6 +3950,7 @@ spec:
 
                       If not specified, defaults to 604800s (one week).
                       Note: this field is only applicable when the "refreshToken" field is set to true.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   defaultTokenTTL:
                     description: |-
@@ -3954,6 +3962,7 @@ spec:
                       If not specified, defaults to 0. In this case, the "expires_in" field in
                       the authorization response must be set by the authorization server, or the
                       OAuth flow will fail.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   denyRedirect:
                     description: |-
@@ -4296,6 +4305,7 @@ spec:
                                 description: |-
                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                   Defaults to 30 seconds.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                 type: string
                               lookupFamily:
                                 description: |-
@@ -4419,14 +4429,13 @@ spec:
                                     description: |-
                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                    format: duration
                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
                                       active health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   tcp:
                                     description: |-
@@ -4505,7 +4514,7 @@ spec:
                                     default: 1s
                                     description: Timeout defines the time to wait
                                       for a health check response.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   type:
                                     allOf:
@@ -4560,7 +4569,7 @@ spec:
                                     description: BaseEjectionTime defines the base
                                       duration for which a host will be ejected on
                                       consecutive failures.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   consecutive5XxErrors:
                                     default: 5
@@ -4586,7 +4595,7 @@ spec:
                                     default: 3s
                                     description: Interval defines the time between
                                       passive health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   maxEjectionPercent:
                                     default: 10
@@ -4678,6 +4687,7 @@ spec:
                                         description: |-
                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                           Max-Age attribute value.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - name
@@ -4765,6 +4775,7 @@ spec:
                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                       Currently only supports linear growth of traffic. For additional details,
                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 required:
                                 - window
@@ -4879,19 +4890,19 @@ spec:
                                       baseInterval:
                                         description: BaseInterval is the base interval
                                           between retries.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxInterval:
                                         description: |-
                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                           The default is 10 times the base_interval
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   timeout:
                                     description: Timeout is the timeout per retry
                                       attempt.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 type: object
                               retryOn:
diff --git a/internal/gatewayapi/backendtrafficpolicy.go b/internal/gatewayapi/backendtrafficpolicy.go
index 7b10a951f..07d926a9b 100644
--- a/internal/gatewayapi/backendtrafficpolicy.go
+++ b/internal/gatewayapi/backendtrafficpolicy.go
@@ -12,6 +12,7 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"time"
 
 	perr "github.com/pkg/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -974,14 +975,24 @@ func int64ToUint32(in int64) (uint32, bool) {
 }
 
 func (t *Translator) buildFaultInjection(policy *egv1a1.BackendTrafficPolicy) *ir.FaultInjection {
-	var fi *ir.FaultInjection
+	var (
+		fi  *ir.FaultInjection
+		d   time.Duration
+		err error
+	)
 	if policy.Spec.FaultInjection != nil {
 		fi = &ir.FaultInjection{}
 
 		if policy.Spec.FaultInjection.Delay != nil {
+			if policy.Spec.FaultInjection.Delay.FixedDelay != nil {
+				d, err = time.ParseDuration(string(*policy.Spec.FaultInjection.Delay.FixedDelay))
+				if err != nil {
+					return nil
+				}
+			}
 			fi.Delay = &ir.FaultInjectionDelay{
 				Percentage: policy.Spec.FaultInjection.Delay.Percentage,
-				FixedDelay: policy.Spec.FaultInjection.Delay.FixedDelay,
+				FixedDelay: ir.MetaV1DurationPtr(d),
 			}
 		}
 		if policy.Spec.FaultInjection.Abort != nil {
diff --git a/internal/gatewayapi/clienttrafficpolicy.go b/internal/gatewayapi/clienttrafficpolicy.go
index 71e307961..d3c59cc72 100644
--- a/internal/gatewayapi/clienttrafficpolicy.go
+++ b/internal/gatewayapi/clienttrafficpolicy.go
@@ -600,9 +600,7 @@ func buildClientTimeout(clientTimeout *egv1a1.ClientTimeout) (*ir.ClientTimeout,
 			if err != nil {
 				return nil, fmt.Errorf("invalid TCP IdleTimeout value %s", *clientTimeout.TCP.IdleTimeout)
 			}
-			irTCPTimeout.IdleTimeout = &metav1.Duration{
-				Duration: d,
-			}
+			irTCPTimeout.IdleTimeout = ir.MetaV1DurationPtr(d)
 		}
 		irClientTimeout.TCP = irTCPTimeout
 	}
@@ -614,9 +612,7 @@ func buildClientTimeout(clientTimeout *egv1a1.ClientTimeout) (*ir.ClientTimeout,
 			if err != nil {
 				return nil, fmt.Errorf("invalid HTTP RequestReceivedTimeout value %s", *clientTimeout.HTTP.RequestReceivedTimeout)
 			}
-			irHTTPTimeout.RequestReceivedTimeout = &metav1.Duration{
-				Duration: d,
-			}
+			irHTTPTimeout.RequestReceivedTimeout = ir.MetaV1DurationPtr(d)
 		}
 
 		if clientTimeout.HTTP.IdleTimeout != nil {
@@ -624,9 +620,7 @@ func buildClientTimeout(clientTimeout *egv1a1.ClientTimeout) (*ir.ClientTimeout,
 			if err != nil {
 				return nil, fmt.Errorf("invalid HTTP IdleTimeout value %s", *clientTimeout.HTTP.IdleTimeout)
 			}
-			irHTTPTimeout.IdleTimeout = &metav1.Duration{
-				Duration: d,
-			}
+			irHTTPTimeout.IdleTimeout = ir.MetaV1DurationPtr(d)
 		}
 
 		if clientTimeout.HTTP.StreamIdleTimeout != nil {
@@ -634,9 +628,7 @@ func buildClientTimeout(clientTimeout *egv1a1.ClientTimeout) (*ir.ClientTimeout,
 			if err != nil {
 				return nil, fmt.Errorf("invalid HTTP StreamIdleTimeout value %s", *clientTimeout.HTTP.StreamIdleTimeout)
 			}
-			irHTTPTimeout.StreamIdleTimeout = &metav1.Duration{
-				Duration: d,
-			}
+			irHTTPTimeout.StreamIdleTimeout = ir.MetaV1DurationPtr(d)
 		}
 		irClientTimeout.HTTP = irHTTPTimeout
 	}
@@ -961,7 +953,7 @@ func buildConnection(connection *egv1a1.ClientConnection) (*ir.ClientConnection,
 			if err != nil {
 				return nil, fmt.Errorf("invalid CloseDelay value %s", *connection.ConnectionLimit.CloseDelay)
 			}
-			irConnectionLimit.CloseDelay = ptr.To(metav1.Duration{Duration: d})
+			irConnectionLimit.CloseDelay = ir.MetaV1DurationPtr(d)
 		}
 
 		irConnection.ConnectionLimit = irConnectionLimit
diff --git a/internal/gatewayapi/clustersettings.go b/internal/gatewayapi/clustersettings.go
index 0f33e5744..42de49bad 100644
--- a/internal/gatewayapi/clustersettings.go
+++ b/internal/gatewayapi/clustersettings.go
@@ -104,7 +104,7 @@ func buildClusterSettingsTimeout(policy egv1a1.ClusterSettings) (*ir.Timeout, er
 			errs = errors.Join(errs, fmt.Errorf("invalid ConnectTimeout value %s", *pto.TCP.ConnectTimeout))
 		} else {
 			to.TCP = &ir.TCPTimeout{
-				ConnectTimeout: ptr.To(metav1.Duration{Duration: d}),
+				ConnectTimeout: ir.MetaV1DurationPtr(d),
 			}
 		}
 	}
@@ -119,7 +119,7 @@ func buildClusterSettingsTimeout(policy egv1a1.ClusterSettings) (*ir.Timeout, er
 			if err != nil {
 				errs = errors.Join(errs, fmt.Errorf("invalid ConnectionIdleTimeout value %s", *pto.HTTP.ConnectionIdleTimeout))
 			} else {
-				cit = ptr.To(metav1.Duration{Duration: d})
+				cit = ir.MetaV1DurationPtr(d)
 			}
 		}
 
@@ -128,7 +128,7 @@ func buildClusterSettingsTimeout(policy egv1a1.ClusterSettings) (*ir.Timeout, er
 			if err != nil {
 				errs = errors.Join(errs, fmt.Errorf("invalid MaxConnectionDuration value %s", *pto.HTTP.MaxConnectionDuration))
 			} else {
-				mcd = ptr.To(metav1.Duration{Duration: d})
+				mcd = ir.MetaV1DurationPtr(d)
 			}
 		}
 
@@ -137,7 +137,7 @@ func buildClusterSettingsTimeout(policy egv1a1.ClusterSettings) (*ir.Timeout, er
 			if err != nil {
 				errs = errors.Join(errs, fmt.Errorf("invalid RequestTimeout value %s", *pto.HTTP.RequestTimeout))
 			} else {
-				rt = ptr.To(metav1.Duration{Duration: d})
+				rt = ir.MetaV1DurationPtr(d)
 			}
 		}
 
@@ -293,8 +293,12 @@ func buildLoadBalancer(policy egv1a1.ClusterSettings) (*ir.LoadBalancer, error)
 			LeastRequest: &ir.LeastRequest{},
 		}
 		if policy.LoadBalancer.SlowStart != nil && policy.LoadBalancer.SlowStart.Window != nil {
+			d, err := time.ParseDuration(string(*policy.LoadBalancer.SlowStart.Window))
+			if err != nil {
+				return nil, err
+			}
 			lb.LeastRequest.SlowStart = &ir.SlowStart{
-				Window: policy.LoadBalancer.SlowStart.Window,
+				Window: ir.MetaV1DurationPtr(d),
 			}
 		}
 	case egv1a1.RandomLoadBalancerType:
@@ -306,8 +310,12 @@ func buildLoadBalancer(policy egv1a1.ClusterSettings) (*ir.LoadBalancer, error)
 			RoundRobin: &ir.RoundRobin{},
 		}
 		if policy.LoadBalancer.SlowStart != nil && policy.LoadBalancer.SlowStart.Window != nil {
+			d, err := time.ParseDuration(string(*policy.LoadBalancer.SlowStart.Window))
+			if err != nil {
+				return nil, err
+			}
 			lb.RoundRobin.SlowStart = &ir.SlowStart{
-				Window: policy.LoadBalancer.SlowStart.Window,
+				Window: ir.MetaV1DurationPtr(d),
 			}
 		}
 	}
@@ -415,14 +423,28 @@ func buildPassiveHealthCheck(policy egv1a1.HealthCheck) *ir.OutlierDetection {
 
 	hc := policy.Passive
 	irOD := &ir.OutlierDetection{
-		Interval:                       hc.Interval,
 		SplitExternalLocalOriginErrors: hc.SplitExternalLocalOriginErrors,
 		ConsecutiveLocalOriginFailures: hc.ConsecutiveLocalOriginFailures,
 		ConsecutiveGatewayErrors:       hc.ConsecutiveGatewayErrors,
 		Consecutive5xxErrors:           hc.Consecutive5xxErrors,
-		BaseEjectionTime:               hc.BaseEjectionTime,
 		MaxEjectionPercent:             hc.MaxEjectionPercent,
 	}
+
+	if hc.Interval != nil {
+		d, err := time.ParseDuration(string(*hc.Interval))
+		if err != nil {
+			return nil
+		}
+		irOD.Interval = ir.MetaV1DurationPtr(d)
+	}
+
+	if hc.BaseEjectionTime != nil {
+		d, err := time.ParseDuration(string(*hc.BaseEjectionTime))
+		if err != nil {
+			return nil
+		}
+		irOD.BaseEjectionTime = ir.MetaV1DurationPtr(d)
+	}
 	return irOD
 }
 
@@ -433,12 +455,22 @@ func buildActiveHealthCheck(policy egv1a1.HealthCheck) *ir.ActiveHealthCheck {
 
 	hc := policy.Active
 	irHC := &ir.ActiveHealthCheck{
-		Timeout:            hc.Timeout,
-		Interval:           hc.Interval,
 		InitialJitter:      hc.InitialJitter,
 		UnhealthyThreshold: hc.UnhealthyThreshold,
 		HealthyThreshold:   hc.HealthyThreshold,
 	}
+
+	if hc.Timeout != nil {
+		if d, err := time.ParseDuration(string(*hc.Timeout)); err == nil {
+			irHC.Timeout = ir.MetaV1DurationPtr(d)
+		}
+	}
+
+	if hc.Interval != nil {
+		if d, err := time.ParseDuration(string(*hc.Interval)); err == nil {
+			irHC.Interval = ir.MetaV1DurationPtr(d)
+		}
+	}
 	switch hc.Type {
 	case egv1a1.ActiveHealthCheckerTypeHTTP:
 		irHC.HTTP = buildHTTPActiveHealthChecker(hc.HTTP)
@@ -522,11 +554,18 @@ func translateDNS(policy egv1a1.ClusterSettings) *ir.DNS {
 	if policy.DNS == nil {
 		return nil
 	}
-	return &ir.DNS{
-		LookupFamily:   policy.DNS.LookupFamily,
-		RespectDNSTTL:  policy.DNS.RespectDNSTTL,
-		DNSRefreshRate: policy.DNS.DNSRefreshRate,
+	irDNS := &ir.DNS{
+		LookupFamily:  policy.DNS.LookupFamily,
+		RespectDNSTTL: policy.DNS.RespectDNSTTL,
+	}
+
+	if policy.DNS.DNSRefreshRate != nil {
+		if d, err := time.ParseDuration(string(*policy.DNS.DNSRefreshRate)); err == nil {
+			irDNS.DNSRefreshRate = ir.MetaV1DurationPtr(d)
+		}
 	}
+
+	return irDNS
 }
 
 func buildRetry(r *egv1a1.Retry) (*ir.Retry, error) {
@@ -565,7 +604,11 @@ func buildRetry(r *egv1a1.Retry) (*ir.Retry, error) {
 		bpr := false
 
 		if r.PerRetry.Timeout != nil {
-			pr.Timeout = r.PerRetry.Timeout
+			d, err := time.ParseDuration(string(*r.PerRetry.Timeout))
+			if err != nil {
+				return nil, err
+			}
+			pr.Timeout = ir.MetaV1DurationPtr(d)
 			bpr = true
 		}
 
@@ -573,18 +616,22 @@ func buildRetry(r *egv1a1.Retry) (*ir.Retry, error) {
 			if r.PerRetry.BackOff.MaxInterval != nil || r.PerRetry.BackOff.BaseInterval != nil {
 				bop := &ir.BackOffPolicy{}
 				if r.PerRetry.BackOff.BaseInterval != nil {
-					bop.BaseInterval = r.PerRetry.BackOff.BaseInterval
-					if bop.BaseInterval.Duration == 0 {
-						return nil, fmt.Errorf("baseInterval cannot be set to 0s")
+					if d, err := time.ParseDuration(string(*r.PerRetry.BackOff.BaseInterval)); err == nil {
+						bop.BaseInterval = ir.MetaV1DurationPtr(d)
+						if bop.BaseInterval.Duration == 0 {
+							return nil, fmt.Errorf("baseInterval cannot be set to 0s")
+						}
 					}
 				}
 				if r.PerRetry.BackOff.MaxInterval != nil {
-					bop.MaxInterval = r.PerRetry.BackOff.MaxInterval
-					if bop.MaxInterval.Duration == 0 {
-						return nil, fmt.Errorf("maxInterval cannot be set to 0s")
-					}
-					if bop.BaseInterval != nil && bop.BaseInterval.Duration > bop.MaxInterval.Duration {
-						return nil, fmt.Errorf("maxInterval cannot be less than baseInterval")
+					if d, err := time.ParseDuration(string(*r.PerRetry.BackOff.MaxInterval)); err == nil {
+						bop.MaxInterval = ir.MetaV1DurationPtr(d)
+						if bop.MaxInterval.Duration == 0 {
+							return nil, fmt.Errorf("maxInterval cannot be set to 0s")
+						}
+						if bop.BaseInterval != nil && bop.BaseInterval.Duration > bop.MaxInterval.Duration {
+							return nil, fmt.Errorf("maxInterval cannot be less than baseInterval")
+						}
 					}
 				}
 
diff --git a/internal/gatewayapi/envoyextensionpolicy.go b/internal/gatewayapi/envoyextensionpolicy.go
index 46894556a..c6986f847 100644
--- a/internal/gatewayapi/envoyextensionpolicy.go
+++ b/internal/gatewayapi/envoyextensionpolicy.go
@@ -605,7 +605,7 @@ func (t *Translator) buildExtProc(
 		if err != nil {
 			return nil, fmt.Errorf("invalid ExtProc MessageTimeout value %v", extProc.MessageTimeout)
 		}
-		extProcIR.MessageTimeout = ptr.To(metav1.Duration{Duration: d})
+		extProcIR.MessageTimeout = ir.MetaV1DurationPtr(d)
 	}
 
 	if extProc.FailOpen != nil {
diff --git a/internal/gatewayapi/filters.go b/internal/gatewayapi/filters.go
index 631de3247..be65cb0be 100644
--- a/internal/gatewayapi/filters.go
+++ b/internal/gatewayapi/filters.go
@@ -1032,7 +1032,7 @@ func (t *Translator) processCORSFilter(
 		AllowMethods:     allowMethods,
 		AllowHeaders:     allowHeaders,
 		ExposeHeaders:    exposeHeaders,
-		MaxAge:           ptr.To(metav1.Duration{Duration: time.Duration(corsFilter.MaxAge) * time.Second}),
+		MaxAge:           ir.MetaV1DurationPtr(time.Duration(corsFilter.MaxAge) * time.Second),
 		AllowCredentials: bool(corsFilter.AllowCredentials),
 	}
 }
diff --git a/internal/gatewayapi/route.go b/internal/gatewayapi/route.go
index 412dea76c..fa517eea6 100644
--- a/internal/gatewayapi/route.go
+++ b/internal/gatewayapi/route.go
@@ -350,7 +350,7 @@ func processRouteTimeout(irRoute *ir.HTTPRoute, rule gwapiv1.HTTPRouteRule) {
 			if err != nil {
 				d, _ = time.ParseDuration(HTTPRequestTimeout)
 			}
-			irRoute.Timeout = ptr.To(metav1.Duration{Duration: d})
+			irRoute.Timeout = ir.MetaV1DurationPtr(d)
 		}
 
 		// Only set the IR Route Timeout to the backend request timeout
@@ -361,7 +361,7 @@ func processRouteTimeout(irRoute *ir.HTTPRoute, rule gwapiv1.HTTPRouteRule) {
 			if err != nil {
 				d, _ = time.ParseDuration(HTTPRequestTimeout)
 			}
-			irRoute.Timeout = ptr.To(metav1.Duration{Duration: d})
+			irRoute.Timeout = ir.MetaV1DurationPtr(d)
 		}
 	}
 }
@@ -381,14 +381,14 @@ func processRouteRetry(irRoute *ir.HTTPRoute, rule gwapiv1.HTTPRouteRule) {
 		if err == nil {
 			res.PerRetry = &ir.PerRetryPolicy{
 				BackOff: &ir.BackOffPolicy{
-					BaseInterval: ptr.To(metav1.Duration{Duration: backoff}),
+					BaseInterval: ir.MetaV1DurationPtr(backoff),
 				},
 			}
 			// xref: https://gateway-api.sigs.k8s.io/geps/gep-1742/#timeout-values
 			if rule.Timeouts != nil && rule.Timeouts.BackendRequest != nil {
 				backendRequestTimeout, err := time.ParseDuration(string(*rule.Timeouts.BackendRequest))
 				if err == nil {
-					res.PerRetry.Timeout = &metav1.Duration{Duration: backendRequestTimeout}
+					res.PerRetry.Timeout = ir.MetaV1DurationPtr(backendRequestTimeout)
 				}
 			}
 		}
@@ -460,7 +460,7 @@ func (t *Translator) processHTTPRouteRule(
 				if err != nil {
 					return nil, status.NewRouteStatusError(err, gwapiv1.RouteReasonUnsupportedValue)
 				}
-				sessionPersistence.Cookie.TTL = &metav1.Duration{Duration: ttl}
+				sessionPersistence.Cookie.TTL = ir.MetaV1DurationPtr(ttl)
 			}
 		case *rule.SessionPersistence.Type == gwapiv1.HeaderBasedSessionPersistence:
 			sessionPersistence = &ir.SessionPersistence{
diff --git a/internal/gatewayapi/securitypolicy.go b/internal/gatewayapi/securitypolicy.go
index 6ca6f4813..a070d5bdc 100644
--- a/internal/gatewayapi/securitypolicy.go
+++ b/internal/gatewayapi/securitypolicy.go
@@ -895,14 +895,21 @@ func (t *Translator) buildCORS(cors *egv1a1.CORS) *ir.CORS {
 		}
 	}
 
-	return &ir.CORS{
+	irCORS := &ir.CORS{
 		AllowOrigins:     allowOrigins,
 		AllowMethods:     cors.AllowMethods,
 		AllowHeaders:     cors.AllowHeaders,
 		ExposeHeaders:    cors.ExposeHeaders,
-		MaxAge:           cors.MaxAge,
 		AllowCredentials: cors.AllowCredentials != nil && *cors.AllowCredentials,
 	}
+
+	if cors.MaxAge != nil {
+		if d, err := time.ParseDuration(string(*cors.MaxAge)); err == nil {
+			irCORS.MaxAge = ir.MetaV1DurationPtr(d)
+		}
+	}
+
+	return irCORS
 }
 
 func containsWildcard(s string) bool {
@@ -1223,28 +1230,40 @@ func (t *Translator) buildOIDC(
 			"HMAC secret not found in secret %s/%s", t.ControllerNamespace, oidcHMACSecretName)
 	}
 
-	return &ir.OIDC{
-		Name:                   irConfigName(policy),
-		Provider:               *provider,
-		ClientID:               clientID,
-		ClientSecret:           clientSecretBytes,
-		Scopes:                 scopes,
-		Resources:              oidc.Resources,
-		RedirectURL:            redirectURL,
-		RedirectPath:           redirectPath,
-		LogoutPath:             logoutPath,
-		ForwardAccessToken:     forwardAccessToken,
-		DefaultTokenTTL:        oidc.DefaultTokenTTL,
-		RefreshToken:           refreshToken,
-		DefaultRefreshTokenTTL: oidc.DefaultRefreshTokenTTL,
-		CookieSuffix:           suffix,
-		CookieNameOverrides:    policy.Spec.OIDC.CookieNames,
-		CookieDomain:           policy.Spec.OIDC.CookieDomain,
-		CookieConfig:           policy.Spec.OIDC.CookieConfig,
-		HMACSecret:             hmacData,
-		PassThroughAuthHeader:  passThroughAuthHeader,
-		DenyRedirect:           oidc.DenyRedirect,
-	}, nil
+	irOIDC := &ir.OIDC{
+		Name:                  irConfigName(policy),
+		Provider:              *provider,
+		ClientID:              clientID,
+		ClientSecret:          clientSecretBytes,
+		Scopes:                scopes,
+		Resources:             oidc.Resources,
+		RedirectURL:           redirectURL,
+		RedirectPath:          redirectPath,
+		LogoutPath:            logoutPath,
+		ForwardAccessToken:    forwardAccessToken,
+		RefreshToken:          refreshToken,
+		CookieSuffix:          suffix,
+		CookieNameOverrides:   policy.Spec.OIDC.CookieNames,
+		CookieDomain:          policy.Spec.OIDC.CookieDomain,
+		CookieConfig:          policy.Spec.OIDC.CookieConfig,
+		HMACSecret:            hmacData,
+		PassThroughAuthHeader: passThroughAuthHeader,
+		DenyRedirect:          oidc.DenyRedirect,
+	}
+
+	if oidc.DefaultTokenTTL != nil {
+		if d, err := time.ParseDuration(string(*oidc.DefaultTokenTTL)); err == nil {
+			irOIDC.DefaultTokenTTL = ir.MetaV1DurationPtr(d)
+		}
+	}
+
+	if oidc.DefaultRefreshTokenTTL != nil {
+		if d, err := time.ParseDuration(string(*oidc.DefaultRefreshTokenTTL)); err == nil {
+			irOIDC.DefaultRefreshTokenTTL = ir.MetaV1DurationPtr(d)
+		}
+	}
+
+	return irOIDC, nil
 }
 
 func (t *Translator) buildOIDCProvider(policy *egv1a1.SecurityPolicy, resources *resource.Resources, envoyProxy *egv1a1.EnvoyProxy) (*ir.OIDCProvider, error) {
diff --git a/internal/infrastructure/common/proxy_args.go b/internal/infrastructure/common/proxy_args.go
index 4d6a67892..5d2fa5f22 100644
--- a/internal/infrastructure/common/proxy_args.go
+++ b/internal/infrastructure/common/proxy_args.go
@@ -7,6 +7,7 @@ package common
 
 import (
 	"fmt"
+	"time"
 
 	"k8s.io/utils/ptr"
 
@@ -84,7 +85,11 @@ func BuildProxyArgs(
 	// Default drain timeout.
 	drainTimeout := 60.0
 	if shutdownConfig != nil && shutdownConfig.DrainTimeout != nil {
-		drainTimeout = shutdownConfig.DrainTimeout.Seconds()
+		d, err := time.ParseDuration(string(*shutdownConfig.DrainTimeout))
+		if err != nil {
+			return nil, err
+		}
+		drainTimeout = d.Seconds()
 	}
 	args = append(args, fmt.Sprintf("--drain-time-s %.0f", drainTimeout))
 
diff --git a/internal/infrastructure/kubernetes/proxy/resource.go b/internal/infrastructure/kubernetes/proxy/resource.go
index a33238774..ace4dcba0 100644
--- a/internal/infrastructure/kubernetes/proxy/resource.go
+++ b/internal/infrastructure/kubernetes/proxy/resource.go
@@ -8,6 +8,7 @@ package proxy
 import (
 	"fmt"
 	"path/filepath"
+	"time"
 
 	"github.com/containers/image/v5/docker/reference"
 	corev1 "k8s.io/api/core/v1"
@@ -257,7 +258,11 @@ func expectedShutdownManagerImage(shutdownManager *egv1a1.ShutdownManager) strin
 func expectedShutdownManagerArgs(cfg *egv1a1.ShutdownConfig) []string {
 	args := []string{"envoy", "shutdown-manager"}
 	if cfg != nil && cfg.DrainTimeout != nil {
-		args = append(args, fmt.Sprintf("--ready-timeout=%.0fs", cfg.DrainTimeout.Seconds()+10))
+		d, err := time.ParseDuration(string(*cfg.DrainTimeout))
+		if err != nil {
+			return nil
+		}
+		args = append(args, fmt.Sprintf("--ready-timeout=%.0fs", d.Seconds()+10))
 	}
 	return args
 }
@@ -270,11 +275,19 @@ func expectedShutdownPreStopCommand(cfg *egv1a1.ShutdownConfig) []string {
 	}
 
 	if cfg.DrainTimeout != nil {
-		command = append(command, fmt.Sprintf("--drain-timeout=%.0fs", cfg.DrainTimeout.Seconds()))
+		d, err := time.ParseDuration(string(*cfg.DrainTimeout))
+		if err != nil {
+			return nil
+		}
+		command = append(command, fmt.Sprintf("--drain-timeout=%.0fs", d.Seconds()))
 	}
 
 	if cfg.MinDrainDuration != nil {
-		command = append(command, fmt.Sprintf("--min-drain-duration=%.0fs", cfg.MinDrainDuration.Seconds()))
+		d, err := time.ParseDuration(string(*cfg.MinDrainDuration))
+		if err != nil {
+			return nil
+		}
+		command = append(command, fmt.Sprintf("--min-drain-duration=%.0fs", d.Seconds()))
 	}
 
 	return command
diff --git a/internal/infrastructure/kubernetes/proxy/resource_provider.go b/internal/infrastructure/kubernetes/proxy/resource_provider.go
index 61adadaff..a7c173977 100644
--- a/internal/infrastructure/kubernetes/proxy/resource_provider.go
+++ b/internal/infrastructure/kubernetes/proxy/resource_provider.go
@@ -9,6 +9,7 @@ import (
 	"context"
 	"fmt"
 	"strconv"
+	"time"
 
 	"golang.org/x/exp/maps"
 	appsv1 "k8s.io/api/apps/v1"
@@ -631,7 +632,11 @@ func (r *ResourceRender) HorizontalPodAutoscaler() (*autoscalingv2.HorizontalPod
 func expectedTerminationGracePeriodSeconds(cfg *egv1a1.ShutdownConfig) *int64 {
 	s := 360 // default
 	if cfg != nil && cfg.DrainTimeout != nil {
-		s = int(cfg.DrainTimeout.Seconds() + 300) // 5 minutes longer than drain timeout
+		d, err := time.ParseDuration(string(*cfg.DrainTimeout))
+		if err != nil {
+			return nil
+		}
+		s = int(d.Seconds() + 300) // 5 minutes longer than drain timeout
 	}
 	return ptr.To(int64(s))
 }
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
index 477d8896c..4b6f24288 100644
--- a/internal/ir/xds.go
+++ b/internal/ir/xds.go
@@ -132,6 +132,11 @@ func (p *PrivateBytes) UnmarshalJSON(data []byte) error {
 	return err
 }
 
+// MetaV1DurationPtr converts a time.Duration to a *metav1.Duration
+func MetaV1DurationPtr(d time.Duration) *metav1.Duration {
+	return &metav1.Duration{Duration: d}
+}
+
 // Xds holds the intermediate representation of a Gateway and is
 // used by the xDS Translator to convert it into xDS resources.
 // +k8s:deepcopy-gen=true
diff --git a/internal/metrics/register.go b/internal/metrics/register.go
index 51c3f9761..cb1d761be 100644
--- a/internal/metrics/register.go
+++ b/internal/metrics/register.go
@@ -112,9 +112,8 @@ func (r *Runner) newOptions() (registerOptions, error) {
 		newOpts.pullOptions.disable = true
 	} else {
 		newOpts.pullOptions.disable = false
-		restclient.RegisterClientMetricsWithoutRequestTotal(metricsserver.Registry)
-		// Workqueue metrics are already registered in controller-runtime. Use another registry.
 		reg := prometheus.NewRegistry()
+		restclient.RegisterClientMetricsWithoutRequestTotal(reg)
 		workqueue.RegisterMetrics(reg)
 		newOpts.pullOptions.registry = metricsserver.Registry
 		newOpts.pullOptions.gatherer = prometheus.Gatherers{
diff --git a/internal/xds/runner/runner.go b/internal/xds/runner/runner.go
index 7262739ef..51d172b35 100644
--- a/internal/xds/runner/runner.go
+++ b/internal/xds/runner/runner.go
@@ -230,7 +230,13 @@ func (r *Runner) subscribeAndTranslate(sub <-chan watchable.Snapshot[string, *ir
 						FailClosed: r.EnvoyGateway.RateLimit.FailClosed,
 					}
 					if r.EnvoyGateway.RateLimit.Timeout != nil {
-						t.GlobalRateLimit.Timeout = r.EnvoyGateway.RateLimit.Timeout.Duration
+						d, err := time.ParseDuration(string(*r.EnvoyGateway.RateLimit.Timeout))
+						if err != nil {
+							r.Logger.Error(err, "invalid rateLimit timeout")
+							errChan <- err
+						} else {
+							t.GlobalRateLimit.Timeout = d
+						}
 					}
 				}
 
diff --git a/internal/xds/translator/cluster.go b/internal/xds/translator/cluster.go
index 3aa5d4952..a4b98ee6b 100644
--- a/internal/xds/translator/cluster.go
+++ b/internal/xds/translator/cluster.go
@@ -422,9 +422,7 @@ func buildXdsCluster(args *xdsClusterArgs) (*buildClusterResult, error) {
 		cluster.RespectDnsTtl = true
 		if args.dns != nil {
 			if args.dns.DNSRefreshRate != nil {
-				if args.dns.DNSRefreshRate.Duration > 0 {
-					cluster.DnsRefreshRate = durationpb.New(args.dns.DNSRefreshRate.Duration)
-				}
+				cluster.DnsRefreshRate = durationpb.New(args.dns.DNSRefreshRate.Duration)
 			}
 			if args.dns.RespectDNSTTL != nil {
 				cluster.RespectDnsTtl = ptr.Deref(args.dns.RespectDNSTTL, true)
diff --git a/internal/xds/translator/route.go b/internal/xds/translator/route.go
index f07f80d8e..5cda9f063 100644
--- a/internal/xds/translator/route.go
+++ b/internal/xds/translator/route.go
@@ -626,7 +626,11 @@ func buildHashPolicy(httpRoute *ir.HTTPRoute) []*routev3.RouteAction_HashPolicy
 			},
 		}
 		if ch.Cookie.TTL != nil {
-			hashPolicy.GetCookie().Ttl = durationpb.New(ch.Cookie.TTL.Duration)
+			d, err := time.ParseDuration(string(*ch.Cookie.TTL))
+			if err != nil {
+				return nil
+			}
+			hashPolicy.GetCookie().Ttl = durationpb.New(d)
 		}
 		if ch.Cookie.Attributes != nil {
 			attributes := make([]*routev3.RouteAction_HashPolicy_CookieAttribute, 0, len(ch.Cookie.Attributes))
diff --git a/release-notes/current.yaml b/release-notes/current.yaml
index b6a5e8606..231985117 100644
--- a/release-notes/current.yaml
+++ b/release-notes/current.yaml
@@ -12,6 +12,7 @@ new features: |
   Added Gateway Listeners to the xDS listener metadata.
 
 bug fixes: |
+  Fixed an issue that controller panic when reloading configuration.
 
 # Enhancements that improve performance.
 performance improvements: |



Test patch:
diff --git a/internal/envoygateway/config/decoder_test.go b/internal/envoygateway/config/decoder_test.go
index cd49d89ff..568a08b6f 100644
--- a/internal/envoygateway/config/decoder_test.go
+++ b/internal/envoygateway/config/decoder_test.go
@@ -195,9 +195,7 @@ func TestDecode(t *testing.T) {
 					Provider: egv1a1.DefaultEnvoyGatewayProvider(),
 					Gateway:  egv1a1.DefaultGateway(),
 					RateLimit: &egv1a1.RateLimit{
-						Timeout: &metav1.Duration{
-							Duration: 10000000,
-						},
+						Timeout:    ptr.To(gwapiv1.Duration("10ms")),
 						FailClosed: true,
 						Backend: egv1a1.RateLimitDatabaseBackend{
 							Type: egv1a1.RedisBackendType,
diff --git a/internal/gatewayapi/resource/testdata/all-resources.out.yaml b/internal/gatewayapi/resource/testdata/all-resources.out.yaml
index f6acba05d..69ac8ade7 100644
--- a/internal/gatewayapi/resource/testdata/all-resources.out.yaml
+++ b/internal/gatewayapi/resource/testdata/all-resources.out.yaml
@@ -45,7 +45,7 @@ backendTrafficPolicies:
           attributes:
             SameSite: Strict
           name: Lb-Test-Cookie
-          ttl: 1m0s
+          ttl: 60s
         tableSize: 65537
         type: Cookie
       type: ConsistentHash
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
index 20cf9e2af..5f679cf77 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
@@ -92,7 +92,7 @@ backendTrafficPolicies:
         type: HTTP
         unhealthyThreshold: 3
       passive:
-        baseEjectionTime: 2m30s
+        baseEjectionTime: 150s
         consecutive5XxErrors: 5
         consecutiveGatewayErrors: 0
         consecutiveLocalOriginFailures: 5
@@ -188,7 +188,7 @@ backendTrafficPolicies:
         type: TCP
         unhealthyThreshold: 3
       passive:
-        baseEjectionTime: 2m40s
+        baseEjectionTime: 160s
         consecutive5XxErrors: 5
         consecutiveGatewayErrors: 0
         consecutiveLocalOriginFailures: 5
@@ -312,7 +312,7 @@ backendTrafficPolicies:
         type: HTTP
         unhealthyThreshold: 3
       passive:
-        baseEjectionTime: 2m40s
+        baseEjectionTime: 160s
         consecutive5XxErrors: 5
         consecutiveGatewayErrors: 0
         consecutiveLocalOriginFailures: 5
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
index 3ad73faa0..ae77eb521 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
@@ -39,7 +39,7 @@ backendTrafficPolicies:
   spec:
     loadBalancer:
       slowStart:
-        window: 5m0s
+        window: 300s
       type: LeastRequest
     targetRef:
       group: gateway.networking.k8s.io
@@ -128,7 +128,7 @@ backendTrafficPolicies:
   spec:
     loadBalancer:
       slowStart:
-        window: 5m0s
+        window: 300s
       type: RoundRobin
       zoneAware:
         preferLocal:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-gateway.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-gateway.out.yaml
index a02130e69..bb297aa72 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-gateway.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-gateway.out.yaml
@@ -29,7 +29,7 @@ backendTrafficPolicies:
         type: HTTP
         unhealthyThreshold: 3
       passive:
-        baseEjectionTime: 2m40s
+        baseEjectionTime: 160s
         consecutive5XxErrors: 5
         consecutiveGatewayErrors: 0
         consecutiveLocalOriginFailures: 5
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-route.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-route.out.yaml
index 68bc27202..0d6f3dda2 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-route.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcp-udp-listeners-apply-on-route.out.yaml
@@ -29,7 +29,7 @@ backendTrafficPolicies:
         type: HTTP
         unhealthyThreshold: 3
       passive:
-        baseEjectionTime: 2m40s
+        baseEjectionTime: 160s
         consecutive5XxErrors: 5
         consecutiveGatewayErrors: 0
         consecutiveLocalOriginFailures: 5
@@ -101,7 +101,7 @@ backendTrafficPolicies:
         type: HTTP
         unhealthyThreshold: 3
       passive:
-        baseEjectionTime: 2m40s
+        baseEjectionTime: 160s
         consecutive5XxErrors: 5
         consecutiveGatewayErrors: 0
         consecutiveLocalOriginFailures: 5
diff --git a/internal/gatewayapi/testdata/conflicting-policies.out.yaml b/internal/gatewayapi/testdata/conflicting-policies.out.yaml
index 0ef3c928d..9db433b2f 100644
--- a/internal/gatewayapi/testdata/conflicting-policies.out.yaml
+++ b/internal/gatewayapi/testdata/conflicting-policies.out.yaml
@@ -244,7 +244,7 @@ securityPolicies:
       - OPTIONS
       allowOrigins:
       - http://*.foo.com
-      maxAge: 10m0s
+      maxAge: 600s
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
diff --git a/internal/gatewayapi/testdata/merge-with-isolated-policies-2.out.yaml b/internal/gatewayapi/testdata/merge-with-isolated-policies-2.out.yaml
index 572fb5b70..202571c4c 100644
--- a/internal/gatewayapi/testdata/merge-with-isolated-policies-2.out.yaml
+++ b/internal/gatewayapi/testdata/merge-with-isolated-policies-2.out.yaml
@@ -441,7 +441,7 @@ securityPolicies:
       exposeHeaders:
       - x-header-7
       - x-header-8
-      maxAge: 33m20s
+      maxAge: 2000s
     targetRef:
       group: gateway.networking.k8s.io
       kind: HTTPRoute
@@ -480,7 +480,7 @@ securityPolicies:
       exposeHeaders:
       - x-header-7
       - x-header-8
-      maxAge: 33m20s
+      maxAge: 2000s
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
diff --git a/internal/gatewayapi/testdata/merge-with-isolated-policies.out.yaml b/internal/gatewayapi/testdata/merge-with-isolated-policies.out.yaml
index 6625c69cd..442b0e5ad 100644
--- a/internal/gatewayapi/testdata/merge-with-isolated-policies.out.yaml
+++ b/internal/gatewayapi/testdata/merge-with-isolated-policies.out.yaml
@@ -272,7 +272,7 @@ securityPolicies:
       exposeHeaders:
       - x-header-7
       - x-header-8
-      maxAge: 33m20s
+      maxAge: 2000s
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
diff --git a/internal/gatewayapi/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml b/internal/gatewayapi/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
index e07797a05..3e0841057 100644
--- a/internal/gatewayapi/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
@@ -81,7 +81,7 @@ securityPolicies:
       exposeHeaders:
       - x-header-3
       - x-header-4
-      maxAge: 16m40s
+      maxAge: 1000s
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
diff --git a/internal/gatewayapi/testdata/securitypolicy-override-replace.out.yaml b/internal/gatewayapi/testdata/securitypolicy-override-replace.out.yaml
index a8d6184b0..d857ab195 100644
--- a/internal/gatewayapi/testdata/securitypolicy-override-replace.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-override-replace.out.yaml
@@ -375,7 +375,7 @@ securityPolicies:
       exposeHeaders:
       - x-header-7
       - x-header-8
-      maxAge: 33m20s
+      maxAge: 2000s
     targetRef:
       group: gateway.networking.k8s.io
       kind: HTTPRoute
@@ -405,7 +405,7 @@ securityPolicies:
     cors:
       allowOrigins:
       - http://*.example.com
-      maxAge: 16m40s
+      maxAge: 1000s
     targetRef:
       group: gateway.networking.k8s.io
       kind: HTTPRoute
@@ -516,7 +516,7 @@ securityPolicies:
       exposeHeaders:
       - x-header-3
       - x-header-4
-      maxAge: 16m40s
+      maxAge: 1000s
     jwt:
       providers:
       - audiences:
diff --git a/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
index 3f11863d2..18deec720 100644
--- a/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
@@ -286,7 +286,7 @@ securityPolicies:
     cors:
       allowOrigins:
       - http://*.example.com
-      maxAge: 16m40s
+      maxAge: 1000s
     targetRef:
       group: gateway.networking.k8s.io
       kind: GRPCRoute
@@ -315,7 +315,7 @@ securityPolicies:
     cors:
       allowOrigins:
       - http://*.example.com
-      maxAge: 16m40s
+      maxAge: 1000s
     targetRef:
       group: gateway.networking.k8s.io
       kind: HTTPRoute
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml
index 4c53e97e3..d78d56070 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-cors-targetrefs.out.yaml
@@ -313,7 +313,7 @@ securityPolicies:
       exposeHeaders:
       - x-header-3
       - x-header-4
-      maxAge: 16m40s
+      maxAge: 1000s
     targetRefs:
     - group: gateway.networking.k8s.io
       kind: Gateway
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
index 12847b3c3..c5d5cd3c3 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
@@ -309,7 +309,7 @@ securityPolicies:
       exposeHeaders:
       - x-header-7
       - x-header-8
-      maxAge: 33m20s
+      maxAge: 2000s
     targetRef:
       group: gateway.networking.k8s.io
       kind: HTTPRoute
@@ -348,7 +348,7 @@ securityPolicies:
       exposeHeaders:
       - x-header-7
       - x-header-8
-      maxAge: 33m20s
+      maxAge: 2000s
     targetRef:
       group: gateway.networking.k8s.io
       kind: HTTPRoute
@@ -389,7 +389,7 @@ securityPolicies:
       exposeHeaders:
       - x-header-3
       - x-header-4
-      maxAge: 16m40s
+      maxAge: 1000s
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendcluster.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendcluster.out.yaml
index 60064b6ed..7fb6248bd 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendcluster.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendcluster.out.yaml
@@ -164,8 +164,8 @@ securityPolicies:
         group: null
         kind: null
         name: client1-secret
-      defaultRefreshTokenTTL: 24h0m0s
-      defaultTokenTTL: 30m0s
+      defaultRefreshTokenTTL: 24h
+      defaultTokenTTL: 30m
       forwardAccessToken: true
       logoutPath: /bar/logout
       provider:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendrefs.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendrefs.out.yaml
index 7b875d44f..883cf1da6 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendrefs.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-backendrefs.out.yaml
@@ -150,8 +150,8 @@ securityPolicies:
         group: null
         kind: null
         name: client1-secret
-      defaultRefreshTokenTTL: 24h0m0s
-      defaultTokenTTL: 30m0s
+      defaultRefreshTokenTTL: 24h
+      defaultTokenTTL: 30m
       forwardAccessToken: true
       logoutPath: /bar/logout
       provider:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc-serviceimport.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc-serviceimport.out.yaml
index d1ff5a259..6b7d8f33c 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc-serviceimport.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc-serviceimport.out.yaml
@@ -146,8 +146,8 @@ securityPolicies:
         group: null
         kind: null
         name: client1-secret
-      defaultRefreshTokenTTL: 24h0m0s
-      defaultTokenTTL: 30m0s
+      defaultRefreshTokenTTL: 24h
+      defaultTokenTTL: 30m
       forwardAccessToken: true
       logoutPath: /bar/logout
       provider:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
index 9f3d3627a..1c603f298 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
@@ -155,8 +155,8 @@ securityPolicies:
         kind: null
         name: client2-secret
       cookieDomain: example.com
-      defaultRefreshTokenTTL: 48h0m0s
-      defaultTokenTTL: 1h0m0s
+      defaultRefreshTokenTTL: 48h
+      defaultTokenTTL: 1h
       forwardAccessToken: true
       logoutPath: /foo/logout
       provider:
@@ -204,8 +204,8 @@ securityPolicies:
         group: null
         kind: null
         name: client1-secret
-      defaultRefreshTokenTTL: 24h0m0s
-      defaultTokenTTL: 30m0s
+      defaultRefreshTokenTTL: 24h
+      defaultTokenTTL: 30m
       forwardAccessToken: true
       logoutPath: /bar/logout
       provider:
diff --git a/internal/infrastructure/kubernetes/proxy/resource_provider_test.go b/internal/infrastructure/kubernetes/proxy/resource_provider_test.go
index def8a1893..8e78d1a60 100644
--- a/internal/infrastructure/kubernetes/proxy/resource_provider_test.go
+++ b/internal/infrastructure/kubernetes/proxy/resource_provider_test.go
@@ -11,7 +11,6 @@ import (
 	"os"
 	"sort"
 	"testing"
-	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -25,6 +24,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/utils/ptr"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 	"sigs.k8s.io/yaml"
 
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
@@ -293,12 +293,8 @@ func TestDeployment(t *testing.T) {
 				},
 			},
 			shutdown: &egv1a1.ShutdownConfig{
-				DrainTimeout: &metav1.Duration{
-					Duration: 30 * time.Second,
-				},
-				MinDrainDuration: &metav1.Duration{
-					Duration: 15 * time.Second,
-				},
+				DrainTimeout:     ptr.To(gwapiv1.Duration("30s")),
+				MinDrainDuration: ptr.To(gwapiv1.Duration("15s")),
 			},
 			shutdownManager: &egv1a1.ShutdownManager{
 				Image: ptr.To("privaterepo/envoyproxy/gateway-dev:v1.2.3"),
@@ -865,12 +861,8 @@ func TestDaemonSet(t *testing.T) {
 				},
 			},
 			shutdown: &egv1a1.ShutdownConfig{
-				DrainTimeout: &metav1.Duration{
-					Duration: 30 * time.Second,
-				},
-				MinDrainDuration: &metav1.Duration{
-					Duration: 15 * time.Second,
-				},
+				DrainTimeout:     ptr.To(gwapiv1.Duration("30s")),
+				MinDrainDuration: ptr.To(gwapiv1.Duration("15s")),
 			},
 		},
 		{
diff --git a/internal/ir/xds_test.go b/internal/ir/xds_test.go
index 6cebc99dc..429e35ef2 100644
--- a/internal/ir/xds_test.go
+++ b/internal/ir/xds_test.go
@@ -15,7 +15,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 
@@ -1533,8 +1532,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			name: "invalid timeout",
 			input: HealthCheck{
 				&ActiveHealthCheck{
-					Timeout:            &metav1.Duration{Duration: time.Duration(0)},
-					Interval:           &metav1.Duration{Duration: time.Second},
+					Timeout:            MetaV1DurationPtr(time.Duration(0)),
+					Interval:           MetaV1DurationPtr(time.Second),
 					UnhealthyThreshold: ptr.To[uint32](3),
 					HealthyThreshold:   ptr.To[uint32](3),
 					HTTP: &HTTPHealthChecker{
@@ -1551,8 +1550,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			name: "invalid panic threshold",
 			input: HealthCheck{
 				&ActiveHealthCheck{
-					Timeout:            &metav1.Duration{Duration: time.Duration(3)},
-					Interval:           &metav1.Duration{Duration: time.Second},
+					Timeout:            MetaV1DurationPtr(time.Duration(3)),
+					Interval:           MetaV1DurationPtr(time.Second),
 					UnhealthyThreshold: ptr.To[uint32](3),
 					HealthyThreshold:   ptr.To[uint32](3),
 					HTTP: &HTTPHealthChecker{
@@ -1569,8 +1568,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			name: "invalid interval",
 			input: HealthCheck{
 				&ActiveHealthCheck{
-					Timeout:            &metav1.Duration{Duration: time.Second},
-					Interval:           &metav1.Duration{Duration: time.Duration(0)},
+					Timeout:            MetaV1DurationPtr(time.Second),
+					Interval:           MetaV1DurationPtr(time.Duration(0)),
 					UnhealthyThreshold: ptr.To[uint32](3),
 					HealthyThreshold:   ptr.To[uint32](3),
 					HTTP: &HTTPHealthChecker{
@@ -1589,8 +1588,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			name: "invalid initial jitter",
 			input: HealthCheck{
 				&ActiveHealthCheck{
-					Timeout:            &metav1.Duration{Duration: time.Second},
-					Interval:           &metav1.Duration{Duration: time.Second},
+					Timeout:            MetaV1DurationPtr(time.Second),
+					Interval:           MetaV1DurationPtr(time.Second),
 					InitialJitter:      ptr.To(gwapiv1.Duration("-1s")),
 					UnhealthyThreshold: ptr.To[uint32](3),
 					HealthyThreshold:   ptr.To[uint32](3),
@@ -1610,8 +1609,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			name: "invalid unhealthy threshold",
 			input: HealthCheck{
 				&ActiveHealthCheck{
-					Timeout:            &metav1.Duration{Duration: time.Second},
-					Interval:           &metav1.Duration{Duration: time.Second},
+					Timeout:            MetaV1DurationPtr(time.Second),
+					Interval:           MetaV1DurationPtr(time.Second),
 					UnhealthyThreshold: ptr.To[uint32](0),
 					HealthyThreshold:   ptr.To[uint32](3),
 					HTTP: &HTTPHealthChecker{
@@ -1630,8 +1629,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			name: "invalid healthy threshold",
 			input: HealthCheck{
 				&ActiveHealthCheck{
-					Timeout:            &metav1.Duration{Duration: time.Second},
-					Interval:           &metav1.Duration{Duration: time.Second},
+					Timeout:            MetaV1DurationPtr(time.Second),
+					Interval:           MetaV1DurationPtr(time.Second),
 					UnhealthyThreshold: ptr.To[uint32](3),
 					HealthyThreshold:   ptr.To[uint32](0),
 					HTTP: &HTTPHealthChecker{
@@ -1650,8 +1649,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			name: "http-health-check: invalid host",
 			input: HealthCheck{
 				&ActiveHealthCheck{
-					Timeout:            &metav1.Duration{Duration: time.Second},
-					Interval:           &metav1.Duration{Duration: time.Second},
+					Timeout:            MetaV1DurationPtr(time.Second),
+					Interval:           MetaV1DurationPtr(time.Second),
 					UnhealthyThreshold: ptr.To[uint32](3),
 					HealthyThreshold:   ptr.To[uint32](3),
 					HTTP: &HTTPHealthChecker{
@@ -1669,8 +1668,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			name: "http-health-check: invalid path",
 			input: HealthCheck{
 				&ActiveHealthCheck{
-					Timeout:            &metav1.Duration{Duration: time.Second},
-					Interval:           &metav1.Duration{Duration: time.Second},
+					Timeout:            MetaV1DurationPtr(time.Second),
+					Interval:           MetaV1DurationPtr(time.Second),
 					UnhealthyThreshold: ptr.To[uint32](3),
 					HealthyThreshold:   ptr.To[uint32](3),
 					HTTP: &HTTPHealthChecker{
@@ -1689,8 +1688,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			name: "http-health-check: invalid method",
 			input: HealthCheck{
 				&ActiveHealthCheck{
-					Timeout:            &metav1.Duration{Duration: time.Second},
-					Interval:           &metav1.Duration{Duration: time.Second},
+					Timeout:            MetaV1DurationPtr(time.Second),
+					Interval:           MetaV1DurationPtr(time.Second),
 					UnhealthyThreshold: ptr.To(uint32(3)),
 					HealthyThreshold:   ptr.To(uint32(3)),
 					HTTP: &HTTPHealthChecker{
@@ -1709,8 +1708,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			name: "http-health-check: invalid expected-statuses",
 			input: HealthCheck{
 				&ActiveHealthCheck{
-					Timeout:            &metav1.Duration{Duration: time.Second},
-					Interval:           &metav1.Duration{Duration: time.Second},
+					Timeout:            MetaV1DurationPtr(time.Second),
+					Interval:           MetaV1DurationPtr(time.Second),
 					UnhealthyThreshold: ptr.To(uint32(3)),
 					HealthyThreshold:   ptr.To(uint32(3)),
 					HTTP: &HTTPHealthChecker{
@@ -1729,8 +1728,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			name: "http-health-check: invalid range",
 			input: HealthCheck{
 				&ActiveHealthCheck{
-					Timeout:            &metav1.Duration{Duration: time.Second},
-					Interval:           &metav1.Duration{Duration: time.Second},
+					Timeout:            MetaV1DurationPtr(time.Second),
+					Interval:           MetaV1DurationPtr(time.Second),
 					UnhealthyThreshold: ptr.To(uint32(3)),
 					HealthyThreshold:   ptr.To(uint32(3)),
 					HTTP: &HTTPHealthChecker{
@@ -1749,8 +1748,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			name: "http-health-check: invalid expected-responses",
 			input: HealthCheck{
 				&ActiveHealthCheck{
-					Timeout:            &metav1.Duration{Duration: time.Second},
-					Interval:           &metav1.Duration{Duration: time.Second},
+					Timeout:            MetaV1DurationPtr(time.Second),
+					Interval:           MetaV1DurationPtr(time.Second),
 					UnhealthyThreshold: ptr.To(uint32(3)),
 					HealthyThreshold:   ptr.To(uint32(3)),
 					HTTP: &HTTPHealthChecker{
@@ -1773,8 +1772,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			name: "tcp-health-check: invalid send payload",
 			input: HealthCheck{
 				&ActiveHealthCheck{
-					Timeout:            &metav1.Duration{Duration: time.Second},
-					Interval:           &metav1.Duration{Duration: time.Second},
+					Timeout:            MetaV1DurationPtr(time.Second),
+					Interval:           MetaV1DurationPtr(time.Second),
 					UnhealthyThreshold: ptr.To(uint32(3)),
 					HealthyThreshold:   ptr.To(uint32(3)),
 					TCP: &TCPHealthChecker{
@@ -1796,8 +1795,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			name: "tcp-health-check: invalid receive payload",
 			input: HealthCheck{
 				&ActiveHealthCheck{
-					Timeout:            &metav1.Duration{Duration: time.Second},
-					Interval:           &metav1.Duration{Duration: time.Second},
+					Timeout:            MetaV1DurationPtr(time.Second),
+					Interval:           MetaV1DurationPtr(time.Second),
 					UnhealthyThreshold: ptr.To(uint32(3)),
 					HealthyThreshold:   ptr.To(uint32(3)),
 					TCP: &TCPHealthChecker{
@@ -1820,8 +1819,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			input: HealthCheck{
 				&ActiveHealthCheck{},
 				&OutlierDetection{
-					Interval:         &metav1.Duration{Duration: time.Duration(0)},
-					BaseEjectionTime: &metav1.Duration{Duration: time.Second},
+					Interval:         MetaV1DurationPtr(time.Duration(0)),
+					BaseEjectionTime: MetaV1DurationPtr(time.Second),
 				},
 				ptr.To[uint32](10),
 			},
@@ -1832,8 +1831,8 @@ func TestValidateHealthCheck(t *testing.T) {
 			input: HealthCheck{
 				&ActiveHealthCheck{},
 				&OutlierDetection{
-					Interval:         &metav1.Duration{Duration: time.Second},
-					BaseEjectionTime: &metav1.Duration{Duration: time.Duration(0)},
+					Interval:         MetaV1DurationPtr(time.Second),
+					BaseEjectionTime: MetaV1DurationPtr(time.Duration(0)),
 				},
 				ptr.To[uint32](10),
 			},
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index f981a65bb..3c7539e52 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -129,8 +129,8 @@ _Appears in:_
 
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
-| `timeout` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  false  | 1s | Timeout defines the time to wait for a health check response. |
-| `interval` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  false  | 3s | Interval defines the time between active health checks. |
+| `timeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  | 1s | Timeout defines the time to wait for a health check response. |
+| `interval` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  | 3s | Interval defines the time between active health checks. |
 | `initialJitter` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | InitialJitter defines the maximum time Envoy will wait before the first health check.<br />Envoy will randomly select a value between 0 and the initial jitter value. |
 | `unhealthyThreshold` | _integer_ |  false  | 3 | UnhealthyThreshold defines the number of unhealthy health checks required before a backend host is marked unhealthy. |
 | `healthyThreshold` | _integer_ |  false  | 1 | HealthyThreshold defines the number of healthy health checks required before a backend host is marked healthy. |
@@ -280,8 +280,8 @@ _Appears in:_
 
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
-| `baseInterval` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  true  |  | BaseInterval is the base interval between retries. |
-| `maxInterval` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  false  |  | MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.<br />The default is 10 times the base_interval |
+| `baseInterval` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | BaseInterval is the base interval between retries. |
+| `maxInterval` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.<br />The default is 10 times the base_interval |
 
 
 #### Backend
@@ -630,7 +630,7 @@ _Appears in:_
 | `allowMethods` | _string array_ |  false  |  | AllowMethods defines the methods that are allowed to make requests.<br />It specifies the allowed methods in the Access-Control-Allow-Methods CORS response header..<br />The value "*" allows any method to be used. |
 | `allowHeaders` | _string array_ |  false  |  | AllowHeaders defines the headers that are allowed to be sent with requests.<br />It specifies the allowed headers in the Access-Control-Allow-Headers CORS response header..<br />The value "*" allows any header to be sent. |
 | `exposeHeaders` | _string array_ |  false  |  | ExposeHeaders defines which response headers should be made accessible to<br />scripts running in the browser.<br />It specifies the headers in the Access-Control-Expose-Headers CORS response header..<br />The value "*" allows any header to be exposed. |
-| `maxAge` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  false  |  | MaxAge defines how long the results of a preflight request can be cached.<br />It specifies the value in the Access-Control-Max-Age CORS response header.. |
+| `maxAge` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | MaxAge defines how long the results of a preflight request can be cached.<br />It specifies the value in the Access-Control-Max-Age CORS response header.. |
 | `allowCredentials` | _boolean_ |  false  |  | AllowCredentials indicates whether a request can include user credentials<br />like cookies, authentication headers, or TLS client certificates.<br />It specifies the value in the Access-Control-Allow-Credentials CORS response header. |
 
 
@@ -960,7 +960,7 @@ _Appears in:_
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
 | `name` | _string_ |  true  |  | Name of the cookie to hash.<br />If this cookie does not exist in the request, Envoy will generate a cookie and set<br />the TTL on the response back to the client based on Layer 4<br />attributes of the backend endpoint, to ensure that these future requests<br />go to the same backend endpoint. Make sure to set the TTL field for this case. |
-| `ttl` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  false  |  | TTL of the generated cookie if the cookie is not present. This value sets the<br />Max-Age attribute value. |
+| `ttl` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | TTL of the generated cookie if the cookie is not present. This value sets the<br />Max-Age attribute value. |
 | `attributes` | _object (keys:string, values:string)_ |  false  |  | Additional Attributes to set for the generated cookie. |
 
 
@@ -1093,8 +1093,8 @@ _Appears in:_
 
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
-| `dnsRefreshRate` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  true  |  | DNSRefreshRate specifies the rate at which DNS records should be refreshed.<br />Defaults to 30 seconds. |
-| `respectDnsTtl` | _boolean_ |  true  |  | RespectDNSTTL indicates whether the DNS Time-To-Live (TTL) should be respected.<br />If the value is set to true, the DNS refresh rate will be set to the resource record’s TTL.<br />Defaults to true. |
+| `dnsRefreshRate` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | DNSRefreshRate specifies the rate at which DNS records should be refreshed.<br />Defaults to 30 seconds. |
+| `respectDnsTtl` | _boolean_ |  false  |  | RespectDNSTTL indicates whether the DNS Time-To-Live (TTL) should be respected.<br />If the value is set to true, the DNS refresh rate will be set to the resource record’s TTL.<br />Defaults to true. |
 | `lookupFamily` | _[DNSLookupFamily](#dnslookupfamily)_ |  false  |  | LookupFamily determines how Envoy would resolve DNS for Routes where the backend is specified as a fully qualified domain name (FQDN).<br />If set, this configuration overrides other defaults. |
 
 
@@ -1995,7 +1995,7 @@ _Appears in:_
 
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
-| `fixedDelay` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  true  |  | FixedDelay specifies the fixed delay duration |
+| `fixedDelay` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  true  |  | FixedDelay specifies the fixed delay duration |
 | `percentage` | _float_ |  false  | 100 | Percentage specifies the percentage of requests to be delayed. Default 100%, if set 0, no requests will be delayed. Accuracy to 0.0001%. |
 
 
@@ -3097,9 +3097,9 @@ _Appears in:_
 
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
-| `leaseDuration` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  true  |  | LeaseDuration defines the time non-leader contenders will wait before attempting to claim leadership.<br />It's based on the timestamp of the last acknowledged signal. The default setting is 15 seconds. |
-| `renewDeadline` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  true  |  | RenewDeadline represents the time frame within which the current leader will attempt to renew its leadership<br />status before relinquishing its position. The default setting is 10 seconds. |
-| `retryPeriod` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  true  |  | RetryPeriod denotes the interval at which LeaderElector clients should perform action retries.<br />The default setting is 2 seconds. |
+| `leaseDuration` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | LeaseDuration defines the time non-leader contenders will wait before attempting to claim leadership.<br />It's based on the timestamp of the last acknowledged signal.<br />The default setting is 15 seconds. |
+| `renewDeadline` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | RenewDeadline represents the time frame within which the current leader will attempt to renew its leadership<br />status before relinquishing its position.<br />The default setting is 10 seconds. |
+| `retryPeriod` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | RetryPeriod denotes the interval at which LeaderElector clients should perform action retries.<br />The default setting is 2 seconds. |
 | `disable` | _boolean_ |  true  |  | Disable provides the option to turn off leader election, which is enabled by default. |
 
 
@@ -3334,9 +3334,9 @@ _Appears in:_
 | `denyRedirect` | _[OIDCDenyRedirect](#oidcdenyredirect)_ |  false  |  | Any request that matches any of the provided matchers (with either tokens that are expired or missing tokens) will not be redirected to the OIDC Provider.<br />This behavior can be useful for AJAX or machine requests. |
 | `logoutPath` | _string_ |  true  |  | The path to log a user out, clearing their credential cookies.<br />If not specified, uses a default logout path "/logout" |
 | `forwardAccessToken` | _boolean_ |  false  |  | ForwardAccessToken indicates whether the Envoy should forward the access token<br />via the Authorization header Bearer scheme to the upstream.<br />If not specified, defaults to false. |
-| `defaultTokenTTL` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  false  |  | DefaultTokenTTL is the default lifetime of the id token and access token.<br />Please note that Envoy will always use the expiry time from the response<br />of the authorization server if it is provided. This field is only used when<br />the expiry time is not provided by the authorization.<br />If not specified, defaults to 0. In this case, the "expires_in" field in<br />the authorization response must be set by the authorization server, or the<br />OAuth flow will fail. |
+| `defaultTokenTTL` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | DefaultTokenTTL is the default lifetime of the id token and access token.<br />Please note that Envoy will always use the expiry time from the response<br />of the authorization server if it is provided. This field is only used when<br />the expiry time is not provided by the authorization.<br />If not specified, defaults to 0. In this case, the "expires_in" field in<br />the authorization response must be set by the authorization server, or the<br />OAuth flow will fail. |
 | `refreshToken` | _boolean_ |  false  |  | RefreshToken indicates whether the Envoy should automatically refresh the<br />id token and access token when they expire.<br />When set to true, the Envoy will use the refresh token to get a new id token<br />and access token when they expire.<br />If not specified, defaults to false. |
-| `defaultRefreshTokenTTL` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  false  |  | DefaultRefreshTokenTTL is the default lifetime of the refresh token.<br />This field is only used when the exp (expiration time) claim is omitted in<br />the refresh token or the refresh token is not JWT.<br />If not specified, defaults to 604800s (one week).<br />Note: this field is only applicable when the "refreshToken" field is set to true. |
+| `defaultRefreshTokenTTL` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | DefaultRefreshTokenTTL is the default lifetime of the refresh token.<br />This field is only used when the exp (expiration time) claim is omitted in<br />the refresh token or the refresh token is not JWT.<br />If not specified, defaults to 604800s (one week).<br />Note: this field is only applicable when the "refreshToken" field is set to true. |
 | `passThroughAuthHeader` | _boolean_ |  false  |  | Skips OIDC authentication when the request contains a header that will be extracted by the JWT filter. Unless<br />explicitly stated otherwise in the extractFrom field, this will be the "Authorization: Bearer ..." header.<br />The passThroughAuthHeader option is typically used for non-browser clients that may not be able to handle OIDC<br />redirects and wish to directly supply a token instead.<br />If not specified, defaults to false. |
 
 
@@ -3504,11 +3504,11 @@ _Appears in:_
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
 | `splitExternalLocalOriginErrors` | _boolean_ |  false  | false | SplitExternalLocalOriginErrors enables splitting of errors between external and local origin. |
-| `interval` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  false  | 3s | Interval defines the time between passive health checks. |
+| `interval` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  | 3s | Interval defines the time between passive health checks. |
 | `consecutiveLocalOriginFailures` | _integer_ |  false  | 5 | ConsecutiveLocalOriginFailures sets the number of consecutive local origin failures triggering ejection.<br />Parameter takes effect only when split_external_local_origin_errors is set to true. |
 | `consecutiveGatewayErrors` | _integer_ |  false  | 0 | ConsecutiveGatewayErrors sets the number of consecutive gateway errors triggering ejection. |
 | `consecutive5XxErrors` | _integer_ |  false  | 5 | Consecutive5xxErrors sets the number of consecutive 5xx errors triggering ejection. |
-| `baseEjectionTime` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  false  | 30s | BaseEjectionTime defines the base duration for which a host will be ejected on consecutive failures. |
+| `baseEjectionTime` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  | 30s | BaseEjectionTime defines the base duration for which a host will be ejected on consecutive failures. |
 | `maxEjectionPercent` | _integer_ |  false  | 10 | MaxEjectionPercent sets the maximum percentage of hosts in a cluster that can be ejected. |
 
 
@@ -3570,7 +3570,7 @@ _Appears in:_
 
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
-| `timeout` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  false  |  | Timeout is the timeout per retry attempt. |
+| `timeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | Timeout is the timeout per retry attempt. |
 | `backOff` | _[BackOffPolicy](#backoffpolicy)_ |  false  |  | Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential<br />back-off algorithm for retries. For additional details,<br />see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries |
 
 
@@ -4003,7 +4003,7 @@ _Appears in:_
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
 | `backend` | _[RateLimitDatabaseBackend](#ratelimitdatabasebackend)_ |  true  |  | Backend holds the configuration associated with the<br />database backend used by the rate limit service to store<br />state associated with global ratelimiting. |
-| `timeout` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  false  |  | Timeout specifies the timeout period for the proxy to access the ratelimit server<br />If not set, timeout is 20ms. |
+| `timeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | Timeout specifies the timeout period for the proxy to access the ratelimit server<br />If not set, timeout is 20ms. |
 | `failClosed` | _boolean_ |  true  |  | FailClosed is a switch used to control the flow of traffic<br />when the response from the ratelimit server cannot be obtained.<br />If FailClosed is false, let the traffic pass,<br />otherwise, don't let the traffic pass and return 500.<br />If not set, FailClosed is False. |
 | `telemetry` | _[RateLimitTelemetry](#ratelimittelemetry)_ |  false  |  | Telemetry defines telemetry configuration for RateLimit. |
 
@@ -4673,8 +4673,8 @@ _Appears in:_
 
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
-| `drainTimeout` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  false  |  | DrainTimeout defines the graceful drain timeout. This should be less than the pod's terminationGracePeriodSeconds.<br />If unspecified, defaults to 60 seconds. |
-| `minDrainDuration` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  false  |  | MinDrainDuration defines the minimum drain duration allowing time for endpoint deprogramming to complete.<br />If unspecified, defaults to 10 seconds. |
+| `drainTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | DrainTimeout defines the graceful drain timeout. This should be less than the pod's terminationGracePeriodSeconds.<br />If unspecified, defaults to 60 seconds. |
+| `minDrainDuration` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | MinDrainDuration defines the minimum drain duration allowing time for endpoint deprogramming to complete.<br />If unspecified, defaults to 10 seconds. |
 
 
 #### ShutdownManager
@@ -4702,7 +4702,7 @@ _Appears in:_
 
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
-| `window` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  true  |  | Window defines the duration of the warm up period for newly added host.<br />During slow start window, traffic sent to the newly added hosts will gradually increase.<br />Currently only supports linear growth of traffic. For additional details,<br />see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig |
+| `window` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  true  |  | Window defines the duration of the warm up period for newly added host.<br />During slow start window, traffic sent to the newly added hosts will gradually increase.<br />Currently only supports linear growth of traffic. For additional details,<br />see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig |
 
 
 #### SourceMatch
diff --git a/test/cel-validation/backendtrafficpolicy_test.go b/test/cel-validation/backendtrafficpolicy_test.go
index f0259ad11..17986a5ae 100644
--- a/test/cel-validation/backendtrafficpolicy_test.go
+++ b/test/cel-validation/backendtrafficpolicy_test.go
@@ -432,9 +432,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 						LoadBalancer: &egv1a1.LoadBalancer{
 							Type: egv1a1.LeastRequestLoadBalancerType,
 							SlowStart: &egv1a1.SlowStart{
-								Window: &metav1.Duration{
-									Duration: 10000000,
-								},
+								Window: ptr.To(gwapiv1.Duration("10ms")),
 							},
 						},
 					},
@@ -459,9 +457,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 						LoadBalancer: &egv1a1.LoadBalancer{
 							Type: egv1a1.RoundRobinLoadBalancerType,
 							SlowStart: &egv1a1.SlowStart{
-								Window: &metav1.Duration{
-									Duration: 10000000,
-								},
+								Window: ptr.To(gwapiv1.Duration("10ms")),
 							},
 						},
 					},
@@ -486,9 +482,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 						LoadBalancer: &egv1a1.LoadBalancer{
 							Type: egv1a1.RandomLoadBalancerType,
 							SlowStart: &egv1a1.SlowStart{
-								Window: &metav1.Duration{
-									Duration: 10000000,
-								},
+								Window: ptr.To(gwapiv1.Duration("10ms")),
 							},
 						},
 					},
@@ -515,9 +509,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 						LoadBalancer: &egv1a1.LoadBalancer{
 							Type: egv1a1.ConsistentHashLoadBalancerType,
 							SlowStart: &egv1a1.SlowStart{
-								Window: &metav1.Duration{
-									Duration: 10000000,
-								},
+								Window: ptr.To(gwapiv1.Duration("10ms")),
 							},
 						},
 					},
@@ -653,9 +645,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 					},
 					FaultInjection: &egv1a1.FaultInjection{
 						Delay: &egv1a1.FaultInjectionDelay{
-							FixedDelay: &metav1.Duration{
-								Duration: 10000000,
-							},
+							FixedDelay: ptr.To(gwapiv1.Duration("10ms")),
 						},
 					},
 				}
diff --git a/test/cel-validation/securitypolicy_test.go b/test/cel-validation/securitypolicy_test.go
index 10a057894..9f8f8b4d4 100644
--- a/test/cel-validation/securitypolicy_test.go
+++ b/test/cel-validation/securitypolicy_test.go
@@ -1315,12 +1315,8 @@ func TestSecurityPolicyTarget(t *testing.T) {
 										NumRetries: ptr.To(int32(3)),
 										PerRetry: &egv1a1.PerRetryPolicy{
 											BackOff: &egv1a1.BackOffPolicy{
-												BaseInterval: &metav1.Duration{
-													Duration: time.Second * 1,
-												},
-												MaxInterval: &metav1.Duration{
-													Duration: time.Second * 10,
-												},
+												BaseInterval: ptr.To(gwapiv1.Duration("1s")),
+												MaxInterval:  ptr.To(gwapiv1.Duration("10s")),
 											},
 										},
 										RetryOn: &egv1a1.RetryOn{
@@ -1366,9 +1362,7 @@ func TestSecurityPolicyTarget(t *testing.T) {
 									Retry: &egv1a1.Retry{
 										NumRetries: ptr.To(int32(3)),
 										PerRetry: &egv1a1.PerRetryPolicy{
-											Timeout: &metav1.Duration{
-												Duration: time.Second * 10,
-											},
+											Timeout: ptr.To(gwapiv1.Duration("10s")),
 										},
 										RetryOn: &egv1a1.RetryOn{
 											HTTPStatusCodes: []egv1a1.HTTPStatus{500},
diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml
index f7461db76..575b0950c 100644
--- a/test/helm/gateway-crds-helm/all.out.yaml
+++ b/test/helm/gateway-crds-helm/all.out.yaml
@@ -17820,6 +17820,7 @@ spec:
                     description: |-
                       DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                       Defaults to 30 seconds.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   lookupFamily:
                     description: |-
@@ -17878,6 +17879,7 @@ spec:
                     properties:
                       fixedDelay:
                         description: FixedDelay specifies the fixed delay duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       percentage:
                         default: 100
@@ -17992,14 +17994,13 @@ spec:
                         description: |-
                           InitialJitter defines the maximum time Envoy will wait before the first health check.
                           Envoy will randomly select a value between 0 and the initial jitter value.
-                        format: duration
                         pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       interval:
                         default: 3s
                         description: Interval defines the time between active health
                           checks.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       tcp:
                         description: |-
@@ -18073,7 +18074,7 @@ spec:
                         default: 1s
                         description: Timeout defines the time to wait for a health
                           check response.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       type:
                         allOf:
@@ -18124,7 +18125,7 @@ spec:
                         default: 30s
                         description: BaseEjectionTime defines the base duration for
                           which a host will be ejected on consecutive failures.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       consecutive5XxErrors:
                         default: 5
@@ -18149,7 +18150,7 @@ spec:
                         default: 3s
                         description: Interval defines the time between passive health
                           checks.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       maxEjectionPercent:
                         default: 10
@@ -18268,6 +18269,7 @@ spec:
                             description: |-
                               TTL of the generated cookie if the cookie is not present. This value sets the
                               Max-Age attribute value.
+                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                             type: string
                         required:
                         - name
@@ -18351,6 +18353,7 @@ spec:
                           During slow start window, traffic sent to the newly added hosts will gradually increase.
                           Currently only supports linear growth of traffic. For additional details,
                           see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                     required:
                     - window
@@ -19286,18 +19289,18 @@ spec:
                           baseInterval:
                             description: BaseInterval is the base interval between
                               retries.
-                            format: duration
+                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                             type: string
                           maxInterval:
                             description: |-
                               MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                               The default is 10 times the base_interval
-                            format: duration
+                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                             type: string
                         type: object
                       timeout:
                         description: Timeout is the timeout per retry attempt.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                     type: object
                   retryOn:
@@ -21764,6 +21767,7 @@ spec:
                               description: |-
                                 DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                 Defaults to 30 seconds.
+                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                               type: string
                             lookupFamily:
                               description: |-
@@ -21887,14 +21891,13 @@ spec:
                                   description: |-
                                     InitialJitter defines the maximum time Envoy will wait before the first health check.
                                     Envoy will randomly select a value between 0 and the initial jitter value.
-                                  format: duration
                                   pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 interval:
                                   default: 3s
                                   description: Interval defines the time between active
                                     health checks.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 tcp:
                                   description: |-
@@ -21973,7 +21976,7 @@ spec:
                                   default: 1s
                                   description: Timeout defines the time to wait for
                                     a health check response.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 type:
                                   allOf:
@@ -22026,7 +22029,7 @@ spec:
                                   description: BaseEjectionTime defines the base duration
                                     for which a host will be ejected on consecutive
                                     failures.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 consecutive5XxErrors:
                                   default: 5
@@ -22051,7 +22054,7 @@ spec:
                                   default: 3s
                                   description: Interval defines the time between passive
                                     health checks.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 maxEjectionPercent:
                                   default: 10
@@ -22141,6 +22144,7 @@ spec:
                                       description: |-
                                         TTL of the generated cookie if the cookie is not present. This value sets the
                                         Max-Age attribute value.
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                   required:
                                   - name
@@ -22227,6 +22231,7 @@ spec:
                                     During slow start window, traffic sent to the newly added hosts will gradually increase.
                                     Currently only supports linear growth of traffic. For additional details,
                                     see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                               required:
                               - window
@@ -22339,18 +22344,18 @@ spec:
                                     baseInterval:
                                       description: BaseInterval is the base interval
                                         between retries.
-                                      format: duration
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                     maxInterval:
                                       description: |-
                                         MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                         The default is 10 times the base_interval
-                                      format: duration
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                   type: object
                                 timeout:
                                   description: Timeout is the timeout per retry attempt.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                               type: object
                             retryOn:
@@ -34440,11 +34445,13 @@ spec:
                     description: |-
                       DrainTimeout defines the graceful drain timeout. This should be less than the pod's terminationGracePeriodSeconds.
                       If unspecified, defaults to 60 seconds.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   minDrainDuration:
                     description: |-
                       MinDrainDuration defines the minimum drain duration allowing time for endpoint deprogramming to complete.
                       If unspecified, defaults to 10 seconds.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                 type: object
               telemetry:
@@ -34798,6 +34805,7 @@ spec:
                                                 description: |-
                                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                                   Defaults to 30 seconds.
+                                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                 type: string
                                               lookupFamily:
                                                 description: |-
@@ -34931,7 +34939,6 @@ spec:
                                                     description: |-
                                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                                    format: duration
                                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   interval:
@@ -34939,7 +34946,7 @@ spec:
                                                     description: Interval defines
                                                       the time between active health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   tcp:
                                                     description: |-
@@ -35028,7 +35035,7 @@ spec:
                                                     description: Timeout defines the
                                                       time to wait for a health check
                                                       response.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   type:
                                                     allOf:
@@ -35091,7 +35098,7 @@ spec:
                                                       defines the base duration for
                                                       which a host will be ejected
                                                       on consecutive failures.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   consecutive5XxErrors:
                                                     default: 5
@@ -35119,7 +35126,7 @@ spec:
                                                     description: Interval defines
                                                       the time between passive health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   maxEjectionPercent:
                                                     default: 10
@@ -35214,6 +35221,7 @@ spec:
                                                         description: |-
                                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                                           Max-Age attribute value.
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     required:
                                                     - name
@@ -35308,6 +35316,7 @@ spec:
                                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                                       Currently only supports linear growth of traffic. For additional details,
                                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 required:
                                                 - window
@@ -35429,19 +35438,19 @@ spec:
                                                         description: BaseInterval
                                                           is the base interval between
                                                           retries.
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                       maxInterval:
                                                         description: |-
                                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                           The default is 10 times the base_interval
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     type: object
                                                   timeout:
                                                     description: Timeout is the timeout
                                                       per retry attempt.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 type: object
                                               retryOn:
@@ -35909,6 +35918,7 @@ spec:
                                                 description: |-
                                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                                   Defaults to 30 seconds.
+                                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                 type: string
                                               lookupFamily:
                                                 description: |-
@@ -36042,7 +36052,6 @@ spec:
                                                     description: |-
                                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                                    format: duration
                                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   interval:
@@ -36050,7 +36059,7 @@ spec:
                                                     description: Interval defines
                                                       the time between active health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   tcp:
                                                     description: |-
@@ -36139,7 +36148,7 @@ spec:
                                                     description: Timeout defines the
                                                       time to wait for a health check
                                                       response.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   type:
                                                     allOf:
@@ -36202,7 +36211,7 @@ spec:
                                                       defines the base duration for
                                                       which a host will be ejected
                                                       on consecutive failures.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   consecutive5XxErrors:
                                                     default: 5
@@ -36230,7 +36239,7 @@ spec:
                                                     description: Interval defines
                                                       the time between passive health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   maxEjectionPercent:
                                                     default: 10
@@ -36325,6 +36334,7 @@ spec:
                                                         description: |-
                                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                                           Max-Age attribute value.
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     required:
                                                     - name
@@ -36419,6 +36429,7 @@ spec:
                                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                                       Currently only supports linear growth of traffic. For additional details,
                                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 required:
                                                 - window
@@ -36540,19 +36551,19 @@ spec:
                                                         description: BaseInterval
                                                           is the base interval between
                                                           retries.
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                       maxInterval:
                                                         description: |-
                                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                           The default is 10 times the base_interval
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     type: object
                                                   timeout:
                                                     description: Timeout is the timeout
                                                       per retry attempt.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 type: object
                                               retryOn:
@@ -37128,6 +37139,7 @@ spec:
                                           description: |-
                                             DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                             Defaults to 30 seconds.
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         lookupFamily:
                                           description: |-
@@ -37256,14 +37268,13 @@ spec:
                                               description: |-
                                                 InitialJitter defines the maximum time Envoy will wait before the first health check.
                                                 Envoy will randomly select a value between 0 and the initial jitter value.
-                                              format: duration
                                               pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             interval:
                                               default: 3s
                                               description: Interval defines the time
                                                 between active health checks.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             tcp:
                                               description: |-
@@ -37347,7 +37358,7 @@ spec:
                                               default: 1s
                                               description: Timeout defines the time
                                                 to wait for a health check response.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             type:
                                               allOf:
@@ -37405,7 +37416,7 @@ spec:
                                               description: BaseEjectionTime defines
                                                 the base duration for which a host
                                                 will be ejected on consecutive failures.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             consecutive5XxErrors:
                                               default: 5
@@ -37432,7 +37443,7 @@ spec:
                                               default: 3s
                                               description: Interval defines the time
                                                 between passive health checks.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             maxEjectionPercent:
                                               default: 10
@@ -37524,6 +37535,7 @@ spec:
                                                   description: |-
                                                     TTL of the generated cookie if the cookie is not present. This value sets the
                                                     Max-Age attribute value.
+                                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                   type: string
                                               required:
                                               - name
@@ -37614,6 +37626,7 @@ spec:
                                                 During slow start window, traffic sent to the newly added hosts will gradually increase.
                                                 Currently only supports linear growth of traffic. For additional details,
                                                 see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           required:
                                           - window
@@ -37730,19 +37743,19 @@ spec:
                                                 baseInterval:
                                                   description: BaseInterval is the
                                                     base interval between retries.
-                                                  format: duration
+                                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                   type: string
                                                 maxInterval:
                                                   description: |-
                                                     MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                     The default is 10 times the base_interval
-                                                  format: duration
+                                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                   type: string
                                               type: object
                                             timeout:
                                               description: Timeout is the timeout
                                                 per retry attempt.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           type: object
                                         retryOn:
@@ -38244,6 +38257,7 @@ spec:
                                     description: |-
                                       DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                       Defaults to 30 seconds.
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   lookupFamily:
                                     description: |-
@@ -38371,14 +38385,13 @@ spec:
                                         description: |-
                                           InitialJitter defines the maximum time Envoy will wait before the first health check.
                                           Envoy will randomly select a value between 0 and the initial jitter value.
-                                        format: duration
                                         pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       interval:
                                         default: 3s
                                         description: Interval defines the time between
                                           active health checks.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       tcp:
                                         description: |-
@@ -38462,7 +38475,7 @@ spec:
                                         default: 1s
                                         description: Timeout defines the time to wait
                                           for a health check response.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       type:
                                         allOf:
@@ -38519,7 +38532,7 @@ spec:
                                         description: BaseEjectionTime defines the
                                           base duration for which a host will be ejected
                                           on consecutive failures.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       consecutive5XxErrors:
                                         default: 5
@@ -38546,7 +38559,7 @@ spec:
                                         default: 3s
                                         description: Interval defines the time between
                                           passive health checks.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxEjectionPercent:
                                         default: 10
@@ -38638,6 +38651,7 @@ spec:
                                             description: |-
                                               TTL of the generated cookie if the cookie is not present. This value sets the
                                               Max-Age attribute value.
+                                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                             type: string
                                         required:
                                         - name
@@ -38727,6 +38741,7 @@ spec:
                                           During slow start window, traffic sent to the newly added hosts will gradually increase.
                                           Currently only supports linear growth of traffic. For additional details,
                                           see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - window
@@ -38841,19 +38856,19 @@ spec:
                                           baseInterval:
                                             description: BaseInterval is the base
                                               interval between retries.
-                                            format: duration
+                                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                             type: string
                                           maxInterval:
                                             description: |-
                                               MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                               The default is 10 times the base_interval
-                                            format: duration
+                                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                             type: string
                                         type: object
                                       timeout:
                                         description: Timeout is the timeout per retry
                                           attempt.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   retryOn:
@@ -39898,6 +39913,7 @@ spec:
                     description: |-
                       MaxAge defines how long the results of a preflight request can be cached.
                       It specifies the value in the Access-Control-Max-Age CORS response header..
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                 type: object
               extAuth:
@@ -40204,6 +40220,7 @@ spec:
                                 description: |-
                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                   Defaults to 30 seconds.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                 type: string
                               lookupFamily:
                                 description: |-
@@ -40327,14 +40344,13 @@ spec:
                                     description: |-
                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                    format: duration
                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
                                       active health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   tcp:
                                     description: |-
@@ -40413,7 +40429,7 @@ spec:
                                     default: 1s
                                     description: Timeout defines the time to wait
                                       for a health check response.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   type:
                                     allOf:
@@ -40468,7 +40484,7 @@ spec:
                                     description: BaseEjectionTime defines the base
                                       duration for which a host will be ejected on
                                       consecutive failures.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   consecutive5XxErrors:
                                     default: 5
@@ -40494,7 +40510,7 @@ spec:
                                     default: 3s
                                     description: Interval defines the time between
                                       passive health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   maxEjectionPercent:
                                     default: 10
@@ -40586,6 +40602,7 @@ spec:
                                         description: |-
                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                           Max-Age attribute value.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - name
@@ -40673,6 +40690,7 @@ spec:
                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                       Currently only supports linear growth of traffic. For additional details,
                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 required:
                                 - window
@@ -40787,19 +40805,19 @@ spec:
                                       baseInterval:
                                         description: BaseInterval is the base interval
                                           between retries.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxInterval:
                                         description: |-
                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                           The default is 10 times the base_interval
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   timeout:
                                     description: Timeout is the timeout per retry
                                       attempt.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 type: object
                               retryOn:
@@ -41211,6 +41229,7 @@ spec:
                                 description: |-
                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                   Defaults to 30 seconds.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                 type: string
                               lookupFamily:
                                 description: |-
@@ -41334,14 +41353,13 @@ spec:
                                     description: |-
                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                    format: duration
                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
                                       active health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   tcp:
                                     description: |-
@@ -41420,7 +41438,7 @@ spec:
                                     default: 1s
                                     description: Timeout defines the time to wait
                                       for a health check response.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   type:
                                     allOf:
@@ -41475,7 +41493,7 @@ spec:
                                     description: BaseEjectionTime defines the base
                                       duration for which a host will be ejected on
                                       consecutive failures.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   consecutive5XxErrors:
                                     default: 5
@@ -41501,7 +41519,7 @@ spec:
                                     default: 3s
                                     description: Interval defines the time between
                                       passive health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   maxEjectionPercent:
                                     default: 10
@@ -41593,6 +41611,7 @@ spec:
                                         description: |-
                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                           Max-Age attribute value.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - name
@@ -41680,6 +41699,7 @@ spec:
                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                       Currently only supports linear growth of traffic. For additional details,
                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 required:
                                 - window
@@ -41794,19 +41814,19 @@ spec:
                                       baseInterval:
                                         description: BaseInterval is the base interval
                                           between retries.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxInterval:
                                         description: |-
                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                           The default is 10 times the base_interval
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   timeout:
                                     description: Timeout is the timeout per retry
                                       attempt.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 type: object
                               retryOn:
@@ -42410,6 +42430,7 @@ spec:
                                       description: |-
                                         DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                         Defaults to 30 seconds.
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                     lookupFamily:
                                       description: |-
@@ -42537,14 +42558,13 @@ spec:
                                           description: |-
                                             InitialJitter defines the maximum time Envoy will wait before the first health check.
                                             Envoy will randomly select a value between 0 and the initial jitter value.
-                                          format: duration
                                           pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         interval:
                                           default: 3s
                                           description: Interval defines the time between
                                             active health checks.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         tcp:
                                           description: |-
@@ -42628,7 +42648,7 @@ spec:
                                           default: 1s
                                           description: Timeout defines the time to
                                             wait for a health check response.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         type:
                                           allOf:
@@ -42686,7 +42706,7 @@ spec:
                                           description: BaseEjectionTime defines the
                                             base duration for which a host will be
                                             ejected on consecutive failures.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         consecutive5XxErrors:
                                           default: 5
@@ -42713,7 +42733,7 @@ spec:
                                           default: 3s
                                           description: Interval defines the time between
                                             passive health checks.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         maxEjectionPercent:
                                           default: 10
@@ -42805,6 +42825,7 @@ spec:
                                               description: |-
                                                 TTL of the generated cookie if the cookie is not present. This value sets the
                                                 Max-Age attribute value.
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           required:
                                           - name
@@ -42894,6 +42915,7 @@ spec:
                                             During slow start window, traffic sent to the newly added hosts will gradually increase.
                                             Currently only supports linear growth of traffic. For additional details,
                                             see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                       required:
                                       - window
@@ -43009,19 +43031,19 @@ spec:
                                             baseInterval:
                                               description: BaseInterval is the base
                                                 interval between retries.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             maxInterval:
                                               description: |-
                                                 MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                 The default is 10 times the base_interval
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           type: object
                                         timeout:
                                           description: Timeout is the timeout per
                                             retry attempt.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                       type: object
                                     retryOn:
@@ -43320,6 +43342,7 @@ spec:
 
                       If not specified, defaults to 604800s (one week).
                       Note: this field is only applicable when the "refreshToken" field is set to true.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   defaultTokenTTL:
                     description: |-
@@ -43331,6 +43354,7 @@ spec:
                       If not specified, defaults to 0. In this case, the "expires_in" field in
                       the authorization response must be set by the authorization server, or the
                       OAuth flow will fail.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   denyRedirect:
                     description: |-
@@ -43673,6 +43697,7 @@ spec:
                                 description: |-
                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                   Defaults to 30 seconds.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                 type: string
                               lookupFamily:
                                 description: |-
@@ -43796,14 +43821,13 @@ spec:
                                     description: |-
                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                    format: duration
                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
                                       active health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   tcp:
                                     description: |-
@@ -43882,7 +43906,7 @@ spec:
                                     default: 1s
                                     description: Timeout defines the time to wait
                                       for a health check response.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   type:
                                     allOf:
@@ -43937,7 +43961,7 @@ spec:
                                     description: BaseEjectionTime defines the base
                                       duration for which a host will be ejected on
                                       consecutive failures.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   consecutive5XxErrors:
                                     default: 5
@@ -43963,7 +43987,7 @@ spec:
                                     default: 3s
                                     description: Interval defines the time between
                                       passive health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   maxEjectionPercent:
                                     default: 10
@@ -44055,6 +44079,7 @@ spec:
                                         description: |-
                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                           Max-Age attribute value.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - name
@@ -44142,6 +44167,7 @@ spec:
                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                       Currently only supports linear growth of traffic. For additional details,
                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 required:
                                 - window
@@ -44256,19 +44282,19 @@ spec:
                                       baseInterval:
                                         description: BaseInterval is the base interval
                                           between retries.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxInterval:
                                         description: |-
                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                           The default is 10 times the base_interval
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   timeout:
                                     description: Timeout is the timeout per retry
                                       attempt.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 type: object
                               retryOn:
diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
index 5e41e689d..ed85e8407 100644
--- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
+++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
@@ -508,6 +508,7 @@ spec:
                     description: |-
                       DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                       Defaults to 30 seconds.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   lookupFamily:
                     description: |-
@@ -566,6 +567,7 @@ spec:
                     properties:
                       fixedDelay:
                         description: FixedDelay specifies the fixed delay duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       percentage:
                         default: 100
@@ -680,14 +682,13 @@ spec:
                         description: |-
                           InitialJitter defines the maximum time Envoy will wait before the first health check.
                           Envoy will randomly select a value between 0 and the initial jitter value.
-                        format: duration
                         pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       interval:
                         default: 3s
                         description: Interval defines the time between active health
                           checks.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       tcp:
                         description: |-
@@ -761,7 +762,7 @@ spec:
                         default: 1s
                         description: Timeout defines the time to wait for a health
                           check response.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       type:
                         allOf:
@@ -812,7 +813,7 @@ spec:
                         default: 30s
                         description: BaseEjectionTime defines the base duration for
                           which a host will be ejected on consecutive failures.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       consecutive5XxErrors:
                         default: 5
@@ -837,7 +838,7 @@ spec:
                         default: 3s
                         description: Interval defines the time between passive health
                           checks.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                       maxEjectionPercent:
                         default: 10
@@ -956,6 +957,7 @@ spec:
                             description: |-
                               TTL of the generated cookie if the cookie is not present. This value sets the
                               Max-Age attribute value.
+                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                             type: string
                         required:
                         - name
@@ -1039,6 +1041,7 @@ spec:
                           During slow start window, traffic sent to the newly added hosts will gradually increase.
                           Currently only supports linear growth of traffic. For additional details,
                           see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                     required:
                     - window
@@ -1974,18 +1977,18 @@ spec:
                           baseInterval:
                             description: BaseInterval is the base interval between
                               retries.
-                            format: duration
+                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                             type: string
                           maxInterval:
                             description: |-
                               MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                               The default is 10 times the base_interval
-                            format: duration
+                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                             type: string
                         type: object
                       timeout:
                         description: Timeout is the timeout per retry attempt.
-                        format: duration
+                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                         type: string
                     type: object
                   retryOn:
@@ -4452,6 +4455,7 @@ spec:
                               description: |-
                                 DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                 Defaults to 30 seconds.
+                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                               type: string
                             lookupFamily:
                               description: |-
@@ -4575,14 +4579,13 @@ spec:
                                   description: |-
                                     InitialJitter defines the maximum time Envoy will wait before the first health check.
                                     Envoy will randomly select a value between 0 and the initial jitter value.
-                                  format: duration
                                   pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 interval:
                                   default: 3s
                                   description: Interval defines the time between active
                                     health checks.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 tcp:
                                   description: |-
@@ -4661,7 +4664,7 @@ spec:
                                   default: 1s
                                   description: Timeout defines the time to wait for
                                     a health check response.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 type:
                                   allOf:
@@ -4714,7 +4717,7 @@ spec:
                                   description: BaseEjectionTime defines the base duration
                                     for which a host will be ejected on consecutive
                                     failures.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 consecutive5XxErrors:
                                   default: 5
@@ -4739,7 +4742,7 @@ spec:
                                   default: 3s
                                   description: Interval defines the time between passive
                                     health checks.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                                 maxEjectionPercent:
                                   default: 10
@@ -4829,6 +4832,7 @@ spec:
                                       description: |-
                                         TTL of the generated cookie if the cookie is not present. This value sets the
                                         Max-Age attribute value.
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                   required:
                                   - name
@@ -4915,6 +4919,7 @@ spec:
                                     During slow start window, traffic sent to the newly added hosts will gradually increase.
                                     Currently only supports linear growth of traffic. For additional details,
                                     see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                               required:
                               - window
@@ -5027,18 +5032,18 @@ spec:
                                     baseInterval:
                                       description: BaseInterval is the base interval
                                         between retries.
-                                      format: duration
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                     maxInterval:
                                       description: |-
                                         MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                         The default is 10 times the base_interval
-                                      format: duration
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                   type: object
                                 timeout:
                                   description: Timeout is the timeout per retry attempt.
-                                  format: duration
+                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                   type: string
                               type: object
                             retryOn:
@@ -17128,11 +17133,13 @@ spec:
                     description: |-
                       DrainTimeout defines the graceful drain timeout. This should be less than the pod's terminationGracePeriodSeconds.
                       If unspecified, defaults to 60 seconds.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   minDrainDuration:
                     description: |-
                       MinDrainDuration defines the minimum drain duration allowing time for endpoint deprogramming to complete.
                       If unspecified, defaults to 10 seconds.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                 type: object
               telemetry:
@@ -17486,6 +17493,7 @@ spec:
                                                 description: |-
                                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                                   Defaults to 30 seconds.
+                                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                 type: string
                                               lookupFamily:
                                                 description: |-
@@ -17619,7 +17627,6 @@ spec:
                                                     description: |-
                                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                                    format: duration
                                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   interval:
@@ -17627,7 +17634,7 @@ spec:
                                                     description: Interval defines
                                                       the time between active health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   tcp:
                                                     description: |-
@@ -17716,7 +17723,7 @@ spec:
                                                     description: Timeout defines the
                                                       time to wait for a health check
                                                       response.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   type:
                                                     allOf:
@@ -17779,7 +17786,7 @@ spec:
                                                       defines the base duration for
                                                       which a host will be ejected
                                                       on consecutive failures.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   consecutive5XxErrors:
                                                     default: 5
@@ -17807,7 +17814,7 @@ spec:
                                                     description: Interval defines
                                                       the time between passive health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   maxEjectionPercent:
                                                     default: 10
@@ -17902,6 +17909,7 @@ spec:
                                                         description: |-
                                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                                           Max-Age attribute value.
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     required:
                                                     - name
@@ -17996,6 +18004,7 @@ spec:
                                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                                       Currently only supports linear growth of traffic. For additional details,
                                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 required:
                                                 - window
@@ -18117,19 +18126,19 @@ spec:
                                                         description: BaseInterval
                                                           is the base interval between
                                                           retries.
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                       maxInterval:
                                                         description: |-
                                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                           The default is 10 times the base_interval
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     type: object
                                                   timeout:
                                                     description: Timeout is the timeout
                                                       per retry attempt.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 type: object
                                               retryOn:
@@ -18597,6 +18606,7 @@ spec:
                                                 description: |-
                                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                                   Defaults to 30 seconds.
+                                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                 type: string
                                               lookupFamily:
                                                 description: |-
@@ -18730,7 +18740,6 @@ spec:
                                                     description: |-
                                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                                    format: duration
                                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   interval:
@@ -18738,7 +18747,7 @@ spec:
                                                     description: Interval defines
                                                       the time between active health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   tcp:
                                                     description: |-
@@ -18827,7 +18836,7 @@ spec:
                                                     description: Timeout defines the
                                                       time to wait for a health check
                                                       response.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   type:
                                                     allOf:
@@ -18890,7 +18899,7 @@ spec:
                                                       defines the base duration for
                                                       which a host will be ejected
                                                       on consecutive failures.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   consecutive5XxErrors:
                                                     default: 5
@@ -18918,7 +18927,7 @@ spec:
                                                     description: Interval defines
                                                       the time between passive health
                                                       checks.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                   maxEjectionPercent:
                                                     default: 10
@@ -19013,6 +19022,7 @@ spec:
                                                         description: |-
                                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                                           Max-Age attribute value.
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     required:
                                                     - name
@@ -19107,6 +19117,7 @@ spec:
                                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                                       Currently only supports linear growth of traffic. For additional details,
                                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 required:
                                                 - window
@@ -19228,19 +19239,19 @@ spec:
                                                         description: BaseInterval
                                                           is the base interval between
                                                           retries.
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                       maxInterval:
                                                         description: |-
                                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                           The default is 10 times the base_interval
-                                                        format: duration
+                                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                         type: string
                                                     type: object
                                                   timeout:
                                                     description: Timeout is the timeout
                                                       per retry attempt.
-                                                    format: duration
+                                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                     type: string
                                                 type: object
                                               retryOn:
@@ -19816,6 +19827,7 @@ spec:
                                           description: |-
                                             DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                             Defaults to 30 seconds.
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         lookupFamily:
                                           description: |-
@@ -19944,14 +19956,13 @@ spec:
                                               description: |-
                                                 InitialJitter defines the maximum time Envoy will wait before the first health check.
                                                 Envoy will randomly select a value between 0 and the initial jitter value.
-                                              format: duration
                                               pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             interval:
                                               default: 3s
                                               description: Interval defines the time
                                                 between active health checks.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             tcp:
                                               description: |-
@@ -20035,7 +20046,7 @@ spec:
                                               default: 1s
                                               description: Timeout defines the time
                                                 to wait for a health check response.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             type:
                                               allOf:
@@ -20093,7 +20104,7 @@ spec:
                                               description: BaseEjectionTime defines
                                                 the base duration for which a host
                                                 will be ejected on consecutive failures.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             consecutive5XxErrors:
                                               default: 5
@@ -20120,7 +20131,7 @@ spec:
                                               default: 3s
                                               description: Interval defines the time
                                                 between passive health checks.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             maxEjectionPercent:
                                               default: 10
@@ -20212,6 +20223,7 @@ spec:
                                                   description: |-
                                                     TTL of the generated cookie if the cookie is not present. This value sets the
                                                     Max-Age attribute value.
+                                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                   type: string
                                               required:
                                               - name
@@ -20302,6 +20314,7 @@ spec:
                                                 During slow start window, traffic sent to the newly added hosts will gradually increase.
                                                 Currently only supports linear growth of traffic. For additional details,
                                                 see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           required:
                                           - window
@@ -20418,19 +20431,19 @@ spec:
                                                 baseInterval:
                                                   description: BaseInterval is the
                                                     base interval between retries.
-                                                  format: duration
+                                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                   type: string
                                                 maxInterval:
                                                   description: |-
                                                     MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                     The default is 10 times the base_interval
-                                                  format: duration
+                                                  pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                                   type: string
                                               type: object
                                             timeout:
                                               description: Timeout is the timeout
                                                 per retry attempt.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           type: object
                                         retryOn:
@@ -20932,6 +20945,7 @@ spec:
                                     description: |-
                                       DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                       Defaults to 30 seconds.
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   lookupFamily:
                                     description: |-
@@ -21059,14 +21073,13 @@ spec:
                                         description: |-
                                           InitialJitter defines the maximum time Envoy will wait before the first health check.
                                           Envoy will randomly select a value between 0 and the initial jitter value.
-                                        format: duration
                                         pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       interval:
                                         default: 3s
                                         description: Interval defines the time between
                                           active health checks.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       tcp:
                                         description: |-
@@ -21150,7 +21163,7 @@ spec:
                                         default: 1s
                                         description: Timeout defines the time to wait
                                           for a health check response.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       type:
                                         allOf:
@@ -21207,7 +21220,7 @@ spec:
                                         description: BaseEjectionTime defines the
                                           base duration for which a host will be ejected
                                           on consecutive failures.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       consecutive5XxErrors:
                                         default: 5
@@ -21234,7 +21247,7 @@ spec:
                                         default: 3s
                                         description: Interval defines the time between
                                           passive health checks.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxEjectionPercent:
                                         default: 10
@@ -21326,6 +21339,7 @@ spec:
                                             description: |-
                                               TTL of the generated cookie if the cookie is not present. This value sets the
                                               Max-Age attribute value.
+                                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                             type: string
                                         required:
                                         - name
@@ -21415,6 +21429,7 @@ spec:
                                           During slow start window, traffic sent to the newly added hosts will gradually increase.
                                           Currently only supports linear growth of traffic. For additional details,
                                           see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - window
@@ -21529,19 +21544,19 @@ spec:
                                           baseInterval:
                                             description: BaseInterval is the base
                                               interval between retries.
-                                            format: duration
+                                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                             type: string
                                           maxInterval:
                                             description: |-
                                               MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                               The default is 10 times the base_interval
-                                            format: duration
+                                            pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                             type: string
                                         type: object
                                       timeout:
                                         description: Timeout is the timeout per retry
                                           attempt.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   retryOn:
@@ -22586,6 +22601,7 @@ spec:
                     description: |-
                       MaxAge defines how long the results of a preflight request can be cached.
                       It specifies the value in the Access-Control-Max-Age CORS response header..
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                 type: object
               extAuth:
@@ -22892,6 +22908,7 @@ spec:
                                 description: |-
                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                   Defaults to 30 seconds.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                 type: string
                               lookupFamily:
                                 description: |-
@@ -23015,14 +23032,13 @@ spec:
                                     description: |-
                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                    format: duration
                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
                                       active health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   tcp:
                                     description: |-
@@ -23101,7 +23117,7 @@ spec:
                                     default: 1s
                                     description: Timeout defines the time to wait
                                       for a health check response.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   type:
                                     allOf:
@@ -23156,7 +23172,7 @@ spec:
                                     description: BaseEjectionTime defines the base
                                       duration for which a host will be ejected on
                                       consecutive failures.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   consecutive5XxErrors:
                                     default: 5
@@ -23182,7 +23198,7 @@ spec:
                                     default: 3s
                                     description: Interval defines the time between
                                       passive health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   maxEjectionPercent:
                                     default: 10
@@ -23274,6 +23290,7 @@ spec:
                                         description: |-
                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                           Max-Age attribute value.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - name
@@ -23361,6 +23378,7 @@ spec:
                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                       Currently only supports linear growth of traffic. For additional details,
                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 required:
                                 - window
@@ -23475,19 +23493,19 @@ spec:
                                       baseInterval:
                                         description: BaseInterval is the base interval
                                           between retries.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxInterval:
                                         description: |-
                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                           The default is 10 times the base_interval
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   timeout:
                                     description: Timeout is the timeout per retry
                                       attempt.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 type: object
                               retryOn:
@@ -23899,6 +23917,7 @@ spec:
                                 description: |-
                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                   Defaults to 30 seconds.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                 type: string
                               lookupFamily:
                                 description: |-
@@ -24022,14 +24041,13 @@ spec:
                                     description: |-
                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                    format: duration
                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
                                       active health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   tcp:
                                     description: |-
@@ -24108,7 +24126,7 @@ spec:
                                     default: 1s
                                     description: Timeout defines the time to wait
                                       for a health check response.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   type:
                                     allOf:
@@ -24163,7 +24181,7 @@ spec:
                                     description: BaseEjectionTime defines the base
                                       duration for which a host will be ejected on
                                       consecutive failures.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   consecutive5XxErrors:
                                     default: 5
@@ -24189,7 +24207,7 @@ spec:
                                     default: 3s
                                     description: Interval defines the time between
                                       passive health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   maxEjectionPercent:
                                     default: 10
@@ -24281,6 +24299,7 @@ spec:
                                         description: |-
                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                           Max-Age attribute value.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - name
@@ -24368,6 +24387,7 @@ spec:
                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                       Currently only supports linear growth of traffic. For additional details,
                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 required:
                                 - window
@@ -24482,19 +24502,19 @@ spec:
                                       baseInterval:
                                         description: BaseInterval is the base interval
                                           between retries.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxInterval:
                                         description: |-
                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                           The default is 10 times the base_interval
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   timeout:
                                     description: Timeout is the timeout per retry
                                       attempt.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 type: object
                               retryOn:
@@ -25098,6 +25118,7 @@ spec:
                                       description: |-
                                         DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                         Defaults to 30 seconds.
+                                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                       type: string
                                     lookupFamily:
                                       description: |-
@@ -25225,14 +25246,13 @@ spec:
                                           description: |-
                                             InitialJitter defines the maximum time Envoy will wait before the first health check.
                                             Envoy will randomly select a value between 0 and the initial jitter value.
-                                          format: duration
                                           pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         interval:
                                           default: 3s
                                           description: Interval defines the time between
                                             active health checks.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         tcp:
                                           description: |-
@@ -25316,7 +25336,7 @@ spec:
                                           default: 1s
                                           description: Timeout defines the time to
                                             wait for a health check response.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         type:
                                           allOf:
@@ -25374,7 +25394,7 @@ spec:
                                           description: BaseEjectionTime defines the
                                             base duration for which a host will be
                                             ejected on consecutive failures.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         consecutive5XxErrors:
                                           default: 5
@@ -25401,7 +25421,7 @@ spec:
                                           default: 3s
                                           description: Interval defines the time between
                                             passive health checks.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                         maxEjectionPercent:
                                           default: 10
@@ -25493,6 +25513,7 @@ spec:
                                               description: |-
                                                 TTL of the generated cookie if the cookie is not present. This value sets the
                                                 Max-Age attribute value.
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           required:
                                           - name
@@ -25582,6 +25603,7 @@ spec:
                                             During slow start window, traffic sent to the newly added hosts will gradually increase.
                                             Currently only supports linear growth of traffic. For additional details,
                                             see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                       required:
                                       - window
@@ -25697,19 +25719,19 @@ spec:
                                             baseInterval:
                                               description: BaseInterval is the base
                                                 interval between retries.
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                             maxInterval:
                                               description: |-
                                                 MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                                 The default is 10 times the base_interval
-                                              format: duration
+                                              pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                               type: string
                                           type: object
                                         timeout:
                                           description: Timeout is the timeout per
                                             retry attempt.
-                                          format: duration
+                                          pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                           type: string
                                       type: object
                                     retryOn:
@@ -26008,6 +26030,7 @@ spec:
 
                       If not specified, defaults to 604800s (one week).
                       Note: this field is only applicable when the "refreshToken" field is set to true.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   defaultTokenTTL:
                     description: |-
@@ -26019,6 +26042,7 @@ spec:
                       If not specified, defaults to 0. In this case, the "expires_in" field in
                       the authorization response must be set by the authorization server, or the
                       OAuth flow will fail.
+                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                   denyRedirect:
                     description: |-
@@ -26361,6 +26385,7 @@ spec:
                                 description: |-
                                   DNSRefreshRate specifies the rate at which DNS records should be refreshed.
                                   Defaults to 30 seconds.
+                                pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                 type: string
                               lookupFamily:
                                 description: |-
@@ -26484,14 +26509,13 @@ spec:
                                     description: |-
                                       InitialJitter defines the maximum time Envoy will wait before the first health check.
                                       Envoy will randomly select a value between 0 and the initial jitter value.
-                                    format: duration
                                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   interval:
                                     default: 3s
                                     description: Interval defines the time between
                                       active health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   tcp:
                                     description: |-
@@ -26570,7 +26594,7 @@ spec:
                                     default: 1s
                                     description: Timeout defines the time to wait
                                       for a health check response.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   type:
                                     allOf:
@@ -26625,7 +26649,7 @@ spec:
                                     description: BaseEjectionTime defines the base
                                       duration for which a host will be ejected on
                                       consecutive failures.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   consecutive5XxErrors:
                                     default: 5
@@ -26651,7 +26675,7 @@ spec:
                                     default: 3s
                                     description: Interval defines the time between
                                       passive health checks.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                   maxEjectionPercent:
                                     default: 10
@@ -26743,6 +26767,7 @@ spec:
                                         description: |-
                                           TTL of the generated cookie if the cookie is not present. This value sets the
                                           Max-Age attribute value.
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     required:
                                     - name
@@ -26830,6 +26855,7 @@ spec:
                                       During slow start window, traffic sent to the newly added hosts will gradually increase.
                                       Currently only supports linear growth of traffic. For additional details,
                                       see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-slowstartconfig
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 required:
                                 - window
@@ -26944,19 +26970,19 @@ spec:
                                       baseInterval:
                                         description: BaseInterval is the base interval
                                           between retries.
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                       maxInterval:
                                         description: |-
                                           MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
                                           The default is 10 times the base_interval
-                                        format: duration
+                                        pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                         type: string
                                     type: object
                                   timeout:
                                     description: Timeout is the timeout per retry
                                       attempt.
-                                    format: duration
+                                    pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                                     type: string
                                 type: object
                               retryOn: